{ "catalog": { "uuid": "6c1c5194-ba1a-55fd-8f1f-ad8d6ed4231e", "title": "Nuclear Cybersecurity Common Control Framework (nuclear-ccf) — 2026.1 Edition", "description": "The industry's first unified Common Control Catalog for Nuclear & Energy Cybersecurity (nuclear-ccf). Harmonizes U.S. NRC Regulatory Guide 5.71 (Rev. 1 & Rev. 0), 10 CFR 73.54/73.77/73.58/Part 53, NEI 08-09 Rev. 6 & NEI 13-10, NERC CIP (2026 Portfolio: CIP-002-5.1a through CIP-015-1 including CIP-003-9 & CIP-012-2), NIST SP 800-82 Rev. 3 (OT Overlays), NIST SP 800-53 Rev. 5, DOE Order 205.1D, DOE C2M2 v2.1, Safeguarding of NNPI, IAEA NSS 17-T (Rev. 1) & NSS 42-G, IEC 62645, IEC 63096, ISA/IEC 62443, IEEE Std 7-4.3.2, Canada CNSC REGDOC-2.12.1, UK ONR SyAPs / CAF v4.0, and MITRE ATT&CK v16.1.", "datePublished": "2026-10-20T00:00:00", "lastRevisionDate": "2026-10-20T00:00:00", "url": "https://regscale.com/", "category": "Nuclear & Energy Critical Infrastructure Cybersecurity", "externalId": "NUCLEAR-CCF-2026.1", "originator": "RegScale Nuclear & Energy Practice", "regulationDatePublished": null, "regulationDateModified": null, "requireUniqueControlId": true, "abstract": "Provides a 'test-once, comply-many' common control catalog for Electric Utilities, Commercial Nuclear Power Plants, Small Modular Reactors (SMRs) / Advanced Reactors, DOE/NNSA National Laboratories, Nuclear Fuel Cycle Facilities, and Energy Supply Chain Vendors.", "keywords": "Nuclear Cybersecurity; nuclear-ccf; NRC RG 5.71 Rev 1; 10 CFR 73.54; 10 CFR Part 53; NEI 08-09; NEI 13-10; NERC CIP-015-1; CIP-003-9; CIP-012-2; IAEA NSS 17-T; IEC 62645; IEC 63096; IEC 62443; IEEE 7-4.3.2; NIST 800-82 R3; DOE O 205.1D; NNPI; SMR;", "isPublic": true, "sourceOscalURL": "", "master": false, "defaultName": "nuclear-ccf", "downloadURL": "https://regscaleblob.blob.core.windows.net/catalogs/nuclear-ccf.json", "securityControls": [ { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69040, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589692", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589692", "securityControlId": 30715, "ccis": [], "uuid": "e153cac4-3c50-5014-8135-a05b42c8b6bf", "testId": "GOV-01_A01", "test": "an organization-wide cybersecurity / data privacy governance program is developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-01a.[01]", "defaultText": null }, { "id": 69041, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589756", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589756", "securityControlId": 30715, "ccis": [], "uuid": "70848e96-6793-5a7e-b7e9-ef39db274835", "testId": "GOV-01_A02", "test": "the cybersecurity / data privacy governance program addresses management commitment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-01a.02[03]", "defaultText": null }, { "id": 69042, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589756", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589757", "securityControlId": 30715, "ccis": [], "uuid": "902374b4-ada4-517c-b1db-699b9b18fa60", "testId": "GOV-01_A03", "test": "the cybersecurity / data privacy governance program addresses statutory, regulatory and/or contractual compliance obligations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-01a.02[05]", "defaultText": null }, { "id": 69043, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589757", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589757", "securityControlId": 30715, "ccis": [], "uuid": "ae217e36-a092-57c1-9396-f1676aa96a8f", "testId": "GOV-01_A04", "test": "the cybersecurity / data privacy governance program is protected from unauthorized disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PM-01c.[01]", "defaultText": null }, { "id": 69044, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589757", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589757", "securityControlId": 30715, "ccis": [], "uuid": "d092406f-7107-5ac1-bd0e-db972ad08fc0", "testId": "GOV-01_A05", "test": "the cybersecurity / data privacy governance program is protected from unauthorized modification.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PM-01c.[02]", "defaultText": null }, { "id": 69045, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589757", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589757", "securityControlId": 30715, "ccis": [], "uuid": "81aadc53-ab37-5070-a2e8-0046a959a2b5", "testId": "GOV-01_A06", "test": "the cybersecurity / data privacy governance program is disseminated.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-01a.[02]", "defaultText": null }, { "id": 69046, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589757", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589757", "securityControlId": 30715, "ccis": [], "uuid": "c4cf8534-06b3-57f5-9a5b-d2646af01357", "testId": "GOV-01_A07", "test": "the cybersecurity / data privacy governance program provides an overview of the requirements for the security program.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-01a.01[01]", "defaultText": null }, { "id": 69047, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589758", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589758", "securityControlId": 30715, "ccis": [], "uuid": "4067d9d3-c68e-531a-b197-77cdeff42385", "testId": "GOV-01_A08", "test": "the cybersecurity / data privacy governance program provides a description of the security program management controls in place or planned for meeting those requirements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-01a.01[02]", "defaultText": null }, { "id": 69048, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589758", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589758", "securityControlId": 30715, "ccis": [], "uuid": "20c50073-fb9b-5c26-bc23-7d806b379fa4", "testId": "GOV-01_A09", "test": "the cybersecurity / data privacy governance program provides a description of the common controls in place or planned for meeting those requirements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-01a.01[03]", "defaultText": null }, { "id": 69049, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589758", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589758", "securityControlId": 30715, "ccis": [], "uuid": "fd617bfc-1b51-527e-a3a6-81a24237ca56", "testId": "GOV-01_A10", "test": "the cybersecurity / data privacy governance program includes the identification and assignment of roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-01a.02[01]", "defaultText": null }, { "id": 69050, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589758", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589758", "securityControlId": 30715, "ccis": [], "uuid": "f50ea675-c258-5ac6-9e8b-505c0acf16c6", "testId": "GOV-01_A11", "test": "the cybersecurity / data privacy governance program includes the identification and assignment of responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-01a.02[02]", "defaultText": null }, { "id": 69051, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589758", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589758", "securityControlId": 30715, "ccis": [], "uuid": "aefd7eb3-a6a5-5977-bc90-0ca65041cb5a", "testId": "GOV-01_A12", "test": "the cybersecurity / data privacy governance program addresses coordination among organizational entities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-01a.02[04]", "defaultText": null }, { "id": 69052, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589759", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589759", "securityControlId": 30715, "ccis": [], "uuid": "61849c35-5b9d-59f7-9aed-1fc85ef28375", "testId": "GOV-01_A13", "test": "the cybersecurity / data privacy governance program reflects the coordination among the organizational entities responsible for cybersecurity / data privacy.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-01a.03", "defaultText": null }, { "id": 69053, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589759", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589759", "securityControlId": 30715, "ccis": [], "uuid": "5a80df61-f01f-5619-8948-34380f0872de", "testId": "GOV-01_A14", "test": "the cybersecurity / data privacy governance program is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-01a.04", "defaultText": null }, { "id": 69054, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589759", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589759", "securityControlId": 30715, "ccis": [], "uuid": "8b959e8c-8afa-5afa-b1b6-bc066e868df1", "testId": "GOV-01_A15", "test": "the frequency at which to review / update the organization-wide cybersecurity / data privacy governance program is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-01_ODP[01]", "defaultText": null }, { "id": 69055, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589759", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589759", "securityControlId": 30715, "ccis": [], "uuid": "de22c39c-8805-51f9-94a3-de048f60ab9b", "testId": "GOV-01_A16", "test": "events that trigger the review / update of the organization-wide cybersecurity / data privacy governance program are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-01_ODP[02]", "defaultText": null }, { "id": 69056, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589759", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589759", "securityControlId": 30715, "ccis": [], "uuid": "a5dcc3a6-4b98-5174-8348-a0b7e6bf1762", "testId": "GOV-01_A17", "test": "the cybersecurity / data privacy governance program is reviewed / updated frequently.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-01b.[01]", "defaultText": null }, { "id": 69057, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589759", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589759", "securityControlId": 30715, "ccis": [], "uuid": "973af102-d26c-5a83-9bce-ce03cd360faa", "testId": "GOV-01_A18", "test": "the cybersecurity / data privacy governance program is reviewed / updated following events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-01b.[02]", "defaultText": null }, { "id": 69058, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58976", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58976", "securityControlId": 30715, "ccis": [], "uuid": "09a3e909-a0e0-558d-a3a2-40bbd039425b", "testId": "GOV-01_A19", "test": "cybersecurity & data protection governance operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69059, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58976", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58976", "securityControlId": 30715, "ccis": [], "uuid": "87343b1e-5204-558b-878a-8b3586434531", "testId": "GOV-01_A20", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support cybersecurity & data protection governance operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69060, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58976", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58976", "securityControlId": 30715, "ccis": [], "uuid": "55ba62a6-2ef3-59f3-8566-4dfedc82129a", "testId": "GOV-01_A21", "test": "responsibility and authority for the performance of cybersecurity & data protection governance-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69061, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589761", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589761", "securityControlId": 30715, "ccis": [], "uuid": "4ef8e667-8730-5611-95ee-1a9df6bfc621", "testId": "GOV-01_A22", "test": "personnel performing cybersecurity & data protection governance-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 545458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580974", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd6fb4bf-2936-5327-9a29-d211dc3282fe", "parentControlId": 30715, "controlId": "ORG 1.1", "title": "ORG 1.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580974" }, { "id": 545461, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580974", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c24c558-7ee1-518e-be7b-74fb3ce9d1f8", "parentControlId": 30715, "controlId": "4.4", "title": "4.4", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580974" }, { "id": 545462, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1cad404a-d05a-5e57-8bdf-f564eec2f6cd", "parentControlId": 30715, "controlId": "5.1", "title": "5.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580975" }, { "id": 545463, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "122c202a-884c-5253-8b64-fb94a384939d", "parentControlId": 30715, "controlId": "5.1(a)", "title": "5.1(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580975" }, { "id": 545464, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a28952af-d6d9-5cee-98c5-b329e0e377fa", "parentControlId": 30715, "controlId": "5.1(b)", "title": "5.1(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580975" }, { "id": 545465, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98af9d1b-0a2a-57e6-814e-bbfb66009a04", "parentControlId": 30715, "controlId": "5.1(c)", "title": "5.1(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580975" }, { "id": 545466, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05862834-a70d-5f77-beb0-13a240a0beb1", "parentControlId": 30715, "controlId": "5.1(d)", "title": "5.1(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580975" }, { "id": 545467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e999b2a-9b70-5863-b243-90297b4efc65", "parentControlId": 30715, "controlId": "5.1(e)", "title": "5.1(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580975" }, { "id": 545468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74ddc704-00e5-5bf2-992d-c04f94ff737c", "parentControlId": 30715, "controlId": "5.1(f)", "title": "5.1(f)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580976" }, { "id": 545469, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bff8e53f-2775-5000-990e-3311d08341e3", "parentControlId": 30715, "controlId": "5.1(g)", "title": "5.1(g)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580976" }, { "id": 545470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37c44c95-3ad9-5e50-940a-89a5f3448c88", "parentControlId": 30715, "controlId": "5.1(h)", "title": "5.1(h)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580976" }, { "id": 545471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b566127c-d294-5041-b3b8-8c058f65299e", "parentControlId": 30715, "controlId": "6.1.1", "title": "6.1.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580976" }, { "id": 545472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7dc2513-abdf-5e7d-9ac0-5ac47137a9fc", "parentControlId": 30715, "controlId": "6.1.1(a)", "title": "6.1.1(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580976" }, { "id": 545473, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0dfc0f14-b587-58eb-bf6f-ba8eb5cc44af", "parentControlId": 30715, "controlId": "6.1.1(b)", "title": "6.1.1(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580976" }, { "id": 545474, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69b71f80-42ec-5d10-9351-933e0608207b", "parentControlId": 30715, "controlId": "6.1.1(c)", "title": "6.1.1(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580976" }, { "id": 545475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b93fe4d-388d-5888-aece-41b4dd86a2bb", "parentControlId": 30715, "controlId": "6.1.1(d)", "title": "6.1.1(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580976" }, { "id": 545476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2720c98-0d8d-593e-b057-9ec30e444c5e", "parentControlId": 30715, "controlId": "6.1.1(e)(1)", "title": "6.1.1(e)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580976" }, { "id": 545477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580977", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b423216-4002-519b-88bd-b6a0fb310624", "parentControlId": 30715, "controlId": "6.1.1(e)(2)", "title": "6.1.1(e)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580977" }, { "id": 545478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580977", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e5b70ac-a743-5b93-a6ce-bc2f46dec932", "parentControlId": 30715, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580977" }, { "id": 545479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580977", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81ba6cfa-a399-57ad-bd48-7ae31b247041", "parentControlId": 30715, "controlId": "10.1", "title": "10.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580977" }, { "id": 545480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580977", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e78b840-eabd-5b71-b30e-45799d74d864", "parentControlId": 30715, "controlId": "5.1", "title": "5.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580977" }, { "id": 545481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580977", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02960b33-4adb-5179-8d03-ea39bee1e846", "parentControlId": 30715, "controlId": "5.4", "title": "5.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580977" }, { "id": 545482, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580977", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47031835-b32b-5633-8bd4-3e5eb65ff77c", "parentControlId": 30715, "controlId": "5.37", "title": "5.37", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580977" }, { "id": 545525, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580983", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68fcdfaa-e4e2-5ec8-a8b5-f84362e5e9bd", "parentControlId": 30715, "controlId": "PM-1", "title": "PM-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580983" }, { "id": 545526, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580983", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e13f303-4398-5986-ac8b-222813f650e8", "parentControlId": 30715, "controlId": "PM-01", "title": "PM-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580983" }, { "id": 545529, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580983", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3bd31e2-cf6d-5b45-85e9-0d734181b7ec", "parentControlId": 30715, "controlId": "PM-01", "title": "PM-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580983" }, { "id": 545530, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580983", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1cb5695-4a9c-5ba8-8d0b-3333c7446a01", "parentControlId": 30715, "controlId": "PM-01", "title": "PM-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580983" }, { "id": 545531, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580983", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4bc29daf-4d4d-5ccc-b211-9825279be3e4", "parentControlId": 30715, "controlId": "PM-01", "title": "PM-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580983" }, { "id": 545532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580983", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7a675e5-7a13-5430-9eba-f3332fa5c202", "parentControlId": 30715, "controlId": "PM-01", "title": "PM-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580983" }, { "id": 545533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580983", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "783b9f90-da67-5c20-87d4-b930076c4fdd", "parentControlId": 30715, "controlId": "03.15.01.a", "title": "03.15.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580983" }, { "id": 545534, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffec5799-b795-53c7-a39b-cc23871f9e72", "parentControlId": 30715, "controlId": "GV", "title": "GV", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580984" }, { "id": 545535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98ef5f1c-bef6-534b-8bd1-bd3fed0746f2", "parentControlId": 30715, "controlId": "GV.RM-01", "title": "GV.RM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580984" }, { "id": 545536, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "272985a1-df8e-568f-a044-33583d1f22b6", "parentControlId": 30715, "controlId": "GV.RM-03", "title": "GV.RM-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580984" }, { "id": 545537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7196dd7-8c91-5dbb-9e8d-63f1f73d76a2", "parentControlId": 30715, "controlId": "GV.RR-01", "title": "GV.RR-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580984" }, { "id": 545538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b53f777-d08d-5ec2-8ec3-f42fa0955320", "parentControlId": 30715, "controlId": "GV.SC", "title": "GV.SC", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580985" }, { "id": 545539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23a3896b-eb8c-51c5-9202-132386aeb04d", "parentControlId": 30715, "controlId": "GV.SC-01", "title": "GV.SC-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580985" }, { "id": 545540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "127cf9d1-e160-5ade-9e5c-2c16051e08ca", "parentControlId": 30715, "controlId": "GV.SC-03", "title": "GV.SC-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580985" }, { "id": 545541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d2c52b6-90cc-57f6-88a9-a9da753e2804", "parentControlId": 30715, "controlId": "GV.SC-09", "title": "GV.SC-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580985" }, { "id": 545542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96283112-ee76-57e7-8551-f09599f6a37f", "parentControlId": 30715, "controlId": "ID.RA", "title": "ID.RA", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580985" }, { "id": 545543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82cdd361-76da-52cb-8206-dfc4e414af55", "parentControlId": 30715, "controlId": "PR", "title": "PR", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580985" }, { "id": 545544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d148da9-de16-507c-a8cf-a2e6b4905c5d", "parentControlId": 30715, "controlId": "PR.IR", "title": "PR.IR", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580985" }, { "id": 545644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580997", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f3a71f3-af92-5507-b1ef-544390809d07", "parentControlId": 30715, "controlId": "PROGRAM-1f", "title": "PROGRAM-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580997" }, { "id": 545645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3472ef74-7081-5856-8478-7e65f92a27b0", "parentControlId": 30715, "controlId": "PROGRAM-1g", "title": "PROGRAM-1g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580998" }, { "id": 545646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e4a93c8-4f12-5261-afdd-5604868eae40", "parentControlId": 30715, "controlId": "PROGRAM-2b", "title": "PROGRAM-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580998" }, { "id": 545647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.580998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc613111-c1a2-5d5e-9b9e-fbb14dd36254", "parentControlId": 30715, "controlId": "PROGRAM-2i", "title": "PROGRAM-2i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.580998" }, { "id": 545688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "010f03df-7e21-5743-8e4f-d673aa75168b", "parentControlId": 30715, "controlId": "CIP-003-8 1.1.4", "title": "CIP-003-8 1.1.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581013" }, { "id": 545689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5a85ec6-2e5d-5c58-a07b-d6b1ab56e96d", "parentControlId": 30715, "controlId": "§117.18(b)", "title": "§117.18(b)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581013" }, { "controlId": "A.3.1.1", "title": "A.3.1.1 — Security Assessment and Authorization", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-1, PL-1, PM-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "86e390bb-0d97-5495-8fcc-6deb282fe1d0", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.1", "title": "NEI 08-09 Sec 3.1.1 — Security Assessment and Authorization", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "7e24c289-3147-5f4b-bb78-03cd35a37894", "isPublic": true }, { "controlId": "10 CFR 73.54(b)(2)", "title": "10 CFR 73.54(b)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "96126ead-3107-5efe-b7f3-8b2c72b0bbe4", "isPublic": true }, { "controlId": "A.3.2", "title": "A.3.2 — Incorporating the Cyber Security Program into the Physical Protection Program", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-1, PM-1, IR-4, CP-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "b30cdb56-4293-538d-bb6c-431b07f8f23b", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.2", "title": "NEI 08-09 Sec 3.2 — Incorporating the Cyber Security Program into the Physical Protection Program", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "3f1c636e-5c90-54e3-8577-da24bb25c57e", "isPublic": true }, { "controlId": "10 CFR 73.54(b)(3), 73.55(c)(6)", "title": "10 CFR 73.54(b)(3), 73.55(c)(6) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "95c46504-f974-5182-80e6-24ab51f7daee", "isPublic": true }, { "controlId": "A.3.3", "title": "A.3.3 — Policies and Implementing Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-1, PL-1, PS-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1373604e-a480-519c-9dae-a628840c8152", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.3", "title": "NEI 08-09 Sec 3.3 — Policies and Implementing Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "0af350c7-92cb-50f3-90ac-2186aebef941", "isPublic": true }, { "controlId": "A.4", "title": "A.4 — Maintaining the Cyber Security Program", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-7, PM-6, SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "db8e8f39-cec5-503e-80ed-e607bc6e7d00", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.0", "title": "NEI 08-09 Sec 4.0 — Maintaining the Cyber Security Program", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "bb863ac9-b228-577c-8d07-8d9b270523af", "isPublic": true }, { "controlId": "10 CFR 73.54(g)", "title": "10 CFR 73.54(g) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "000e5e1b-f8f3-55dd-b991-072b3797e62b", "isPublic": true }, { "controlId": "A.4.2.4", "title": "A.4.2.4 — Updating Cyber Security Practices", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-1, SI-5, CA-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "b563c745-287c-5fbe-a136-4449bca19a2f", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.4", "title": "NEI 08-09 Sec 4.2.4 — Updating Cyber Security Practices", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6a2725d9-96e9-5fce-89a7-1fff060a6055", "isPublic": true }, { "controlId": "A.5", "title": "A.5 — DOCUMENT CONTROL AND RECORDS RETENTION AND HANDLING", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-11, MP-4, PM-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "b857371b-d36f-573a-b33f-df71650af1af", "isPublic": true }, { "controlId": "NEI 08-09 Sec 5.0", "title": "NEI 08-09 Sec 5.0 — DOCUMENT CONTROL AND RECORDS RETENTION AND HANDLING", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e68f9351-1818-54be-bfb2-8aa2a33df020", "isPublic": true }, { "controlId": "10 CFR 73.54(h), 73.55(q)", "title": "10 CFR 73.54(h), 73.55(q) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "a570cabf-8b0f-5bfd-a251-0fc780fe9a25", "isPublic": true }, { "controlId": "CIP-003-8-R1", "title": "CIP-003-8-R1 — Cyber Security Policy Development and Approval", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1fec188f-df38-569c-81e0-20419fce9228", "isPublic": true }, { "controlId": "CIP-003-8-1.1", "title": "CIP-003-8-1.1 — For its high impact and medium impact BES Cyber Systems, if any: 1.1.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7f6b9fbc-6f55-5bc6-b2e4-657717cbc73b", "isPublic": true }, { "controlId": "CIP-003-8-1.2", "title": "CIP-003-8-1.2 — For its assets identified in CIP-002 containing low impact BES Cyber Systems, if any: 1.2.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e905eca2-3ba1-5fe3-b67b-480ba179500a", "isPublic": true }, { "controlId": "CIP-003-9-1.2.6", "title": "CIP-003-9-1.2.6 — Low Impact Vendor Electronic Remote Access Security Policy", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "84ef02c2-adee-5da1-80ac-16bc23593e46", "isPublic": true }, { "controlId": "CIP-003-8-R2", "title": "CIP-003-8-R2 — Cyber Security Plan Implementation for Low Impact BES Cyber Systems", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "50b07949-bb9b-57d0-a134-21688b146ee9", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec1", "title": "CIP-003-9-Attachment1-Sec1 — Low Impact Cyber Security Awareness", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a53efd2e-3384-5c48-b32f-564116d0fc1d", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec2", "title": "CIP-003-9-Attachment1-Sec2 — Low Impact Physical Security Controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "bdcaad88-0c6c-584d-854f-d24cbb60b4c9", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec3", "title": "CIP-003-9-Attachment1-Sec3 — Low Impact Electronic Access Controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9719fbc1-943d-5d0a-8ac5-670b61613e0a", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec4", "title": "CIP-003-9-Attachment1-Sec4 — Low Impact Cyber Security Incident Response", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a44019ef-e764-5046-84d1-2f96187c51ca", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec5", "title": "CIP-003-9-Attachment1-Sec5 — Low Impact Transient Cyber Asset and Removable Media Malicious Code Risk Mitigation", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "fd267337-f3d5-5bef-b49a-1ebc5a372fa1", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec6", "title": "CIP-003-9-Attachment1-Sec6 — Low Impact Vendor Electronic Remote Access Security Controls (CIP-003-9)", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "acdcb8c5-acfe-502d-ae71-5ab20f4d9f0c", "isPublic": true }, { "controlId": "CIP-003-8-R3", "title": "CIP-003-8-R3 — Delegation of CIP Senior Manager Authority", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "63d77e63-ed80-5f7d-a61e-3394b0e2f3fd", "isPublic": true }, { "controlId": "NSS-17T-Sec4.1", "title": "NSS-17T-Sec4.1 — Computer Security Program Management & Policy", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b6d956b5-d25b-5c89-911d-4cf776baccc1", "isPublic": true }, { "controlId": "IEC-62645-5.1", "title": "IEC-62645-5.1 — Nuclear Plant Level Computer Security Programme", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "6f0513b7-ec9c-51ba-9a19-81ed98ba8ded", "isPublic": true }, { "controlId": "IEC-63096-5.1", "title": "IEC-63096-5.1 — Information Security Policies for Nuclear Facilities", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "3517e44d-b63e-50de-be51-0e134bfe59a5", "isPublic": true }, { "controlId": "10-CFR-73.100(b)", "title": "10-CFR-73.100(b) — Performance-Based Cybersecurity Program for Advanced Reactors", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "53311361-e128-5473-996d-21a5c8ce2749", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.a", "title": "DOE-O-205.1D-4.a — Enterprise Cybersecurity Risk Management & Governance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "113f8acb-dff2-5a33-ba0a-0d52069df82d", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3", "title": "REGDOC-2.12.1-Sec3 — Cyber Security Program Governance & Organization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "778fe67f-8b42-5cac-a71d-a997c98b4a85", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP1", "title": "ONR-SyAP-FSyP1 — Leadership and Management for Security (CS&IA)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "f32b59e0-580b-50a7-a411-f90f6b23caf2", "isPublic": true } ], "id": 30715, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730689", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730689", "catalogueId": 1062, "uuid": "e226b86a-dbf1-5258-9657-ecea6a43b00e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of security, compliance and resilience governance controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Security, Compliance & Resilience Program (SCRP)", "description": "

Control Description

Mechanisms exist to facilitate the implementation of security, compliance and resilience governance controls.

Evidence Request List (ERL)

E-GOV-01\nE-GOV-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cybersecurity & Data Protection Governance (GOV) capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with GOV domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Governance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT/cybersecurity personnel.\n▪ Cybersecurity and data protection governance is informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ Basic procedures are established for important tasks, but are ad hoc and not formally documented.\n▪ The responsibility for developing and operating cybersecurity and data privacy procedures are up to the business process owner(s) to determine, including the definition and enforcement of roles and responsibilities.\n▪ Governance documentation is made available to internal personnel (e.g., policies, standards, procedures, etc.).\n▪ IT /cyber engineering governance is decentralized, with the responsibility for implementing and testing cybersecurity and data protection controls being assigned to the business process owner(s), including the definition and enforcement of roles and responsibilities.

Level 2 - Planned & Tracked: Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel ensure cybersecurity policies and standards are aligned with a leading cybersecurity framework (e.g., SCF, NIST 800-53, NIST 800-171, ISO 27002 or NIST Cybersecurity Framework).\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to implement and manage the organization's internal control system.\n▪ Legal representation is consulted on an as-needed basis.

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to facilitate the implementation of security, compliance and resilience governance controls.

Level 4 - Quantitatively Controlled: Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.1, A.3.2, A.3.3, A.4, A.4.2.4, A.5
NERC-CIP (2026) Requirements: CIP-003-8-R1, CIP-003-8-R2, CIP-003-8-R3", "controlId": "GOV-01", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-01", "references": "

Micro-Small Business (<10 staff)

∙ ComplianceForge - Cybersecurity & Data Protection Program (CDPP) (https://complianceforge.com)\n∙ SCFConnect (https://scfconnect.com)\n∙ NIST Cybersecurity Framework (CSF) 2.0 (https://www.nist.gov/cyberframework)

Small Business (10-49 staff)

∙ ComplianceForge - Cybersecurity & Data Protection Program (CDPP) (https://complianceforge.com)\n∙ SCFConnect (https://scfconnect.com)\n∙ NIST Cybersecurity Framework (CSF) 2.0 (https://www.nist.gov/cyberframework)

Medium Business (50-249 staff)

∙ Steering committee\n∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)\n∙ ComplianceForge - Cybersecurity & Data Protection Program (CDPP) (https://complianceforge.com)\n∙ GRC platform (e.g., OneTrust, ServiceNow GRC, LogicGate)\n∙ Secure Controls Framework (SCF), NIST SP 800-53 Rev 5 and/or ISO 27001:2022 alignment

Large Business (250-999 staff)

∙ Steering committee\n∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Secure Controls Framework (SCF), NIST SP 800-53 Rev 5 and/or ISO 27001:2022 alignment

Enterprise (>1,000 staff)

∙ Steering committee\n∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)\n∙ Enterprise GRC platform (e.g., Cyturus, Archer, MetricStream, ServiceNow IRM)\n∙ Secure Controls Framework (SCF), NIST SP 800-53 Rev 5 and/or ISO 27001:2022 alignment", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69062, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589761", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589761", "securityControlId": 30716, "ccis": [], "uuid": "a26a920f-a68e-5e6f-9f56-74445038829f", "testId": "GOV-01.1_A01", "test": "an executive steering committee, or advisory board, is formed and is comprised of key cybersecurity, technology, risk, privacy and business executives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69063, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589761", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589761", "securityControlId": 30716, "ccis": [], "uuid": "e873551b-d30f-58eb-be2d-ff00b43ba82e", "testId": "GOV-01.1_A02", "test": "the executive steering committee, or advisory board, coordinates cybersecurity, technology, risk, privacy and business alignment through recurring, formal meetings.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 545918, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80960c32-935d-5415-bd9b-68c605e7ceaa", "parentControlId": 30716, "controlId": "4.4", "title": "4.4", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581042" }, { "id": 545919, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd6a5463-cd7b-501c-98e2-6d87dc5bc42c", "parentControlId": 30716, "controlId": "5.1", "title": "5.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581042" }, { "id": 545920, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a96dcb3b-e965-5db7-b3db-ac95fe5e2a70", "parentControlId": 30716, "controlId": "5.3", "title": "5.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581042" }, { "id": 545921, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bad7d12-c473-53d0-a5ad-0fd03dddc16d", "parentControlId": 30716, "controlId": "5.3(a)", "title": "5.3(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581042" }, { "id": 545922, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce1b40f4-c619-59bb-9d89-0f82e4fbabf4", "parentControlId": 30716, "controlId": "5.3(b)", "title": "5.3(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581042" }, { "id": 545923, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9df42173-217d-51dd-8e7d-ee162dc761b1", "parentControlId": 30716, "controlId": "9.3.1", "title": "9.3.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581042" }, { "id": 545924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1e9a6e1-03e6-5476-a06f-e0b870f69616", "parentControlId": 30716, "controlId": "9.3.2(a)", "title": "9.3.2(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581042" }, { "id": 545925, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2ff78e2-edb4-5f96-ba2c-0b5dac260edb", "parentControlId": 30716, "controlId": "9.3.2(b)", "title": "9.3.2(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581043" }, { "id": 545926, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40629990-0956-52e2-97d7-b5a59dae48ac", "parentControlId": 30716, "controlId": "9.3.2(c)", "title": "9.3.2(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581043" }, { "id": 545927, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7bb19665-7b4b-5c15-bc80-42c85c2ac69c", "parentControlId": 30716, "controlId": "9.3.2(d)", "title": "9.3.2(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581043" }, { "id": 545928, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86c952a9-ba97-56cd-be19-cff3b9f3fbcb", "parentControlId": 30716, "controlId": "9.3.2(d)(1)", "title": "9.3.2(d)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581043" }, { "id": 545929, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13cace01-083e-5bb9-9e44-f5e35ed6dfca", "parentControlId": 30716, "controlId": "9.3.2(d)(2)", "title": "9.3.2(d)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581043" }, { "id": 545930, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73248cf1-e920-5182-8a7a-f32b7e959d80", "parentControlId": 30716, "controlId": "9.3.2(d)(3)", "title": "9.3.2(d)(3)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581043" }, { "id": 545931, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb108b8b-f242-5ef8-b23d-9f8778ffddef", "parentControlId": 30716, "controlId": "9.3.2(d)(4)", "title": "9.3.2(d)(4)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581043" }, { "id": 545932, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ed1101f-dbdd-5acd-9207-458b08f7739e", "parentControlId": 30716, "controlId": "9.3.2(e)", "title": "9.3.2(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581043" }, { "id": 545933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12e9196b-90fa-5951-a854-5d6a88508d85", "parentControlId": 30716, "controlId": "9.3.2(f)", "title": "9.3.2(f)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581044" }, { "id": 545934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a50c0b61-cd10-5804-abac-35a93339649d", "parentControlId": 30716, "controlId": "9.3.2(g)", "title": "9.3.2(g)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581044" }, { "id": 545935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cad41cd1-b9e1-59ea-8841-91bb79be24a5", "parentControlId": 30716, "controlId": "9.3.3", "title": "9.3.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581044" }, { "id": 545936, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17e67275-dbda-5e85-9636-9d58494611cd", "parentControlId": 30716, "controlId": "10.1", "title": "10.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581044" }, { "id": 545972, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e56d5529-1e89-528f-8984-138bafd9de0c", "parentControlId": 30716, "controlId": "03.12.03", "title": "03.12.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581058" }, { "id": 545973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5723e34-e9e0-5f3d-82f1-5fabc5b9a1f9", "parentControlId": 30716, "controlId": "GV.RM-01", "title": "GV.RM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581058" }, { "id": 545974, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b766e8e-a303-5b75-8602-3b8ca708fc76", "parentControlId": 30716, "controlId": "GV.RM-03", "title": "GV.RM-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581059" }, { "id": 545975, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a683a8c0-4fe2-53e1-8588-939bc235ada2", "parentControlId": 30716, "controlId": "GV.RR-01", "title": "GV.RR-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581059" }, { "id": 545976, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25aa3043-f2af-5a44-b743-daa2334a0863", "parentControlId": 30716, "controlId": "GV.OV", "title": "GV.OV", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581059" }, { "id": 545977, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fd66d22-4596-5a02-bbe0-84b1606dbb10", "parentControlId": 30716, "controlId": "GV.OV-01", "title": "GV.OV-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581059" }, { "id": 545978, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2adde61a-a880-53e3-b439-1f39782f776a", "parentControlId": 30716, "controlId": "GV.OV-02", "title": "GV.OV-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581059" }, { "id": 545979, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fcc5cdc-9223-574e-be50-ced5db36d993", "parentControlId": 30716, "controlId": "GV.OV-03", "title": "GV.OV-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581059" }, { "id": 545980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3b9ec22-54bf-5679-9165-45f898376324", "parentControlId": 30716, "controlId": "GV.SC", "title": "GV.SC", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581059" }, { "id": 545981, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7cb1e9f5-759e-5c9e-80a5-7555eb6805d7", "parentControlId": 30716, "controlId": "GV.SC-01", "title": "GV.SC-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581059" }, { "id": 545982, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c910347-7bb0-5e9e-a506-ce1eddf19b88", "parentControlId": 30716, "controlId": "GV.SC-03", "title": "GV.SC-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581059" }, { "id": 545983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58106", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67ac4931-cd3d-5060-bc0a-ff1574636e72", "parentControlId": 30716, "controlId": "GV.SC-09", "title": "GV.SC-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58106" }, { "id": 545984, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58106", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9277dfb8-14fe-5ea7-bbc8-a786881693fc", "parentControlId": 30716, "controlId": "ID", "title": "ID", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58106" }, { "id": 545985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58106", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4698546-6e25-53e0-acec-6894f93109ac", "parentControlId": 30716, "controlId": "ID.RA", "title": "ID.RA", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58106" }, { "id": 545986, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58106", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47efd86b-47d0-5e71-bf01-8812ffb0504d", "parentControlId": 30716, "controlId": "PR", "title": "PR", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58106" }, { "id": 545987, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58106", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39ddb921-faf1-5bd2-a4ae-43593b053e23", "parentControlId": 30716, "controlId": "PR.IR", "title": "PR.IR", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58106" }, { "id": 546024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9baeabd-d17b-5e12-8f16-a1ddf0225ebe", "parentControlId": 30716, "controlId": "RISK-1f", "title": "RISK-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581065" }, { "id": 546025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e822f698-2318-578a-bfd7-912eb401321e", "parentControlId": 30716, "controlId": "PROGRAM-2a", "title": "PROGRAM-2a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581065" }, { "id": 546026, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80313283-7e2f-500e-9751-cd04bf3f2299", "parentControlId": 30716, "controlId": "PROGRAM-2c", "title": "PROGRAM-2c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581065" }, { "id": 546027, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a26d6f3-74f7-5626-b7f9-743f6b7895a1", "parentControlId": 30716, "controlId": "PROGRAM-2d", "title": "PROGRAM-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581065" }, { "id": 546088, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581072", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd7d3dca-bdc7-593b-bae2-af55a9dea152", "parentControlId": 30716, "controlId": "A1.a", "title": "A1.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581072" }, { "id": 546089, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581073", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78fd028b-a750-5272-8066-802cbdcf2924", "parentControlId": 30716, "controlId": "A1.c", "title": "A1.c", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581073" } ], "id": 30716, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730821", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730821", "catalogueId": 1062, "uuid": "a56a1b6d-ef63-5c4d-a7a8-c17419a55b91", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization align security, compliance and resilience capabilities with business requirements through a steering committee or advisory board, comprised of key cybersecurity, data protection and business executives, which meets formally and on a regular basis?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Steering Committee & Program Oversight", "description": "

Control Description

Mechanisms exist to align security, compliance and resilience capabilities with business requirements through a steering committee or advisory board, comprised of key cybersecurity, data protection and business executives, which meets formally and on a regular basis.

Evidence Request List (ERL)

E-GOV-03\nE-PRM-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.\n▪ Organizational leadership maintains an informal process to review and respond to trends.

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to align security, compliance and resilience capabilities with business requirements through a steering committee or advisory board, comprised of key cybersecurity, data protection and business executives, which meets formally and on a regular basis.

Level 4 - Quantitatively Controlled: Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "GOV-01.1", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Third-party advisors (subject matter experts)\n∙ Virtual CISO (vCISO) service\n∙ Fractional security advisor

Small Business (10-49 staff)

∙ Third-party advisors (subject matter experts)\n∙ Virtual CISO (vCISO) service\n∙ Informal security advisory committee

Medium Business (50-249 staff)

∙ Steering committee / advisory board\n∙ Quarterly security committee meetings with documented minutes\n∙ Cross-functional representation (IT, Legal, HR, Operations)

Large Business (250-999 staff)

∙ Formal steering committee / advisory board\n∙ Documented charter with defined roles and meeting cadence\n∙ Board-level cybersecurity reporting

Enterprise (>1,000 staff)

∙ Formal steering committee / advisory board\n∙ Board-level Cybersecurity Committee or subcommittee\n∙ Chief Information Security Officer (CISO) with board-level access\n∙ Independent security advisor / external audit committee", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69064, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589762", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589762", "securityControlId": 30717, "ccis": [], "uuid": "72bc2731-8d21-5b2d-b594-915ac54ec3ba", "testId": "GOV-01.2_A01", "test": "the executive steering committee, or advisory board, makes executive decisions about matters considered material to the organization's cybersecurity / data privacy program.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 546195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aed616c0-c98d-5577-adc6-13af330a2db4", "parentControlId": 30717, "controlId": "7.4", "title": "7.4", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581085" }, { "id": 546196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0beafca2-7cfc-5e3b-a2cc-20328b75e527", "parentControlId": 30717, "controlId": "7.4(a)", "title": "7.4(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581085" }, { "id": 546197, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcb27537-8029-5868-a372-a4e3a385bb20", "parentControlId": 30717, "controlId": "7.4(b)", "title": "7.4(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581086" }, { "id": 546198, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b3cadf5-a9bf-56db-a2df-2066e168d396", "parentControlId": 30717, "controlId": "7.4(c)", "title": "7.4(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581086" }, { "id": 546199, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc4e0a7f-c08e-5b5f-93d9-0291f5d34cb7", "parentControlId": 30717, "controlId": "7.4(d)", "title": "7.4(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581086" }, { "id": 546200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a27426e7-c87c-5656-81aa-486bd83c2816", "parentControlId": 30717, "controlId": "9.1", "title": "9.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581086" }, { "id": 546201, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b345179-8dea-5932-af4d-cb48c88978a8", "parentControlId": 30717, "controlId": "9.1(a)", "title": "9.1(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581086" }, { "id": 546202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb06799e-817e-5470-81d5-1224a5cdf3ee", "parentControlId": 30717, "controlId": "9.1(b)", "title": "9.1(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581086" }, { "id": 546203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3b09a4d-1da2-561b-91e7-95a71976234a", "parentControlId": 30717, "controlId": "9.1(c)", "title": "9.1(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581086" }, { "id": 546204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9940b8af-2f57-5da1-8d2f-c52888341ba1", "parentControlId": 30717, "controlId": "9.1(d)", "title": "9.1(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581086" }, { "id": 546205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d676314c-9f6e-5e76-adaa-b0bfb03a0fcb", "parentControlId": 30717, "controlId": "9.1(e)", "title": "9.1(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581086" }, { "id": 546206, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4614434-97d5-577d-bc92-33c8d270bbc9", "parentControlId": 30717, "controlId": "9.1(f)", "title": "9.1(f)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581087" }, { "id": 546207, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c1897d4-6a0e-5949-99c3-0f551b268152", "parentControlId": 30717, "controlId": "9.3.1", "title": "9.3.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581087" }, { "id": 546208, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c86c20e-8097-5c51-99ec-48692acd3637", "parentControlId": 30717, "controlId": "9.3.2(a)", "title": "9.3.2(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581087" }, { "id": 546209, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8992a4f3-3833-5755-9760-48906a8b93e6", "parentControlId": 30717, "controlId": "9.3.2(b)", "title": "9.3.2(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581087" }, { "id": 546210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38c1d261-50bc-5a0a-963a-1308d2a0046d", "parentControlId": 30717, "controlId": "9.3.2(c)", "title": "9.3.2(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581087" }, { "id": 546211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39f88569-f4d8-5536-a1a1-e534d84a0de9", "parentControlId": 30717, "controlId": "9.3.2(d)", "title": "9.3.2(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581087" }, { "id": 546212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77e117b3-a40c-54bd-940a-6862b7099656", "parentControlId": 30717, "controlId": "9.3.2(d)(1)", "title": "9.3.2(d)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581087" }, { "id": 546213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8318a3e-b20f-5917-8504-8792349beb3c", "parentControlId": 30717, "controlId": "9.3.2(d)(2)", "title": "9.3.2(d)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581087" }, { "id": 546214, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f6a59c2-0e9e-5d7d-8a10-32d606f5763a", "parentControlId": 30717, "controlId": "9.3.2(d)(3)", "title": "9.3.2(d)(3)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581087" }, { "id": 546215, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "650b2159-ad94-5eeb-8ea0-9765fa098f2b", "parentControlId": 30717, "controlId": "9.3.2(d)(4)", "title": "9.3.2(d)(4)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581088" }, { "id": 546216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "320ab2fb-7280-59c4-a968-80fcbc9fbd68", "parentControlId": 30717, "controlId": "9.3.2(e)", "title": "9.3.2(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581088" }, { "id": 546217, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c20e56f9-9f29-53cb-ae37-db1256272ab8", "parentControlId": 30717, "controlId": "9.3.2(f)", "title": "9.3.2(f)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581088" }, { "id": 546218, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c1f442e-1942-567e-aa08-3a8a1ff17738", "parentControlId": 30717, "controlId": "9.3.2(g)", "title": "9.3.2(g)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581088" }, { "id": 546219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3dc3080a-e4c6-5ed6-8eb3-ae91025b9a49", "parentControlId": 30717, "controlId": "9.3.3", "title": "9.3.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581088" }, { "id": 546230, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "addcd7c3-522a-5c16-85be-766541afa91c", "parentControlId": 30717, "controlId": "03.12.03", "title": "03.12.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581089" }, { "id": 546231, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b8d2b96-20d4-5429-a22e-27181f56511f", "parentControlId": 30717, "controlId": "GV.OV", "title": "GV.OV", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581089" }, { "id": 546232, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e30c4111-48e3-545b-b70e-e1d0c2673705", "parentControlId": 30717, "controlId": "GV.OV-01", "title": "GV.OV-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58109" }, { "id": 546233, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a67f4be4-ac68-5b70-9f0c-b71135a590db", "parentControlId": 30717, "controlId": "GV.OV-03", "title": "GV.OV-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58109" }, { "id": 546234, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18f0a74a-1d01-5560-a074-a8c9dd3f4cb3", "parentControlId": 30717, "controlId": "GV.SC", "title": "GV.SC", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58109" }, { "id": 546235, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e467533-5981-5266-8385-d1961d4587ec", "parentControlId": 30717, "controlId": "GV.SC-09", "title": "GV.SC-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58109" }, { "id": 546236, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1527cf44-d83c-5c1b-ad5f-9aad0d76861d", "parentControlId": 30717, "controlId": "ID", "title": "ID", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58109" }, { "id": 546239, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0e7e48a-5b48-5f52-b442-7d4bf8d4a839", "parentControlId": 30717, "controlId": "PROGRAM-2g", "title": "PROGRAM-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58109" }, { "controlId": "A.4.2.4", "title": "A.4.2.4 — Updating Cyber Security Practices", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-1, SI-5, CA-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "3b98148d-a5a6-5755-b529-8e14292c5a1a", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.4", "title": "NEI 08-09 Sec 4.2.4 — Updating Cyber Security Practices", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "a27cdfcd-eae0-5f96-a828-db5ec7576ca5", "isPublic": true }, { "controlId": "10 CFR 73.54(g)", "title": "10 CFR 73.54(g) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "9387b5a6-8403-59ac-8bfa-af84175a9f51", "isPublic": true }, { "controlId": "NSS-17T-Sec4.1", "title": "NSS-17T-Sec4.1 — Computer Security Program Management & Policy", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "3b037132-fe64-5bee-be05-1e7396fed0a6", "isPublic": true }, { "controlId": "IEC-62645-5.1", "title": "IEC-62645-5.1 — Nuclear Plant Level Computer Security Programme", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "4698178a-cfcd-5cf3-957c-0814810dee93", "isPublic": true }, { "controlId": "IEC-63096-5.1", "title": "IEC-63096-5.1 — Information Security Policies for Nuclear Facilities", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "704cda9c-3d71-53a5-bf8a-268d76002746", "isPublic": true }, { "controlId": "10-CFR-73.100(b)", "title": "10-CFR-73.100(b) — Performance-Based Cybersecurity Program for Advanced Reactors", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "acacd967-70a1-599e-9c2b-296175367292", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.a", "title": "DOE-O-205.1D-4.a — Enterprise Cybersecurity Risk Management & Governance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "30f05073-185c-5709-9f21-22fcda4b00dc", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3", "title": "REGDOC-2.12.1-Sec3 — Cyber Security Program Governance & Organization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "7e6eb020-76e5-578d-9269-715baafa842f", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP1", "title": "ONR-SyAP-FSyP1 — Leadership and Management for Security (CS&IA)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "5196abfb-b53a-5a1b-aada-545c66e0e25f", "isPublic": true } ], "id": 30717, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730821", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730821", "catalogueId": 1062, "uuid": "78518b6e-349d-54e1-9a26-a8b23141c3d1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide governance oversight reporting and recommendations to those entrusted to make executive decisions about matters considered material to the organization's Security, Compliance & Resilience Program (SCRP)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Status Reporting To Governing Body", "description": "

Control Description

Mechanisms exist to provide governance oversight reporting and recommendations to those entrusted to make executive decisions about matters considered material to the organization's Security, Compliance & Resilience Program (SCRP).

Evidence Request List (ERL)

E-CPL-05\nE-CPL-09\nE-GOV-03\nE-GOV-04\nE-GOV-05\nE-GOV-06\nE-GOV-07\nE-GOV-13

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.\n▪ Organizational leadership maintains an informal process to review and respond to trends.

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to provide governance oversight reporting and recommendations to those entrusted to make executive decisions about matters considered material to the organization's Security, Compliance & Resilience Program (SCRP).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.2.4", "controlId": "GOV-01.2", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-01.2", "references": "

Micro-Small Business (<10 staff)

∙ Quarterly Business Review (QBR)\n∙ Simple security status dashboard (spreadsheet or slide deck)\n∙ Email status updates to owner/manager

Small Business (10-49 staff)

∙ Quarterly Business Review (QBR)\n∙ Structured security metrics report (incidents, patching status, training completion)\n∙ Documented reporting cadence

Medium Business (50-249 staff)

∙ Quarterly Business Review (QBR)\n∙ Formal security status reports to leadership\n∙ KPI/KRI dashboard (e.g., Power BI, Tableau, or GRC tool reporting)

Large Business (250-999 staff)

∙ Quarterly Business Review (QBR)\n∙ Executive security dashboard with KPIs/KRIs\n∙ Board-level reporting on material risk indicators\n∙ Automated reporting via GRC platform

Enterprise (>1,000 staff)

∙ Quarterly Business Review (QBR)\n∙ Board and audit committee cybersecurity briefings\n∙ Integrated GRC dashboard with real-time metrics\n∙ SEC cybersecurity disclosure-ready reporting processes (if applicable)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69066, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589762", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589762", "securityControlId": 30719, "ccis": [], "uuid": "2586facb-7754-562e-bfdc-caa7e2626d0a", "testId": "GOV-02_A01", "test": "cybersecurity / data privacy policies are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-01a.[01]\n53A_R5_AT-01a.[01]\n53A_R5_AU-01a.[01]\n53A_R5_CA-01a.[01]\n53A_R5_CM-01a.[01]\n53A_R5_CP-01a.[01]\n53A_R5_IA-01a.[01]\n53A_R5_IR-01a.[01]\n53A_R5_MA-01a.[01]\n53A_R5_MP-01a.[01]\n53A_R5_PE-01a.[01]\n53A_R5_PL-01a.[01]\n53A_R5_PS-01a.[01]\n53A_R5_PT-01a.[01]\n53A_R5_RA-01a.[01]\n53A_R5_SA-01a.[01]\n53A_R5_SC-01a.[01]\n53A_R5_SI-01a.[01]\n53A_R5_SR-01a.[01]\n171A_3.4.9[a]\n171A_3.9.2[a]\n53A_R5_AC-02a.[03]\n53A_R5_AC-04(25)_ODP[02]\n53A_R5_IA-04(05)_ODP\n53A_R5_SR-11a.[03]", "defaultText": null }, { "id": 69067, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589763", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589763", "securityControlId": 30719, "ccis": [], "uuid": "af6d37db-3626-5360-ad18-25e9d3df262d", "testId": "GOV-02_A02", "test": "policies needed to satisfy the security requirements for the protection of sensitive / regulated data are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69068, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589763", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589763", "securityControlId": 30719, "ccis": [], "uuid": "b2fb03cb-8d54-50af-91ee-fdf6caf35df1", "testId": "GOV-02_A03", "test": "policies needed to satisfy the security requirements for the protection of sensitive / regulated data are disseminated to organizational personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69069, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589763", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589763", "securityControlId": 30719, "ccis": [], "uuid": "2aac3972-becc-5d93-a5f9-0b9718f76a87", "testId": "GOV-02_A04", "test": "procedures needed to satisfy the security requirements for the protection of sensitive / regulated data are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69070, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589763", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589763", "securityControlId": 30719, "ccis": [], "uuid": "1667df1d-b4a4-5df3-a0ad-7fde599067f1", "testId": "GOV-02_A05", "test": "procedures needed to satisfy the security requirements for the protection of sensitive / regulated data are disseminated to organizational personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69071, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589763", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589763", "securityControlId": 30719, "ccis": [], "uuid": "cadc9da2-fb71-58ed-8769-3aa61b050345", "testId": "GOV-02_A06", "test": "the cybersecurity / data privacy policies address purpose.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-01a.01(a)[01]\n53A_R5_AT-01a.01(a)[01]\n53A_R5_AU-01a.01(a)[01]\n53A_R5_CA-01a.01(a)[01]\n53A_R5_CM-01a.01(a)[01]\n53A_R5_CP-01a.01(a)[01]\n53A_R5_IA-01a.01(a)[01]\n53A_R5_IR-01a.01(a)[01]\n53A_R5_MA-01a.01(a)[01]\n53A_R5_MP-01a.01(a)[01]\n53A_R5_PE-01a.01(a)[01]\n53A_R5_PL-01a.01(a)[01]\n53A_R5_PS-01a.01(a)[01]\n53A_R5_PT-01a.01(a)[01]\n53A_R5_RA-01a.01(a)[01]\n53A_R5_SA-01a.01(a)[01]\n53A_R5_SC-01a.01(a)[01]\n53A_R5_SI-01a.01(a)[01]\n53A_R5_SR-01a.01(a)[01]", "defaultText": null }, { "id": 69072, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589764", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589764", "securityControlId": 30719, "ccis": [], "uuid": "4fd6bf06-4611-53ef-a927-4145242e3707", "testId": "GOV-02_A07", "test": "the cybersecurity / data privacy policies address scope.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-01a.01(a)[02]\n53A_R5_AT-01a.01(a)[02]\n53A_R5_AU-01a.01(a)[02]\n53A_R5_CA-01a.01(a)[02]\n53A_R5_CM-01a.01(a)[02]\n53A_R5_CP-01a.01(a)[02]\n53A_R5_IA-01a.01(a)[02]\n53A_R5_IR-01a.01(a)[02]\n53A_R5_MA-01a.01(a)[02]\n53A_R5_MP-01a.01(a)[02]\n53A_R5_PE-01a.01(a)[02]\n53A_R5_PL-01a.01(a)[02]\n53A_R5_PS-01a.01(a)[02]\n53A_R5_PT-01a.01(a)[02]\n53A_R5_RA-01a.01(a)[02]\n53A_R5_SA-01a.01(a)[02]\n53A_R5_SC-01a.01(a)[02]\n53A_R5_SI-01a.01(a)[02]\n53A_R5_SR-01a.01(a)[02]", "defaultText": null }, { "id": 69073, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589764", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589764", "securityControlId": 30719, "ccis": [], "uuid": "802aa703-8f53-5d06-a16d-96cc24becb78", "testId": "GOV-02_A08", "test": "the cybersecurity / data privacy policies address roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-01a.01(a)[03]\n53A_R5_AT-01a.01(a)[03]\n53A_R5_AU-01a.01(a)[03]\n53A_R5_CA-01a.01(a)[03]\n53A_R5_CM-01a.01(a)[03]\n53A_R5_CP-01a.01(a)[03]\n53A_R5_IA-01a.01(a)[03]\n53A_R5_IR-01a.01(a)[03]\n53A_R5_MA-01a.01(a)[03]\n53A_R5_MP-01a.01(a)[03]\n53A_R5_PE-01a.01(a)[03]\n53A_R5_PL-01a.01(a)[03]\n53A_R5_PS-01a.01(a)[03]\n53A_R5_PT-01a.01(a)[03]\n53A_R5_RA-01a.01(a)[03]\n53A_R5_SA-01a.01(a)[03]\n53A_R5_SC-01a.01(a)[03]\n53A_R5_SI-01a.01(a)[03]\n53A_R5_SR-01a.01(a)[03]", "defaultText": null }, { "id": 69074, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589764", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589764", "securityControlId": 30719, "ccis": [], "uuid": "2648b14f-ddfb-5c31-97b3-72be227ee17b", "testId": "GOV-02_A09", "test": "the cybersecurity / data privacy policies address responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-01a.01(a)[04]\n53A_R5_AT-01a.01(a)[04]\n53A_R5_AU-01a.01(a)[04]\n53A_R5_CA-01a.01(a)[04]\n53A_R5_CM-01a.01(a)[04]\n53A_R5_CP-01a.01(a)[04]\n53A_R5_IA-01a.01(a)[04]\n53A_R5_IR-01a.01(a)[04]\n53A_R5_MA-01a.01(a)[04]\n53A_R5_MP-01a.01(a)[04]\n53A_R5_PE-01a.01(a)[04]\n53A_R5_PL-01a.01(a)[04]\n53A_R5_PS-01a.01(a)[04]\n53A_R5_PT-01a.01(a)[04]\n53A_R5_RA-01a.01(a)[04]\n53A_R5_SA-01a.01(a)[04]\n53A_R5_SC-01a.01(a)[04]\n53A_R5_SI-01a.01(a)[04]\n53A_R5_SR-01a.01(a)[04]", "defaultText": null }, { "id": 69075, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589764", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589764", "securityControlId": 30719, "ccis": [], "uuid": "26119fd6-059b-5bab-b056-3384e5c5fa44", "testId": "GOV-02_A10", "test": "the cybersecurity / data privacy policies address management commitment.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-01a.01(a)[05]\n53A_R5_AT-01a.01(a)[05]\n53A_R5_AU-01a.01(a)[05]\n53A_R5_CA-01a.01(a)[05]\n53A_R5_CM-01a.01(a)[05]\n53A_R5_CP-01a.01(a)[05]\n53A_R5_IA-01a.01(a)[05]\n53A_R5_IR-01a.01(a)[05]\n53A_R5_MA-01a.01(a)[05]\n53A_R5_MP-01a.01(a)[05]\n53A_R5_PE-01a.01(a)[05]\n53A_R5_PL-01a.01(a)[05]\n53A_R5_PS-01a.01(a)[05]\n53A_R5_PT-01a.01(a)[05]\n53A_R5_RA-01a.01(a)[05]\n53A_R5_SA-01a.01(a)[05]\n53A_R5_SC-01a.01(a)[05]\n53A_R5_SI-01a.01(a)[05]\n53A_R5_SR-01a.01(a)[05]", "defaultText": null }, { "id": 69076, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589764", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589764", "securityControlId": 30719, "ccis": [], "uuid": "e5d27dce-2a0a-5907-ac41-afee1994ce24", "testId": "GOV-02_A11", "test": "the cybersecurity / data privacy policies address coordination among organizational entities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-01a.01(a)[06]\n53A_R5_AT-01a.01(a)[06]\n53A_R5_AU-01a.01(a)[06]\n53A_R5_CA-01a.01(a)[06]\n53A_R5_CM-01a.01(a)[06]\n53A_R5_CP-01a.01(a)[06]\n53A_R5_IA-01a.01(a)[06]\n53A_R5_IR-01a.01(a)[06]\n53A_R5_MA-01a.01(a)[06]\n53A_R5_MP-01a.01(a)[06]\n53A_R5_PE-01a.01(a)[06]\n53A_R5_PL-01a.01(a)[06]\n53A_R5_PS-01a.01(a)[06]\n53A_R5_PT-01a.01(a)[06]\n53A_R5_RA-01a.01(a)[06]\n53A_R5_SA-01a.01(a)[06]\n53A_R5_SC-01a.01(a)[06]\n53A_R5_SI-01a.01(a)[06]\n53A_R5_SR-01a.01(a)[06]", "defaultText": null }, { "id": 69077, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589765", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589765", "securityControlId": 30719, "ccis": [], "uuid": "cbbad0da-30f1-581f-a58e-274fcf442e02", "testId": "GOV-02_A12", "test": "the cybersecurity / data privacy policies address compliance.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-01a.01(a)[07]\n53A_R5_AT-01a.01(a)[07]\n53A_R5_AU-01a.01(a)[07]\n53A_R5_CA-01a.01(a)[07]\n53A_R5_CM-01a.01(a)[07]\n53A_R5_CP-01a.01(a)[07]\n53A_R5_IA-01a.01(a)[07]\n53A_R5_IR-01a.01(a)[07]\n53A_R5_MA-01a.01(a)[07]\n53A_R5_MP-01a.01(a)[07]\n53A_R5_PE-01a.01(a)[07]\n53A_R5_PL-01a.01(a)[07]\n53A_R5_PS-01a.01(a)[07]\n53A_R5_PT-01a.01(a)[07]\n53A_R5_RA-01a.01(a)[07]\n53A_R5_SA-01a.01(a)[07]\n53A_R5_SC-01a.01(a)[07]\n53A_R5_SI-01a.01(a)[07]\n53A_R5_SR-01a.01(a)[07]", "defaultText": null }, { "id": 69078, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589765", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589765", "securityControlId": 30719, "ccis": [], "uuid": "ff895543-11a6-55c6-aa1d-15b1a8b9b8ea", "testId": "GOV-02_A13", "test": "the cybersecurity / data privacy policies are consistent with applicable laws, regulations and contractual obligations.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-01a.01(b)\n53A_R5_AT-01a.01(b)\n53A_R5_AU-01a.01(b)\n53A_R5_CA-01a.01(b)\n53A_R5_CM-01a.01(b)\n53A_R5_CP-01a.01(b)\n53A_R5_IA-01a.01(b)\n53A_R5_IR-01a.01(b)\n53A_R5_MA-01a.01(b)\n53A_R5_MP-01a.01(b)\n53A_R5_PE-01a.01(b)\n53A_R5_PL-01a.01(b)\n53A_R5_PS-01a.01(b)\n53A_R5_PT-01a.01(b)\n53A_R5_RA-01a.01(b)\n53A_R5_SA-01a.01(b)\n53A_R5_SC-01a.01(b)\n53A_R5_SI-01a.01(b)\n53A_R5_SR-01a.01(b)", "defaultText": null }, { "id": 69079, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589765", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589765", "securityControlId": 30719, "ccis": [], "uuid": "a49fe793-ac3e-5715-b790-51a3773a16ba", "testId": "GOV-02_A14", "test": "personnel or roles to whom the cybersecurity / data privacy policies are to be disseminated is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-01_ODP[01]\n53A_R5_AT-01_ODP[01]\n53A_R5_AU-01_ODP[01]\n53A_R5_CA-01_ODP[01]\n53A_R5_CM-01_ODP[01]\n53A_R5_CP-01_ODP[01]\n53A_R5_IA-01_ODP[01]\n53A_R5_IR-01_ODP[01]\n53A_R5_MA-01_ODP[01]\n53A_R5_MP-01_ODP[01]\n53A_R5_PE-01_ODP[01]\n53A_R5_PL-01_ODP[01]\n53A_R5_PS-01_ODP[01]\n53A_R5_PT-01_ODP[01]\n53A_R5_RA-01_ODP[01]\n53A_R5_SA-01_ODP[01]\n53A_R5_SC-01_ODP[01]\n53A_R5_SI-01_ODP[01]\n53A_R5_SR-01_ODP[01]", "defaultText": null }, { "id": 69080, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589765", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589765", "securityControlId": 30719, "ccis": [], "uuid": "200d0783-0fbc-5506-803f-86749d6ac208", "testId": "GOV-02_A15", "test": "the cybersecurity / data privacy policies are disseminated to personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-01a.[02]\n53A_R5_AT-01a.[02]\n53A_R5_AU-01a.[02]\n53A_R5_CA-01a.[02]\n53A_R5_CM-01a.[02]\n53A_R5_CP-01a.[02]\n53A_R5_IA-01a.[02]\n53A_R5_IR-01a.[02]\n53A_R5_MA-01a.[02]\n53A_R5_MP-01a.[02]\n53A_R5_PE-01a.[02]\n53A_R5_PL-01a.[02]\n53A_R5_PS-01a.[02]\n53A_R5_PT-01a.[02]\n53A_R5_RA-01a.[02]\n53A_R5_SA-01a.[02]\n53A_R5_SC-01a.[02]\n53A_R5_SI-01a.[02]\n53A_R5_SR-01a.[02]", "defaultText": null }, { "id": 69081, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589765", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589765", "securityControlId": 30719, "ccis": [], "uuid": "b5a77e1c-f627-5829-a96a-150cf05409f7", "testId": "GOV-02_A16", "test": "the official is designated to manage the development, documentation and dissemination of the cybersecurity / data privacy policies and procedures.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_AC-01b\n53A_R5_AT-01b\n53A_R5_AU-01b\n53A_R5_CA-01b\n53A_R5_CM-01b\n53A_R5_CP-01b\n53A_R5_IA-01b\n53A_R5_IR-01b\n53A_R5_MA-01b\n53A_R5_MP-01b\n53A_R5_PE-01b\n53A_R5_PL-01b\n53A_R5_PS-01b\n53A_R5_PT-01b\n53A_R5_RA-01b\n53A_R5_SA-01b\n53A_R5_SC-01b\n53A_R5_SI-01b\n53A_R5_SR-01b", "defaultText": null }, { "id": 69082, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589765", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589766", "securityControlId": 30719, "ccis": [], "uuid": "a80e6f3b-868c-58ba-a967-ca1518f75896", "testId": "GOV-02_A17", "test": "an official to manage the governance of cybersecurity / data privacy policies and procedures is defined.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "53A_R5_AC-01_ODP[04]\n53A_R5_AT-01_ODP[04]\n53A_R5_AU-01_ODP[04]\n53A_R5_CA-01_ODP[04]\n53A_R5_CM-01_ODP[04]\n53A_R5_CP-01_ODP[04]\n53A_R5_IA-01_ODP[04]\n53A_R5_IR-01_ODP[04]\n53A_R5_MA-01_ODP[04]\n53A_R5_MP-01_ODP[04]\n53A_R5_PE-01_ODP[04]\n53A_R5_PL-01_ODP[04]\n53A_R5_PS-01_ODP[04]\n53A_R5_PT-01_ODP[04]\n53A_R5_RA-01_ODP[04]\n53A_R5_SA-01_ODP[04]\n53A_R5_SC-01_ODP[04]\n53A_R5_SI-01_ODP[04]\n53A_R5_SR-01_ODP[04]\n171A_3.4.9[a]\n171A_3.9.2[a]\n53A_R5_AC-02a.[03]\n53A_R5_AC-04(25)_ODP[02]\n53A_R5_IA-04(05)_ODP\n53A_R5_SR-11a.[03]", "defaultText": null }, { "id": 69083, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589766", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589766", "securityControlId": 30719, "ccis": [], "uuid": "3efdf008-5c62-5ed8-b285-24f6ee4a3e6e", "testId": "GOV-02_A18", "test": "policies needed to satisfy the security requirements for the protection of CUI are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.15.01.a[01]", "defaultText": null }, { "id": 69084, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589766", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589766", "securityControlId": 30719, "ccis": [], "uuid": "97e0838a-84ac-5236-961e-c30eb97f6f62", "testId": "GOV-02_A19", "test": "policies needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.15.01.a[02]", "defaultText": null }, { "id": 69085, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589766", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589766", "securityControlId": 30719, "ccis": [], "uuid": "33efc14e-621d-5efd-b12e-b11a950ab466", "testId": "GOV-02_A20", "test": "procedures needed to satisfy the security requirements for the protection of CUI are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.15.01.a[03]", "defaultText": null }, { "id": 69086, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589766", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589766", "securityControlId": 30719, "ccis": [], "uuid": "1a0f9093-f4f1-57e1-86ce-195a8fa9b275", "testId": "GOV-02_A21", "test": "procedures needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.15.01.a[04]", "defaultText": null } ], "externalMappings": [ { "id": 546455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581132", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "134c0871-d4a7-5387-8704-2df0fe04816a", "parentControlId": 30719, "controlId": "5.1(a)", "title": "5.1(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581132" }, { "id": 546456, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581132", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed963a9c-27fa-5ac6-93cc-05f18607d1d8", "parentControlId": 30719, "controlId": "5.2", "title": "5.2", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581132" }, { "id": 546457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581133", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "432e8ada-f02b-5810-b02c-d3dee9111fa2", "parentControlId": 30719, "controlId": "5.2(a)", "title": "5.2(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581133" }, { "id": 546458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581133", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d2af442-28ff-53f8-ac33-749f00cdfad5", "parentControlId": 30719, "controlId": "5.2(b)", "title": "5.2(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581133" }, { "id": 546459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581133", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "744ed161-8f12-569b-a697-d3297db89eff", "parentControlId": 30719, "controlId": "5.2(c)", "title": "5.2(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581133" }, { "id": 546460, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581133", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0ba6050-7acd-587f-9a23-6e85836c28cc", "parentControlId": 30719, "controlId": "5.2(d)", "title": "5.2(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581133" }, { "id": 546461, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581133", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19019e2b-af88-5502-8dc1-4cc8ce6cd2ed", "parentControlId": 30719, "controlId": "5.2(e)", "title": "5.2(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581133" }, { "id": 546462, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581134", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3771cc79-ea81-5e12-b08a-c74fb7fc40ad", "parentControlId": 30719, "controlId": "5.2(f)", "title": "5.2(f)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581134" }, { "id": 546463, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581134", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79da68fe-f5eb-5d8e-9f8e-abab9d4a9c87", "parentControlId": 30719, "controlId": "5.2(g)", "title": "5.2(g)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581134" }, { "id": 546464, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581134", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fa34a84-40bc-5f92-8bb6-c4e165f85d2c", "parentControlId": 30719, "controlId": "7.5.1", "title": "7.5.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581134" }, { "id": 546465, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581134", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10ea5712-c9f8-5a26-aca3-9637df445074", "parentControlId": 30719, "controlId": "7.5.1(a)", "title": "7.5.1(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581134" }, { "id": 546466, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581134", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8956c902-39e4-5b42-b0b0-e9884f4bd83d", "parentControlId": 30719, "controlId": "7.5.1(b)", "title": "7.5.1(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581134" }, { "id": 546467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581134", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed817731-c2c0-5e1c-851c-4e8cfa604ef2", "parentControlId": 30719, "controlId": "7.5.2", "title": "7.5.2", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581135" }, { "id": 546468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e62de2ee-0ac0-5d5f-973d-71647951cb37", "parentControlId": 30719, "controlId": "7.5.2(a)", "title": "7.5.2(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581135" }, { "id": 546469, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfcc2ab0-b1b7-56cb-be97-9deebf059b45", "parentControlId": 30719, "controlId": "7.5.2(b)", "title": "7.5.2(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581135" }, { "id": 546470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b410866b-a0ca-5648-8612-c62b17641aa7", "parentControlId": 30719, "controlId": "7.5.2(c)", "title": "7.5.2(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581135" }, { "id": 546471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ea921d5-146b-5646-aba2-11c7260f5355", "parentControlId": 30719, "controlId": "7.5.3", "title": "7.5.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581135" }, { "id": 546472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "007b5f54-5ce6-58bc-9d89-cb37bfd63b01", "parentControlId": 30719, "controlId": "7.5.3(a)", "title": "7.5.3(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581135" }, { "id": 546473, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b328e30-cbcf-517f-b3e1-a7274b4cb90f", "parentControlId": 30719, "controlId": "7.5.3(b)", "title": "7.5.3(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581135" }, { "id": 546474, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7af3a04-40f3-5cd4-84f7-e7636b20de67", "parentControlId": 30719, "controlId": "7.5.3(c)", "title": "7.5.3(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581135" }, { "id": 546475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c64c907-449f-56fb-bd36-fe927e6730aa", "parentControlId": 30719, "controlId": "7.5.3(d)", "title": "7.5.3(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581135" }, { "id": 546476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb759523-97c7-5ed7-86e9-8f25f52d3992", "parentControlId": 30719, "controlId": "7.5.3(e)", "title": "7.5.3(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581135" }, { "id": 546477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581136", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5a4ce4c-39c4-54e8-96d7-73327d1069cb", "parentControlId": 30719, "controlId": "7.5.3(f)", "title": "7.5.3(f)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581136" }, { "id": 546478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581136", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e16ad06c-f922-5dcf-a466-64d24a97a3d9", "parentControlId": 30719, "controlId": "5.1", "title": "5.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581136" }, { "id": 546479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581136", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da50137e-bf82-5309-8ad9-72ec484c0063", "parentControlId": 30719, "controlId": "5.37", "title": "5.37", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581136" }, { "id": 546542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "243ae7a1-ba1b-5ec6-9d31-57ffef6f60d7", "parentControlId": 30719, "controlId": "PM-1", "title": "PM-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581152" }, { "id": 546543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f5373e3-ef31-54c6-82c5-71ae6420313b", "parentControlId": 30719, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581152" }, { "id": 546544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50168bab-7e7e-55c4-8dcd-b3bd53993c52", "parentControlId": 30719, "controlId": "AT-01", "title": "AT-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581152" }, { "id": 546545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abeb974b-52c9-5044-82ce-96dd762b813e", "parentControlId": 30719, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581152" }, { "id": 546546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e359484-af94-5144-a500-e77cbf11cc3e", "parentControlId": 30719, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581152" }, { "id": 546547, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97facaff-23f5-53b9-b54e-d998ab4dd0d2", "parentControlId": 30719, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581152" }, { "id": 546548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1042892e-53ed-5dd6-8d59-d8c00de5a5df", "parentControlId": 30719, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581153" }, { "id": 546549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e527f840-7b5a-54f1-aa71-e4c06e476d7b", "parentControlId": 30719, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581153" }, { "id": 546550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a8a54d4-5954-51c0-a9fc-5de69e652ed8", "parentControlId": 30719, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581153" }, { "id": 546551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "742a8023-7e64-5cd9-8cfa-960423534183", "parentControlId": 30719, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581153" }, { "id": 546552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5353803a-d946-5f17-8f1d-23fc838cf350", "parentControlId": 30719, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581153" }, { "id": 546553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56b0e9da-3371-5914-ba1a-b83bb798d7f8", "parentControlId": 30719, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581153" }, { "id": 546554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "870b27e6-0d37-5e56-ab46-7b0a19f5487c", "parentControlId": 30719, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581153" }, { "id": 546555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac57162c-57cc-5fb4-9feb-3864150fa1e0", "parentControlId": 30719, "controlId": "PM-01", "title": "PM-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581153" }, { "id": 546556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "011843ac-ebe4-5581-b331-94eed8003f5d", "parentControlId": 30719, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581153" }, { "id": 546557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37e1af8b-f92e-5861-adb5-8db3660d325e", "parentControlId": 30719, "controlId": "PT-01", "title": "PT-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581154" }, { "id": 546558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "608203b9-7e6b-59f3-8683-f3d11e83a66c", "parentControlId": 30719, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581154" }, { "id": 546559, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e79afdb4-9e7f-5a67-9083-ddd236145216", "parentControlId": 30719, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581154" }, { "id": 546560, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d751f11-5f2f-532e-927d-b927b343288f", "parentControlId": 30719, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581154" }, { "id": 546561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99e41503-4b51-5b9d-bd0f-3ec89796cdcd", "parentControlId": 30719, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581154" }, { "id": 546562, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3b8b8bf-e24a-573d-891e-312ac36a039d", "parentControlId": 30719, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581154" }, { "id": 546583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581157", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b11d94c-e261-52a0-bcb0-03f362d7a8d0", "parentControlId": 30719, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581157" }, { "id": 546584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581157", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d8c09bb-1625-5461-be48-6eeeadad78dc", "parentControlId": 30719, "controlId": "AT-01", "title": "AT-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581157" }, { "id": 546585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581157", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d03f8ca8-8bb2-53f7-9792-f071ae1c8b3a", "parentControlId": 30719, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581157" }, { "id": 546586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581157", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d73f082-7703-5bd0-9e34-65de01562333", "parentControlId": 30719, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581157" }, { "id": 546587, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581157", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43977bc9-90a9-5720-b80e-12b2a3697500", "parentControlId": 30719, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581157" }, { "id": 546588, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581157", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7689236-0c1d-5b59-bf1b-28dd9d4cdc1a", "parentControlId": 30719, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581157" }, { "id": 546589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d733dc9a-8bc0-51d4-b6d7-6a2f57346c9f", "parentControlId": 30719, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581158" }, { "id": 546590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4c4361f-5a51-5122-83b3-c5f5e9c48444", "parentControlId": 30719, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581158" }, { "id": 546591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "530d9157-e3a2-513e-b033-e37f24c232bd", "parentControlId": 30719, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581158" }, { "id": 546592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ac58187-eebb-5b1f-863d-6116c0aecedb", "parentControlId": 30719, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581158" }, { "id": 546593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e71a4e7e-aa35-5ae2-961a-dda389b6f5d4", "parentControlId": 30719, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581158" }, { "id": 546594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90a3d3f1-9eb1-5b40-a4c4-45e15feb0329", "parentControlId": 30719, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581158" }, { "id": 546595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e297cea-8360-574c-ab48-483096cd09ea", "parentControlId": 30719, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581158" }, { "id": 546596, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581159", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7cc97baa-c926-57e5-b0cb-d5c055472b3f", "parentControlId": 30719, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581159" }, { "id": 546597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581159", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9872c585-b66a-5233-9137-806c4a945449", "parentControlId": 30719, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581159" }, { "id": 546598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581159", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b8601b6-7d6a-55f7-bf55-f23be7d0d41a", "parentControlId": 30719, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581159" }, { "id": 546599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581159", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d55274f-4107-5742-9a6a-b894738d48a2", "parentControlId": 30719, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581159" }, { "id": 546600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581159", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d901b6c0-c25d-5f94-916c-b49fe5e23ac4", "parentControlId": 30719, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581159" }, { "id": 546613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58116", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0e08e00-47c5-5169-b664-54d6cb92ea68", "parentControlId": 30719, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58116" }, { "id": 546614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62966a9d-df23-51b2-b583-0fe356d9abfa", "parentControlId": 30719, "controlId": "AT-01", "title": "AT-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581161" }, { "id": 546615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d77806e1-ed8f-5d26-8c83-44085e01e0ca", "parentControlId": 30719, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581161" }, { "id": 546616, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37b65706-2219-57bb-b4f5-b656915e690b", "parentControlId": 30719, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581161" }, { "id": 546617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d184530b-fb5c-52c6-93b6-0718f8340ac6", "parentControlId": 30719, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581161" }, { "id": 546618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d32d0633-24eb-5cb0-81f6-90fc96d33b84", "parentControlId": 30719, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581161" }, { "id": 546619, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b9ccdb2-b039-5f8a-b405-d9bcb357e492", "parentControlId": 30719, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581161" }, { "id": 546620, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6dda4b75-e833-55bf-af07-fe3ec871bd87", "parentControlId": 30719, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581161" }, { "id": 546621, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "947cffd8-fd45-501e-ae92-6f157965406d", "parentControlId": 30719, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581161" }, { "id": 546622, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7bfcd3d9-c5ad-5861-8c75-7537f77b47f3", "parentControlId": 30719, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581162" }, { "id": 546623, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74d72409-0e01-5697-a7cb-be55f1cde83b", "parentControlId": 30719, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581162" }, { "id": 546624, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70e9fa9a-9ec5-5de2-8d7d-a4e13357ed3b", "parentControlId": 30719, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581162" }, { "id": 546625, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92538ae2-ec25-559c-a31b-0503888a907a", "parentControlId": 30719, "controlId": "PM-01", "title": "PM-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581162" }, { "id": 546626, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b91735c2-c5d1-55d2-b15b-96fe1a069369", "parentControlId": 30719, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581162" }, { "id": 546627, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2707240-d2df-5d0e-929f-b7b2a4dd72c4", "parentControlId": 30719, "controlId": "PT-01", "title": "PT-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581162" }, { "id": 546628, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88b417fc-23de-544f-953c-070bfacb37a3", "parentControlId": 30719, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581162" }, { "id": 546629, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cb6e568-6e85-5c82-a4b3-0273e4c85e47", "parentControlId": 30719, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581162" }, { "id": 546630, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f397eb0b-893f-5a5f-ab23-16a06da3f8af", "parentControlId": 30719, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581162" }, { "id": 546631, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c192f39-94ac-5aef-95ac-d81b81ab33ff", "parentControlId": 30719, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581163" }, { "id": 546632, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdda6ffd-75e1-50fa-ba1a-81c4909f82e3", "parentControlId": 30719, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581163" }, { "id": 546633, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f94738a7-b306-56a3-936d-f7d0e6ca3dee", "parentControlId": 30719, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581163" }, { "id": 546634, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1a2f3a1-1bc2-56bc-935d-b5ed646f9e26", "parentControlId": 30719, "controlId": "AT-01", "title": "AT-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581163" }, { "id": 546635, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a49d526-2141-587b-bcd1-3e4058f8ff4c", "parentControlId": 30719, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581163" }, { "id": 546636, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38197cf2-669e-5375-9606-c596c860270e", "parentControlId": 30719, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581163" }, { "id": 546637, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9dc2b928-31f0-51fb-8516-615ec72fbbe0", "parentControlId": 30719, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581163" }, { "id": 546638, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4963086-49dd-588c-96ab-5ed3e0c46896", "parentControlId": 30719, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581163" }, { "id": 546639, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e5beb06-644c-50b1-bee6-83d17a53f7ed", "parentControlId": 30719, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581163" }, { "id": 546640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d5a87b9-d4bd-5136-874d-7591f574d62f", "parentControlId": 30719, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581164" }, { "id": 546641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e25596f7-30b9-52b4-9147-2102e0c5439c", "parentControlId": 30719, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581164" }, { "id": 546642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d350742-212b-539a-b2d5-eb2bb539c08a", "parentControlId": 30719, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581164" }, { "id": 546643, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d864c11-ed63-574e-8fb3-c5fad503894d", "parentControlId": 30719, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581164" }, { "id": 546644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d044b4d3-cb70-557d-8a16-f6c560fe4566", "parentControlId": 30719, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581164" }, { "id": 546645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55caa900-3b4b-56c8-b80f-b68df90818ba", "parentControlId": 30719, "controlId": "PM-01", "title": "PM-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581164" }, { "id": 546646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0472ea49-904a-5095-851f-b79e99954bae", "parentControlId": 30719, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581164" }, { "id": 546647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e5d38a8-7929-5ac7-b79e-0baa4e141c22", "parentControlId": 30719, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581164" }, { "id": 546648, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d995cbd-390e-57e2-be52-3652e62f0edc", "parentControlId": 30719, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581165" }, { "id": 546649, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98de30c3-19fa-500d-be23-3150d8d6e12c", "parentControlId": 30719, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581165" }, { "id": 546650, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46d75a31-c430-5d8e-9785-f8dabe80b139", "parentControlId": 30719, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581165" }, { "id": 546651, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ec456a2-4dee-539a-ba69-105d141eeb7a", "parentControlId": 30719, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581165" }, { "id": 546652, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f92bc7e9-6cfb-5109-955f-54ceb3544c43", "parentControlId": 30719, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581165" }, { "id": 546653, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c552292a-b168-5377-96f9-856914251352", "parentControlId": 30719, "controlId": "AT-01", "title": "AT-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581165" }, { "id": 546654, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83fbb395-0d56-5f1c-a53c-d2b04484ed5f", "parentControlId": 30719, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581165" }, { "id": 546655, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "896f975d-19bc-5804-a2b3-26a386bc9d76", "parentControlId": 30719, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581165" }, { "id": 546656, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92ad9b7e-727e-50e0-add6-7de5b3784564", "parentControlId": 30719, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581165" }, { "id": 546657, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0b69a2d-cbde-5347-aca9-d984d38d86fe", "parentControlId": 30719, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581165" }, { "id": 546658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581166", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa846b09-624f-5933-b096-608a1e88fd48", "parentControlId": 30719, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581166" }, { "id": 546659, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581166", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3841f6f-12d3-5005-9d42-0c4cf381e986", "parentControlId": 30719, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581166" }, { "id": 546660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581166", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eede5f77-0267-51b7-b173-6a1caa505a02", "parentControlId": 30719, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581166" }, { "id": 546661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581166", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a2da13a-aade-59ee-902a-8ec5d11392bb", "parentControlId": 30719, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581166" }, { "id": 546662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581166", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29d6cd21-6ef1-500f-9af0-7cca7f780b94", "parentControlId": 30719, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581166" }, { "id": 546663, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581166", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb860867-f779-59e9-95ef-20de7d7d1f3d", "parentControlId": 30719, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581166" }, { "id": 546664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581166", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f3f518e-076c-5c01-99fe-844a9410608f", "parentControlId": 30719, "controlId": "PM-01", "title": "PM-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581166" }, { "id": 546665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581166", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07bf9b73-0984-5bf3-abae-eb4d25fe1c86", "parentControlId": 30719, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581166" }, { "id": 546666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d4a4464-af45-5fb7-9b13-b410514838f3", "parentControlId": 30719, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581167" }, { "id": 546667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ff5f1ea-da69-56eb-9e15-0664de6ca593", "parentControlId": 30719, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581167" }, { "id": 546668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50e5f2e6-88dd-5f37-8357-f438a1e24846", "parentControlId": 30719, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581167" }, { "id": 546669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bcaf0f2f-26b5-5c13-a887-c11c95dc8b08", "parentControlId": 30719, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581167" }, { "id": 546670, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ade4704a-14de-5167-bd78-e5c7cb6b0285", "parentControlId": 30719, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581167" }, { "id": 546671, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bab5bcdd-91fa-5e77-aa48-0f731743a0cc", "parentControlId": 30719, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581167" }, { "id": 546672, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6df791a6-dd1e-5727-93f3-39688c599a3f", "parentControlId": 30719, "controlId": "AT-01", "title": "AT-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581168" }, { "id": 546673, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b406808a-7929-5598-b6be-9b9760426a83", "parentControlId": 30719, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581168" }, { "id": 546674, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89af4ec8-f566-56a3-849c-53f84124becd", "parentControlId": 30719, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581168" }, { "id": 546675, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04177f04-943a-52ec-9d9c-5f9de4e1bfa2", "parentControlId": 30719, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581168" }, { "id": 546676, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "868f85e1-8b02-5ef5-a512-301b8ac741b1", "parentControlId": 30719, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581168" }, { "id": 546677, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "edf027a1-cf86-52f1-9146-39d927c53e19", "parentControlId": 30719, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581168" }, { "id": 546678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63a30f8d-0311-5598-b597-45978eb2fd30", "parentControlId": 30719, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581168" }, { "id": 546679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5eb601f6-dba5-577b-a5a7-090a6ae1fd68", "parentControlId": 30719, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581168" }, { "id": 546680, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "212ec85c-62a7-5a0b-8842-f211ffbab36d", "parentControlId": 30719, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581168" }, { "id": 546681, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c65876e9-0367-518f-bb67-423744385528", "parentControlId": 30719, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581168" }, { "id": 546682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa6a44d5-f244-50d6-bddb-c585cd78f7cb", "parentControlId": 30719, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581169" }, { "id": 546683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82509fea-8a4e-5661-b571-346d4d885571", "parentControlId": 30719, "controlId": "PM-01", "title": "PM-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581169" }, { "id": 546684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "624e22f2-b25a-5432-a51e-83d748cb0fc4", "parentControlId": 30719, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581169" }, { "id": 546685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7995265-f94c-5b62-8ee8-8dafb2a4b807", "parentControlId": 30719, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581169" }, { "id": 546686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d67a5eb1-6c81-519e-be78-3ea10ca94f74", "parentControlId": 30719, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581169" }, { "id": 546687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1afe8a87-258c-5e84-8125-a039136e81cc", "parentControlId": 30719, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581169" }, { "id": 546688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39ea23b6-3d32-5aa6-bab3-cd00be0ea624", "parentControlId": 30719, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581169" }, { "id": 546689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b192e1a2-ba3c-5a77-8526-8090eb48f99e", "parentControlId": 30719, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581169" }, { "id": 546690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3f0059b-085f-5076-a803-792e811f734a", "parentControlId": 30719, "controlId": "AC-1", "title": "AC-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581169" }, { "id": 546691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2aee92f5-26fe-5b49-bae0-8f2b4d32563e", "parentControlId": 30719, "controlId": "AT-1", "title": "AT-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58117" }, { "id": 546692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5de6d4e0-5c34-5987-95fb-d5bd13bfca6e", "parentControlId": 30719, "controlId": "AU-1", "title": "AU-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58117" }, { "id": 546693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4a3af7a-e933-50a6-89f8-202dda946d0a", "parentControlId": 30719, "controlId": "CA-1", "title": "CA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58117" }, { "id": 546694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c70e12c4-d6e6-52c4-a9ef-b1a83bb0e818", "parentControlId": 30719, "controlId": "CM-1", "title": "CM-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58117" }, { "id": 546695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "302bde01-01f8-5d3e-ac7f-875f71a9f27b", "parentControlId": 30719, "controlId": "CP-1", "title": "CP-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58117" }, { "id": 546696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "baf2455d-3077-50ce-a7a6-f3160c1ed21a", "parentControlId": 30719, "controlId": "IA-1", "title": "IA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58117" }, { "id": 546697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df230ae8-ebbc-5b47-9067-fbedcb7027f1", "parentControlId": 30719, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58117" }, { "id": 546698, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49dbc858-1b53-5434-8565-3390cc24d506", "parentControlId": 30719, "controlId": "MA-1", "title": "MA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58117" }, { "id": 546699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73fda2ec-25f6-5241-a362-6cb1ab164c2a", "parentControlId": 30719, "controlId": "MP-1", "title": "MP-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581171" }, { "id": 546700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a82296e1-ec55-5fdf-b517-7f36778a9f0b", "parentControlId": 30719, "controlId": "PE-1", "title": "PE-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581171" }, { "id": 546701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2df0b0c7-ee72-5c1b-a1dd-54d2647f198b", "parentControlId": 30719, "controlId": "PL-1", "title": "PL-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581171" }, { "id": 546702, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fb70ba4-88a3-5589-b455-2b3f5d677c6a", "parentControlId": 30719, "controlId": "PS-1", "title": "PS-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581171" }, { "id": 546703, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ada315ab-46a3-5254-883c-8c367a7d8de4", "parentControlId": 30719, "controlId": "RA-1", "title": "RA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581171" }, { "id": 546704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e79f317b-2517-5757-b365-847a9a516901", "parentControlId": 30719, "controlId": "SC-1", "title": "SC-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581171" }, { "id": 546705, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6faca2c-db52-5ffb-9962-1f138167639a", "parentControlId": 30719, "controlId": "SI-1", "title": "SI-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581171" }, { "id": 546706, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82cd25a1-8953-57fb-820c-0340dfd25d9a", "parentControlId": 30719, "controlId": "SR-1", "title": "SR-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581171" }, { "id": 546707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "093787ba-d86f-5c18-b158-9e7593c17c56", "parentControlId": 30719, "controlId": "AC-1", "title": "AC-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581171" }, { "id": 546708, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db635352-ac3b-54f7-ab0a-682f8525cae2", "parentControlId": 30719, "controlId": "AT-1", "title": "AT-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581172" }, { "id": 546709, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1e2d2ad-bc22-595e-926e-2dd89cd89f34", "parentControlId": 30719, "controlId": "AU-1", "title": "AU-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581172" }, { "id": 546710, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf7e59f0-21ba-565c-91bd-82e948541416", "parentControlId": 30719, "controlId": "CA-1", "title": "CA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581172" }, { "id": 546711, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c8c8e95-4782-5a2e-abba-a2ede0eae594", "parentControlId": 30719, "controlId": "CM-1", "title": "CM-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581172" }, { "id": 546712, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e617841f-5fc5-5700-a2c7-4701215e4a31", "parentControlId": 30719, "controlId": "CP-1", "title": "CP-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581172" }, { "id": 546713, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b883b87d-e63f-592f-bb76-950b5255b17c", "parentControlId": 30719, "controlId": "IA-1", "title": "IA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581172" }, { "id": 546714, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b1f2e44-d133-5ec7-a162-ab75acd5cac6", "parentControlId": 30719, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581172" }, { "id": 546715, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73a369b0-2201-5715-9ed2-d80565267b4d", "parentControlId": 30719, "controlId": "MA-1", "title": "MA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581172" }, { "id": 546716, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581173", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b459dc2-a4ca-5084-897b-daad5c6a746e", "parentControlId": 30719, "controlId": "MP-1", "title": "MP-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581173" }, { "id": 546717, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581173", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c64fe59-b9bf-554e-a39a-da32f1db5ffc", "parentControlId": 30719, "controlId": "PE-1", "title": "PE-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581173" }, { "id": 546718, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581173", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59465c0a-ce92-5f18-89aa-07406df30181", "parentControlId": 30719, "controlId": "PL-1", "title": "PL-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581173" }, { "id": 546719, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581173", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40436db1-5eea-554f-802c-e6ad48ccf5ae", "parentControlId": 30719, "controlId": "PS-1", "title": "PS-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581173" }, { "id": 546720, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581173", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94d24c81-191a-5b61-84a3-93f1549de04b", "parentControlId": 30719, "controlId": "RA-1", "title": "RA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581173" }, { "id": 546721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581173", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "815ff389-d2fe-5af1-bb89-8a67415941fa", "parentControlId": 30719, "controlId": "SC-1", "title": "SC-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581173" }, { "id": 546722, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581173", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b25fab84-76f2-5235-bf5c-d61aea94b2ab", "parentControlId": 30719, "controlId": "SI-1", "title": "SI-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581173" }, { "id": 546723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581173", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52ecd0d9-2861-5f9b-a9ab-63aae26d012d", "parentControlId": 30719, "controlId": "SR-1", "title": "SR-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581173" }, { "id": 546724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581173", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2657e766-73de-5ae7-869e-cd0c373ba9d4", "parentControlId": 30719, "controlId": "AC-1", "title": "AC-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581173" }, { "id": 546725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581173", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1b6ca1d-092a-51e8-a2d5-d6c1397ba3d4", "parentControlId": 30719, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581173" }, { "id": 546726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581174", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e94e1cb-1b6c-5f68-9240-72ac7c038823", "parentControlId": 30719, "controlId": "MA-1", "title": "MA-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581174" }, { "id": 546727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581174", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e58d9f9b-b76b-5cd0-8abe-6807e761f620", "parentControlId": 30719, "controlId": "PS-1", "title": "PS-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581174" }, { "id": 546775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581179", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37636f85-2a9a-5ccb-a757-27e1c25b708a", "parentControlId": 30719, "controlId": "03.15.01.a", "title": "03.15.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581179" }, { "id": 546782, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cf630d2-6b99-5ce7-8582-f2f5f0bc82b4", "parentControlId": 30719, "controlId": "GV.PO", "title": "GV.PO", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58118" }, { "id": 546783, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8a03d4e-c916-516b-b02c-8f213b8568d0", "parentControlId": 30719, "controlId": "GV.PO-01", "title": "GV.PO-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58118" }, { "id": 546784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "096f1d4f-d8ae-58e2-a086-b7fb6fc62902", "parentControlId": 30719, "controlId": "GV.SC-01", "title": "GV.SC-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58118" }, { "id": 546785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c76aa300-d46f-52b8-aff8-6ad2d8e92de0", "parentControlId": 30719, "controlId": "GV.SC-03", "title": "GV.SC-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58118" }, { "id": 546786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da5f0ddb-e929-5c27-ad7b-684992cda061", "parentControlId": 30719, "controlId": "ID.RA", "title": "ID.RA", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58118" }, { "id": 546925, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581206", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad54e142-5736-5c04-9821-c77f9b19b663", "parentControlId": 30719, "controlId": "ASSET-5c", "title": "ASSET-5c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581206" }, { "id": 546926, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581206", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d9bd13d-cd82-5900-bc88-0630538dcae6", "parentControlId": 30719, "controlId": "THREAT-3c", "title": "THREAT-3c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581206" }, { "id": 546927, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581206", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "145213ba-6063-5b51-815e-c7367a6b2d24", "parentControlId": 30719, "controlId": "RISK-5c", "title": "RISK-5c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581206" }, { "id": 546928, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581206", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b228544-8b3f-5ff9-b027-301eb8c75543", "parentControlId": 30719, "controlId": "ACCESS-4c", "title": "ACCESS-4c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581206" }, { "id": 546929, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31e93601-0158-517a-849f-2542097897b4", "parentControlId": 30719, "controlId": "SITUATION-4c", "title": "SITUATION-4c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581207" }, { "id": 546930, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5f8e6a9-2f1a-58f0-a61a-63c79b470224", "parentControlId": 30719, "controlId": "RESPONSE-5c", "title": "RESPONSE-5c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581207" }, { "id": 546931, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25cdb91b-d1a9-5b42-ad61-342fb7d14d9e", "parentControlId": 30719, "controlId": "THIRD-PARTIES-3c", "title": "THIRD-PARTIES-3c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581207" }, { "id": 546932, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6596ccd7-644d-54e0-bc73-f504e7c16afc", "parentControlId": 30719, "controlId": "WORKFORCE-5c", "title": "WORKFORCE-5c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581207" }, { "id": 546933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3b29fd7-f7f4-5fd0-96b5-11f7a8813788", "parentControlId": 30719, "controlId": "ARCHITECTURE-6c", "title": "ARCHITECTURE-6c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581207" }, { "id": 546934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7e64b14-cd64-518c-8180-0ee6e71d1ac5", "parentControlId": 30719, "controlId": "PROGRAM-3c", "title": "PROGRAM-3c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581207" }, { "id": 547138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e4fd47a-f449-5838-b698-ac16c4a6b7a3", "parentControlId": 30719, "controlId": "§117.18(b)(1)", "title": "§117.18(b)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581234" }, { "id": 547139, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1d0e627-eba5-5b57-94e1-31150f8cf0c3", "parentControlId": 30719, "controlId": "13-2.b(2)", "title": "13-2.b(2)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581234" }, { "id": 547354, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4646e307-f187-572e-91dc-17eec00f0355", "parentControlId": 30719, "controlId": "A1", "title": "A1", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581268" }, { "id": 547355, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c96b224-d333-51e1-895e-e28d8b129fbe", "parentControlId": 30719, "controlId": "B1", "title": "B1", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581268" }, { "id": 547356, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd1b333a-71c9-56e0-9e48-e60c2f920dd5", "parentControlId": 30719, "controlId": "B1.b", "title": "B1.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581269" }, { "controlId": "A.3.1.2", "title": "A.3.1.2 — Cyber Security Team", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-2, PS-2, AT-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "6f78449a-f4fa-5ad8-8867-6f014938978a", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.2", "title": "NEI 08-09 Sec 3.1.2 — Cyber Security Team", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d2f21c20-04ae-501e-834b-608788e3f77f", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(1)", "title": "10 CFR 73.54(d)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "a7fe3c41-c7bb-588a-bddf-deca16564e1e", "isPublic": true }, { "controlId": "C.10.5", "title": "C.10.5 — Cross-Functional Cyber Security Team", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-2, AT-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "28382275-8e7f-55d7-a217-51ecf4d8f487", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.5", "title": "NEI 08-09 App E.10.5 — Cross-Functional Cyber Security Team", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "776883b9-98d3-5e80-820e-bb09bd573019", "isPublic": true }, { "controlId": "C.10.10", "title": "C.10.10 — Roles and Responsibilities", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PS-2, PM-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "919e9bc2-bcf9-5bdb-928c-a6c8d8141d12", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.10", "title": "NEI 08-09 App E.10.10 — Roles and Responsibilities", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.10", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "1c973818-0cc8-505c-8688-085a8e4679db", "isPublic": true }, { "controlId": "CIP-003-8-R3", "title": "CIP-003-8-R3 — Delegation of CIP Senior Manager Authority", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c00b40c4-0788-530b-a6c8-b0bf700f981e", "isPublic": true }, { "controlId": "CIP-003-8-R4", "title": "CIP-003-8-R4 — CIP Senior Manager Identification and Change Delegation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "22e43e7d-4e00-53bb-a495-5c38dfa394a5", "isPublic": true }, { "controlId": "NSS-17T-Sec4.1", "title": "NSS-17T-Sec4.1 — Computer Security Program Management & Policy", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "0b2bd775-1395-5882-8127-0ca8eb5f4629", "isPublic": true }, { "controlId": "IEC-62645-5.1", "title": "IEC-62645-5.1 — Nuclear Plant Level Computer Security Programme", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "6a1acc5d-3c2a-50d4-8844-6c2e1c56c411", "isPublic": true }, { "controlId": "IEC-63096-5.1", "title": "IEC-63096-5.1 — Information Security Policies for Nuclear Facilities", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "1d330371-bcc3-573e-84b6-79082e4a42f5", "isPublic": true }, { "controlId": "10-CFR-73.100(b)", "title": "10-CFR-73.100(b) — Performance-Based Cybersecurity Program for Advanced Reactors", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "79e64540-be5d-5557-8fb2-a42df3d6e0b5", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.a", "title": "DOE-O-205.1D-4.a — Enterprise Cybersecurity Risk Management & Governance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "38858eb9-16c9-56da-8d21-5be04e60e885", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3", "title": "REGDOC-2.12.1-Sec3 — Cyber Security Program Governance & Organization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "1ec62102-2073-5d8c-b0c4-0443bfcf93e0", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP1", "title": "ONR-SyAP-FSyP1 — Leadership and Management for Security (CS&IA)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "2dd6ca34-a1be-58c4-8e34-c789500ebd0a", "isPublic": true } ], "id": 30719, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730822", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730822", "catalogueId": 1062, "uuid": "ecee014f-d8ef-5dad-a1e7-2bef2bc0d0e4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Publishing Security, Compliance & Resilience Documentation", "description": "

Control Description

Mechanisms exist to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.

Evidence Request List (ERL)

E-GOV-08\nE-GOV-09\nE-GOV-11

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cybersecurity & Data Protection Governance (GOV) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with GOV domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Governance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT/cybersecurity personnel.\n▪ Cybersecurity and data protection governance is informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ Basic procedures are established for important tasks, but are ad hoc and not formally documented.\n▪ No formal cybersecurity and/or data protection principles are identified for the organization.\n▪ Informal recommendations are leveraged to update existing policies and standards.\n▪ The responsibility for developing and operating cybersecurity and data privacy procedures are up to the business process owner(s) to determine, including the definition and enforcement of roles and responsibilities.\n▪ Governance documentation is made available to internal personnel (e.g., policies, standards, procedures, etc.).\n▪ People affected by documentation changes are provided notification of the policy and standard changes.

Level 2 - Planned & Tracked: Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel ensure cybersecurity policies and standards are aligned with a leading cybersecurity framework (e.g., SCF, NIST 800-53, NIST 800-171, ISO 27002 or NIST Cybersecurity Framework).\n▪ The organization's cybersecurity policies and standards are made available to internal personnel.\n▪ Documented procedures exist for requesting a deviation from approved standards.\n▪ The responsibility for enforcing cybersecurity and data protection control implementation is assigned to business / process owners and asset custodians.

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to establish, maintain and disseminate policies, standards and procedures necessary for secure, compliant and resilient capabilities.

Level 4 - Quantitatively Controlled: Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.2, C.10.5, C.10.10
NERC-CIP (2026) Requirements: CIP-003-8-R3, CIP-003-8-R4", "controlId": "GOV-02", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-02", "references": "

Micro-Small Business (<10 staff)

∙ ComplianceForge - Cybersecurity & Data Protection Program (CDPP) (https://complianceforge.com)\n∙ SCFConnect (https://scfconnect.com)\n∙ Shared drive or intranet for policy distribution (e.g., Google Drive, SharePoint Online)

Small Business (10-49 staff)

∙ ComplianceForge - Cybersecurity & Data Protection Program (CDPP) (https://complianceforge.com)\n∙ SCFConnect (https://scfconnect.com)\n∙ Document management system (e.g., SharePoint, Confluence, Notion)

Medium Business (50-249 staff)

∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)\n∙ ComplianceForge - Cybersecurity & Data Protection Program (CDPP) (https://complianceforge.com)\n∙ Document management / intranet portal (e.g., SharePoint, Confluence)\n∙ Policy acknowledgement tracking (e.g., KnowBe4, Absorb LMS)

Large Business (250-999 staff)

∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)\n∙ Policy management platform\n∙ Version-controlled policy repository with access controls\n∙ Automated policy attestation and acknowledgement tracking

Enterprise (>1,000 staff)

∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)\n∙ Enterprise policy management platform\n∙ Integrated GRC policy module with automated review workflows\n∙ Enterprise-wide policy acknowledgement and training integration", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69087, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589767", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589767", "securityControlId": 30720, "ccis": [], "uuid": "9b0a7a97-8583-50af-9f77-1e9fb87f5282", "testId": "GOV-02.1_A01", "test": "exception requests to standards are formally submitted for review, along with a business justification for the deviation and proposed compensating controls.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69088, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589767", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589767", "securityControlId": 30720, "ccis": [], "uuid": "f99bb301-9213-513d-adc2-1d9f78ae345e", "testId": "GOV-02.1_A02", "test": "the exception request undergoes a risk assessment to evaluate the business justification and proposed compensating controls.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69089, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589767", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589767", "securityControlId": 30720, "ccis": [], "uuid": "7ceea7e3-6f32-5c13-ad5f-bb065a1c67f4", "testId": "GOV-02.1_A03", "test": "a documented determination is made to approve or deny the exception request.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69090, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589767", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589767", "securityControlId": 30720, "ccis": [], "uuid": "c677ee24-fe25-593b-8eeb-9737eb18ba07", "testId": "GOV-02.1_A04", "test": "the requestor of the exception is provided a response on the determination including required actions, if applicable.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 547419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a87b718-245a-56f3-81af-1fd866efd1c7", "parentControlId": 30720, "controlId": "ID.RA-07", "title": "ID.RA-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581276" } ], "id": 30720, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730823", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730823", "catalogueId": 1062, "uuid": "339b8e43-f013-5bce-a781-cba6540423a2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prohibit exceptions to standards, except when the exception has been formally assessed for risk impact, approved and recorded?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Exception Management", "description": "

Control Description

Mechanisms exist to prohibit exceptions to standards, except when the exception has been formally assessed for risk impact, approved and recorded.

Evidence Request List (ERL)

E-GOV-18

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cybersecurity & Data Protection Governance (GOV) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with GOV domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Governance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT/cybersecurity personnel.\n▪ Cybersecurity and data protection governance is informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ Cybersecurity and data privacy governance practices are informally assigned as an additional duty to existing IT/cybersecurity personnel.

Level 2 - Planned & Tracked: Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to prohibit exceptions to standards, except when the exception has been formally assessed for risk impact, approved and recorded.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "GOV-02.1", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Manual exception management process\n∙ Documented exception request form (Word/PDF template)\n∙ SCFConnect (https://scfconnect.com)

Small Business (10-49 staff)

∙ Manual exception management process\n∙ Formalized exception request and approval workflow\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Medium Business (50-249 staff)

∙ Documented exception management process with approval authority matrix\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Risk acceptance tracking with time-bound exceptions

Large Business (250-999 staff)

∙ Formal exception management program with defined risk acceptance criteria\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Time-limited exceptions with mandatory compensating controls\n∙ Periodic exception review and recertification process

Enterprise (>1,000 staff)

∙ Enterprise exception management program integrated with GRC platform\n∙ Automated exception workflows with defined approval chains\n∙ Exception-to-risk register linkage with ongoing monitoring\n∙ Audit-ready exception documentation and closure tracking", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69091, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589768", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589768", "securityControlId": 30721, "ccis": [], "uuid": "a0c6603f-c5a0-5a99-b85c-3e5044fcd959", "testId": "GOV-03_A01", "test": "the frequency at which the policies and procedures for satisfying security requirements are reviewed and updated is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "171A_R3_A.03.15.01.ODP[01]\n53A_R5_AC-01_ODP[05]\n53A_R5_AT-01_ODP[05]\n53A_R5_AU-01_ODP[05]\n53A_R5_CA-01_ODP[05]\n53A_R5_CM-01_ODP[05]\n53A_R5_CP-01_ODP[05]\n53A_R5_IA-01_ODP[05]\n53A_R5_IR-01_ODP[05]\n53A_R5_MA-01_ODP[05]\n53A_R5_MP-01_ODP[05]\n53A_R5_PE-01_ODP[05]\n53A_R5_PL-01_ODP[05]\n53A_R5_PS-01_ODP[05]\n53A_R5_PT-01_ODP[05]\n53A_R5_RA-01_ODP[05]\n53A_R5_SA-01_ODP[05]\n53A_R5_SC-01_ODP[05]\n53A_R5_SI-01_ODP[05]\n53A_R5_SR-01_ODP[05]", "defaultText": null }, { "id": 69092, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589768", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589768", "securityControlId": 30721, "ccis": [], "uuid": "f6ed8450-5c4e-59e9-aede-167223222c42", "testId": "GOV-03_A02", "test": "policies and procedures are reviewed / updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: Review policies, standards and procedures at least annual and following significant changes", "otherId": "53A_R5_AC-01c.01[01]\n53A_R5_AC-01c.01[02]\n53A_R5_AT-01c.01[01]\n53A_R5_AT-01c.01[02]\n53A_R5_AU-01c.01[01]\n53A_R5_AU-01c.01[02]\n53A_R5_CA-01c.01[01]\n53A_R5_CA-01c.01[02]\n53A_R5_CM-01c.01[01]\n53A_R5_CM-01c.01[02]\n53A_R5_CP-01c.01[01]\n53A_R5_CP-01c.01[02]\n53A_R5_IA-01c.01[01]\n53A_R5_IA-01c.01[02]\n53A_R5_IR-01c.01[01]\n53A_R5_IR-01c.01[02]\n53A_R5_MA-01c.01[01]\n53A_R5_MA-01c.01[02]\n53A_R5_MP-01c.01[01]\n53A_R5_MP-01c.01[02]\n53A_R5_PE-01c.01[01]\n53A_R5_PE-01c.01[02]\n53A_R5_PL-01c.01[01]\n53A_R5_PL-01c.01[02]\n53A_R5_PS-01c.01[01]\n53A_R5_PS-01c.01[02]\n53A_R5_PT-01c.01[01]\n53A_R5_PT-01c.01[02]\n53A_R5_RA-01c.01[01]\n53A_R5_RA-01c.01[02]\n53A_R5_SA-01c.01[01]\n53A_R5_SA-01c.01[02]\n53A_R5_SC-01c.01[01]\n53A_R5_SC-01c.01[02]\n53A_R5_SI-01c.01[01]\n53A_R5_SI-01c.01[02]\n53A_R5_SR-01c.01[01]\n53A_R5_SR-01c.01[02]", "defaultText": null }, { "id": 69093, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589768", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589768", "securityControlId": 30721, "ccis": [], "uuid": "c4ab1970-b6e7-56b8-9a5b-eec054795f69", "testId": "GOV-03_A03", "test": "events that would require the current cybersecurity / data privacy policies to be reviewed / updated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-01_ODP[06]\n53A_R5_AT-01_ODP[06]\n53A_R5_AU-01_ODP[06]\n53A_R5_CA-01_ODP[06]\n53A_R5_CM-01_ODP[06]\n53A_R5_CP-01_ODP[06]\n53A_R5_IA-01_ODP[06]\n53A_R5_IR-01_ODP[06]\n53A_R5_MA-01_ODP[06]\n53A_R5_MP-01_ODP[06]\n53A_R5_PE-01_ODP[06]\n53A_R5_PL-01_ODP[06]\n53A_R5_PS-01_ODP[06]\n53A_R5_PT-01_ODP[06]\n53A_R5_RA-01_ODP[06]\n53A_R5_SA-01_ODP[06]\n53A_R5_SC-01_ODP[06]\n53A_R5_SI-01_ODP[06]\n53A_R5_SR-01_ODP[06]", "defaultText": null }, { "id": 69094, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589769", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589769", "securityControlId": 30721, "ccis": [], "uuid": "d2653f3f-233f-5521-bd4d-a0c6a24452df", "testId": "GOV-03_A04", "test": "policies and procedures are reviewed .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months, or when there are significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.15.01.b[01]", "defaultText": null }, { "id": 69095, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589769", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589769", "securityControlId": 30721, "ccis": [], "uuid": "67abd801-7476-51b1-9fa9-46728d036339", "testId": "GOV-03_A05", "test": "policies and procedures are updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months, or when there are significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.15.01.b[02]", "defaultText": null } ], "externalMappings": [ { "id": 547550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581301", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3489b4b3-34e0-5fd0-ab0d-ec41ae09a751", "parentControlId": 30721, "controlId": "7.5.2", "title": "7.5.2", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581301" }, { "id": 547551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581301", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ede1d207-20a0-57cd-bc7e-5d9ddd118adf", "parentControlId": 30721, "controlId": "7.5.2(a)", "title": "7.5.2(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581301" }, { "id": 547552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581301", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a5f30c9-101a-5905-8dbe-2612ba6c952c", "parentControlId": 30721, "controlId": "7.5.2(b)", "title": "7.5.2(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581301" }, { "id": 547553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a123fa2a-2b9d-5a48-b21e-f1ba8bd6fa62", "parentControlId": 30721, "controlId": "7.5.2(c)", "title": "7.5.2(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581302" }, { "id": 547554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78386813-c342-5e91-b89b-89be140070a6", "parentControlId": 30721, "controlId": "5.1", "title": "5.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581302" }, { "id": 547555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da246019-88b5-5772-8975-23545d647f00", "parentControlId": 30721, "controlId": "5.37", "title": "5.37", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581302" }, { "id": 547565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5dec1ab-0769-5681-85b9-2a19deaa7421", "parentControlId": 30721, "controlId": "PM-1", "title": "PM-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581303" }, { "id": 547566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77320c55-aecf-576d-bf86-c96039edd294", "parentControlId": 30721, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581303" }, { "id": 547567, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6767741a-0957-5423-892b-010fdfd4ba13", "parentControlId": 30721, "controlId": "AT-01", "title": "AT-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581303" }, { "id": 547568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "965ad3e5-d159-5b4b-ba00-80fd99da2b25", "parentControlId": 30721, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581303" }, { "id": 547569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee597352-eddf-5def-95f0-6c58cb0c3d1f", "parentControlId": 30721, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581303" }, { "id": 547570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a400d8d-230a-5d2e-ae0c-a6f0d1302f14", "parentControlId": 30721, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581304" }, { "id": 547571, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62b86ddc-99c6-5e50-abb2-1aa1087dff3d", "parentControlId": 30721, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581304" }, { "id": 547572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7cd0f35-9a08-5223-aaf7-479c8a1cc9ea", "parentControlId": 30721, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581304" }, { "id": 547573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "042b341d-8a1b-5d2a-bdf7-de58cb6589fe", "parentControlId": 30721, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581304" }, { "id": 547574, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c664fff7-a996-5952-a678-76a56a8a225e", "parentControlId": 30721, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581304" }, { "id": 547575, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50189b7d-636c-59ce-afd7-c31d20214723", "parentControlId": 30721, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581304" }, { "id": 547576, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "445637eb-fb89-593e-8293-1e8c80396a5f", "parentControlId": 30721, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581304" }, { "id": 547577, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d2be9bd-e5a8-5061-9849-eb03a3f7f0a1", "parentControlId": 30721, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581304" }, { "id": 547578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "350e5c7f-e44c-5e7f-afcb-559f4d56c7ef", "parentControlId": 30721, "controlId": "PM-01", "title": "PM-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581304" }, { "id": 547579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bcf1268b-e746-5d59-a6cd-9e52dced6f04", "parentControlId": 30721, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581304" }, { "id": 547580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c01c679d-f0aa-5c6a-be9b-8094ac21c742", "parentControlId": 30721, "controlId": "PT-01", "title": "PT-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581305" }, { "id": 547581, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "587c60b0-70de-5bae-9789-31062250cc3b", "parentControlId": 30721, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581305" }, { "id": 547582, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc79613a-609c-5d67-831e-0e970b6e0377", "parentControlId": 30721, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581305" }, { "id": 547583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52516406-5e61-5cd2-990e-3d5779dfa882", "parentControlId": 30721, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581305" }, { "id": 547584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40dbde49-4923-5ec7-8424-647cb83512ca", "parentControlId": 30721, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581305" }, { "id": 547585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3693b015-da14-5e84-9003-ec633b64d942", "parentControlId": 30721, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581305" }, { "id": 547606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f675daef-0bd5-58b7-b072-2c02a66d26f6", "parentControlId": 30721, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581307" }, { "id": 547607, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48419ac4-825a-52e1-a8d1-79f0de265834", "parentControlId": 30721, "controlId": "AT-01", "title": "AT-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581308" }, { "id": 547608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "139da5bf-5e3f-5a06-bdfe-a16479d4f1f3", "parentControlId": 30721, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581308" }, { "id": 547609, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f32f28fa-2f0c-5ae0-8f02-f28d53161910", "parentControlId": 30721, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581308" }, { "id": 547610, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "734f4e38-6890-5f7f-9249-90f5322e4057", "parentControlId": 30721, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581308" }, { "id": 547611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f479be38-8bce-570b-8902-dc6c36e420c0", "parentControlId": 30721, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581308" }, { "id": 547612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed586636-37c6-51b0-97e2-3a7447572e51", "parentControlId": 30721, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581308" }, { "id": 547613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8261cf6d-f0a3-57ae-aceb-242f77d62927", "parentControlId": 30721, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581308" }, { "id": 547614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e2ec4c5-6fe0-5d7f-82d9-061a32d76926", "parentControlId": 30721, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581308" }, { "id": 547615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ce01df9-746f-5e9b-86f1-b34e187c6f7b", "parentControlId": 30721, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581308" }, { "id": 547616, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "426548f5-c601-5a4d-81d6-f9943306c324", "parentControlId": 30721, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581309" }, { "id": 547617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "363e59f9-b01c-596d-8c94-ad8599506c38", "parentControlId": 30721, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581309" }, { "id": 547618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3a7c804-92a2-5d33-9259-0226081c1f0e", "parentControlId": 30721, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581309" }, { "id": 547619, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50597328-640f-53a4-b1f6-fa96abfdf672", "parentControlId": 30721, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581309" }, { "id": 547620, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4c4a800-62cf-5985-9d5f-49c277fbb91e", "parentControlId": 30721, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581309" }, { "id": 547621, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03fd88ea-1130-589f-a66e-3b159ef60441", "parentControlId": 30721, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581309" }, { "id": 547622, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48f4f4db-adac-561c-ad7b-8e90d1050e21", "parentControlId": 30721, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581309" }, { "id": 547623, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e07bcd63-7289-564f-a82d-7ad6f5c6a369", "parentControlId": 30721, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581309" }, { "id": 547625, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58131", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "719afc1a-a97c-517b-9094-ce9ffbf31e64", "parentControlId": 30721, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58131" }, { "id": 547626, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58131", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e43e7f22-2810-59d1-be82-9c4542224298", "parentControlId": 30721, "controlId": "AT-01", "title": "AT-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58131" }, { "id": 547627, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58131", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc3a294d-4e94-52bc-8933-9b05d5a07042", "parentControlId": 30721, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58131" }, { "id": 547628, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58131", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c312fd2-71e1-5bcb-8005-7fea90107add", "parentControlId": 30721, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58131" }, { "id": 547629, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58131", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29313069-7e3c-5a4d-832a-03d006dc68d6", "parentControlId": 30721, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58131" }, { "id": 547630, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58131", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47923ab7-303a-5e92-beab-76c686d2c2c2", "parentControlId": 30721, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58131" }, { "id": 547631, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58131", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56aec1d4-5e97-5c7e-81ee-ce3e392cf20c", "parentControlId": 30721, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58131" }, { "id": 547632, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58131", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b930c08-0872-5f75-ac32-58489342bd7a", "parentControlId": 30721, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58131" }, { "id": 547633, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58131", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91c5dbc6-c0a7-5ba0-a9d6-17a564235afe", "parentControlId": 30721, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58131" }, { "id": 547634, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581311", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff4d59ae-bae9-5496-8ce3-6414f312ff00", "parentControlId": 30721, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581311" }, { "id": 547635, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581311", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38592c85-798e-503b-85f3-0211cd96c168", "parentControlId": 30721, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581311" }, { "id": 547636, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581311", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c082ba89-7d09-5bfb-a810-47f440cd8401", "parentControlId": 30721, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581311" }, { "id": 547637, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581311", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45f80e27-d816-54bf-9f8d-117e2c5ef6e1", "parentControlId": 30721, "controlId": "PM-01", "title": "PM-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581311" }, { "id": 547638, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581311", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f27c4a70-32a6-512f-b1a2-f4d6e87ad700", "parentControlId": 30721, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581311" }, { "id": 547639, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581311", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57f40ea9-4cf1-54bb-aabe-632c73177a3d", "parentControlId": 30721, "controlId": "PT-01", "title": "PT-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581311" }, { "id": 547640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581311", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc307bc5-477d-53da-8628-c43658735aa8", "parentControlId": 30721, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581311" }, { "id": 547641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581312", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4de2d0ef-89a6-57d3-b9d3-1b248ba12a9f", "parentControlId": 30721, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581312" }, { "id": 547642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581312", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2cea74d9-3c67-50e9-a2d4-75a38d6e2f34", "parentControlId": 30721, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581312" }, { "id": 547643, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581312", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfbda6a4-a549-592e-b180-730adbf3bae7", "parentControlId": 30721, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581312" }, { "id": 547644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581312", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4168417e-6d45-51d5-a8cc-69f9b4d5e615", "parentControlId": 30721, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581312" }, { "id": 547645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581312", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c940208d-c7da-5f88-9834-6da0402aa157", "parentControlId": 30721, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581312" }, { "id": 547646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581312", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d5b9738-c31c-5f14-bb93-138a592e841b", "parentControlId": 30721, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581312" }, { "id": 547647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581312", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "430a1c41-7f90-556c-acf7-d728b8eb60fe", "parentControlId": 30721, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581312" }, { "id": 547648, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581312", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9d32115-b02e-5527-80ba-5f0ecd618f47", "parentControlId": 30721, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581312" }, { "id": 547649, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581312", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cbff52fc-0881-5ef4-b2b9-131b8551c47f", "parentControlId": 30721, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581313" }, { "id": 547650, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c312694b-7864-5cab-a7ad-75e68096055b", "parentControlId": 30721, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581313" }, { "id": 547651, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03fff3d4-89a9-5907-82e3-78209ba04dbd", "parentControlId": 30721, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581313" }, { "id": 547652, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d69a4a5c-2222-58f4-b85b-380bdad20966", "parentControlId": 30721, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581313" }, { "id": 547653, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0081aa85-e4f6-5993-91fc-fba4104dbfcb", "parentControlId": 30721, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581313" }, { "id": 547654, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5efcca1-59b9-5edd-a520-2a2627a55f34", "parentControlId": 30721, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581313" }, { "id": 547655, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5af8406-66b2-575a-a9df-831ee3a44993", "parentControlId": 30721, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581313" }, { "id": 547656, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b48f05ba-37c4-56c0-899f-8f13f0ec0df6", "parentControlId": 30721, "controlId": "PM-01", "title": "PM-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581313" }, { "id": 547657, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "085d370f-b4f3-55f9-96b9-f92e3e6006f2", "parentControlId": 30721, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581313" }, { "id": 547658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19fd945f-0c92-5c9e-a5db-4056ef8b5438", "parentControlId": 30721, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581313" }, { "id": 547659, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8aeeb7d6-3f99-5864-8e7d-6f09783a2b72", "parentControlId": 30721, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581314" }, { "id": 547660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36cbb4ca-924c-537a-8970-f2d033f6b45b", "parentControlId": 30721, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581314" }, { "id": 547661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac583b9b-c228-5450-a875-9a137502ab5e", "parentControlId": 30721, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581314" }, { "id": 547662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee45f665-01df-574e-9c09-e312037cab66", "parentControlId": 30721, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581314" }, { "id": 547663, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ceb478d-fe66-51cf-824e-90d1517d7cd3", "parentControlId": 30721, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581314" }, { "id": 547664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88d80e88-4430-57ba-be3f-68e7e0581d77", "parentControlId": 30721, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581314" }, { "id": 547665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40eeb6dc-0e75-50a9-97f4-1cdf50bbfa5c", "parentControlId": 30721, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581314" }, { "id": 547666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a35b6f4-fa25-5931-bb12-3bd0161f37c1", "parentControlId": 30721, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581314" }, { "id": 547667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e463e19-4541-52ad-bfb5-54154d50cc48", "parentControlId": 30721, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581315" }, { "id": 547668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3599b80d-b874-5de4-a81e-81bc37247d39", "parentControlId": 30721, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581315" }, { "id": 547669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "727c409a-923a-55d9-8f6c-a84552276843", "parentControlId": 30721, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581315" }, { "id": 547670, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7142ae9-0439-5da8-b83a-650aa07c93dc", "parentControlId": 30721, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581315" }, { "id": 547671, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55957243-6ec1-598d-adb6-3d3dabce5909", "parentControlId": 30721, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581315" }, { "id": 547672, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e54e0018-e4e8-5973-b648-1180fdbf00e5", "parentControlId": 30721, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581315" }, { "id": 547673, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f99c38f2-bc8f-54e3-a24e-43f9a3cc714b", "parentControlId": 30721, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581315" }, { "id": 547674, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae1eea92-489c-52e5-bfd5-1975aac3fc98", "parentControlId": 30721, "controlId": "PM-01", "title": "PM-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581315" }, { "id": 547675, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "449218e1-9a7f-5434-863b-b61b8b78f7fa", "parentControlId": 30721, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581315" }, { "id": 547676, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0076af79-3500-554f-a008-1fa2c4b82f02", "parentControlId": 30721, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581316" }, { "id": 547677, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "473c3431-96e8-59a9-ad09-9be8bbdc999a", "parentControlId": 30721, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581316" }, { "id": 547678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4389f52f-0838-5648-a968-719b7d018eae", "parentControlId": 30721, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581316" }, { "id": 547679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "039f8b64-fd8c-5f41-9694-9d844348c5ee", "parentControlId": 30721, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581316" }, { "id": 547680, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e2610d0-352d-5633-971c-fb25f10aaa16", "parentControlId": 30721, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581316" }, { "id": 547681, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee8f09f0-d315-5b2d-b489-111640f6c959", "parentControlId": 30721, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581316" }, { "id": 547682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d108b22e-ea64-590d-8e0b-cc59a191fc3a", "parentControlId": 30721, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581316" }, { "id": 547683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4f8ecbf-0e7c-5a74-85fc-e75de8b5a24c", "parentControlId": 30721, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581316" }, { "id": 547684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b6eb8a8-c005-5e14-b4c9-66f9a5cea07b", "parentControlId": 30721, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581316" }, { "id": 547685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "804d9d7e-93b6-5ff5-871d-7ff406562f0c", "parentControlId": 30721, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581317" }, { "id": 547686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5e5a89b-592f-52c8-8d26-81daccf673c0", "parentControlId": 30721, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581317" }, { "id": 547687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79f790b2-f0cc-56a4-992d-cd7fc58e8b64", "parentControlId": 30721, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581317" }, { "id": 547688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65305522-6338-5450-bf7f-f196d187b979", "parentControlId": 30721, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581317" }, { "id": 547689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51157c49-861b-5a79-bd21-747f3bc5444a", "parentControlId": 30721, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581317" }, { "id": 547690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bccfb20f-dd91-5fbc-ac28-0607d1a8103e", "parentControlId": 30721, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581317" }, { "id": 547691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8c893f9-d757-596a-a8a6-d58b8d958f7e", "parentControlId": 30721, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581317" }, { "id": 547692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e332ea8-7a36-5445-b450-4ba7fa528893", "parentControlId": 30721, "controlId": "PM-01", "title": "PM-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581317" }, { "id": 547693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71aa4669-700e-5fb1-bdc3-16d029575d6e", "parentControlId": 30721, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581317" }, { "id": 547694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44af8ca6-b1cf-5241-a680-4a093c2d213f", "parentControlId": 30721, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581318" }, { "id": 547695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9117211f-29d9-5fa0-981d-9f1e728a5dea", "parentControlId": 30721, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581318" }, { "id": 547696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "501f0569-8395-5f9c-8e5c-4f7a7a3906b8", "parentControlId": 30721, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581318" }, { "id": 547697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b61e751-4c69-508f-997e-a35691746bb3", "parentControlId": 30721, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581318" }, { "id": 547698, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80076786-0d60-51fa-947f-339cb7597593", "parentControlId": 30721, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581318" }, { "id": 547699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3674404b-b689-5f81-9da7-ce26603b60fc", "parentControlId": 30721, "controlId": "AC-1", "title": "AC-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581318" }, { "id": 547700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7198e3ca-24e3-5229-b8da-5b355d2b9ee4", "parentControlId": 30721, "controlId": "AT-1", "title": "AT-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581318" }, { "id": 547701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de9aac10-621a-5b84-a6dc-4c237f73987f", "parentControlId": 30721, "controlId": "AU-1", "title": "AU-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581318" }, { "id": 547702, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0fc3384-2d16-5006-a314-0b7819ea3850", "parentControlId": 30721, "controlId": "CA-1", "title": "CA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581318" }, { "id": 547703, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eea145ab-d7d9-5a07-ac8f-f0ba5c1a54c5", "parentControlId": 30721, "controlId": "CM-1", "title": "CM-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581319" }, { "id": 547704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "285fdcea-b36b-5b66-ade6-863c98121240", "parentControlId": 30721, "controlId": "CP-1", "title": "CP-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581319" }, { "id": 547705, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f868b5a1-d273-5302-b8c8-8bbe1045059f", "parentControlId": 30721, "controlId": "IA-1", "title": "IA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581319" }, { "id": 547706, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59e55f19-5c5a-518a-b7df-dbe52a6c49e1", "parentControlId": 30721, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581319" }, { "id": 547707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "207d344c-6cf6-5db0-89d1-a0b260d350b2", "parentControlId": 30721, "controlId": "MA-1", "title": "MA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581319" }, { "id": 547708, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3a85392-9ddb-5c31-931a-df30dde7308d", "parentControlId": 30721, "controlId": "MP-1", "title": "MP-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581319" }, { "id": 547709, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0238efa5-e439-5ce3-96c9-d27287ab2844", "parentControlId": 30721, "controlId": "PE-1", "title": "PE-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581319" }, { "id": 547710, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b23ccb3-a634-572a-b583-873aa12af7e8", "parentControlId": 30721, "controlId": "PL-1", "title": "PL-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581319" }, { "id": 547711, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfa0ecd8-7878-5194-a082-8e51da77d153", "parentControlId": 30721, "controlId": "PS-1", "title": "PS-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581319" }, { "id": 547712, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73205df9-8904-5558-bb3e-056429cd6791", "parentControlId": 30721, "controlId": "PT-1", "title": "PT-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58132" }, { "id": 547713, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58132", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3dcc6541-232a-5a31-bcd9-382359fa93f0", "parentControlId": 30721, "controlId": "RA-1", "title": "RA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58132" }, { "id": 547714, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58132", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f269ef8-8ec5-5d5c-bedb-6059898ead27", "parentControlId": 30721, "controlId": "SA-1", "title": "SA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58132" }, { "id": 547715, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58132", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17ac0a17-2ef4-5186-8331-899ebd7e33d4", "parentControlId": 30721, "controlId": "SC-1", "title": "SC-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58132" }, { "id": 547716, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58132", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bf2d081-ffb4-5c45-923c-a2d6fa41a23c", "parentControlId": 30721, "controlId": "SI-1", "title": "SI-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58132" }, { "id": 547717, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58132", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63db6c0f-9d42-54ea-9a9e-45a053e4860c", "parentControlId": 30721, "controlId": "SR-1", "title": "SR-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58132" }, { "id": 547718, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58132", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc37bc00-d2b4-5156-9f6b-20a141de5690", "parentControlId": 30721, "controlId": "AC-1", "title": "AC-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58132" }, { "id": 547719, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58132", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bef93a8d-7828-5340-bc71-1c9a6327d6ad", "parentControlId": 30721, "controlId": "AT-1", "title": "AT-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58132" }, { "id": 547720, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58132", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce12fa17-2124-5f2f-98d3-d60e1131b6dc", "parentControlId": 30721, "controlId": "AU-1", "title": "AU-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58132" }, { "id": 547721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e43a195-96cb-5706-8918-5bc3abbd2833", "parentControlId": 30721, "controlId": "CA-1", "title": "CA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581321" }, { "id": 547722, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d0d6765-8a5d-5843-aa22-e97516906a48", "parentControlId": 30721, "controlId": "CM-1", "title": "CM-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581321" }, { "id": 547723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03320c51-da28-556c-a62e-54dd146b5098", "parentControlId": 30721, "controlId": "CP-1", "title": "CP-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581321" }, { "id": 547724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b5083d5-5abb-5354-ace0-217539eb33bc", "parentControlId": 30721, "controlId": "IA-1", "title": "IA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581321" }, { "id": 547725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5b0ba61-0b12-5737-9682-41aac6833293", "parentControlId": 30721, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581321" }, { "id": 547726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a98bfc04-fd27-588b-8b47-682663003be3", "parentControlId": 30721, "controlId": "MA-1", "title": "MA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581321" }, { "id": 547727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ba47fc6-a427-54ae-9588-895861bc833b", "parentControlId": 30721, "controlId": "MP-1", "title": "MP-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581321" }, { "id": 547728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c161c2d-dcc4-507e-8d79-6d1ed33ea444", "parentControlId": 30721, "controlId": "PE-1", "title": "PE-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581321" }, { "id": 547729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ab4c0e3-61c5-5575-ba48-7ba8b038537a", "parentControlId": 30721, "controlId": "PL-1", "title": "PL-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581321" }, { "id": 547730, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4fa1108-ca49-5921-b1c8-9d297bc3d244", "parentControlId": 30721, "controlId": "PS-1", "title": "PS-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581322" }, { "id": 547731, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6598080f-e48d-5b77-8f5e-64bb03b26bbe", "parentControlId": 30721, "controlId": "RA-1", "title": "RA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581322" }, { "id": 547732, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec63c9b1-708e-5784-b06d-53401b629698", "parentControlId": 30721, "controlId": "SA-1", "title": "SA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581322" }, { "id": 547733, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d09a13ea-8d79-51f5-b36a-537c6820d4d7", "parentControlId": 30721, "controlId": "SC-1", "title": "SC-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581322" }, { "id": 547734, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3a0daa7-6c96-56e2-a720-298a43da9f78", "parentControlId": 30721, "controlId": "SI-1", "title": "SI-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581322" }, { "id": 547735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18b13b9f-c278-5798-b130-a3a5c09bab24", "parentControlId": 30721, "controlId": "SR-1", "title": "SR-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581322" }, { "id": 547736, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31fd483e-311b-5417-8453-f8120df38d4f", "parentControlId": 30721, "controlId": "AC-1", "title": "AC-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581322" }, { "id": 547737, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6c03c8f-fd9d-55db-a780-776d56836eb5", "parentControlId": 30721, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581322" }, { "id": 547738, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06d397a3-1258-5933-b321-5889a4f3f1eb", "parentControlId": 30721, "controlId": "MA-1", "title": "MA-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581322" }, { "id": 547739, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e673e9a-4d4a-5143-b99c-b96fa2c3b071", "parentControlId": 30721, "controlId": "PS-1", "title": "PS-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581322" }, { "id": 547740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581323", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "861cfaa7-7707-527b-9d95-e9a861e61e22", "parentControlId": 30721, "controlId": "PT-1", "title": "PT-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581323" }, { "id": 547794, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581338", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "668256cb-e01c-5367-8be4-7d8ff015386f", "parentControlId": 30721, "controlId": "03.15.01.b", "title": "03.15.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581338" }, { "id": 547795, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581338", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80f8b743-750d-50f2-9d81-cd763840b990", "parentControlId": 30721, "controlId": "03.15.03.d", "title": "03.15.03.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581338" }, { "id": 547799, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581338", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b94c0e8f-ba41-592c-92be-f07bada8f5fa", "parentControlId": 30721, "controlId": "GV.PO-02", "title": "GV.PO-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581338" }, { "id": 547800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581338", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a120fbb-3a2d-5f4f-85aa-b679c88c367e", "parentControlId": 30721, "controlId": "GV.OV", "title": "GV.OV", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581338" }, { "id": 547801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581339", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d531411-591c-5050-a51c-a18145443f41", "parentControlId": 30721, "controlId": "GV.OV-01", "title": "GV.OV-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581339" }, { "id": 547802, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581339", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4c80a3d-a315-51e4-a7f4-bf90afe02ea2", "parentControlId": 30721, "controlId": "GV.OV-02", "title": "GV.OV-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581339" }, { "id": 547899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae17496a-fa95-5598-8904-815920e2a6e0", "parentControlId": 30721, "controlId": "PROGRAM-1h", "title": "PROGRAM-1h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58135" }, { "id": 548029, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581365", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6fb5475-4644-56f9-9093-8b1edd92724c", "parentControlId": 30721, "controlId": "CIP-002-5.1a 2.1", "title": "CIP-002-5.1a 2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581365" }, { "id": 548030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581365", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a6f315f-adf6-55c5-845c-a72e3e7c1053", "parentControlId": 30721, "controlId": "CIP-002-5.1a 2.2", "title": "CIP-002-5.1a 2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581365" }, { "id": 548031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581365", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbfbb5a2-c22c-5f78-997a-a11678b05ea0", "parentControlId": 30721, "controlId": "CIP-003-8 R1", "title": "CIP-003-8 R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581365" }, { "id": 548148, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11972318-f492-57f7-8a5b-b233e020d902", "parentControlId": 30721, "controlId": "B1.a", "title": "B1.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581388" }, { "controlId": "A.3.3", "title": "A.3.3 — Policies and Implementing Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-1, PL-1, PS-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "26620c07-e1e1-5fc4-90ac-5a5c9f0bf582", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.3", "title": "NEI 08-09 Sec 3.3 — Policies and Implementing Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "40939b01-e5bd-5654-abe6-5c1ce4fea9d2", "isPublic": true }, { "controlId": "10 CFR 73.54(b)(2)", "title": "10 CFR 73.54(b)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "20c3e358-7935-5299-b9d5-ded9a4a6b120", "isPublic": true }, { "controlId": "CIP-002-5.1a-R2", "title": "CIP-002-5.1a-R2 — Annual Review and Approval of BES Cyber System Categorization", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a91119d0-a649-5b86-8c59-64c94eb11453", "isPublic": true }, { "controlId": "CIP-002-5.1a-2.1", "title": "CIP-002-5.1a-2.1 — Review the identifications in Requirement R1 and its parts (and update them if there are changes identified) at least...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d8ace597-3540-5856-958a-041a90c1d2c9", "isPublic": true }, { "controlId": "CIP-002-5.1a-2.2", "title": "CIP-002-5.1a-2.2 — Have its CIP Senior Manager or delegate approve the identifications required by Requirement R1 at least once every 15...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "37ea0699-93b6-546d-84d7-185d350877da", "isPublic": true }, { "controlId": "CIP-003-8-R1", "title": "CIP-003-8-R1 — Cyber Security Policy Development and Approval", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4037b944-899e-583d-8f16-fd3201ae65b6", "isPublic": true }, { "controlId": "CIP-003-8-1.1", "title": "CIP-003-8-1.1 — For its high impact and medium impact BES Cyber Systems, if any: 1.1.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d743d728-cb6c-5f82-8092-96f8818c7b35", "isPublic": true }, { "controlId": "CIP-003-8-1.2", "title": "CIP-003-8-1.2 — For its assets identified in CIP-002 containing low impact BES Cyber Systems, if any: 1.2.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e016e872-bc18-522f-944a-9297bc19f34c", "isPublic": true }, { "controlId": "CIP-003-9-1.2.6", "title": "CIP-003-9-1.2.6 — Low Impact Vendor Electronic Remote Access Security Policy", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "513ffa54-5f16-5c1b-ba7f-a461395a02cc", "isPublic": true }, { "controlId": "NSS-17T-Sec4.1", "title": "NSS-17T-Sec4.1 — Computer Security Program Management & Policy", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "6cc5116a-d66b-5caf-940c-c38d26aea278", "isPublic": true }, { "controlId": "IEC-62645-5.1", "title": "IEC-62645-5.1 — Nuclear Plant Level Computer Security Programme", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "9b424149-7f01-5588-b68d-c5c2364dbb35", "isPublic": true }, { "controlId": "IEC-63096-5.1", "title": "IEC-63096-5.1 — Information Security Policies for Nuclear Facilities", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "66051517-09f9-5f8f-9ae9-dfee2da405e6", "isPublic": true }, { "controlId": "10-CFR-73.100(b)", "title": "10-CFR-73.100(b) — Performance-Based Cybersecurity Program for Advanced Reactors", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "20a59734-64c7-5638-af9d-a36097d4be6d", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.a", "title": "DOE-O-205.1D-4.a — Enterprise Cybersecurity Risk Management & Governance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "e7921302-db66-55fd-8274-dfbdbba1fd34", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3", "title": "REGDOC-2.12.1-Sec3 — Cyber Security Program Governance & Organization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "1be3c060-e248-5601-ae60-90f40394e339", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP1", "title": "ONR-SyAP-FSyP1 — Leadership and Management for Security (CS&IA)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "e49640c9-9051-5397-aade-b40cf3fd1362", "isPublic": true } ], "id": 30721, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730823", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730823", "catalogueId": 1062, "uuid": "b62b3702-b182-55c6-8d5a-a733349744f9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization review the Security, Compliance & Resilience Program (SCRP), including policies, standards and procedures, at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy and effectiveness?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Periodic Review & Update of Security, Compliance & Resilience Program", "description": "

Control Description

Mechanisms exist to review the Security, Compliance & Resilience Program (SCRP), including policies, standards and procedures, at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy and effectiveness.

Evidence Request List (ERL)

E-GOV-12

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel perform an annual documentation review process that includes the scope of applicable statutory, regulatory and/or contractual obligations.\n▪ Recommendations for documentation edits are submitted for review and are handled in accordance with documentation change control processes.\n▪ Updated documentation versions are published, based on no less than an annual review cycle.

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to review the Security, Compliance & Resilience Program (SCRP), including policies, standards and procedures, at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy and effectiveness.

Level 4 - Quantitatively Controlled: Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.3
NERC-CIP (2026) Requirements: CIP-002-5.1a-R2, CIP-003-8-R1", "controlId": "GOV-03", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-03", "references": "

Micro-Small Business (<10 staff)

∙ Annual human reviews of policies and procedures\n∙ Documentation change control (version history in document)\n∙ Calendar reminders for review cycles

Small Business (10-49 staff)

∙ Annual human reviews with documented review log\n∙ Documentation change control with version history\n∙ Defined policy review and approval process

Medium Business (50-249 staff)

∙ Documented review cycle (minimum annual) with ownership assignment\n∙ Change control process with approval workflows\n∙ Document management system with review reminders (e.g., SharePoint, PolicyTech)

Large Business (250-999 staff)

∙ Formalized policy lifecycle management (create, review, retire)\n∙ Automated review reminders via policy management platform\n∙ GRC-integrated documentation change control\n∙ Triggered reviews for significant regulatory or organizational changes

Enterprise (>1,000 staff)

∙ Enterprise policy lifecycle management integrated with GRC platform\n∙ Automated review workflows with escalation paths\n∙ Regulatory change monitoring integrated with policy review triggers\n∙ Audit-ready documentation of all policy changes and approvals", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69096, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589769", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589769", "securityControlId": 30722, "ccis": [], "uuid": "5d545511-e6e1-5bc6-a8bf-83a3224b86ac", "testId": "GOV-04_A01", "test": "a senior organizational cybersecurity position is appointed.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_PM-02[01]", "defaultText": null }, { "id": 69097, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589769", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589769", "securityControlId": 30722, "ccis": [], "uuid": "fd630b48-1721-5cdf-84f1-b1152262ee6c", "testId": "GOV-04_A02", "test": "the senior organizational cybersecurity position is provided with the mission and resources to coordinate, develop, implement and maintain an organization-wide cybersecurity program.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_PM-02[02]\n53A_R5_PM-02[03]\n53A_R5_PM-02[04]\n53A_R5_PM-02[05]", "defaultText": null } ], "externalMappings": [ { "id": 548197, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7175ef76-5bf4-5005-b635-d066863062c5", "parentControlId": 30722, "controlId": "5.1(f)", "title": "5.1(f)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581394" }, { "id": 548198, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "674f1432-9a45-5c51-b117-5b89703d0870", "parentControlId": 30722, "controlId": "5.1(h)", "title": "5.1(h)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581394" }, { "id": 548199, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73e5eb89-47ce-5743-9f35-62e0aec943da", "parentControlId": 30722, "controlId": "5.3", "title": "5.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581394" }, { "id": 548200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f55a9874-1d10-5145-9d87-8345efbcd51e", "parentControlId": 30722, "controlId": "5.3(a)", "title": "5.3(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581394" }, { "id": 548201, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62b8dc13-04d7-56eb-9681-4d6773f5ef5b", "parentControlId": 30722, "controlId": "5.3(b)", "title": "5.3(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581394" }, { "id": 548202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c32d4c5d-a1b8-508c-96d5-64c87cac2f3e", "parentControlId": 30722, "controlId": "5.2", "title": "5.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581394" }, { "id": 548226, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "adb67b17-0dc2-5fbd-968c-d5a6b5b7645c", "parentControlId": 30722, "controlId": "PL-9", "title": "PL-9", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581397" }, { "id": 548227, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b92ce8e2-ca31-5d54-95f0-29804ba040ca", "parentControlId": 30722, "controlId": "PM-2", "title": "PM-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581397" }, { "id": 548228, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74bf3e02-69ac-56bc-9262-55b77c57ecac", "parentControlId": 30722, "controlId": "PM-6", "title": "PM-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581397" }, { "id": 548229, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68fbde26-2ba3-59ee-be95-b9ac2dcb9ae2", "parentControlId": 30722, "controlId": "PL-09", "title": "PL-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581397" }, { "id": 548230, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f195cf65-8cf0-5c30-b7eb-1ca9e82915d3", "parentControlId": 30722, "controlId": "PM-02", "title": "PM-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581398" }, { "id": 548231, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24d4239d-97bd-5b76-9e3c-a026feb83320", "parentControlId": 30722, "controlId": "PM-06", "title": "PM-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581398" }, { "id": 548232, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "190e86c0-a5de-5401-9031-1c94e6c298b7", "parentControlId": 30722, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581398" }, { "id": 548237, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3819c5f-bb06-597a-8b22-42741a24911d", "parentControlId": 30722, "controlId": "PL-09", "title": "PL-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581398" }, { "id": 548238, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "febfea84-6e95-5aa2-89cd-9ab2b5a0779e", "parentControlId": 30722, "controlId": "PM-02", "title": "PM-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581398" }, { "id": 548239, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581399", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ded3287b-6fe6-57e8-a5eb-6e8eecd37fe5", "parentControlId": 30722, "controlId": "PM-06", "title": "PM-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581399" }, { "id": 548240, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581399", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c7f50ea-dc0c-514e-ae86-390e148c8c6e", "parentControlId": 30722, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581399" }, { "id": 548241, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581399", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47aebfc4-c7af-5be7-901a-36ddbd621408", "parentControlId": 30722, "controlId": "PM-02", "title": "PM-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581399" }, { "id": 548242, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581399", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7374ea6-000c-5d80-990b-3882f6bd0023", "parentControlId": 30722, "controlId": "PM-06", "title": "PM-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581399" }, { "id": 548243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581399", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f5d638e-9b80-5e38-897a-72634a95eb96", "parentControlId": 30722, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581399" }, { "id": 548244, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581399", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb0eed17-77c3-5527-acc7-02549b81ed06", "parentControlId": 30722, "controlId": "PM-02", "title": "PM-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581399" }, { "id": 548245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9abbb837-dc84-5e79-87ee-0d9973bff6a8", "parentControlId": 30722, "controlId": "PM-06", "title": "PM-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5814" }, { "id": 548246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3587fd29-bcef-50d8-91d6-4e615ed7ff67", "parentControlId": 30722, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5814" }, { "id": 548247, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d2ce3a5-4f0d-5432-9e89-dd96b7aaa0fc", "parentControlId": 30722, "controlId": "PM-02", "title": "PM-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5814" }, { "id": 548248, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "625a5966-1cce-55ee-9068-6d969e27d862", "parentControlId": 30722, "controlId": "PM-06", "title": "PM-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5814" }, { "id": 548249, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6267e094-0d72-5cba-bf36-862f0165e87a", "parentControlId": 30722, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5814" }, { "id": 548250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf5662a5-f0e6-5103-831e-1e702220f06b", "parentControlId": 30722, "controlId": "PL-9", "title": "PL-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5814" }, { "id": 548251, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a64692b-114c-5148-a9fd-29a240ab4d16", "parentControlId": 30722, "controlId": "PM-2", "title": "PM-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5814" }, { "id": 548252, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c388480-c418-5cd4-ae2e-1983d0f80bf4", "parentControlId": 30722, "controlId": "PM-6", "title": "PM-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5814" }, { "id": 548253, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f51f1a1-4a4a-533b-920e-a69c364ecab6", "parentControlId": 30722, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5814" }, { "id": 548262, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f655cfb2-8343-560c-ac73-ab4223378701", "parentControlId": 30722, "controlId": "GV.RM", "title": "GV.RM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581401" }, { "id": 548263, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "239b316c-cc64-5632-bdad-12477dba39c2", "parentControlId": 30722, "controlId": "GV.RM-05", "title": "GV.RM-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581401" }, { "id": 548264, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581402", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f63fcac8-fc9e-5a9f-96ea-c818b0fc3682", "parentControlId": 30722, "controlId": "GV.RR-01", "title": "GV.RR-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581402" }, { "id": 548265, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581402", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8bbb812-0c6d-514e-a8db-8b95cd9128a0", "parentControlId": 30722, "controlId": "GV.RR-02", "title": "GV.RR-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581402" }, { "id": 548318, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2999354a-f2d1-547f-86be-b74b93d25dd3", "parentControlId": 30722, "controlId": "ASSET-5d", "title": "ASSET-5d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581408" }, { "id": 548319, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78afbf92-b12c-5c3c-ba48-9e1bc1deaf88", "parentControlId": 30722, "controlId": "THREAT-3d", "title": "THREAT-3d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581408" }, { "id": 548320, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da44c498-5a87-5b98-9321-b059771303cf", "parentControlId": 30722, "controlId": "RISK-5d", "title": "RISK-5d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581408" }, { "id": 548321, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24369b8e-123f-56c9-abf7-a2f8f4da78a6", "parentControlId": 30722, "controlId": "ACCESS-4d", "title": "ACCESS-4d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581408" }, { "id": 548322, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "815548fb-18f3-5229-8432-e8b29cd66a27", "parentControlId": 30722, "controlId": "SITUATION-4d", "title": "SITUATION-4d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581408" }, { "id": 548323, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b1ef451-ab14-57f6-befd-40ca2c5e5c4d", "parentControlId": 30722, "controlId": "RESPONSE-5d", "title": "RESPONSE-5d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581408" }, { "id": 548324, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c621a77-a294-5ada-8dec-ab1149148bd1", "parentControlId": 30722, "controlId": "THIRD-PARTIES-3d", "title": "THIRD-PARTIES-3d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581408" }, { "id": 548325, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62dc032b-74e0-5504-af4d-ce4dafb048c8", "parentControlId": 30722, "controlId": "WORKFORCE-5d", "title": "WORKFORCE-5d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581409" }, { "id": 548326, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "536f23e7-d1a2-5c2f-9458-61e2f522c6bd", "parentControlId": 30722, "controlId": "ARCHITECTURE-6d", "title": "ARCHITECTURE-6d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581409" }, { "id": 548327, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e671d7ef-0ed1-54a0-b2b3-2628688d44e4", "parentControlId": 30722, "controlId": "PROGRAM-2e", "title": "PROGRAM-2e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581409" }, { "id": 548328, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e2c373c-a840-5965-91ce-b5528c62eb74", "parentControlId": 30722, "controlId": "PROGRAM-3d", "title": "PROGRAM-3d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581409" }, { "id": 548353, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4d90daf-4f8c-58b1-87ec-5f8c1a8131c3", "parentControlId": 30722, "controlId": "CIP-003-8 R4", "title": "CIP-003-8 R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581421" }, { "id": 548402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581427", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9a8144d-0721-5002-9de3-496bc57ab8ab", "parentControlId": 30722, "controlId": "A1.b", "title": "A1.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581427" }, { "id": 548403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581427", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e632ecee-27a9-5eaa-96b6-ab2aa38d5574", "parentControlId": 30722, "controlId": "A1.c", "title": "A1.c", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581427" }, { "controlId": "A.4.3", "title": "A.4.3 — Cyber Security Program Review", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-1, CA-2, CA-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "2ee33935-bd2a-550a-8b68-8d0da9aea4e5", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.3", "title": "NEI 08-09 Sec 4.3 — Cyber Security Program Review", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "9b4215f2-250f-562f-9fb4-0a618fba94a7", "isPublic": true }, { "controlId": "10 CFR 73.54(g), 73.55(m)", "title": "10 CFR 73.54(g), 73.55(m) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "275fe9b8-8c7d-5403-bba6-09e7b5db0435", "isPublic": true }, { "controlId": "CIP-002-5.1a-R2", "title": "CIP-002-5.1a-R2 — Annual Review and Approval of BES Cyber System Categorization", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "eaa4dc7d-5478-5d87-8278-e60f3644c014", "isPublic": true }, { "controlId": "CIP-002-5.1a-2.1", "title": "CIP-002-5.1a-2.1 — Review the identifications in Requirement R1 and its parts (and update them if there are changes identified) at least...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a649a4dd-fed1-5138-afa7-52c708fb9b1d", "isPublic": true }, { "controlId": "CIP-002-5.1a-2.2", "title": "CIP-002-5.1a-2.2 — Have its CIP Senior Manager or delegate approve the identifications required by Requirement R1 at least once every 15...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d2c74385-a86d-5940-9952-8a4851cd40cc", "isPublic": true }, { "controlId": "CIP-003-8-R4", "title": "CIP-003-8-R4 — CIP Senior Manager Identification and Change Delegation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d425e08b-129b-5bb7-b5be-f4a98efd7238", "isPublic": true }, { "controlId": "CIP-013-2-R3", "title": "CIP-013-2-R3 — Supply Chain Risk Management Plan Review and Approval", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "bd866c58-2d9f-5985-9cba-fdc2c8c3d161", "isPublic": true }, { "controlId": "NSS-17T-Sec4.1", "title": "NSS-17T-Sec4.1 — Computer Security Program Management & Policy", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "6a37b56f-84f9-51f6-90c7-5b7cbb675a28", "isPublic": true }, { "controlId": "IEC-62645-5.1", "title": "IEC-62645-5.1 — Nuclear Plant Level Computer Security Programme", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "9e812475-9a1f-5486-bd0a-7204cf6e06be", "isPublic": true }, { "controlId": "IEC-63096-5.1", "title": "IEC-63096-5.1 — Information Security Policies for Nuclear Facilities", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "e578baa7-4e6e-5003-ac19-88e4f7c897b1", "isPublic": true }, { "controlId": "10-CFR-73.100(b)", "title": "10-CFR-73.100(b) — Performance-Based Cybersecurity Program for Advanced Reactors", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "01163811-5234-5c38-884d-3246799a9e3d", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.a", "title": "DOE-O-205.1D-4.a — Enterprise Cybersecurity Risk Management & Governance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "3b04fb66-e11e-53f8-9c72-c0280d92a307", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3", "title": "REGDOC-2.12.1-Sec3 — Cyber Security Program Governance & Organization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "a796f919-0191-56b4-adef-976bd899e69e", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP1", "title": "ONR-SyAP-FSyP1 — Leadership and Management for Security (CS&IA)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "de9a7a82-e872-50b9-bf92-b27a63b2159b", "isPublic": true } ], "id": 30722, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730823", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730823", "catalogueId": 1062, "uuid": "9e5626ce-0918-5fbd-8524-a22639f3c222", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Assigned Security, Compliance & Resilience Responsibilities", "description": "

Control Description

Mechanisms exist to assign one or more qualified individuals with the mission and resources to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP).

Evidence Request List (ERL)

E-HRS-01\nE-HRS-05\nE-HRS-06\nE-HRS-07\nE-HRS-08\nE-HRS-09\nE-HRS-10\nE-HRS-13\nE-HRS-15

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.\n▪ A qualified individual is assigned the role and responsibilities to centrally manage, coordinate, develop, implement and maintain a cybersecurity and data protection program (e.g., cybersecurity director or Chief Information Security Officer (CISO)).\n▪ The individual assigned the role and responsibilities to centrally manage, coordinate, develop, implement and maintain a cybersecurity and data protection program develops plans to implement the organization's security, compliance and resiliency-related objectives.

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ A qualified individual is assigned the role and responsibilities to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide Security, Compliance & Resilience Program (SCRP) (e.g., cybersecurity director or Chief Information Security Officer (CISO)).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.3
NERC-CIP (2026) Requirements: CIP-002-5.1a-R2, CIP-003-8-R4, CIP-013-2-R3", "controlId": "GOV-04", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-04", "references": "

Micro-Small Business (<10 staff)

∙ Third-party advisors (e.g., virtual CISO (vCISO), Managed Security Services Provider (MSSP))\n∙ Designated internal security point of contact\n∙ vCISO services (e.g., Truvantis, private vCISO firms)

Small Business (10-49 staff)

∙ Third-party advisors (e.g., virtual CISO (vCISO), Managed Security Services Provider (MSSP))\n∙ Part-time or shared security manager\n∙ vCISO services with defined scope and deliverables

Medium Business (50-249 staff)

∙ Dedicated Information Security Manager (ISM) or fractional CISO\n∙ Chief Information Security Officer (CISO) or equivalent role\n∙ Defined Information Security Management System (ISMS) ownership

Large Business (250-999 staff)

∙ Chief Information Security Officer (CISO) with defined authority and budget\n∙ Security leadership team (CISO, DPO, IAM lead, etc.)\n∙ Security organizational structure with clear reporting lines

Enterprise (>1,000 staff)

∙ Chief Information Security Officer (CISO) with C-suite authority and board access\n∙ Security leadership organization (CISO, Deputy CISO, DPO, domain leads)\n∙ Security Center of Excellence (CoE)\n∙ Defined succession planning for key security roles", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69098, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58977", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58977", "securityControlId": 30723, "ccis": [], "uuid": "31f223de-03af-58a4-8606-d72654c43f59", "testId": "GOV-04.1_A01", "test": "the cybersecurity / data privacy governance program includes the identification and assignment of roles.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-01a.02[01]", "defaultText": null }, { "id": 69099, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58977", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58977", "securityControlId": 30723, "ccis": [], "uuid": "1c447d8d-25de-5fe7-a1a0-cbe4f8692948", "testId": "GOV-04.1_A02", "test": "the cybersecurity / data privacy governance program includes the identification and assignment of responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-01a.02[02]", "defaultText": null } ], "externalMappings": [ { "id": 548532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7dfa9b21-54d6-54e7-be45-6c3844560421", "parentControlId": 30723, "controlId": "GV.RM-05", "title": "GV.RM-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581442" }, { "id": 548533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef039c95-ba99-5a6c-981d-769660109cdc", "parentControlId": 30723, "controlId": "GV.RR-01", "title": "GV.RR-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581442" }, { "id": 548541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "836b5587-6863-516e-b2d0-4fe5e4556d41", "parentControlId": 30723, "controlId": "RISK-1e", "title": "RISK-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581443" }, { "id": 548542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40a81f17-d3a3-5d55-82ef-97b036df0799", "parentControlId": 30723, "controlId": "PROGRAM-2f", "title": "PROGRAM-2f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581444" }, { "id": 548553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4eaa2585-9175-576a-ae48-a98763681fc4", "parentControlId": 30723, "controlId": "A1.b", "title": "A1.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581445" } ], "id": 30723, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730824", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730824", "catalogueId": 1062, "uuid": "53f4abdf-f4fe-5f60-97e1-026f80d4589d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce an accountability structure so that appropriate teams and individuals are empowered, responsible and trained for mapping, measuring and managing Technology Assets, Applications, Services and/or Data (TAASD)-related risks?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Stakeholder Accountability Structure", "description": "

Control Description

Mechanisms exist to enforce an accountability structure so that appropriate teams and individuals are empowered, responsible and trained for mapping, measuring and managing Technology Assets, Applications, Services and/or Data (TAASD)-related risks.

Evidence Request List (ERL)

E-HRS-15

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to enforce an accountability structure so that appropriate teams and individuals are empowered, responsible and trained for mapping, measuring and managing Technology Assets, Applications, Services and/or Data (TAASD)-related risks.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "GOV-04.1", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Documented roles and responsibilities (RACI matrix or equivalent)\n∙ Job descriptions with security duties clearly defined

Small Business (10-49 staff)

∙ Documented RACI matrix for cybersecurity responsibilities\n∙ Formal security role assignments in job descriptions\n∙ Access control aligned to defined roles

Medium Business (50-249 staff)

∙ Documented RACI matrix for cybersecurity responsibilities\n∙ Role-based accountability framework\n∙ Performance metrics tied to security responsibilities

Large Business (250-999 staff)

∙ Formal accountability framework (RACI/RASCI) maintained in GRC platform\n∙ Security role definitions with measurable performance criteria\n∙ Control ownership assigned and tracked in GRC platform

Enterprise (>1,000 staff)

∙ Enterprise accountability framework integrated with GRC and HR systems\n∙ Control ownership model with documented accountability for each control domain\n∙ Security KPIs tied to role-based performance management\n∙ Third-party accountability structures for key vendors", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69100, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58977", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58977", "securityControlId": 30724, "ccis": [], "uuid": "0f1604ac-20cc-55dc-8a60-ba009a4d06d1", "testId": "GOV-04.2_A01", "test": "a formal organization structure is published.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69101, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58977", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58977", "securityControlId": 30724, "ccis": [], "uuid": "f09a6941-6980-587a-bc71-0a90af3d7a11", "testId": "GOV-04.2_A02", "test": "an individual's chain of command is clearly delineated.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 548605, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "043caa7b-2dc1-5506-a76b-f60b44346b78", "parentControlId": 30724, "controlId": "RISK-1e", "title": "RISK-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581451" }, { "id": 548606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2426f55-3d23-54ba-b029-1bce0345b027", "parentControlId": 30724, "controlId": "PROGRAM-2f", "title": "PROGRAM-2f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581451" }, { "id": 548613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a77a645f-d257-523c-ad63-57702722cc56", "parentControlId": 30724, "controlId": "A1.b", "title": "A1.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581451" } ], "id": 30724, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730824", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730824", "catalogueId": 1062, "uuid": "484e0488-bc7c-51b2-9b81-902217799739", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish an authoritative chain of command with clear lines of communication to remove ambiguity from individuals and teams related to managing Technology Assets, Applications, Services and/or Data (TAASD)-related risks?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Authoritative Chain of Command", "description": "

Control Description

Mechanisms exist to establish an authoritative chain of command with clear lines of communication to remove ambiguity from individuals and teams related to managing Technology Assets, Applications, Services and/or Data (TAASD)-related risks.

Evidence Request List (ERL)

E-HRS-15

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cybersecurity & Data Protection Governance (GOV) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with GOV domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Governance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT/cybersecurity personnel.\n▪ Cybersecurity and data protection governance is informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ Cybersecurity and data privacy governance practices are informally assigned as an additional duty to existing IT/cybersecurity personnel.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to establish an authoritative chain of command with clear lines of communication to remove ambiguity from individuals and teams related to managing Technology Assets, Applications, Services and/or Data (TAASD)-related risks.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "GOV-04.2", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-04.2", "references": "

Micro-Small Business (<10 staff)

∙ Organization chart with security escalation paths\n∙ Documented incident escalation contact list

Small Business (10-49 staff)

∙ Organization chart with defined security escalation paths\n∙ Documented escalation procedures for security decisions\n∙ Clear IT/security reporting relationships

Medium Business (50-249 staff)

∙ Organization chart with cybersecurity reporting lines\n∙ Formal escalation matrix for security decisions and incidents\n∙ Defined authority levels for security-related approvals

Large Business (250-999 staff)

∙ Formal organizational structure with clear cybersecurity authority chain\n∙ Documented delegation of authority for security decisions\n∙ Defined escalation procedures published in the SCRP

Enterprise (>1,000 staff)

∙ Enterprise organizational structure with defined CISO authority and reporting chain\n∙ Board-level visibility into security command structure\n∙ Integrated HR/org management system reflecting security authority\n∙ Formalized delegation of authority matrix for security decisions", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69102, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58977", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58977", "securityControlId": 30725, "ccis": [], "uuid": "9637ad0b-b6b0-597c-9ae5-5880b078236e", "testId": "GOV-05_A01", "test": "cybersecurity / data privacy measures of performance are developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-06[01]\n53A_R5_PM-06[04]", "defaultText": null }, { "id": 69103, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58977", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589771", "securityControlId": 30725, "ccis": [], "uuid": "7d02a63b-981b-52f6-a48d-fd24af419c5c", "testId": "GOV-05_A02", "test": "cybersecurity / data privacy measures of performance are monitored.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-06[02]\n53A_R5_PM-06[05]", "defaultText": null }, { "id": 69104, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589771", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589771", "securityControlId": 30725, "ccis": [], "uuid": "254d38d7-ab20-5833-82c6-70356dd0f9ba", "testId": "GOV-05_A03", "test": "the results of cybersecurity / data privacy measures of performance are reported.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-06[03]\n53A_R5_PM-06[06]", "defaultText": null } ], "externalMappings": [ { "id": 548656, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581457", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "718c33ce-2302-51a5-8917-add97e56bdf5", "parentControlId": 30725, "controlId": "9.1", "title": "9.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581457" }, { "id": 548657, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581457", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c66565b7-7cc9-5ba7-9d2a-5cf4cd33dba7", "parentControlId": 30725, "controlId": "9.1(a)", "title": "9.1(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581457" }, { "id": 548658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581457", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1dd4a01-742b-5b8f-8edc-eda2b7d4c3fc", "parentControlId": 30725, "controlId": "9.1(b)", "title": "9.1(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581457" }, { "id": 548659, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581457", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9632cc47-0bdb-5bf4-9462-0f7490e01cd5", "parentControlId": 30725, "controlId": "9.1(c)", "title": "9.1(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581457" }, { "id": 548660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581457", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7d97c21-54c1-5179-928c-43c2ee585d1c", "parentControlId": 30725, "controlId": "9.1(d)", "title": "9.1(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581457" }, { "id": 548661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581457", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "533c2274-3409-5a01-b07a-ff2167425481", "parentControlId": 30725, "controlId": "9.1(e)", "title": "9.1(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581457" }, { "id": 548662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581457", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "794ef4cd-c3bc-5110-94b2-a110dff941ff", "parentControlId": 30725, "controlId": "9.1(f)", "title": "9.1(f)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581457" }, { "id": 548684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581468", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf3abfb0-fd16-55e0-a57c-02baf3efa8e2", "parentControlId": 30725, "controlId": "PM-6", "title": "PM-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581468" }, { "id": 548685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581468", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80a6c9bc-ef62-53de-b4b3-d879249e644c", "parentControlId": 30725, "controlId": "PM-06", "title": "PM-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581468" }, { "id": 548687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581469", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bad2316-825b-596a-9b6e-b7de14bfa811", "parentControlId": 30725, "controlId": "PM-06", "title": "PM-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581469" }, { "id": 548688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581469", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b68a21e-ce3e-5e27-9f3e-1ea5f02b4a8b", "parentControlId": 30725, "controlId": "PM-06", "title": "PM-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581469" }, { "id": 548689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581469", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90e97e3a-99a0-50f1-b658-7fce218ccdda", "parentControlId": 30725, "controlId": "PM-06", "title": "PM-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581469" }, { "id": 548690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581469", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21212f87-999a-5892-abe5-08f11a975870", "parentControlId": 30725, "controlId": "PM-06", "title": "PM-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581469" }, { "id": 548691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581469", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "618171ac-58ae-5d31-ba2d-a715df586d8b", "parentControlId": 30725, "controlId": "PM-6", "title": "PM-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581469" }, { "id": 548694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58147", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef0ef5a0-19f2-5148-bfe6-a7e76c54716d", "parentControlId": 30725, "controlId": "03.12.03", "title": "03.12.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58147" }, { "id": 548696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58147", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a6357cf-15f5-55fa-999c-b7ebb116093c", "parentControlId": 30725, "controlId": "GV", "title": "GV", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58147" }, { "id": 548697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58147", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f46c461a-e839-5c8c-8bdf-7390c9afdc15", "parentControlId": 30725, "controlId": "GV.OV", "title": "GV.OV", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58147" }, { "id": 548698, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58147", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81225c31-ebee-5c52-b68f-e290e6418bf8", "parentControlId": 30725, "controlId": "GV.OV-01", "title": "GV.OV-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58147" }, { "id": 548699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58147", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ea65f69-1651-5965-b630-041e36d49c9b", "parentControlId": 30725, "controlId": "GV.OV-03", "title": "GV.OV-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58147" }, { "id": 548700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58147", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8b19f00-22aa-5efe-8649-2566a34d8cd1", "parentControlId": 30725, "controlId": "GV.SC", "title": "GV.SC", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58147" }, { "id": 548701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58147", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "367ba9ad-cdd6-5759-b0e0-836089b210fa", "parentControlId": 30725, "controlId": "GV.SC-09", "title": "GV.SC-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58147" }, { "id": 548702, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58147", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23128fc1-a0a5-58ae-9487-86e4fa46fe2c", "parentControlId": 30725, "controlId": "ID.IM-03", "title": "ID.IM-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58147" }, { "id": 548718, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ddb1f065-f8fe-551a-9164-504a1ba3cb88", "parentControlId": 30725, "controlId": "ASSET-5f", "title": "ASSET-5f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581473" }, { "id": 548719, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a1fe4b9-6b61-5d16-900d-fde17ed82e32", "parentControlId": 30725, "controlId": "THREAT-3f", "title": "THREAT-3f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581473" }, { "id": 548720, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ab5e0eb-2564-5ae9-9859-7ac75662a9f2", "parentControlId": 30725, "controlId": "RISK-5f", "title": "RISK-5f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581473" }, { "id": 548721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ce5c4a5-9436-501a-b846-7c75e76f5e1d", "parentControlId": 30725, "controlId": "ACCESS-4f", "title": "ACCESS-4f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581473" }, { "id": 548722, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a07795c1-e9a7-5571-88a8-104ae1b1769c", "parentControlId": 30725, "controlId": "SITUATION-3d", "title": "SITUATION-3d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581473" }, { "id": 548723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a192df30-f9ce-55af-ba4a-bc505fdc44dc", "parentControlId": 30725, "controlId": "SITUATION-4f", "title": "SITUATION-4f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581473" }, { "id": 548724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00ef765e-3b30-53db-88fe-26279cbeadc7", "parentControlId": 30725, "controlId": "RESPONSE-5f", "title": "RESPONSE-5f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581473" }, { "id": 548725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9066ba7-13ce-56e4-a3b1-8fc25e5fe692", "parentControlId": 30725, "controlId": "THIRD-PARTIES-3f", "title": "THIRD-PARTIES-3f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581473" }, { "id": 548726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1149bef-6ca8-510a-a19d-e433d609a865", "parentControlId": 30725, "controlId": "WORKFORCE-5f", "title": "WORKFORCE-5f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581473" }, { "id": 548727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581474", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a464fc04-6f60-5b0b-a61d-2ad4e108b863", "parentControlId": 30725, "controlId": "ARCHITECTURE-6f", "title": "ARCHITECTURE-6f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581474" }, { "id": 548728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581474", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da063392-978c-53fd-88c5-f8c64ff3e89b", "parentControlId": 30725, "controlId": "PROGRAM-2g", "title": "PROGRAM-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581474" }, { "id": 548729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581474", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55029680-c029-5eb8-9a54-a0457e66ac7d", "parentControlId": 30725, "controlId": "PROGRAM-3f", "title": "PROGRAM-3f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581474" }, { "controlId": "A.5", "title": "A.5 — DOCUMENT CONTROL AND RECORDS RETENTION AND HANDLING", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-11, MP-4, PM-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "20ade8a1-85da-54ba-88d5-077f314da777", "isPublic": true }, { "controlId": "NEI 08-09 Sec 5.0", "title": "NEI 08-09 Sec 5.0 — DOCUMENT CONTROL AND RECORDS RETENTION AND HANDLING", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6519b0f8-2b0e-5cb7-8ce5-a321506b9315", "isPublic": true }, { "controlId": "10 CFR 73.54(h), 73.55(q)", "title": "10 CFR 73.54(h), 73.55(q) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "3c178e8c-3df2-54b8-a11b-09ca1ef9de32", "isPublic": true }, { "controlId": "NSS-17T-Sec4.1", "title": "NSS-17T-Sec4.1 — Computer Security Program Management & Policy", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "2e4781ee-d8dd-5138-bde1-2dfa92a02c47", "isPublic": true }, { "controlId": "IEC-62645-5.1", "title": "IEC-62645-5.1 — Nuclear Plant Level Computer Security Programme", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "819c851d-b3ac-5399-aa50-937900bcc69e", "isPublic": true }, { "controlId": "IEC-63096-5.1", "title": "IEC-63096-5.1 — Information Security Policies for Nuclear Facilities", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "a69d79cd-0702-5bd1-beb2-b19c9b5a60db", "isPublic": true }, { "controlId": "10-CFR-73.100(b)", "title": "10-CFR-73.100(b) — Performance-Based Cybersecurity Program for Advanced Reactors", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "33d01581-b52f-5265-aa0e-dafefd0096eb", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.a", "title": "DOE-O-205.1D-4.a — Enterprise Cybersecurity Risk Management & Governance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "1b43b6a0-53ec-5ff7-be84-72159f508825", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3", "title": "REGDOC-2.12.1-Sec3 — Cyber Security Program Governance & Organization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "0bd6c6da-1ac4-5756-84ed-08c5cc0eab6a", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP1", "title": "ONR-SyAP-FSyP1 — Leadership and Management for Security (CS&IA)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "f14df418-20a1-563c-be6e-2585838cf060", "isPublic": true } ], "id": 30725, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730824", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730824", "catalogueId": 1062, "uuid": "79051751-0840-51b1-9fa0-fa1cbe7eac0e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization develop, report and monitor Security, Compliance & Resilience Program (SCRP) measures of performance?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Measures of Performance", "description": "

Control Description

Mechanisms exist to develop, report and monitor Security, Compliance & Resilience Program (SCRP) measures of performance.

Evidence Request List (ERL)

E-GOV-13

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.\n▪ Basic metrics are developed to provide operational oversight of a limited scope of cybersecurity and data protection controls.

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to develop, report and monitor Security, Compliance & Resilience Program (SCRP) measures of performance.

Level 4 - Quantitatively Controlled: Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.5", "controlId": "GOV-05", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-05", "references": "

Micro-Small Business (<10 staff)

∙ Manually-generated metrics (spreadsheet-based dashboard)\n∙ Basic security scorecard (patch %, training completion %, incident count)

Small Business (10-49 staff)

∙ Manually-generated metrics with structured reporting template\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Simple security dashboard (e.g., Power BI free tier, Google Looker Studio)

Medium Business (50-249 staff)

∙ Automated metrics via GRC or security tool integrations\n∙ Security dashboard with defined KPIs/KRIs (e.g., Power BI, GRC platform reporting)\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Large Business (250-999 staff)

∙ GRC platform with integrated metrics and dashboards\n∙ Automated data collection from security tools (SIEM, vulnerability scanner, etc.)\n∙ Defined measurement cadence aligned with board reporting schedule

Enterprise (>1,000 staff)

∙ Enterprise GRC platform with automated metrics collection and reporting\n∙ Security metrics integrated with business intelligence platform (e.g., Tableau, Power BI)\n∙ Automated benchmarking against industry standards (e.g., CIS Benchmarks, CISA metrics)\n∙ Real-time security posture dashboards for executive and board reporting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69106, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589771", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589771", "securityControlId": 30727, "ccis": [], "uuid": "efe46879-8df8-5a94-8a3b-9980dc4ab879", "testId": "GOV-05.2_A01", "test": "Key Risk Indicators (KRIs) are developed to assist senior management in performance monitoring and trend analysis of specific aspects of the organization's cybersecurity / data privacy program.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 548786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58148", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fc726d6-8521-5b62-bcaa-d951a1f8aeea", "parentControlId": 30727, "controlId": "GV.RM-01", "title": "GV.RM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58148" } ], "id": 30727, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730825", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730825", "catalogueId": 1062, "uuid": "5ff4568b-7e2f-5068-90ef-45542be77b12", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization develop, report and monitor Key Risk Indicators (KRIs) to assist senior management in performance monitoring and trend analysis of the Security, Compliance & Resilience Program (SCRP)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Key Risk Indicators (KRIs)", "description": "

Control Description

Mechanisms exist to develop, report and monitor Key Risk Indicators (KRIs) to assist senior management in performance monitoring and trend analysis of the Security, Compliance & Resilience Program (SCRP).

Evidence Request List (ERL)

E-GOV-13

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cybersecurity & Data Protection Governance (GOV) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with GOV domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Governance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT/cybersecurity personnel.\n▪ Cybersecurity and data protection governance is informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ Organizational leadership maintains an informal process to review and respond to observed trends.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to develop, report and monitor Key Risk Indicators (KRIs) to assist senior management in performance monitoring and trend analysis of the Security, Compliance & Resilience Program (SCRP).

Level 4 - Quantitatively Controlled: Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "GOV-05.2", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-05.2", "references": "

Micro-Small Business (<10 staff)

∙ Manually-generated metrics (spreadsheet)\n∙ Basic risk indicators: critical unpatched vulnerabilities, failed logins, open security incidents

Small Business (10-49 staff)

∙ Manually-generated KRI tracking with alert thresholds\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Documented risk tolerance thresholds

Medium Business (50-249 staff)

∙ Defined KRI library tied to organizational risk register\n∙ Automated KRI monitoring via GRC platform or SIEM (e.g., Splunk, Microsoft Sentinel)\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Large Business (250-999 staff)

∙ Formal KRI program with defined risk appetite thresholds\n∙ Automated KRI monitoring with escalation triggers\n∙ GRC platform with KRI dashboards linked to risk register\n∙ Regular KRI reporting to risk committee

Enterprise (>1,000 staff)

∙ Enterprise KRI program integrated with risk management framework\n∙ Automated real-time KRI monitoring with AI-assisted anomaly detection\n∙ Board-level risk indicator reporting with trend analysis\n∙ KRIs linked to enterprise risk appetite and materiality thresholds", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69107, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589781", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589781", "securityControlId": 30728, "ccis": [], "uuid": "2ce070ea-98d4-5166-9601-9e3ab965f561", "testId": "GOV-06_A01", "test": "relevant law enforcement and/or regulatory bodies are identified that necessitate communications.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69108, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589781", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589781", "securityControlId": 30728, "ccis": [], "uuid": "b89dbb75-be06-53a2-a6b9-9fa93bded184", "testId": "GOV-06_A02", "test": "contacts with relevant law enforcement and/or regulatory bodies are established and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 548797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b93fcd73-5f34-5e57-ae16-b258d05e5229", "parentControlId": 30728, "controlId": "5.5", "title": "5.5", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581482" }, { "id": 548801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d6a9195-bc53-5056-ad0c-ded5023c4065", "parentControlId": 30728, "controlId": "IR-6", "title": "IR-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581482" }, { "id": 548802, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d14fe80a-f4bc-5491-986b-b33cb87dd8eb", "parentControlId": 30728, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581482" }, { "id": 548804, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581483", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1baa2faf-29dd-5cc4-8455-b92276acf6cc", "parentControlId": 30728, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581483" }, { "id": 548805, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581483", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "741da422-7e0a-5ef1-abb3-7c753945bc65", "parentControlId": 30728, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581483" }, { "id": 548806, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581483", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4ff3050-ac66-5fd4-92ea-3d6214c616f0", "parentControlId": 30728, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581483" }, { "id": 548807, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581483", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdd39453-3318-56b5-843c-ade4ed06a464", "parentControlId": 30728, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581483" }, { "id": 548808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581483", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39d6330d-9c11-595f-8d56-f4315541c2c2", "parentControlId": 30728, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581483" }, { "id": 548809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581483", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c781d8a4-6b0c-5895-9a39-d79aa7b7046b", "parentControlId": 30728, "controlId": "IR-6", "title": "IR-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581483" }, { "controlId": "C.8.6", "title": "C.8.6 — Incident Reporting", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "49fbc97c-edc1-5783-87a0-b99975cce2e7", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.6 / RG 5.83 Rev 1", "title": "NEI 08-09 App E.8.6 / RG 5.83 Rev 1 — Incident Reporting", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "0c8d5bc4-a256-5438-970c-e4c28df5904f", "isPublic": true }, { "controlId": "10 CFR 73.77 (1/4/8-hr Reporting)", "title": "10 CFR 73.77 (1/4/8-hr Reporting) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "d0627bda-c4b9-5e09-bdf2-75225a62b3d0", "isPublic": true }, { "controlId": "C.10.9", "title": "C.10.9 — Contacts with Security Groups and Associations", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-15", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "978f95b7-1ca5-55c7-bc80-816567f4fbb8", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.9", "title": "NEI 08-09 App E.10.9 — Contacts with Security Groups and Associations", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.9", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "7ca85d07-3c51-5b89-9c88-0846253378c9", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(1)", "title": "10 CFR 73.54(d)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.10.9", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "c43c6c82-8ef5-582e-9767-4e107691d59b", "isPublic": true }, { "controlId": "CIP-014-3-R3", "title": "CIP-014-3-R3 — Transmission Owner Notification of Risk Assessment Results", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2576fc5a-987a-5340-8b46-49eb85411ea4", "isPublic": true }, { "controlId": "CIP-014-3-3.1", "title": "CIP-014-3-3.1 — If a Transmission station or Transmission substation previously identified under Requirement R1 and verified accordin...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c3e44091-ca0f-5b51-82e0-12d0f78736ca", "isPublic": true }, { "controlId": "NSS-17T-Sec4.1", "title": "NSS-17T-Sec4.1 — Computer Security Program Management & Policy", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "af2c4b02-6a87-5e26-85fa-2c846e9f144a", "isPublic": true }, { "controlId": "IEC-62645-5.1", "title": "IEC-62645-5.1 — Nuclear Plant Level Computer Security Programme", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "594a027e-bcf2-5b49-bca9-e24e21fe8165", "isPublic": true }, { "controlId": "IEC-63096-5.1", "title": "IEC-63096-5.1 — Information Security Policies for Nuclear Facilities", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "065b8a0d-b7c3-592b-956f-311a339ee413", "isPublic": true }, { "controlId": "10-CFR-73.100(b)", "title": "10-CFR-73.100(b) — Performance-Based Cybersecurity Program for Advanced Reactors", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "493598bd-796e-5a9e-afa3-2cb8d3f46070", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.a", "title": "DOE-O-205.1D-4.a — Enterprise Cybersecurity Risk Management & Governance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "4d79eec3-c47c-584f-ace1-0f14e10c1c19", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3", "title": "REGDOC-2.12.1-Sec3 — Cyber Security Program Governance & Organization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "b6cad305-3042-5675-8371-6ae0a749f2d1", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP1", "title": "ONR-SyAP-FSyP1 — Leadership and Management for Security (CS&IA)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "5b6c402e-72d1-5dad-8eb3-4f263aeabf97", "isPublic": true } ], "id": 30728, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730826", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730826", "catalogueId": 1062, "uuid": "da139df9-c3c2-545c-9463-2453a2a8ac7d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify and document appropriate contacts with relevant law enforcement and regulatory bodies?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Contacts With Authorities", "description": "

Control Description

Mechanisms exist to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cybersecurity & Data Protection Governance (GOV) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with GOV domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Governance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT/cybersecurity personnel.\n▪ Cybersecurity and data protection governance is informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ Cybersecurity personnel identify and maintain contact information for local and national law enforcement (e.g., FBI field office) in case of cybersecurity incidents that require law enforcement involvement.

Level 2 - Planned & Tracked: Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.

Level 4 - Quantitatively Controlled: Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.8.6, C.10.9
NERC-CIP (2026) Requirements: CIP-014-3-R3", "controlId": "GOV-06", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-06", "references": "

Micro-Small Business (<10 staff)

∙ Documented list of law enforcement and regulatory contacts (FBI, CISA, state AG)\n∙ MS-ISAC free membership (https://www.cisecurity.org/ms-isac)

Small Business (10-49 staff)

∙ Documented contacts with FBI Cyber Division, CISA, and relevant regulators\n∙ MS-ISAC or sector-specific ISAC membership\n∙ Pre-established law enforcement liaisons for incident response

Medium Business (50-249 staff)

∙ Integrated Security Incident Response Team (ISIRT) with defined authority contacts\n∙ CISA Cyber Liaison and FBI Cyber Division contacts\n∙ Sector ISAC membership (e.g., FS-ISAC, H-ISAC, E-ISAC)\n∙ Regulatory notification contact list (e.g., FTC, OCR, state regulators)

Large Business (250-999 staff)

∙ Integrated Security Incident Response Team (ISIRT) with pre-established authority relationships\n∙ Formal engagement with law enforcement (FBI, USSS, CISA)\n∙ Sector ISAC active membership with information sharing participation\n∙ Regulatory breach notification contacts and documented procedures

Enterprise (>1,000 staff)

∙ Dedicated government liaison program (FBI, CISA, NSA, sector regulators)\n∙ Active ISAC membership with classified threat briefing access (where applicable)\n∙ Pre-established breach notification workflows for all applicable regulators\n∙ Integrated Security Incident Response Team (ISIRT) with 24/7 law enforcement contact protocols", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69109, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589782", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589782", "securityControlId": 30729, "ccis": [], "uuid": "1659530a-bdf3-523b-aab3-a7932a212869", "testId": "GOV-07_A01", "test": "contact is established and institutionalized with selected groups and associations within the cybersecurity / data privacy community to facilitate ongoing security education and training for organizational personnel.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-15a.[01]\n53A_R5_PM-15a.[02]", "defaultText": null }, { "id": 69110, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589782", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589782", "securityControlId": 30729, "ccis": [], "uuid": "2a214a9d-01d2-5da9-af51-d88ef11bb2d2", "testId": "GOV-07_A02", "test": "contact is established and institutionalized with selected groups and associations within the cybersecurity / data privacy community to maintain currency with recommended security practices, techniques and technologies.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-15b.[01]\n53A_R5_PM-15b.[02]", "defaultText": null }, { "id": 69111, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589782", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589782", "securityControlId": 30729, "ccis": [], "uuid": "94784f95-55d9-5a47-8cf9-9b0597884ac6", "testId": "GOV-07_A03", "test": "contact is established and institutionalized with selected groups and associations within the cybersecurity / data privacy community to share current security information, including threats, vulnerabilities and incidents.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-15c.[01]\n53A_R5_PM-15c.[02]", "defaultText": null } ], "externalMappings": [ { "id": 548846, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581487", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d866c27c-3152-5331-9cfb-f1e7ff641341", "parentControlId": 30729, "controlId": "EVENT 1.3", "title": "EVENT 1.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581487" }, { "id": 548847, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5076b2a-5a46-556f-9b87-18f48aa001dd", "parentControlId": 30729, "controlId": "5.6", "title": "5.6", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581488" }, { "id": 548850, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "021603bb-45ec-5a04-be02-a0b2b31083ee", "parentControlId": 30729, "controlId": "PM-15", "title": "PM-15", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581488" }, { "id": 548851, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6567310-847a-525c-8ca0-b9639331f3cc", "parentControlId": 30729, "controlId": "PM-15", "title": "PM-15", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581488" }, { "id": 548853, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fcdfbcc-cc40-56b9-bab0-02589fade13f", "parentControlId": 30729, "controlId": "PM-15", "title": "PM-15", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581488" }, { "id": 548854, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7494ac6c-e711-523d-9287-9b8e69876e22", "parentControlId": 30729, "controlId": "PM-15", "title": "PM-15", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581488" }, { "id": 548855, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7845ee74-23b2-512d-ae35-6b7f58defcdd", "parentControlId": 30729, "controlId": "PM-15", "title": "PM-15", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581488" }, { "id": 548856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b5174a3-6cdb-5034-a093-df46e50c42c7", "parentControlId": 30729, "controlId": "PM-15", "title": "PM-15", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581489" }, { "id": 548857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "529fbe25-bc7c-580f-8340-d8d3a6e22652", "parentControlId": 30729, "controlId": "PM-15", "title": "PM-15", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581489" }, { "id": 548860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4243fcf8-ee52-5e82-a4cd-12f9a0d87f44", "parentControlId": 30729, "controlId": "ID.RA-02", "title": "ID.RA-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581489" }, { "id": 548869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58149", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a06646b4-3d98-5192-b350-0f553cd3dd6e", "parentControlId": 30729, "controlId": "PROGRAM-2j", "title": "PROGRAM-2j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58149" }, { "controlId": "C.10.9", "title": "C.10.9 — Contacts with Security Groups and Associations", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-15", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1c769455-d60d-552d-849e-6b723a1b1c49", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.9", "title": "NEI 08-09 App E.10.9 — Contacts with Security Groups and Associations", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.9", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "8afb0119-74c3-5142-85e4-af4af76ea708", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(1)", "title": "10 CFR 73.54(d)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.10.9", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "69e5c02c-c72e-5fcd-bf64-0e83f1673c12", "isPublic": true }, { "controlId": "NSS-17T-Sec4.1", "title": "NSS-17T-Sec4.1 — Computer Security Program Management & Policy", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7e2f0749-1729-527c-87fb-135e7406a83e", "isPublic": true }, { "controlId": "IEC-62645-5.1", "title": "IEC-62645-5.1 — Nuclear Plant Level Computer Security Programme", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "d7eb9982-bfa7-5e84-af84-256569484a36", "isPublic": true }, { "controlId": "IEC-63096-5.1", "title": "IEC-63096-5.1 — Information Security Policies for Nuclear Facilities", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "d5eb1658-0aec-5bd5-849c-18aada7c5aef", "isPublic": true }, { "controlId": "10-CFR-73.100(b)", "title": "10-CFR-73.100(b) — Performance-Based Cybersecurity Program for Advanced Reactors", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "57ecc433-cea1-54f4-af8f-a883c5196f19", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.a", "title": "DOE-O-205.1D-4.a — Enterprise Cybersecurity Risk Management & Governance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "d19c5489-52be-536c-9a14-1c27f90f0ebd", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3", "title": "REGDOC-2.12.1-Sec3 — Cyber Security Program Governance & Organization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "f3246418-8e81-553a-a4c3-73d6ca2b0d66", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP1", "title": "ONR-SyAP-FSyP1 — Leadership and Management for Security (CS&IA)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "a0b4a4e4-0e38-55ba-87f1-ff28fa6838ad", "isPublic": true } ], "id": 30729, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730826", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730826", "catalogueId": 1062, "uuid": "63c61937-6385-5855-b1d5-8ee90e287587", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish contact with selected groups and associations within the security, compliance and resilience communities to: \n(1) Facilitate ongoing cybersecurity and data protection education and training for organizational personnel;\n(2) Maintain currency with recommended cybersecurity and data protection practices, techniques and technologies; and\n(3) Share current cybersecurity and/or data protection-related information including threats, vulnerabilities and incidents?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Contacts With Groups & Associations", "description": "

Control Description

Mechanisms exist to establish contact with selected groups and associations within the security, compliance and resilience communities to: \n(1) Facilitate ongoing cybersecurity and data protection education and training for organizational personnel;\n(2) Maintain currency with recommended cybersecurity and data protection practices, techniques and technologies; and\n(3) Share current cybersecurity and/or data protection-related information including threats, vulnerabilities and incidents.

Evidence Request List (ERL)

E-THR-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.\n▪ Cybersecurity and data privacy personnel identify and maintain contact information for local, regional and national cybersecurity / data privacy groups and associations.

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to establish contact with selected groups and associations within the security, compliance and resilience communities to: \n(1) Facilitate ongoing cybersecurity and data protection education and training for organizational personnel;\n(2) Maintain currency with recommended cybersecurity and data protection practices, techniques and technologies; and\n(3) Share current cybersecurity and/or data protection-related information including threats, vulnerabilities and incidents.

Level 4 - Quantitatively Controlled: Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.10.9", "controlId": "GOV-07", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-07", "references": "

Micro-Small Business (<10 staff)

∙ ISACA chapters (https://www.isaca.org)\n∙ ISC2 chapters (https://www.isc2.org)\n∙ IAPP chapters (https://iapp.org)\n∙ CISA free resources and advisories (https://www.cisa.gov)\n∙ SANS reading room, vendor security blogs

Small Business (10-49 staff)

∙ ISACA chapters (https://www.isaca.org)\n∙ ISC2 chapters (https://www.isc2.org)\n∙ IAPP chapters (https://iapp.org)\n∙ CISA free resources and advisories (https://www.cisa.gov)\n∙ MS-ISAC free membership (https://www.cisecurity.org/ms-isac)

Medium Business (50-249 staff)

∙ ISACA chapters (https://www.isaca.org)\n∙ ISC2 chapters (https://www.isc2.org)\n∙ IAPP chapters (https://iapp.org)\n∙ CISA advisories and threat alerts (https://www.cisa.gov)\n∙ Sector-specific ISAC membership

Large Business (250-999 staff)

∙ ISACA chapters (https://www.isaca.org)\n∙ ISC2 chapters (https://www.isc2.org)\n∙ IAPP chapters (https://iapp.org)\n∙ Sector ISAC active membership (e.g., FS-ISAC, H-ISAC)\n∙ CISA Cyber Information Sharing program\n∙ InfraGard membership (https://www.infragard.org)

Enterprise (>1,000 staff)

∙ ISACA enterprise membership (https://www.isaca.org)\n∙ ISC2 enterprise programs (https://www.isc2.org)\n∙ IAPP enterprise membership (https://iapp.org)\n∙ Sector ISAC leadership participation\n∙ InfraGard and CISA partnership programs\n∙ Sector-specific policy engagement (FS-ISAC, NTIA, etc.)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69112, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589782", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589782", "securityControlId": 30730, "ccis": [], "uuid": "fea97498-c37e-5327-b287-b66946e1d207", "testId": "GOV-08_A01", "test": "the organization's mission is clearly defined and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69113, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589783", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589783", "securityControlId": 30730, "ccis": [], "uuid": "e2115647-ee7e-5746-b9fb-65f6cc829289", "testId": "GOV-08_A02", "test": "the organization's executive leadership defines and documents a formal business strategy that is used to provide operational guidance to key business leaders across the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 548918, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581496", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6956a4f-889a-547c-9f23-13f72f3022cb", "parentControlId": 30730, "controlId": "4.1", "title": "4.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581496" }, { "id": 548919, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581496", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28073efb-0f05-5d72-a349-27d2054fdc45", "parentControlId": 30730, "controlId": "4.2(a)", "title": "4.2(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581496" }, { "id": 548920, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581496", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62ee540a-1ec5-54c3-8459-22b780d4fa33", "parentControlId": 30730, "controlId": "4.3", "title": "4.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581496" }, { "id": 548921, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581496", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98e86ea8-a33c-5ccf-82c9-7e97a6ae767c", "parentControlId": 30730, "controlId": "5.1", "title": "5.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581496" }, { "id": 548931, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581497", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd872297-61c0-51fb-b02f-0a83e12c154c", "parentControlId": 30730, "controlId": "GV.OC", "title": "GV.OC", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581497" }, { "id": 548932, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581497", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83e4a73b-632f-538f-8ee6-a46e493c17f5", "parentControlId": 30730, "controlId": "GV.OC-01", "title": "GV.OC-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581497" }, { "id": 548933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581498", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e88a4e97-47ff-5c3d-b205-f39c054ac77f", "parentControlId": 30730, "controlId": "GV.OC-04", "title": "GV.OC-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581498" }, { "id": 548934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581498", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a40e22fd-9a4e-597e-abc5-2374c670a7b1", "parentControlId": 30730, "controlId": "GV.OV-01", "title": "GV.OV-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581498" }, { "id": 548935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581498", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27308471-3f26-5360-ba79-7a2b197c95a7", "parentControlId": 30730, "controlId": "GV.SC-03", "title": "GV.SC-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581498" }, { "controlId": "NSS-17T-Sec4.1", "title": "NSS-17T-Sec4.1 — Computer Security Program Management & Policy", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "723037c1-ef9d-5e0c-b21a-5bbe6c8dbb92", "isPublic": true }, { "controlId": "IEC-62645-5.1", "title": "IEC-62645-5.1 — Nuclear Plant Level Computer Security Programme", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "fd665d01-b1bc-55cd-b887-bfcad387ae8c", "isPublic": true }, { "controlId": "IEC-63096-5.1", "title": "IEC-63096-5.1 — Information Security Policies for Nuclear Facilities", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "ba3baf16-3975-5c95-8b40-fcfa014cb29a", "isPublic": true }, { "controlId": "10-CFR-73.100(b)", "title": "10-CFR-73.100(b) — Performance-Based Cybersecurity Program for Advanced Reactors", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "7c94bbd2-e61f-5172-994f-ddafe70b0128", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.a", "title": "DOE-O-205.1D-4.a — Enterprise Cybersecurity Risk Management & Governance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "9701be0c-cf4a-50d7-b0a1-8c05a76eddc4", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3", "title": "REGDOC-2.12.1-Sec3 — Cyber Security Program Governance & Organization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "033aee46-7946-5a69-8ec7-ec29d6819fac", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP1", "title": "ONR-SyAP-FSyP1 — Leadership and Management for Security (CS&IA)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "66e528fa-7b92-5e0b-8bbd-7f4655fcee39", "isPublic": true } ], "id": 30730, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730826", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730826", "catalogueId": 1062, "uuid": "a3a511f9-21df-5ab6-b660-eb4e272949fc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define the context of its business model and document the mission of the organization?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Defining Business Context & Mission", "description": "

Control Description

Mechanisms exist to define the context of its business model and document the organization's mission.

Evidence Request List (ERL)

E-PRM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ The context of the entity's business model and its mission are documented.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "GOV-08", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-08", "references": "

Micro-Small Business (<10 staff)

∙ Document mission statement and business context in writing

Small Business (10-49 staff)

∙ Written mission statement and business context document\n∙ Annual review

Medium Business (50-249 staff)

∙ Formal business context document\n∙ Integrated into risk management process

Large Business (250-999 staff)

∙ Formal business context and mission documentation\n∙ Linked to enterprise risk management (ERM)\n∙ Stakeholder review process

Enterprise (>1,000 staff)

∙ Enterprise business context framework\n∙ Integrated ERM platform\n∙ Formal mission alignment review process\n∙ Strategic planning documentation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69114, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589783", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589783", "securityControlId": 30731, "ccis": [], "uuid": "c9ea192b-f8b4-5411-8d49-3287a0f0d524", "testId": "GOV-09_A01", "test": "security and privacy-related control objectives are established as the basis for the selection, implementation and management of the organization's internal control system.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 548960, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581501", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f094e6db-b4da-5492-b147-a0f1ea16175f", "parentControlId": 30731, "controlId": "4.1", "title": "4.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581501" }, { "id": 548961, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581501", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae109e39-2cfd-54b5-b968-05c351d1f80f", "parentControlId": 30731, "controlId": "4.2", "title": "4.2", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581501" }, { "id": 548962, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581501", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef35d270-cd03-5ef0-90f8-c9a04d5ce890", "parentControlId": 30731, "controlId": "4.2(b)", "title": "4.2(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581501" }, { "id": 548963, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581501", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f14b3836-4667-578d-a96b-472e3a4bc431", "parentControlId": 30731, "controlId": "4.2(c)", "title": "4.2(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581501" }, { "id": 548964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581501", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81776244-a7a2-59a3-a1a0-23fc077cea9e", "parentControlId": 30731, "controlId": "5.2(b)", "title": "5.2(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581501" }, { "id": 548965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581501", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce85646e-8f4b-5ae8-90b8-9c5b6a0983f2", "parentControlId": 30731, "controlId": "6.2", "title": "6.2", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581501" }, { "id": 548966, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581501", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9048a3a1-2d8e-5ba2-9fd3-893ba8d5f5b3", "parentControlId": 30731, "controlId": "6.2(a)", "title": "6.2(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581501" }, { "id": 548967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9653132-5a29-514b-9c76-daa2d7b41c26", "parentControlId": 30731, "controlId": "6.2(b)", "title": "6.2(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581502" }, { "id": 548968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6db9754c-eaf4-58b6-b50f-46ffe9ff3b67", "parentControlId": 30731, "controlId": "6.2(c)", "title": "6.2(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581502" }, { "id": 548969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da8712e9-d337-555b-b3b6-204cbb84e4c8", "parentControlId": 30731, "controlId": "6.2(d)", "title": "6.2(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581502" }, { "id": 548970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74f4253f-8fd3-508b-82c8-1e097c12cd0f", "parentControlId": 30731, "controlId": "6.2(e)", "title": "6.2(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581502" }, { "id": 548971, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27d547fb-502d-53c4-9e14-cbc1a642eefc", "parentControlId": 30731, "controlId": "6.2(f)", "title": "6.2(f)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581502" }, { "id": 548972, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5634a306-a287-54a8-a95f-422d036c91e3", "parentControlId": 30731, "controlId": "6.2(g)", "title": "6.2(g)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581502" }, { "id": 548973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5d98e05-219e-5543-9dff-00c150d878eb", "parentControlId": 30731, "controlId": "6.2(h)", "title": "6.2(h)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581502" }, { "id": 548974, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d4a5ca7-53d0-51e4-b2a8-59bee8f5ea24", "parentControlId": 30731, "controlId": "6.2(i)", "title": "6.2(i)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581502" }, { "id": 548975, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04f7c0b1-430c-570d-8ea8-150aa12649d0", "parentControlId": 30731, "controlId": "6.2(j)", "title": "6.2(j)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581502" }, { "id": 548976, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3affbb1f-18a6-58cf-9dbc-13ddb9292f72", "parentControlId": 30731, "controlId": "6.2(k)", "title": "6.2(k)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581503" }, { "id": 548977, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581503", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03f72335-4cb3-5471-8fcf-10803eff25a5", "parentControlId": 30731, "controlId": "6.2(l)", "title": "6.2(l)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581503" }, { "id": 548985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581503", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47d6728b-4300-5081-b724-f9960cd0cd5c", "parentControlId": 30731, "controlId": "GV.SC-03", "title": "GV.SC-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581503" }, { "controlId": "NSS-17T-Sec4.1", "title": "NSS-17T-Sec4.1 — Computer Security Program Management & Policy", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "4a07a9f6-20fc-5d76-9678-0a7d6d291065", "isPublic": true }, { "controlId": "IEC-62645-5.1", "title": "IEC-62645-5.1 — Nuclear Plant Level Computer Security Programme", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "b31a041a-5f86-5ac9-87ef-fa69b5d19017", "isPublic": true }, { "controlId": "IEC-63096-5.1", "title": "IEC-63096-5.1 — Information Security Policies for Nuclear Facilities", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "ab818122-fe0f-5757-8867-518b144a85ee", "isPublic": true }, { "controlId": "10-CFR-73.100(b)", "title": "10-CFR-73.100(b) — Performance-Based Cybersecurity Program for Advanced Reactors", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "2ebaf0a8-8933-55f0-b724-b9b58eb5af88", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.a", "title": "DOE-O-205.1D-4.a — Enterprise Cybersecurity Risk Management & Governance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "bac70e59-191d-5c2c-908d-c0b4b02b6e1e", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3", "title": "REGDOC-2.12.1-Sec3 — Cyber Security Program Governance & Organization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "e894a0c6-3fd7-58c4-b0ff-215623b51100", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP1", "title": "ONR-SyAP-FSyP1 — Leadership and Management for Security (CS&IA)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "347f30ee-0e5c-5315-b7e1-74187089f414", "isPublic": true } ], "id": 30731, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730827", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730827", "catalogueId": 1062, "uuid": "bc809a5c-dc91-5f58-97c3-156f4edc7394", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish control objectives as the basis for the selection, implementation and management of the organization's internal security, compliance and resilience control system?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Define Control Objectives", "description": "

Control Description

Mechanisms exist to establish control objectives as the basis for the selection, implementation and management of the organization's internal security, compliance and resilience control system.

Evidence Request List (ERL)

E-GOV-10

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cybersecurity & Data Protection Governance (GOV) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with GOV domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Governance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT/cybersecurity personnel.\n▪ Cybersecurity and data protection governance is informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ Cybersecurity and data privacy governance practices are informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ IT /cyber engineering governance is decentralized, with the responsibility for implementing and testing cybersecurity and data protection controls being assigned to the business process owner(s), including the definition and enforcement of roles and responsibilities.

Level 2 - Planned & Tracked: Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to establish control objectives as the basis for the selection, implementation and management of the organization's internal security, compliance and resilience control system.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "GOV-09", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-09", "references": "

Micro-Small Business (<10 staff)

∙ Document basic security control objectives in a policy

Small Business (10-49 staff)

∙ Written control objectives tied to applicable requirements

Medium Business (50-249 staff)

∙ Formal control objectives framework\n∙ Mapped to applicable laws and regulations

Large Business (250-999 staff)

∙ Enterprise control objectives library\n∙ Mapped to regulatory requirements\n∙ GRC platform for control tracking

Enterprise (>1,000 staff)

∙ Enterprise GRC platform (e.g., ServiceNow GRC, RSA Archer)\n∙ Control objectives library\n∙ Automated compliance mapping\n∙ Continuous control monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69115, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589783", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589783", "securityControlId": 30732, "ccis": [], "uuid": "d1ebd20f-ee81-56f4-9f95-f8e5952f2448", "testId": "GOV-10_A01", "test": "a data integrity board/function is established.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-24", "defaultText": null }, { "id": 69116, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589784", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589784", "securityControlId": 30732, "ccis": [], "uuid": "19d21fea-f077-5041-9099-5f6633fc793f", "testId": "GOV-10_A02", "test": "the data integrity board/function reviews proposals to conduct or participate in a matching program.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-24a.", "defaultText": null }, { "id": 69117, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589784", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589784", "securityControlId": 30732, "ccis": [], "uuid": "47613bd9-5d2b-5c46-9459-2d03e600e8d5", "testId": "GOV-10_A03", "test": "the data integrity board/function conducts an annual review of all matching programs in which the organization has participated.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-24b.", "defaultText": null }, { "id": 69118, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589784", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589784", "securityControlId": 30732, "ccis": [], "uuid": "19ef4a23-36c3-5ac3-b2a9-1a289aad8d38", "testId": "GOV-10_A04", "test": "the roles of the organization's data governance body are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-23_ODP[01]", "defaultText": null }, { "id": 69119, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589784", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589784", "securityControlId": 30732, "ccis": [], "uuid": "e22756a4-0768-57d4-836b-9aac2a1831ef", "testId": "GOV-10_A05", "test": "the responsibilities of the organization's data governance body are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-23_ODP[02]", "defaultText": null }, { "id": 69120, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589784", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589784", "securityControlId": 30732, "ccis": [], "uuid": "9913d567-827e-5c86-a2b4-81bee073a67e", "testId": "GOV-10_A06", "test": "the organization's data governance body has defined roles with established responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-23", "defaultText": null } ], "externalMappings": [ { "id": 549011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "981c1ac6-b737-54d9-a01d-5fb1ad4029f6", "parentControlId": 30732, "controlId": "5.12", "title": "5.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581515" }, { "id": 549014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "318037c9-cd31-5663-99e7-fe161303f567", "parentControlId": 30732, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581515" }, { "id": 549015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9a8986f-d260-5543-beb0-80eb823b75c9", "parentControlId": 30732, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581515" }, { "id": 549018, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5cae8b9-2dcb-5833-ac7f-b072a29ab15d", "parentControlId": 30732, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581516" }, { "id": 549019, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8c26559-f3b9-5fa6-b41a-2c85be38b853", "parentControlId": 30732, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581516" }, { "id": 549020, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3011362e-c789-59b4-b582-9e7333365a1a", "parentControlId": 30732, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581516" }, { "id": 549021, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "313f08ee-f7d4-5cb2-bec7-376db5fda6f1", "parentControlId": 30732, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581516" }, { "id": 549022, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb6877be-c485-548e-a064-c3ac90a2b759", "parentControlId": 30732, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581516" }, { "id": 549023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf8a6c2d-1cff-57df-b82a-822deae2efaa", "parentControlId": 30732, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581516" }, { "id": 549024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f51d11f-95b4-58bc-895d-1704b3ed626a", "parentControlId": 30732, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581517" }, { "id": 549025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "921303ab-3065-5544-bfcb-81a5720099fe", "parentControlId": 30732, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581517" }, { "id": 549026, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1827a2b-2b16-58d3-ab3a-c99349749861", "parentControlId": 30732, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581517" }, { "controlId": "NSS-17T-Sec4.1", "title": "NSS-17T-Sec4.1 — Computer Security Program Management & Policy", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "bf1c4bb8-28a6-5abd-b947-39526bf7b99c", "isPublic": true }, { "controlId": "IEC-62645-5.1", "title": "IEC-62645-5.1 — Nuclear Plant Level Computer Security Programme", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "ef4bf2b3-efff-5516-8238-c1de436ef66c", "isPublic": true }, { "controlId": "IEC-63096-5.1", "title": "IEC-63096-5.1 — Information Security Policies for Nuclear Facilities", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "f4366ca3-035a-5717-a6e5-6816ab8e6667", "isPublic": true }, { "controlId": "10-CFR-73.100(b)", "title": "10-CFR-73.100(b) — Performance-Based Cybersecurity Program for Advanced Reactors", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "0396557d-faf1-5a5d-9c59-1870ca367ea4", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.a", "title": "DOE-O-205.1D-4.a — Enterprise Cybersecurity Risk Management & Governance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "2a0b3d77-a436-50ca-9faa-c8f45f1f12ee", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3", "title": "REGDOC-2.12.1-Sec3 — Cyber Security Program Governance & Organization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "03963f18-acc8-5f23-a555-7669fcb2a3e3", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP1", "title": "ONR-SyAP-FSyP1 — Leadership and Management for Security (CS&IA)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "12021aa7-2268-5fad-822e-c8361821a15b", "isPublic": true } ], "id": 30732, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730827", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730827", "catalogueId": 1062, "uuid": "44b9d408-1a01-55e2-8103-1f20b395f8e9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate data governance to oversee its policies, standards and procedures so that sensitive/regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Data Governance", "description": "

Control Description

Mechanisms exist to facilitate data governance to oversee the organization's policies, standards and procedures so that sensitive/regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cybersecurity & Data Protection Governance (GOV) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with GOV domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Governance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT/cybersecurity personnel.\n▪ Cybersecurity and data protection governance is informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ Administrative processes require all employees and contractors to apply cybersecurity and data protection principles in their daily work (e.g., policies & standards).\n▪ Cybersecurity and data privacy governance practices are informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ IT /cyber engineering governance is decentralized, with the responsibility for implementing and testing cybersecurity and data protection controls being assigned to the business process owner(s), including the definition and enforcement of roles and responsibilities.

Level 2 - Planned & Tracked: Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to facilitate data governance to oversee the organization's policies, standards and procedures so that sensitive/regulated data is effectively managed and maintained in accordance with applicable statutory, regulatory and contractual obligations.

Level 4 - Quantitatively Controlled: Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "GOV-10", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-10", "references": "

Micro-Small Business (<10 staff)

∙ Basic data inventory (spreadsheet)\n∙ Designated data owner / data custodian role\n∙ Informal data classification policy

Small Business (10-49 staff)

∙ Data governance policy and data classification standard\n∙ Designated data owner(s) by data type\n∙ Basic data inventory with sensitivity classification

Medium Business (50-249 staff)

∙ Formal data governance program with data classification scheme\n∙ Data steward and data owner roles defined\n∙ Data catalog tool (e.g., Microsoft Purview free tier, OpenMetadata)

Large Business (250-999 staff)

∙ Chief Data Officer (CDO) or equivalent role\n∙ Formal data governance committee\n∙ Enterprise data catalog and classification tool (e.g., Microsoft Purview, Collibra)\n∙ Data quality and lineage management program

Enterprise (>1,000 staff)

∙ Chief Data Officer (CDO) with executive authority\n∙ Enterprise Data Governance Council\n∙ Enterprise data catalog, classification, and lineage platform (e.g., Collibra, Alation, Informatica)\n∙ Data governance integrated with privacy, compliance, and risk programs", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69121, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589784", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589784", "securityControlId": 30733, "ccis": [], "uuid": "b6da4c5e-77be-5a81-8824-ab5855343596", "testId": "GOV-11_A01", "test": "systems or system components supporting mission-essential services or functions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-32_ODP", "defaultText": null }, { "id": 69122, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589785", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589785", "securityControlId": 30733, "ccis": [], "uuid": "e46b7d45-13a9-50f6-aebf-b2754eb2be94", "testId": "GOV-11_A02", "test": "systems or system components supporting mission-essential services or functions are analyzed to ensure that the information resources are being used in a manner that is consistent with their intended purpose.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-32", "defaultText": null } ], "externalMappings": [ { "id": 549046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581519", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1473dff5-12ba-59de-a2d6-36100afdfeb3", "parentControlId": 30733, "controlId": "PM-32", "title": "PM-32", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581519" }, { "id": 549047, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16c33847-5de6-5dd5-bc4b-ec00675fa7da", "parentControlId": 30733, "controlId": "PM-32", "title": "PM-32", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58152" }, { "id": 549048, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51d39076-04cb-5cf7-844d-e9594ac56315", "parentControlId": 30733, "controlId": "PM-32", "title": "PM-32", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58152" }, { "id": 549049, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01a8a5c6-2c03-58f8-8cd0-c5a7cf82ea5b", "parentControlId": 30733, "controlId": "PM-32", "title": "PM-32", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58152" }, { "id": 549050, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9029648-5885-547a-8e05-f93ef0032c8d", "parentControlId": 30733, "controlId": "PM-32", "title": "PM-32", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58152" }, { "id": 549052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9882154-5f5a-5fed-b467-30ac89fdd084", "parentControlId": 30733, "controlId": "PM-32", "title": "PM-32", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58152" }, { "controlId": "NSS-17T-Sec4.1", "title": "NSS-17T-Sec4.1 — Computer Security Program Management & Policy", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "1a674477-024c-59be-9435-799c6f84d12b", "isPublic": true }, { "controlId": "IEC-62645-5.1", "title": "IEC-62645-5.1 — Nuclear Plant Level Computer Security Programme", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "74545ea2-2309-53d1-8eb8-e8b8b809023b", "isPublic": true }, { "controlId": "IEC-63096-5.1", "title": "IEC-63096-5.1 — Information Security Policies for Nuclear Facilities", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "6732dbf6-8738-5b21-8a03-eae9ea2e307e", "isPublic": true }, { "controlId": "10-CFR-73.100(b)", "title": "10-CFR-73.100(b) — Performance-Based Cybersecurity Program for Advanced Reactors", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "aaf56a41-51d8-56a8-8544-1e6b47b28fdf", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.a", "title": "DOE-O-205.1D-4.a — Enterprise Cybersecurity Risk Management & Governance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "55d4fda7-de26-55d0-b108-8faed3355b59", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3", "title": "REGDOC-2.12.1-Sec3 — Cyber Security Program Governance & Organization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "55f2e8a3-67cc-505e-ad77-f5052771022d", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP1", "title": "ONR-SyAP-FSyP1 — Leadership and Management for Security (CS&IA)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "dc0ffafe-6ec1-5809-8e7b-e883cb8a0dae", "isPublic": true } ], "id": 30733, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730827", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730828", "catalogueId": 1062, "uuid": "4ac72d5a-bf06-55f2-811f-fde06b88b53c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization monitor mission/business-critical Technology Assets, Applications and/or Services (TAAS) to ensure those resources are being used consistent with their intended purpose?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Purpose Validation", "description": "

Control Description

Mechanisms exist to monitor mission/business-critical Technology Assets, Applications and/or Services (TAAS) to ensure those resources are being used consistent with their intended purpose.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to monitor mission/business-critical Technology Assets, Applications and/or Services (TAAS) to ensure those resources are being used consistent with their intended purpose.

Level 4 - Quantitatively Controlled: Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "GOV-11", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-11", "references": "

Micro-Small Business (<10 staff)

∙ Document intended use for critical systems

Small Business (10-49 staff)

∙ Documented intended use policy for critical systems\n∙ Periodic review

Medium Business (50-249 staff)

∙ Asset purpose documentation\n∙ Log review for anomalous use patterns

Large Business (250-999 staff)

∙ SIEM for usage monitoring\n∙ Asset management system with intended-use tagging\n∙ Periodic usage audits

Enterprise (>1,000 staff)

∙ SIEM platform (e.g., Splunk, IBM QRadar)\n∙ UEBA for anomaly detection\n∙ Asset inventory with purpose classification\n∙ Automated alerting for out-of-purpose usage", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69132, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589787", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589787", "securityControlId": 30737, "ccis": [], "uuid": "e19846d8-8f46-56a1-b5de-54217ab5ba96", "testId": "GOV-15_A01", "test": "roles and responsibilities exist to compel data and/or process owners to operationalize cybersecurity / data privacy practices for each system, application and/or service under their control.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69133, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589788", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589788", "securityControlId": 30737, "ccis": [], "uuid": "87584c56-4e4a-5595-b9a0-175951660bb8", "testId": "GOV-15_A02", "test": "Individual Contributor (IC) performance reviews cover how data and/or process owners operationalized cybersecurity / data privacy practices for each system, application and/or service under their control.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69134, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589788", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589788", "securityControlId": 30737, "ccis": [], "uuid": "6d362148-b600-5cc9-80fc-ccb356a17858", "testId": "GOV-15_A03", "test": "organization-defined systems security engineering principles are applied to the development or modification of the system and system components.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 69135, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589788", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589788", "securityControlId": 30737, "ccis": [], "uuid": "d972ed73-e14f-51fd-b919-96dc66711961", "testId": "GOV-15_A04", "test": " are applied to the development or modification of the system and system components.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: Guidance: At a minimum, documentation that provides user and administrator guidance for the implementation and operation of controls. The level of detail required in such documentation should be based on the degree to which organizations depend on the capabilities, functions, or mechanisms to meet risk response expectations. Requirements can include mandated configuration settings that specify allowed functions, ports, protocols, and services. Acceptance criteria for systems, system components, and system services are defined in the same manner as the criteria for any organizational acquisition or procurement.", "otherId": "171A_R3_A.03.16.01", "defaultText": null } ], "externalMappings": [ { "id": 549165, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581534", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d9c7edd-51a3-52d6-9895-f8970c5886d6", "parentControlId": 30737, "controlId": "03.15.01.a", "title": "03.15.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581534" }, { "id": 549166, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581534", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a77e4a75-6cfe-5f12-9498-5612f7a21b27", "parentControlId": 30737, "controlId": "03.17.01.a", "title": "03.17.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581534" }, { "id": 549175, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581535", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14a3fa31-730f-5be1-a1a1-7bc0eea647db", "parentControlId": 30737, "controlId": "ARCHITECTURE-1f", "title": "ARCHITECTURE-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581535" }, { "id": 549194, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581537", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b5e8433-a48b-5b66-b98b-e372cfc4f003", "parentControlId": 30737, "controlId": "§117.18(a)(1)", "title": "§117.18(a)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581537" }, { "id": 549195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581537", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ee5c062-19e6-5a0c-8417-76bdd89325ee", "parentControlId": 30737, "controlId": "§117.18(e)", "title": "§117.18(e)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581537" }, { "id": 549196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581537", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "adbabf7a-2134-5de3-a3fa-94866722d458", "parentControlId": 30737, "controlId": "9-2.b", "title": "9-2.b", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581537" }, { "id": 549275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3339c02-772d-5428-b006-0c49b1dadc41", "parentControlId": 30737, "controlId": "B4.a", "title": "B4.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581546" }, { "controlId": "NSS-17T-Sec4.1", "title": "NSS-17T-Sec4.1 — Computer Security Program Management & Policy", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "e6647ad7-8c3d-5c27-aaa5-b6bd5af66d5d", "isPublic": true }, { "controlId": "IEC-62645-5.1", "title": "IEC-62645-5.1 — Nuclear Plant Level Computer Security Programme", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "8a2a527d-3105-59b8-81f1-96336b398af0", "isPublic": true }, { "controlId": "IEC-63096-5.1", "title": "IEC-63096-5.1 — Information Security Policies for Nuclear Facilities", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "c467b934-adf1-5119-9965-8820cb225e2f", "isPublic": true }, { "controlId": "10-CFR-73.100(b)", "title": "10-CFR-73.100(b) — Performance-Based Cybersecurity Program for Advanced Reactors", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "f59a8c7e-54a3-514b-b7e5-5809358e159f", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.a", "title": "DOE-O-205.1D-4.a — Enterprise Cybersecurity Risk Management & Governance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "fe19990d-ca73-5561-951d-85db2e7bd0b8", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3", "title": "REGDOC-2.12.1-Sec3 — Cyber Security Program Governance & Organization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "8d3a8422-fd5e-522c-ac6e-8ea591d9e3f7", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP1", "title": "ONR-SyAP-FSyP1 — Leadership and Management for Security (CS&IA)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "e7bde28a-33bc-5918-b3a6-2ffd552b01c8", "isPublic": true } ], "id": 30737, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730829", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730829", "catalogueId": 1062, "uuid": "27d58fe0-fbcf-5729-9af6-6f010afefced", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization compel data and/or process owners to operationalize security, compliance and resilience practices for each Technology Asset, Application and/or Service (TAAS) under their control?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Operationalizing Security, Compliance & Resilience Capabilities", "description": "

Control Description

Mechanisms exist to compel data and/or process owners to operationalize security, compliance and resilience practices for each Technology Asset, Application and/or Service (TAAS) under their control.

Evidence Request List (ERL)

E-GOV-19

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to compel data and/or process owners to operationalize security, compliance and resilience practices for each Technology Asset, Application and/or Service (TAAS) under their control.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "GOV-15", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-15", "references": "

Micro-Small Business (<10 staff)

∙ ComplianceForge - Cybersecurity Standardized Operating Procedures (CSOP) (https://complianceforge.com)

Small Business (10-49 staff)

∙ ComplianceForge - Cybersecurity Standardized Operating Procedures (CSOP) (https://complianceforge.com)

Medium Business (50-249 staff)

∙ ComplianceForge - Cybersecurity Standardized Operating Procedures (CSOP) (https://complianceforge.com)

Large Business (250-999 staff)

∙ ComplianceForge - Cybersecurity Standardized Operating Procedures (CSOP) (https://complianceforge.com)

Enterprise (>1,000 staff)

∙ ComplianceForge - Cybersecurity Standardized Operating Procedures (CSOP) (https://complianceforge.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69136, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589788", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589788", "securityControlId": 30738, "ccis": [], "uuid": "4cb50a7d-fb4b-50a9-85d6-6bd609e2ac94", "testId": "GOV-15.1_A01", "test": "roles and responsibilities exist to compel data and/or process owners to select required cybersecurity / data privacy controls for each system, application and/or service under their control.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69137, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589789", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589789", "securityControlId": 30738, "ccis": [], "uuid": "7729d494-f79d-55fd-9234-44e36ba15d2d", "testId": "GOV-15.1_A02", "test": "Individual Contributor (IC) performance reviews cover how data and/or process owners select required cybersecurity / data privacy controls for each system, application and/or service under their control.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 549310, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e84278e5-a498-52ab-b4e3-0a077d8c35e1", "parentControlId": 30738, "controlId": "03.15.01.a", "title": "03.15.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58155" }, { "id": 549311, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78ccd759-eb27-5c1e-a73a-ea90287fafba", "parentControlId": 30738, "controlId": "03.17.01.a", "title": "03.17.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58155" }, { "id": 549325, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17055502-f588-5fc6-bbd0-da1511f28a33", "parentControlId": 30738, "controlId": "ARCHITECTURE-1f", "title": "ARCHITECTURE-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581561" }, { "id": 549326, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12b040a8-73ec-53e1-95a0-f3e8c9ae6b15", "parentControlId": 30738, "controlId": "ARCHITECTURE-1g", "title": "ARCHITECTURE-1g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581561" }, { "id": 549338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "558c1e21-42f5-59c4-aa88-7f956780fba8", "parentControlId": 30738, "controlId": "§117.18(a)(1)", "title": "§117.18(a)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581562" }, { "id": 549339, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbbe98e8-ae51-543b-b277-b616d99aa656", "parentControlId": 30738, "controlId": "§117.18(a)(2)", "title": "§117.18(a)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581562" }, { "id": 549340, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cf4cea2-a274-5ff4-abc5-d087405df642", "parentControlId": 30738, "controlId": "§117.18(e)(1)", "title": "§117.18(e)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581562" }, { "id": 549341, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68d21dde-72ae-58ac-85e1-5fe18191b9a1", "parentControlId": 30738, "controlId": "§117.18(e)(2)", "title": "§117.18(e)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581563" }, { "id": 549342, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ca5ef48-a728-5290-b49e-6fb60862a298", "parentControlId": 30738, "controlId": "§117.18(e)(3)", "title": "§117.18(e)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581563" }, { "id": 549343, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc13247d-8583-5c31-97f6-32c2608eba9d", "parentControlId": 30738, "controlId": "9-2.b", "title": "9-2.b", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581563" }, { "id": 549398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581569", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef93a93b-36c3-5660-8b0e-bb3b8693f696", "parentControlId": 30738, "controlId": "B4.a", "title": "B4.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581569" } ], "id": 30738, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730829", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730829", "catalogueId": 1062, "uuid": "bd595203-8580-5e18-ab0f-7da247d26124", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization compel data and/or process owners to select required security, compliance and resilience controls for each Technology Asset, Application and/or Service (TAAS) under their control?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Select Controls", "description": "

Control Description

Mechanisms exist to compel data and/or process owners to select required security, compliance and resilience controls for each Technology Asset, Application and/or Service (TAAS) under their control.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to compel data and/or process owners to select required security, compliance and resilience controls for each Technology Asset, Application and/or Service (TAAS) under their control.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "GOV-15.1", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-15.1", "references": "

Micro-Small Business (<10 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Small Business (10-49 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Medium Business (50-249 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Large Business (250-999 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Enterprise (>1,000 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69138, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589789", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589789", "securityControlId": 30739, "ccis": [], "uuid": "0c717ef8-688e-52ef-8670-9786e5e0d675", "testId": "GOV-15.2_A01", "test": "roles and responsibilities exist to compel data and/or process owners to implement required cybersecurity / data privacy controls for each system, application and/or service under their control.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69139, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589789", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589789", "securityControlId": 30739, "ccis": [], "uuid": "94f5587f-167a-5cd5-9938-74049524ffbb", "testId": "GOV-15.2_A02", "test": "Individual Contributor (IC) performance reviews cover how data and/or process owners implement required cybersecurity / data privacy controls for each system, application and/or service under their control.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 549421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b78355c-5198-5314-9525-869646da07d3", "parentControlId": 30739, "controlId": "03.15.01.a", "title": "03.15.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581572" }, { "id": 549422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "819bc24e-7ee3-5c6c-b857-8c715e7d3713", "parentControlId": 30739, "controlId": "03.17.01.a", "title": "03.17.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581572" }, { "id": 549439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "200dad7c-6e0b-504e-bf14-ce67a9ca8f69", "parentControlId": 30739, "controlId": "§117.18(a)(1)", "title": "§117.18(a)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581574" }, { "id": 549440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "deb0b6f3-7e44-532d-9728-1926fdb7985f", "parentControlId": 30739, "controlId": "§117.18(e)(4)", "title": "§117.18(e)(4)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581574" }, { "id": 549441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c336152d-3c9f-588a-87f5-f21f1ee65150", "parentControlId": 30739, "controlId": "9-2.b", "title": "9-2.b", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581574" }, { "id": 549487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99f8c397-797c-57f1-a9e3-3474f806321c", "parentControlId": 30739, "controlId": "B4.a", "title": "B4.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58158" } ], "id": 30739, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730829", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730829", "catalogueId": 1062, "uuid": "01a08c04-1b03-5501-b215-7ac54dec1219", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization compel data and/or process owners to implement required security, compliance and resilience controls for each Technology Asset, Application and/or Service (TAAS) under their control?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Implement Controls", "description": "

Control Description

Mechanisms exist to compel data and/or process owners to implement required security, compliance and resilience controls for each Technology Asset, Application and/or Service (TAAS) under their control.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to compel data and/or process owners to implement required security, compliance and resilience controls for each Technology Asset, Application and/or Service (TAAS) under their control.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "GOV-15.2", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-15.2", "references": "

Micro-Small Business (<10 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Small Business (10-49 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Medium Business (50-249 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Large Business (250-999 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Enterprise (>1,000 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69140, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589789", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58979", "securityControlId": 30740, "ccis": [], "uuid": "cece47ad-078b-5240-9214-e16e5e898f70", "testId": "GOV-15.3_A01", "test": "roles and responsibilities exist to compel data and/or process owners to assess if required cybersecurity / data privacy controls for each system, application and/or service under their control are implemented correctly and are operating as intended.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69141, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58979", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58979", "securityControlId": 30740, "ccis": [], "uuid": "557f3e9e-1de3-53b2-8037-bb5112974d97", "testId": "GOV-15.3_A02", "test": "Individual Contributor (IC) performance reviews cover how data and/or process owners assess if required cybersecurity / data privacy controls for each system, application and/or service under their control are implemented correctly and are operating as intended.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 549504, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "243ed51f-4339-50c3-923d-95ebedb5a5ca", "parentControlId": 30740, "controlId": "03.15.01.a", "title": "03.15.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581582" }, { "id": 549505, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "593ba7f4-12b0-593c-8774-b0a5cf1f3030", "parentControlId": 30740, "controlId": "03.17.01.a", "title": "03.17.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581582" }, { "id": 549520, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75c9ad9a-0b25-5a12-8902-1740ffdc9364", "parentControlId": 30740, "controlId": "§117.18(a)(1)", "title": "§117.18(a)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581584" }, { "id": 549521, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00a2d611-0e78-590b-99ca-b9e222ea6efd", "parentControlId": 30740, "controlId": "§117.18(e)(5)", "title": "§117.18(e)(5)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581584" }, { "id": 549522, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9769d55-4c46-5e68-b602-f31646033bb3", "parentControlId": 30740, "controlId": "9-2.b", "title": "9-2.b", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581584" } ], "id": 30740, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73083", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73083", "catalogueId": 1062, "uuid": "4cf8da59-370e-5a08-a0ba-6572f606c07c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization compel data and/or process owners to assess if required security, compliance and resilience controls for each Technology Asset, Application and/or Service (TAAS) under their control are:\n(1) Implemented correctly; and \n(2) Operating as intended?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Assess Controls", "description": "

Control Description

Mechanisms exist to compel data and/or process owners to assess if required security, compliance and resilience controls for each Technology Asset, Application and/or Service (TAAS) under their control are:\n(1) Implemented correctly; and \n(2) Operating as intended.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to compel data and/or process owners to assess if required security, compliance and resilience controls for each Technology Asset, Application and/or Service (TAAS) under their control are:\n(1) Implemented correctly; and \n(2) Operating as intended.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "GOV-15.3", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-15.3", "references": "

Micro-Small Business (<10 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Small Business (10-49 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Medium Business (50-249 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Large Business (250-999 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Enterprise (>1,000 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69142, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58979", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58979", "securityControlId": 30741, "ccis": [], "uuid": "d7725a86-f309-599c-a46a-1b1e16fa71bf", "testId": "GOV-15.4_A01", "test": "roles and responsibilities exist to compel data and/or process owners to obtain authorization for the production use of each system, application and/or service under their control.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69143, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58979", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58979", "securityControlId": 30741, "ccis": [], "uuid": "099b1976-2266-5e82-b5b8-811716cc8029", "testId": "GOV-15.4_A02", "test": "Individual Contributor (IC) performance reviews cover how data and/or process owners obtain authorization for the production use of each system, application and/or service under their control.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 549560, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46b8035d-a170-5a38-a6a3-84eb42faf4f5", "parentControlId": 30741, "controlId": "03.15.01.a", "title": "03.15.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581599" }, { "id": 549561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581599", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aabb5330-c999-5d8d-957a-3818c6d7f579", "parentControlId": 30741, "controlId": "03.17.01.a", "title": "03.17.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581599" }, { "id": 549572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5816", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ab6fafa-c18f-5c89-8410-053500810475", "parentControlId": 30741, "controlId": "§117.18(a)(1)", "title": "§117.18(a)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5816" }, { "id": 549573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5816", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f246b54b-5ef8-59d4-95f5-a48b06c5b976", "parentControlId": 30741, "controlId": "§117.18(e)(6)", "title": "§117.18(e)(6)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5816" }, { "id": 549574, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5816", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a711b007-ea99-5caf-a4ef-8d90b793c872", "parentControlId": 30741, "controlId": "9-2.b", "title": "9-2.b", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5816" }, { "id": 549575, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5816", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbf5473b-29f6-5b7b-9c17-e6e3c47d403a", "parentControlId": 30741, "controlId": "9-3.a", "title": "9-3.a", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5816" }, { "id": 549576, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5816", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fe0c611-3fd4-5c46-9919-2fe28c0bed8a", "parentControlId": 30741, "controlId": "9-3.b", "title": "9-3.b", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5816" }, { "id": 549577, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84784b15-9055-5a3f-9e9e-4aa84fee716b", "parentControlId": 30741, "controlId": "9-3.d", "title": "9-3.d", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581601" } ], "id": 30741, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730831", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730831", "catalogueId": 1062, "uuid": "9d16c2d0-3bde-5027-bf84-3302706db25d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization compel data and/or process owners to obtain authorization for the production use of each Technology Asset, Application and/or Service (TAAS) under their control?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Authorize Technology Assets, Applications and/or Services (TAAS)", "description": "

Control Description

Mechanisms exist to compel data and/or process owners to obtain authorization for the production use of each Technology Asset, Application and/or Service (TAAS) under their control.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to compel data and/or process owners to obtain authorization for the production use of each Technology Asset, Application and/or Service (TAAS) under their control.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "GOV-15.4", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-15.4", "references": "

Micro-Small Business (<10 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Small Business (10-49 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Medium Business (50-249 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Large Business (250-999 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Enterprise (>1,000 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69144, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589791", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589791", "securityControlId": 30742, "ccis": [], "uuid": "7f4b9a79-2af1-5864-b8df-7ea832787f7e", "testId": "GOV-15.5_A01", "test": "roles and responsibilities exist to compel data and/or process owners to monitor systems, applications and/or services under their control on an ongoing basis for applicable threats and risks, as well as to ensure cybersecurity / data privacy controls are operating as intended.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69145, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589791", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589791", "securityControlId": 30742, "ccis": [], "uuid": "2af08ec2-b551-5289-bc02-e8327248b51f", "testId": "GOV-15.5_A02", "test": "Individual Contributor (IC) performance reviews cover how data and/or process owners monitor systems, applications and/or services under their control on an ongoing basis for applicable threats and risks, as well as to ensure cybersecurity / data privacy controls are operating as intended.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 549597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581603", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bfcb11d-ae0b-5e5b-9433-a36fbdfaec82", "parentControlId": 30742, "controlId": "9.2.2", "title": "9.2.2", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581603" }, { "id": 549602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581603", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7501064b-62d0-5aac-8e74-249d5f10c143", "parentControlId": 30742, "controlId": "03.15.01.a", "title": "03.15.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581603" }, { "id": 549603, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581603", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93b3de28-7f34-554a-8e45-56729650648a", "parentControlId": 30742, "controlId": "03.17.01.a", "title": "03.17.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581603" }, { "id": 549612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe13fedf-51e9-549d-8eee-cd09c7ace5c5", "parentControlId": 30742, "controlId": "§117.18(a)(1)", "title": "§117.18(a)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581604" }, { "id": 549613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5f3e0de-e657-58fb-9f11-46241d8c70da", "parentControlId": 30742, "controlId": "§117.18(e)(7)", "title": "§117.18(e)(7)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581604" }, { "id": 549614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5765f50-46be-55c7-b36d-a3386680f938", "parentControlId": 30742, "controlId": "§117.18(e)(7)(i)", "title": "§117.18(e)(7)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581605" }, { "id": 549615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14a5de77-9f35-50dd-b8bd-6ffa18137a59", "parentControlId": 30742, "controlId": "§117.18(e)(7)(ii)", "title": "§117.18(e)(7)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581605" }, { "id": 549616, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "354349d6-8b29-5fff-81ab-3392abd41b1b", "parentControlId": 30742, "controlId": "§117.18(e)(7)(iii)", "title": "§117.18(e)(7)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581605" }, { "id": 549617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0aea8e2-9f85-56f4-8fea-010812ef0f58", "parentControlId": 30742, "controlId": "§117.18(e)(7)(iv)", "title": "§117.18(e)(7)(iv)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581605" }, { "id": 549618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f959786b-2a1b-5392-ad45-4dfdaaa7011b", "parentControlId": 30742, "controlId": "9-2.b", "title": "9-2.b", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581605" } ], "id": 30742, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730831", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730831", "catalogueId": 1062, "uuid": "cf37248d-5983-520a-9874-12061d153218", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization compel data and/or process owners to monitor Technology Assets, Applications, Services and/or Data (TAASD) under their control on an ongoing basis for applicable threats and risks, as well as to ensure security, compliance and resilience controls are operating as intended?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Monitor Controls", "description": "

Control Description

Mechanisms exist to compel data and/or process owners to monitor Technology Assets, Applications, Services and/or Data (TAASD) under their control on an ongoing basis for applicable threats and risks, as well as to ensure security, compliance and resilience controls are operating as intended.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to compel data and/or process owners to monitor Technology Assets, Applications, Services and/or Data (TAASD) under their control on an ongoing basis for applicable threats and risks, as well as to ensure security, compliance and resilience controls are operating as intended.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "GOV-15.5", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-15.5", "references": "

Micro-Small Business (<10 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Small Business (10-49 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Medium Business (50-249 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Large Business (250-999 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)

Enterprise (>1,000 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69146, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589791", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589791", "securityControlId": 30743, "ccis": [], "uuid": "c2bd5cd5-7402-5c5d-a597-2d2d23bcd274", "testId": "GOV-16_A01", "test": "organization-specific criteria to define a materiality threshold capable of designating an incident as material is documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 549644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0e53951-2d0c-56d2-a78f-6a10f55c32af", "parentControlId": 30743, "controlId": "DE.AE-04", "title": "DE.AE-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581608" }, { "controlId": "NSS-17T-Sec4.1", "title": "NSS-17T-Sec4.1 — Computer Security Program Management & Policy", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "9908fe9b-e1c5-505e-a2ef-b7c09befbcae", "isPublic": true }, { "controlId": "IEC-62645-5.1", "title": "IEC-62645-5.1 — Nuclear Plant Level Computer Security Programme", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "42d8cad5-d865-5f2e-a02a-e089bf866e29", "isPublic": true }, { "controlId": "IEC-63096-5.1", "title": "IEC-63096-5.1 — Information Security Policies for Nuclear Facilities", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "7203df54-5ed7-53cc-b87d-74fc4eb62c2f", "isPublic": true }, { "controlId": "10-CFR-73.100(b)", "title": "10-CFR-73.100(b) — Performance-Based Cybersecurity Program for Advanced Reactors", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "75a1e4ec-9536-58f2-bc7b-6f0d942c047a", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.a", "title": "DOE-O-205.1D-4.a — Enterprise Cybersecurity Risk Management & Governance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "5f95b9ca-d221-5744-aa1d-30e3358ce313", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3", "title": "REGDOC-2.12.1-Sec3 — Cyber Security Program Governance & Organization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "68296fed-6852-5a61-87fa-a2f2218b6bce", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP1", "title": "ONR-SyAP-FSyP1 — Leadership and Management for Security (CS&IA)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "b9866dd6-a2b5-5a6a-978c-a5127005bb81", "isPublic": true } ], "id": 30743, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730832", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730832", "catalogueId": 1062, "uuid": "5f5644be-4a75-5250-83fd-00831bfde178", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define materiality threshold criteria capable of designating an incident as material?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Materiality Determination", "description": "

Control Description

Mechanisms exist to define materiality threshold criteria capable of designating an incident as material.

Evidence Request List (ERL)

E-GOV-14

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to define materiality threshold criteria capable of designating an incident as material.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "GOV-16", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-16", "references": "

Micro-Small Business (<10 staff)

∙ SCF Secure, Compliant & Resilient (SCR) Risk Management Model (SCR-RMM) (https://securecontrolsframework.com/risk-management-model)\n∙ Simple materiality threshold definition (document what constitutes a material incident)

Small Business (10-49 staff)

∙ SCF Secure, Compliant & Resilient (SCR) Risk Management Model (SCR-RMM) (https://securecontrolsframework.com/risk-management-model)\n∙ Documented materiality criteria aligned to business impact and applicable regulations

Medium Business (50-249 staff)

∙ SCF Secure, Compliant & Resilient (SCR) Risk Management Model (SCR-RMM) (https://securecontrolsframework.com/risk-management-model)\n∙ Documented materiality thresholds (financial, reputational, operational, regulatory)\n∙ SEC cybersecurity disclosure rules considered (if applicable)

Large Business (250-999 staff)

∙ SCF Secure, Compliant & Resilient (SCR) Risk Management Model (SCR-RMM) (https://securecontrolsframework.com/risk-management-model)\n∙ Formal materiality determination process aligned to SEC cybersecurity disclosure rules (if public)\n∙ Cross-functional materiality review team (Legal, Finance, CISO, Operations)

Enterprise (>1,000 staff)

∙ SCF Secure, Compliant & Resilient (SCR) Risk Management Model (SCR-RMM) (https://securecontrolsframework.com/risk-management-model)\n∙ Enterprise materiality determination framework (SEC Item 1.05, PCAOB, SOX alignment)\n∙ Board-approved materiality thresholds with regular review cycle\n∙ Automated materiality scoring integrated with incident response workflows", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69154, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589793", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589793", "securityControlId": 30748, "ccis": [], "uuid": "20351d03-9124-5fce-94d1-2902c521cd20", "testId": "GOV-19_A01", "test": "the basis for confidence that implemented practices conform to applicable security, compliance and resilience controls, where the control implementation performs as intended is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 549756, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df923b1d-3418-5e38-9a73-8fb98e95ba43", "parentControlId": 30748, "controlId": "A2.c", "title": "A2.c", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581621" }, { "controlId": "NSS-17T-Sec4.1", "title": "NSS-17T-Sec4.1 — Computer Security Program Management & Policy", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "3b224d7d-57aa-51e3-8c45-512ec307a35c", "isPublic": true }, { "controlId": "IEC-62645-5.1", "title": "IEC-62645-5.1 — Nuclear Plant Level Computer Security Programme", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "36fcbb3e-8ba7-58b1-8d8d-80c3eada5b98", "isPublic": true }, { "controlId": "IEC-63096-5.1", "title": "IEC-63096-5.1 — Information Security Policies for Nuclear Facilities", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "9f5ba84d-0041-572b-a3d7-82bcb4f8dd94", "isPublic": true }, { "controlId": "10-CFR-73.100(b)", "title": "10-CFR-73.100(b) — Performance-Based Cybersecurity Program for Advanced Reactors", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "718900e9-e068-5f34-a250-0de461e4ea09", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.a", "title": "DOE-O-205.1D-4.a — Enterprise Cybersecurity Risk Management & Governance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "13b955ef-f85d-55be-933e-0ed3bf76e8ac", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3", "title": "REGDOC-2.12.1-Sec3 — Cyber Security Program Governance & Organization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "e842500f-790c-5227-bba8-33f03e5c6ad2", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP1", "title": "ONR-SyAP-FSyP1 — Leadership and Management for Security (CS&IA)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (GOV Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "c38881c3-6a01-556e-a3d6-adea57aaed76", "isPublic": true } ], "id": 30748, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730834", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730834", "catalogueId": 1062, "uuid": "71a378ce-295e-576b-9cef-e45d82ab7241", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define the basis for confidence that implemented practices conform to applicable security, compliance and resilience controls, where the control implementation performs as intended?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Assurance", "description": "

Control Description

Mechanisms exist to define the basis for confidence that implemented practices conform to applicable security, compliance and resilience controls, where the control implementation performs as intended.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cybersecurity & Data Protection Governance (GOV) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with GOV domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Governance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT/cybersecurity personnel.\n▪ Cybersecurity and data protection governance is informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ IT /cyber engineering governance is decentralized, with the responsibility for implementing and testing cybersecurity and data protection controls being assigned to the business process owner(s), including the definition and enforcement of roles and responsibilities.

Level 2 - Planned & Tracked: Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.\n▪ The entity's GRC team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ An implemented and operational capability exists to define the basis for confidence that implemented practices conform to applicable security, compliance and resilience controls, where the control implementation performs as intended.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "GOV-19", "family": "Security, Compliance & Resilience Governance", "enhancements": "", "sortId": "GOV-19", "references": "

Micro-Small Business (<10 staff)

∙ Annual self-assessment against documented controls

Small Business (10-49 staff)

∙ Annual internal assessment against documented controls\n∙ Track findings and remediation

Medium Business (50-249 staff)

∙ Formal internal assessment program\n∙ Track assurance evidence\n∙ Third-party assessments as needed

Large Business (250-999 staff)

∙ Formal assurance program\n∙ Third-party assessments\n∙ Internal audit function\n∙ Control testing schedule

Enterprise (>1,000 staff)

∙ Enterprise assurance program\n∙ Dedicated internal audit team\n∙ Third-party assessments (SOC 2, ISO 27001)\n∙ Continuous control monitoring platform", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69509, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589907", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589907", "securityControlId": 30909, "ccis": [], "uuid": "3db89766-fe01-57ee-980f-d4481d2d1b4b", "testId": "AST-01_A01", "test": "an authoritative source and repository are established to provide a trusted source and accountability for approved and implemented systems and system components.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.4.1e[c]\n172A_3.4.1e[d]", "defaultText": null }, { "id": 69510, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589908", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589908", "securityControlId": 30909, "ccis": [], "uuid": "eda7ba70-42b9-5a89-98b0-cc5bb598a986", "testId": "AST-01_A02", "test": "the frequency at which to review / update the system and system component inventory is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CM-08_ODP[02]", "defaultText": null }, { "id": 69511, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589908", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589908", "securityControlId": 30909, "ccis": [], "uuid": "46e1fb18-467d-5545-93f0-dc5c6a298318", "testId": "AST-01_A03", "test": "an inventory of systems and system components that is at the level of granularity deemed necessary for tracking and reporting is developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-08a.04", "defaultText": null }, { "id": 69512, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589914", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589914", "securityControlId": 30909, "ccis": [], "uuid": "8e22c28e-8c22-5cf1-bc1a-8d7df989ce45", "testId": "AST-01_A04", "test": "IT Asset Management (ITAM) operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69513, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589914", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589914", "securityControlId": 30909, "ccis": [], "uuid": "fa7afdbe-1c44-59b4-84d5-300578ee943d", "testId": "AST-01_A05", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support IT Asset Management (ITAM) operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69514, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589915", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589915", "securityControlId": 30909, "ccis": [], "uuid": "c05763b2-8069-5af4-a502-35852387eb77", "testId": "AST-01_A06", "test": "responsibility and authority for the performance of IT Asset Management (ITAM)-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69515, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589915", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589915", "securityControlId": 30909, "ccis": [], "uuid": "a869941d-39fe-54f9-9a63-90da92208b37", "testId": "AST-01_A07", "test": "personnel performing IT Asset Management (ITAM)-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 550664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581774", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8d2edfb-6d9a-58f2-b5f8-88f6e390dae0", "parentControlId": 30909, "controlId": "5.3", "title": "5.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581774" }, { "id": 550665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581774", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4c075ae-caac-5755-88ef-453b2f910479", "parentControlId": 30909, "controlId": "5.31", "title": "5.31", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581774" }, { "id": 550666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581774", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2ca284a-bf2d-5f26-b0a4-3d3497d5090f", "parentControlId": 30909, "controlId": "7.9", "title": "7.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581774" }, { "id": 550678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "645af532-bad7-5f81-b07b-91ee20c6fce2", "parentControlId": 30909, "controlId": "PM-5", "title": "PM-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581776" }, { "id": 550679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "284c0643-f768-52fa-adeb-de1eb440d7d7", "parentControlId": 30909, "controlId": "PM-05", "title": "PM-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581776" }, { "id": 550683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f65f4082-1d39-5890-b895-174582d5da2e", "parentControlId": 30909, "controlId": "PM-05", "title": "PM-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581776" }, { "id": 550684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee885259-6617-584f-9fc4-6e85eb671ec5", "parentControlId": 30909, "controlId": "PM-05", "title": "PM-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581776" }, { "id": 550685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "455a24c6-8c93-58f8-ab3a-c88f4e79748b", "parentControlId": 30909, "controlId": "PM-05", "title": "PM-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581776" }, { "id": 550686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee347b04-56d2-5637-9e93-61b4f14db4fe", "parentControlId": 30909, "controlId": "PM-05", "title": "PM-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581776" }, { "id": 550687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581777", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b07457dd-c7d9-5d30-b9a9-575a953788aa", "parentControlId": 30909, "controlId": "PM-5", "title": "PM-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581777" }, { "id": 550688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581777", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93f1ac49-1ff9-549e-9df6-927bba304cd7", "parentControlId": 30909, "controlId": "PM-5", "title": "PM-5", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581777" }, { "id": 550691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581777", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42073a46-5fe4-535e-87cb-f537846b39fe", "parentControlId": 30909, "controlId": "3.4.1", "title": "3.4.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581777" }, { "id": 550692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581777", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f529c61-9e78-5c01-b50f-52e06474c3ad", "parentControlId": 30909, "controlId": "3.8.3", "title": "3.8.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581777" }, { "id": 550693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581777", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "daa682c2-b78c-51fa-a883-579a3f55fc90", "parentControlId": 30909, "controlId": "03.01.03", "title": "03.01.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581777" }, { "id": 550694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581777", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "090f5fdf-d0ff-517b-9365-a615a6941002", "parentControlId": 30909, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581777" }, { "id": 550695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581778", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa42b186-2adb-53c9-a330-d06e953a3a8e", "parentControlId": 30909, "controlId": "03.04.11.a", "title": "03.04.11.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581778" }, { "id": 550696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581778", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac6b379e-1c7d-5a86-9f32-406a5d759ed5", "parentControlId": 30909, "controlId": "03.07.04.a", "title": "03.07.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581778" }, { "id": 550699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581778", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba491a03-ca67-5081-9af4-0d33c4fe5622", "parentControlId": 30909, "controlId": "GV.SC-04", "title": "GV.SC-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581778" }, { "id": 550700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581778", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33bd258f-247e-555a-ab97-2bcd04a2e894", "parentControlId": 30909, "controlId": "ID.AM", "title": "ID.AM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581778" }, { "id": 550701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581778", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb59a5df-4ef9-5710-b38d-ad2850574874", "parentControlId": 30909, "controlId": "ID.AM-08", "title": "ID.AM-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581778" }, { "id": 550738, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581782", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3ad52d7-4192-59ea-ac0b-0c2232e842e7", "parentControlId": 30909, "controlId": "ASSET-1d", "title": "ASSET-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581782" }, { "id": 550739, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581782", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5976cfb-4a95-5f1b-8a2b-39a3ebe0b5ae", "parentControlId": 30909, "controlId": "ASSET-1h", "title": "ASSET-1h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581783" }, { "id": 550740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581783", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4791c99-fd2e-52c4-9b12-24bcfacf16dd", "parentControlId": 30909, "controlId": "ASSET-2e", "title": "ASSET-2e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581783" }, { "id": 550762, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581785", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a26776c8-ddc5-5d18-a19c-491f32c076b8", "parentControlId": 30909, "controlId": "CIP-003-8 1.1", "title": "CIP-003-8 1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581785" }, { "id": 550763, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581785", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2c4118d-fb6e-564e-9078-0ace9bf5061d", "parentControlId": 30909, "controlId": "CIP-003-8 1.2.5", "title": "CIP-003-8 1.2.5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581785" }, { "id": 550764, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581785", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d3edfe3-94eb-5967-a204-573976e15bdc", "parentControlId": 30909, "controlId": "CIP-003-8 R2", "title": "CIP-003-8 R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581785" }, { "id": 550765, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581785", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b30b184-0d1e-5825-b42a-9791d3769369", "parentControlId": 30909, "controlId": "CIP-011-3 R1", "title": "CIP-011-3 R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581785" }, { "id": 550766, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581786", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9c534c1-946e-53d6-b13e-8e027764d792", "parentControlId": 30909, "controlId": "CIP-011-3 1.2", "title": "CIP-011-3 1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581786" }, { "id": 550797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581789", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bf3baf8-6e1d-52f0-a876-67cf027375ee", "parentControlId": 30909, "controlId": "A3", "title": "A3", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581789" }, { "controlId": "A.3.1.3", "title": "A.3.1.3 — Identification of Critical Digital Assets", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-8, RA-2, PL-2, SA-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "fe632e8c-ec8c-5328-ba7e-874df41fc8cf", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.3 / NEI 13-10", "title": "NEI 08-09 Sec 3.1.3 / NEI 13-10 — Identification of Critical Digital Assets", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "81d5a049-e014-5b4e-b084-b62d1274f606", "isPublic": true }, { "controlId": "10 CFR 73.54(a)(1), (b)(1)", "title": "10 CFR 73.54(a)(1), (b)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "069d8135-0544-5702-88e0-dfdef05a19c4", "isPublic": true }, { "controlId": "CIP-002-5.1a-R1", "title": "CIP-002-5.1a-R1 — BES Cyber System Categorization Process", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "951b8d53-1852-5ce8-8d7d-2161d4815cc1", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.1", "title": "CIP-002-5.1a-1.1 — Identify each of the high impact BES Cyber Systems according to Attachment 1, Section 1, if any, at each asset", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "db0ce53e-8701-5f7d-84b4-e012beb1a8bf", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.2", "title": "CIP-002-5.1a-1.2 — Identify each of the medium impact BES Cyber Systems according to Attachment 1, Section 2, if any, at each asset", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "47ae223c-3092-502c-b445-ef119ee3f9c8", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.3", "title": "CIP-002-5.1a-1.3 — Identify each asset that contains a low impact BES Cyber System according to Attachment 1, Section 3, if any (a discr...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "398bebae-6302-5c49-8712-f4daa0d827dc", "isPublic": true }, { "controlId": "CIP-002-5.1a-R2", "title": "CIP-002-5.1a-R2 — Annual Review and Approval of BES Cyber System Categorization", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3a76ed49-6cb5-5921-b6a5-62f069457574", "isPublic": true }, { "controlId": "CIP-002-5.1a-2.1", "title": "CIP-002-5.1a-2.1 — Review the identifications in Requirement R1 and its parts (and update them if there are changes identified) at least...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0bf42a66-c50f-59af-8c6b-42f3978fedca", "isPublic": true }, { "controlId": "CIP-002-5.1a-2.2", "title": "CIP-002-5.1a-2.2 — Have its CIP Senior Manager or delegate approve the identifications required by Requirement R1 at least once every 15...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "305585cf-5a6a-5fb6-a873-17c1dd056190", "isPublic": true }, { "controlId": "CIP-003-8-R2", "title": "CIP-003-8-R2 — Cyber Security Plan Implementation for Low Impact BES Cyber Systems", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f5485ace-cf25-5adb-bda1-9719abe76f0f", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec1", "title": "CIP-003-9-Attachment1-Sec1 — Low Impact Cyber Security Awareness", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9902cb21-8b8d-59f9-bd33-0fc887b50b0b", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec2", "title": "CIP-003-9-Attachment1-Sec2 — Low Impact Physical Security Controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "63a61dfc-f5f7-5bde-9773-300ac0ac47d6", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec3", "title": "CIP-003-9-Attachment1-Sec3 — Low Impact Electronic Access Controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "38f05f9a-5101-5efc-8c26-1d9cd4675b1e", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec4", "title": "CIP-003-9-Attachment1-Sec4 — Low Impact Cyber Security Incident Response", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4ef6e5d7-1bc6-56d9-b6d2-682889b40fbd", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec5", "title": "CIP-003-9-Attachment1-Sec5 — Low Impact Transient Cyber Asset and Removable Media Malicious Code Risk Mitigation", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a47944d8-69a9-52a5-a54f-bf7871be775e", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec6", "title": "CIP-003-9-Attachment1-Sec6 — Low Impact Vendor Electronic Remote Access Security Controls (CIP-003-9)", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9cc0c58a-3c41-5364-8b64-a735f4a558d5", "isPublic": true }, { "controlId": "CIP-011-3-R1", "title": "CIP-011-3-R1 — Information Protection Program (BCSI)", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b9ae9ccd-16f6-5c85-9d78-5d005190ac5a", "isPublic": true }, { "controlId": "CIP-011-3-1.1", "title": "CIP-011-3-1.1 — Method(s) to identify BCSI.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-011-3-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2dc8ef56-d29c-54ef-a6b1-587c65c69443", "isPublic": true }, { "controlId": "CIP-011-3-1.2", "title": "CIP-011-3-1.2 — Method(s) to protect and securely handle BCSI to mitigate risks of compromising confidentiality.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-011-3-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5edaadc9-379d-5519-a746-4c8d9176578c", "isPublic": true }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "6b03045c-ddc7-5bd5-8e86-9dc8b62f5548", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "c2c83bb2-3f19-5b40-a705-d8f26e14f309", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "7f323066-a918-5f04-8fcb-20cd6a2bc34e", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "86b47246-b0d2-5129-8bf9-5c1abe59550e", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "dc5b6e2c-0f0e-51e3-8c0c-cda49226840d", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "e8f59305-7763-505c-8a27-1d968415ff81", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "6a8f0d62-8569-59c1-a426-7ab98f4cbe9e", "isPublic": true } ], "id": 30909, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730894", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730894", "catalogueId": 1062, "uuid": "d2f6fa08-70a7-5700-aae3-58f7808e524b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate an IT Asset Management (ITAM) program to implement and manage asset management controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Asset Governance", "description": "

Control Description

Mechanisms exist to facilitate an IT Asset Management (ITAM) program to implement and manage asset management controls.

Evidence Request List (ERL)

E-AST-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate an IT Asset Management (ITAM) program to implement and manage asset management controls.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.3
NERC-CIP (2026) Requirements: CIP-002-5.1a-R1, CIP-002-5.1a-R2, CIP-003-8-R2, CIP-011-3-R1", "controlId": "AST-01", "family": "Asset Management", "enhancements": "", "sortId": "AST-01", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program\n∙ Spreadsheet-based asset inventory\n∙ Designated asset owner responsibility

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program\n∙ Formal asset management policy\n∙ Basic CMDB or asset tracking tool (e.g., Snipe-IT free)

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)\n∙ ITAM tool (e.g., ManageEngine AssetExplorer, Snipe-IT, Lansweeper)

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB) (e.g., ServiceNow CMDB, Device42)\n∙ ITAM software integrated with procurement and HR offboarding

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program\n∙ Enterprise CMDB (e.g., ServiceNow CMDB, BMC Helix CMDB)\n∙ ITAM integrated with GRC, procurement, and HR systems", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69516, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589915", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589915", "securityControlId": 30910, "ccis": [], "uuid": "c5b06b33-aed2-5068-89a2-a979326be984", "testId": "AST-01.1_A01", "test": "asset-service dependencies are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69517, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589915", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589915", "securityControlId": 30910, "ccis": [], "uuid": "6a3edf01-c4ca-53f8-9b82-cccf44a51f4e", "testId": "AST-01.1_A02", "test": "asset-service dependencies are assessed to evaluate cybersecurity / data privacy concerns for technology assets that support more than one critical business function.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 550855, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581805", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ce2d4ec-d135-54a2-8662-a36cb5af66a5", "parentControlId": 30910, "controlId": "5.9", "title": "5.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581805" }, { "id": 550856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581805", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5df0fd2-b791-53cd-a665-183e3e177f7e", "parentControlId": 30910, "controlId": "5.3", "title": "5.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581805" }, { "id": 550862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581805", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca8df17c-cd96-5be4-9b28-416a3d0f529e", "parentControlId": 30910, "controlId": "03.01.03", "title": "03.01.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581805" }, { "id": 550864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581806", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f76375a-19ce-57cd-a1e9-833df2ee6f74", "parentControlId": 30910, "controlId": "GV.OC", "title": "GV.OC", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581806" }, { "id": 550865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581806", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bffec9f8-08c1-5321-bf0e-226b31121de0", "parentControlId": 30910, "controlId": "GV.SC-04", "title": "GV.SC-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581806" }, { "id": 550866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581806", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d811576-3736-5b55-9d21-d523f98ae76a", "parentControlId": 30910, "controlId": "ID.AM", "title": "ID.AM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581806" }, { "id": 550873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee54ff9b-a3a8-5f18-97cb-3ee1b5081980", "parentControlId": 30910, "controlId": "ASSET-1a", "title": "ASSET-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581807" }, { "id": 550874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60481e4a-3fef-57bf-bda4-bb3da7fd0035", "parentControlId": 30910, "controlId": "RISK-2m", "title": "RISK-2m", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581807" }, { "id": 550875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8aafa90-a6f7-5aef-98e2-2be9c1030002", "parentControlId": 30910, "controlId": "THIRD-PARTIES-1a", "title": "THIRD-PARTIES-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581807" }, { "id": 550878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "536cff8c-bb5a-5183-872c-86ca010035a7", "parentControlId": 30910, "controlId": "CIP-011-3 1.2", "title": "CIP-011-3 1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581807" }, { "id": 550886, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581808", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02113b4c-9040-5f08-8d90-8bd6149dccb5", "parentControlId": 30910, "controlId": "A3", "title": "A3", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581808" }, { "id": 550887, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581808", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "294bc418-446a-5040-82dd-8a5df99a4507", "parentControlId": 30910, "controlId": "A3.a (point 2)", "title": "A3.a (point 2)", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581808" }, { "controlId": "A.3.1.4", "title": "A.3.1.4 — Reviews and Validation Testing", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, CA-7, RA-5, SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "74aeb822-24ae-53f2-9f7e-3e999c6839c8", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.4", "title": "NEI 08-09 Sec 3.1.4 — Reviews and Validation Testing", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "c085cc4f-9cb5-560c-afba-b85fdc1c7330", "isPublic": true }, { "controlId": "10 CFR 73.54(b)(1), (c)(2)", "title": "10 CFR 73.54(b)(1), (c)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "a5e3b1c7-7e6d-5599-9cf8-ebfe95617306", "isPublic": true }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "9f2a6188-9e68-519f-a506-3aa18840d087", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "4de19aa4-9666-5033-96ef-23a9325e95ff", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "683c4bb2-f928-57a4-80c3-ba282e8bb7d1", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "940cba52-c5af-5950-9163-66ffb46c79ba", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "75cf5be7-1a49-5ea5-a92c-2197fecc4b0e", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "8d1eb6d4-2db1-5caa-8202-85b32eff7393", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "0707e42a-125b-5f5d-8071-2efd042e2412", "isPublic": true } ], "id": 30910, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730894", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730894", "catalogueId": 1062, "uuid": "aca470cc-7122-5ddd-b7d6-ae05157df76c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify and assess the security of Technology Assets, Applications and/or Services (TAAS) that support more than one critical business function?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Asset-Service Dependencies", "description": "

Control Description

Mechanisms exist to identify and assess the security of Technology Assets, Applications and/or Services (TAAS) that support more than one critical business function.

Evidence Request List (ERL)

E-BCM-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Asset Management (AST) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with AST domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Asset management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Asset management is informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ Inventories are manual (e.g., spreadsheets).\n▪ Data / process owners maintain limited network diagrams to document the flow of sensitive/regulated data that is specific to their initiative.\n▪ Inventory of physical technology assets are assigned to individual users or teams and covers common devices (e.g., laptops, workstations and servers).\n▪ No structured process exists to review or share the results of the inventories.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to i identify and assess the security of Technology Assets, Applications and/or Services (TAAS) that support more than one critical business function.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.4", "controlId": "AST-01.1", "family": "Asset Management", "enhancements": "", "sortId": "AST-01.1", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69518, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589916", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589916", "securityControlId": 30911, "ccis": [], "uuid": "77373fcd-5bfb-524c-b370-22bc889c8019", "testId": "AST-01.2_A01", "test": "pertinent stakeholders of critical systems, applications and services are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69519, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589916", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589916", "securityControlId": 30911, "ccis": [], "uuid": "bb6f8558-934b-5a7e-a8a6-af842a93371b", "testId": "AST-01.2_A02", "test": "pertinent stakeholders of critical systems, applications and services are involved in supporting the ongoing secure management of those assets.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 550898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58181", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f2edaca-ebcf-501e-b428-0f2880faa1f6", "parentControlId": 30911, "controlId": "4.2", "title": "4.2", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58181" }, { "id": 550899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58181", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58260271-580c-5856-aa13-987c8ef1711a", "parentControlId": 30911, "controlId": "4.2(a)", "title": "4.2(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58181" }, { "id": 550900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58181", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cae8dbd6-919d-54a5-9401-51e76d7689ca", "parentControlId": 30911, "controlId": "5.9", "title": "5.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58181" }, { "id": 550916, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75c4bebf-154c-540f-ab20-8b107637a699", "parentControlId": 30911, "controlId": "GV.OC", "title": "GV.OC", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581812" }, { "id": 550917, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5614b734-ef40-50ff-996c-17a8325a0072", "parentControlId": 30911, "controlId": "GV.OC-02", "title": "GV.OC-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581812" }, { "id": 550918, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97f67368-5b52-5d73-ad34-411edbac161e", "parentControlId": 30911, "controlId": "ID.AM", "title": "ID.AM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581812" }, { "id": 550919, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a517e2b1-f6c7-5713-9a56-03a398bdcdba", "parentControlId": 30911, "controlId": "ID.AM-08", "title": "ID.AM-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581812" }, { "id": 550949, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef080d41-b8f3-5426-b417-0e6b9eb45887", "parentControlId": 30911, "controlId": "CIP-003-8 R3", "title": "CIP-003-8 R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581815" }, { "id": 550954, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581816", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5bc93afc-6e29-59a6-b2cb-62974a87aab2", "parentControlId": 30911, "controlId": "A3.a (point 4)", "title": "A3.a (point 4)", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581816" }, { "controlId": "CIP-003-8-R3", "title": "CIP-003-8-R3 — Delegation of CIP Senior Manager Authority", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c21d7189-e61f-51ea-a9aa-d7ae8c1c54c7", "isPublic": true }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "44701c56-31f5-52d5-9764-5868022dde5c", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "4dbf398c-5b60-5815-a457-29fa19c8234d", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "ef22c30a-57e8-5aec-b3f9-f8c062febdba", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "9551a4ee-4e5c-58a5-8235-b5ab97c9fc21", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "721d435e-4fa2-5db4-a979-be07cf36aaf7", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "b6e9c58c-cf24-5b90-8c03-6820eb8572e5", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "14e7351b-8ae3-5b08-871b-66e2a34bd7d7", "isPublic": true } ], "id": 30911, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730894", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730894", "catalogueId": 1062, "uuid": "7e1e99a6-9154-51e8-b766-889d465712b6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify and involve pertinent stakeholders of critical Technology Assets, Applications, Services and/or Data (TAASD) to support the ongoing secure management of those assets?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Stakeholder Identification & Involvement", "description": "

Control Description

Mechanisms exist to identify and involve pertinent stakeholders of critical Technology Assets, Applications, Services and/or Data (TAASD) to support the ongoing secure management of those assets.

Evidence Request List (ERL)

E-CPL-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).\n▪ Inventories may be manual (e.g., spreadsheets) or automated.\n▪ Data/process owners for business-critical assets are documented and are reviewed as part of the annual asset inventories.\n▪ Annual IT asset inventories validate or update stakeholders /owners.

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify and involve pertinent stakeholders of critical TAASD to support the ongoing secure management of those assets.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

NERC-CIP (2026) Requirements: CIP-003-8-R3", "controlId": "AST-01.2", "family": "Asset Management", "enhancements": "", "sortId": "AST-01.2", "references": "

Micro-Small Business (<10 staff)

∙ System Security & Privacy Plan (SSPP)

Small Business (10-49 staff)

∙ System Security & Privacy Plan (SSPP)

Medium Business (50-249 staff)

∙ System Security & Privacy Plan (SSPP)

Large Business (250-999 staff)

∙ System Security & Privacy Plan (SSPP)

Enterprise (>1,000 staff)

∙ System Security & Privacy Plan (SSPP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69525, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589917", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589917", "securityControlId": 30915, "ccis": [], "uuid": "ee9f66f9-c091-5ee9-8775-f307551fb7f0", "testId": "AST-02_A01", "test": "a documented, up-to-date, complete, accurate and readily available inventory of systems and system components exists.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.4.3e[b]\n171A_3.4.1[d]\n172A_3.4.1e[b]\n53A_R5_CM-08a.01\n53A_R5_CM-08a.02\n53A_R5_CM-08a.05\n53A_R5_PM-05[01]", "defaultText": null }, { "id": 69526, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589918", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589918", "securityControlId": 30915, "ccis": [], "uuid": "1d445219-82df-5eeb-9281-aac78efc9dfd", "testId": "AST-02_A02", "test": "the system inventory includes hardware, software, firmware and documentation.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.4.1[e]", "defaultText": null }, { "id": 69527, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589918", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589918", "securityControlId": 30915, "ccis": [], "uuid": "701b4dad-6e45-583c-a922-fb810fa181a2", "testId": "AST-02_A03", "test": "the inventory is maintained (reviewed / updated) throughout the system development life cycle.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least monthly", "otherId": "171A_3.4.1[f]\n53A_R5_CM-08b.", "defaultText": null }, { "id": 69528, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589918", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589918", "securityControlId": 30915, "ccis": [], "uuid": "2ef842f7-4054-543b-a98b-60bebf302351", "testId": "AST-02_A04", "test": "approved systems and system components are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "172A_3.4.1e[a]", "defaultText": null }, { "id": 69529, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589918", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589918", "securityControlId": 30915, "ccis": [], "uuid": "b09bf2c3-edda-56d7-81e2-c716d3357c90", "testId": "AST-02_A05", "test": "information deemed necessary to achieve effective systems and system component accountability is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-08_ODP[01]", "defaultText": null }, { "id": 69530, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589918", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589918", "securityControlId": 30915, "ccis": [], "uuid": "5e350098-fbcc-5f00-97a7-7a03852955e1", "testId": "AST-02_A06", "test": "the frequency at which to update the inventory of systems and system components is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-05_ODP", "defaultText": null }, { "id": 69531, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589918", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589919", "securityControlId": 30915, "ccis": [], "uuid": "e061ca14-eb16-540f-8675-92c85359ea58", "testId": "AST-02_A07", "test": "the inventory of systems and system components is updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-05[02]", "defaultText": null }, { "id": 69532, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589919", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589919", "securityControlId": 30915, "ccis": [], "uuid": "394bbc7b-2c3f-583b-b658-2e87e69db991", "testId": "AST-02_A08", "test": "the frequency at which to review and update the system component inventory is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least annually", "otherId": "171A_R3_A.03.04.10.ODP[01]", "defaultText": null }, { "id": 69533, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589919", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589919", "securityControlId": 30915, "ccis": [], "uuid": "6b3483de-f394-50d0-a59c-645a128eca5f", "testId": "AST-02_A09", "test": "an inventory of system components is developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.10.a", "defaultText": null }, { "id": 69534, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589919", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589919", "securityControlId": 30915, "ccis": [], "uuid": "92d03507-4ee9-5083-b870-54c12477c237", "testId": "AST-02_A10", "test": "the system component inventory is reviewed .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least quarterly", "otherId": "171A_R3_A.03.04.10.b[01]", "defaultText": null }, { "id": 69535, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589919", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589919", "securityControlId": 30915, "ccis": [], "uuid": "d5ca4734-8ea4-54b2-95da-d91a2acb157b", "testId": "AST-02_A11", "test": "the system component inventory is updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least quarterly", "otherId": "171A_R3_A.03.04.10.b[02]", "defaultText": null } ], "externalMappings": [ { "id": 551004, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c031b14-a4d8-52f0-8b06-f09ff45641ae", "parentControlId": 30915, "controlId": "CM 1.1", "title": "CM 1.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581822" }, { "id": 551005, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8fea938-36e7-5eba-a582-39f6299bc7b1", "parentControlId": 30915, "controlId": "CM 1.1(a)", "title": "CM 1.1(a)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581822" }, { "id": 551006, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89c6d1c7-c334-57e4-adf0-ed8e615fbffb", "parentControlId": 30915, "controlId": "CM 1.1(b)", "title": "CM 1.1(b)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581822" }, { "id": 551007, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed1aab48-3b07-5517-90c1-6037d9a7360e", "parentControlId": 30915, "controlId": "CM 1.1(c)", "title": "CM 1.1(c)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581822" }, { "id": 551008, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a711c050-e19a-5437-bfd1-f206373c1efc", "parentControlId": 30915, "controlId": "CM 1.1(d)", "title": "CM 1.1(d)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581822" }, { "id": 551009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd11b72f-796c-5728-b49e-6b8339308f8f", "parentControlId": 30915, "controlId": "CM 1.1(e)", "title": "CM 1.1(e)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581822" }, { "id": 551010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d07cada2-fc76-54bf-8763-7dfe1330ca72", "parentControlId": 30915, "controlId": "CM 1.1(f)", "title": "CM 1.1(f)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581822" }, { "id": 551011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91992aba-dc69-5509-aded-4fd9c55a7981", "parentControlId": 30915, "controlId": "CM 1.1(g)", "title": "CM 1.1(g)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581822" }, { "id": 551012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2688118-3f95-55b5-9255-347d3b9db77d", "parentControlId": 30915, "controlId": "CM 1.1(h)", "title": "CM 1.1(h)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581822" }, { "id": 551013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581823", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63c7ae2a-f68b-5a17-ab34-b90e9db12bac", "parentControlId": 30915, "controlId": "CM 1.1(i)", "title": "CM 1.1(i)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581823" }, { "id": 551014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581823", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d0b28ac-9516-5bb1-b047-c4c0aaf3b088", "parentControlId": 30915, "controlId": "SR 7.8", "title": "SR 7.8", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581823" }, { "id": 551015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581823", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b47f116-21dd-5afb-a7a6-b879fc8c7aef", "parentControlId": 30915, "controlId": "CR 7.8", "title": "CR 7.8", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581823" }, { "id": 551017, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581823", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "058a3bbb-d895-58b3-b129-cc30344ed08e", "parentControlId": 30915, "controlId": "5.9", "title": "5.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581823" }, { "id": 551020, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581823", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9c7d358-0a2b-5787-9cfa-454e86730104", "parentControlId": 30915, "controlId": "T1011.001", "title": "T1011.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581823" }, { "id": 551021, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c940b667-dfc6-56ae-a6f4-a49aa7465ea7", "parentControlId": 30915, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581824" }, { "id": 551022, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ad3e626-7e86-5e26-afa8-9f279258e219", "parentControlId": 30915, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581824" }, { "id": 551023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a2c9595-8c74-50d2-9007-aa2863d02c45", "parentControlId": 30915, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581824" }, { "id": 551024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e606feb5-b91f-5ab7-a61f-1754f14978b6", "parentControlId": 30915, "controlId": "T1021.004", "title": "T1021.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581824" }, { "id": 551025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45569004-5393-53aa-bffe-b843c371ccd5", "parentControlId": 30915, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581824" }, { "id": 551026, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c83a1050-4dff-53f1-afb7-50ba393577c0", "parentControlId": 30915, "controlId": "T1021.006", "title": "T1021.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581824" }, { "id": 551027, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51e77002-68f5-54ba-af50-5585fcb9717c", "parentControlId": 30915, "controlId": "T1046", "title": "T1046", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581824" }, { "id": 551028, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b22ea1e-a9a5-5f8f-ac3e-3487d5fdf2dc", "parentControlId": 30915, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581824" }, { "id": 551029, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f7318d5-01a0-598a-a82e-24b97da4c84b", "parentControlId": 30915, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581824" }, { "id": 551030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15aed438-fa5f-54c2-8bac-2a0670ce343b", "parentControlId": 30915, "controlId": "T1053", "title": "T1053", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581825" }, { "id": 551031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc885280-fd6e-5710-8765-727a339ca2db", "parentControlId": 30915, "controlId": "T1053.002", "title": "T1053.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581825" }, { "id": 551032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f706d0e-a1c7-5b45-8c55-5539f4ff069d", "parentControlId": 30915, "controlId": "T1053.005", "title": "T1053.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581825" }, { "id": 551033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c147d77b-15c7-5ad2-b2dd-52a06ef4eda2", "parentControlId": 30915, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581825" }, { "id": 551034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4cc4132-fd33-5938-9fae-461e84d0bb49", "parentControlId": 30915, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581825" }, { "id": 551035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b17095a9-0117-5e0c-a75b-30fd2f43d909", "parentControlId": 30915, "controlId": "T1059.005", "title": "T1059.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581825" }, { "id": 551036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05c722cd-4719-59ca-b48f-d1a99f2fde23", "parentControlId": 30915, "controlId": "T1059.007", "title": "T1059.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581825" }, { "id": 551037, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4bdc504-3c51-5898-90c1-3b91942c352e", "parentControlId": 30915, "controlId": "T1059.010", "title": "T1059.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581825" }, { "id": 551038, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6a7610b-c9b7-5ddb-8ad6-d7b48af55c95", "parentControlId": 30915, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581825" }, { "id": 551039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e30b32e-ff0b-5bef-b703-f437b878372c", "parentControlId": 30915, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581826" }, { "id": 551040, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be431bd5-7517-5a0d-bcab-e34bda8aace9", "parentControlId": 30915, "controlId": "T1091", "title": "T1091", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581826" }, { "id": 551041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35045797-7cbe-5e33-a2fa-b50f6ef6d9a4", "parentControlId": 30915, "controlId": "T1092", "title": "T1092", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581826" }, { "id": 551042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "830fa386-927d-5a95-bf20-9c312da17a80", "parentControlId": 30915, "controlId": "T1098.004", "title": "T1098.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581826" }, { "id": 551043, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98f948ce-15d1-53eb-8db1-974daf02d46c", "parentControlId": 30915, "controlId": "T1119", "title": "T1119", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581826" }, { "id": 551044, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54c81b3a-aac6-53a6-a472-4bdf8c15cd80", "parentControlId": 30915, "controlId": "T1127", "title": "T1127", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581826" }, { "id": 551045, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fe66844-4513-5869-b61b-16f2fd24e4b9", "parentControlId": 30915, "controlId": "T1127.001", "title": "T1127.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581826" }, { "id": 551046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd663236-9377-5f5d-830a-f336cb0f6b11", "parentControlId": 30915, "controlId": "T1127.002", "title": "T1127.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581826" }, { "id": 551047, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40f7e8d6-eff0-532d-a82c-038762796e88", "parentControlId": 30915, "controlId": "T1133", "title": "T1133", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581827" }, { "id": 551048, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c5a491b-17c9-5bf5-87cf-49c3c89f962b", "parentControlId": 30915, "controlId": "T1137", "title": "T1137", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581827" }, { "id": 551049, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9070c527-8e63-56e9-96b1-f8a375201f43", "parentControlId": 30915, "controlId": "T1137.001", "title": "T1137.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581827" }, { "id": 551050, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80cca62d-edf7-573b-a8bd-da374a14d1aa", "parentControlId": 30915, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581827" }, { "id": 551051, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "138e1305-6c34-53b4-a78a-d4e8f014f819", "parentControlId": 30915, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581827" }, { "id": 551052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec6de9df-ea80-5307-b574-124c94ff1f3a", "parentControlId": 30915, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581827" }, { "id": 551053, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27850a21-a206-5869-807c-3e051e329190", "parentControlId": 30915, "controlId": "T1195.003", "title": "T1195.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581827" }, { "id": 551054, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89f93b9c-0f39-5713-8a43-092af02addeb", "parentControlId": 30915, "controlId": "T1203", "title": "T1203", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581827" }, { "id": 551055, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "423c87af-01d0-56c2-b1fd-8cbe0ba7a9ef", "parentControlId": 30915, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581827" }, { "id": 551056, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65b0afc3-5d5b-57e6-9a00-f24e24e0cc67", "parentControlId": 30915, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581828" }, { "id": 551057, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7b8fee5-0e3c-526b-a8d9-0cc2a0c429f9", "parentControlId": 30915, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581828" }, { "id": 551058, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a8c8310-38ce-59e7-96c0-2a82614a9bf0", "parentControlId": 30915, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581828" }, { "id": 551059, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6a5d50a-8753-5cca-a565-855e8c6528cc", "parentControlId": 30915, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581828" }, { "id": 551060, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad2e989a-ae32-51f6-b153-e5f0efa7d13e", "parentControlId": 30915, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581828" }, { "id": 551061, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0606a2aa-db30-5b7e-8307-df09ee6903f7", "parentControlId": 30915, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581828" }, { "id": 551062, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd0af3e7-7661-5cb4-864e-7e309eb0e531", "parentControlId": 30915, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581828" }, { "id": 551063, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd163153-f9bb-5d9e-95b6-f4d98edec030", "parentControlId": 30915, "controlId": "T1218.003", "title": "T1218.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581828" }, { "id": 551064, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a423aa1-618d-52da-8431-f69bb527d7ea", "parentControlId": 30915, "controlId": "T1218.004", "title": "T1218.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581828" }, { "id": 551065, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6ce35f8-b58f-593c-a0c0-50e49713d2f1", "parentControlId": 30915, "controlId": "T1218.005", "title": "T1218.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581828" }, { "id": 551066, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec0bfb31-bb95-503b-85fa-16f55cf4625d", "parentControlId": 30915, "controlId": "T1218.008", "title": "T1218.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581829" }, { "id": 551067, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ed3f15a-6696-5c38-a28a-e9b8bce807b1", "parentControlId": 30915, "controlId": "T1218.009", "title": "T1218.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581829" }, { "id": 551068, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c01deeae-8015-5641-98e2-619cd57f87c4", "parentControlId": 30915, "controlId": "T1218.012", "title": "T1218.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581829" }, { "id": 551069, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b67e05c3-039b-503c-8035-26e46e67d034", "parentControlId": 30915, "controlId": "T1218.013", "title": "T1218.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581829" }, { "id": 551070, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67e30a9e-dcd0-52df-83e0-6a02dd69b8ce", "parentControlId": 30915, "controlId": "T1218.014", "title": "T1218.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581829" }, { "id": 551071, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19321dc1-17c7-5ecd-9256-da1bf81111ad", "parentControlId": 30915, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581829" }, { "id": 551072, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfa896c7-c0ae-57f6-9fac-8240b359af39", "parentControlId": 30915, "controlId": "T1221", "title": "T1221", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581829" }, { "id": 551073, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af303599-e96c-5a21-8bfc-959d54fa5c04", "parentControlId": 30915, "controlId": "T1495", "title": "T1495", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581829" }, { "id": 551074, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4e24da6-9dcd-5497-9bdf-6ad35f84788e", "parentControlId": 30915, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58183" }, { "id": 551075, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4026e343-49ce-592d-b979-e64f7cf983f7", "parentControlId": 30915, "controlId": "T1505.001", "title": "T1505.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58183" }, { "id": 551076, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2cf4ebb8-e52e-59e8-b91f-eaddd7fae85f", "parentControlId": 30915, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58183" }, { "id": 551077, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41633131-98b5-59d0-b7ff-32d8ca921859", "parentControlId": 30915, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58183" }, { "id": 551078, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "659d10b4-06dc-550b-af50-e917de46f9fe", "parentControlId": 30915, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58183" }, { "id": 551079, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fc3ada8-bcec-5f1c-bf3b-3f60b491798a", "parentControlId": 30915, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58183" }, { "id": 551080, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bb8adf8-57b9-5d1b-a44c-a0d6599c202c", "parentControlId": 30915, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58183" }, { "id": 551081, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37fe8b2f-ddba-5103-b0cb-79f7c9fa6eec", "parentControlId": 30915, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58183" }, { "id": 551082, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4525fe9-6923-5f35-a093-076aadd53c1e", "parentControlId": 30915, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58183" }, { "id": 551083, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "319574a0-4a69-5b92-8106-af1e91c55912", "parentControlId": 30915, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581831" }, { "id": 551084, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99800da7-bf72-54b9-82ac-5c20ba8c87bb", "parentControlId": 30915, "controlId": "T1546.002", "title": "T1546.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581831" }, { "id": 551085, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00aeb6b6-ecbd-5eac-a02d-af472382d5dc", "parentControlId": 30915, "controlId": "T1546.006", "title": "T1546.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581831" }, { "id": 551086, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3c6a0ba-c157-5be5-84ce-49eed422a63e", "parentControlId": 30915, "controlId": "T1546.014", "title": "T1546.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581831" }, { "id": 551087, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e60e0fb-4dca-5a39-be32-b70faec895bd", "parentControlId": 30915, "controlId": "T1547.007", "title": "T1547.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581831" }, { "id": 551088, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3cd84de2-5f2e-5e2f-a0e6-8bf367a8a6a7", "parentControlId": 30915, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581831" }, { "id": 551089, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "096fe418-c9da-5a3f-88f7-3a34b74da05e", "parentControlId": 30915, "controlId": "T1548.004", "title": "T1548.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581831" }, { "id": 551090, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80fe4c2a-fc0c-5fed-b755-2936880c504d", "parentControlId": 30915, "controlId": "T1548.006", "title": "T1548.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581831" }, { "id": 551091, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a7dc47f-f8e8-566c-b984-6db1959e777c", "parentControlId": 30915, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581831" }, { "id": 551092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "452c4050-d71c-508c-ad58-e675c7383214", "parentControlId": 30915, "controlId": "T1553.006", "title": "T1553.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581832" }, { "id": 551093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c485050-45e8-5297-9d65-3f2172a3a407", "parentControlId": 30915, "controlId": "T1556.009", "title": "T1556.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581832" }, { "id": 551094, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bafed2d-e4a3-5fe6-b11c-156a4d0e36dd", "parentControlId": 30915, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581832" }, { "id": 551095, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d0b6c73-b81e-59d8-aa2c-798a8a1b121b", "parentControlId": 30915, "controlId": "T1557.001", "title": "T1557.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581832" }, { "id": 551096, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31a4dc76-f618-5022-a5dd-adc5cb98434b", "parentControlId": 30915, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581832" }, { "id": 551097, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba034b15-ab8b-537a-86bd-ed295f657869", "parentControlId": 30915, "controlId": "T1557.003", "title": "T1557.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581832" }, { "id": 551098, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cfac988-55f0-55c6-b858-954868525a02", "parentControlId": 30915, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581832" }, { "id": 551099, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5aba5f9-6c86-5105-a9a0-9d033cfde771", "parentControlId": 30915, "controlId": "T1559.002", "title": "T1559.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581832" }, { "id": 551100, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b779d454-5670-5ea2-9e63-47a2b39f655a", "parentControlId": 30915, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581832" }, { "id": 551101, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16da64db-2236-59a4-8a6e-bdacb5e5cdcd", "parentControlId": 30915, "controlId": "T1563.001", "title": "T1563.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581833" }, { "id": 551102, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22b93b34-08e9-520b-9f71-9bedfa37ec3e", "parentControlId": 30915, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581833" }, { "id": 551103, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5e7b3ff-15c0-5b48-ae86-01e87f4f1ef2", "parentControlId": 30915, "controlId": "T1564.006", "title": "T1564.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581833" }, { "id": 551104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42c5564c-fa14-5979-bfaa-a2e3cd1defc0", "parentControlId": 30915, "controlId": "T1564.007", "title": "T1564.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581833" }, { "id": 551105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbcfa000-2dfe-521b-8b97-3abc5592a2c0", "parentControlId": 30915, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581833" }, { "id": 551106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b9b9283-bf73-5357-b036-1b3e87569cb6", "parentControlId": 30915, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581833" }, { "id": 551107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd72dc76-c1e6-5d2a-9228-aaa4d2b6d603", "parentControlId": 30915, "controlId": "T1565.002", "title": "T1565.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581833" }, { "id": 551108, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "900b28ea-763a-56f3-9be5-6107aeee45f5", "parentControlId": 30915, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581833" }, { "id": 551109, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "026062fb-8d31-5e1e-879d-3a3dfeb5167c", "parentControlId": 30915, "controlId": "T1574.004", "title": "T1574.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581833" }, { "id": 551110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d72e126f-aacc-5ab6-aa74-cdd59d98776a", "parentControlId": 30915, "controlId": "T1574.007", "title": "T1574.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581833" }, { "id": 551111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581834", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66d05605-3667-5ec9-abb6-e5acefb46374", "parentControlId": 30915, "controlId": "T1574.008", "title": "T1574.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581834" }, { "id": 551112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581834", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7e2d0d9-8087-5772-81dc-cea34e55fc44", "parentControlId": 30915, "controlId": "T1574.009", "title": "T1574.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581834" }, { "id": 551113, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581834", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49d7ac5c-695c-51d1-ba4b-dc7ba6dc21b1", "parentControlId": 30915, "controlId": "T1593.003", "title": "T1593.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581834" }, { "id": 551114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581834", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c0a6b06-8fd9-5a15-a601-57153d9c8e58", "parentControlId": 30915, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581834" }, { "id": 551115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581834", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91655050-a9da-5f29-9a43-c9bcba30d17c", "parentControlId": 30915, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581834" }, { "id": 551116, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581834", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e54a9d36-eec9-5a55-8111-f5908b87bdcd", "parentControlId": 30915, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581834" }, { "id": 551117, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581834", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ae0063e-a95a-5138-833f-8e1fd5d0d89e", "parentControlId": 30915, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581834" }, { "id": 551118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581835", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11b28898-0c02-55ee-9c3c-5126b8a63a81", "parentControlId": 30915, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581835" }, { "id": 551119, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581835", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19505957-2796-504b-a20a-52632c9742f4", "parentControlId": 30915, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581835" }, { "id": 551120, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581835", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22d96200-8cee-566f-96e8-497ca8958c5a", "parentControlId": 30915, "controlId": "T1622", "title": "T1622", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581835" }, { "id": 551129, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581836", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4bbef5cc-a8ce-5284-98d8-dcdc430244f2", "parentControlId": 30915, "controlId": "CM-8", "title": "CM-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581836" }, { "id": 551130, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581836", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79e6350f-3285-577b-bcf1-65f4405c6584", "parentControlId": 30915, "controlId": "PM-5", "title": "PM-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581836" }, { "id": 551131, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581836", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ba79c4a-c128-52d7-9dce-968fc6687f47", "parentControlId": 30915, "controlId": "CM-08", "title": "CM-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581836" }, { "id": 551132, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581836", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aebdabe8-1c66-592f-8fad-b5348d49564d", "parentControlId": 30915, "controlId": "PM-05", "title": "PM-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581836" }, { "id": 551135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581836", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9dd8e709-a516-559a-afdf-2855ce71dcfa", "parentControlId": 30915, "controlId": "CM-08", "title": "CM-08", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581837" }, { "id": 551137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ac1dfd2-6189-5a5f-86cb-06a431fd6278", "parentControlId": 30915, "controlId": "CM-08", "title": "CM-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581837" }, { "id": 551138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5439aa7-ab72-551a-bbe8-45d25a8a0f9e", "parentControlId": 30915, "controlId": "PM-05", "title": "PM-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581837" }, { "id": 551139, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e00139c0-7955-5f10-b235-3b5afa312a63", "parentControlId": 30915, "controlId": "CM-08", "title": "CM-08", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581837" }, { "id": 551140, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b22ae934-e87b-5ad2-b7f3-35aa94fb9aa7", "parentControlId": 30915, "controlId": "PM-05", "title": "PM-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581837" }, { "id": 551141, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62e10bb5-b473-596e-8cf6-295df168752a", "parentControlId": 30915, "controlId": "CM-08", "title": "CM-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581846" }, { "id": 551142, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e06f4397-b60f-5a9f-b084-75ab8c3d1ee0", "parentControlId": 30915, "controlId": "PM-05", "title": "PM-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581846" }, { "id": 551143, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "beecfb56-4540-58e9-ae8d-7dc37c078fc2", "parentControlId": 30915, "controlId": "CM-08", "title": "CM-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581846" }, { "id": 551144, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81014272-cc6e-52c6-bb88-2904ce28f516", "parentControlId": 30915, "controlId": "PM-05", "title": "PM-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581846" }, { "id": 551145, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4733ed0-d2e7-5405-b103-dce21667167f", "parentControlId": 30915, "controlId": "CM-8", "title": "CM-8", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581846" }, { "id": 551146, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "815ace11-19c2-566e-927a-cbf5b2b5e156", "parentControlId": 30915, "controlId": "PM-5", "title": "PM-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581846" }, { "id": 551147, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87f9242c-7e04-5ed5-88ed-a9e48d0a3bdb", "parentControlId": 30915, "controlId": "CM-8", "title": "CM-8", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581846" }, { "id": 551148, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15b3c024-bc0a-57cc-8898-f52fa39e3cd5", "parentControlId": 30915, "controlId": "CM-8", "title": "CM-8", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581847" }, { "id": 551149, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9dad5a9e-a73f-52d2-abf4-c0cd500677c2", "parentControlId": 30915, "controlId": "PM-5", "title": "PM-5", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581847" }, { "id": 551154, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "588898ea-0069-5f84-a7c8-343d8cfe44d3", "parentControlId": 30915, "controlId": "3.4.1", "title": "3.4.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581847" }, { "id": 551155, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5246ae9-87e1-57f6-8c00-cd068b554880", "parentControlId": 30915, "controlId": "03.04.08.a", "title": "03.04.08.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581847" }, { "id": 551156, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f073034-63a0-50da-ab78-4f04e1e62a5c", "parentControlId": 30915, "controlId": "03.04.08.c", "title": "03.04.08.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581847" }, { "id": 551157, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581848", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28832976-dad2-5ad8-9844-569b9bc57757", "parentControlId": 30915, "controlId": "03.04.10.a", "title": "03.04.10.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581848" }, { "id": 551158, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581848", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16bef643-9440-58fa-95c3-d6b4781a16a0", "parentControlId": 30915, "controlId": "03.04.10.b", "title": "03.04.10.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581848" }, { "id": 551159, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581848", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48d6d3c1-84a2-590c-9b88-71d0e5deeb63", "parentControlId": 30915, "controlId": "03.04.11.a", "title": "03.04.11.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581848" }, { "id": 551169, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c76253a6-424e-5faf-a14b-bffe0e353390", "parentControlId": 30915, "controlId": "ID.AM", "title": "ID.AM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581849" }, { "id": 551170, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ad3c6d4-010d-525e-8f3b-273d6fad535e", "parentControlId": 30915, "controlId": "ID.AM-01", "title": "ID.AM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581849" }, { "id": 551171, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a45f091-397b-511e-aca7-f75fe9e418d1", "parentControlId": 30915, "controlId": "ID.AM-02", "title": "ID.AM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581849" }, { "id": 551201, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581853", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a81d51d9-a5bf-5be8-847b-7119ef104121", "parentControlId": 30915, "controlId": "ASSET-1a", "title": "ASSET-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581853" }, { "id": 551202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581853", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5786a390-8925-5c16-abad-ad0d2bc6b8f7", "parentControlId": 30915, "controlId": "ASSET-1b", "title": "ASSET-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581853" }, { "id": 551203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581853", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9831b33-b221-5371-9445-052307cf0876", "parentControlId": 30915, "controlId": "ASSET-1d", "title": "ASSET-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581853" }, { "id": 551204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581853", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec24aeba-38ce-5e38-96d7-850d13cbfe8b", "parentControlId": 30915, "controlId": "ASSET-1e", "title": "ASSET-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581853" }, { "id": 551205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581853", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a7402af-98ec-57ba-b923-b317a61013c8", "parentControlId": 30915, "controlId": "ASSET-1f", "title": "ASSET-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581853" }, { "id": 551206, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581853", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d84440f6-eae6-51c9-8c03-8a284b1496a1", "parentControlId": 30915, "controlId": "ASSET-1g", "title": "ASSET-1g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581853" }, { "id": 551207, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581854", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "963f6242-3af8-5d22-b4b6-5784fe863972", "parentControlId": 30915, "controlId": "ASSET-2a", "title": "ASSET-2a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581854" }, { "id": 551208, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581854", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87a76c5b-5f6e-5e9c-b2c4-477bca87a9ed", "parentControlId": 30915, "controlId": "ASSET-2b", "title": "ASSET-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581854" }, { "id": 551209, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581854", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37977d50-aba0-52b7-aedf-8a1c02b933ab", "parentControlId": 30915, "controlId": "ASSET-2f", "title": "ASSET-2f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581854" }, { "id": 551210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581854", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b0c5b8a-3410-5604-ba80-3e921c14d329", "parentControlId": 30915, "controlId": "ASSET-2g", "title": "ASSET-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581854" }, { "id": 551211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581854", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d49ed165-c4cb-598a-a145-9e686b2e6521", "parentControlId": 30915, "controlId": "RISK-2h", "title": "RISK-2h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581854" }, { "id": 551239, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581861", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6fd0541-499f-554c-a1e5-d48a843d76ee", "parentControlId": 30915, "controlId": "CIP-011-3 1.1", "title": "CIP-011-3 1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581861" }, { "id": 551279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581866", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a2b7c6a-b82a-5add-9672-43e9742dc513", "parentControlId": 30915, "controlId": "A3.a (point 1)", "title": "A3.a (point 1)", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581866" }, { "controlId": "A.3.1.3", "title": "A.3.1.3 — Identification of Critical Digital Assets", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-8, RA-2, PL-2, SA-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "b2bb0796-3b3a-5836-b706-9870302ac670", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.3 / NEI 13-10", "title": "NEI 08-09 Sec 3.1.3 / NEI 13-10 — Identification of Critical Digital Assets", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "b8271e28-08e4-5299-a2ae-bcf9d3616814", "isPublic": true }, { "controlId": "10 CFR 73.54(a)(1), (b)(1)", "title": "10 CFR 73.54(a)(1), (b)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "43e4032d-4433-5ed8-ad8d-6cfd0219b446", "isPublic": true }, { "controlId": "A.4.2.1", "title": "A.4.2.1 — Configuration Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-1, CM-2, CM-3, CM-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "f7f93064-d60e-5a43-bb9b-d71addfccb49", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.1", "title": "NEI 08-09 Sec 4.2.1 — Configuration Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "2eacf8c3-83f7-5854-9079-319f81d9c8d5", "isPublic": true }, { "controlId": "10 CFR 73.54(e)", "title": "10 CFR 73.54(e) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "4a336803-85b1-50b2-a44f-3423e808339d", "isPublic": true }, { "controlId": "C.11.9", "title": "C.11.9 — Component Inventory", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "37408473-8c70-5094-b4e3-bcdb6c42d101", "isPublic": true }, { "controlId": "NEI 08-09 App E.11.9", "title": "NEI 08-09 App E.11.9 — Component Inventory", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.11.9", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "c5151369-6626-5fba-b958-a412ed39d25a", "isPublic": true }, { "controlId": "10 CFR 73.54(b)(1)", "title": "10 CFR 73.54(b)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.11.9", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "479b1fb9-afc8-59ee-85f1-e2f4c12ab977", "isPublic": true }, { "controlId": "CIP-002-5.1a-R1", "title": "CIP-002-5.1a-R1 — BES Cyber System Categorization Process", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ee80d604-8b27-5576-9dbf-8227ae2e5a34", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.1", "title": "CIP-002-5.1a-1.1 — Identify each of the high impact BES Cyber Systems according to Attachment 1, Section 1, if any, at each asset", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "07723854-6f1d-5d43-be25-af9cc01ee58a", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.2", "title": "CIP-002-5.1a-1.2 — Identify each of the medium impact BES Cyber Systems according to Attachment 1, Section 2, if any, at each asset", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c5a4a67c-c3db-51db-a17c-be8007115a84", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.3", "title": "CIP-002-5.1a-1.3 — Identify each asset that contains a low impact BES Cyber System according to Attachment 1, Section 3, if any (a discr...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d69dc58d-b4a6-5e50-97d9-d7e1dc167ed6", "isPublic": true }, { "controlId": "CIP-002-5.1a-R2", "title": "CIP-002-5.1a-R2 — Annual Review and Approval of BES Cyber System Categorization", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5917733e-77cb-5f8d-8fd8-221e9c80e515", "isPublic": true }, { "controlId": "CIP-002-5.1a-2.1", "title": "CIP-002-5.1a-2.1 — Review the identifications in Requirement R1 and its parts (and update them if there are changes identified) at least...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b14546b0-8084-5321-b2b1-1898e7e149a4", "isPublic": true }, { "controlId": "CIP-002-5.1a-2.2", "title": "CIP-002-5.1a-2.2 — Have its CIP Senior Manager or delegate approve the identifications required by Requirement R1 at least once every 15...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "af4bda72-6999-50e6-aa36-a25c1e29cc32", "isPublic": true }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "9ed58436-1881-5f00-bff9-f5028c293e28", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "79d7447c-f5f2-5186-9338-a722dfafa501", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "a214bc5f-1e89-50ad-b1b6-7f42ff0682db", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "bbe7d56d-1058-559f-a0b6-40b3ac1e6b74", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "e3a05641-fbef-51ca-9595-fca0132c4e06", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "08ffd3e5-baf4-5ba8-9d1a-f614ef7e41db", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "9aff26b5-2a97-5efd-a693-84f2cbcfc653", "isPublic": true } ], "id": 30915, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730896", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730896", "catalogueId": 1062, "uuid": "c32c19a7-2ba4-5a21-b0f8-2c7aba87e375", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n (1) Accurately reflects the current TAASD in use; \n (2) Identifies authorized software products, including business justification details;\n (3) Is at the level of granularity deemed necessary for tracking and reporting;\n (4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n (5) Is available for review and audit by designated organizational personnel?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Asset Inventories", "description": "

Control Description

Mechanisms exist to perform inventories of Technology Assets, Applications, Services and/or Data (TAASD) that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.

Evidence Request List (ERL)

E-AST-04\nE-AST-05\nE-AST-07\nE-AST-28

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).\n▪ Inventories may be manual (e.g., spreadsheets) or automated.\n▪ Data/process owners for business-critical assets are documented and are reviewed as part of the annual asset inventories.\n▪ Software licensing is tracked as part of IT asset inventories.\n▪ No structured process exists to review or share the results of the inventories.\n▪ Annual IT asset inventories validate or update stakeholders /owners.

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to perform inventories of TAASD that:\n(1) Accurately reflects the current TAASD in use; \n(2) Identifies authorized software products, including business justification details;\n(3) Is at the level of granularity deemed necessary for tracking and reporting;\n(4) Includes organization-defined information deemed necessary to achieve effective property accountability; and\n(5) Is available for review and audit by designated organizational personnel.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.3, A.4.2.1, C.11.9
NERC-CIP (2026) Requirements: CIP-002-5.1a-R1, CIP-002-5.1a-R2", "controlId": "AST-02", "family": "Asset Management", "enhancements": "", "sortId": "AST-02", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program\n∙ Spreadsheet-based asset inventory or Snipe-IT (free, https://snipeitapp.com)\n∙ JAMF (https://jamf.com) for Apple device management\n∙ Configuration Management Database (CMDB)

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program\n∙ ManageEngine AssetExplorer (https://manageengine.com)\n∙ JAMF (https://jamf.com) or Microsoft Intune for device management\n∙ Configuration Management Database (CMDB)

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program\n∙ ManageEngine AssetExplorer (https://manageengine.com)\n∙ Ivanti (https://ivanti.com) or Microsoft Intune\n∙ Configuration Management Database (CMDB)\n∙ Lansweeper for network device discovery

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program\n∙ ManageEngine AssetExplorer or Ivanti (https://ivanti.com)\n∙ Configuration Management Database (CMDB) (e.g., ServiceNow, Device42)\n∙ Integration with network discovery tools (e.g., Nmap, Qualys Asset Inventory)

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program\n∙ Enterprise ITAM solution (e.g., Ivanti, Snow Software, Flexera)\n∙ Configuration Management Database (CMDB) (e.g., ServiceNow CMDB)\n∙ Automated asset discovery integrated with vulnerability management\n∙ CIS Control 1 & 2 alignment", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69536, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589919", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589919", "securityControlId": 30916, "ccis": [], "uuid": "ebb0349f-afab-539c-a715-fb202470b2b9", "testId": "AST-02.1_A01", "test": "the system component inventory is updated as part of component installations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.04.10.c[01]\n53A_R5_CM-08(01)[01]", "defaultText": null }, { "id": 69537, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58992", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58992", "securityControlId": 30916, "ccis": [], "uuid": "addbb907-6775-5834-8d19-384cb3e38d13", "testId": "AST-02.1_A02", "test": "the system component inventory is updated as part of component removals.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.04.10.c[02]\n53A_R5_CM-08(01)[02]", "defaultText": null }, { "id": 69538, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58992", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58992", "securityControlId": 30916, "ccis": [], "uuid": "a65d6c3e-82bd-52dd-a457-9baa7853f16c", "testId": "AST-02.1_A03", "test": "the system component inventory is updated as part of system updates.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.04.10.c[03]\n53A_R5_CM-08(01)[03]", "defaultText": null } ], "externalMappings": [ { "id": 551327, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581872", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de6dece9-24e5-5098-a355-a0ecc4a6f615", "parentControlId": 30916, "controlId": "CM-8(1)", "title": "CM-8(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581872" }, { "id": 551328, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581872", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "144cc439-8a1a-5c35-8906-b3430cca4d14", "parentControlId": 30916, "controlId": "CM-08(01)", "title": "CM-08(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581872" }, { "id": 551329, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581872", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f49473f6-0029-50be-ae43-8a7be177f4f8", "parentControlId": 30916, "controlId": "CM-08(01)", "title": "CM-08(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581872" }, { "id": 551331, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581872", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1807718f-c5c4-538f-99a2-0a7ce3fec7b9", "parentControlId": 30916, "controlId": "CM-08(01)", "title": "CM-08(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581872" }, { "id": 551332, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581872", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33481440-490b-5e2e-b6bd-238c62df8c93", "parentControlId": 30916, "controlId": "CM-08(01)", "title": "CM-08(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581872" }, { "id": 551333, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581872", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42d99667-b738-57d5-a971-ea48bc41a532", "parentControlId": 30916, "controlId": "CM-08(01)", "title": "CM-08(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581872" }, { "id": 551334, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61c140c2-283f-506c-afc0-61888ee5bf6d", "parentControlId": 30916, "controlId": "CM-8(1)", "title": "CM-8(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581873" }, { "id": 551336, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acef75f4-b5bf-5567-8029-105b2bb7c15c", "parentControlId": 30916, "controlId": "03.04.10.a", "title": "03.04.10.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581873" }, { "id": 551337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b58ab197-d02f-5831-849e-fe7a350614e9", "parentControlId": 30916, "controlId": "03.04.10.b", "title": "03.04.10.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581873" }, { "id": 551338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28f8e232-cbc2-5dc4-bad9-8b68ae64b128", "parentControlId": 30916, "controlId": "03.04.10.c", "title": "03.04.10.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581873" }, { "id": 551345, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581874", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58f51439-1451-53c0-8e3b-b9e2e06815f5", "parentControlId": 30916, "controlId": "ASSET-2g", "title": "ASSET-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581874" }, { "controlId": "A.3.1.3", "title": "A.3.1.3 — Identification of Critical Digital Assets", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-8, RA-2, PL-2, SA-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "fcd8dba0-e945-5ed1-a003-f1f323bad1ef", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.3 / NEI 13-10", "title": "NEI 08-09 Sec 3.1.3 / NEI 13-10 — Identification of Critical Digital Assets", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "0c190a94-8ae5-5fa1-b06b-07fba5ad944d", "isPublic": true }, { "controlId": "10 CFR 73.54(a)(1), (b)(1)", "title": "10 CFR 73.54(a)(1), (b)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "97cb6e38-4373-5f6c-ae7b-c57ee9b3f670", "isPublic": true }, { "controlId": "CIP-002-5.1a-R1", "title": "CIP-002-5.1a-R1 — BES Cyber System Categorization Process", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0bde2c65-cecb-5170-aa15-8e18918503ea", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.1", "title": "CIP-002-5.1a-1.1 — Identify each of the high impact BES Cyber Systems according to Attachment 1, Section 1, if any, at each asset", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2fbbc646-5212-5246-a73b-9f5250c1c755", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.2", "title": "CIP-002-5.1a-1.2 — Identify each of the medium impact BES Cyber Systems according to Attachment 1, Section 2, if any, at each asset", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e0cf2a39-ba1e-50a3-80d8-1c5d1b6b8caf", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.3", "title": "CIP-002-5.1a-1.3 — Identify each asset that contains a low impact BES Cyber System according to Attachment 1, Section 3, if any (a discr...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3c79c4f9-e24b-5e5c-bf9a-9df595cbc5c7", "isPublic": true }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "384b8cdb-3adc-5844-b193-2b3807569136", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "0ee4d350-1f4d-5d0d-b82a-ae5601f7662e", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "a76e7e80-7b95-5d31-85f3-1b74860a40ef", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "c7c5a18a-03bb-56ca-a361-a9ee28353c01", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "8a12ed23-dff6-5290-9281-5a7e41ad9f0f", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "5e9bc634-37d8-5fe3-b1bd-f11c36512f1d", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "1a228d2c-e13e-5562-afca-296eba2be8ff", "isPublic": true } ], "id": 30916, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730896", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730896", "catalogueId": 1062, "uuid": "125a7da1-e294-5063-aa11-f1240657e3a2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization update asset inventories as part of component installations, removals and asset upgrades?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Updates During Installations / Removals", "description": "

Control Description

Mechanisms exist to update asset inventories as part of component installations, removals and asset upgrades.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to update asset inventories as part of component installations, removals and asset upgrades.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.3
NERC-CIP (2026) Requirements: CIP-002-5.1a-R1", "controlId": "AST-02.1", "family": "Asset Management", "enhancements": "", "sortId": "AST-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Configuration Management Database (CMDB)

Small Business (10-49 staff)

∙ Configuration Management Database (CMDB)

Medium Business (50-249 staff)

∙ Configuration Management Database (CMDB)

Large Business (250-999 staff)

∙ Configuration Management Database (CMDB)

Enterprise (>1,000 staff)

∙ Configuration Management Database (CMDB)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69539, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58992", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58992", "securityControlId": 30917, "ccis": [], "uuid": "3d68147a-e7b8-5908-91fc-2b6e9c758ca0", "testId": "AST-02.2_A01", "test": "automated mechanisms used to detect the presence of unauthorized hardware within the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-08(03)_ODP[01]\n53A_R5_CM-08(03)_ODP[02]\n53A_R5_CM-08(03)_ODP[03]\n53A_R5_CM-08(03)(a)[01]\n53A_R5_CM-08(03)(a)[02]\n53A_R5_CM-08(03)(a)[03]", "defaultText": null }, { "id": 69540, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58992", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58992", "securityControlId": 30917, "ccis": [], "uuid": "1351a391-d8bf-57ef-a44f-c4e28e231f13", "testId": "AST-02.2_A02", "test": "the frequency at which automated mechanisms are used to detect the presence of unauthorized hardware, software and/or firmware within the system is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: automated mechanisms with a maximum five-minute delay in detection", "otherId": "53A_R5_CM-08(03)_ODP[04]", "defaultText": null }, { "id": 69541, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589921", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589921", "securityControlId": 30917, "ccis": [], "uuid": "41ac032b-cd7b-5072-9020-912e37dd074a", "testId": "AST-02.2_A03", "test": "automated mechanisms disable network access by unauthorized components, isolate unauthorized components and/or notify organization-defined personnel or roles.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "53A_R5_CM-08(03)_ODP[05]", "defaultText": null }, { "id": 69542, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589921", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589921", "securityControlId": 30917, "ccis": [], "uuid": "9e14b77e-7b14-54fd-b946-39934703bd2f", "testId": "AST-02.2_A04", "test": "personnel or roles to be notified when unauthorized components are detected is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-08(03)_ODP[06]", "defaultText": null }, { "id": 69543, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589921", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589921", "securityControlId": 30917, "ccis": [], "uuid": "3df7c2fe-960d-5b98-a6f9-677cc725d1ef", "testId": "AST-02.2_A05", "test": "organization-defined actions are taken when unauthorized hardware, software and/or firmware is/are detected.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-08(03)(b)[01]\n53A_R5_CM-08(03)(b)[02]\n53A_R5_CM-08(03)(b)[03]", "defaultText": null } ], "externalMappings": [ { "id": 551383, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581878", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18f9ba53-acd5-5a56-a33b-09ca5e91065c", "parentControlId": 30917, "controlId": "ORG 2.2(a)", "title": "ORG 2.2(a)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581878" }, { "id": 551384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581878", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00c87348-002a-559b-84ce-850c04dc2592", "parentControlId": 30917, "controlId": "CM-8(3)", "title": "CM-8(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581878" }, { "id": 551385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581878", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d79bb3f-513e-59bb-96c1-47c8d4832f40", "parentControlId": 30917, "controlId": "CM-08(03)", "title": "CM-08(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581878" }, { "id": 551387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581878", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c54c78d8-da66-55f2-aeb8-a2817a7ed1b1", "parentControlId": 30917, "controlId": "CM-08(03)", "title": "CM-08(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581878" }, { "id": 551388, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581879", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "932d170f-dbcd-55ef-9905-9b86e495b1a8", "parentControlId": 30917, "controlId": "CM-08(03)", "title": "CM-08(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581879" }, { "id": 551389, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581879", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bada73bd-f235-505b-a238-44c0e9df5bcf", "parentControlId": 30917, "controlId": "CM-08(03)", "title": "CM-08(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581879" }, { "id": 551390, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581879", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e285970-9c8f-552e-98d3-1c8b590cf54e", "parentControlId": 30917, "controlId": "CM-08(03)", "title": "CM-08(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581879" } ], "id": 30917, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730896", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730897", "catalogueId": 1062, "uuid": "fb9357c7-2384-51d4-bcaf-baa462483fa2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to detect and alert upon the detection of unauthorized hardware, software and firmware components?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 3.0, "title": "Automated Unauthorized Component Detection", "description": "

Control Description

Automated mechanisms exist to detect and alert upon the detection of unauthorized hardware, software and firmware components.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically detect and alert upon the detection of unauthorized hardware, software and firmware components.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-02.2", "family": "Asset Management", "enhancements": "", "sortId": "AST-02.2", "references": "

Micro-Small Business (<10 staff)

∙ DHCP logging\n∙ Active discovery scan (e.g., Nmap, Angry IP Scanner - free)\n∙ Configuration Management Database (CMDB)

Small Business (10-49 staff)

∙ DHCP logging\n∙ Active discovery tools (e.g., Nmap, Lansweeper free tier)\n∙ Configuration Management Database (CMDB)

Medium Business (50-249 staff)

∙ DHCP logging\n∙ Active discovery tools (e.g., Lansweeper, Nmap)\n∙ Configuration Management Database (CMDB)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netwrix.com)

Large Business (250-999 staff)

∙ DHCP logging\n∙ Network access control (NAC) for unauthorized device blocking\n∙ Configuration Management Database (CMDB)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netwrix.com)\n∙ Qualys or Tenable asset discovery

Enterprise (>1,000 staff)

∙ Enterprise asset discovery with continuous monitoring (e.g., Qualys CSAM, Tenable.io)\n∙ Network Access Control (NAC) integration\n∙ DHCP + SIEM correlation for unauthorized device alerting\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ CIS Control 1 automated asset discovery alignment", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69544, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589921", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589921", "securityControlId": 30918, "ccis": [], "uuid": "99f4bb8e-5c99-5d7f-afe0-3ae070975f4d", "testId": "AST-02.3_A01", "test": "an inventory of system components that accurately reflects the system is developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-08a.01", "defaultText": null }, { "id": 69545, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589922", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589922", "securityControlId": 30918, "ccis": [], "uuid": "d32f602a-d774-594f-9bc8-92c1cb2c9c72", "testId": "AST-02.3_A02", "test": "an inventory of system components that includes all components within the system is developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-08a.02", "defaultText": null }, { "id": 69546, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589922", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589922", "securityControlId": 30918, "ccis": [], "uuid": "9e94de27-fd76-5aa1-94d7-73f98b22f886", "testId": "AST-02.3_A03", "test": "an inventory of system components that does not include duplicate accounting of components or components assigned to any other system is developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-08a.03", "defaultText": null }, { "id": 69547, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589922", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589922", "securityControlId": 30918, "ccis": [], "uuid": "e42af618-1203-5bc1-b066-edddf1daa05f", "testId": "AST-02.3_A04", "test": "an inventory of system components that includes information is developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-08a.05", "defaultText": null }, { "id": 69548, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589922", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589922", "securityControlId": 30918, "ccis": [], "uuid": "1f12bd30-f7a7-511c-8a0e-dda112c81487", "testId": "AST-02.3_A05", "test": "the system component inventory is reviewed / updated frequently.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least monthly", "otherId": "53A_R5_CM-08b.", "defaultText": null } ], "externalMappings": [ { "id": 551427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4430d7c5-5ec5-5778-b1d4-996f2704d433", "parentControlId": 30918, "controlId": "CM-8(5)", "title": "CM-8(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581892" }, { "id": 551428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "720a2ed1-5862-59e5-8c12-2f08d1855eb4", "parentControlId": 30918, "controlId": "CM-08", "title": "CM-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581892" }, { "id": 551430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19ff69b6-01b1-5c64-9831-095f9b7af0c9", "parentControlId": 30918, "controlId": "CM-08", "title": "CM-08", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581892" }, { "id": 551431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "caa34005-4e26-5571-831b-c75aa4b79e13", "parentControlId": 30918, "controlId": "CM-08", "title": "CM-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581892" }, { "id": 551432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "851033c6-806a-5385-be3c-7a800312c993", "parentControlId": 30918, "controlId": "CM-08", "title": "CM-08", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581892" }, { "id": 551433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc1de13a-4bfa-5e79-85e8-681214319f23", "parentControlId": 30918, "controlId": "CM-08", "title": "CM-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581892" }, { "id": 551434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05ad8528-b10c-5da3-8ee1-23f5989a2803", "parentControlId": 30918, "controlId": "CM-08", "title": "CM-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581892" }, { "id": 551435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "198a130f-c53d-57a7-9d12-666f38e8b6df", "parentControlId": 30918, "controlId": "CM-8", "title": "CM-8", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581893" }, { "id": 551436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b37918d-ab18-53bb-9f92-8810800503a6", "parentControlId": 30918, "controlId": "CM-8", "title": "CM-8", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581893" }, { "id": 551437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56c373a0-b9ca-5fab-930c-0c4fd72e3218", "parentControlId": 30918, "controlId": "CM-8", "title": "CM-8", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581893" }, { "id": 551440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c0bf0fb-ef40-5776-b2be-ebc901ff358f", "parentControlId": 30918, "controlId": "NFO - CM-8(5)", "title": "NFO - CM-8(5)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581893" } ], "id": 30918, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730897", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730897", "catalogueId": 1062, "uuid": "78a47d74-2b9a-558a-9f14-c5eb78aa4abc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish and maintain an authoritative source and repository to provide a trusted source and accountability for approved and implemented system components that prevents assets from being duplicated in other asset inventories?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Component Duplication Avoidance", "description": "

Control Description

Mechanisms exist to establish and maintain an authoritative source and repository to provide a trusted source and accountability for approved and implemented system components that prevents assets from being duplicated in other asset inventories.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Asset Management (AST) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with AST domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Asset management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Asset management is informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ Inventories are manual (e.g., spreadsheets).

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to establish and maintain an authoritative source and repository to provide a trusted source and accountability for approved and implemented system components that prevents assets from being duplicated in other asset inventories.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-02.3", "family": "Asset Management", "enhancements": "", "sortId": "AST-02.3", "references": "

Micro-Small Business (<10 staff)

∙ Configuration Management Database (CMDB)

Small Business (10-49 staff)

∙ Configuration Management Database (CMDB)

Medium Business (50-249 staff)

∙ Configuration Management Database (CMDB)

Large Business (250-999 staff)

∙ Configuration Management Database (CMDB)

Enterprise (>1,000 staff)

∙ Configuration Management Database (CMDB)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69549, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589922", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589922", "securityControlId": 30919, "ccis": [], "uuid": "3a201710-2f6e-50eb-9b1f-af2e9d1f2454", "testId": "AST-02.4_A01", "test": "assessed component configurations are included in the system component inventory.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-08(06)[01]", "defaultText": null }, { "id": 69550, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589922", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589922", "securityControlId": 30919, "ccis": [], "uuid": "c3dc141e-a019-5b2b-8eb0-665dd6526036", "testId": "AST-02.4_A02", "test": "any approved deviations to current deployed configurations are included in the system component inventory.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-08(06)[02]", "defaultText": null } ], "externalMappings": [ { "id": 551454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85ff5338-56bb-56e7-a1a3-0fb74fadcf67", "parentControlId": 30919, "controlId": "CM-8(6)", "title": "CM-8(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581895" }, { "id": 551455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e73d4c1f-8c95-55c2-85d6-47fe16a10446", "parentControlId": 30919, "controlId": "CM-08(06)", "title": "CM-08(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581895" }, { "id": 551456, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f597cae0-75ee-53ac-9daf-c326b56dd1c1", "parentControlId": 30919, "controlId": "CM-08(06)", "title": "CM-08(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581895" }, { "id": 551457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07df828a-515d-5275-b3fe-1d18997fab3c", "parentControlId": 30919, "controlId": "CM-8(6)", "title": "CM-8(6)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581895" }, { "id": 551459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77a2f8b0-19c3-54af-bcea-40e98ca9bbf3", "parentControlId": 30919, "controlId": "03.04.02.b", "title": "03.04.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581895" }, { "id": 551460, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5be6b94c-1a5c-56f2-9444-c1ed8eca26e5", "parentControlId": 30919, "controlId": "03.04.06.a", "title": "03.04.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581895" } ], "id": 30919, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730897", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730897", "catalogueId": 1062, "uuid": "ae0ae67e-61c5-5d60-8235-f9dcfb936e1e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization document and govern instances of approved deviations from established baseline configurations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Approved Baseline Deviations", "description": "

Control Description

Mechanisms exist to document and govern instances of approved deviations from established baseline configurations.

Evidence Request List (ERL)

E-AST-33\nE-RSK-03\nE-TDA-14

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to document and govern instances of approved deviations from established baseline configurations.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-02.4", "family": "Asset Management", "enhancements": "", "sortId": "AST-02.4", "references": "

Micro-Small Business (<10 staff)

∙ Configuration Management Database (CMDB)

Small Business (10-49 staff)

∙ Configuration Management Database (CMDB)

Medium Business (50-249 staff)

∙ Configuration Management Database (CMDB)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)\n∙ Tripwire Enterprise (https://tripwire.com/products/tripwire-enterprise)\n∙ Puppet (https://puppet.com)\n∙ Chef (https://chef.io) (https://chef.io)

Large Business (250-999 staff)

∙ Configuration Management Database (CMDB)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)\n∙ Tripwire Enterprise (https://tripwire.com/products/tripwire-enterprise)\n∙ Puppet (https://puppet.com)\n∙ Chef (https://chef.io) (https://chef.io)

Enterprise (>1,000 staff)

∙ Configuration Management Database (CMDB)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)\n∙ Tripwire Enterprise (https://tripwire.com/products/tripwire-enterprise)\n∙ Puppet (https://puppet.com)\n∙ Chef (https://chef.io) (https://chef.io)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69551, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589923", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589923", "securityControlId": 30920, "ccis": [], "uuid": "8ac4d2e4-638a-5f4a-92f9-35fa61b11798", "testId": "AST-02.5_A01", "test": "system components that are known, authenticated, in a properly configured state or in a trust profile are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.5.3e[a]", "defaultText": null }, { "id": 69552, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589923", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589923", "securityControlId": 30920, "ccis": [], "uuid": "11631908-da3a-5da1-a151-7dc0a8e2e31f", "testId": "AST-02.5_A02", "test": "automated or manual/procedural mechanisms to prohibit system components from connecting to organizational systems are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.5.3e[b]", "defaultText": null }, { "id": 69553, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589932", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589932", "securityControlId": 30920, "ccis": [], "uuid": "36137fb1-fb6d-5cdd-b00f-6b7a2007bd25", "testId": "AST-02.5_A03", "test": "automated or manual/procedural mechanisms are employed to prohibit system components from connecting to organizational systems unless the components are known, authenticated, in a properly configured state or in a trust profile.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.5.3e[c]", "defaultText": null }, { "id": 69554, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589936", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589936", "securityControlId": 30920, "ccis": [], "uuid": "6b9e9b58-b428-5682-805d-8e6942d544cd", "testId": "AST-02.5_A04", "test": "configuration management process to be employed to handle device identification and authentication based on attestation is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IA-03(04)_ODP", "defaultText": null }, { "id": 69555, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589937", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589937", "securityControlId": 30920, "ccis": [], "uuid": "ec794325-4d2d-5ab1-ab8f-836efb4cf15e", "testId": "AST-02.5_A05", "test": "device identification and authentication are handled based on attestation by configuration management process.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_IA-03(04)", "defaultText": null } ], "externalMappings": [ { "id": 551470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "573b462d-044c-5065-b7f9-12e457a4c139", "parentControlId": 30920, "controlId": "IA-3(4)", "title": "IA-3(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581897" }, { "id": 551471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8662621e-0d86-5978-8a3c-736d4c8f1240", "parentControlId": 30920, "controlId": "IA-03(03)", "title": "IA-03(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581897" }, { "id": 551472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3448f8a-8990-5678-90d8-a35540f94ce0", "parentControlId": 30920, "controlId": "SC-07(19)", "title": "SC-07(19)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581897" }, { "id": 551473, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffdcac0a-3a6a-5592-aaaa-0c87d5e4ee0e", "parentControlId": 30920, "controlId": "IA-03(03)", "title": "IA-03(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581897" }, { "id": 551474, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a24a366d-2930-59ee-869a-83c86fdf7b47", "parentControlId": 30920, "controlId": "SC-07(19)", "title": "SC-07(19)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581897" }, { "id": 551475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f63f67c1-2566-5771-908e-79be5d158ead", "parentControlId": 30920, "controlId": "SC-7(19)", "title": "SC-7(19)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581897" }, { "id": 551480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52085990-42ea-5812-b719-f529df7efcbe", "parentControlId": 30920, "controlId": "ARCHITECTURE-2k", "title": "ARCHITECTURE-2k", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581898" } ], "id": 30920, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730898", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730898", "catalogueId": 1062, "uuid": "832e8f38-be26-5958-a5ba-bb61ee3c9eed", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to employ Network Access Control (NAC), or a similar technology, which is capable of detecting unauthorized devices and disable network access to those unauthorized devices?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 4.0, "title": "Network Access Control (NAC)", "description": "

Control Description

Automated mechanisms exist to employ Network Access Control (NAC), or a similar technology, which is capable of detecting unauthorized devices and disable network access to those unauthorized devices.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically employ Network Access Control (NAC), or a similar technology, which is capable of detecting unauthorized devices and disable network access to those unauthorized devices.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-02.5", "family": "Asset Management", "enhancements": "", "sortId": "AST-02.5", "references": "

Micro-Small Business (<10 staff)

∙ VLAN segmentation to isolate unknown devices\n∙ Basic wireless network access controls

Small Business (10-49 staff)

∙ VLAN segmentation to isolate unknown devices\n∙ MAC address filtering (basic NAC)\n∙ Wireless access point policies

Medium Business (50-249 staff)

∙ Cisco Identity Services Engine (ISE) (https://cisco.com)\n∙ HPE Aruba Central (https://arubanetworks.com)\n∙ Juniper Mist Access Assurance (https://juniper.net)\n∙ Open-source NAC (e.g., PacketFence)

Large Business (250-999 staff)

∙ Cisco Identity Services Engine (ISE) (https://cisco.com)\n∙ HPE Aruba Central (https://arubanetworks.com)\n∙ Juniper Mist Access Assurance (https://juniper.net)\n∙ 802.1X certificate-based authentication

Enterprise (>1,000 staff)

∙ Cisco Identity Services Engine (ISE) (https://cisco.com)\n∙ HPE Aruba Central (https://arubanetworks.com)\n∙ Juniper Mist Access Assurance (https://juniper.net)\n∙ Zero Trust Network Access (ZTNA) integration\n∙ 802.1X with EAP-TLS and certificate infrastructure", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69558, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589937", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589937", "securityControlId": 30922, "ccis": [], "uuid": "56ebd04f-8632-5f0f-ac8b-315c7c64dba9", "testId": "AST-02.7_A01", "test": "administrative practices identify software licensing restrictions to ensure compliance with End User Licensing Agreements (EULA).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69559, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589938", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589938", "securityControlId": 30922, "ccis": [], "uuid": "97f621f8-6bc7-5e68-801d-a164ff2c3aa0", "testId": "AST-02.7_A02", "test": "software inventories are automatically or manually reviewed for software licensing compliance.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 551500, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9d81127-0b7b-534b-9629-1168f0598a23", "parentControlId": 30922, "controlId": "5.32", "title": "5.32", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5819" }, { "id": 551504, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b749602e-5c9e-523e-81df-ea515be6fb03", "parentControlId": 30922, "controlId": "SC-18(2)", "title": "SC-18(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581901" }, { "id": 551505, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba56a382-ee68-5504-b46d-3d6ca85a58ed", "parentControlId": 30922, "controlId": "SC-18(02)", "title": "SC-18(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581901" }, { "id": 551507, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62372792-1f2a-588b-bd40-a988efb96d18", "parentControlId": 30922, "controlId": "SC-18(02)", "title": "SC-18(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581901" }, { "id": 551508, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fafa7b0-0af9-51b9-b493-a893e6a1953b", "parentControlId": 30922, "controlId": "SC-18(2)", "title": "SC-18(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581901" } ], "id": 30922, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730898", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730898", "catalogueId": 1062, "uuid": "1cc9b539-3014-5ea4-a4e3-fd428cecca4d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect Intellectual Property (IP) rights with software licensing restrictions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Software Licensing Restrictions", "description": "

Control Description

Mechanisms exist to protect Intellectual Property (IP) rights with software licensing restrictions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Asset Management (AST) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with AST domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Asset management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Asset management is informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ Software licensing restrictions for users, as part of acceptable and unacceptable behaviors.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).\n▪ Software licensing is tracked as part of IT asset inventories.\n▪ Software licensing restrictions for users, as part of acceptable and unacceptable behaviors are primarily administrative and preventative in nature.

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to protect Intellectual Property (IP) rights with software licensing restrictions.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-02.7", "family": "Asset Management", "enhancements": "", "sortId": "AST-02.7", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69560, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589938", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589938", "securityControlId": 30923, "ccis": [], "uuid": "4bcfa575-8189-534d-b4d7-c1a6aa82098b", "testId": "AST-02.8_A01", "test": "a map of system data actions is developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-13", "defaultText": null }, { "id": 69561, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589938", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589938", "securityControlId": 30923, "ccis": [], "uuid": "b7d7a6ad-c184-5f04-a307-1f73880ad788", "testId": "AST-02.8_A02", "test": "the location of sensitive / regulated data is identified and documented.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69562, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589947", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589947", "securityControlId": 30923, "ccis": [], "uuid": "4fc0015f-113d-5af5-9fdf-4e2ca44ae62c", "testId": "AST-02.8_A03", "test": "the system components on which sensitive / regulated data is processed are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69563, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589947", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589947", "securityControlId": 30923, "ccis": [], "uuid": "cd11841f-262e-5ec9-ac0c-1295d2fdb19a", "testId": "AST-02.8_A04", "test": "the system components on which sensitive / regulated data is stored are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69564, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589948", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589948", "securityControlId": 30923, "ccis": [], "uuid": "193d1c9b-c002-5aba-99c1-e0b517917533", "testId": "AST-02.8_A05", "test": "changes to the system or system component location where sensitive / regulated data is processed are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69565, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589948", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589948", "securityControlId": 30923, "ccis": [], "uuid": "1cd493c3-add7-52e4-a233-f9596769f0fe", "testId": "AST-02.8_A06", "test": "changes to the system or system component location where sensitive / regulated data is stored are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69566, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589948", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589948", "securityControlId": 30923, "ccis": [], "uuid": "ae9b00dd-317b-5968-b6b6-c3e191b17741", "testId": "AST-02.8_A07", "test": "the location of CUI is identified and documented.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.04.11.a[01]", "defaultText": null }, { "id": 69567, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589948", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589948", "securityControlId": 30923, "ccis": [], "uuid": "cde4de34-cd64-5a35-afa2-b17cd72b9575", "testId": "AST-02.8_A08", "test": "the system components on which CUI is processed are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.04.11.a[02]", "defaultText": null }, { "id": 69568, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589948", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589948", "securityControlId": 30923, "ccis": [], "uuid": "3f649c55-c343-585f-9eba-c5170cb15059", "testId": "AST-02.8_A09", "test": "the system components on which CUI is stored are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.04.11.a[03]", "defaultText": null }, { "id": 69569, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589948", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589948", "securityControlId": 30923, "ccis": [], "uuid": "5e117190-c72b-5c56-8703-b1fae6cbaf30", "testId": "AST-02.8_A10", "test": "changes to the system or system component location where CUI is processed are documented.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.04.11.b[01]", "defaultText": null }, { "id": 69570, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589948", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589948", "securityControlId": 30923, "ccis": [], "uuid": "7ab62838-5b0f-52c5-acff-93dae8f1c626", "testId": "AST-02.8_A11", "test": "changes to the system or system component location where CUI is stored are documented.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.04.11.b[02]", "defaultText": null } ], "externalMappings": [ { "id": 551535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b1bd14e-0454-53fd-b644-cc1ee4740e4a", "parentControlId": 30923, "controlId": "5.9", "title": "5.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581904" }, { "id": 551542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2436f0bd-c480-5e88-b48a-bf50ed6219d4", "parentControlId": 30923, "controlId": "CM-13", "title": "CM-13", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581905" }, { "id": 551543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ddd03b0-7332-56b0-845c-1d1b80a0ed18", "parentControlId": 30923, "controlId": "CM-13", "title": "CM-13", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581905" }, { "id": 551544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72ff0f41-e31d-50bb-9570-b99b58ac5fa5", "parentControlId": 30923, "controlId": "CM-13", "title": "CM-13", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581905" }, { "id": 551547, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b68cdbb-82bc-556c-af79-80dcb538a40e", "parentControlId": 30923, "controlId": "03.04.11.a", "title": "03.04.11.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581906" }, { "id": 551548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4b65a84-a2f9-5826-b388-597539d3aa91", "parentControlId": 30923, "controlId": "03.04.11.b", "title": "03.04.11.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581906" } ], "id": 30923, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730899", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730899", "catalogueId": 1062, "uuid": "73d10377-6d8e-5c64-9417-eb41514d775e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization create and maintain a map of Technology Assets, Applications and/or Services (TAAS) where sensitive/regulated data is stored, transmitted or processed?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Data Action Mapping", "description": "

Control Description

Mechanisms exist to create and maintain a map of Technology Assets, Applications and/or Services (TAAS) where sensitive/regulated data is stored, transmitted or processed.

Evidence Request List (ERL)

E-DCH-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).\n▪ IT and/or cybersecurity personnel work with process owners to generate and maintain Data Flow Diagrams (DFDs) and network diagrams to document the flow of data to create and maintain a map of systems where sensitive/regulated data is stored, transmitted or processed.

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to create and maintain a map of Technology Assets, Applications and/or Services (TAAS) where sensitive/regulated data is stored, transmitted or processed.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-02.8", "family": "Asset Management", "enhancements": "", "sortId": "AST-02.8", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Visio or draw.io (free, https://draw.io) for data flow diagrams\n∙ LucidChart (https://lucidchart.com)

Small Business (10-49 staff)

∙ Microsoft Visio or draw.io (free, https://draw.io)\n∙ LucidChart (https://lucidchart.com)\n∙ Documented data flow diagrams with sensitivity labels

Medium Business (50-249 staff)

∙ Microsoft Visio\n∙ LucidChart (https://lucidchart.com)\n∙ draw.io (https://draw.io)\n∙ Data flow diagrams integrated with privacy impact assessments

Large Business (250-999 staff)

∙ Microsoft Visio\n∙ LucidChart (https://lucidchart.com)\n∙ Data flow diagrams maintained in CMDB or GRC platform\n∙ Automated data mapping tools (e.g., BigID, OneTrust Data Mapping)

Enterprise (>1,000 staff)

∙ Enterprise data flow/action mapping platform (e.g., BigID, OneTrust, Securiti.ai)\n∙ Microsoft Visio / LucidChart for technical documentation\n∙ Automated data lineage tools (e.g., Collibra, Alation)\n∙ Data maps maintained current for regulatory compliance (GDPR Article 30)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69571, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589949", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589949", "securityControlId": 30924, "ccis": [], "uuid": "e381e3bb-c4b1-50b1-83b9-e650a94e090c", "testId": "AST-02.9_A01", "test": "a centralized repository for the system and system component inventory is provided.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-08(07)", "defaultText": null }, { "id": 69572, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589949", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589949", "securityControlId": 30924, "ccis": [], "uuid": "54d715f2-8032-594f-93df-def226867b8c", "testId": "AST-02.9_A02", "test": "automated mechanisms used to maintain the currency of the system component inventory are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-08(02)_ODP[01]\n53A_R5_CM-08(02)[01]", "defaultText": null }, { "id": 69573, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589949", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589949", "securityControlId": 30924, "ccis": [], "uuid": "a24c457f-cbd9-5276-a377-f10c2e3109c3", "testId": "AST-02.9_A03", "test": "automated mechanisms used to maintain the completeness of the system component inventory are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-08(02)_ODP[02]\n53A_R5_CM-08(02)[02]", "defaultText": null }, { "id": 69574, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589949", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589949", "securityControlId": 30924, "ccis": [], "uuid": "40bda9b3-9ff1-57d3-a0fa-140d752be89b", "testId": "AST-02.9_A04", "test": "automated mechanisms used to maintain the accuracy of the system component inventory are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-08(02)_ODP[03]\n53A_R5_CM-08(02)[03]", "defaultText": null }, { "id": 69575, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589949", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589949", "securityControlId": 30924, "ccis": [], "uuid": "897ba84e-7b53-5738-862f-dc68250c4466", "testId": "AST-02.9_A05", "test": "automated mechanisms used to maintain the availability of the system component inventory are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-08(02)_ODP[04]\n53A_R5_CM-08(02)[04]", "defaultText": null } ], "externalMappings": [ { "id": 551585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6e5d91f-ddb6-5437-a865-b84ebf2f9c17", "parentControlId": 30924, "controlId": "8.9", "title": "8.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58191" }, { "id": 551588, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f25df84-5c43-5179-abfc-3ff45844f480", "parentControlId": 30924, "controlId": "CM-8(2)", "title": "CM-8(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58191" }, { "id": 551589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f431d1ac-b388-58e7-9e7f-454769d07538", "parentControlId": 30924, "controlId": "CM-08(02)", "title": "CM-08(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58191" }, { "id": 551590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7cffa56-aa18-5d84-822f-f32453f53a2e", "parentControlId": 30924, "controlId": "CM-08(07)", "title": "CM-08(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581911" }, { "id": 551591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f00d3d1-5084-5360-b46b-dcadc63f8e69", "parentControlId": 30924, "controlId": "CM-08(02)", "title": "CM-08(02)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581911" }, { "id": 551593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19339c33-acad-5ce1-9dc1-be29d1a4198e", "parentControlId": 30924, "controlId": "CM-08(02)", "title": "CM-08(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581911" }, { "id": 551594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0846cff-1a15-548a-a6a5-abd3bf2894e7", "parentControlId": 30924, "controlId": "CM-08(07)", "title": "CM-08(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581911" }, { "id": 551595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e06f9d6-4ffc-5504-9470-08a6a044af5e", "parentControlId": 30924, "controlId": "CM-08(02)", "title": "CM-08(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581911" }, { "id": 551596, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "281d6418-7dc7-5e2d-9f59-9a62e1ce6d43", "parentControlId": 30924, "controlId": "CM-8(2)", "title": "CM-8(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581911" }, { "id": 551597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e035097-00e3-55b7-9114-42534199d72e", "parentControlId": 30924, "controlId": "CM-8(7)", "title": "CM-8(7)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581911" }, { "id": 551600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c791fbf-a550-53f5-b11a-dbdefd8bd5f7", "parentControlId": 30924, "controlId": "03.04.08.a", "title": "03.04.08.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581912" }, { "id": 551601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0336ce5b-eca2-5be3-819d-418b8dcfd723", "parentControlId": 30924, "controlId": "03.04.10.a", "title": "03.04.10.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581912" }, { "id": 551602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b22274ba-e670-5abe-aff6-2262674130a0", "parentControlId": 30924, "controlId": "03.04.10.b", "title": "03.04.10.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581912" }, { "id": 551603, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78d99af1-032b-50dc-8524-279b56ba8b05", "parentControlId": 30924, "controlId": "03.04.10.c", "title": "03.04.10.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581912" }, { "id": 551611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be11cf92-c1e1-5028-8d6d-436a6a41e7a5", "parentControlId": 30924, "controlId": "ASSET-1d", "title": "ASSET-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581913" }, { "id": 551612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eec89603-2db4-5e58-b4b4-dbd1da162b37", "parentControlId": 30924, "controlId": "ASSET-2e", "title": "ASSET-2e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581913" }, { "id": 551613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6daa36fb-9591-5b6e-b20f-8c8cff04aa54", "parentControlId": 30924, "controlId": "ASSET-2g", "title": "ASSET-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581913" } ], "id": 30924, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730899", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730899", "catalogueId": 1062, "uuid": "7c1638ff-c8dd-5fdc-83a8-ef9b6835443b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement and manage a Configuration Management Database (CMDB), or similar technology, to monitor and govern technology asset-specific information?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Configuration Management Database (CMDB)", "description": "

Control Description

Mechanisms exist to implement and manage a Configuration Management Database (CMDB), or similar technology, to monitor and govern technology asset-specific information.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement and manage a Configuration Management Database (CMDB), or similar technology, to monitor and govern technology asset-specific information.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-02.9", "family": "Asset Management", "enhancements": "", "sortId": "AST-02.9", "references": "

Micro-Small Business (<10 staff)

∙ Configuration Management Database (CMDB)

Small Business (10-49 staff)

∙ Configuration Management Database (CMDB)

Medium Business (50-249 staff)

∙ Configuration Management Database (CMDB)

Large Business (250-999 staff)

∙ Configuration Management Database (CMDB)

Enterprise (>1,000 staff)

∙ Configuration Management Database (CMDB)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69576, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58995", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58995", "securityControlId": 30925, "ccis": [], "uuid": "6990489f-e9f0-53f1-8116-c63e24ff2ac1", "testId": "AST-02.10_A01", "test": "automated mechanisms for tracking components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-08(08)_ODP", "defaultText": null }, { "id": 69577, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58995", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58995", "securityControlId": 30925, "ccis": [], "uuid": "bdfe6ff9-242f-595d-83ba-3dc8c3b09c91", "testId": "AST-02.10_A02", "test": "organization-defined automated mechanisms are used to support the tracking of system components by geographic location.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CM-08(08)", "defaultText": null } ], "externalMappings": [ { "id": 551640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79b34089-922f-5c7b-9cc6-2284c020e7f0", "parentControlId": 30925, "controlId": "CM-08(08)", "title": "CM-08(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581916" }, { "id": 551641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b065d567-c3be-5a2b-8b25-567e6abce0c0", "parentControlId": 30925, "controlId": "CM-08(08)", "title": "CM-08(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581917" }, { "id": 551642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f0098de-3b41-59b6-8dd6-1ee12ff6047f", "parentControlId": 30925, "controlId": "CM-8(8)", "title": "CM-8(8)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581917" } ], "id": 30925, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730899", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730899", "catalogueId": 1062, "uuid": "7ba386b3-8435-556e-8a0e-a5c50f4d105d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization track the geographic location of system components?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 5.0, "title": "Automated Location\nTracking", "description": "

Control Description

Mechanisms exist to track the geographic location of system components.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to track the geographic location of system components.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "AST-02.10", "family": "Asset Management", "enhancements": "", "sortId": "AST-02.10", "references": "

Micro-Small Business (<10 staff)

∙ Prey (https://preyproject.com)\n∙ Apple Find My / Google Find My Device for mobile assets

Small Business (10-49 staff)

∙ Prey (https://preyproject.com)\n∙ MDM solution with location tracking (e.g., Jamf Now, Microsoft Intune)

Medium Business (50-249 staff)

∙ Prey (https://preyproject.com)\n∙ MDM solution with location tracking (e.g., Jamf, Microsoft Intune, Mosyle)\n∙ RFID asset tagging for physical hardware

Large Business (250-999 staff)

∙ MDM solution with location tracking (e.g., Jamf, Microsoft Intune, VMware Workspace ONE)\n∙ RFID asset tracking system\n∙ Prey (https://preyproject.com) for supplemental coverage

Enterprise (>1,000 staff)

∙ Enterprise MDM with location tracking (e.g., Jamf Pro, Microsoft Intune, VMware Workspace ONE)\n∙ Enterprise RFID/barcode asset tracking system\n∙ Integration of location data with CMDB and ITAM platform", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69578, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58995", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58995", "securityControlId": 30926, "ccis": [], "uuid": "5731d015-4f1f-5b3c-9a2e-5e88c95ba553", "testId": "AST-02.11_A01", "test": "personnel or roles from which to receive an acknowledgement is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-08(09)_ODP", "defaultText": null }, { "id": 69579, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58995", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58995", "securityControlId": 30926, "ccis": [], "uuid": "2a1b6914-db2e-5fb1-8cf4-c29e9d482507", "testId": "AST-02.11_A02", "test": "system components are assigned to a system.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-08(09)(a)", "defaultText": null }, { "id": 69580, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58995", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58995", "securityControlId": 30926, "ccis": [], "uuid": "91c6c047-518c-59af-87ae-48885e48dc9b", "testId": "AST-02.11_A03", "test": "an acknowledgement of the component assignment is received from organization-defined personnel or roles.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_CM-08(09)(b)", "defaultText": null } ], "externalMappings": [ { "id": 551645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8893a0c-b009-5bf5-bb64-a27808628c3c", "parentControlId": 30926, "controlId": "CM-08(09)", "title": "CM-08(09)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581917" }, { "id": 551646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "574dfc96-0d16-5fc8-acc8-3ebdf3ff2bdf", "parentControlId": 30926, "controlId": "CM-08(09)", "title": "CM-08(09)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581917" }, { "id": 551647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af4b474e-8ab9-594a-89e9-d7a39ae6b820", "parentControlId": 30926, "controlId": "CM-8(9)", "title": "CM-8(9)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581917" } ], "id": 30926, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.7309", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.7309", "catalogueId": 1062, "uuid": "3d55f7c7-ede9-59c4-8ac2-890b69bdd9b0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization bind components to a specific system?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Component Assignment", "description": "

Control Description

Mechanisms exist to bind components to a specific system.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Asset Management (AST) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with AST domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Asset management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Asset management is informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ Inventories are manual (e.g., spreadsheets).

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to bind components to a specific system.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-02.11", "family": "Asset Management", "enhancements": "", "sortId": "AST-02.11", "references": "

Micro-Small Business (<10 staff)

∙ Spreadsheet asset inventory

Small Business (10-49 staff)

∙ Asset inventory spreadsheet\n∙ Asset ownership assignment

Medium Business (50-249 staff)

∙ Asset management tool (e.g., Snipe-IT)\n∙ Asset classification policy

Large Business (250-999 staff)

∙ Enterprise asset management platform (e.g., ServiceNow CMDB, Lansweeper)\n∙ Automated discovery

Enterprise (>1,000 staff)

∙ Enterprise CMDB (e.g., ServiceNow)\n∙ Automated network discovery\n∙ Asset lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69581, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589951", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589951", "securityControlId": 30927, "ccis": [], "uuid": "8e17a07d-818c-584c-844a-566c97c22f5b", "testId": "AST-03_A01", "test": "name, position and/or role of data ownership is documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-08(04)_ODP", "defaultText": null } ], "externalMappings": [ { "id": 551652, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581918", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cdaa4f0-e413-58b1-a1ff-4a396c225c8c", "parentControlId": 30927, "controlId": "5.9", "title": "5.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581918" }, { "id": 551657, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581918", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8dbd737-a69a-5c48-bd2e-0da1d7389429", "parentControlId": 30927, "controlId": "SA-04(12)", "title": "SA-04(12)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581918" }, { "id": 551660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581919", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c088c8c6-c5d0-5104-8305-03d956af7c62", "parentControlId": 30927, "controlId": "SA-04(12)", "title": "SA-04(12)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581919" }, { "id": 551661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581919", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c70c5322-2451-5a72-9d89-4debbca4dec0", "parentControlId": 30927, "controlId": "SA-04(12)", "title": "SA-04(12)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581919" }, { "id": 551662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581919", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42419f77-4174-5356-a00a-1b404a230523", "parentControlId": 30927, "controlId": "SA-04(12)", "title": "SA-04(12)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581919" }, { "id": 551663, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581919", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8360d19-d7f9-540c-995d-54bf8011a66c", "parentControlId": 30927, "controlId": "SA-04(12)", "title": "SA-04(12)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581919" }, { "id": 551664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581919", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "412fdc9e-29be-5f96-a0db-07e0200ab1fc", "parentControlId": 30927, "controlId": "03.09.02.a.03", "title": "03.09.02.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581919" }, { "id": 551665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581919", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a02f1b24-f038-525c-8fdc-717845d2aef5", "parentControlId": 30927, "controlId": "ID.AM", "title": "ID.AM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581919" }, { "id": 551707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581924", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86646896-9d3e-50da-9999-c99e242a8616", "parentControlId": 30927, "controlId": "A3.a (point 4)", "title": "A3.a (point 4)", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581924" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "14b552d7-529a-58c1-9946-859b861b273f", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "69d1dac3-6f5e-5d81-a223-22639805f3ab", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "ecd4ede6-7c86-5e88-bb72-1928b2ff83e7", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "a6b79d8e-94c8-5ed1-94d0-bba608dd7bd1", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "32207f5f-ec76-560d-8277-cb833e2f3c7f", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "12c716ef-4d89-5716-a117-792f089e1cf4", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "bfa61ffd-8813-5e0c-a375-1cbdc73f05ae", "isPublic": true } ], "id": 30927, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.7309", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.7309", "catalogueId": 1062, "uuid": "1bd9be51-e55b-5110-80af-52d5be3c7a9e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure asset ownership responsibilities are assigned, tracked and managed at a team, individual, or responsible organization level to establish a common understanding of requirements for asset protection?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Asset Ownership Assignment", "description": "

Control Description

Mechanisms exist to ensure asset ownership responsibilities are assigned, tracked and managed at a team, individual, or responsible organization level to establish a common understanding of requirements for asset protection.

Evidence Request List (ERL)

E-AST-01\nE-CPL-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).\n▪ Data/process owners for business-critical assets are documented and are reviewed as part of the annual asset inventories.\n▪ Annual IT asset inventories validate or update stakeholders /owners.

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure asset ownership responsibilities are assigned, tracked and managed at a team, individual, or responsible organization level to establish a common understanding of requirements for asset protection.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "AST-03", "family": "Asset Management", "enhancements": "", "sortId": "AST-03", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69582, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589951", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589951", "securityControlId": 30928, "ccis": [], "uuid": "d378a401-579a-5e72-b946-a665bb167d4a", "testId": "AST-03.1_A01", "test": "individuals responsible and accountable for administering system components are identified by organization-defined criteria in the system component inventory.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-08(04)", "defaultText": null } ], "externalMappings": [ { "id": 551721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581934", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ea7effa-1383-51f6-a5ec-7c782b357f26", "parentControlId": 30928, "controlId": "5.9", "title": "5.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581934" }, { "id": 551725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581934", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39283ccf-e224-5f5b-b2a4-d9296cfbbdbf", "parentControlId": 30928, "controlId": "CM-8(4)", "title": "CM-8(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581934" }, { "id": 551726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581934", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc5f5a45-0a45-5da9-b754-222b57d00d99", "parentControlId": 30928, "controlId": "CM-08(04)", "title": "CM-08(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581934" }, { "id": 551727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd04916e-b9a7-5b0f-bbed-78168c38d539", "parentControlId": 30928, "controlId": "CM-08(04)", "title": "CM-08(04)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581935" }, { "id": 551729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42a9a59d-640b-515d-9bdc-a1ac07e97761", "parentControlId": 30928, "controlId": "CM-08(04)", "title": "CM-08(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581935" }, { "id": 551730, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7f5f750-3714-5abb-99ba-808af69a9a4a", "parentControlId": 30928, "controlId": "CM-08(04)", "title": "CM-08(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581935" }, { "id": 551731, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04452e3b-e036-5cc6-8290-1d08ef2c838b", "parentControlId": 30928, "controlId": "CM-8(4)", "title": "CM-8(4)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581935" }, { "id": 551733, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e1bbc8a-4e1d-542e-a351-124c9c199271", "parentControlId": 30928, "controlId": "03.09.02.a.03", "title": "03.09.02.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581935" }, { "id": 551734, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ccc006f-61ce-5b71-8d81-3ab1e9538fac", "parentControlId": 30928, "controlId": "ID.AM", "title": "ID.AM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581935" } ], "id": 30928, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.7309", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.7309", "catalogueId": 1062, "uuid": "f22d32fb-f96f-5c8b-a3b4-a0a9c1c10809", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization include capturing the name, position and/or role of individuals responsible/accountable for administering assets as part of the technology asset inventory process?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Accountability Information", "description": "

Control Description

Mechanisms exist to include capturing the name, position and/or role of individuals responsible/accountable for administering assets as part of the technology asset inventory process.

Evidence Request List (ERL)

E-AST-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).\n▪ Data/process owners for business-critical assets are documented and are reviewed as part of the annual asset inventories.\n▪ Annual IT asset inventories validate or update stakeholders /owners.

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to include capturing the name, position and/or role of individuals responsible/accountable for administering assets as part of the technology asset inventory process.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-03.1", "family": "Asset Management", "enhancements": "", "sortId": "AST-03.1", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69583, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589951", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589951", "securityControlId": 30929, "ccis": [], "uuid": "58bf94cd-b6bd-5f5a-bb43-f9dbff883be1", "testId": "AST-03.2_A01", "test": "systems, system components and associated data that require valid provenance are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-04_ODP", "defaultText": null }, { "id": 69584, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589951", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589951", "securityControlId": 30929, "ccis": [], "uuid": "efdf007f-d522-5617-ba74-d9b10bfcd92a", "testId": "AST-03.2_A02", "test": "valid provenance is documented for systems, system components and associated data.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-04[01]", "defaultText": null }, { "id": 69585, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589952", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589952", "securityControlId": 30929, "ccis": [], "uuid": "224d9396-8b0e-5714-a4e5-3f73275451f7", "testId": "AST-03.2_A03", "test": "valid provenance is monitored for systems, system components and associated data.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-04[02]", "defaultText": null }, { "id": 69586, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589952", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589952", "securityControlId": 30929, "ccis": [], "uuid": "83043253-db14-563b-8bc0-07cd9a6393bb", "testId": "AST-03.2_A04", "test": "valid provenance is maintained for systems, system components and associated data.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-04[03]", "defaultText": null }, { "id": 69587, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589954", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589954", "securityControlId": 30929, "ccis": [], "uuid": "1ef0d3fe-a319-5f11-a44c-0dc48f0cc43a", "testId": "AST-03.2_A05", "test": "supply chain elements, processes and personnel associated with systems and critical system components that require unique identification are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-04(01)_ODP", "defaultText": null }, { "id": 69588, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589954", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589954", "securityControlId": 30929, "ccis": [], "uuid": "45ea2399-ad20-5898-b18d-60a0a8491bb1", "testId": "AST-03.2_A06", "test": "unique identification of supply chain elements, processes and personnel is established.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-04(01)[01]", "defaultText": null }, { "id": 69589, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589955", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589955", "securityControlId": 30929, "ccis": [], "uuid": "3db696c1-4547-5f15-a1ff-4d5813497c75", "testId": "AST-03.2_A07", "test": "unique identification of supply chain elements, processes and personnel is maintained.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-04(01)[02]", "defaultText": null }, { "id": 69590, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589955", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589955", "securityControlId": 30929, "ccis": [], "uuid": "a9ab0045-4911-552d-9739-ada8fb387ed0", "testId": "AST-03.2_A08", "test": "systems and critical system components that require unique identification for tracking through the supply chain are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-04(02)_ODP", "defaultText": null }, { "id": 69591, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589955", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589955", "securityControlId": 30929, "ccis": [], "uuid": "a07cc75c-a7e2-5674-a45e-60b7338ac115", "testId": "AST-03.2_A09", "test": "the unique identification of systems and critical system components is established for tracking through the supply chain.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-04(02)[01]", "defaultText": null }, { "id": 69592, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589955", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589955", "securityControlId": 30929, "ccis": [], "uuid": "81824f9b-96a0-5be2-a5f4-34f48f4bc218", "testId": "AST-03.2_A10", "test": "the unique identification of systems and critical system components is maintained for tracking through the supply chain.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-04(02)[02]", "defaultText": null } ], "externalMappings": [ { "id": 551745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581937", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7170f4e7-698a-524a-8b2e-d6675ee1a048", "parentControlId": 30929, "controlId": "5.21", "title": "5.21", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581937" }, { "id": 551748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581937", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ccc4341-b95a-58a1-b699-919ceb29f5c8", "parentControlId": 30929, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581937" }, { "id": 551749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581937", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc72abe3-cf75-5ccd-8b8c-906817223d67", "parentControlId": 30929, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581937" }, { "id": 551750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581937", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f10dff6a-aa68-56f3-9a2c-6f3d5b2dd16c", "parentControlId": 30929, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581937" }, { "id": 551751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581937", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7cc670d-d59f-50f3-aecb-56a8bc1b6ac1", "parentControlId": 30929, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581937" }, { "id": 551752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581938", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b2e3e54-115f-5b96-8058-db9839d299fe", "parentControlId": 30929, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581938" }, { "id": 551753, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581938", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a96e313-723a-5699-8de6-836b9893d78f", "parentControlId": 30929, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581938" }, { "id": 551754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581938", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71954b17-c8eb-5aec-8fc8-49d9d43833dc", "parentControlId": 30929, "controlId": "T1059.002", "title": "T1059.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581938" }, { "id": 551755, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581938", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18bf95f0-32d3-5d8f-8854-1e08776d9e1f", "parentControlId": 30929, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581938" }, { "id": 551756, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581938", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45fe7f26-95d0-508f-88c6-22b44811dcfe", "parentControlId": 30929, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581938" }, { "id": 551757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581938", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2fba94b-7e29-5bf0-9dae-6ce24f07dafc", "parentControlId": 30929, "controlId": "T1195.002", "title": "T1195.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581938" }, { "id": 551758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581938", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b6f8df7-9791-561f-aeb7-b038a57ae3f5", "parentControlId": 30929, "controlId": "T1195.003", "title": "T1195.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581938" }, { "id": 551759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581938", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a71b8d9-7e24-531a-85ab-58c1471ae885", "parentControlId": 30929, "controlId": "T1204.003", "title": "T1204.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581938" }, { "id": 551760, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581938", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c648cf6-f3ee-5478-ab21-37d1f8bc4660", "parentControlId": 30929, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581938" }, { "id": 551761, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ea76f83-9db6-5185-8660-68c14b3b10f7", "parentControlId": 30929, "controlId": "T1505.001", "title": "T1505.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581939" }, { "id": 551762, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a0e1f7c-cefd-58c3-914a-feb01f1c6a55", "parentControlId": 30929, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581939" }, { "id": 551763, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca1610af-a4b7-536c-bdf1-a1af0b17db7f", "parentControlId": 30929, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581939" }, { "id": 551764, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5dd407c8-804f-5135-8177-8d6815e16a60", "parentControlId": 30929, "controlId": "T1546.006", "title": "T1546.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581939" }, { "id": 551765, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c901f48c-59ac-5859-beb9-adf40dbda299", "parentControlId": 30929, "controlId": "T1554", "title": "T1554", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581939" }, { "id": 551766, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8e96d7a-1ceb-5f3c-88ee-7ee8f741a5fe", "parentControlId": 30929, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581939" }, { "id": 551767, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9b3767a-3e50-5c11-9020-2a86dc7df705", "parentControlId": 30929, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58194" }, { "id": 551768, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b979e191-4020-5a26-8119-7ee256a55ed7", "parentControlId": 30929, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58194" }, { "id": 551769, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "247e1f43-35a9-5410-9c65-088e9a0297d4", "parentControlId": 30929, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58194" }, { "id": 551770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36973539-de16-5d2f-bce2-85ecaa3f33d8", "parentControlId": 30929, "controlId": "SR-04", "title": "SR-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58194" }, { "id": 551771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35e5f906-da74-5467-8d60-1c5092cc67b3", "parentControlId": 30929, "controlId": "SR-04(01)", "title": "SR-04(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58194" }, { "id": 551772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12ea80fd-4aac-53a7-8807-f1bbd40be680", "parentControlId": 30929, "controlId": "SR-04(02)", "title": "SR-04(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58194" }, { "id": 551773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fb35996-83e3-5526-b7e8-7cfd05e89168", "parentControlId": 30929, "controlId": "SR-04", "title": "SR-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58194" }, { "id": 551774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05e9946b-e09f-5dc7-9054-c5337cb5765d", "parentControlId": 30929, "controlId": "SR-04(01)", "title": "SR-04(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58194" }, { "id": 551775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b763554a-7ef6-5dfc-bfff-7fb0527fe682", "parentControlId": 30929, "controlId": "SR-04(02)", "title": "SR-04(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58194" }, { "id": 551779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581941", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "971b4e13-6f95-592e-9a06-b1879e581842", "parentControlId": 30929, "controlId": "SR-4", "title": "SR-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581941" } ], "id": 30929, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730901", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730901", "catalogueId": 1062, "uuid": "7e418f07-25a7-5899-a743-e590ea20a38c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization track the origin, development, ownership, location and changes to Technology Assets, Applications, Services and/or Data (TAASD)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Provenance", "description": "

Control Description

Mechanisms exist to track the origin, development, ownership, location and changes to Technology Assets, Applications, Services and/or Data (TAASD).

Evidence Request List (ERL)

E-AST-22

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Asset Management (AST) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with AST domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Asset management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Asset management is informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ Inventories are manual (e.g., spreadsheets).

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to track the origin, development, ownership, location and changes to TAASD.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-03.2", "family": "Asset Management", "enhancements": "", "sortId": "AST-03.2", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69593, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589956", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589956", "securityControlId": 30930, "ccis": [], "uuid": "ed8e55e3-4247-59da-85c0-de515443ad56", "testId": "AST-04_A01", "test": "sensitive data flows are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69594, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589956", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589956", "securityControlId": 30930, "ccis": [], "uuid": "e4d0f98a-2f18-587a-99c1-c236df0fe070", "testId": "AST-04_A02", "test": "a Data Flow Diagram (DFD) exists for each type of sensitive / regulated data that is stored, processed and/or transmitted.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69595, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589956", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589956", "securityControlId": 30930, "ccis": [], "uuid": "986386ea-4d21-5592-be19-1da82ea41d0b", "testId": "AST-04_A03", "test": "a process exists to review DFDs for accuracy.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69596, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589956", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589956", "securityControlId": 30930, "ccis": [], "uuid": "39c69d77-ca9a-592e-8e80-1c1aec97a7b6", "testId": "AST-04_A04", "test": "a process exists to update DFDs upon technology or business practice changes that affect where sensitive / regulated data is stored, processed and/or transmitted.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69597, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589956", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589956", "securityControlId": 30930, "ccis": [], "uuid": "c7ab6949-d38f-5150-a389-958d7098bc4e", "testId": "AST-04_A05", "test": "one or more high-level network diagrams exist as a schematic to identify the logical placement of systems, applications and services at a conceptual level.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null }, { "id": 69598, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589956", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589957", "securityControlId": 30930, "ccis": [], "uuid": "d077764c-78df-5e7d-9c1c-9072445d5256", "testId": "AST-04_A06", "test": "one or more low-level network diagrams exist as a schematic to identify the detailed logical and physical placement of systems, applications and services.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null }, { "id": 69599, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589957", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589957", "securityControlId": 30930, "ccis": [], "uuid": "d0692f74-9737-5524-a4c3-f56fad103a0a", "testId": "AST-04_A07", "test": "a process exists to review network diagrams for accuracy.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 69600, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589957", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589957", "securityControlId": 30930, "ccis": [], "uuid": "48d16699-4b10-5bee-bccc-0fe049a6dbe6", "testId": "AST-04_A08", "test": "a process exists to update network diagrams upon technologies change.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 551813, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50ca242c-9663-56ed-9bce-1002e19b2f65", "parentControlId": 30930, "controlId": "CM 1.2", "title": "CM 1.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581945" }, { "id": 551814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da300b47-e17e-5316-9fcd-6b0f5e9f30f9", "parentControlId": 30930, "controlId": "5.9", "title": "5.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581945" }, { "id": 551815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2000672a-3068-561b-a12e-c62a5ae97269", "parentControlId": 30930, "controlId": "8.2", "title": "8.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581945" }, { "id": 551823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581946", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c126a8b-ab8f-5994-9f36-a160d060bf24", "parentControlId": 30930, "controlId": "PL-2", "title": "PL-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581946" }, { "id": 551824, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581946", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac0574d5-4b58-53ce-ae2a-1f89e559a2b6", "parentControlId": 30930, "controlId": "SA-5(1)", "title": "SA-5(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581946" }, { "id": 551825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581946", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8067a621-579e-5410-8462-c265bcc08b78", "parentControlId": 30930, "controlId": "SA-5(2)", "title": "SA-5(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581946" }, { "id": 551826, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581946", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ccad0e2-7156-5473-bca8-8005e03e8604", "parentControlId": 30930, "controlId": "SA-5(3)", "title": "SA-5(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581946" }, { "id": 551827, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581946", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61a0b611-397c-5113-b5a8-613e7ee3d60d", "parentControlId": 30930, "controlId": "SA-5(4)", "title": "SA-5(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581946" }, { "id": 551828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4273563e-792b-580d-a8ed-e38f5aab96d6", "parentControlId": 30930, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581947" }, { "id": 551829, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2eb44f9e-5d8b-515a-bcae-acfb60f4a745", "parentControlId": 30930, "controlId": "SA-04(01)", "title": "SA-04(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581947" }, { "id": 551830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd7327dc-7ba8-5dd1-9ef3-80ab3d1ba563", "parentControlId": 30930, "controlId": "SA-04(02)", "title": "SA-04(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581947" }, { "id": 551834, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "997c4555-6fa3-5a26-b66a-1e79bb49d747", "parentControlId": 30930, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581947" }, { "id": 551835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db1c74dc-ae2f-5cee-9955-428f75a0f969", "parentControlId": 30930, "controlId": "SA-04(01)", "title": "SA-04(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581947" }, { "id": 551836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "056d7173-93cd-51f5-ad03-662821fa2690", "parentControlId": 30930, "controlId": "SA-04(02)", "title": "SA-04(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581947" }, { "id": 551837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bdadfc3-34d1-50d0-96f4-d1eb88225190", "parentControlId": 30930, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581948" }, { "id": 551838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce2c09a1-6e6f-5020-85b3-84d03b0981cd", "parentControlId": 30930, "controlId": "SA-04(01)", "title": "SA-04(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581948" }, { "id": 551839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d6053fe-0aeb-59db-ac68-f67534d62602", "parentControlId": 30930, "controlId": "SA-04(02)", "title": "SA-04(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581948" }, { "id": 551840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9a132a7-aee2-5a35-a725-5bf2b8c9edc4", "parentControlId": 30930, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581948" }, { "id": 551841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef396ec8-fe62-5210-9daf-263887038a42", "parentControlId": 30930, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581948" }, { "id": 551842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb7126e1-0075-5794-92d7-57db86cbc6b1", "parentControlId": 30930, "controlId": "SA-04(01)", "title": "SA-04(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581948" }, { "id": 551843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35bce8d7-ba8a-59e6-9cd4-c5829d206b19", "parentControlId": 30930, "controlId": "SA-04(02)", "title": "SA-04(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581948" }, { "id": 551844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ad6df2d-af5b-5f71-8632-89ef3f03daa4", "parentControlId": 30930, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581948" }, { "id": 551845, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5344547-3bfd-5923-a8dd-e85932648a02", "parentControlId": 30930, "controlId": "SA-04(01)", "title": "SA-04(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581948" }, { "id": 551846, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "990432ed-5aec-55e6-93cf-f43095dc5686", "parentControlId": 30930, "controlId": "SA-04(02)", "title": "SA-04(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581949" }, { "id": 551847, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3eab97f-cbd1-508f-a944-394b306feb35", "parentControlId": 30930, "controlId": "PL-2", "title": "PL-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581949" }, { "id": 551848, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77ab49cf-4489-5bbf-a070-3c8a27b156fe", "parentControlId": 30930, "controlId": "PL-2", "title": "PL-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581949" }, { "id": 551849, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f31fa0c5-c019-5722-9f33-f1ed68243faf", "parentControlId": 30930, "controlId": "PL-2", "title": "PL-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581949" }, { "id": 551851, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3cf3ea70-0a43-5f73-b6a7-aa23d94abbbf", "parentControlId": 30930, "controlId": "03.01.03", "title": "03.01.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581949" }, { "id": 551852, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38bae205-68ad-54f9-a107-606f36cf8d33", "parentControlId": 30930, "controlId": "03.04.11.a", "title": "03.04.11.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581949" }, { "id": 551853, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47062c20-8f2e-50b9-9718-44e71534b5e2", "parentControlId": 30930, "controlId": "03.04.11.b", "title": "03.04.11.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581949" }, { "id": 551856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10a83e22-eedb-5caf-bede-da58bf8b2de1", "parentControlId": 30930, "controlId": "ID.AM-03", "title": "ID.AM-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58195" }, { "id": 551910, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581956", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32a8b228-5d4b-5636-831e-85eee5491c68", "parentControlId": 30930, "controlId": "B3.a", "title": "B3.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581956" }, { "controlId": "B.1.18", "title": "B.1.18 — Insecure and Rogue Connections", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, CA-9, SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1e8d7ee3-fed2-5ae5-a76e-4b493ab0a29c", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.18", "title": "NEI 08-09 App D.1.18 — Insecure and Rogue Connections", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.18", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "9b36b421-723a-5f21-a4da-2119524b7b16", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.18", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "7473b053-d206-55de-a656-d2b0ce80b724", "isPublic": true }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "0f9fe755-a7a8-5550-8d9f-bdc9083232ef", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "ce36d3e8-4983-5651-aa00-0e7054520deb", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "a595553c-21ee-5038-b786-e84dc9837995", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "87bac9dc-ff26-5030-a6ee-993ed860f36c", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "bd580776-f5b0-5033-8c6c-417e2b9cd5f3", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "93d39539-ab55-5a16-9958-bcaff081b85c", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "40929b4c-98ed-5017-acd3-6ba13df5f734", "isPublic": true } ], "id": 30930, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730901", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730901", "catalogueId": 1062, "uuid": "ff93552a-c7a8-5fbf-a6c3-0d4603e8e924", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain network architecture diagrams that: \n (1) Contain sufficient detail to assess the security of the network's architecture;\n (2) Reflect the current architecture of the network environment; and\n (3) Document all sensitive/regulated data flows?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Network Diagrams & Data Flow Diagrams (DFDs)", "description": "

Control Description

Mechanisms exist to maintain network architecture diagrams that: \n(1) Contain sufficient detail to assess the security of the network's architecture;\n(2) Reflect the current architecture of the network environment; and\n(3) Document all sensitive/regulated data flows.

Evidence Request List (ERL)

E-DCH-03\nE-DCH-04\nE-DCH-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).\n▪ IT and/or cybersecurity personnel work with process owners to generate and maintain Data Flow Diagrams (DFDs) and network diagrams to document the flow of data to create and maintain a map of systems where sensitive/regulated data is stored, transmitted or processed.

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain network architecture diagrams that: \n(1) Contain sufficient detail to assess the security of the network's architecture;\n(2) Reflect the current architecture of the network environment; and\n(3) Document all sensitive/regulated data flows.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.18", "controlId": "AST-04", "family": "Asset Management", "enhancements": "", "sortId": "AST-04", "references": "

Micro-Small Business (<10 staff)

∙ High-Level Diagram (HLD)\n∙ Data Flow Diagram (DFD)\n∙ draw.io (free, https://draw.io) or Microsoft Visio

Small Business (10-49 staff)

∙ High-Level Diagram (HLD)\n∙ Low-Level Diagram (LLD)\n∙ Data Flow Diagram (DFD)\n∙ draw.io (free) or Microsoft Visio

Medium Business (50-249 staff)

∙ High-Level Diagram (HLD)\n∙ Low-Level Diagram (LLD)\n∙ Data Flow Diagram (DFD)\n∙ LucidChart (https://lucidchart.com) or Microsoft Visio\n∙ Network documentation tool (e.g., NetBox, SolarWinds NTM)

Large Business (250-999 staff)

∙ High-Level Diagram (HLD)\n∙ Low-Level Diagram (LLD)\n∙ Data Flow Diagram (DFD)\n∙ Network topology tool (e.g., SolarWinds Network Topology Mapper, NetBox)\n∙ Automated network diagram updates via discovery tools

Enterprise (>1,000 staff)

∙ High-Level Diagram (HLD)\n∙ Low-Level Diagram (LLD)\n∙ Data Flow Diagram (DFD)\n∙ Enterprise network documentation platform (e.g., NetBox, SolarWinds NTM)\n∙ Automated network discovery and diagram generation\n∙ Diagrams integrated with CMDB and change management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69601, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589957", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589957", "securityControlId": 30931, "ccis": [], "uuid": "6d4c8035-fa39-552f-aec2-2513ec801657", "testId": "AST-04.1_A01", "test": "system hardware components to be marked indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-22_ODP", "defaultText": null }, { "id": 69602, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589957", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589957", "securityControlId": 30931, "ccis": [], "uuid": "537db496-0ca0-587c-bda5-3624cea2f99a", "testId": "AST-04.1_A02", "test": "system hardware components are marked indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-22", "defaultText": null } ], "externalMappings": [ { "id": 551943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95c73bfe-cc2e-5030-b0a5-f1a3221fc735", "parentControlId": 30931, "controlId": "SM-3", "title": "SM-3", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58196" }, { "id": 551944, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b372f4f2-4308-5098-b22f-c224b0fdfe76", "parentControlId": 30931, "controlId": "4.3", "title": "4.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58196" }, { "id": 551945, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de2164bb-0d8e-5fd6-8b00-fa4e21db1de1", "parentControlId": 30931, "controlId": "5.12", "title": "5.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58196" }, { "id": 551949, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e296d400-7ea6-5733-9bd3-f42fe0f988fc", "parentControlId": 30931, "controlId": "PE-22", "title": "PE-22", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58196" }, { "id": 551950, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91ef7cc4-0ceb-55c1-8b8d-bfc2024d27df", "parentControlId": 30931, "controlId": "SA-05", "title": "SA-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58196" }, { "id": 551953, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fba23f1e-25f2-50fe-bcb0-beef5259062f", "parentControlId": 30931, "controlId": "SA-05", "title": "SA-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581961" }, { "id": 551954, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b2747c4-f210-50a7-aef3-088fbb7d4887", "parentControlId": 30931, "controlId": "PE-22", "title": "PE-22", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581961" }, { "id": 551955, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb50aef2-006b-500d-aedc-49bc048ed8ac", "parentControlId": 30931, "controlId": "SA-05", "title": "SA-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581961" }, { "id": 551956, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3730034d-1b92-5fc0-bd6f-31f212c67ff6", "parentControlId": 30931, "controlId": "SA-05", "title": "SA-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581961" }, { "id": 551957, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "835c1510-d43d-5b96-8651-7c595de7dd5a", "parentControlId": 30931, "controlId": "PE-22", "title": "PE-22", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581961" }, { "id": 551958, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3468665-8784-5901-a4ca-36a61cd1a19b", "parentControlId": 30931, "controlId": "SA-05", "title": "SA-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581961" }, { "id": 551959, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "532375d9-57aa-5b2d-abfb-b3d8ff0ec4cf", "parentControlId": 30931, "controlId": "PE-22", "title": "PE-22", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581961" }, { "id": 551960, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3aebbe73-6190-5ee2-a03c-00763f171785", "parentControlId": 30931, "controlId": "SA-05", "title": "SA-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581961" }, { "id": 551961, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "763b946a-d469-5054-9341-0caadd64b58f", "parentControlId": 30931, "controlId": "SA-5", "title": "SA-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581961" }, { "id": 551962, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581962", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4b6ff2b-d301-5c5e-8f6d-5b61b3561965", "parentControlId": 30931, "controlId": "SA-5", "title": "SA-5", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581962" }, { "id": 551964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581962", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d8da5f6-59b4-5c0c-9be4-4c068c68bbeb", "parentControlId": 30931, "controlId": "03.04.11.a", "title": "03.04.11.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581962" }, { "id": 551965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581962", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "994b8b38-9b26-5ba7-b808-e479d9209f31", "parentControlId": 30931, "controlId": "03.04.11.b", "title": "03.04.11.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581962" }, { "id": 551968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581963", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1593c57-ead2-5fac-ac89-8f245ba75ac2", "parentControlId": 30931, "controlId": "ID.AM-05", "title": "ID.AM-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581963" } ], "id": 30931, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730901", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730901", "catalogueId": 1062, "uuid": "9a680b94-5eb4-5e8d-9ea4-b5c36de2541c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization determine security, compliance and resilience control applicability by identifying, assigning and documenting the appropriate asset scope categorization for all Technology Assets, Applications and/or Services (TAAS) and personnel (internal and third-parties)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Asset Scope Classification", "description": "

Control Description

Mechanisms exist to determine security, compliance and resilience control applicability by identifying, assigning and documenting the appropriate asset scope categorization for all Technology Assets, Applications and/or Services (TAAS) and personnel (internal and third-parties).

Evidence Request List (ERL)

E-AST-02\nE-CPL-02\nE-DCH-01\nE-DCH-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to determine security, compliance and resilience control applicability by identifying, assigning and documenting the appropriate asset scope categorization for all Technology Assets, Applications and/or Services (TAAS) and personnel (internal and third-parties).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-04.1", "family": "Asset Management", "enhancements": "", "sortId": "AST-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)

Small Business (10-49 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)

Medium Business (50-249 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)

Large Business (250-999 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)

Enterprise (>1,000 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69603, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589958", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589958", "securityControlId": 30932, "ccis": [], "uuid": "6d5596da-43ff-5042-a420-747f56a8aef8", "testId": "AST-04.2_A01", "test": "one or more diagrams graphically depict control applicability boundaries for systems, applications, services and third parties to clarify \"in-scope versus out-of-scope\" determinations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 552007, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34677234-3224-5394-920f-19055c65aa61", "parentControlId": 30932, "controlId": "03.04.11.a", "title": "03.04.11.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581967" }, { "id": 552008, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb6534a7-f1df-5122-aa56-5b80e6048ce5", "parentControlId": 30932, "controlId": "03.04.11.b", "title": "03.04.11.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581967" }, { "id": 552009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "415c73a0-4e65-50c1-b088-3425a61adb82", "parentControlId": 30932, "controlId": "03.15.02.a.04", "title": "03.15.02.a.04", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581967" }, { "id": 552010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ce14c06-e1f3-5d23-b552-9c6839d8a9d0", "parentControlId": 30932, "controlId": "ID.AM-03", "title": "ID.AM-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581967" } ], "id": 30932, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730902", "catalogueId": 1062, "uuid": "51973913-9be8-5346-bdc1-2bfc295a4bea", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure control applicability is appropriately-determined for Technology Assets, Applications and/or Services (TAAS) and third parties by graphically representing applicable boundaries?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Control Applicability Boundary Graphical Representation", "description": "

Control Description

Mechanisms exist to ensure control applicability is appropriately-determined for Technology Assets, Applications and/or Services (TAAS) and third parties by graphically representing applicable boundaries.

Evidence Request List (ERL)

E-AST-02\nE-CPL-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure control applicability is appropriately-determined for Technology Assets, Applications and/or Services (TAAS) and third parties by graphically representing applicable boundaries.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-04.2", "family": "Asset Management", "enhancements": "", "sortId": "AST-04.2", "references": "

Micro-Small Business (<10 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)

Small Business (10-49 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)

Medium Business (50-249 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)

Large Business (250-999 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)

Enterprise (>1,000 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69604, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589958", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589958", "securityControlId": 30933, "ccis": [], "uuid": "177a5401-5fb9-5cee-981c-34fa20f1b31e", "testId": "AST-04.3_A01", "test": "an inventory of systems, applications and services exists for each specific statutory, regulatory and/or contractual compliance obligations that provides sufficient detail to determine control applicability, based on asset scope categorization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69605, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589958", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589958", "securityControlId": 30933, "ccis": [], "uuid": "2b5d3733-6851-564c-8df3-80e79fc13dcd", "testId": "AST-04.3_A02", "test": "inventories of systems, applications and services are kept current for each specific statutory, regulatory and/or contractual compliance obligations that provides sufficient detail to determine control applicability, based on asset scope categorization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 552025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581969", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88320a99-2a75-5e95-92fe-de586b340bff", "parentControlId": 30933, "controlId": "03.01.03", "title": "03.01.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581969" } ], "id": 30933, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730902", "catalogueId": 1062, "uuid": "81f34451-76d4-58eb-91cb-9f710f81e1d1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization create and maintain a current inventory of Technology Assets, Applications, Services and/or Data (TAASD) that are in scope for statutory, regulatory and/or contractual compliance obligations that provides sufficient detail to determine control applicability, based on asset scope categorization?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 6.0, "title": "Compliance-Specific Asset Identification", "description": "

Control Description

Mechanisms exist to create and maintain a current inventory of Technology Assets, Applications, Services and/or Data (TAASD) that are in scope for statutory, regulatory and/or contractual compliance obligations that provides sufficient detail to determine control applicability, based on asset scope categorization.

Evidence Request List (ERL)

E-AST-02\nE-CPL-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Asset Management (AST) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with AST domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Asset management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Asset management is informally assigned as an additional duty to existing IT/cybersecurity personnel.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to create and maintain a current inventory of TAASD that are in scope for statutory, regulatory and/or contractual compliance obligations that provides sufficient detail to determine control applicability, based on asset scope categorization.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-04.3", "family": "Asset Management", "enhancements": "", "sortId": "AST-04.3", "references": "

Micro-Small Business (<10 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)

Small Business (10-49 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)

Medium Business (50-249 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)

Large Business (250-999 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)

Enterprise (>1,000 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69606, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589958", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589958", "securityControlId": 30934, "ccis": [], "uuid": "1c2de049-4303-5847-a0f4-3c1fcc7c4650", "testId": "AST-05_A01", "test": "strict control is maintained over the internal or external distribution of any kind of sensitive / regulated media.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 552041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581979", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f43e1a7-524f-552a-bad8-a297b683f312", "parentControlId": 30934, "controlId": "7.9", "title": "7.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581979" }, { "id": 552044, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581979", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fee6eac6-5854-549c-b2e2-ace0c1dbe47d", "parentControlId": 30934, "controlId": "NFO - MP-1", "title": "NFO - MP-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581979" }, { "id": 552045, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58198", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3cbb8d6b-9b69-522e-9f88-865b3938ad79", "parentControlId": 30934, "controlId": "03.07.04.a", "title": "03.07.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58198" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "c940afc9-750d-5bba-b4ed-637ca75ce585", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "c4806480-0e6c-5d1a-920e-672151a0b6f2", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "68f2f04d-f44c-5ed2-bdc4-a1df79866f11", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "68cca523-5cc1-51e4-898d-36c124538721", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "1479287b-3065-5308-adca-43d8ed154ea1", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "84425d4f-1658-56a1-baef-f467907cae63", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "5032ff9c-9680-5d4f-9343-fe4496ff61ad", "isPublic": true } ], "id": 30934, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730902", "catalogueId": 1062, "uuid": "bdfe3492-c7ad-5e41-a5ce-0079785655cb", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain strict control over the internal or external distribution of any kind of sensitive/regulated media?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Security of Assets & Media", "description": "

Control Description

Mechanisms exist to maintain strict control over the internal or external distribution of any kind of sensitive/regulated media.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).\n▪ IT personnel collect technology assets and media for destruction when it is no longer needed for business or legal reasons.

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain strict control over the internal or external distribution of any kind of sensitive/regulated media.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-05", "family": "Asset Management", "enhancements": "", "sortId": "AST-05", "references": "

Micro-Small Business (<10 staff)

∙ Formally assigned roles & responsibilities\n∙ Rules of Behavior (RoB) / Acceptable Use\n∙ Confidentiality / Non-Disclosure Agreements (NDAs)

Small Business (10-49 staff)

∙ Formally assigned roles & responsibilities\n∙ Rules of Behavior (RoB) / Acceptable Use\n∙ Confidentiality / Non-Disclosure Agreements (NDAs)

Medium Business (50-249 staff)

∙ Formally assigned roles & responsibilities\n∙ Rules of Behavior (RoB) / Acceptable Use\n∙ Confidentiality / Non-Disclosure Agreements (NDAs)

Large Business (250-999 staff)

∙ Formally assigned roles & responsibilities\n∙ Rules of Behavior (RoB) / Acceptable Use\n∙ Confidentiality / Non-Disclosure Agreements (NDAs)

Enterprise (>1,000 staff)

∙ Formally assigned roles & responsibilities\n∙ Rules of Behavior (RoB) / Acceptable Use\n∙ Confidentiality / Non-Disclosure Agreements (NDAs)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69608, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589959", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589959", "securityControlId": 30936, "ccis": [], "uuid": "c033b92f-2207-527e-b572-b27bb07c1a97", "testId": "AST-06_A01", "test": "enhanced protection measures for unattended systems are implemented to protect against tampering and unauthorized access.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 552078, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2db0cbe-dfa1-59c3-a461-682063c933af", "parentControlId": 30936, "controlId": "7.7", "title": "7.7", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581984" }, { "id": 552079, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b969038c-68c0-5480-8e08-a2f60b2b9793", "parentControlId": 30936, "controlId": "7.9", "title": "7.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581984" }, { "id": 552080, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2ceed63-e0ce-5c77-891c-998cddd5b055", "parentControlId": 30936, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581984" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "166529c7-efea-50f5-af8d-36cb3eda758b", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "4b92dfd5-7523-55f6-a0d9-019710d554cc", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "948df04f-7dc2-5687-912f-ba229beb21c3", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "7f10ba59-8699-5d0f-aac7-28adbf15028c", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "e74723b2-f74a-51ad-ad91-2f6a2877b43e", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "87ec68fa-050d-5d44-ac6f-fc4429d0446e", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "f36ffe5a-7c7d-52cd-8e05-55cb166a17f2", "isPublic": true } ], "id": 30936, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730903", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730903", "catalogueId": 1062, "uuid": "33d7e06f-dcb8-5017-ac54-212bcc549bd6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement enhanced protection measures for unattended technology assets to protect against tampering and unauthorized access?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Unattended End-User Equipment", "description": "

Control Description

Mechanisms exist to implement enhanced protection measures for unattended technology assets to protect against tampering and unauthorized access.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Asset Management (AST) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with AST domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Asset management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Asset management is informally assigned as an additional duty to existing IT/cybersecurity personnel.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement enhanced protection measures for unattended technology assets to protect against tampering and unauthorized access.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-06", "family": "Asset Management", "enhancements": "", "sortId": "AST-06", "references": "

Micro-Small Business (<10 staff)

∙ Lockable casings\n∙ Tamper detection tape\n∙ Full Disk Encryption (FDE)

Small Business (10-49 staff)

∙ Lockable casings\n∙ Tamper detection tape\n∙ Full Disk Encryption (FDE)

Medium Business (50-249 staff)

∙ Lockable casings\n∙ Tamper detection tape\n∙ Full Disk Encryption (FDE) \n∙ File Integrity Monitoring (FIM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Large Business (250-999 staff)

∙ Lockable casings\n∙ Tamper detection tape\n∙ Full Disk Encryption (FDE) \n∙ File Integrity Monitoring (FIM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Enterprise (>1,000 staff)

∙ Lockable casings\n∙ Tamper detection tape\n∙ Full Disk Encryption (FDE) \n∙ File Integrity Monitoring (FIM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69610, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589959", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589959", "securityControlId": 30938, "ccis": [], "uuid": "a0be4771-4ca9-5dc8-b6f2-9e13b19c2d77", "testId": "AST-07_A01", "test": "devices that capture sensitive / regulated data via direct physical interaction are appropriately protected from tampering and substitution.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 552107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57fdafaa-b52c-5c3a-8813-ef07ca1f84d0", "parentControlId": 30938, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581987" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "707809c5-87e0-543f-89a0-96997d9d47b4", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "3e0d8460-1274-522c-a9bd-690a5e05ac10", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "d52f489c-6335-5a2d-b427-936397cd3452", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "2f2662eb-455e-5569-9260-1bb92844561e", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "b1274f51-046e-5c3b-8bb8-9c4f4ee9aea0", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "6bb9a0d8-60ac-5fb8-a784-f2d5fcdff15d", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "17146a99-9e65-50ad-9fb3-a3d79c00aa72", "isPublic": true } ], "id": 30938, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730904", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730904", "catalogueId": 1062, "uuid": "b303d2e9-750c-55ff-8ef7-13d5a3bb3899", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization appropriately protect devices that capture sensitive/regulated data via direct physical interaction from tampering and substitution?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Kiosks & Point of Interaction (PoI) Devices", "description": "

Control Description

Mechanisms exist to appropriately protect devices that capture sensitive/regulated data via direct physical interaction from tampering and substitution.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Asset Management (AST) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with AST domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Asset management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Asset management is informally assigned as an additional duty to existing IT/cybersecurity personnel.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to appropriately protect devices that capture sensitive/regulated data via direct physical interaction from tampering and substitution.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-07", "family": "Asset Management", "enhancements": "", "sortId": "AST-07", "references": "

Micro-Small Business (<10 staff)

∙ Lockable casings\n∙ Tamper detection tape\n∙ Full Disk Encryption (FDE)

Small Business (10-49 staff)

∙ Lockable casings\n∙ Tamper detection tape\n∙ Full Disk Encryption (FDE)

Medium Business (50-249 staff)

∙ Lockable casings\n∙ Tamper detection tape\n∙ Full Disk Encryption (FDE) \n∙ File Integrity Monitoring (FIM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Large Business (250-999 staff)

∙ Lockable casings\n∙ Tamper detection tape\n∙ Full Disk Encryption (FDE) \n∙ File Integrity Monitoring (FIM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Enterprise (>1,000 staff)

∙ Lockable casings\n∙ Tamper detection tape\n∙ Full Disk Encryption (FDE) \n∙ File Integrity Monitoring (FIM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69611, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58996", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58996", "securityControlId": 30939, "ccis": [], "uuid": "4c399127-4acd-5574-96b6-30f32b56e396", "testId": "AST-08_A01", "test": "mobile devices are inspected for evidence of tampering upon return from geographic regions of concern or other known hostile environments that could lead to device compromise.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69612, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58996", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58996", "securityControlId": 30939, "ccis": [], "uuid": "790888df-3a8d-554b-9228-6406f01bd3f7", "testId": "AST-08_A02", "test": "mobile devices that show signs of tampering are confiscated for forensic examination.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 552133, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58199", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d79baf66-6d12-5d5f-9de1-44a3ad897844", "parentControlId": 30939, "controlId": "CR 3.11", "title": "CR 3.11", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58199" }, { "id": 552134, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58199", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "009f7f10-b3f0-5fe7-83a7-c79037d41b6d", "parentControlId": 30939, "controlId": "EDR 3.11", "title": "EDR 3.11", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58199" }, { "id": 552135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58199", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b78108e-b7c4-51a9-ab7d-5dca751e812f", "parentControlId": 30939, "controlId": "HDR 3.11", "title": "HDR 3.11", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58199" }, { "id": 552136, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58199", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c83eb0a-2807-52ad-a5a3-4d84a508812f", "parentControlId": 30939, "controlId": "NDR 3.11", "title": "NDR 3.11", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58199" }, { "id": 552137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58199", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "300a19a8-dacf-5b72-9c57-c2d5b6bc610d", "parentControlId": 30939, "controlId": "7.9", "title": "7.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581991" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "07460cc8-1be6-5430-bd77-00446f7fbab8", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "fe244910-77c3-53ff-b572-0cacf91bf4af", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "1f24fb55-9aee-5e56-aa69-4aff5ad4a73a", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "c621aedf-a56c-5442-a577-99f55ff6fac4", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "deeea042-69c1-5705-a6c7-6f5a5c89a752", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "e4fa6621-65c3-52a6-919a-087b8c0e6723", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "77314f2b-e6b0-58a6-b7b3-102174665ad3", "isPublic": true } ], "id": 30939, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730904", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730904", "catalogueId": 1062, "uuid": "fc72df56-a9c2-597c-89e7-60470f02d9ab", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization periodically inspect systems and system components for Indicators of Compromise (IoC)?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Physical Tampering Detection", "description": "

Control Description

Mechanisms exist to periodically inspect systems and system components for Indicators of Compromise (IoC).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Asset Management (AST) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with AST domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Asset management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Asset management is informally assigned as an additional duty to existing IT/cybersecurity personnel.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).\n▪ Periodic physical inspections are performed to validate the integrity of unattended technology assets (e.g., kiosks, ATMs, point of sale devices, etc.).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to periodically inspect systems and system components for Indicators of Compromise (IoC).

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-08", "family": "Asset Management", "enhancements": "", "sortId": "AST-08", "references": "

Micro-Small Business (<10 staff)

∙ Tamper detection tape

Small Business (10-49 staff)

∙ Tamper detection tape

Medium Business (50-249 staff)

∙ Tamper detection tape

Large Business (250-999 staff)

∙ Tamper detection tape

Enterprise (>1,000 staff)

∙ Tamper detection tape", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69613, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58996", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58996", "securityControlId": 30940, "ccis": [], "uuid": "70513e7c-0e85-5ab1-a0f2-230f20a55228", "testId": "AST-09_A01", "test": "data, documentation, tools or system components to be disposed of are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-12_ODP[01]\n53A_R5_MP-06_ODP[01]\n53A_R5_MP-06_ODP[02]\n53A_R5_MP-06_ODP[03]", "defaultText": null }, { "id": 69614, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589961", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589961", "securityControlId": 30940, "ccis": [], "uuid": "7a669031-3aec-5630-ae8b-bbbc3074bd9c", "testId": "AST-09_A02", "test": "techniques and methods for disposing of data, documentation, tools or system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-12_ODP[02]\n53A_R5_MP-06_ODP[04]\n53A_R5_MP-06_ODP[05]\n53A_R5_MP-06_ODP[06]", "defaultText": null }, { "id": 69615, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589961", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589961", "securityControlId": 30940, "ccis": [], "uuid": "b936df30-d5b2-5592-993e-192c22e0d74a", "testId": "AST-09_A03", "test": "data, documentation, tools or system components are disposed of using techniques and methods.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-12", "defaultText": null }, { "id": 69616, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589961", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589961", "securityControlId": 30940, "ccis": [], "uuid": "e0fc1d49-357b-53ac-9efe-fc786fdeb7d2", "testId": "AST-09_A04", "test": "system media is sanitized using sanitization techniques and procedures prior to disposal.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: techniques and procedures IAW NIST SP 800-088 Section 4: Reuse and Disposal of Storage Media and Hardware", "otherId": "53A_R5_MP-06a.[01]", "defaultText": null }, { "id": 69617, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589961", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589961", "securityControlId": 30940, "ccis": [], "uuid": "a595a70e-0d72-5d82-b91e-fc348710eb6a", "testId": "AST-09_A05", "test": "system media is sanitized using sanitization techniques and procedures prior to release from organizational control.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: techniques and procedures IAW NIST SP 800-088 Section 4: Reuse and Disposal of Storage Media and Hardware", "otherId": "53A_R5_MP-06a.[02]", "defaultText": null }, { "id": 69618, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589962", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589962", "securityControlId": 30940, "ccis": [], "uuid": "8920660e-cf3d-58ae-b036-b73d631b2d32", "testId": "AST-09_A06", "test": "system media is sanitized using sanitization techniques and procedures prior to release for reuse.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: techniques and procedures IAW NIST SP 800-088 Section 4: Reuse and Disposal of Storage Media and Hardware", "otherId": "53A_R5_MP-06a.[03]", "defaultText": null }, { "id": 69619, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589962", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589962", "securityControlId": 30940, "ccis": [], "uuid": "f0478320-f04d-5872-bf06-86556d5c21d0", "testId": "AST-09_A07", "test": "sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_MP-06b.", "defaultText": null } ], "externalMappings": [ { "id": 552172, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9538a32e-0e3e-5b51-a7fc-fa8544c32f33", "parentControlId": 30940, "controlId": "7.14", "title": "7.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581995" }, { "id": 552173, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "285dc454-3b3d-5525-b7d7-32c762dbf876", "parentControlId": 30940, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581995" }, { "id": 552181, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62fd0002-d53b-5119-a6c0-bf9a724cfe1d", "parentControlId": 30940, "controlId": "SA-19(3)", "title": "SA-19(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581995" }, { "id": 552182, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26b8c4f0-4003-5ac7-808d-262a1c41bab0", "parentControlId": 30940, "controlId": "SR-12", "title": "SR-12", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581996" }, { "id": 552184, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b62084ee-7fd0-5617-ac20-499645cac236", "parentControlId": 30940, "controlId": "SR-12", "title": "SR-12", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581996" }, { "id": 552186, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f734102b-c2ad-5f07-9e21-e97153d801b3", "parentControlId": 30940, "controlId": "SR-12", "title": "SR-12", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581996" }, { "id": 552187, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7113f528-a442-5beb-a307-8fdb3ab87f34", "parentControlId": 30940, "controlId": "SR-12", "title": "SR-12", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581996" }, { "id": 552188, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00b88ec4-6dc8-5c21-8ffe-968e80ddcec8", "parentControlId": 30940, "controlId": "SR-12", "title": "SR-12", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581996" }, { "id": 552189, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12fb9cf7-235f-5145-b78a-f2b49ceb2628", "parentControlId": 30940, "controlId": "SR-12", "title": "SR-12", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581996" }, { "id": 552190, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6d51124-8434-5352-bc78-6a1446c8f70a", "parentControlId": 30940, "controlId": "SR-12", "title": "SR-12", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581996" }, { "id": 552191, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581997", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30f03ec4-0f1d-5d6f-8bdf-b3b370e4c2b1", "parentControlId": 30940, "controlId": "SR-12", "title": "SR-12", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581997" }, { "id": 552194, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581997", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2eae177-1dac-53b3-9fe8-b15aaf52f583", "parentControlId": 30940, "controlId": "3.8.3", "title": "3.8.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581997" }, { "id": 552195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581997", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a3f7442-d885-53d3-b1e2-2d7c77856df4", "parentControlId": 30940, "controlId": "03.07.04.c", "title": "03.07.04.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581997" }, { "id": 552196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581997", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa6a15dd-1b35-547c-9d4c-206fbf5cd1c4", "parentControlId": 30940, "controlId": "03.08.03", "title": "03.08.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581997" }, { "id": 552203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "086fe8ec-3b2a-5aaa-8537-9607368da181", "parentControlId": 30940, "controlId": "ASSET-1h", "title": "ASSET-1h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581998" }, { "id": 552204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.581998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97a000a2-01c3-5fd1-9cf2-3cba77660843", "parentControlId": 30940, "controlId": "ASSET-2h", "title": "ASSET-2h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.581998" }, { "id": 552218, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "851e291d-ebc8-53d6-88c8-f6da5add4f6a", "parentControlId": 30940, "controlId": "6-2.a", "title": "6-2.a", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582" }, { "id": 552219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da65ad8a-905c-572c-8143-11bf17f74e35", "parentControlId": 30940, "controlId": "6-3", "title": "6-3", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582" }, { "id": 552220, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5badce5-43fd-59f5-8c91-4d11ffdbf1d7", "parentControlId": 30940, "controlId": "6-3.a", "title": "6-3.a", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582" }, { "id": 552221, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9173827b-d757-53ed-aa7a-981d6b87255d", "parentControlId": 30940, "controlId": "11-3.a(4)(d)", "title": "11-3.a(4)(d)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582" }, { "id": 552222, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91dfc671-5d6c-5801-98f7-cd818e60b797", "parentControlId": 30940, "controlId": "11-3.a(5)(c)", "title": "11-3.a(5)(c)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582" }, { "id": 552223, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89799208-6b52-530b-ac2a-77087c5a1778", "parentControlId": 30940, "controlId": "11-3.c", "title": "11-3.c", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "21574133-3d9b-5f7c-8374-9f28b8d591f6", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "8327c2e6-1ed1-57c6-b251-5cd6510c333d", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "decda4b8-4499-54a6-a674-650930725a5b", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "5923b6f6-263a-574e-bd51-79849bf88b32", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "925804bd-2172-5b20-8b81-a9060e493639", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "eaefb4b2-3629-576a-877a-231141328afe", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "06c950f9-553e-53d7-aedd-f0c9bd8ea66b", "isPublic": true } ], "id": 30940, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730904", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730904", "catalogueId": 1062, "uuid": "78d5cc31-e0d0-518e-9b34-a0711ea17be1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization securely dispose of, destroy or repurpose system components using organization-defined techniques and methods to prevent information being recovered from these components?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Secure Disposal, Destruction or Re-Use of Equipment", "description": "

Control Description

Mechanisms exist to securely dispose of, destroy or repurpose system components using organization-defined techniques and methods to prevent information being recovered from these components.

Evidence Request List (ERL)

E-AST-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Asset Management (AST) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with AST domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Asset management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Asset management is informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ Decentralized requirements for data / process owners to dispose of, destroy or repurpose systems when no longer needed for business or legal reasons.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).\n▪ IT personnel collect technology assets and media for destruction when it is no longer needed for business or legal reasons.\n▪ IT personnel perform the destruction of technology assets and media in a secure manner or outsource the destruction to a third-party that specializes in technology assets and media destruction, as well as provides evidence of destruction (e.g., certificate of destruction).\n▪ Asset decommissioning consists of mainly wiping hard drives.\n▪ IT personnel use technology to re-image, or configure, assets from configuration-controlled and integrity-protected images or scripts (infrastructure as code).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to securely dispose of, destroy or repurpose system components using organization-defined techniques and methods to prevent information being recovered from these components.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-09", "family": "Asset Management", "enhancements": "", "sortId": "AST-09", "references": "

Micro-Small Business (<10 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Small Business (10-49 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Medium Business (50-249 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Large Business (250-999 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Enterprise (>1,000 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69620, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589962", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589962", "securityControlId": 30941, "ccis": [], "uuid": "552ca319-71ab-5a03-8af1-e8a192287aec", "testId": "AST-10_A01", "test": "the organization governs a process to ensure that employees return all organizational assets in their possession upon termination of employment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69621, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589962", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589962", "securityControlId": 30941, "ccis": [], "uuid": "d6af7382-dc7f-5986-9c4c-33f34a5f3259", "testId": "AST-10_A02", "test": "the organization governs a process to ensure that third-party users return all organizational assets in their possession upon termination of contract or agreement.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69622, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589963", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589963", "securityControlId": 30941, "ccis": [], "uuid": "2e8bd8d1-5d9e-5f2a-8759-7d22532c5de9", "testId": "AST-10_A03", "test": "upon termination of individual employment, security-related system property is retrieved.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "171A_R3_A.03.09.02.a.03", "defaultText": null } ], "externalMappings": [ { "id": 552337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1402037c-831f-5e62-a1e8-fe72198dd875", "parentControlId": 30941, "controlId": "5.11", "title": "5.11", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582013" }, { "id": 552341, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582014", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21f7d18a-7a32-5bd5-a3e6-6edb20b4540a", "parentControlId": 30941, "controlId": "03.09.02.a.03", "title": "03.09.02.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582014" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "34e3d5d5-293f-5336-825a-28d86da7aeab", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "5ec2e74a-1d9f-5893-9cf2-49e677e8a5be", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "d40e9c48-d958-55ed-915a-213199a6cb50", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "7a7a3192-7ddb-5fc4-a6e5-4e68ca7d5c10", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "8596be9b-02da-5073-89ee-bdcf0a519a78", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "01d77f5a-5ba7-51ef-88a4-09df2698c0b8", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "1f64a21c-fb54-5ab6-bf84-7463699395a4", "isPublic": true } ], "id": 30941, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730904", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730905", "catalogueId": 1062, "uuid": "e2bca0da-85e3-5f0d-acad-dff5e776e518", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure that employees and third-party users return all organizational assets in their possession upon termination of employment, contract or agreement?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Return of Assets", "description": "

Control Description

Mechanisms exist to ensure that employees and third-party users return all organizational assets in their possession upon termination of employment, contract or agreement.

Evidence Request List (ERL)

E-AST-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Asset Management (AST) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with AST domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Asset management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Asset management is informally assigned as an additional duty to existing IT/cybersecurity personnel.\n▪ Decentralized requirements for data / process owners to dispose of, destroy or repurpose systems when no longer needed for business or legal reasons.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).\n▪ IT personnel collect technology assets and media for destruction when it is no longer needed for business or legal reasons.\n▪ The IT department receives organization-owned assets up on termination of an individual's employment.\n▪ Assets not returned are reported as a security incident, based on the data that may exist on the device(s).\n▪ Mobile devices are escrowed in storage for a period of time before being wiped and reissued, in case data on the devices are needed for investigations or business purposes.\n▪ IT personnel use technology to re-image, or configure, assets from configuration-controlled and integrity-protected images or scripts (infrastructure as code).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure that employees and third-party users return all organizational assets in their possession upon termination of employment, contract or agreement.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-10", "family": "Asset Management", "enhancements": "", "sortId": "AST-10", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69623, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589963", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589963", "securityControlId": 30942, "ccis": [], "uuid": "5fb2b0a4-616b-50d0-935b-861daa8c3a1c", "testId": "AST-11_A01", "test": "facility egress points are controlled by physical security measures.
PPTDF Applicability: Facility
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null }, { "id": 69624, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589963", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589963", "securityControlId": 30942, "ccis": [], "uuid": "f91926bf-d89e-5bd3-9571-6f46e0b82d6a", "testId": "AST-11_A02", "test": "prior management authorization is required for the removal of technology assets from organizational facilities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69625, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589963", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589963", "securityControlId": 30942, "ccis": [], "uuid": "e8e33fb4-b74b-5c1d-b0c9-91a4e6573e11", "testId": "AST-11_A03", "test": "the organization controls and tracks technology assets entering and exiting organizational facilities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 552349, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582015", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6dbe754-bcb6-5935-886e-ec4fcf7cb0d7", "parentControlId": 30942, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582015" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "11361c1b-7105-5211-862a-070884a25712", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "cf02ffcd-d80c-5a93-9bb4-96fcf2554942", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "3fbf361f-76cf-5fa7-9323-9df496071a34", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "090eff5d-ed5b-5f2d-8676-a216bf9a9412", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "addc6a80-05b4-5d1e-bfa1-df4a38c797cc", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "f67b73ac-e311-5fb9-adaa-4f8c016866ca", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "3f743316-82c2-5706-b2f8-29acdf762808", "isPublic": true } ], "id": 30942, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730905", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730905", "catalogueId": 1062, "uuid": "6d6addcb-169e-5cfd-a1d6-e9d93cf25d31", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization authorize, control and track technology assets entering and exiting organizational facilities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Removal of Assets", "description": "

Control Description

Mechanisms exist to authorize, control and track technology assets entering and exiting organizational facilities.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Asset Management (AST) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with AST domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Asset management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Asset management is informally assigned as an additional duty to existing IT/cybersecurity personnel.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to authorize, control and track technology assets entering and exiting organizational facilities.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-11", "family": "Asset Management", "enhancements": "", "sortId": "AST-11", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program\n∙ RFID asset tagging\n∙ RFID proximity sensors at access points

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program\n∙ RFID asset tagging\n∙ RFID proximity sensors at access points

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program\n∙ RFID asset tagging\n∙ RFID proximity sensors at access points", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69626, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589963", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589963", "securityControlId": 30943, "ccis": [], "uuid": "f0f5a468-ad7a-593e-9ee5-ab277d0ca918", "testId": "AST-12_A01", "test": "the possession of personally-owned technology devices is restricted within organization-controlled facilities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69627, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589964", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589964", "securityControlId": 30943, "ccis": [], "uuid": "9c59d444-6792-5ac6-bf2c-03a94b69752f", "testId": "AST-12_A02", "test": "the usage of personally-owned technology devices is restricted within organization-controlled facilities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 552355, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582015", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59649b34-2bd1-5f31-9bac-b39f92a06602", "parentControlId": 30943, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582015" }, { "id": 552356, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582015", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9de57ff2-aae6-51d4-a5a1-3769a6fcff0d", "parentControlId": 30943, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582015" }, { "id": 552359, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582016", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13aaa701-81a0-5947-ab72-2dcc91399ee7", "parentControlId": 30943, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582016" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "3cdb1802-eb5c-5bca-bbed-c6cdba47f443", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "761f14a9-6204-5233-afcf-84d9d1720b88", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "64104e74-5ea0-5980-be75-5536d006c807", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "14fe0cfb-911f-53ed-9fe5-5f0055917656", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "fc6e3e65-d2ac-50ef-b1cc-fd342414d20e", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "ec8469b3-7224-50b1-b8a6-0f441915549f", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "ecdd3935-fa15-52f7-bb78-4a75d1b6ea17", "isPublic": true } ], "id": 30943, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730905", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730905", "catalogueId": 1062, "uuid": "cb04317b-14e2-5fd3-9d2d-11e0f472a10a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict the possession and/or use of personally-owned Technology Assets, Applications and/or Services (TAAS) within organization-controlled facilities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Use of Personal Devices", "description": "

Control Description

Mechanisms exist to restrict the possession and/or use of personally-owned Technology Assets, Applications and/or Services (TAAS) within organization-controlled facilities.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Asset Management (AST) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with AST domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Asset management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Asset management is informally assigned as an additional duty to existing IT/cybersecurity personnel.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict the possession and/or use of personally-owned Technology Assets, Applications and/or Services (TAAS) within organization-controlled facilities.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-12", "family": "Asset Management", "enhancements": "", "sortId": "AST-12", "references": "

Micro-Small Business (<10 staff)

∙ Rules of Behavior (RoB) / Acceptable Use

Small Business (10-49 staff)

∙ Rules of Behavior (RoB) / Acceptable Use

Medium Business (50-249 staff)

∙ Rules of Behavior (RoB) / Acceptable Use

Large Business (250-999 staff)

∙ Rules of Behavior (RoB) / Acceptable Use

Enterprise (>1,000 staff)

∙ Rules of Behavior (RoB) / Acceptable Use", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69628, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589964", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589964", "securityControlId": 30944, "ccis": [], "uuid": "6959712c-c81c-50cf-8a13-c9b1b2e72686", "testId": "AST-13_A01", "test": "technology configurations prohibit third-party technology assets from connecting to the organization's internal network(s).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 552363, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582016", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c743f61a-3ad3-595f-877a-c6c26c2d3392", "parentControlId": 30944, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582016" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "6fdd4d6e-d2c3-5dee-b165-aa31c0942c49", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "129a11e6-398f-56fd-8658-7dea84505452", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "7cd59e28-cff7-5f6b-8b1e-ecd27e9dc5c2", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "3f57d553-9be0-567f-8fb6-00a978ebab6f", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "0cf48c5c-e287-5341-ad64-0c5be0ad9750", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "73f90e82-ba1f-54ae-8429-fb802894a752", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "2ed4db71-a0b2-5b4e-a06c-594e2de70bb9", "isPublic": true } ], "id": 30944, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730906", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730906", "catalogueId": 1062, "uuid": "9e20eb58-bdd5-5e57-83cc-d05f60037ac9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization reduce the risk associated with third-party assets that are attached to the network from harming organizational assets or exfiltrating organizational data?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Use of Third-Party Devices", "description": "

Control Description

Mechanisms exist to reduce the risk associated with third-party assets that are attached to the network from harming organizational assets or exfiltrating organizational data.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to reduce the risk associated with third-party assets that are attached to the network from harming organizational assets or exfiltrating organizational data.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-13", "family": "Asset Management", "enhancements": "", "sortId": "AST-13", "references": "

Micro-Small Business (<10 staff)

∙ Rules of Behavior (RoB) / Acceptable Use

Small Business (10-49 staff)

∙ Rules of Behavior (RoB) / Acceptable Use

Medium Business (50-249 staff)

∙ Rules of Behavior (RoB) / Acceptable Use\n∙ Network Access Control (NAC)

Large Business (250-999 staff)

∙ Rules of Behavior (RoB) / Acceptable Use\n∙ Network Access Control (NAC)

Enterprise (>1,000 staff)

∙ Rules of Behavior (RoB) / Acceptable Use\n∙ Network Access Control (NAC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69629, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589964", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589964", "securityControlId": 30945, "ccis": [], "uuid": "5a2cea78-955d-50b6-b3f4-cf5830db28eb", "testId": "AST-14_A01", "test": "the components for which usage restrictions and implementation guidance are to be established are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-43_ODP", "defaultText": null }, { "id": 69630, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589965", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589965", "securityControlId": 30945, "ccis": [], "uuid": "ffa5748a-86ea-52c3-96d9-1e1f3ea766f7", "testId": "AST-14_A02", "test": "usage restrictions and implementation guidelines are established for components.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-43a.", "defaultText": null }, { "id": 69631, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589965", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589965", "securityControlId": 30945, "ccis": [], "uuid": "8154f674-9032-5eb0-bf78-d21142e2ebb4", "testId": "AST-14_A03", "test": "the use of components is authorized within the system.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-43b.[01]", "defaultText": null }, { "id": 69632, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589965", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589965", "securityControlId": 30945, "ccis": [], "uuid": "870b18d8-f7a4-5b44-819e-bce1b3ab70d8", "testId": "AST-14_A04", "test": "the use of components is monitored within the system.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-43b.[02]", "defaultText": null }, { "id": 69633, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589965", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589965", "securityControlId": 30945, "ccis": [], "uuid": "a1f8bacc-0ef0-5177-acea-2b504dffe379", "testId": "AST-14_A05", "test": "the use of components is controlled within the system.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-43b.[03]", "defaultText": null } ], "externalMappings": [ { "id": 552369, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "165cff16-7dd5-5f42-98ae-9ef998fae2bb", "parentControlId": 30945, "controlId": "T1011", "title": "T1011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582025" }, { "id": 552370, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efbe4d9b-82a7-5705-a9cf-2f4a0e8484b3", "parentControlId": 30945, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582025" }, { "id": 552371, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5fa12f3-4175-5d9e-b71e-9d9f61940980", "parentControlId": 30945, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582025" }, { "id": 552372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58d35aeb-502b-5e0c-b9ac-000c1fa7a543", "parentControlId": 30945, "controlId": "T1114.003", "title": "T1114.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582025" }, { "id": 552373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582026", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f529f76-c927-5cea-b6da-140c9415ff73", "parentControlId": 30945, "controlId": "T1613", "title": "T1613", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582026" }, { "id": 552374, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582026", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e645f403-2bc3-58dc-bffc-07d9d17e2a3c", "parentControlId": 30945, "controlId": "SC-43", "title": "SC-43", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582026" }, { "id": 552375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582026", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c58a657-2557-5597-b7df-23004e34aa4a", "parentControlId": 30945, "controlId": "SC-43", "title": "SC-43", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582026" }, { "id": 552376, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582026", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48544a48-ca70-5b10-9c19-a33bd65485a0", "parentControlId": 30945, "controlId": "SC-43", "title": "SC-43", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582026" }, { "id": 552377, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582026", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09c5c485-22c8-50db-9c5e-e5bd4768c34c", "parentControlId": 30945, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582026" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "f1af5285-091e-505d-ad9d-b02c44f00b49", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "50b0e3cc-479c-53c3-87e6-dba0da585a68", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "f2bc696e-3ec7-58ca-950f-f58fb8613294", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "c3ce490e-f0e9-584e-b3c6-2ed10e2800f3", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "9cc4e355-0783-5d5c-b35c-fdae05f8032c", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "3939438c-61be-50c5-9d97-d94b9150819d", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "ecc11e7e-fbf3-5090-a737-615f62b18c2e", "isPublic": true } ], "id": 30945, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730906", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730906", "catalogueId": 1062, "uuid": "8e87f818-2e31-5eb7-a5ae-005963ebccd0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization monitor and enforce usage parameters that limit the potential damage caused from the unauthorized or unintentional alteration of system parameters?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Usage Parameters", "description": "

Control Description

Mechanisms exist to monitor and enforce usage parameters that limit the potential damage caused from the unauthorized or unintentional alteration of system parameters.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to monitor and enforce usage parameters that limit the potential damage caused from the unauthorized or unintentional alteration of system parameters.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "AST-14", "family": "Asset Management", "enhancements": "", "sortId": "AST-14", "references": "

Micro-Small Business (<10 staff)

∙ Centralized log collector\n∙ Manual event log reviews

Small Business (10-49 staff)

∙ Centralized log collector\n∙ Manual event log reviews\n∙ Security Incident Event Manager (SIEM)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69638, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589968", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589969", "securityControlId": 30948, "ccis": [], "uuid": "99228f9d-9e78-5658-8700-6acf49ec67ea", "testId": "AST-15_A01", "test": "a tamper protection program is implemented for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-09", "defaultText": null }, { "id": 69639, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589969", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589969", "securityControlId": 30948, "ccis": [], "uuid": "0ae7e2cc-00e9-51df-9ba5-70dfa00fd303", "testId": "AST-15_A02", "test": "anti-tamper technologies, tools and techniques are employed throughout the system development life cycle.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-09(01)", "defaultText": null } ], "externalMappings": [ { "id": 552401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a95ba57-cd0d-5a50-a88f-43d9ab72aaba", "parentControlId": 30948, "controlId": "7.9", "title": "7.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582029" }, { "id": 552404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37d75192-7d05-57c8-aa0f-db5253e1ad0a", "parentControlId": 30948, "controlId": "SA-18", "title": "SA-18", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58203" }, { "id": 552405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f969dfd-b0c4-5058-a063-1e49dfd085fe", "parentControlId": 30948, "controlId": "SR-09", "title": "SR-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58203" }, { "id": 552406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6782b08-ca25-5602-babc-beec16863598", "parentControlId": 30948, "controlId": "SR-09(01)", "title": "SR-09(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58203" }, { "id": 552407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23b2e0c3-00f3-57e0-a609-33c109dad634", "parentControlId": 30948, "controlId": "SR-09", "title": "SR-09", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58203" }, { "id": 552408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0064c889-f5a5-5447-9115-ddcfdee26ef5", "parentControlId": 30948, "controlId": "SR-09(01)", "title": "SR-09(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58203" }, { "id": 552409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4004498c-34ff-5168-958e-b4653778168d", "parentControlId": 30948, "controlId": "SR-09", "title": "SR-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58203" }, { "id": 552410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc24c9b5-c3a7-57e0-946f-6eee7cfec2ec", "parentControlId": 30948, "controlId": "SR-09(01)", "title": "SR-09(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58203" }, { "id": 552411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ff426d5-10a0-5f7f-99d8-d64836729cee", "parentControlId": 30948, "controlId": "SR-09", "title": "SR-09", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58203" }, { "id": 552412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0f04d32-b158-5bc1-8766-4b5089151c6e", "parentControlId": 30948, "controlId": "SR-09(01)", "title": "SR-09(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58203" }, { "id": 552415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7ac85e4-1449-5039-9518-f8c8850a9329", "parentControlId": 30948, "controlId": "SR-9", "title": "SR-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582031" }, { "id": 552418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de931769-0e54-597c-9ec6-99c19a8a119b", "parentControlId": 30948, "controlId": "ID.RA-09", "title": "ID.RA-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582031" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "db3eb5c9-c11f-5bc9-a448-a916c78d680b", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "be4d854d-9ae4-57f8-9bfc-89df64f3952f", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "19b80a32-197f-554e-9998-067bc3d156b1", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "732cee6e-e1d4-5910-878a-76e925e62b5d", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "a57c21f1-1cee-5ede-b263-0f605e908811", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "2f46aaf8-221f-5080-9dbd-34da38ad703c", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "58365095-1b74-53e4-ba2c-c8da4b75ba98", "isPublic": true } ], "id": 30948, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730907", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730907", "catalogueId": 1062, "uuid": "27421a22-5d9b-5c80-b2d2-43691ec0b7b6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization assess the integrity of critical Technology Assets, Applications and/or Services (TAAS) to detect evidence of tampering, where:\n(1)\tLogical assessments evaluate the integrity of critical components (e.g., configuration settings); and\n(2)\tPhysical assessments evaluate assets for evidence of unauthorized access and/or modifications?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Logical Tampering Protection", "description": "

Control Description

Mechanisms exist to assess the integrity of critical Technology Assets, Applications and/or Services (TAAS) to detect evidence of tampering, where:\n(1)\tLogical assessments evaluate the integrity of critical components (e.g., configuration settings); and\n(2)\tPhysical assessments evaluate assets for evidence of unauthorized access and/or modifications.

Evidence Request List (ERL)

E-AST-25

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Asset Management (AST) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with AST domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Asset management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Asset management is informally assigned as an additional duty to existing IT/cybersecurity personnel.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).\n▪ Periodic physical inspections are performed to validate the integrity of unattended technology assets (e.g., kiosks, ATMs, point of sale devices, etc.).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to assess the integrity of critical Technology Assets, Applications and/or Services (TAAS) to detect evidence of tampering, where:\n(1)\tLogical assessments evaluate the integrity of critical components (e.g., configuration settings); and\n(2)\tPhysical assessments evaluate assets for evidence of unauthorized access and/or modifications.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "AST-15", "family": "Asset Management", "enhancements": "", "sortId": "AST-15", "references": "

Micro-Small Business (<10 staff)

∙ Indicators of Compromise (IoC)\n∙ File Integrity Monitoring (FIM)

Small Business (10-49 staff)

∙ Indicators of Compromise (IoC)\n∙ File Integrity Monitoring (FIM)

Medium Business (50-249 staff)

∙ Indicators of Compromise (IoC)\n∙ File Integrity Monitoring (FIM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)\n∙ Tripwire Enterprise (https://tripwire.com)

Large Business (250-999 staff)

∙ Indicators of Compromise (IoC)\n∙ File Integrity Monitoring (FIM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)\n∙ Tripwire Enterprise (https://tripwire.com)

Enterprise (>1,000 staff)

∙ Indicators of Compromise (IoC)\n∙ File Integrity Monitoring (FIM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)\n∙ Tripwire Enterprise (https://tripwire.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69640, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589969", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589969", "securityControlId": 30949, "ccis": [], "uuid": "57ef1e4f-a7e1-531b-8cfa-f35ac4d7bfa9", "testId": "AST-15.1_A01", "test": "systems or system components that require inspection are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-10_ODP[01]", "defaultText": null }, { "id": 69641, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589969", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589969", "securityControlId": 30949, "ccis": [], "uuid": "867199d1-08a8-51fd-9ade-1f4f14344812", "testId": "AST-15.1_A02", "test": "the frequency at which to inspect systems or system components is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_SR-10_ODP[02]\n53A_R5_SR-10_ODP[03]", "defaultText": null }, { "id": 69642, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589969", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589969", "securityControlId": 30949, "ccis": [], "uuid": "5026aa9e-7d6b-53e1-ab06-2a1a4f4ae9e7", "testId": "AST-15.1_A03", "test": "indications of the need for an inspection of systems or system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-10_ODP[04]", "defaultText": null }, { "id": 69643, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58997", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58997", "securityControlId": 30949, "ccis": [], "uuid": "ef545608-654e-5d79-83c9-2793a9bcb7c4", "testId": "AST-15.1_A04", "test": "systems or system components are inspected to detect tampering.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-10", "defaultText": null } ], "externalMappings": [ { "id": 552431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582033", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae8804d6-3eb0-5a8c-8be5-c708cc67c711", "parentControlId": 30949, "controlId": "SA-18(2)", "title": "SA-18(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582033" }, { "id": 552432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582033", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f53fba08-3a60-5d8a-a9c5-3031ef86349a", "parentControlId": 30949, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582033" }, { "id": 552434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582033", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66e6fdbb-d1b1-5989-b64a-61a7b71a19ac", "parentControlId": 30949, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582033" }, { "id": 552435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582033", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c29cb2a6-f4e9-54c4-aff6-e8eb0bf34080", "parentControlId": 30949, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582033" }, { "id": 552436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582033", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8e319aa-ccf5-5827-8994-826f10a510e7", "parentControlId": 30949, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582033" }, { "id": 552437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582033", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7625d24e-3834-5081-bc22-7cfc4628860f", "parentControlId": 30949, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582033" }, { "id": 552438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582033", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49422332-f3a8-5974-9b32-839966858b17", "parentControlId": 30949, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582034" }, { "id": 552440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f044fda2-2d18-59c6-a287-605a0f736e8b", "parentControlId": 30949, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582034" }, { "id": 552441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f25ee1cc-61ea-55ab-ba38-eb17dfe71486", "parentControlId": 30949, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582034" }, { "id": 552442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a19ab366-952c-51d0-b2f4-2cb7e51c3149", "parentControlId": 30949, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582034" } ], "id": 30949, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730907", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730907", "catalogueId": 1062, "uuid": "064c7b35-8049-5b1c-98a3-b5d395bea407", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization physically and logically inspect critical technology assets to detect evidence of tampering?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Technology Asset Inspections", "description": "

Control Description

Mechanisms exist to physically and logically inspect critical technology assets to detect evidence of tampering.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Asset Management (AST) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with AST domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Asset management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Asset management is informally assigned as an additional duty to existing IT/cybersecurity personnel.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).\n▪ Periodic physical inspections are performed to validate the integrity of unattended technology assets (e.g., kiosks, ATMs, point of sale devices, etc.).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to physically and logically inspect critical technology assets to detect evidence of tampering.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "AST-15.1", "family": "Asset Management", "enhancements": "", "sortId": "AST-15.1", "references": "

Micro-Small Business (<10 staff)

∙ Tamper detection tape\n∙ Indicators of Compromise (IoC)\n∙ File Integrity Monitoring (FIM)

Small Business (10-49 staff)

∙ Tamper detection tape\n∙ Indicators of Compromise (IoC)\n∙ File Integrity Monitoring (FIM)

Medium Business (50-249 staff)

∙ Tamper detection tape\n∙ Indicators of Compromise (IoC)\n∙ File Integrity Monitoring (FIM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)\n∙ Tripwire Enterprise (https://tripwire.com)

Large Business (250-999 staff)

∙ Tamper detection tape\n∙ Indicators of Compromise (IoC)\n∙ File Integrity Monitoring (FIM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)\n∙ Tripwire Enterprise (https://tripwire.com)

Enterprise (>1,000 staff)

∙ Tamper detection tape\n∙ Indicators of Compromise (IoC)\n∙ File Integrity Monitoring (FIM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)\n∙ Tripwire Enterprise (https://tripwire.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69644, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58997", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58997", "securityControlId": 30950, "ccis": [], "uuid": "cd7f0389-9bd0-5cbe-ad7a-cf4a429af40d", "testId": "AST-16_A01", "test": "a Bring Your Own Device (BYOD) program is implemented and governed to reduce risk associated with personally-owned devices in the workplace.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 552468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20062d73-470e-5470-a6ca-53194643f3db", "parentControlId": 30950, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582037" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d7dd7db3-6316-53ae-877e-0998d66cddce", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "8a22300e-0844-530b-846b-478975d68126", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "1f58b7d7-47c1-5d64-86bc-ffc4976256de", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "965d6d8b-439b-54bf-9aa0-daa3e3fe1c60", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "356774af-56ad-5c21-bbf3-eabca63a8150", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "b56b886d-e7bf-50dd-baba-ce7ce0f2770a", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "54c65b1d-dbf7-5ad7-80c5-08fd93e40b68", "isPublic": true } ], "id": 30950, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730907", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730907", "catalogueId": 1062, "uuid": "75961c36-ba04-500d-b2be-f5847332a7e2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement and govern a Bring Your Own Device (BYOD) program to reduce risk associated with personally-owned devices in the workplace?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Bring Your Own Device (BYOD) Usage", "description": "

Control Description

Mechanisms exist to implement and govern a Bring Your Own Device (BYOD) program to reduce risk associated with personally-owned devices in the workplace.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).\n▪ The use of personal devices (e.g., Bring Your Own Device (BYOD), as part of acceptable and unacceptable behaviors are primarily administrative and preventative in nature.

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement and govern a Bring Your Own Device (BYOD) program to reduce risk associated with personally-owned devices in the workplace.

Level 4 - Quantitatively Controlled: Asset Management (AST) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-16", "family": "Asset Management", "enhancements": "", "sortId": "AST-16", "references": "

Micro-Small Business (<10 staff)

∙ Rules of Behavior (RoB) / Acceptable Use\n∙ Mobile Device Management (MDM) solution (e.g., Microsoft Intune with M365 Business Premium)

Small Business (10-49 staff)

∙ Rules of Behavior (RoB) / Acceptable Use\n∙ Mobile Device Management (MDM) solution (e.g., Microsoft Intune, Jamf Now)\n∙ BYOD-specific security policy with enrollment requirements

Medium Business (50-249 staff)

∙ Rules of Behavior (RoB) / Acceptable Use\n∙ Mobile Device Management (MDM) solution (e.g., Microsoft Intune, Jamf, Mosyle)\n∙ Containerization / MAM (Mobile Application Management) for BYOD data separation

Large Business (250-999 staff)

∙ Rules of Behavior (RoB) / Acceptable Use\n∙ Enterprise MDM solution (e.g., Microsoft Intune, VMware Workspace ONE)\n∙ Mobile Application Management (MAM) with corporate data containerization\n∙ Conditional access policies for BYOD (e.g., Microsoft Entra Conditional Access)

Enterprise (>1,000 staff)

∙ Enterprise MDM/MAM solution (e.g., VMware Workspace ONE, Microsoft Intune, MobileIron)\n∙ Conditional Access policies enforcing compliance posture\n∙ BYOD security policy with attestation and enrollment controls\n∙ DLP policies applied to corporate data on personal devices", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69645, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58997", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58997", "securityControlId": 30951, "ccis": [], "uuid": "ab7993ed-2f8b-5b0f-a8c2-9575914c709b", "testId": "AST-17_A01", "test": "Supply Chain Risk Management (SCRM) practices require the removal and prohibition of certain technology services and/or equipment that are designated as supply chain threats by a statutory or regulatory body.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 552540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ff6efaf-f73a-5f0d-ad00-3c32cd1cbadf", "parentControlId": 30951, "controlId": "03.11.01.a", "title": "03.11.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582046" }, { "id": 552541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d1dbd81-25a7-53c0-8945-b967a0366293", "parentControlId": 30951, "controlId": "03.16.01", "title": "03.16.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582047" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "bdf9b609-89f3-5523-9f04-ee5cef48ab7d", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "b9e0025e-2e98-5aba-8da2-14c8d59d69c6", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "f25ef5d5-55ae-523d-9d64-43b1146f235e", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "352f610f-ebdb-56a6-9e4a-c838c4129e0f", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "b486106f-ce48-5ef7-8b8b-873dedd4001c", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "1e29199c-35f8-5c62-88d4-39fba7228a0d", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "c9cbbc2b-82df-5665-886d-9022b6275536", "isPublic": true } ], "id": 30951, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730908", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730908", "catalogueId": 1062, "uuid": "0f83a6da-382c-5013-ac5c-6c7d68548a7b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization govern Supply Chain Risk Management (SCRM) sanctions that require the removal and prohibition of certain Technology Assets, Applications and/or Services (TAAS) that are designated as supply chain threats by a statutory or regulatory body?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Prohibited Equipment & Services", "description": "

Control Description

Mechanisms exist to govern Supply Chain Risk Management (SCRM) sanctions that require the removal and prohibition of certain Technology Assets, Applications and/or Services (TAAS) that are designated as supply chain threats by a statutory or regulatory body.

Evidence Request List (ERL)

E-AST-10

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to govern Supply Chain Risk Management (SCRM) sanctions that require the removal and prohibition of certain Technology Assets, Applications and/or Services (TAAS) that are designated as supply chain threats by a statutory or regulatory body.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-17", "family": "Asset Management", "enhancements": "", "sortId": "AST-17", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69646, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589971", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589971", "securityControlId": 30952, "ccis": [], "uuid": "060481b1-08de-5741-84bd-3294477b55ce", "testId": "AST-18_A01", "test": "security-critical or essential software is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.1e_ODP[1]", "defaultText": null }, { "id": 69647, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589971", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589971", "securityControlId": 30952, "ccis": [], "uuid": "816bf2c7-44ef-583b-a4c7-04d099a87c11", "testId": "AST-18_A02", "test": "root of trust mechanisms or cryptographic signatures are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.1e[a]", "defaultText": null }, { "id": 69648, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589971", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589971", "securityControlId": 30952, "ccis": [], "uuid": "f3cc4cd4-4076-5e00-8ac6-92ef339e5af9", "testId": "AST-18_A03", "test": "the integrity of security critical or essential software is verified using root of trust mechanisms or cryptographic signatures.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.1e[b]", "defaultText": null } ], "externalMappings": [ { "id": 552548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e34db1d-42e0-5071-acd9-87b09c42cbd8", "parentControlId": 30952, "controlId": "EDR 3.12", "title": "EDR 3.12", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582047" }, { "id": 552549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb3f0cd1-2ffe-5390-bffa-897624059ca4", "parentControlId": 30952, "controlId": "EDR 3.13(a)", "title": "EDR 3.13(a)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582048" }, { "id": 552550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0fc9b02-2849-563b-94ba-2bf7c02ef7a4", "parentControlId": 30952, "controlId": "EDR 3.13(b)", "title": "EDR 3.13(b)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582048" }, { "id": 552551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a6f048e-936f-5210-ac1e-33e12b7e4d34", "parentControlId": 30952, "controlId": "HDR 3.12", "title": "HDR 3.12", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582048" }, { "id": 552552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5cd6184-c2b6-5250-b68d-1b32549efdce", "parentControlId": 30952, "controlId": "HDR 3.13(a)", "title": "HDR 3.13(a)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582048" }, { "id": 552553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "366d0c97-3b8f-50e7-8a29-0515cfd395ec", "parentControlId": 30952, "controlId": "NDR 3.12", "title": "NDR 3.12", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582048" }, { "id": 552554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c96b1cf-5f31-5256-9030-1c5c4f1b490c", "parentControlId": 30952, "controlId": "NDR 3.13(a)", "title": "NDR 3.13(a)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582048" }, { "id": 552555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0381c13-bc4c-506c-8be4-89a2b5c59ec3", "parentControlId": 30952, "controlId": "NDR 3.13(b)", "title": "NDR 3.13(b)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582048" }, { "id": 552557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cfaf9fa1-defb-5dfc-bf74-673f47e3d020", "parentControlId": 30952, "controlId": "ID.RA-09", "title": "ID.RA-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582048" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "1e72367a-cd5a-58c4-882a-d68011b32aba", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "2868bef7-0373-5907-89cc-6a82effe6de0", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "55225f00-21e7-5800-93e5-640349948738", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "1c9db1ee-14a1-5d4d-8bde-b1cf2dd40b81", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "9448ee2a-61d3-58f3-8fd5-23b006f1c284", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "4d927392-ab87-57ad-974c-f64634c01e7e", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "e3ff88ce-d004-5ea3-a781-c56748607e3b", "isPublic": true } ], "id": 30952, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730908", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730908", "catalogueId": 1062, "uuid": "4f8962e0-5cdb-5fc1-850a-375c79c65f12", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provision and protect the confidentiality, integrity and authenticity of product supplier keys and data that can be used as a “roots of trust” basis for integrity verification?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Roots of Trust Protection", "description": "

Control Description

Mechanisms exist to provision and protect the confidentiality, integrity and authenticity of product supplier keys and data that can be used as a “roots of trust” basis for integrity verification.

Evidence Request List (ERL)

E-AST-26

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provision and protect the confidentiality, integrity and authenticity of product supplier keys and data that can be used as a “roots of trust” basis for integrity verification.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-18", "family": "Asset Management", "enhancements": "", "sortId": "AST-18", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69655, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589973", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589973", "securityControlId": 30958, "ccis": [], "uuid": "5313f5c2-b755-5e50-b041-f1a0379f2ed4", "testId": "AST-24_A01", "test": "the organization maintains a pool of temporary, loaner or \"travel-only\" end user technology (e.g., laptops and mobile devices).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69656, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589973", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589973", "securityControlId": 30958, "ccis": [], "uuid": "eb391e94-2bb0-5785-aeb2-81de5a2127c8", "testId": "AST-24_A02", "test": "personnel travelling overseas request and are issued a temporary, loaner or \"travel-only\" end user technology (e.g., laptops and mobile devices) when travelling to authoritarian countries with a higher-than average risk for Intellectual Property (IP) theft or espionage against individuals and private companies.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69657, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589973", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589973", "securityControlId": 30958, "ccis": [], "uuid": "b0e39c7f-7c03-5566-9445-4af6653631ec", "testId": "AST-24_A03", "test": "systems or system components with organization-defined configurations are issued to individuals traveling to high-risk locations.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 69658, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589973", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589973", "securityControlId": 30958, "ccis": [], "uuid": "18858eb2-170c-5b84-a241-15b8091e2aaa", "testId": "AST-24_A04", "test": "systems or system components with the following configurations are issued to individuals traveling to high-risk locations: .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: a configuration that has no CUI or FCI stored on the system and prevents the processing, storing, and transmission of CUI and FCI, unless a specific exception is granted in writing by the Contracting Officer", "otherId": "171A_R3_A.03.04.12.a", "defaultText": null } ], "externalMappings": [ { "id": 552660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8e57f2f-08c1-5d28-bb0d-df5546054440", "parentControlId": 30958, "controlId": "03.04.12.a", "title": "03.04.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582061" }, { "id": 552661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6dc93c81-7b1e-54e4-aeee-2d5a1dd1aac8", "parentControlId": 30958, "controlId": "03.04.12.b", "title": "03.04.12.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582061" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "ac4f1389-7688-5639-bb9f-6669d54d986e", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "54e92b26-7d4c-571a-8406-c55d1f70001e", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "9aabfbea-8676-5a53-8aa8-5dcfe362ea2c", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "446bdf91-200d-5887-973f-c9540a11cd1f", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "af1d73c8-aa10-5b94-9e09-974f143c78f1", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "c27aa410-8705-5494-bf97-86ea0222a3c4", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "17964f93-58d0-5c07-be60-06c1f8ced895", "isPublic": true } ], "id": 30958, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73091", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73091", "catalogueId": 1062, "uuid": "ac8e0f35-9c45-57dc-b031-84068c526acd", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization issue personnel travelling overseas with temporary, loaner or \"travel-only\" end user technology (e.g., laptops and mobile devices) when travelling to authoritarian countries with a higher-than average risk for Intellectual Property (IP) theft or espionage against individuals and private companies?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Travel-Only Devices", "description": "

Control Description

Mechanisms exist to issue personnel travelling overseas with temporary, loaner or \"travel-only\" end user technology (e.g., laptops and mobile devices) when travelling to authoritarian countries with a higher-than average risk for Intellectual Property (IP) theft or espionage against individuals and private companies.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to issue personnel travelling overseas with temporary, loaner or \"travel-only\" end user technology (e.g., laptops and mobile devices) when travelling to authoritarian countries with a higher-than average risk for Intellectual Property (IP) theft or espionage against individuals and private companies.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-24", "family": "Asset Management", "enhancements": "", "sortId": "AST-24", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program\n∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program\n∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program\n∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program\n∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program\n∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69659, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589974", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589974", "securityControlId": 30959, "ccis": [], "uuid": "77459bb1-8379-567a-85b5-7b73c1e78186", "testId": "AST-25_A01", "test": "upon return from travel to authoritarian counties, the issued temporary, loaner or \"travel-only\" end user technology (e.g., laptops and mobile devices) is wiped / re-imaged before being re-issued.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69660, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589974", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589974", "securityControlId": 30959, "ccis": [], "uuid": "c4964e05-bd49-5968-9822-815d2f3aa0bd", "testId": "AST-25_A02", "test": "organization-defined security requirements are applied to the system or system components when the individuals return from travel.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 69661, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589974", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589974", "securityControlId": 30959, "ccis": [], "uuid": "e4f8c1ef-9b18-55e6-b088-8839117bdb8d", "testId": "AST-25_A03", "test": "the following security requirements are applied to the system or system components when the individuals return from travel: .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: examine the system for signs of physical tampering and take the appropriate actions, and then either purge and reimage all storage media or destroy the system", "otherId": "171A_R3_A.03.04.12.b", "defaultText": null } ], "externalMappings": [ { "id": 552672, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba895876-d61a-56ed-853a-58b2d0b3c86d", "parentControlId": 30959, "controlId": "03.04.12.b", "title": "03.04.12.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582062" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "158a9cea-7ade-5a96-a731-f4912ba76d32", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "8da105ef-8932-597d-8234-c7b41f127367", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "5d1a701c-c555-51e3-8741-471328b7875c", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "da4fb278-90b0-50ae-86c8-5f51428fe2bc", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "a8fd5bdd-83cd-5191-a3b7-ce048f2aec14", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "6c55811c-fcff-5bbe-9484-a7c89b940414", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "65a34fe7-a033-5b2b-b014-86c39c741dd3", "isPublic": true } ], "id": 30959, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730911", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730911", "catalogueId": 1062, "uuid": "840d3524-270b-5650-a309-8ca24d10eff4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization re-image end user technology (e.g., laptops and mobile devices) when returning from overseas travel to an authoritarian country with a higher-than average risk for Intellectual Property (IP) theft or espionage against individuals and private companies?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Re-Imaging Devices After Travel", "description": "

Control Description

Mechanisms exist to re-image end user technology (e.g., laptops and mobile devices) when returning from overseas travel to an authoritarian country with a higher-than average risk for Intellectual Property (IP) theft or espionage against individuals and private companies.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to re-image end user technology (e.g., laptops and mobile devices) when returning from overseas travel to an authoritarian country with a higher-than average risk for Intellectual Property (IP) theft or espionage against individuals and private companies.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-25", "family": "Asset Management", "enhancements": "", "sortId": "AST-25", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69663, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589975", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589975", "securityControlId": 30961, "ccis": [], "uuid": "e5ee5562-9c16-56dd-95fc-4f2eb804fff7", "testId": "AST-27_A01", "test": "a \"jump box\" or \"jump server\" is established in secure enclaves that are in a separate network zone to user workstations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69664, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589975", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589975", "securityControlId": 30961, "ccis": [], "uuid": "ede36205-adbf-5259-84b0-40f7090ed197", "testId": "AST-27_A02", "test": "non-console system administrative functions are restricted to connect to secure enclaves via a \"jump box\" or \"jump server\" that is located in a separate network zone to user workstations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 552689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ceb5cf40-74e4-5274-8f91-9bcbc59114ed", "parentControlId": 30961, "controlId": "03.01.12.a", "title": "03.01.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582064" }, { "id": 552690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c107ad0-ed02-5c38-86d3-e727473cb7c6", "parentControlId": 30961, "controlId": "03.01.12.c", "title": "03.01.12.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582064" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "aff8694d-0c8b-59b6-9167-a6005014a33e", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "1e7928be-8c5e-5683-9957-1d1c194ec000", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "5b403db6-0d3a-515c-a2ad-7c581bb94ef6", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "485fdfd2-76bd-50ea-a2af-dfd421c01cfa", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "4bd2c788-f28e-59a3-821a-3dd044ff4f85", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "4b67a4f4-1354-5edf-aab9-8cf687e95ac3", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "e9831575-8f97-5bed-8944-628f3119943f", "isPublic": true } ], "id": 30961, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730911", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730911", "catalogueId": 1062, "uuid": "65e153f8-08d8-5657-b5fe-f5d76fb4cac3", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct remote system administrative functions via a \"jump box\" or \"jump server\" that is located in a separate network zone to user workstations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Jump Server", "description": "

Control Description

Mechanisms exist to conduct remote system administrative functions via a \"jump box\" or \"jump server\" that is located in a separate network zone to user workstations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conduct remote system administrative functions via a \"jump box\" or \"jump server\" that is located in a separate network zone to user workstations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-27", "family": "Asset Management", "enhancements": "", "sortId": "AST-27", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program\n∙ Secure Baseline Configurations (SBC)\n∙ Network segmentation

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program\n∙ Secure Baseline Configurations (SBC)\n∙ Network segmentation

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program\n∙ Secure Baseline Configurations (SBC)\n∙ Network segmentation

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program\n∙ Secure Baseline Configurations (SBC)\n∙ Network segmentation

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program\n∙ Secure Baseline Configurations (SBC)\n∙ Network segmentation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69671, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589977", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589977", "securityControlId": 30966, "ccis": [], "uuid": "a3a2e58b-b5c5-5a3a-b764-8931c76e5517", "testId": "AST-30_A01", "test": "systems, applications and services are properly decommissioned so that data is properly transitioned to new systems or archived in accordance with applicable organizational standards, as well as statutory, regulatory and contractual obligations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 552800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69ce4091-9bb7-526b-b052-afe435bbb39f", "parentControlId": 30966, "controlId": "CIP-011-3 2.2", "title": "CIP-011-3 2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582085" }, { "id": 552801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b673bae-83fe-51a4-8657-f5643723e7ae", "parentControlId": 30966, "controlId": "11-3.a(5)(a)", "title": "11-3.a(5)(a)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582085" }, { "id": 552802, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0cc26f2a-fcba-5bce-ae22-b79a750e1c2e", "parentControlId": 30966, "controlId": "11-3.a(5)(b)", "title": "11-3.a(5)(b)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582085" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "dad84fff-6e47-5a8d-b79c-2cc901076e69", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "72c4d2e4-aa6e-5641-8623-afe66764f121", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "94d941c8-3545-55cb-bada-5993b54f00c1", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "fbd7d45c-8853-5626-b57d-2f299fe1af05", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "2ccb17f5-c375-55a1-b957-eef54de5aa3f", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "20b03e27-b976-5646-bad7-b0f33e2226c3", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "ba5b29df-d9f2-56b5-a46c-46ae6a3d240a", "isPublic": true } ], "id": 30966, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730913", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730913", "catalogueId": 1062, "uuid": "66eecb1b-729d-55ea-b3d0-96e2759bed11", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure Technology Assets, Applications and/or Services (TAAS) are properly decommissioned so that data is properly transitioned to new systems or archived in accordance with applicable organizational standards, as well as statutory, regulatory and contractual obligations?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 4.0, "title": "Decommissioning", "description": "

Control Description

Mechanisms exist to ensure Technology Assets, Applications and/or Services (TAAS) are properly decommissioned so that data is properly transitioned to new systems or archived in accordance with applicable organizational standards, as well as statutory, regulatory and contractual obligations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).\n▪ IT personnel collect technology assets and media for destruction when it is no longer needed for business or legal reasons.\n▪ Asset decommissioning consists of mainly wiping hard drives.

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure Technology Assets, Applications and/or Services (TAAS) are properly decommissioned so that data is properly transitioned to new systems or archived in accordance with applicable organizational standards, as well as statutory, regulatory and contractual obligations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-30", "family": "Asset Management", "enhancements": "", "sortId": "AST-30", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69672, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589977", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589977", "securityControlId": 30967, "ccis": [], "uuid": "2b1e4347-84eb-54b9-82f5-512cb25fa9f5", "testId": "AST-31_A01", "test": "the organization utilizes a defined methodology to categorize its technology assets based on data sensitivity and criticality.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 552820, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97cddfaf-058c-5819-b8fc-af19b4d3904e", "parentControlId": 30967, "controlId": "03.01.03", "title": "03.01.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582088" }, { "id": 552824, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fa8001b-40cc-5caf-9d4c-14a6f9dda025", "parentControlId": 30967, "controlId": "ASSET-2c", "title": "ASSET-2c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582088" }, { "id": 552825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dba6143a-d39f-5ed0-8c3d-d01cd157e0f9", "parentControlId": 30967, "controlId": "ASSET-2d", "title": "ASSET-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582088" }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets (Safety/Security)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "757f90e5-569d-5df8-bc6e-0813e2d4d750", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C System & Asset Inventory and Security Degree Assignment (S1-S3)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "21ef023f-1f6c-5be9-b86f-6a32c14c2eb9", "isPublic": true }, { "controlId": "IEC-63096-8.1", "title": "IEC-63096-8.1 — Responsibility for Nuclear Digital Assets (CDAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "775e279e-8488-5f2f-952c-754e2515376a", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3", "title": "IEEE-7-4.3.2-5.3 — Software & Digital Device Identification and Quality Qualification", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "b2c7db10-6e99-5adf-80db-7d62a2a49f19", "isPublic": true }, { "controlId": "10-CFR-73.100(c)", "title": "10-CFR-73.100(c) — Consequence-Based Critical Digital Asset Analysis for SMRs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "72fe4345-4914-590d-8fd2-a37d69825681", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec4", "title": "REGDOC-2.12.1-Sec4 — Identification and Classification of Cyber Essential Assets (CEAs)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "d240eed7-f5e4-5e7d-9052-b3fb4aeeaefe", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ASSET", "title": "ONR-SyAP-FSyP7-ASSET — Identification & Categorization of Vital Digital Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (AST Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "42c5f3b6-b305-5c66-bd36-07694bf74ed8", "isPublic": true } ], "id": 30967, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730913", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730913", "catalogueId": 1062, "uuid": "aa7cbf8f-e0f9-5c10-ab24-6eb5e1705aa8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization categorize Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Asset Categorization", "description": "

Control Description

Mechanisms exist to categorize Technology Assets, Applications and/or Services (TAAS).

Evidence Request List (ERL)

E-AST-24

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers).

Level 3 - Well Defined: Asset Management (AST) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are well-documented and kept current by process owners.\n▪ An IT Asset Management (ITAM) team, or similar function, is appropriately staffed and supported to implement and maintain AST domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of ITAM operations (e.g., ITAM platform, (e.g., Configuration Management Database (CMBD) Asset Management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to categorize Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "AST-31", "family": "Asset Management", "enhancements": "", "sortId": "AST-31", "references": "

Micro-Small Business (<10 staff)

∙ Data classification scheme\n∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Small Business (10-49 staff)

∙ Data classification scheme\n∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Medium Business (50-249 staff)

∙ Data classification scheme\n∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Large Business (250-999 staff)

∙ Data classification scheme\n∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)

Enterprise (>1,000 staff)

∙ Data classification scheme\n∙ IT Asset Management (ITAM) program\n∙ Configuration Management Database (CMDB)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69681, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589979", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589979", "securityControlId": 30972, "ccis": [], "uuid": "30a70c51-ef7b-596b-907f-cbac7694aae1", "testId": "BCD-01_A01", "test": "cybersecurity issues are addressed in the development of a critical infrastructure and key resources protection plan.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PM-08[01]", "defaultText": null }, { "id": 69682, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589979", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589979", "securityControlId": 30972, "ccis": [], "uuid": "05ca1720-cd5d-589d-bda7-a4001b9ed47d", "testId": "BCD-01_A02", "test": "privacy issues are addressed in the development of a critical infrastructure and key resources protection plan.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PM-08[04]", "defaultText": null }, { "id": 69683, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589979", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589979", "securityControlId": 30972, "ccis": [], "uuid": "99fd4727-48a3-537a-a54c-b2f9fa00dd33", "testId": "BCD-01_A03", "test": "cybersecurity issues are addressed in the documentation of a critical infrastructure and key resources protection plan.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-08[02]", "defaultText": null }, { "id": 69684, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58998", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58998", "securityControlId": 30972, "ccis": [], "uuid": "370f8d1b-493a-530b-afa2-e51527ac0033", "testId": "BCD-01_A04", "test": "privacy issues are addressed in the documentation of a critical infrastructure and key resources protection plan.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-08[05]", "defaultText": null }, { "id": 69685, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58998", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58998", "securityControlId": 30972, "ccis": [], "uuid": "4a98621a-9ae4-5fd6-a1a5-b280091b870e", "testId": "BCD-01_A05", "test": "cybersecurity issues are addressed in the update of a critical infrastructure and key resources protection plan.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-08[03]", "defaultText": null }, { "id": 69686, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.58998", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.58998", "securityControlId": 30972, "ccis": [], "uuid": "3d6a217f-0667-5ada-be23-cfce0ac960b5", "testId": "BCD-01_A06", "test": "privacy issues are addressed in the update of a critical infrastructure and key resources protection plan.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-08[06]", "defaultText": null }, { "id": 69687, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589992", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589992", "securityControlId": 30972, "ccis": [], "uuid": "4bc42956-b4a7-58eb-a183-cae5a342f3bd", "testId": "BCD-01_A07", "test": "Business Continuity & Disaster Recovery (BC/DR) operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69688, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589992", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589992", "securityControlId": 30972, "ccis": [], "uuid": "f6589925-40df-5771-aab4-3fc6c655cb9d", "testId": "BCD-01_A08", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support Business Continuity & Disaster Recovery (BC/DR) operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69689, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589992", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589992", "securityControlId": 30972, "ccis": [], "uuid": "7b78c24f-af23-5752-80e3-73c4308d90ab", "testId": "BCD-01_A09", "test": "responsibility and authority for the performance of Business Continuity & Disaster Recovery (BC/DR)-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69690, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589992", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589992", "securityControlId": 30972, "ccis": [], "uuid": "38299b1b-6324-5480-8ff1-9d70d06b719b", "testId": "BCD-01_A10", "test": "personnel performing Business Continuity & Disaster Recovery (BC/DR)-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 552891, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5084472e-3d78-57ca-9950-032260572553", "parentControlId": 30972, "controlId": "AVAIL 1.1", "title": "AVAIL 1.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582096" }, { "id": 552892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54d27162-8ed4-5a53-b989-9cb3bc805534", "parentControlId": 30972, "controlId": "CR 2.10(a)", "title": "CR 2.10(a)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582096" }, { "id": 552979, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582106", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "389f5f22-e252-5c30-b60c-aa5bf01c4256", "parentControlId": 30972, "controlId": "5.29", "title": "5.29", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582106" }, { "id": 552980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582106", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "688b7ec7-151c-50ae-8061-91bcf4780935", "parentControlId": 30972, "controlId": "5.3", "title": "5.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582106" }, { "id": 552986, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4da0ed8d-cf58-581d-a622-8640b36f15a4", "parentControlId": 30972, "controlId": "T1485", "title": "T1485", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582107" }, { "id": 552987, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98e168f7-558d-5199-9083-c45065565853", "parentControlId": 30972, "controlId": "T1486", "title": "T1486", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582107" }, { "id": 552988, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2a78301-2f0d-5949-8adf-f58b31d69622", "parentControlId": 30972, "controlId": "T1490", "title": "T1490", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582107" }, { "id": 552989, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53094e72-d32a-575c-ad67-05bb2d87c5ef", "parentControlId": 30972, "controlId": "T1491", "title": "T1491", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582107" }, { "id": 552990, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19253cde-a7c8-5698-afd8-042c90782590", "parentControlId": 30972, "controlId": "T1491.001", "title": "T1491.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582107" }, { "id": 552991, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8670f1f5-46e6-5673-a4e9-2b207cd4edc7", "parentControlId": 30972, "controlId": "T1491.002", "title": "T1491.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582107" }, { "id": 552992, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582108", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36aeac2c-213a-5fd7-b8a7-7f02489cac5b", "parentControlId": 30972, "controlId": "T1561", "title": "T1561", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582108" }, { "id": 552993, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582108", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78e4c636-9d88-5d3f-a08e-ca018938a0e4", "parentControlId": 30972, "controlId": "T1561.001", "title": "T1561.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582108" }, { "id": 552994, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582108", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88db14fc-2ff7-53b0-a717-77011ffe0b4f", "parentControlId": 30972, "controlId": "T1561.002", "title": "T1561.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582108" }, { "id": 553001, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc52788f-8244-58f0-b199-b44ea0f73455", "parentControlId": 30972, "controlId": "CP-1", "title": "CP-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582109" }, { "id": 553002, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5f5fe3c-25a3-5241-8079-0f1b4ac6f33d", "parentControlId": 30972, "controlId": "CP-2", "title": "CP-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582109" }, { "id": 553003, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2f1fafd-cf3d-542b-8ee5-20f386e2aa10", "parentControlId": 30972, "controlId": "IR-4(3)", "title": "IR-4(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582109" }, { "id": 553004, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "162e3931-2d1a-5ba4-a931-a097521ccdb9", "parentControlId": 30972, "controlId": "PM-8", "title": "PM-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582109" }, { "id": 553005, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc95b29e-8383-5075-8974-1baccd69b66e", "parentControlId": 30972, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582109" }, { "id": 553006, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c6abfe2-d87a-5642-9242-08f6e8c40a9a", "parentControlId": 30972, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582109" }, { "id": 553007, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4106309-7c58-5afe-8201-cba3e2d9b3ce", "parentControlId": 30972, "controlId": "CP-02", "title": "CP-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582109" }, { "id": 553008, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03805abc-6d39-54dc-8521-112195237544", "parentControlId": 30972, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582109" }, { "id": 553009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75aeea01-17c9-5d57-bfc0-446ddb0f1cc1", "parentControlId": 30972, "controlId": "IR-04(03)", "title": "IR-04(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582109" }, { "id": 553010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41f7b078-bbb0-5c8d-b4db-a88945a79c8b", "parentControlId": 30972, "controlId": "PM-08", "title": "PM-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582109" }, { "id": 553016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c20656e2-0768-5e0f-bcc8-de0691629aad", "parentControlId": 30972, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582118" }, { "id": 553017, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56d5dbc2-04fe-5843-9a43-2012508a33ae", "parentControlId": 30972, "controlId": "CP-02", "title": "CP-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582118" }, { "id": 553018, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fd195b8-cf53-59ba-8e0a-f9a09852b66f", "parentControlId": 30972, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582119" }, { "id": 553020, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582119", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf73d89a-3f92-5a01-9cb0-afeb4b44a80e", "parentControlId": 30972, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582119" }, { "id": 553021, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582119", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5c3d4ec-b7be-53c0-941e-fd8510bc50eb", "parentControlId": 30972, "controlId": "CP-02", "title": "CP-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582119" }, { "id": 553022, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582119", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "841dec86-b8fa-5ede-a468-97a3f3eaa733", "parentControlId": 30972, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582119" }, { "id": 553023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582119", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "494a07e2-1917-58f6-84af-91e4b7003091", "parentControlId": 30972, "controlId": "IR-04(03)", "title": "IR-04(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582119" }, { "id": 553024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582119", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f5f07ac-efc4-5b4d-8677-724f80949055", "parentControlId": 30972, "controlId": "PM-08", "title": "PM-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582119" }, { "id": 553025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582119", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8ece927-ef2e-5c00-ba9c-510710092b53", "parentControlId": 30972, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582119" }, { "id": 553026, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582119", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e24d63d4-eb77-527c-b13e-3fcc175e6043", "parentControlId": 30972, "controlId": "CP-02", "title": "CP-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582119" }, { "id": 553027, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58212", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb317874-b4fa-51cf-b325-65de0764011f", "parentControlId": 30972, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58212" }, { "id": 553028, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58212", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b3d8b63-e4b5-5368-b4a5-a6d1602599e8", "parentControlId": 30972, "controlId": "PM-08", "title": "PM-08", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58212" }, { "id": 553029, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58212", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39d3b1fd-9c89-512c-b543-8fbab48330f4", "parentControlId": 30972, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58212" }, { "id": 553030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58212", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1398c523-e9f7-59d9-a583-b72f5b0008c5", "parentControlId": 30972, "controlId": "CP-02", "title": "CP-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58212" }, { "id": 553031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58212", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "febfa59a-dc22-50c3-857e-f44c0a3226e4", "parentControlId": 30972, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58212" }, { "id": 553032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58212", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbc08f46-178a-56cb-bea4-ab5c4aa96ed4", "parentControlId": 30972, "controlId": "PM-08", "title": "PM-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58212" }, { "id": 553033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58212", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf909222-d269-5f70-b989-b52ca034307f", "parentControlId": 30972, "controlId": "CP-01", "title": "CP-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58212" }, { "id": 553034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58212", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "572952e5-c45a-5c55-81af-fd06b8b84dc6", "parentControlId": 30972, "controlId": "CP-02", "title": "CP-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58212" }, { "id": 553035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58212", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b526970e-ceef-53b7-b555-4cc5f0e576a1", "parentControlId": 30972, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58212" }, { "id": 553036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582121", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "049b17eb-0b11-5aab-889d-eec97a8a7b7a", "parentControlId": 30972, "controlId": "PM-08", "title": "PM-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582121" }, { "id": 553038, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582121", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4766eda9-348c-5f40-9522-e56ce9ca770d", "parentControlId": 30972, "controlId": "CP-1", "title": "CP-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582121" }, { "id": 553039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582121", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0fa6bd3-1575-5740-b80a-00b83d97bc1e", "parentControlId": 30972, "controlId": "CP-2", "title": "CP-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582121" }, { "id": 553040, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582121", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdef2b60-b06c-50a8-bcee-004e08e1132c", "parentControlId": 30972, "controlId": "PM-8", "title": "PM-8", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582121" }, { "id": 553041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582121", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72a26649-360d-5b1e-9d23-84d7fd432b20", "parentControlId": 30972, "controlId": "CP-1", "title": "CP-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582121" }, { "id": 553042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582121", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0fd4481-4d10-54e3-a7a0-f0b918b774ac", "parentControlId": 30972, "controlId": "CP-2", "title": "CP-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582121" }, { "id": 553049, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582122", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52fd5557-27fb-5057-9e69-e4da4a16d1a5", "parentControlId": 30972, "controlId": "GV.SC-08", "title": "GV.SC-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582122" }, { "id": 553050, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582122", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d941b5c-4607-52f0-8540-5bcb101d7912", "parentControlId": 30972, "controlId": "ID.IM-04", "title": "ID.IM-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582122" }, { "id": 553051, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582122", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "738ef7ab-ba77-5d4b-8923-760dd26ac4a4", "parentControlId": 30972, "controlId": "PR.IR-02", "title": "PR.IR-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582122" }, { "id": 553052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582122", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0aae12b0-da0d-58b6-b6eb-910e3da47f2a", "parentControlId": 30972, "controlId": "PR.IR-03", "title": "PR.IR-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582122" }, { "id": 553053, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582122", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bb71420-3f90-52b4-bd21-55a1c7491b06", "parentControlId": 30972, "controlId": "RS.MA-05", "title": "RS.MA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582122" }, { "id": 553054, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582123", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bed4f37-2f9f-5e00-83e3-ffc91872a142", "parentControlId": 30972, "controlId": "RC", "title": "RC", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582123" }, { "id": 553055, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582123", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fcebb47-9c66-5193-81c4-8254c9056cf8", "parentControlId": 30972, "controlId": "RC.RP", "title": "RC.RP", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582123" }, { "id": 553056, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582123", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db160f4c-a6e8-5393-97ce-54f8c2fe7f46", "parentControlId": 30972, "controlId": "RC.RP-02", "title": "RC.RP-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582123" }, { "id": 553057, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582123", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "817018a9-5ff6-57ad-9a2e-db5c4a682483", "parentControlId": 30972, "controlId": "RC.RP-04", "title": "RC.RP-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582123" }, { "id": 553112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582129", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c715aec3-69a8-5265-9a08-5731d947db28", "parentControlId": 30972, "controlId": "RESPONSE-4d", "title": "RESPONSE-4d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582129" }, { "id": 553158, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582134", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90176d8e-3edc-59f9-8e28-1bcd20f4dfd1", "parentControlId": 30972, "controlId": "CIP-003-8 1.1.6", "title": "CIP-003-8 1.1.6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582134" }, { "id": 553159, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582134", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f275d2aa-991e-5b54-88fb-7bfd909ef781", "parentControlId": 30972, "controlId": "CIP-009-6 R1", "title": "CIP-009-6 R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582134" }, { "id": 553160, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582134", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a148e485-1dd3-520c-b4b6-71644962bd5c", "parentControlId": 30972, "controlId": "CIP-009-6 R2", "title": "CIP-009-6 R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582135" }, { "id": 553161, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa60c85a-3839-5d29-a1e2-3bec607423f8", "parentControlId": 30972, "controlId": "CIP-009-6 R3", "title": "CIP-009-6 R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582135" }, { "id": 553286, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582149", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51f79856-aff1-59c3-ab33-0261fc669e22", "parentControlId": 30972, "controlId": "B5.a", "title": "B5.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582149" }, { "controlId": "C.3.11", "title": "C.3.11 — Anticipated Failure Response", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-13, CP-10", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "130a83c5-9cbb-5d86-8631-17703236d3bc", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.11", "title": "NEI 08-09 App E.3.11 — Anticipated Failure Response", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.11", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e74de0cc-aa08-5593-ba4b-055b91ac2223", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(2)", "title": "10 CFR 73.54(c)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.3.11", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "7b29e54f-6ac2-5274-a85e-f7952ff48a70", "isPublic": true }, { "controlId": "C.9.1", "title": "C.9.1 — Contingency Planning Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CP-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "3b0d925b-07ca-54ec-b690-e9f34f788cf2", "isPublic": true }, { "controlId": "NEI 08-09 App E.9.1", "title": "NEI 08-09 App E.9.1 — Contingency Planning Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.9.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "2372a9f3-7ca5-5fb9-b63e-421194c56c3a", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3)", "title": "10 CFR 73.54(d)(3) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.9.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "043b451f-c400-5b51-a5c6-6784554cc80e", "isPublic": true }, { "controlId": "C.9.2", "title": "C.9.2 — Contingency Plan", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CP-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "172fc3b4-9bef-5550-b4c5-821df0177058", "isPublic": true }, { "controlId": "NEI 08-09 App E.9.2", "title": "NEI 08-09 App E.9.2 — Contingency Plan", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.9.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "5dd16c65-634e-51ae-b886-04432b14e190", "isPublic": true }, { "controlId": "CIP-009-6-R1", "title": "CIP-009-6-R1 — Recovery Plan for BES Cyber Systems", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c9a63216-bfb7-533b-aa1d-e2acf145f384", "isPublic": true }, { "controlId": "CIP-009-6-1.1", "title": "CIP-009-6-1.1 — Conditions for activation of the recovery plan(s).", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1e86a4d9-0743-513b-a9b6-dec4c640f453", "isPublic": true }, { "controlId": "CIP-009-6-1.2", "title": "CIP-009-6-1.2 — Roles and responsibilities of responders.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5e21c3db-4c31-5fcd-8ab6-ddf7ee2e1e63", "isPublic": true }, { "controlId": "CIP-009-6-1.3", "title": "CIP-009-6-1.3 — One or more processes for the backup and storage of information required to recover BES Cyber System functionality.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "008e5197-4dea-59e7-afe8-0cb0b1c22643", "isPublic": true }, { "controlId": "CIP-009-6-1.4", "title": "CIP-009-6-1.4 — One or more processes to verify the successful completion of the backup processes in Part 1.3 and to address any back...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "031d5ae3-d2bd-5119-8e45-006a1e61898b", "isPublic": true }, { "controlId": "CIP-009-6-1.5", "title": "CIP-009-6-1.5 — One or more processes to preserve data, per Cyber Asset capability, for determining the cause of a Cyber Security Inc...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5b263e55-c501-5639-a4bc-5c1788f1b7d6", "isPublic": true }, { "controlId": "CIP-009-6-R2", "title": "CIP-009-6-R2 — Recovery Plan Implementation and Testing", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2669a350-73a2-5d70-b19a-364eccc7562d", "isPublic": true }, { "controlId": "CIP-009-6-2.1", "title": "CIP-009-6-2.1 — Test each of the recovery plans referenced in Requirement R1 at least once every 15 calendar months", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b0e43d82-4bc7-5f63-acad-6974cdb29b3d", "isPublic": true }, { "controlId": "CIP-009-6-2.2", "title": "CIP-009-6-2.2 — Test a representative sample of information used to recover BES Cyber System functionality at least once every 15 cal...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b46df7a3-2fc9-543a-8376-dc53d2602a3e", "isPublic": true }, { "controlId": "CIP-009-6-2.3", "title": "CIP-009-6-2.3 — Test each of the recovery plans referenced in Requirement R1 at least once every 36 calendar months through an operat...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0103d933-65bb-55d2-810b-c31add686f43", "isPublic": true }, { "controlId": "CIP-009-6-R3", "title": "CIP-009-6-R3 — Recovery Plan Review and Maintenance", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ad2fdb78-9f22-51fd-abc4-7c1f4a2999c2", "isPublic": true }, { "controlId": "CIP-009-6-3.1", "title": "CIP-009-6-3.1 — No later than 90 calendar days after completion of a recovery plan test or actual recovery: 3.1.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2d020a2b-dbb7-5e7f-851f-a0d7176cbf88", "isPublic": true }, { "controlId": "CIP-009-6-3.1.1", "title": "CIP-009-6-3.1.1 — Document any lessons learned associated with a recovery plan test or actual recovery or document the absence of any l...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "111d82a9-06c7-5adb-bd8f-7d9394d68cb7", "isPublic": true }, { "controlId": "CIP-009-6-3.1.2", "title": "CIP-009-6-3.1.2 — Update the recovery plan based on any documented lessons learned associated with the plan", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "76f1560f-ab90-56ff-a149-2ad50661ecd4", "isPublic": true }, { "controlId": "CIP-009-6-3.1.3", "title": "CIP-009-6-3.1.3 — Notify each person or group with a defined role in the recovery plan of the updates to the recovery plan based on any...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "195833cb-e6bb-576c-93b9-de7aaa0b08e7", "isPublic": true }, { "controlId": "CIP-009-6-3.2", "title": "CIP-009-6-3.2 — No later than 60 calendar days after a change to the roles or responsibilities, responders, or technology that the Re...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "dbbedb91-82fc-5acc-9255-f6446d83cdcb", "isPublic": true }, { "controlId": "CIP-009-6-3.2.1", "title": "CIP-009-6-3.2.1 — Update the recovery plan", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2f52416d-def6-55f9-bcb6-512b411ab0a5", "isPublic": true }, { "controlId": "CIP-009-6-3.2.2", "title": "CIP-009-6-3.2.2 — Notify each person or group with a defined role in the recovery plan of the updates.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "847bde28-e447-56dc-970b-7f6941e08f4c", "isPublic": true }, { "controlId": "NSS-17T-Sec4.8", "title": "NSS-17T-Sec4.8 — Contingency Planning, Backup & Safe-State Recovery", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "89d6a538-3222-5f01-8ec2-31b1a0474072", "isPublic": true }, { "controlId": "IEC-62645-8.5", "title": "IEC-62645-8.5 — Continuity, Backup, and Recovery of I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "be13c446-670d-5764-ba1d-d59c9aaea294", "isPublic": true }, { "controlId": "IEC-63096-17.1", "title": "IEC-63096-17.1 — Operational Continuity and Reconstitution of CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "a45c3185-8a49-57f4-bb7d-3ee0a6a5f311", "isPublic": true } ], "id": 30972, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730915", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730915", "catalogueId": 1062, "uuid": "a6dfe651-fda2-5552-a9ce-4033eb3acb2e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of contingency planning controls to help ensure resilient Technology Assets, Applications and/or Services (TAAS) (e.g., Continuity of Operations Plan (COOP) or Business Continuity & Disaster Recovery (BC/DR) playbooks)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Business Continuity Management System (BCMS)", "description": "

Control Description

Mechanisms exist to facilitate the implementation of contingency planning controls to help ensure resilient Technology Assets, Applications and/or Services (TAAS) (e.g., Continuity of Operations Plan (COOP) or Business Continuity & Disaster Recovery (BC/DR) playbooks).

Evidence Request List (ERL)

E-BCM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ IT and/or cybersecurity personnel develop limited Disaster Recovery Plans (DRP) to recover business-critical Technology Assets, Applications and/or Services (TAAS) and services.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners identify business-critical TAASD and External Service Providers (ESPs).\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to identify single points of failure from a TAASD perspective.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to develop BC/DR plans to recover business-critical TAASD.\n▪ Data/process owners conduct a Business Impact Analysis (BIA) at least annually, or after any major technology or process change, to identify TAASD that are critical to the business, as well as single points of failure.\n▪ Business stakeholders and process owners designate alternative decision-makers if primary decision-makers are unavailable.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of contingency planning controls to help ensure resilient Technology Assets, Applications and/or Services (TAAS) (e.g., Continuity of Operations Plan (COOP) or BC/DR playbooks).

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.3.11, C.9.1, C.9.2
NERC-CIP (2026) Requirements: CIP-009-6-R1, CIP-009-6-R2, CIP-009-6-R3", "controlId": "BCD-01", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-01", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)\n∙ Business Impact Analysis (BIA)\n∙ Criticality assessments

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)\n∙ Business Impact Analysis (BIA)\n∙ Criticality assessments

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)\n∙ Business Impact Analysis (BIA)\n∙ Criticality assessments

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)\n∙ Business Impact Analysis (BIA)\n∙ Criticality assessments

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)\n∙ Business Impact Analysis (BIA)\n∙ Criticality assessments", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69691, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589993", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589993", "securityControlId": 30973, "ccis": [], "uuid": "2f4deb6f-5e3c-570e-a7ae-9f143c209191", "testId": "BCD-01.1_A01", "test": "contingency plan development is coordinated with organizational elements responsible for related plans.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-02(01)", "defaultText": null } ], "externalMappings": [ { "id": 553368, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582166", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88f8b8bd-4b9b-52fa-973f-9e60bad85e90", "parentControlId": 30973, "controlId": "5.29", "title": "5.29", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582166" }, { "id": 553369, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582166", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7dd4fdbe-a69d-552b-bd8c-ee54a122d925", "parentControlId": 30973, "controlId": "5.3", "title": "5.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582167" }, { "id": 553372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63db5a8c-4da0-58ac-8f9e-004b84928987", "parentControlId": 30973, "controlId": "CP-2(1)", "title": "CP-2(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582167" }, { "id": 553373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a0d8cd4-d349-5d25-89da-6970ff0c9046", "parentControlId": 30973, "controlId": "CP-02(01)", "title": "CP-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582167" }, { "id": 553374, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b4a83ec-a49e-514d-968b-cdc24ed6ef92", "parentControlId": 30973, "controlId": "CP-02(01)", "title": "CP-02(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582167" }, { "id": 553375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6cc5aad-b8d8-5fc3-82f4-6acb5ff30d32", "parentControlId": 30973, "controlId": "CP-02(01)", "title": "CP-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582167" }, { "id": 553376, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0991ea10-8ebb-56c7-9539-75d327d0a2c1", "parentControlId": 30973, "controlId": "CP-02(01)", "title": "CP-02(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582167" }, { "id": 553377, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29729e47-ce65-5278-9d6f-18f0ed6113de", "parentControlId": 30973, "controlId": "CP-02(01)", "title": "CP-02(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582167" }, { "id": 553379, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30f5337d-7795-54a0-af40-1acc897d523b", "parentControlId": 30973, "controlId": "CP-2(1)", "title": "CP-2(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582168" }, { "id": 553382, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5b198a4-39dd-5cbc-a043-7a14ae26b4a8", "parentControlId": 30973, "controlId": "RC.CO", "title": "RC.CO", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582168" } ], "id": 30973, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730915", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730915", "catalogueId": 1062, "uuid": "42001ca1-7c94-5604-a5bc-87ce972ddc41", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization coordinate contingency plan development with internal and external elements responsible for related plans?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Coordinate with Related Plans", "description": "

Control Description

Mechanisms exist to coordinate contingency plan development with internal and external elements responsible for related plans.

Evidence Request List (ERL)

E-BCM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ IT and/or cybersecurity personnel develop limited Disaster Recovery Plans (DRP) to recover business-critical Technology Assets, Applications and/or Services (TAAS) and services.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners identify business-critical TAASD and External Service Providers (ESPs).\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to identify single points of failure from a TAASD perspective.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to coordinate contingency plan development with internal and external elements responsible for related plans.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-01.1", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Incident Response Plan (IRP)

Small Business (10-49 staff)

∙ Incident Response Plan (IRP)

Medium Business (50-249 staff)

∙ Incident Response Plan (IRP)

Large Business (250-999 staff)

∙ Incident Response Plan (IRP)

Enterprise (>1,000 staff)

∙ Incident Response Plan (IRP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69692, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589993", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589993", "securityControlId": 30974, "ccis": [], "uuid": "9518b031-dc58-5a0c-9995-d963832be859", "testId": "BCD-01.2_A01", "test": "the contingency plan is coordinated with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-02(07)", "defaultText": null } ], "externalMappings": [ { "id": 553393, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cccd381f-ecff-52fe-b6ff-6050016263e9", "parentControlId": 30974, "controlId": "5.29", "title": "5.29", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58217" }, { "id": 553394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e7176f0-0c01-59da-a380-fdb9fc485848", "parentControlId": 30974, "controlId": "5.3", "title": "5.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58217" }, { "id": 553397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ce763b6-24b3-57b5-97fb-73d7047605fc", "parentControlId": 30974, "controlId": "CP-2(7)", "title": "CP-2(7)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58217" }, { "id": 553398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75d4196f-928a-547e-a79b-4d4c327ad8ba", "parentControlId": 30974, "controlId": "CP-02(07)", "title": "CP-02(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58217" }, { "id": 553399, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cdde0d55-c139-5cff-af2e-b87939c6633e", "parentControlId": 30974, "controlId": "CP-02(07)", "title": "CP-02(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58217" }, { "id": 553400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8690890-df4e-5957-8bf7-4394b437eb5f", "parentControlId": 30974, "controlId": "CP-2(7)", "title": "CP-2(7)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582171" }, { "id": 553401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29fa4eee-3c65-5f4c-b5e5-a244afea93b4", "parentControlId": 30974, "controlId": "CP-2(7)", "title": "CP-2(7)", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582171" }, { "id": 553403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7d3a578-9edd-55fa-a362-68dc775ec38f", "parentControlId": 30974, "controlId": "GV.SC-08", "title": "GV.SC-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582171" }, { "id": 553404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4bf0a02f-9e4f-580d-88ed-12dc2da28536", "parentControlId": 30974, "controlId": "RC.CO", "title": "RC.CO", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582171" } ], "id": 30974, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730916", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730916", "catalogueId": 1062, "uuid": "65deb6ba-4427-5c7d-9a7f-fcaefc3bb072", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization coordinate internal contingency plans with the contingency plans of external service providers to ensure that contingency requirements can be satisfied?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Coordinate With External Service Providers", "description": "

Control Description

Mechanisms exist to coordinate internal contingency plans with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.

Evidence Request List (ERL)

E-BCM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners identify business-critical TAASD and External Service Providers (ESPs).\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to identify single points of failure from a TAASD perspective.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to coordinate internal contingency plans with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-01.2", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-01.2", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69693, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589993", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589993", "securityControlId": 30975, "ccis": [], "uuid": "dec18e62-2329-535d-bb52-be90ca50737e", "testId": "BCD-01.3_A01", "test": "the transfer of organization-defined criteria mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity is planned for.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-02(06)[01]", "defaultText": null }, { "id": 69694, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589994", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589994", "securityControlId": 30975, "ccis": [], "uuid": "7984b650-d26a-5d06-9fda-3abe419e771a", "testId": "BCD-01.3_A02", "test": "operational continuity is sustained until full system restoration at primary processing and/or storage sites.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02(06)[02]", "defaultText": null } ], "externalMappings": [ { "id": 553408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b710f9e-1a41-542e-a163-20367be2de35", "parentControlId": 30975, "controlId": "CP-2(6)", "title": "CP-2(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582171" }, { "id": 553409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91edece1-808b-538f-b3d8-89ce7cffa8dd", "parentControlId": 30975, "controlId": "CP-02(06)", "title": "CP-02(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582172" }, { "id": 553410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23f3ff99-2f4a-5e26-a32e-d0a360258424", "parentControlId": 30975, "controlId": "CP-02(06)", "title": "CP-02(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582172" } ], "id": 30975, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730916", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730916", "catalogueId": 1062, "uuid": "63937310-5eff-596c-9bef-e388abdc1e5f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization redeploy personnel to other roles during a disruptive event or in the execution of a continuity plan?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Transfer to Alternate Processing / Storage Site", "description": "

Control Description

Mechanisms exist to redeploy personnel to other roles during a disruptive event or in the execution of a continuity plan.

Evidence Request List (ERL)

E-DCH-13

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to redeploy personnel to other roles during a disruptive event or in the execution of a continuity plan.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-01.3", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-01.3", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69695, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589994", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589994", "securityControlId": 30976, "ccis": [], "uuid": "f79285e1-3588-584a-82c8-4c7573517d3a", "testId": "BCD-01.4_A01", "test": "time period consistent with Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for the recovery of the system is determined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-10_ODP[01]", "defaultText": null }, { "id": 69696, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589994", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589994", "securityControlId": 30976, "ccis": [], "uuid": "a3d097f5-cdda-55a7-b558-51956b61744a", "testId": "BCD-01.4_A02", "test": "the alternate storage site is configured to facilitate recovery operations in accordance with Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CP-06(02)[01]\n53A_R5_CP-06(02)[02]", "defaultText": null }, { "id": 69697, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589994", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589994", "securityControlId": 30976, "ccis": [], "uuid": "516c80d7-8824-5d41-ba9f-b1801053cf58", "testId": "BCD-01.4_A03", "test": "time period consistent with Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for the reconstitution of the system is determined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-10_ODP[02]", "defaultText": null }, { "id": 69698, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589995", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589995", "securityControlId": 30976, "ccis": [], "uuid": "29b420c3-0ad4-5aa8-bca3-87491d48a0c3", "testId": "BCD-01.4_A04", "test": "the recovery of the system to a known state is provided within a specified time period after a disruption, compromise or failure.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CP-10[01]", "defaultText": null }, { "id": 69699, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589995", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589995", "securityControlId": 30976, "ccis": [], "uuid": "c9d6ee0a-6dba-56cf-bc2f-d6419ee10954", "testId": "BCD-01.4_A05", "test": "a reconstitution of the system to a known state is provided within an organization-defined time period after a disruption, compromise or failure.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CP-10[02]", "defaultText": null } ], "externalMappings": [ { "id": 553422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582173", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a30582bf-34bb-531c-bc23-8d83057da789", "parentControlId": 30976, "controlId": "CP-6(2)", "title": "CP-6(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582173" }, { "id": 553423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582173", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73831381-baba-557c-a16c-f997eeeae551", "parentControlId": 30976, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582173" }, { "id": 553424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582174", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13dad709-bf1f-5d1f-9e96-2791f56d9bc3", "parentControlId": 30976, "controlId": "CP-06(02)", "title": "CP-06(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582174" }, { "id": 553425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582174", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "434ecbcd-b0d7-5fc3-92e5-66f01c40f406", "parentControlId": 30976, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582174" }, { "id": 553427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582174", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b85ea97-308b-5885-85d6-ac234b13b63d", "parentControlId": 30976, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582174" }, { "id": 553428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582174", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9840dec-8e9f-5b07-8432-8c9a3f54c608", "parentControlId": 30976, "controlId": "CP-06(02)", "title": "CP-06(02)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582174" }, { "id": 553429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582174", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "568cec2e-dcb3-5a16-b3da-20bc1b30e917", "parentControlId": 30976, "controlId": "CP-06(02)", "title": "CP-06(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582174" }, { "id": 553430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582174", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a26329f5-2d69-5f69-a22c-aee851cafc41", "parentControlId": 30976, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582174" }, { "id": 553431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582174", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19a2a680-e150-5c2b-a7e8-ede3306a8c8c", "parentControlId": 30976, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582174" }, { "id": 553432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582174", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e9131fd-a446-5c9a-a024-16e97430c198", "parentControlId": 30976, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582174" }, { "id": 553433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582174", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5d942f4-36fd-55fb-a524-c9814386bc98", "parentControlId": 30976, "controlId": "CP-06(02)", "title": "CP-06(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582174" }, { "id": 553434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582175", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89b2cc35-b274-57e9-8feb-69ce127e8763", "parentControlId": 30976, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582175" }, { "id": 553435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582175", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "960c64b8-f9a1-5ae3-ba38-1e40d3d26e9d", "parentControlId": 30976, "controlId": "RC.RP", "title": "RC.RP", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582175" }, { "id": 553436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582175", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c73132e-b34a-56a9-bd9e-454c562612e7", "parentControlId": 30976, "controlId": "RC.RP-02", "title": "RC.RP-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582175" }, { "id": 553437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582175", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e15a188a-e270-5b2f-889d-0f301ba9bc8e", "parentControlId": 30976, "controlId": "RC.RP-04", "title": "RC.RP-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582175" }, { "id": 553439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582175", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2dae4915-6ab5-5f56-993e-fbd8dfd0af4c", "parentControlId": 30976, "controlId": "RESPONSE-4g", "title": "RESPONSE-4g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582175" } ], "id": 30976, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730917", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730917", "catalogueId": 1062, "uuid": "61c81cf1-dcb0-50a9-8c91-c6c312d1aaf6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate recovery operations in accordance with Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Recovery Time / Point Objectives (RTO / RPO)", "description": "

Control Description

Mechanisms exist to facilitate recovery operations in accordance with Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).

Evidence Request List (ERL)

E-BCM-02\nE-BCM-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate recovery operations in accordance with Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-01.4", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-01.4", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69700, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589995", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589995", "securityControlId": 30977, "ccis": [], "uuid": "894df0cc-f0f5-5a5b-9156-ae378d7f221a", "testId": "BCD-01.5_A01", "test": "criteria that must be met to initiate Business Continuity / Disaster Recovery (BC/DR) plans that facilitate business continuity operations capable of meeting applicable Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 553475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7defed8a-163c-504c-a84a-fbc77ae00cea", "parentControlId": 30977, "controlId": "RS.MA-05", "title": "RS.MA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58218" }, { "id": 553476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bfc5f1f-5cb8-5488-ae90-b1f14ca0f2ce", "parentControlId": 30977, "controlId": "RC.RP-01", "title": "RC.RP-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58218" }, { "id": 553477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c477b755-8fc4-5b21-a85c-ab1ca2e52e10", "parentControlId": 30977, "controlId": "RESPONSE-4h", "title": "RESPONSE-4h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58218" }, { "id": 553478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1cb8eb68-15a8-5c86-bce2-41c839f3c7ef", "parentControlId": 30977, "controlId": "CIP-009-6 1.1", "title": "CIP-009-6 1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58218" } ], "id": 30977, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730917", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730917", "catalogueId": 1062, "uuid": "b740141d-d595-5358-8fd7-0fc4e1e06d5d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define specific criteria that must be met to initiate Business Continuity / Disaster Recover (BC/DR) plans that facilitate business continuity operations capable of meeting applicable Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Recovery Operations Criteria", "description": "

Control Description

Mechanisms exist to define specific criteria that must be met to initiate Business Continuity / Disaster Recover (BC/DR) plans that facilitate business continuity operations capable of meeting applicable Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).

Evidence Request List (ERL)

E-BCM-14

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ IT and/or cybersecurity personnel develop limited Disaster Recovery Plans (DRP) to recover business-critical Technology Assets, Applications and/or Services (TAAS) and services.\n▪ Recovery Time Objectives (RTOs) and/or Recovery Point Objectives (RPOs) are not formally planned for or resourced to meet.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to define specific criteria that must be met to initiate Business Continuity / Disaster Recover (BC/DR) plans that facilitate business continuity operations capable of meeting applicable Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-01.5", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-01.5", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69701, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589995", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589995", "securityControlId": 30978, "ccis": [], "uuid": "fecd8e58-649f-5caa-82f4-a9bca84fe040", "testId": "BCD-01.6_A01", "test": "internal and external stakeholders requiring notification of recovery activities and progress in restoring operational capabilities are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69702, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589995", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589996", "securityControlId": 30978, "ccis": [], "uuid": "21eb060c-6340-56bb-929d-ee3af77344cc", "testId": "BCD-01.6_A02", "test": "based on the type of incident, methods to contact internal and external stakeholders requiring notification of recovery activities and progress in restoring operational capabilities are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69703, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589996", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589996", "securityControlId": 30978, "ccis": [], "uuid": "6cf9b339-86fc-5e3a-a89b-7dbab9e334fb", "testId": "BCD-01.6_A03", "test": "processes exist to communicate the status of recovery activities and progress in restoring operational capabilities to designated internal and external stakeholders.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 553485, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582181", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f334e259-4520-5e43-ab91-c82f4543f102", "parentControlId": 30978, "controlId": "RC.CO-03", "title": "RC.CO-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582181" } ], "id": 30978, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730917", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730917", "catalogueId": 1062, "uuid": "6657b3ef-b1ae-5407-aff5-c5064ba4774b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization communicate the status of recovery activities and progress in restoring operational capabilities to designated internal and external stakeholders?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Recovery Operations Communications", "description": "

Control Description

Mechanisms exist to communicate the status of recovery activities and progress in restoring operational capabilities to designated internal and external stakeholders.

Evidence Request List (ERL)

E-BCM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ IT and/or cybersecurity personnel develop limited Disaster Recovery Plans (DRP) to recover business-critical Technology Assets, Applications and/or Services (TAAS) and services.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners identify business-critical TAASD and External Service Providers (ESPs).\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to identify single points of failure from a TAASD perspective.\n▪ Within the BC/DR plans, alternate communications channels are defined if primary means of communication are unavailable.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to communicate the status of recovery activities and progress in restoring operational capabilities to designated internal and external stakeholders.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-01.6", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-01.6", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69704, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589996", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589996", "securityControlId": 30979, "ccis": [], "uuid": "625e4296-b501-568d-abbc-25fecc010462", "testId": "BCD-01.7_A01", "test": "Documented roles and responsibilities exist that direct process owners to establish and maintain formal Business Continuity & Disaster Recovery (BC/DR) plans.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69705, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589996", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589996", "securityControlId": 30979, "ccis": [], "uuid": "1c7fb964-c607-5c8a-add8-ff4a62e1320f", "testId": "BCD-01.7_A02", "test": "Process owners to establish and maintain formal BC/DR plans to ensure information is detailed enough, accurate and representative of current operations in order to sustain and/or restore operations under adverse conditions.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 553493, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce4e91e6-ff8f-5cf1-9233-dac04c97a57a", "parentControlId": 30979, "controlId": "RESPONSE-4a", "title": "RESPONSE-4a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582182" }, { "id": 553494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d845cbbe-1937-5891-b170-ca7b62edcc2f", "parentControlId": 30979, "controlId": "RESPONSE-4e", "title": "RESPONSE-4e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582182" }, { "id": 553495, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ecd14212-fe39-571f-97bb-ff7883d73275", "parentControlId": 30979, "controlId": "RESPONSE-4f", "title": "RESPONSE-4f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582182" }, { "id": 553496, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3f2dc52-5a0c-53b8-b52c-8b6758eebf55", "parentControlId": 30979, "controlId": "RESPONSE-4g", "title": "RESPONSE-4g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582182" }, { "id": 553497, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b334e78-f289-5241-a239-52fa66ae726f", "parentControlId": 30979, "controlId": "RESPONSE-4m", "title": "RESPONSE-4m", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582182" } ], "id": 30979, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730918", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730918", "catalogueId": 1062, "uuid": "66f78f36-21af-5114-9535-554b7391e5e5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization process owners to establish and maintain formal Business Continuity & Disaster Recovery (BC/DR) plans to ensure information is detailed enough, accurate and representative of current operations in order to sustain and/or restore operations under adverse conditions?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Business Continuity & Disaster Recovery (BC/DR) Plans", "description": "

Control Description

Mechanisms exist for process owners to establish and maintain formal Business Continuity & Disaster Recovery (BC/DR) plans to ensure information is detailed enough, accurate and representative of current operations in order to sustain and/or restore operations under adverse conditions.

Evidence Request List (ERL)

E-BCM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ IT and/or cybersecurity personnel develop limited Disaster Recovery Plans (DRP) to recover business-critical Technology Assets, Applications and/or Services (TAAS) and services.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners identify business-critical TAASD and External Service Providers (ESPs).\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to develop BC/DR plans to recover business-critical TAASD.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to for process owners to establish and maintain formal Business Continuity & Disaster Recovery (BC/DR) plans to ensure information is detailed enough, accurate and representative of current operations in order to sustain and/or restore operations under adverse conditions.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-01.7", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-01.7", "references": "

Micro-Small Business (<10 staff)

∙ Basic business continuity plan\n∙ Regular data backup

Small Business (10-49 staff)

∙ Business continuity plan\n∙ Tested backup and restore procedures

Medium Business (50-249 staff)

∙ Formal BCP/DRP program\n∙ Regular backup testing\n∙ Alternate processing capability

Large Business (250-999 staff)

∙ Enterprise BCP/DRP program\n∙ DR site\n∙ Annual exercises\n∙ RTO/RPO targets

Enterprise (>1,000 staff)

∙ Enterprise BC/DR platform (e.g., Zerto, Veeam Enterprise)\n∙ Dedicated DR site\n∙ Automated failover\n∙ Annual DR exercises", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69706, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589997", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589997", "securityControlId": 30980, "ccis": [], "uuid": "f76b6256-961e-5b42-ba9f-fa28186aa9a9", "testId": "BCD-02_A01", "test": "systems, applications and services that support essential missions and business functions are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-02(03)_ODP[01]\n53A_R5_CP-02(05)_ODP\n53A_R5_CP-02(06)_ODP\n53A_R5_CP-02(08)_ODP", "defaultText": null }, { "id": 69707, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589997", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589997", "securityControlId": 30980, "ccis": [], "uuid": "d2a1045f-fd2a-5939-b4f8-1c741f82ac6b", "testId": "BCD-02_A02", "test": "critical system assets supporting organization-defined criteria mission and business functions are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-02(08)", "defaultText": null } ], "externalMappings": [ { "id": 553530, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582186", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6756233f-9e65-5fd1-8fe5-faf760f57b84", "parentControlId": 30980, "controlId": "CP-2(8)", "title": "CP-2(8)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582186" }, { "id": 553531, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582186", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "522d48fd-9996-57d9-9679-a557034932f7", "parentControlId": 30980, "controlId": "CP-02(08)", "title": "CP-02(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582186" }, { "id": 553532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582186", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12377b57-65ee-56db-a324-d1d14c3bac30", "parentControlId": 30980, "controlId": "CP-02(08)", "title": "CP-02(08)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582186" }, { "id": 553534, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582186", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0996b0bb-aebd-5bbc-9b6a-80e8cbc107cc", "parentControlId": 30980, "controlId": "CP-02(08)", "title": "CP-02(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582186" }, { "id": 553535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582186", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f253a430-08e4-5bc4-8210-4a5a8f508cb3", "parentControlId": 30980, "controlId": "CP-02(08)", "title": "CP-02(08)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582186" }, { "id": 553536, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cfd365e3-49c7-5bcb-a569-d09b39b9811a", "parentControlId": 30980, "controlId": "CP-02(08)", "title": "CP-02(08)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582187" }, { "id": 553538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf7ea0ff-8319-54e7-bb8b-607eb9a8fcdc", "parentControlId": 30980, "controlId": "CP-2(8)", "title": "CP-2(8)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582187" }, { "id": 553540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe07858a-c3e4-5439-a48d-a43ee5d3869b", "parentControlId": 30980, "controlId": "GV.OC-04", "title": "GV.OC-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582187" }, { "id": 553541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34e3fc7c-a8f3-544d-a586-90747f055bcf", "parentControlId": 30980, "controlId": "GV.OC-05", "title": "GV.OC-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582187" }, { "id": 553542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36b4d582-e6d0-5a6e-81fd-936c0c1f96fa", "parentControlId": 30980, "controlId": "ID.AM-05", "title": "ID.AM-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582187" }, { "id": 553543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d65fc62-4ba4-5ad4-8062-edf8c2a40b3e", "parentControlId": 30980, "controlId": "RC.RP", "title": "RC.RP", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582187" }, { "id": 553544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4406735-d969-5079-a435-ae72ae142ed6", "parentControlId": 30980, "controlId": "RC.RP-02", "title": "RC.RP-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582188" }, { "id": 553545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b33c133-029e-50e4-9fdc-a650e9737d85", "parentControlId": 30980, "controlId": "RC.RP-04", "title": "RC.RP-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582188" }, { "id": 553553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26023acc-7c5b-5bd3-944c-f9a0a698e3ba", "parentControlId": 30980, "controlId": "ASSET-1c", "title": "ASSET-1c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582189" }, { "id": 553554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58219", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0645af70-3212-50c0-919d-56ae73172b5b", "parentControlId": 30980, "controlId": "ASSET-2c", "title": "ASSET-2c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58219" }, { "id": 553555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58219", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "791522cc-0c76-57b7-8680-afd9be8bebd5", "parentControlId": 30980, "controlId": "RISK-2h", "title": "RISK-2h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58219" }, { "id": 553556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58219", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "068f04db-fb30-5050-9747-acea11af825a", "parentControlId": 30980, "controlId": "RISK-2m", "title": "RISK-2m", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58219" }, { "id": 553557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58219", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e02211d-20de-5492-bbc3-8c7d74ee1947", "parentControlId": 30980, "controlId": "THIRD-PARTIES-1a", "title": "THIRD-PARTIES-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58219" }, { "id": 553577, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d660a027-6608-52fb-ab58-14e9676808d3", "parentControlId": 30980, "controlId": "A3.a (point 3)", "title": "A3.a (point 3)", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582192" }, { "controlId": "C.9.2", "title": "C.9.2 — Contingency Plan", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CP-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "c4529834-3730-5507-b0ad-f8499f2e503e", "isPublic": true }, { "controlId": "NEI 08-09 App E.9.2", "title": "NEI 08-09 App E.9.2 — Contingency Plan", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.9.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "2cef63d5-ae4c-54d0-aeaa-5ca5f8d448ba", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3)", "title": "10 CFR 73.54(d)(3) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.9.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "8224cd63-2ba5-55c5-a733-9dee908dbe61", "isPublic": true }, { "controlId": "CIP-009-6-R1", "title": "CIP-009-6-R1 — Recovery Plan for BES Cyber Systems", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ca0fd104-bbb2-5ac7-a722-cfa1cb5fabce", "isPublic": true }, { "controlId": "CIP-009-6-1.1", "title": "CIP-009-6-1.1 — Conditions for activation of the recovery plan(s).", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ce2d0f6f-d592-5ab2-b4a3-17c23eee034d", "isPublic": true }, { "controlId": "CIP-009-6-1.2", "title": "CIP-009-6-1.2 — Roles and responsibilities of responders.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "637069e3-56ce-5afb-a122-5ee7b1f203e2", "isPublic": true }, { "controlId": "CIP-009-6-1.3", "title": "CIP-009-6-1.3 — One or more processes for the backup and storage of information required to recover BES Cyber System functionality.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "220d3d70-c98e-545c-be55-dc744e0d82cf", "isPublic": true }, { "controlId": "CIP-009-6-1.4", "title": "CIP-009-6-1.4 — One or more processes to verify the successful completion of the backup processes in Part 1.3 and to address any back...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f4bbb917-dbe8-5c85-acac-b7ea0d4dbc42", "isPublic": true }, { "controlId": "CIP-009-6-1.5", "title": "CIP-009-6-1.5 — One or more processes to preserve data, per Cyber Asset capability, for determining the cause of a Cyber Security Inc...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3d991dd5-8a12-552e-8f3f-ad799ebc56d8", "isPublic": true }, { "controlId": "CIP-009-6-R3", "title": "CIP-009-6-R3 — Recovery Plan Review and Maintenance", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "56c91ed9-e4be-5691-8a7f-b034acff80b7", "isPublic": true }, { "controlId": "CIP-009-6-3.1", "title": "CIP-009-6-3.1 — No later than 90 calendar days after completion of a recovery plan test or actual recovery: 3.1.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "67c57fa8-eebc-5326-9672-7227b9c2b261", "isPublic": true }, { "controlId": "CIP-009-6-3.1.1", "title": "CIP-009-6-3.1.1 — Document any lessons learned associated with a recovery plan test or actual recovery or document the absence of any l...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "552f379c-6764-55c3-8bd6-169dbd61a497", "isPublic": true }, { "controlId": "CIP-009-6-3.1.2", "title": "CIP-009-6-3.1.2 — Update the recovery plan based on any documented lessons learned associated with the plan", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0774cc5d-855c-5716-826d-6729e414c3b3", "isPublic": true }, { "controlId": "CIP-009-6-3.1.3", "title": "CIP-009-6-3.1.3 — Notify each person or group with a defined role in the recovery plan of the updates to the recovery plan based on any...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "40e48085-ebab-5906-bc29-3d701727553b", "isPublic": true }, { "controlId": "CIP-009-6-3.2", "title": "CIP-009-6-3.2 — No later than 60 calendar days after a change to the roles or responsibilities, responders, or technology that the Re...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "99d7a461-d506-5afd-836c-17fab0f52a90", "isPublic": true }, { "controlId": "CIP-009-6-3.2.1", "title": "CIP-009-6-3.2.1 — Update the recovery plan", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c37632a3-0db9-59c2-9afc-bdd93ca36bf5", "isPublic": true }, { "controlId": "CIP-009-6-3.2.2", "title": "CIP-009-6-3.2.2 — Notify each person or group with a defined role in the recovery plan of the updates.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3c6fa939-5631-5798-960b-8d04d5b61fdf", "isPublic": true }, { "controlId": "NSS-17T-Sec4.8", "title": "NSS-17T-Sec4.8 — Contingency Planning, Backup & Safe-State Recovery", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "2f8da101-859c-5c12-bfdd-43e2977d1c9d", "isPublic": true }, { "controlId": "IEC-62645-8.5", "title": "IEC-62645-8.5 — Continuity, Backup, and Recovery of I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "089feb2e-cd35-5891-a034-055d2fa25956", "isPublic": true }, { "controlId": "IEC-63096-17.1", "title": "IEC-63096-17.1 — Operational Continuity and Reconstitution of CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "f8c805a3-e856-5964-b7b3-c1439382f846", "isPublic": true } ], "id": 30980, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730918", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730918", "catalogueId": 1062, "uuid": "b038cf06-8880-55c0-a38b-763535f5d141", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify and document the critical Technology Assets, Applications, Services and/or Data (TAASD) that support essential missions and business functions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Identify Critical Assets", "description": "

Control Description

Mechanisms exist to identify and document the critical Technology Assets, Applications, Services and/or Data (TAASD) that support essential missions and business functions.

Evidence Request List (ERL)

E-BCM-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ IT and/or cybersecurity personnel develop limited Disaster Recovery Plans (DRP) to recover business-critical Technology Assets, Applications and/or Services (TAAS) and services.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners identify business-critical TAASD and External Service Providers (ESPs).\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to identify single points of failure from a TAASD perspective.\n▪ Production TAASD support business-critical application and services failover.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to develop BC/DR plans to recover business-critical TAASD.\n▪ Data/process owners conduct a Business Impact Analysis (BIA) at least annually, or after any major technology or process change, to identify TAASD that are critical to the business, as well as single points of failure.\n▪ Business stakeholders and process owners define Recovery Time Objectives (RTOs) for business-critical TAASD.\n▪ Business stakeholders and process owners define Recovery Point Objectives (RPOs) for business-critical TAASD.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify and document the critical TAASD that support essential missions and business functions.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.9.2
NERC-CIP (2026) Requirements: CIP-009-6-R1, CIP-009-6-R3", "controlId": "BCD-02", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-02", "references": "

Micro-Small Business (<10 staff)

∙ Business Impact Analysis (BIA)\n∙ Criticality assessments

Small Business (10-49 staff)

∙ Business Impact Analysis (BIA)\n∙ Criticality assessments

Medium Business (50-249 staff)

∙ Business Impact Analysis (BIA)\n∙ Criticality assessments

Large Business (250-999 staff)

∙ Business Impact Analysis (BIA)\n∙ Criticality assessments

Enterprise (>1,000 staff)

∙ Business Impact Analysis (BIA)\n∙ Criticality assessments", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69708, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589997", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589997", "securityControlId": 30981, "ccis": [], "uuid": "9efa60ae-b7ba-5b3d-b1bd-bd9e791663f2", "testId": "BCD-02.1_A01", "test": "the contingency plan activation time period within which to resume all mission and business functions is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: Recovery Time Objective (RTO)", "otherId": "53A_R5_CP-02(03)_ODP[02]", "defaultText": null }, { "id": 69709, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589997", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589997", "securityControlId": 30981, "ccis": [], "uuid": "37372d5d-17e5-5721-82ef-0ad05d66879b", "testId": "BCD-02.1_A02", "test": "the resumption of all mission and business functions are planned for within an organization-defined time period of contingency plan activation.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: time period defined in service provider and organization SLA", "otherId": "53A_R5_CP-02(03)", "defaultText": null } ], "externalMappings": [ { "id": 553598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e5093b6-6f90-522f-918a-097f448b28e9", "parentControlId": 30981, "controlId": "CP-2(4)", "title": "CP-2(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582195" }, { "id": 553599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de4e96a1-f510-5140-93da-3d5919f0b694", "parentControlId": 30981, "controlId": "CP-02(03)", "title": "CP-02(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582195" }, { "id": 553601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf8e7d8b-007c-599f-9c99-9077676bed94", "parentControlId": 30981, "controlId": "CP-02(03)", "title": "CP-02(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582195" }, { "id": 553602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10120da5-5bed-528b-915c-e34e0f121b71", "parentControlId": 30981, "controlId": "CP-02(03)", "title": "CP-02(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582195" }, { "id": 553603, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "574c3013-8d37-5b0f-935c-f57053d80db9", "parentControlId": 30981, "controlId": "CP-02(03)", "title": "CP-02(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582195" }, { "id": 553604, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a07a6a1-9349-5d3e-8b3b-cb0a6092e2d8", "parentControlId": 30981, "controlId": "CP-02(03)", "title": "CP-02(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582196" }, { "id": 553605, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "044db14d-5188-5d27-a708-ffcb20b4b35d", "parentControlId": 30981, "controlId": "RC.RP", "title": "RC.RP", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582196" }, { "id": 553606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "684b039b-4f99-505f-b676-8ce224cc75ec", "parentControlId": 30981, "controlId": "RC.RP-02", "title": "RC.RP-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582196" }, { "id": 553607, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9a0d421-b644-5e86-9b27-5a672416c617", "parentControlId": 30981, "controlId": "RC.RP-04", "title": "RC.RP-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582196" } ], "id": 30981, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730918", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730918", "catalogueId": 1062, "uuid": "0947683c-16f3-5291-928e-f01607c4d00f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization resume all missions and business functions within Recovery Time Objectives (RTOs) of the contingency plan's activation?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Resume All Missions & Business Functions", "description": "

Control Description

Mechanisms exist to resume all missions and business functions within Recovery Time Objectives (RTOs) of the contingency plan's activation.

Evidence Request List (ERL)

E-BCM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ IT and/or cybersecurity personnel develop limited Disaster Recovery Plans (DRP) to recover business-critical Technology Assets, Applications and/or Services (TAAS) and services.\n▪ Recovery Time Objectives (RTOs) and/or Recovery Point Objectives (RPOs) are not formally planned for or resourced to meet.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners identify business-critical TAASD and External Service Providers (ESPs).\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to identify single points of failure from a TAASD perspective.\n▪ Production TAASD support business-critical application and services failover.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to develop BC/DR plans to recover business-critical TAASD.\n▪ Business stakeholders and process owners define Recovery Time Objectives (RTOs) for business-critical TAASD.\n▪ Business stakeholders and process owners define Recovery Point Objectives (RPOs) for business-critical TAASD.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to resume all missions and business functions within Recovery Time Objectives (RTOs) of the contingency plan's activation.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-02.1", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69710, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589998", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589998", "securityControlId": 30982, "ccis": [], "uuid": "25697e3d-0a02-5691-b304-0311146f1dad", "testId": "BCD-02.2_A01", "test": "the continuance of organization-defined criteria mission and business functions with minimal or no loss of operational continuity is planned for.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-02(05)[01]", "defaultText": null }, { "id": 69711, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589998", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589998", "securityControlId": 30982, "ccis": [], "uuid": "3da235f9-a66b-52b4-8e21-7a283afeac98", "testId": "BCD-02.2_A02", "test": "continuity is sustained until full system restoration at primary processing and/or storage sites.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02(05)[02]", "defaultText": null } ], "externalMappings": [ { "id": 553635, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e07cea62-b672-53a9-826b-7c2f4221c0f4", "parentControlId": 30982, "controlId": "CP-2(5)", "title": "CP-2(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582222" }, { "id": 553636, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d6c1bec-ced8-547c-8ff1-366f2a1b2d1a", "parentControlId": 30982, "controlId": "CP-02(05)", "title": "CP-02(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582223" }, { "id": 553637, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a23f87e-fd0f-5940-ab9d-1433fd398356", "parentControlId": 30982, "controlId": "CP-02(05)", "title": "CP-02(05)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582223" }, { "id": 553639, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f93d68bf-6195-5313-849c-d38dc23e742d", "parentControlId": 30982, "controlId": "CP-02(05)", "title": "CP-02(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582223" }, { "id": 553640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "010e7fd9-1cab-59a7-9631-ed40e1b9e7fa", "parentControlId": 30982, "controlId": "CP-02(05)", "title": "CP-02(05)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582223" } ], "id": 30982, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730918", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730918", "catalogueId": 1062, "uuid": "283182d1-2e9d-5592-b996-f5f64469c621", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization continue essential missions and business functions with little or no loss of operational continuity and sustain that continuity until full system restoration at primary processing and/or storage sites?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Continue Essential Mission & Business Functions", "description": "

Control Description

Mechanisms exist to continue essential missions and business functions with little or no loss of operational continuity and sustain that continuity until full system restoration at primary processing and/or storage sites.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ IT and/or cybersecurity personnel develop limited Disaster Recovery Plans (DRP) to recover business-critical Technology Assets, Applications and/or Services (TAAS) and services.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners identify business-critical TAASD and External Service Providers (ESPs).\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to identify single points of failure from a TAASD perspective.\n▪ Production TAASD support business-critical application and services failover.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to develop BC/DR plans to recover business-critical TAASD.\n▪ Business stakeholders and process owners define Recovery Time Objectives (RTOs) for business-critical TAASD.\n▪ Business stakeholders and process owners define Recovery Point Objectives (RPOs) for business-critical TAASD.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to continue essential missions and business functions with little or no loss of operational continuity and sustain that continuity until full system restoration at primary processing and/or storage sites.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-02.2", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-02.2", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69712, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589998", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589998", "securityControlId": 30983, "ccis": [], "uuid": "60674867-b993-50f1-8c5f-7a412976e112", "testId": "BCD-02.3_A01", "test": "the contingency plan activation time period within which to resume essential mission and business functions is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: Recovery Time Objective (RTO)", "otherId": "53A_R5_CP-02(03)_ODP[02]", "defaultText": null }, { "id": 69713, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589999", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589999", "securityControlId": 30983, "ccis": [], "uuid": "1aa97e78-2e88-5cf7-b1f9-22bd4a342dcd", "testId": "BCD-02.3_A02", "test": "the resumption of essential mission and business functions are planned for within an organization-defined time period of contingency plan activation.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: Recovery Time Objective (RTO)", "otherId": "53A_R5_CP-02(03)", "defaultText": null } ], "externalMappings": [ { "id": 553664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582227", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4efa4793-6cde-5555-8316-aa1297868a52", "parentControlId": 30983, "controlId": "CP-2(3)", "title": "CP-2(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582227" }, { "id": 553665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582227", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7e1069b-a4fd-5fd9-8722-88439b292377", "parentControlId": 30983, "controlId": "CP-02(03)", "title": "CP-02(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582227" }, { "id": 553667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0cc0765-eda4-542b-afaa-1e1427dfb898", "parentControlId": 30983, "controlId": "CP-02(03)", "title": "CP-02(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582238" }, { "id": 553668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58ed7f95-33ec-582e-adbb-c7f70031109d", "parentControlId": 30983, "controlId": "CP-02(03)", "title": "CP-02(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582238" }, { "id": 553669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3bc5bf1-c156-5bb9-8625-8a4d0edf367e", "parentControlId": 30983, "controlId": "CP-02(03)", "title": "CP-02(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582238" }, { "id": 553670, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a815a58-b535-5aa3-ac74-1baf0eed11eb", "parentControlId": 30983, "controlId": "CP-02(03)", "title": "CP-02(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582238" } ], "id": 30983, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730919", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730919", "catalogueId": 1062, "uuid": "400b01bd-3376-52b9-8fee-167879f222c5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization resume essential missions and business functions within an organization-defined time period of contingency plan activation?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Resume Essential Missions & Business Functions", "description": "

Control Description

Mechanisms exist to resume essential missions and business functions within an organization-defined time period of contingency plan activation.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners identify business-critical TAASD and External Service Providers (ESPs).\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to identify single points of failure from a TAASD perspective.\n▪ Business stakeholders and process owners define Recovery Time Objectives (RTOs) for business-critical TAASD.\n▪ Business stakeholders and process owners define Recovery Point Objectives (RPOs) for business-critical TAASD.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to resume essential missions and business functions within an organization-defined time period of contingency plan activation.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-02.3", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-02.3", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Business Continuity Plan (BCP)\n∙ Disaster Recovery Plan (DRP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69716, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.589999", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.589999", "securityControlId": 30985, "ccis": [], "uuid": "bb2a6b66-91c8-57aa-bfa1-9fb5c3be0760", "testId": "BCD-03_A01", "test": "the time period within which to provide contingency training after assuming a contingency role or responsibility is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-03_ODP[01]", "defaultText": null }, { "id": 69717, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59", "securityControlId": 30985, "ccis": [], "uuid": "d18cab1f-5e17-53f2-be41-6fe6f93fe0c4", "testId": "BCD-03_A02", "test": "the frequency at which to provide training to system users with a contingency role or responsibility is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-03_ODP[02]", "defaultText": null }, { "id": 69718, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59", "securityControlId": 30985, "ccis": [], "uuid": "077fd5fa-6f33-5404-8b49-b3efab28d95f", "testId": "BCD-03_A03", "test": "the frequency at which to review / update contingency training content is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-03_ODP[03]", "defaultText": null }, { "id": 69719, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59", "securityControlId": 30985, "ccis": [], "uuid": "1fd2c034-f22a-5022-8263-9634c87549f4", "testId": "BCD-03_A04", "test": "events necessitating review / update of contingency training are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-03_ODP[04]", "defaultText": null }, { "id": 69720, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59", "securityControlId": 30985, "ccis": [], "uuid": "3122698d-1b97-565d-b545-4a2a0270ae13", "testId": "BCD-03_A05", "test": "contingency training is provided to system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming a contingency role or responsibility.
PPTDF Applicability: People
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-03a.01", "defaultText": null }, { "id": 69721, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59", "securityControlId": 30985, "ccis": [], "uuid": "2738cb90-3d2e-5beb-9450-cae001914908", "testId": "BCD-03_A06", "test": "contingency training is provided to system users consistent with assigned roles and responsibilities when required by system changes.
PPTDF Applicability: People
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-03a.02", "defaultText": null }, { "id": 69722, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590001", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590001", "securityControlId": 30985, "ccis": [], "uuid": "ed0673c1-018b-52b5-9151-c92e66dd1109", "testId": "BCD-03_A07", "test": "contingency training is provided to system users consistent with assigned roles and responsibilities and frequency thereafter.
PPTDF Applicability: People
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-03a.03", "defaultText": null }, { "id": 69723, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590001", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590001", "securityControlId": 30985, "ccis": [], "uuid": "235249c9-c990-516a-952c-df55a99f02ff", "testId": "BCD-03_A08", "test": "the contingency plan training content is reviewed / updated frequently.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-03b.[01]", "defaultText": null }, { "id": 69724, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590001", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590001", "securityControlId": 30985, "ccis": [], "uuid": "0b7a015e-983d-587b-b3f6-2b2c21ddb2c1", "testId": "BCD-03_A09", "test": "the contingency plan training content is reviewed / updated following events.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-03b.[02]", "defaultText": null } ], "externalMappings": [ { "id": 553695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582242", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ca2ecff-6265-5ede-b35f-e92af537d622", "parentControlId": 30985, "controlId": "CP-3", "title": "CP-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582242" }, { "id": 553696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582242", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30f50428-fe8f-589a-bf53-71af001fca85", "parentControlId": 30985, "controlId": "CP-03", "title": "CP-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582242" }, { "id": 553697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582242", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c107b70-c686-52dc-bc04-5bef8fb1549a", "parentControlId": 30985, "controlId": "CP-03", "title": "CP-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582242" }, { "id": 553698, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582242", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5e7afa5-3eca-5e69-996c-300cc7aa2da1", "parentControlId": 30985, "controlId": "CP-03", "title": "CP-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582242" }, { "id": 553699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582242", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1512a714-cd13-5474-9997-d0f0168f5845", "parentControlId": 30985, "controlId": "CP-03", "title": "CP-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582242" }, { "id": 553700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582242", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a5cd66a-8615-569b-acbb-4179fabc6511", "parentControlId": 30985, "controlId": "CP-03", "title": "CP-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582242" }, { "id": 553701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582242", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de7583d3-37bc-5a0d-8ce3-238ed94ea4fd", "parentControlId": 30985, "controlId": "CP-03", "title": "CP-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582242" }, { "id": 553702, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582242", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef5eeb23-59ed-508a-8565-cf5d2c3f9c9a", "parentControlId": 30985, "controlId": "CP-3", "title": "CP-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582242" }, { "id": 553703, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582242", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e223d49d-e0ef-53b8-a1e4-0385379f2690", "parentControlId": 30985, "controlId": "CP-3", "title": "CP-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582242" }, { "id": 553704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582243", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "baf98505-b387-57c8-945b-ae817c22271e", "parentControlId": 30985, "controlId": "CP-3", "title": "CP-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582243" }, { "controlId": "C.9.4", "title": "C.9.4 — Contingency Plan Training", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CP-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "d89e26b9-73a5-5473-a8ee-d2de61b669da", "isPublic": true }, { "controlId": "NEI 08-09 App E.9.4", "title": "NEI 08-09 App E.9.4 — Contingency Plan Training", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.9.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "88d49c93-a609-55ef-a4aa-b68f52d7271d", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(2)", "title": "10 CFR 73.54(d)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.9.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "23bd0f8c-5be9-58a2-b4c9-9fad0441a31b", "isPublic": true }, { "controlId": "NSS-17T-Sec4.8", "title": "NSS-17T-Sec4.8 — Contingency Planning, Backup & Safe-State Recovery", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "6456febc-d39d-52d0-9190-4495bcde57c7", "isPublic": true }, { "controlId": "IEC-62645-8.5", "title": "IEC-62645-8.5 — Continuity, Backup, and Recovery of I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "85fb710c-afa3-5de8-a9b7-e204f0adccd7", "isPublic": true }, { "controlId": "IEC-63096-17.1", "title": "IEC-63096-17.1 — Operational Continuity and Reconstitution of CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "93c89e09-be7f-53f4-ac58-3ed9d12a0309", "isPublic": true } ], "id": 30985, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73092", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73092", "catalogueId": 1062, "uuid": "c1c5b2e6-59e2-5aa3-bdbb-7742158d0689", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization adequately train contingency personnel and applicable stakeholders in their contingency roles and responsibilities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Contingency Training", "description": "

Control Description

Mechanisms exist to adequately train contingency personnel and applicable stakeholders in their contingency roles and responsibilities.

Evidence Request List (ERL)

E-BCM-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to adequately train contingency personnel and applicable stakeholders in their contingency roles and responsibilities.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.9.4", "controlId": "BCD-03", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-03", "references": "

Micro-Small Business (<10 staff)

∙ NIST NICE Framework\n∙ Tabletop exercises

Small Business (10-49 staff)

∙ NIST NICE Framework\n∙ Tabletop exercises

Medium Business (50-249 staff)

∙ NIST NICE Framework\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ NIST NICE Framework\n∙ Tabletop exercises\n∙ Simulated events

Enterprise (>1,000 staff)

∙ NIST NICE Framework\n∙ Tabletop exercises\n∙ Simulated events", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69725, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590001", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590001", "securityControlId": 30986, "ccis": [], "uuid": "fcadd45f-2e32-51da-a9a9-67d76622c08f", "testId": "BCD-03.1_A01", "test": "simulated events are incorporated into contingency training to facilitate effective response by personnel in crisis situations.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_CP-03(01)", "defaultText": null } ], "externalMappings": [ { "id": 553727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d06f1f59-3bd9-5231-b5c3-6dc9d708b2da", "parentControlId": 30986, "controlId": "CP-3(1)", "title": "CP-3(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582246" }, { "id": 553728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74c41e7b-8868-53c0-a8ae-1b2cf324a3d4", "parentControlId": 30986, "controlId": "CP-03(01)", "title": "CP-03(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582246" }, { "id": 553729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c9ab918-68d6-5193-9140-71c0ab733a66", "parentControlId": 30986, "controlId": "CP-03(01)", "title": "CP-03(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582246" }, { "id": 553730, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fb49b44-0480-5505-beeb-f8c29f04af27", "parentControlId": 30986, "controlId": "CP-03(01)", "title": "CP-03(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582246" }, { "id": 553731, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97b5bacc-86bc-5e27-8a5e-6f08e808bfef", "parentControlId": 30986, "controlId": "CP-03(01)", "title": "CP-03(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582246" }, { "id": 553732, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b29691f-b029-5a51-a1f7-9f5b13e5cd9c", "parentControlId": 30986, "controlId": "CP-3(1)", "title": "CP-3(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582246" } ], "id": 30986, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73092", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73092", "catalogueId": 1062, "uuid": "977ff0ef-7505-5bb2-9776-ad71f966a838", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Simulated Events", "description": "

Control Description

Mechanisms exist to incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations.

Evidence Request List (ERL)

E-BCM-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-03.1", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Tabletop exercises

Small Business (10-49 staff)

∙ Tabletop exercises

Medium Business (50-249 staff)

∙ Tabletop exercises

Large Business (250-999 staff)

∙ Tabletop exercises\n∙ Simulated events

Enterprise (>1,000 staff)

∙ Tabletop exercises\n∙ Simulated events", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69726, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590002", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590002", "securityControlId": 30987, "ccis": [], "uuid": "abe5f036-2422-5db9-8a01-4a8be19dbf9b", "testId": "BCD-03.2_A01", "test": "mechanisms used in operations are employed to provide a more thorough and realistic contingency training environment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-03(02)", "defaultText": null } ], "externalMappings": [ { "id": 553742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3acd1a43-e126-55c4-b11a-64a7aefa9ca5", "parentControlId": 30987, "controlId": "CP-3(2)", "title": "CP-3(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582247" }, { "id": 553743, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73fa3641-8190-5db8-932d-5d82e7ac2613", "parentControlId": 30987, "controlId": "CP-03(02)", "title": "CP-03(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582247" }, { "id": 553744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582248", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be1e3e55-778a-54c9-af25-770ce64654a0", "parentControlId": 30987, "controlId": "CP-03(02)", "title": "CP-03(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582248" } ], "id": 30987, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73092", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73092", "catalogueId": 1062, "uuid": "43104d0b-221e-5350-9cc6-2a9d06ddda03", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to provide a more thorough and realistic contingency training environment?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 1.0, "title": "Automated Training Environments", "description": "

Control Description

Automated mechanisms exist to provide a more thorough and realistic contingency training environment.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ IT and/or cybersecurity personnel develop limited Disaster Recovery Plans (DRP) to recover business-critical Technology Assets, Applications and/or Services (TAAS) and services.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically provide a more thorough and realistic contingency training environment.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-03.2", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-03.2", "references": "

Micro-Small Business (<10 staff)

∙ Basic business continuity plan\n∙ Regular data backup

Small Business (10-49 staff)

∙ Business continuity plan\n∙ Tested backup and restore procedures

Medium Business (50-249 staff)

∙ Formal BCP/DRP program\n∙ Regular backup testing\n∙ Alternate processing capability

Large Business (250-999 staff)

∙ Enterprise BCP/DRP program\n∙ DR site\n∙ Annual exercises\n∙ RTO/RPO targets

Enterprise (>1,000 staff)

∙ Enterprise BC/DR platform (e.g., Zerto, Veeam Enterprise)\n∙ Dedicated DR site\n∙ Automated failover\n∙ Annual DR exercises", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69727, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590002", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590002", "securityControlId": 30988, "ccis": [], "uuid": "1c9a5f56-54f2-5823-804e-2491fea5c2b1", "testId": "BCD-04_A01", "test": "the frequency of testing the contingency plan for the system is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-04_ODP[01]", "defaultText": null }, { "id": 69728, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590002", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590002", "securityControlId": 30988, "ccis": [], "uuid": "c88bd9a6-6908-5bc0-9a2e-872961f32c39", "testId": "BCD-04_A02", "test": "tests for determining the effectiveness of the contingency plan are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-04_ODP[02]", "defaultText": null }, { "id": 69729, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590002", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590002", "securityControlId": 30988, "ccis": [], "uuid": "242df903-06c5-5d7a-be6f-a44452df2882", "testId": "BCD-04_A03", "test": "tests for determining readiness to execute the contingency plan are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-04_ODP[03]", "defaultText": null }, { "id": 69730, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590002", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590002", "securityControlId": 30988, "ccis": [], "uuid": "87f81d59-9a58-54a4-aa41-2e1bb98f3534", "testId": "BCD-04_A04", "test": "the contingency plan for the system is tested frequently.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-04a.[01]", "defaultText": null }, { "id": 69731, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590003", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590003", "securityControlId": 30988, "ccis": [], "uuid": "cd5dee8d-e94c-513f-a2fc-5ea19330add2", "testId": "BCD-04_A05", "test": "tests are used to determine the effectiveness of the plan.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: functional exercises", "otherId": "53A_R5_CP-04a.[02]", "defaultText": null }, { "id": 69732, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590003", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590003", "securityControlId": 30988, "ccis": [], "uuid": "bfe791bc-1828-5988-a93a-14e0e1d3f541", "testId": "BCD-04_A06", "test": "tests are used to determine the readiness to execute the plan.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: functional exercises", "otherId": "53A_R5_CP-04a.[03]", "defaultText": null } ], "externalMappings": [ { "id": 553772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ea9b9e6-ac4e-5ef2-8d29-d7b4185d76d2", "parentControlId": 30988, "controlId": "5.29", "title": "5.29", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582251" }, { "id": 553773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd4c4e96-d8dc-5b1e-9d4e-b5c13b1e86dc", "parentControlId": 30988, "controlId": "5.3", "title": "5.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582251" }, { "id": 553778, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e9a736e-1f97-504c-80af-c560609e90a5", "parentControlId": 30988, "controlId": "CP-4", "title": "CP-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582252" }, { "id": 553779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86392351-dff8-5dd9-bd5e-23de8de36ab3", "parentControlId": 30988, "controlId": "CP-04", "title": "CP-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582252" }, { "id": 553781, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72106873-d2f5-5cf3-8195-2efcccd6b63d", "parentControlId": 30988, "controlId": "CP-04", "title": "CP-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582252" }, { "id": 553783, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8147a4bd-49b0-527b-8efd-bc2e3fd302eb", "parentControlId": 30988, "controlId": "CP-04", "title": "CP-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582252" }, { "id": 553784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5c5c807-02bd-531c-8229-8233c1024a74", "parentControlId": 30988, "controlId": "CP-04", "title": "CP-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582252" }, { "id": 553785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "814f2abb-7cc5-54b6-8cad-1f7ba0ba177f", "parentControlId": 30988, "controlId": "CP-04", "title": "CP-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582252" }, { "id": 553786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "488540f5-030b-5289-a56a-10c58319e8df", "parentControlId": 30988, "controlId": "CP-04", "title": "CP-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582252" }, { "id": 553787, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37802b0a-bd13-5a26-a409-9842515bafd5", "parentControlId": 30988, "controlId": "CP-4", "title": "CP-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582252" }, { "id": 553788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef5b8605-0ebe-562b-a0a8-bfaec9a4e63b", "parentControlId": 30988, "controlId": "CP-4", "title": "CP-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582253" }, { "id": 553793, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e15ffda2-1fc2-559a-9729-7f3a4ec6ce46", "parentControlId": 30988, "controlId": "RESPONSE-4i", "title": "RESPONSE-4i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582253" }, { "id": 553794, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b951755-82c8-5d26-a04f-d42f04331f07", "parentControlId": 30988, "controlId": "RESPONSE-4n", "title": "RESPONSE-4n", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582253" }, { "id": 553807, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c513b27-68af-5209-9abf-e19f2091087e", "parentControlId": 30988, "controlId": "CIP-009-6 2.1", "title": "CIP-009-6 2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582255" }, { "id": 553808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7b24fd6-3ce4-5ce4-a870-1d555c8fac6f", "parentControlId": 30988, "controlId": "CIP-009-6 2.3", "title": "CIP-009-6 2.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582255" }, { "id": 553809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ca303e5-4e6a-5309-aabe-ce9ca98ed2bb", "parentControlId": 30988, "controlId": "CIP-009-6 3.1", "title": "CIP-009-6 3.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582255" }, { "controlId": "C.9.3", "title": "C.9.3 — Contingency Plan Testing", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CP-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "25700501-6ae6-57e8-9541-88287cdad4a3", "isPublic": true }, { "controlId": "NEI 08-09 App E.9.3", "title": "NEI 08-09 App E.9.3 — Contingency Plan Testing", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.9.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "7649e943-a156-56ad-b6a1-fad0a89daa59", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3)", "title": "10 CFR 73.54(d)(3) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.9.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "4242b810-102e-5633-8e1d-0c520eab0a65", "isPublic": true }, { "controlId": "CIP-009-6-R2", "title": "CIP-009-6-R2 — Recovery Plan Implementation and Testing", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "98c3241d-1b57-50f1-99c2-0887807d740d", "isPublic": true }, { "controlId": "CIP-009-6-2.1", "title": "CIP-009-6-2.1 — Test each of the recovery plans referenced in Requirement R1 at least once every 15 calendar months", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "376cb98f-3678-54a8-afec-963155e27961", "isPublic": true }, { "controlId": "CIP-009-6-2.2", "title": "CIP-009-6-2.2 — Test a representative sample of information used to recover BES Cyber System functionality at least once every 15 cal...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1f82c920-fd27-5bde-b0a2-02077495085f", "isPublic": true }, { "controlId": "CIP-009-6-2.3", "title": "CIP-009-6-2.3 — Test each of the recovery plans referenced in Requirement R1 at least once every 36 calendar months through an operat...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5064a413-f06e-5bc2-a33a-c15ff97a8362", "isPublic": true }, { "controlId": "CIP-009-6-R3", "title": "CIP-009-6-R3 — Recovery Plan Review and Maintenance", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c13daef8-9632-5da9-85e2-a13906d805fe", "isPublic": true }, { "controlId": "CIP-009-6-3.1", "title": "CIP-009-6-3.1 — No later than 90 calendar days after completion of a recovery plan test or actual recovery: 3.1.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c8ecb7e2-b528-54e1-83c5-b73e314857ba", "isPublic": true }, { "controlId": "CIP-009-6-3.1.1", "title": "CIP-009-6-3.1.1 — Document any lessons learned associated with a recovery plan test or actual recovery or document the absence of any l...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "35219682-7f07-5c8d-a752-b57af407cab3", "isPublic": true }, { "controlId": "CIP-009-6-3.1.2", "title": "CIP-009-6-3.1.2 — Update the recovery plan based on any documented lessons learned associated with the plan", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "09142e4b-0a55-57e4-90ea-70f94b0f6042", "isPublic": true }, { "controlId": "CIP-009-6-3.1.3", "title": "CIP-009-6-3.1.3 — Notify each person or group with a defined role in the recovery plan of the updates to the recovery plan based on any...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d3433235-33cc-5217-b918-2e751f5cb517", "isPublic": true }, { "controlId": "CIP-009-6-3.2", "title": "CIP-009-6-3.2 — No later than 60 calendar days after a change to the roles or responsibilities, responders, or technology that the Re...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "99f08b80-696e-5265-8119-866392c72f0a", "isPublic": true }, { "controlId": "CIP-009-6-3.2.1", "title": "CIP-009-6-3.2.1 — Update the recovery plan", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f8bfd7c0-0249-5d80-837d-37ad8027a5dd", "isPublic": true }, { "controlId": "CIP-009-6-3.2.2", "title": "CIP-009-6-3.2.2 — Notify each person or group with a defined role in the recovery plan of the updates.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5f240271-3de6-5213-8322-82d6840a5771", "isPublic": true }, { "controlId": "NSS-17T-Sec4.8", "title": "NSS-17T-Sec4.8 — Contingency Planning, Backup & Safe-State Recovery", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "c4106b1a-6088-5a92-9171-40ed3f3d58af", "isPublic": true }, { "controlId": "IEC-62645-8.5", "title": "IEC-62645-8.5 — Continuity, Backup, and Recovery of I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "6c5cbc15-b458-50e8-b254-44dc716c59ef", "isPublic": true }, { "controlId": "IEC-63096-17.1", "title": "IEC-63096-17.1 — Operational Continuity and Reconstitution of CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "16b1d37c-68f7-5b08-afcc-f84fa233a16b", "isPublic": true } ], "id": 30988, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730921", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730921", "catalogueId": 1062, "uuid": "6fcaab71-16a0-553c-a6c8-9f974e873d7d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct tests and/or exercises to evaluate the contingency plan's effectiveness and its readiness to execute the plan?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Contingency Plan Testing & Exercises", "description": "

Control Description

Mechanisms exist to conduct tests and/or exercises to evaluate the contingency plan's effectiveness and the organization's readiness to execute the plan.

Evidence Request List (ERL)

E-BCM-06\nE-BCM-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ IT and/or cybersecurity personnel develop limited Disaster Recovery Plans (DRP) to recover business-critical Technology Assets, Applications and/or Services (TAAS) and services.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conduct tests and/or exercises to evaluate the contingency plan's effectiveness and the organization's readiness to execute the plan.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.9.3
NERC-CIP (2026) Requirements: CIP-009-6-R2, CIP-009-6-R3", "controlId": "BCD-04", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-04", "references": "

Micro-Small Business (<10 staff)

∙ Tabletop exercises

Small Business (10-49 staff)

∙ Tabletop exercises

Medium Business (50-249 staff)

∙ Tabletop exercises

Large Business (250-999 staff)

∙ Tabletop exercises\n∙ Simulated events

Enterprise (>1,000 staff)

∙ Tabletop exercises\n∙ Simulated events", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69733, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590003", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590003", "securityControlId": 30989, "ccis": [], "uuid": "9ca4a207-0111-5b4c-a5f3-4a7b91058e83", "testId": "BCD-04.1_A01", "test": "contingency plan testing is coordinated with organizational elements responsible for related plans.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-04(01)", "defaultText": null } ], "externalMappings": [ { "id": 553874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a4cfddd-ef7f-5927-86ee-c744d4712a6f", "parentControlId": 30989, "controlId": "CP-4(1)", "title": "CP-4(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582263" }, { "id": 553875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "672b8334-2abe-5637-aa9b-91d4585e0250", "parentControlId": 30989, "controlId": "CP-04(01)", "title": "CP-04(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582263" }, { "id": 553876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67468dfe-f15a-5f96-8b64-4c1383a24a7a", "parentControlId": 30989, "controlId": "CP-04(01)", "title": "CP-04(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582263" }, { "id": 553877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "735fd766-8a97-549a-af85-6cfcb35fa36a", "parentControlId": 30989, "controlId": "CP-04(01)", "title": "CP-04(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582263" }, { "id": 553878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa4ea2e1-55b7-5334-8d2b-31d7646eeb5a", "parentControlId": 30989, "controlId": "CP-04(01)", "title": "CP-04(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582263" }, { "id": 553879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "004f7a1c-4765-548d-9410-52b788a0684d", "parentControlId": 30989, "controlId": "CP-04(01)", "title": "CP-04(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582263" } ], "id": 30989, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730921", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730921", "catalogueId": 1062, "uuid": "5e8f8494-e0c7-5887-9da9-ac79c396b929", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization coordinate contingency plan testing with internal and external elements responsible for related plans?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Coordinated Testing with Related Plans", "description": "

Control Description

Mechanisms exist to coordinate contingency plan testing with internal and external elements responsible for related plans.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to coordinate contingency plan testing with internal and external elements responsible for related plans.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-04.1", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Tabletop exercises

Small Business (10-49 staff)

∙ Tabletop exercises

Medium Business (50-249 staff)

∙ Tabletop exercises\n∙ Red Team testing\n∙ Penetration testing

Large Business (250-999 staff)

∙ Tabletop exercises\n∙ Red Team testing\n∙ Penetration testing

Enterprise (>1,000 staff)

∙ Tabletop exercises\n∙ Red Team testing\n∙ Penetration testing", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69734, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590003", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590003", "securityControlId": 30990, "ccis": [], "uuid": "55ba36a2-d57a-5431-bf71-28d5ce04ddbd", "testId": "BCD-04.2_A01", "test": "the contingency plan is tested at the alternate processing site to familiarize contingency personnel with the facility and available resources.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-04(02)(a)", "defaultText": null }, { "id": 69735, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590003", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590003", "securityControlId": 30990, "ccis": [], "uuid": "b47bc26c-2d7e-5f4b-8b69-35bf8ab95789", "testId": "BCD-04.2_A02", "test": "the contingency plan is tested at the alternate processing site to evaluate the capabilities of the alternate processing site to support contingency operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-04(02)(b)", "defaultText": null } ], "externalMappings": [ { "id": 553892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d013be5-bdc5-5310-8e8d-585324727803", "parentControlId": 30990, "controlId": "CP-4(2)", "title": "CP-4(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582265" }, { "id": 553893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4571e9be-8c94-51df-84aa-b378e026438d", "parentControlId": 30990, "controlId": "CP-04(02)", "title": "CP-04(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582265" }, { "id": 553894, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a532c4cd-1ddf-53e7-b3c5-a140ee7a4c3d", "parentControlId": 30990, "controlId": "CP-04(02)", "title": "CP-04(02)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582265" }, { "id": 553895, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67c29864-a6d2-5486-ba42-f1f57346d6b9", "parentControlId": 30990, "controlId": "CP-04(02)", "title": "CP-04(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582265" }, { "id": 553896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d9ac02a-fdde-5d01-9c8a-62c5c939cb95", "parentControlId": 30990, "controlId": "CP-04(02)", "title": "CP-04(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582265" } ], "id": 30990, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730921", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730921", "catalogueId": 1062, "uuid": "c3b4abe2-2d2d-5a0f-852e-4afb6ac67f6e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization test contingency plans at alternate storage & processing sites to both familiarize contingency personnel with the facility and evaluate the capabilities of the alternate processing site to support contingency operations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Alternate Storage & Processing Sites", "description": "

Control Description

Mechanisms exist to test contingency plans at alternate storage & processing sites to both familiarize contingency personnel with the facility and evaluate the capabilities of the alternate processing site to support contingency operations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ IT and/or cybersecurity personnel develop limited Disaster Recovery Plans (DRP) to recover business-critical Technology Assets, Applications and/or Services (TAAS) and services.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A dedicated alternate site(s) is/are equipped to be compatible with the production network's processing, storage, connectivity and other infrastructure needs.\n▪ Alternate sites are given priority of service to meet applicable RTOs and/or RPOs.\n▪ RTOs are used to identify business-critical TAASD, which are given priority of service in alternate processing and storage sites.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to test contingency plans at alternate storage & processing sites to both familiarize contingency personnel with the facility and evaluate the capabilities of the alternate processing site to support contingency operations.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-04.2", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-04.2", "references": "

Micro-Small Business (<10 staff)

∙ Failover testing\n∙ On-site visit to alternate site(s)

Small Business (10-49 staff)

∙ Failover testing\n∙ On-site visit to alternate site(s)

Medium Business (50-249 staff)

∙ Failover testing\n∙ On-site visit to alternate site(s)

Large Business (250-999 staff)

∙ Failover testing\n∙ On-site visit to alternate site(s)

Enterprise (>1,000 staff)

∙ Failover testing\n∙ On-site visit to alternate site(s)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69736, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590004", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590004", "securityControlId": 30991, "ccis": [], "uuid": "d529a776-780c-58cd-8079-dfed026a8c9a", "testId": "BCD-05_A01", "test": "the contingency plan test results are reviewed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-04b.", "defaultText": null }, { "id": 69737, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590011", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590011", "securityControlId": 30991, "ccis": [], "uuid": "0a59d91d-480c-5537-ac50-5e480c284fad", "testId": "BCD-05_A02", "test": "corrective actions to remediate contingency plan deficiencies are initiated, if needed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-04c.", "defaultText": null } ], "externalMappings": [ { "id": 553911, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582267", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aca90639-67df-5d37-a9bc-ad46d31a4ddd", "parentControlId": 30991, "controlId": "CP-4", "title": "CP-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582267" }, { "id": 553912, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582267", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8097ece-83a0-5e98-b84c-1e3885e3827d", "parentControlId": 30991, "controlId": "CP-04", "title": "CP-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582267" }, { "id": 553914, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582267", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1a6acd1-7ec0-52ac-9048-698b3d886950", "parentControlId": 30991, "controlId": "CP-04", "title": "CP-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582267" }, { "id": 553916, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf40cf0b-96bf-5ba5-862c-84ee16376d4a", "parentControlId": 30991, "controlId": "CP-04", "title": "CP-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582268" }, { "id": 553917, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77bfd77a-f24e-5908-827c-70b8259464d2", "parentControlId": 30991, "controlId": "CP-04", "title": "CP-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582268" }, { "id": 553918, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd5adf4a-7de1-5df9-9b6c-e018f3487175", "parentControlId": 30991, "controlId": "CP-04", "title": "CP-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582268" }, { "id": 553919, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a15c2d09-01c5-5088-931a-147e1271b669", "parentControlId": 30991, "controlId": "CP-04", "title": "CP-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582268" }, { "id": 553920, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a3d56cd-f109-5d11-8aed-62343b56e218", "parentControlId": 30991, "controlId": "CP-4", "title": "CP-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582268" }, { "id": 553921, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b57720ba-5686-59d3-9bc2-4d207d28a504", "parentControlId": 30991, "controlId": "CP-4", "title": "CP-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582268" }, { "id": 553924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "989db3ac-8fad-5c01-8abf-6540a4823e81", "parentControlId": 30991, "controlId": "ID.IM-02", "title": "ID.IM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582269" }, { "id": 553925, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7c6b70a-044d-58d6-b6ab-7ecb0dffeea3", "parentControlId": 30991, "controlId": "ID.IM-03", "title": "ID.IM-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582269" }, { "id": 553927, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2fdb512-8199-5b60-a873-3b8512f1080d", "parentControlId": 30991, "controlId": "RESPONSE-4o", "title": "RESPONSE-4o", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582269" }, { "id": 553936, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58227", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb87e6ff-9510-512d-a893-0733ebfbce9a", "parentControlId": 30991, "controlId": "CIP-009-6 3.1.1", "title": "CIP-009-6 3.1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58227" }, { "id": 553937, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58227", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff27c3e8-b265-5bfb-885e-eca1987b1c50", "parentControlId": 30991, "controlId": "CIP-009-6 3.1.2", "title": "CIP-009-6 3.1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58227" }, { "controlId": "NSS-17T-Sec4.8", "title": "NSS-17T-Sec4.8 — Contingency Planning, Backup & Safe-State Recovery", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "259cb894-37ac-53c0-aa86-0f2a3e7f6abe", "isPublic": true }, { "controlId": "IEC-62645-8.5", "title": "IEC-62645-8.5 — Continuity, Backup, and Recovery of I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "b6ff434e-6e40-5d7d-84e1-983b69cb0819", "isPublic": true }, { "controlId": "IEC-63096-17.1", "title": "IEC-63096-17.1 — Operational Continuity and Reconstitution of CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "5f578526-4d22-53e7-81dc-264ad7e0007e", "isPublic": true } ], "id": 30991, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730921", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730921", "catalogueId": 1062, "uuid": "2a950186-7229-5b3a-8701-fd6d3c4fede5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct a Root Cause Analysis (RCA) and \"lessons learned\" activity every time the contingency plan is activated?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Contingency Plan Root Cause Analysis (RCA) & Lessons Learned", "description": "

Control Description

Mechanisms exist to conduct a Root Cause Analysis (RCA) and \"lessons learned\" activity every time the contingency plan is activated.

Evidence Request List (ERL)

E-BCM-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conduct a Root Cause Analysis (RCA) and \"lessons learned\" activity every time the contingency plan is activated.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-05", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-05", "references": "

Micro-Small Business (<10 staff)

∙ Root Cause Analysis (RCA) (After Action Review (AAR), lessons learned, etc.)

Small Business (10-49 staff)

∙ Root Cause Analysis (RCA) (After Action Review (AAR), lessons learned, etc.)

Medium Business (50-249 staff)

∙ Root Cause Analysis (RCA) (After Action Review (AAR), lessons learned, etc.)

Large Business (250-999 staff)

∙ Root Cause Analysis (RCA) (After Action Review (AAR), lessons learned, etc.)

Enterprise (>1,000 staff)

∙ Root Cause Analysis (RCA) (After Action Review (AAR), lessons learned, etc.)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69738, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590011", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590011", "securityControlId": 30992, "ccis": [], "uuid": "928dcaf5-dd01-56a1-8f35-efd3337f6fe5", "testId": "BCD-06_A01", "test": "a contingency plan is developed that identifies essential mission and business functions and associated contingency requirements.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-02a.01", "defaultText": null }, { "id": 69739, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590011", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590011", "securityControlId": 30992, "ccis": [], "uuid": "c88e4f5b-82ff-538e-9b4c-840300b0351a", "testId": "BCD-06_A02", "test": "personnel or roles to review a contingency plan is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-02_ODP[01]", "defaultText": null }, { "id": 69740, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590012", "securityControlId": 30992, "ccis": [], "uuid": "8616db9a-4c08-5f0f-8600-59c8e1e97941", "testId": "BCD-06_A03", "test": "the contingency plan is updated to address changes to the organization, system or environment of operation.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-02e.[01]", "defaultText": null }, { "id": 69741, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590012", "securityControlId": 30992, "ccis": [], "uuid": "225bfec9-d0ff-5816-8493-e71555f97972", "testId": "BCD-06_A04", "test": "contingency plan changes are communicated to key contingency personnel.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-02f.[01]", "defaultText": null }, { "id": 69742, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590012", "securityControlId": 30992, "ccis": [], "uuid": "0663f013-161d-54ea-8033-672bc98196b2", "testId": "BCD-06_A05", "test": "the contingency plan is updated to address problems encountered during contingency plan implementation, execution or testing.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02e.[02]", "defaultText": null }, { "id": 69743, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590012", "securityControlId": 30992, "ccis": [], "uuid": "bf60b6db-2206-5b29-967f-ac5e0385582a", "testId": "BCD-06_A06", "test": "personnel or roles to approve a contingency plan is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02_ODP[02]", "defaultText": null }, { "id": 69744, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590012", "securityControlId": 30992, "ccis": [], "uuid": "013c8d2d-24c6-5090-a672-e59a8bbcb656", "testId": "BCD-06_A07", "test": "key contingency personnel (identified by name and/or by role) to whom copies of the contingency plan are distributed are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02_ODP[03]", "defaultText": null }, { "id": 69745, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590012", "securityControlId": 30992, "ccis": [], "uuid": "1ce2454d-a0fd-55a5-84e9-a49725e63428", "testId": "BCD-06_A08", "test": "key contingency organizational elements to which copies of the contingency plan are distributed are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02_ODP[04]", "defaultText": null }, { "id": 69746, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590013", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590013", "securityControlId": 30992, "ccis": [], "uuid": "a33b7eca-a15a-55f2-a607-d63e1a9e1208", "testId": "BCD-06_A09", "test": "the frequency of contingency plan review is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-02_ODP[05]", "defaultText": null }, { "id": 69747, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590013", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590013", "securityControlId": 30992, "ccis": [], "uuid": "50c47881-5b85-5d33-afe4-89d43e74a33c", "testId": "BCD-06_A10", "test": "key contingency personnel (identified by name and/or by role) to communicate changes to are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02_ODP[06]", "defaultText": null }, { "id": 69748, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590013", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590013", "securityControlId": 30992, "ccis": [], "uuid": "9da473b6-795d-529d-b61c-495aacfbfe65", "testId": "BCD-06_A11", "test": "key contingency organizational elements to communicate changes to are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02_ODP[07]", "defaultText": null }, { "id": 69749, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590013", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590013", "securityControlId": 30992, "ccis": [], "uuid": "e48ed08f-be5c-54a3-a3f2-ffe41e84ebf5", "testId": "BCD-06_A12", "test": "a contingency plan for the system is developed that provides recovery objectives.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02a.02[01]", "defaultText": null }, { "id": 69750, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590013", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590013", "securityControlId": 30992, "ccis": [], "uuid": "1c087aee-0c74-589d-abbf-3ad8abbcb5f9", "testId": "BCD-06_A13", "test": "a contingency plan for the system is developed that provides restoration priorities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02a.02[02]", "defaultText": null }, { "id": 69751, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590013", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590013", "securityControlId": 30992, "ccis": [], "uuid": "a428ad52-3ee4-5656-a60b-f3d59584ac23", "testId": "BCD-06_A14", "test": "a contingency plan for the system is developed that provides metrics.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02a.02[03]", "defaultText": null }, { "id": 69752, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590014", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590014", "securityControlId": 30992, "ccis": [], "uuid": "ec44fcb5-20e3-50fe-9163-f74e04062e44", "testId": "BCD-06_A15", "test": "a contingency plan for the system is developed that addresses contingency roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02a.03[01]", "defaultText": null }, { "id": 69753, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590014", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590014", "securityControlId": 30992, "ccis": [], "uuid": "ea873efb-2ea8-5de9-97f0-3ff0390a861d", "testId": "BCD-06_A16", "test": "a contingency plan for the system is developed that addresses contingency responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02a.03[02]", "defaultText": null }, { "id": 69754, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590014", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590014", "securityControlId": 30992, "ccis": [], "uuid": "b557fae7-14f1-5076-9de9-75866a3a686e", "testId": "BCD-06_A17", "test": "a contingency plan for the system is developed that addresses assigned individuals with contact information.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02a.03[03]", "defaultText": null }, { "id": 69755, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590014", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590014", "securityControlId": 30992, "ccis": [], "uuid": "2ebc3225-268c-5d9f-a1ee-5ee302dd0dbf", "testId": "BCD-06_A18", "test": "a contingency plan for the system is developed that addresses maintaining essential mission and business functions despite a disruption, compromise or failure of a system, application or service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02a.04", "defaultText": null }, { "id": 69756, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590014", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590014", "securityControlId": 30992, "ccis": [], "uuid": "676f243e-470a-5d24-8db7-c515e95a9a1d", "testId": "BCD-06_A19", "test": "a contingency plan for the system is developed that addresses eventual, full-system restoration without deterioration of the controls originally planned and implemented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02a.05", "defaultText": null }, { "id": 69757, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590015", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590015", "securityControlId": 30992, "ccis": [], "uuid": "641be809-39e8-5942-bf33-46a19a189b03", "testId": "BCD-06_A20", "test": "a contingency plan for the system is developed that addresses the sharing of contingency information.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02a.06", "defaultText": null }, { "id": 69758, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590015", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590015", "securityControlId": 30992, "ccis": [], "uuid": "36726cc2-d34d-51a9-b968-a2db6b711926", "testId": "BCD-06_A21", "test": "a contingency plan for the system is developed that is reviewed by personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02a.07[01]", "defaultText": null }, { "id": 69759, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590015", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590015", "securityControlId": 30992, "ccis": [], "uuid": "21d4612d-c061-5cac-b70b-1232633953e6", "testId": "BCD-06_A22", "test": "a contingency plan for the system is developed that is approved by personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02a.07[02]", "defaultText": null }, { "id": 69760, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590015", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590015", "securityControlId": 30992, "ccis": [], "uuid": "69d864f3-f2b0-5c4b-a7b2-af4dc7f562ed", "testId": "BCD-06_A23", "test": "copies of the contingency plan are distributed to key contingency personnel.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02b.[01]", "defaultText": null }, { "id": 69761, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590015", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590015", "securityControlId": 30992, "ccis": [], "uuid": "2b507b02-240a-5daf-a6e4-6ce33b18317f", "testId": "BCD-06_A24", "test": "copies of the contingency plan are distributed to organizational elements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02b.[02]", "defaultText": null }, { "id": 69762, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590016", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590016", "securityControlId": 30992, "ccis": [], "uuid": "8048fd67-ec98-55a8-a752-568ee9ee22ba", "testId": "BCD-06_A25", "test": "contingency planning activities are coordinated with incident handling activities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02c.", "defaultText": null }, { "id": 69763, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590016", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590016", "securityControlId": 30992, "ccis": [], "uuid": "cad1910b-3226-5222-95c8-eff6169e64a1", "testId": "BCD-06_A26", "test": "the contingency plan for the system is reviewed frequently.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-02d.", "defaultText": null }, { "id": 69764, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590016", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590016", "securityControlId": 30992, "ccis": [], "uuid": "d413e2e2-fe75-594b-b098-67ea7c3019c7", "testId": "BCD-06_A27", "test": "contingency plan changes are communicated to organizational elements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02f.[02]", "defaultText": null }, { "id": 69765, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590016", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590016", "securityControlId": 30992, "ccis": [], "uuid": "e183cfc8-109c-5350-8950-55022c21505a", "testId": "BCD-06_A28", "test": "lessons learned from contingency plan testing or actual contingency activities are incorporated into contingency testing.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02g.[01]", "defaultText": null }, { "id": 69766, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590016", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590016", "securityControlId": 30992, "ccis": [], "uuid": "28ebff18-b5c1-56f7-8379-24a1b30c42f3", "testId": "BCD-06_A29", "test": "lessons learned from contingency plan training or actual contingency activities are incorporated into contingency testing and training.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02g.[02]", "defaultText": null }, { "id": 69767, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590016", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590016", "securityControlId": 30992, "ccis": [], "uuid": "46fefb51-55a8-5158-8382-e19e0ce93145", "testId": "BCD-06_A30", "test": "the contingency plan is protected from unauthorized disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CP-02h.[01]", "defaultText": null }, { "id": 69768, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590016", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590016", "securityControlId": 30992, "ccis": [], "uuid": "dca4e622-2c51-5376-b9b4-3ead86e1bbaf", "testId": "BCD-06_A31", "test": "the contingency plan is protected from unauthorized modification.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CP-02h.[02]", "defaultText": null } ], "externalMappings": [ { "id": 553987, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0f5b9e8-dd78-5d66-9c1e-56c9b549880f", "parentControlId": 30992, "controlId": "CP-2", "title": "CP-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582276" }, { "id": 553988, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5a496e6-47a6-5605-b8ba-514ec4b07190", "parentControlId": 30992, "controlId": "CP-02", "title": "CP-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582276" }, { "id": 553990, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53f6fd65-1631-5227-8f2f-a6e07ef4a98b", "parentControlId": 30992, "controlId": "CP-02", "title": "CP-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582276" }, { "id": 553991, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef22d075-a628-556a-b97b-e9bd97a34689", "parentControlId": 30992, "controlId": "CP-02", "title": "CP-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582285" }, { "id": 553992, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4738be16-173b-5068-9241-c31b54f72198", "parentControlId": 30992, "controlId": "CP-02", "title": "CP-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582285" }, { "id": 553993, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "342e17fd-a6d3-5416-90a2-6fee67b54c0a", "parentControlId": 30992, "controlId": "CP-02", "title": "CP-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582285" }, { "id": 553994, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e0b1d59-6de8-5eea-9da2-4e3729e8646e", "parentControlId": 30992, "controlId": "CP-02", "title": "CP-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582285" }, { "id": 553995, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d537a63-3237-5568-992a-82b16ad6b19f", "parentControlId": 30992, "controlId": "CP-2", "title": "CP-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582285" }, { "id": 553996, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79378099-9993-5861-857e-ca5626299914", "parentControlId": 30992, "controlId": "CP-2", "title": "CP-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582285" }, { "id": 553999, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b934e8a6-0a7f-525c-872e-715ff469168a", "parentControlId": 30992, "controlId": "ID.IM-04", "title": "ID.IM-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582286" }, { "id": 554001, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "889b122d-327f-504e-b0a2-910909509a43", "parentControlId": 30992, "controlId": "RESPONSE-4p", "title": "RESPONSE-4p", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582286" }, { "id": 554009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d14acc8-93fd-5395-bbde-ba99ed2bb191", "parentControlId": 30992, "controlId": "CIP-009-6 3.1.3", "title": "CIP-009-6 3.1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582287" }, { "id": 554010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82b0e8a3-f2b1-55ad-a69c-5d59661e934d", "parentControlId": 30992, "controlId": "CIP-009-6 3.2.1", "title": "CIP-009-6 3.2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582287" }, { "controlId": "C.9.2", "title": "C.9.2 — Contingency Plan", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CP-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "60dac8cc-23f3-57e5-9404-36df869d6cd1", "isPublic": true }, { "controlId": "NEI 08-09 App E.9.2", "title": "NEI 08-09 App E.9.2 — Contingency Plan", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.9.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "ac10df34-8849-5558-a670-8d79efe9d27d", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3)", "title": "10 CFR 73.54(d)(3) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.9.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "ff3de87b-3ffa-57d0-94c6-b159e7d9a91f", "isPublic": true }, { "controlId": "NSS-17T-Sec4.8", "title": "NSS-17T-Sec4.8 — Contingency Planning, Backup & Safe-State Recovery", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7bb237f8-e83c-5e01-bc54-5bba0a6f9548", "isPublic": true }, { "controlId": "IEC-62645-8.5", "title": "IEC-62645-8.5 — Continuity, Backup, and Recovery of I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "464fdd6b-4011-5f6b-946d-dd2e6d3101df", "isPublic": true }, { "controlId": "IEC-63096-17.1", "title": "IEC-63096-17.1 — Operational Continuity and Reconstitution of CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "b81d2f8b-c1ed-527b-bcba-3269d594ccd2", "isPublic": true } ], "id": 30992, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730922", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730922", "catalogueId": 1062, "uuid": "c150021d-83ec-557e-9c6d-6ae9affa94d7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization update contingency plans due to changes affecting:\n(1) People (e.g., personnel changes);\n(2) Processes (e.g., new, altered or decommissioned business practices, including third-party services)\n(3) Technologies (e.g., new, altered or decommissioned technologies);\n(4) Data (e.g., changes to data flows and/or data repositories);\n(5) Facilities (e.g., new, altered or decommissioned physical infrastructure); and/or\n(6) Feedback from contingency plan testing activities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Ongoing Contingency Planning", "description": "

Control Description

Mechanisms exist to update contingency plans due to changes affecting:\n(1) People (e.g., personnel changes);\n(2) Processes (e.g., new, altered or decommissioned business practices, including third-party services)\n(3) Technologies (e.g., new, altered or decommissioned technologies);\n(4) Data (e.g., changes to data flows and/or data repositories);\n(5) Facilities (e.g., new, altered or decommissioned physical infrastructure); and/or\n(6) Feedback from contingency plan testing activities.

Evidence Request List (ERL)

E-BCM-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Production TAASD support business-critical application and services failover.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to develop BC/DR plans to recover business-critical TAASD.\n▪ Data/process owners conduct a Business Impact Analysis (BIA) at least annually, or after any major technology or process change, to identify TAASD that are critical to the business, as well as single points of failure.\n▪ Business stakeholders and process owners designate alternative decision-makers if primary decision-makers are unavailable.\n▪ Within the BC/DR plans, alternate communications channels are defined if primary means of communication are unavailable.\n▪ RTOs are used to identify business-critical TAASD, which are given priority of service in alternate processing and storage sites.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to update contingency plans due to changes affecting:\n(1) People (e.g., personnel changes);\n(2) Processes (e.g., new, altered or decommissioned business practices, including third-party services)\n(3) Technologies (e.g., new, altered or decommissioned technologies);\n(4) Data (e.g., changes to data flows and/or data repositories);\n(5) Facilities (e.g., new, altered or decommissioned physical infrastructure); and/or\n(6) Feedback from contingency plan testing activities.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.9.2", "controlId": "BCD-06", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-06", "references": "

Micro-Small Business (<10 staff)

∙ Documentation change control

Small Business (10-49 staff)

∙ Documentation change control

Medium Business (50-249 staff)

∙ Documentation change control

Large Business (250-999 staff)

∙ Documentation change control

Enterprise (>1,000 staff)

∙ Documentation change control", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69769, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590017", "securityControlId": 30993, "ccis": [], "uuid": "7299a56b-0430-5b90-b44c-cc595256e7aa", "testId": "BCD-06.1_A01", "test": "the organization identifies components that, if changed, potentially impact the organization's ability to execute contingency plans.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 554021, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd1dfc88-b280-5921-98ab-4485a2ae8619", "parentControlId": 30993, "controlId": "CIP-009-6 3.2", "title": "CIP-009-6 3.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582288" } ], "id": 30993, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730922", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730922", "catalogueId": 1062, "uuid": "f55381b9-fe10-5f29-9246-e445e420891c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify components that potentially impacts the organization's ability to execute contingency plans, including changes to:\n(1) Personnel roles;\n(2) Business processes (including the use of third-party services);\n(3) Deployed technologies; \n(4) Data repositories and/or data flows; and/or\n(5) Physical infrastructure?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Contingency Planning Components", "description": "

Control Description

Mechanisms exist to identify components that potentially impact the organization's ability to execute contingency plans, including changes to:\n(1) Personnel roles;\n(2) Business processes (including the use of third-party services);\n(3) Deployed technologies; \n(4) Data repositories and/or data flows; and/or\n(5) Physical infrastructure.

Evidence Request List (ERL)

E-BCM-17

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify components that potentially impacts the organization's ability to execute contingency plans, including changes to:\n(1) Personnel roles;\n(2) Business processes (including the use of third-party services);\n(3) Deployed technologies; \n(4) Data repositories and/or data flows; and/or\n(5) Physical infrastructure.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-06.1", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-06.1", "references": "

Micro-Small Business (<10 staff)

∙ Basic business continuity plan\n∙ Regular data backup

Small Business (10-49 staff)

∙ Business continuity plan\n∙ Tested backup and restore procedures

Medium Business (50-249 staff)

∙ Formal BCP/DRP program\n∙ Regular backup testing\n∙ Alternate processing capability

Large Business (250-999 staff)

∙ Enterprise BCP/DRP program\n∙ DR site\n∙ Annual exercises\n∙ RTO/RPO targets

Enterprise (>1,000 staff)

∙ Enterprise BC/DR platform (e.g., Zerto, Veeam Enterprise)\n∙ Dedicated DR site\n∙ Automated failover\n∙ Annual DR exercises", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69770, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590017", "securityControlId": 30994, "ccis": [], "uuid": "ef1261dd-171e-5ca4-9bd1-f8f7637c91b4", "testId": "BCD-06.2_A01", "test": "stakeholders for contingency plans are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69771, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590017", "securityControlId": 30994, "ccis": [], "uuid": "32abbf9d-62ca-5c66-8938-bd1966bf71c8", "testId": "BCD-06.2_A02", "test": "stakeholders are informed of changes to contingency plans.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 554023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f7d0f43-24c0-5d4c-84cd-0bfd1cd787f1", "parentControlId": 30994, "controlId": "CIP-009-6 3.2.2", "title": "CIP-009-6 3.2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582289" } ], "id": 30994, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730922", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730922", "catalogueId": 1062, "uuid": "63b5eec7-cdf7-5451-8b09-768397699e32", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization keep stakeholders informed of changes to contingency plans?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Contingency Plan Update Notifications", "description": "

Control Description

Mechanisms exist to keep stakeholders informed of changes to contingency plans.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to keep stakeholders informed of changes to contingency plans.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-06.2", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-06.2", "references": "

Micro-Small Business (<10 staff)

∙ Basic business continuity plan\n∙ Regular data backup

Small Business (10-49 staff)

∙ Business continuity plan\n∙ Tested backup and restore procedures

Medium Business (50-249 staff)

∙ Formal BCP/DRP program\n∙ Regular backup testing\n∙ Alternate processing capability

Large Business (250-999 staff)

∙ Enterprise BCP/DRP program\n∙ DR site\n∙ Annual exercises\n∙ RTO/RPO targets

Enterprise (>1,000 staff)

∙ Enterprise BC/DR platform (e.g., Zerto, Veeam Enterprise)\n∙ Dedicated DR site\n∙ Automated failover\n∙ Annual DR exercises", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69772, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590017", "securityControlId": 30995, "ccis": [], "uuid": "65712feb-7a71-55b1-9211-f2ec4c48f0b4", "testId": "BCD-07_A01", "test": "alternative or supplemental security mechanisms are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-13_ODP[01]", "defaultText": null }, { "id": 69773, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590017", "securityControlId": 30995, "ccis": [], "uuid": "663475f5-b6cf-57e8-891e-e00591dffdca", "testId": "BCD-07_A02", "test": "alternative or supplemental security mechanisms are employed for satisfying security functions when the primary means of implementing the security function is unavailable or compromised.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-13", "defaultText": null }, { "id": 69774, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590018", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590018", "securityControlId": 30995, "ccis": [], "uuid": "a28477ca-58e8-55ed-a3d2-215a1e32eb13", "testId": "BCD-07_A03", "test": "security functions are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-13_ODP[02]", "defaultText": null } ], "externalMappings": [ { "id": 554026, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8eeb6bf-0859-5885-acec-97f935a3ba56", "parentControlId": 30995, "controlId": "CP-13", "title": "CP-13", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582289" }, { "id": 554027, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78eb69e9-eb37-542c-b4c6-7ababa403416", "parentControlId": 30995, "controlId": "CP-13", "title": "CP-13", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582289" }, { "id": 554028, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "878dce7c-27c9-5d2d-adc6-05b1eddde87f", "parentControlId": 30995, "controlId": "CP-13", "title": "CP-13", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582289" }, { "controlId": "NSS-17T-Sec4.8", "title": "NSS-17T-Sec4.8 — Contingency Planning, Backup & Safe-State Recovery", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "346c070a-0024-5064-af6d-5572b14eb76f", "isPublic": true }, { "controlId": "IEC-62645-8.5", "title": "IEC-62645-8.5 — Continuity, Backup, and Recovery of I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "9d6d1e1a-83ff-5cf3-91dd-6de5e21b35cd", "isPublic": true }, { "controlId": "IEC-63096-17.1", "title": "IEC-63096-17.1 — Operational Continuity and Reconstitution of CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "93d2bae0-a367-5a8d-b7cd-d9b9f245b11e", "isPublic": true } ], "id": 30995, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730923", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730923", "catalogueId": 1062, "uuid": "658cc608-002b-56cf-bf19-878cb7cdbe00", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement alternative or compensating controls to satisfy security functions when the primary means of implementing the security function is unavailable or compromised?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Alternative Security Measures", "description": "

Control Description

Mechanisms exist to implement alternative or compensating controls to satisfy security functions when the primary means of implementing the security function is unavailable or compromised.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement alternative or compensating controls to satisfy security functions when the primary means of implementing the security function is unavailable or compromised.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-07", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-07", "references": "

Micro-Small Business (<10 staff)

∙ Compensating controls\n∙ Configuration management practices

Small Business (10-49 staff)

∙ Compensating controls\n∙ Configuration management practices

Medium Business (50-249 staff)

∙ Compensating controls\n∙ Configuration management practices

Large Business (250-999 staff)

∙ Compensating controls\n∙ Configuration management practices

Enterprise (>1,000 staff)

∙ Compensating controls\n∙ Configuration management practices", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69775, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590018", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590018", "securityControlId": 30996, "ccis": [], "uuid": "470b145b-acfb-5798-85b4-a1cb85834463", "testId": "BCD-08_A01", "test": "an alternate storage site is established.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CP-06a.[01]", "defaultText": null }, { "id": 69776, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590018", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590018", "securityControlId": 30996, "ccis": [], "uuid": "9cdb6dcf-5fbe-5162-8df4-b271095b77c4", "testId": "BCD-08_A02", "test": "establishment of the alternate storage site includes necessary agreements to permit the storage and retrieval of system backup information.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_CP-06a.[02]", "defaultText": null }, { "id": 69777, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590018", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590018", "securityControlId": 30996, "ccis": [], "uuid": "58666c7c-a678-51e2-92b0-419f883be8fd", "testId": "BCD-08_A03", "test": "the alternate storage site provides controls equivalent to that of the primary site.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_CP-06b.", "defaultText": null }, { "id": 69778, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590018", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590018", "securityControlId": 30996, "ccis": [], "uuid": "70fb6040-4065-53f4-b433-197fa0460f1d", "testId": "BCD-08_A04", "test": "the location or site of the facility where the system resides is planned considering physical and environmental hazards.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-23a.", "defaultText": null } ], "externalMappings": [ { "id": 554036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58229", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcaa5af0-9360-5f90-9d96-b80b15cdc43b", "parentControlId": 30996, "controlId": "8.14", "title": "8.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58229" }, { "id": 554039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58229", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60d752e5-2a74-526b-8bee-72088f169bc9", "parentControlId": 30996, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582291" }, { "id": 554040, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30e185a5-1048-52e4-b81d-d88b9802f0ce", "parentControlId": 30996, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582291" }, { "id": 554041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6c6e4e1-c8e6-556f-8704-c894d889874b", "parentControlId": 30996, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582291" }, { "id": 554042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "146617a1-ced6-57b0-871d-20986700a999", "parentControlId": 30996, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582291" }, { "id": 554043, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9743c3c5-0862-5fd7-9190-1ec9254a9405", "parentControlId": 30996, "controlId": "T1119", "title": "T1119", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582291" }, { "id": 554044, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff64c8a6-3942-563c-a472-1319586cfeba", "parentControlId": 30996, "controlId": "T1486", "title": "T1486", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582291" }, { "id": 554045, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd1943ce-7621-5cd3-bb45-262825afdbea", "parentControlId": 30996, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582291" }, { "id": 554046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "558cd79b-0ee1-54aa-8029-5c0188429cd1", "parentControlId": 30996, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582292" }, { "id": 554048, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a881254-4756-5dae-aa17-7329e19b3316", "parentControlId": 30996, "controlId": "CP-6", "title": "CP-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582292" }, { "id": 554049, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8381de25-006a-5df0-a1b7-6c44fdf99a5b", "parentControlId": 30996, "controlId": "CP-06", "title": "CP-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582292" }, { "id": 554050, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48c0f0bc-b264-50eb-ae92-b7689f3de7fe", "parentControlId": 30996, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582292" }, { "id": 554052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1eb366d7-28d8-5d09-97b4-8120504882bb", "parentControlId": 30996, "controlId": "CP-06", "title": "CP-06", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582292" }, { "id": 554053, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b439af4c-1c2b-5e33-96d9-257220c9eb41", "parentControlId": 30996, "controlId": "CP-06", "title": "CP-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582292" }, { "id": 554054, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95afc48c-3378-5b98-a6bc-beffeb0e4469", "parentControlId": 30996, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582292" }, { "id": 554055, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1363bff2-d410-52cc-b0c7-3c74eb4772a0", "parentControlId": 30996, "controlId": "CP-06", "title": "CP-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582293" }, { "id": 554056, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd694044-78e5-52e1-b64d-757a4726b8c4", "parentControlId": 30996, "controlId": "CP-06", "title": "CP-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582293" }, { "id": 554057, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46b0afb7-84eb-5ac0-89df-b37536b7986d", "parentControlId": 30996, "controlId": "CP-6", "title": "CP-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582293" }, { "id": 554058, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16aa103c-bdd5-5f18-8a80-75520fa523a8", "parentControlId": 30996, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582293" }, { "id": 554059, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ca5a301-9294-5c08-a3a4-2ebd14d0d1da", "parentControlId": 30996, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582293" }, { "controlId": "C.9.5", "title": "C.9.5 — Alternate Storage Site and Location for Backups", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CP-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "8d295e2f-437d-570b-89a9-c43a2d59ff0e", "isPublic": true }, { "controlId": "NEI 08-09 App E.9.5", "title": "NEI 08-09 App E.9.5 — Alternate Storage Site and Location for Backups", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.9.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "642d3b2f-2cd8-578a-9786-076a8f15e96d", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3)", "title": "10 CFR 73.54(d)(3) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.9.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "dd548f57-9bea-548f-ba8c-18808071ce1b", "isPublic": true }, { "controlId": "NSS-17T-Sec4.8", "title": "NSS-17T-Sec4.8 — Contingency Planning, Backup & Safe-State Recovery", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "8614296d-6740-599a-b771-7556897f0871", "isPublic": true }, { "controlId": "IEC-62645-8.5", "title": "IEC-62645-8.5 — Continuity, Backup, and Recovery of I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "8091a0f7-5d31-556a-ab33-57a46225b298", "isPublic": true }, { "controlId": "IEC-63096-17.1", "title": "IEC-63096-17.1 — Operational Continuity and Reconstitution of CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "73c97234-19bd-5d93-a5b6-50c32e728a7c", "isPublic": true } ], "id": 30996, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730923", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730923", "catalogueId": 1062, "uuid": "c2956866-4beb-5374-8769-b10f2c4da950", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish an alternate storage site that includes both the assets and necessary agreements to permit the storage and recovery of system backup information?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Alternate Storage Site", "description": "

Control Description

Mechanisms exist to establish an alternate storage site that includes both the assets and necessary agreements to permit the storage and recovery of system backup information.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to establish an alternate storage site that includes both the assets and necessary agreements to permit the storage and recovery of system backup information.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.9.5", "controlId": "BCD-08", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-08", "references": "

Micro-Small Business (<10 staff)

∙ Cloud-based backup storage: AWS S3, Azure Blob Storage, or Backblaze B2\n∙ Off-site backup media storage (e.g., Iron Mountain)

Small Business (10-49 staff)

∙ Cloud-based backup storage: AWS S3, Azure Blob Storage, or Backblaze B2\n∙ Off-site backup media storage (e.g., Iron Mountain)

Medium Business (50-249 staff)

∙ AWS S3 / Azure Blob / Google Cloud Storage\n∙ Managed backup service (e.g., Veeam Cloud Connect, Acronis Cloud Backup)\n∙ Geographically separated alternate storage site

Large Business (250-999 staff)

∙ AWS / Azure / Google Cloud alternate storage region\n∙ Enterprise backup solution with cloud tiering (e.g., Veeam, Commvault)\n∙ Geographically separated alternate storage site with tested recovery

Enterprise (>1,000 staff)

∙ Multi-region cloud storage (AWS, Azure, or Google Cloud)\n∙ Enterprise backup and DR platform (e.g., Commvault, Veeam Enterprise, Zerto)\n∙ Alternate storage site with defined SLAs and tested failover\n∙ NIST SP 800-34 contingency planning alignment", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69779, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590019", "securityControlId": 30997, "ccis": [], "uuid": "2e351486-f96f-5bbf-9618-3597ca11e63a", "testId": "BCD-08.1_A01", "test": "an alternate storage site that is sufficiently separated from the primary storage site is identified to reduce susceptibility to the same threats.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-06(01)", "defaultText": null } ], "externalMappings": [ { "id": 554090, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba4e2f76-7295-5300-ab10-6c4b18a388c0", "parentControlId": 30997, "controlId": "CP-6(1)", "title": "CP-6(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582297" }, { "id": 554091, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b027e5a4-1a08-57e0-ac80-b5b1f65f0679", "parentControlId": 30997, "controlId": "CP-06(01)", "title": "CP-06(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582297" }, { "id": 554092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8b0a69d-cef5-51a6-86b8-46211a1de210", "parentControlId": 30997, "controlId": "CP-06(01)", "title": "CP-06(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582297" }, { "id": 554093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b925418e-564d-5c59-bc9a-aaf2003a3170", "parentControlId": 30997, "controlId": "CP-06(01)", "title": "CP-06(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582297" }, { "id": 554094, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51e8bee2-3ce9-586f-94f1-25324dd9fadf", "parentControlId": 30997, "controlId": "CP-06(01)", "title": "CP-06(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582297" }, { "id": 554095, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c2268ce-dabf-5528-935c-3a4a1f854991", "parentControlId": 30997, "controlId": "CP-06(01)", "title": "CP-06(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582298" }, { "id": 554096, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53fcdd78-8b74-5998-b0df-b5b7d7dea3c0", "parentControlId": 30997, "controlId": "CP-6(1)", "title": "CP-6(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582298" } ], "id": 30997, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730923", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730923", "catalogueId": 1062, "uuid": "b8a417b5-75d7-519a-915a-05e6d891b144", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization separate the alternate storage site from the primary storage site to reduce susceptibility to similar threats?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Separation from Primary Storage Site", "description": "

Control Description

Mechanisms exist to separate the alternate storage site from the primary storage site to reduce susceptibility to similar threats.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to separate the alternate storage site from the primary storage site to reduce susceptibility to similar threats.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-08.1", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-08.1", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69780, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590019", "securityControlId": 30998, "ccis": [], "uuid": "5e4c8671-0cd2-5eef-b249-31ba03c835c2", "testId": "BCD-08.2_A01", "test": "potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-06(03)[01]", "defaultText": null }, { "id": 69781, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590019", "securityControlId": 30998, "ccis": [], "uuid": "6ed08ac0-0674-5287-be12-154535e909db", "testId": "BCD-08.2_A02", "test": "explicit mitigation actions to address identified accessibility problems are outlined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-06(03)[02]", "defaultText": null } ], "externalMappings": [ { "id": 554109, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81ccb0da-0844-5407-b569-5e2a82f4ff42", "parentControlId": 30998, "controlId": "CP-6(3)", "title": "CP-6(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582299" }, { "id": 554110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e2a5d52-1957-5e56-8e1d-d53143c3869d", "parentControlId": 30998, "controlId": "CP-06(03)", "title": "CP-06(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582299" }, { "id": 554111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d74ed35-43d6-5e43-8a54-1f6891d43263", "parentControlId": 30998, "controlId": "CP-06(03)", "title": "CP-06(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582299" }, { "id": 554112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21828ea5-fbd8-536a-a496-d8313fad0c68", "parentControlId": 30998, "controlId": "CP-06(03)", "title": "CP-06(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582299" }, { "id": 554113, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5823", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b251a21a-ac98-54a5-bfce-4a8acd5a6412", "parentControlId": 30998, "controlId": "CP-06(03)", "title": "CP-06(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5823" }, { "id": 554114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5823", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2937ffd4-a6b8-558e-a48c-09b34b8ce8cf", "parentControlId": 30998, "controlId": "CP-06(03)", "title": "CP-06(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5823" } ], "id": 30998, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730924", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730924", "catalogueId": 1062, "uuid": "51cf7d5a-cb3c-558b-b1fa-fa5290f1cc88", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify and mitigate potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Primary Storage Site Accessibility", "description": "

Control Description

Mechanisms exist to identify and mitigate potential accessibility problems to the alternate storage sites in the event of an area-wide disruption or disaster.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify and mitigate potential accessibility problems to the alternate storage sites in the event of an area-wide disruption or disaster.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-08.2", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-08.2", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69782, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590019", "securityControlId": 30999, "ccis": [], "uuid": "a5822335-375a-52d1-a5fe-7838e9d0dd2f", "testId": "BCD-09_A01", "test": "system operations for essential mission and business functions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-07_ODP[01]", "defaultText": null }, { "id": 69783, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59002", "securityControlId": 30999, "ccis": [], "uuid": "4401bdaa-2620-5e44-a8fc-0091cba347a7", "testId": "BCD-09_A02", "test": "time period consistent with recovery time and recovery point objectives is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-07_ODP[02]", "defaultText": null }, { "id": 69784, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59002", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59002", "securityControlId": 30999, "ccis": [], "uuid": "c4f31181-9ab2-54dc-a445-c3aebd52d7aa", "testId": "BCD-09_A03", "test": "an alternate processing site, including necessary agreements to permit the transfer and resumption of system operations for essential mission and business functions, is established within an organization-defined time period when the primary processing capabilities are unavailable.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-07a.", "defaultText": null }, { "id": 69785, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59002", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59002", "securityControlId": 30999, "ccis": [], "uuid": "2663d705-5124-5650-9dbf-0b3fec96d1b4", "testId": "BCD-09_A04", "test": "the equipment and supplies required to transfer operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within an organization-specified time period for transfer.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-07b.[01]", "defaultText": null }, { "id": 69786, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59002", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59002", "securityControlId": 30999, "ccis": [], "uuid": "9ce01a47-5332-581c-9128-4078dffef2ba", "testId": "BCD-09_A05", "test": "the equipment and supplies required to resume operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within an organization-defined time period for resumption.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-07b.[02]", "defaultText": null }, { "id": 69787, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590022", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590022", "securityControlId": 30999, "ccis": [], "uuid": "070f7ff1-b6db-571a-88a1-9f85bfd4dc00", "testId": "BCD-09_A06", "test": "controls provided at the alternate processing site are equivalent to those at the primary site.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-07c.", "defaultText": null }, { "id": 69788, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590022", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590022", "securityControlId": 30999, "ccis": [], "uuid": "48df0c19-d5e5-5d43-a5f5-0f36436f21e7", "testId": "BCD-09_A07", "test": "the location or site of the facility where the system resides is planned considering physical and environmental hazards.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-23a.", "defaultText": null } ], "externalMappings": [ { "id": 554128, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582301", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b8d5557-6304-568d-80fd-1412fe6f0eff", "parentControlId": 30999, "controlId": "8.14", "title": "8.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582301" }, { "id": 554131, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31c16c74-bbaa-59f7-b38b-1db5e9d11618", "parentControlId": 30999, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582302" }, { "id": 554132, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51a43427-c339-5abf-8247-0b77548473a5", "parentControlId": 30999, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582302" }, { "id": 554133, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2cbb7576-c20c-515b-8199-41d0fc225300", "parentControlId": 30999, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582302" }, { "id": 554134, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c384f2f-3392-57c7-b4fb-fc4ee0b10a0e", "parentControlId": 30999, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582302" }, { "id": 554135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7e81f1a-6a2e-5036-83d7-1993bca568c6", "parentControlId": 30999, "controlId": "T1119", "title": "T1119", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582302" }, { "id": 554136, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9dc9bd2-5fa4-5130-ba69-6e42a3322c5c", "parentControlId": 30999, "controlId": "T1485", "title": "T1485", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582302" }, { "id": 554137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aeff0e7a-ae44-536c-b26b-bd38d580116f", "parentControlId": 30999, "controlId": "T1486", "title": "T1486", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582302" }, { "id": 554138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3623c60a-077e-512c-a21a-827057892f7c", "parentControlId": 30999, "controlId": "T1490", "title": "T1490", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582303" }, { "id": 554139, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79c3522c-4ce2-58a2-8022-d338bf31fbaf", "parentControlId": 30999, "controlId": "T1491", "title": "T1491", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582303" }, { "id": 554140, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9513f26f-56af-53dd-9a1c-fa289362a2e0", "parentControlId": 30999, "controlId": "T1491.001", "title": "T1491.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582303" }, { "id": 554141, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86d91869-b590-511d-8c47-2545768fe1d4", "parentControlId": 30999, "controlId": "T1491.002", "title": "T1491.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582303" }, { "id": 554142, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb6750ac-3cb2-510a-95d0-b7edbb687aee", "parentControlId": 30999, "controlId": "T1561", "title": "T1561", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582303" }, { "id": 554143, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "987d87fd-68e0-596f-ab47-7a9b9060d83e", "parentControlId": 30999, "controlId": "T1561.001", "title": "T1561.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582303" }, { "id": 554144, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "916a1122-c825-54cb-9f2f-013a9e77fee6", "parentControlId": 30999, "controlId": "T1561.002", "title": "T1561.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582303" }, { "id": 554145, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b250eb0e-6d5b-5280-91fa-962c0f51d16b", "parentControlId": 30999, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582303" }, { "id": 554146, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c11f5bcd-8ba1-5b19-ad33-754549e8e1e7", "parentControlId": 30999, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582304" }, { "id": 554148, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bb6f373-a773-5c11-be9f-a67b7c76bd5d", "parentControlId": 30999, "controlId": "CP-7", "title": "CP-7", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582304" }, { "id": 554149, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d9a7597-a3ad-59b7-8922-08e093259be2", "parentControlId": 30999, "controlId": "CP-07", "title": "CP-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582304" }, { "id": 554150, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19c28945-c91b-52ba-b54e-0b6a8593f1b9", "parentControlId": 30999, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582304" }, { "id": 554152, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b2dd93b-0e64-5b9b-90d3-60deb29f8883", "parentControlId": 30999, "controlId": "CP-07", "title": "CP-07", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582304" }, { "id": 554153, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ee74c2d-f545-5cdf-82ef-c27cc00aa90b", "parentControlId": 30999, "controlId": "CP-07", "title": "CP-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582304" }, { "id": 554154, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80b414c6-955d-5cd9-aae3-3d86463bcf1c", "parentControlId": 30999, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582304" }, { "id": 554155, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "523ade86-1b3f-5404-b4cf-dd04a854a8ec", "parentControlId": 30999, "controlId": "CP-07", "title": "CP-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582305" }, { "id": 554156, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "569ee36e-714e-5aa5-becf-134838dd16f0", "parentControlId": 30999, "controlId": "CP-07", "title": "CP-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582305" }, { "id": 554157, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b76bbae5-be97-5915-b34e-88ba3ec0051e", "parentControlId": 30999, "controlId": "CP-7", "title": "CP-7", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582305" }, { "id": 554158, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e94bba91-c6bd-5e4e-81e2-a8b04056a8fc", "parentControlId": 30999, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582305" }, { "id": 554159, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92128fe8-cc11-5026-a62a-7f86192d263f", "parentControlId": 30999, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582305" }, { "controlId": "CIP-012-1-R1", "title": "CIP-012-1-R1 — Real-time Assessment and Monitoring Data Protection Between Control Centers", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ebab7eb1-6405-51bb-9e12-a619b6f4592e", "isPublic": true }, { "controlId": "CIP-012-1-1.1", "title": "CIP-012-1-1.1 — Identification of security protection used to mitigate the risks posed by unauthorized disclosure and unauthorized mo...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-012-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ab2190da-5b08-5912-a348-8b75f882a724", "isPublic": true }, { "controlId": "CIP-012-1-1.2", "title": "CIP-012-1-1.2 — Identification of where the Responsible Entity applied security protection for transmitting Real-time Assessment and...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-012-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2cc318f3-dc66-5b13-b58c-4c1d5eb1c799", "isPublic": true }, { "controlId": "CIP-012-1-1.3", "title": "CIP-012-1-1.3 — If the Control Centers are owned or operated by different Responsible Entities, identification of the responsibilitie...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-012-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ed0b0cdc-1ba3-56dc-8b3c-6a6e5e5fed22", "isPublic": true }, { "controlId": "CIP-012-2-1.1", "title": "CIP-012-2-1.1 — Risk Mitigation for Availability, Integrity, and Confidentiality of Real-Time Data (CIP-012-2)", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-012-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d68c9e5c-afb5-51d6-9299-21e4b950cd4c", "isPublic": true }, { "controlId": "NSS-17T-Sec4.8", "title": "NSS-17T-Sec4.8 — Contingency Planning, Backup & Safe-State Recovery", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "fad4da50-6f03-5f62-a1d1-5f298646ec94", "isPublic": true }, { "controlId": "IEC-62645-8.5", "title": "IEC-62645-8.5 — Continuity, Backup, and Recovery of I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "024eeb3f-d440-5cdc-a0b9-17bfe3e0e6d3", "isPublic": true }, { "controlId": "IEC-63096-17.1", "title": "IEC-63096-17.1 — Operational Continuity and Reconstitution of CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "e5631efb-31db-522f-bb20-d3544f07efca", "isPublic": true } ], "id": 30999, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730924", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730924", "catalogueId": 1062, "uuid": "592b88e1-166d-5808-bc9c-c1fbd301cf35", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish an alternate processing site that provides security measures equivalent to that of the primary site?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Alternate Processing Site", "description": "

Control Description

Mechanisms exist to establish an alternate processing site that provides security measures equivalent to that of the primary site.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to establish an alternate processing site that provides security measures equivalent to that of the primary site.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

NERC-CIP (2026) Requirements: CIP-012-1-R1", "controlId": "BCD-09", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-09", "references": "

Micro-Small Business (<10 staff)

∙ Cloud-based alternate processing (AWS, Azure, or Google Cloud)\n∙ Documented recovery procedures to cloud fallback

Small Business (10-49 staff)

∙ Cloud-based alternate processing (AWS, Azure, or Google Cloud)\n∙ Basic DR runbooks and cloud failover procedures

Medium Business (50-249 staff)

∙ Cloud-based warm/hot site (AWS, Azure, GCP)\n∙ Managed DR service (e.g., AWS Elastic Disaster Recovery, Azure Site Recovery)\n∙ Documented and tested failover procedures

Large Business (250-999 staff)

∙ AWS Elastic Disaster Recovery or Azure Site Recovery\n∙ Cloud-based or colocation alternate processing site\n∙ Regular failover testing with documented RTO/RPO validation

Enterprise (>1,000 staff)

∙ Enterprise DR platform with automated failover (e.g., Zerto, Veeam Replication, AWS DRS)\n∙ Geographically separate alternate processing site (cloud or colocation)\n∙ Regularly tested failover with RTO/RPO compliance verification\n∙ NIST SP 800-34 contingency planning alignment", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69789, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590022", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590022", "securityControlId": 31000, "ccis": [], "uuid": "9ae4ad29-7c99-54d7-ac85-7564b7961ad6", "testId": "BCD-09.1_A01", "test": "an alternate processing site is sufficiently separated from the primary processing site to reduce susceptibility to the same threats is identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-07(01)", "defaultText": null } ], "externalMappings": [ { "id": 554200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58231", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a568a1c3-7921-5ff5-93b1-29563b33b69e", "parentControlId": 31000, "controlId": "CP-7(1)", "title": "CP-7(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58231" }, { "id": 554201, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58231", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "477c66b7-29b6-5b54-b93a-3c3b7d0aec4e", "parentControlId": 31000, "controlId": "CP-07(01)", "title": "CP-07(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58231" }, { "id": 554202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58231", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb49e48e-9967-5adb-82e5-447d24813bc4", "parentControlId": 31000, "controlId": "CP-07(01)", "title": "CP-07(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58231" }, { "id": 554203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58231", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce826e7f-97ad-5ed1-b79d-b24f004fe8f1", "parentControlId": 31000, "controlId": "CP-07(01)", "title": "CP-07(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58231" }, { "id": 554204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58231", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "512270fa-859e-54ac-9614-a95e98f3cd60", "parentControlId": 31000, "controlId": "CP-07(01)", "title": "CP-07(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58231" }, { "id": 554205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58231", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2cca2f32-1b86-5cc0-89d5-6e18234263a4", "parentControlId": 31000, "controlId": "CP-07(01)", "title": "CP-07(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58231" } ], "id": 31000, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730924", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730924", "catalogueId": 1062, "uuid": "558cd846-f3d7-56d9-ba8c-fbed5ed49ffe", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization separate the alternate processing site from the primary processing site to reduce susceptibility to similar threats?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Separation from Primary Processing Site", "description": "

Control Description

Mechanisms exist to separate the alternate processing site from the primary processing site to reduce susceptibility to similar threats.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to separate the alternate processing site from the primary processing site to reduce susceptibility to similar threats.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-09.1", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-09.1", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69790, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590023", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590023", "securityControlId": 31001, "ccis": [], "uuid": "80ae7aea-8cf9-5713-96e6-40e1d2baf43f", "testId": "BCD-09.2_A01", "test": "potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-07(02)[01]", "defaultText": null }, { "id": 69791, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590023", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590023", "securityControlId": 31001, "ccis": [], "uuid": "19c8b94d-e85f-5593-a8f6-14ede949d6c3", "testId": "BCD-09.2_A02", "test": "explicit mitigation actions to address identified accessibility problems are outlined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-07(02)[02]", "defaultText": null } ], "externalMappings": [ { "id": 554217, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b6de8c5-063c-5efe-b0c6-d3964c5c40d4", "parentControlId": 31001, "controlId": "CP-7(2)", "title": "CP-7(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582313" }, { "id": 554218, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9518c176-c327-5cec-96ca-207163ac247d", "parentControlId": 31001, "controlId": "CP-07(02)", "title": "CP-07(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582313" }, { "id": 554219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "580758a7-e749-5514-b0ce-63c504615f9f", "parentControlId": 31001, "controlId": "CP-07(02)", "title": "CP-07(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582313" }, { "id": 554221, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cfdc7270-7707-59b8-a5bf-c93c736ea1c2", "parentControlId": 31001, "controlId": "CP-07(02)", "title": "CP-07(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582313" }, { "id": 554222, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd1b1042-84ef-50b8-b803-0c958ab84f4e", "parentControlId": 31001, "controlId": "CP-07(02)", "title": "CP-07(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582313" }, { "id": 554223, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e26589aa-a03d-5e4e-a13e-c0ffeba7ccbc", "parentControlId": 31001, "controlId": "CP-07(02)", "title": "CP-07(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582313" } ], "id": 31001, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730925", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730925", "catalogueId": 1062, "uuid": "8aaebb05-3607-5078-b7a3-c4c6be4124c4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify and mitigate potential accessibility problems to the alternate processing site and possible mitigation actions, in the event of an area-wide disruption or disaster?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Alternate Processing Site Accessibility", "description": "

Control Description

Mechanisms exist to identify and mitigate potential accessibility problems to the alternate processing sites and possible mitigation actions, in the event of an area-wide disruption or disaster.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify and mitigate potential accessibility problems to the alternate processing sites and possible mitigation actions, in the event of an area-wide disruption or disaster.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-09.2", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-09.2", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69792, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590023", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590023", "securityControlId": 31002, "ccis": [], "uuid": "8f7d2132-1257-53db-bf2d-4ac5fa631539", "testId": "BCD-09.3_A01", "test": "alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-07(03)", "defaultText": null } ], "externalMappings": [ { "id": 554236, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "478ef438-740a-518f-ba06-343a528181ef", "parentControlId": 31002, "controlId": "CP-7(3)", "title": "CP-7(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582315" }, { "id": 554237, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "239f9691-dbd4-54c3-8433-a4a6878689a5", "parentControlId": 31002, "controlId": "CP-07(03)", "title": "CP-07(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582315" }, { "id": 554238, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc020a48-db1b-547e-beba-a88a07491567", "parentControlId": 31002, "controlId": "CP-07(03)", "title": "CP-07(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582315" }, { "id": 554239, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bd80b95-7cde-5403-85da-8ac9f8840bc4", "parentControlId": 31002, "controlId": "CP-07(03)", "title": "CP-07(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582315" }, { "id": 554240, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bafc16da-7998-5241-a247-df2a8362b3ff", "parentControlId": 31002, "controlId": "CP-07(03)", "title": "CP-07(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582315" }, { "id": 554241, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43741a94-f3c4-5e1a-8c28-489e7eaa76d4", "parentControlId": 31002, "controlId": "CP-07(03)", "title": "CP-07(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582316" } ], "id": 31002, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730925", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730925", "catalogueId": 1062, "uuid": "0bf42fa4-ac7d-55e1-a200-e452db023515", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization address priority-of-service provisions in alternate processing and storage sites that support availability requirements, including Recovery Time Objectives (RTOs)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Alternate Site Priority of Service", "description": "

Control Description

Mechanisms exist to address priority-of-service provisions in alternate processing and storage sites that support availability requirements, including Recovery Time Objectives (RTOs).

Evidence Request List (ERL)

E-TPM-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to address priority-of-service provisions in alternate processing and storage sites that support availability requirements, including Recovery Time Objectives (RTOs).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-09.3", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-09.3", "references": "

Micro-Small Business (<10 staff)

∙ Priority-of-service contract provisions for hot / warm / cold sites.

Small Business (10-49 staff)

∙ Priority-of-service contract provisions for hot / warm / cold sites.

Medium Business (50-249 staff)

∙ Priority-of-service contract provisions for hot / warm / cold sites.

Large Business (250-999 staff)

∙ Priority-of-service contract provisions for hot / warm / cold sites.

Enterprise (>1,000 staff)

∙ Priority-of-service contract provisions for hot / warm / cold sites.", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69793, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590023", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590023", "securityControlId": 31003, "ccis": [], "uuid": "20345789-b248-5d21-9877-4581ca4170d1", "testId": "BCD-09.4_A01", "test": "the alternate processing site is prepared so that the site can serve as the operational site supporting essential mission and business functions.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-07(04)", "defaultText": null } ], "externalMappings": [ { "id": 554250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f97623b-0533-5b61-9cba-e62fa3627c70", "parentControlId": 31003, "controlId": "CP-7(4)", "title": "CP-7(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582317" }, { "id": 554251, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7f63e67-0a9c-547f-a4ab-8a76ef1920ac", "parentControlId": 31003, "controlId": "CP-07(04)", "title": "CP-07(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582317" }, { "id": 554252, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7c291a1-fd61-5407-b578-22711a103889", "parentControlId": 31003, "controlId": "CP-07(04)", "title": "CP-07(04)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582317" }, { "id": 554253, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "103066dd-6409-5a9e-830a-44b31a32568f", "parentControlId": 31003, "controlId": "CP-07(04)", "title": "CP-07(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582317" }, { "id": 554254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c49b203a-d48a-5206-8828-a3db7c904ed8", "parentControlId": 31003, "controlId": "CP-07(04)", "title": "CP-07(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582317" } ], "id": 31003, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730925", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730925", "catalogueId": 1062, "uuid": "8f4f89ae-2373-5af4-acd2-efc496a13732", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prepare the alternate processing alternate to support essential missions and business functions so that the alternate site is capable of being used as the primary site?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Preparation for Use", "description": "

Control Description

Mechanisms exist to prepare the alternate processing alternate to support essential missions and business functions so that the alternate site is capable of being used as the primary site.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prepare the alternate processing alternate to support essential missions and business functions so that the alternate site is capable of being used as the primary site.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-09.4", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-09.4", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69794, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590024", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590024", "securityControlId": 31004, "ccis": [], "uuid": "0010aa04-9a95-5c5a-95fe-0543d91e3f8f", "testId": "BCD-09.5_A01", "test": "circumstances that preclude returning to the primary processing site are planned for.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-07(06)[01]", "defaultText": null }, { "id": 69795, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590024", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590024", "securityControlId": 31004, "ccis": [], "uuid": "b3813b83-33be-5a0f-87d3-537b04d8b535", "testId": "BCD-09.5_A02", "test": "circumstances that preclude returning to the primary processing site are prepared for.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-07(06)[02]", "defaultText": null } ], "externalMappings": [ { "id": 554256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "364a3301-076d-5272-95be-07199d7c0c8b", "parentControlId": 31004, "controlId": "CP-7(6)", "title": "CP-7(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582317" }, { "id": 554257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5175c6c9-b043-586f-9ad0-fc0ffccd1c19", "parentControlId": 31004, "controlId": "CP-07(06)", "title": "CP-07(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582317" }, { "id": 554258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b87e7807-d329-51ca-be34-8c8bf1caed51", "parentControlId": 31004, "controlId": "CP-07(06)", "title": "CP-07(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582318" } ], "id": 31004, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730926", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730926", "catalogueId": 1062, "uuid": "ada6ac24-1cae-55c0-9ce9-3c125f51a0bd", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization plan and prepare for both natural and manmade circumstances that preclude returning to the primary processing site?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Inability to Return to Primary Site", "description": "

Control Description

Mechanisms exist to plan and prepare for both natural and manmade circumstances that preclude returning to the primary site.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to plan and prepare for both natural and manmade circumstances that preclude returning to the primary site.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-09.5", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-09.5", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69796, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590024", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590024", "securityControlId": 31005, "ccis": [], "uuid": "9e95b402-a2ce-5410-b35d-10daecf2b6ff", "testId": "BCD-10_A01", "test": "alternative communications protocols in support of maintaining continuity of operations are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-11_ODP", "defaultText": null }, { "id": 69797, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590024", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590024", "securityControlId": 31005, "ccis": [], "uuid": "4a937a61-0d9e-521d-9135-17bdcc44e070", "testId": "BCD-10_A02", "test": "the capability to employ alternative communications protocols are provided in support of maintaining continuity of operations.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-11", "defaultText": null }, { "id": 69798, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590025", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590025", "securityControlId": 31005, "ccis": [], "uuid": "8c72e01a-2f41-5fc0-be4e-ff143730b4c6", "testId": "BCD-10_A03", "test": "system operations to be resumed for essential mission and business functions are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-08_ODP[01]", "defaultText": null }, { "id": 69799, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590025", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590025", "securityControlId": 31005, "ccis": [], "uuid": "65ab2a39-908f-562c-8fb9-358b27ae19fc", "testId": "BCD-10_A04", "test": "time period within which to resume essential mission and business functions when the primary telecommunications capabilities are unavailable is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-08_ODP[02]", "defaultText": null }, { "id": 69800, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590025", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590025", "securityControlId": 31005, "ccis": [], "uuid": "10307e6b-61fb-592e-9ba8-61f431936e01", "testId": "BCD-10_A05", "test": "alternate telecommunications services, including necessary agreements to permit the resumption of system operations, are established for essential mission and business functions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-08", "defaultText": null }, { "id": 69801, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590025", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590025", "securityControlId": 31005, "ccis": [], "uuid": "f5764bc7-8040-5e60-bdc0-b2f27d1b8596", "testId": "BCD-10_A06", "test": "alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services are obtained.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CP-08(02)", "defaultText": null } ], "externalMappings": [ { "id": 554269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa03e6b7-546c-5642-8403-931ef51d6035", "parentControlId": 31005, "controlId": "CP-8", "title": "CP-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582319" }, { "id": 554270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05e4ff18-58fb-5127-965e-6af667a7da9f", "parentControlId": 31005, "controlId": "CP-8(2)", "title": "CP-8(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582319" }, { "id": 554271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfb161d4-d5a5-5042-907f-018ef1a08476", "parentControlId": 31005, "controlId": "CP-11", "title": "CP-11", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582319" }, { "id": 554272, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8b29af7-6197-554b-bd03-de33ec1e9e71", "parentControlId": 31005, "controlId": "CP-08", "title": "CP-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582319" }, { "id": 554273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aba85702-8a24-57ab-ade0-00eb4bb6752e", "parentControlId": 31005, "controlId": "CP-08(02)", "title": "CP-08(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58232" }, { "id": 554274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58232", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e69f844-4e73-5c8f-a5ab-8936287ad910", "parentControlId": 31005, "controlId": "CP-11", "title": "CP-11", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58232" }, { "id": 554275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58232", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19476a65-506a-5a5b-b0db-ab06e100974a", "parentControlId": 31005, "controlId": "CP-08", "title": "CP-08", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58232" }, { "id": 554276, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58232", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6d382ba-deda-5a21-9dd9-350e28000299", "parentControlId": 31005, "controlId": "CP-08(02)", "title": "CP-08(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58232" }, { "id": 554277, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58232", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c5c93ff-2732-53f6-b7bf-9a6ca143b703", "parentControlId": 31005, "controlId": "CP-08", "title": "CP-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58232" }, { "id": 554278, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58232", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a412ea7a-0146-59a6-b2bc-a1073615c823", "parentControlId": 31005, "controlId": "CP-08(02)", "title": "CP-08(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58232" }, { "id": 554279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58232", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b37b4b42-7ebe-5c6b-b884-64dd998404ab", "parentControlId": 31005, "controlId": "CP-11", "title": "CP-11", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58232" }, { "id": 554280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58232", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "762a1100-642c-5953-a4f6-c98621b4099e", "parentControlId": 31005, "controlId": "CP-08", "title": "CP-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58232" }, { "id": 554281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58232", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ddad4b5a-efff-5d0c-9034-44a3c37e1d05", "parentControlId": 31005, "controlId": "CP-08(02)", "title": "CP-08(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58232" }, { "id": 554282, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58232", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a951e1ed-2614-56c9-ad61-69a7b7946ccf", "parentControlId": 31005, "controlId": "CP-08", "title": "CP-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58232" }, { "id": 554283, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b8e9ccb-d7f3-5785-8474-724ca04f028f", "parentControlId": 31005, "controlId": "CP-08(02)", "title": "CP-08(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582321" }, { "id": 554285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f969b2c0-03da-5827-9f8b-cde649de26f9", "parentControlId": 31005, "controlId": "CP-8", "title": "CP-8", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582321" }, { "id": 554286, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59050340-ef98-597d-b651-87a1a48a553a", "parentControlId": 31005, "controlId": "CP-11", "title": "CP-11", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582321" }, { "controlId": "NSS-17T-Sec4.8", "title": "NSS-17T-Sec4.8 — Contingency Planning, Backup & Safe-State Recovery", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b8400d2d-c54d-5c84-b024-2f34e1f038e1", "isPublic": true }, { "controlId": "IEC-62645-8.5", "title": "IEC-62645-8.5 — Continuity, Backup, and Recovery of I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "9b285f6f-6c7c-521e-a3b3-b7b6fc7adec0", "isPublic": true }, { "controlId": "IEC-63096-17.1", "title": "IEC-63096-17.1 — Operational Continuity and Reconstitution of CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "dfb8851b-3ee6-5d64-b128-44b9b9147ac8", "isPublic": true } ], "id": 31005, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730926", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730926", "catalogueId": 1062, "uuid": "c72ac009-2880-5e5f-b84d-a77c53b51df4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization reduce the likelihood of a single point of failure with primary telecommunications services?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Telecommunications Services Availability", "description": "

Control Description

Mechanisms exist to reduce the likelihood of a single point of failure with primary telecommunications services.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to reduce the likelihood of a single point of failure with primary telecommunications services.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-10", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-10", "references": "

Micro-Small Business (<10 staff)

∙ Alternate / redundant telecommunications services are maintained with more than one telecom / Internet provider.

Small Business (10-49 staff)

∙ Alternate / redundant telecommunications services are maintained with more than one telecom / Internet provider.

Medium Business (50-249 staff)

∙ Alternate / redundant telecommunications services are maintained with more than one telecom / Internet provider.

Large Business (250-999 staff)

∙ Alternate / redundant telecommunications services are maintained with more than one telecom / Internet provider.

Enterprise (>1,000 staff)

∙ Alternate / redundant telecommunications services are maintained with more than one telecom / Internet provider.", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69802, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590026", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590026", "securityControlId": 31006, "ccis": [], "uuid": "6b2424d0-f7b5-5372-b356-bd4e23a549dd", "testId": "BCD-10.1_A01", "test": "primary telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-08(01)(a)[01]", "defaultText": null }, { "id": 69803, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590026", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590026", "securityControlId": 31006, "ccis": [], "uuid": "c397e4e7-3bef-5529-9fca-1eb0db92ebc9", "testId": "BCD-10.1_A02", "test": "alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-08(01)(a)[02]", "defaultText": null }, { "id": 69804, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590026", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590026", "securityControlId": 31006, "ccis": [], "uuid": "96b6742b-1866-5194-9918-d7d89ca4e45d", "testId": "BCD-10.1_A03", "test": "Telecommunications Service Priority is requested for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-08(01)(b)", "defaultText": null } ], "externalMappings": [ { "id": 554312, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582324", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01afaa06-2b16-577e-93fb-5147fc28cb3f", "parentControlId": 31006, "controlId": "CP-8(1)", "title": "CP-8(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582324" }, { "id": 554313, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582324", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cc5bb9d-db44-5306-9fd6-c9953c9cd9de", "parentControlId": 31006, "controlId": "CP-08(01)", "title": "CP-08(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582324" }, { "id": 554314, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582324", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3369892-0f26-57c1-bfca-ea17ac85f3ae", "parentControlId": 31006, "controlId": "CP-08(01)", "title": "CP-08(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582324" }, { "id": 554315, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582324", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8a75379-c40a-5bd9-a133-c1d4425d533a", "parentControlId": 31006, "controlId": "CP-08(01)", "title": "CP-08(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582324" }, { "id": 554316, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582333", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e8fec1d-cb83-5bf4-892d-e3835aff7761", "parentControlId": 31006, "controlId": "CP-08(01)", "title": "CP-08(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582333" }, { "id": 554317, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582333", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6432d074-0d83-5afb-b11b-d4a7cb35511e", "parentControlId": 31006, "controlId": "CP-08(01)", "title": "CP-08(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582333" } ], "id": 31006, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730926", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730926", "catalogueId": 1062, "uuid": "44949afb-3261-5ca9-9663-9a2dedf35dc7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization formalize primary and alternate telecommunications service agreements contain priority-of-service provisions that support availability requirements, including Recovery Time Objectives (RTOs)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Telecommunications Priority of Service Provisions", "description": "

Control Description

Mechanisms exist to formalize primary and alternate telecommunications service agreements contain priority-of-service provisions that support availability requirements, including Recovery Time Objectives (RTOs).

Evidence Request List (ERL)

E-TPM-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to formalize primary and alternate telecommunications service agreements contain priority-of-service provisions that support availability requirements, including Recovery Time Objectives (RTOs).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-10.1", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-10.1", "references": "

Micro-Small Business (<10 staff)

∙ Priority-of-service contract provisions for hot / warm / cold sites.

Small Business (10-49 staff)

∙ Priority-of-service contract provisions for hot / warm / cold sites.

Medium Business (50-249 staff)

∙ Priority-of-service contract provisions for hot / warm / cold sites.

Large Business (250-999 staff)

∙ Priority-of-service contract provisions for hot / warm / cold sites.

Enterprise (>1,000 staff)

∙ Priority-of-service contract provisions for hot / warm / cold sites.", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69805, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590026", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590027", "securityControlId": 31007, "ccis": [], "uuid": "81d5c662-db2f-5168-9684-bb0848ee5a5e", "testId": "BCD-10.2_A01", "test": "alternate telecommunications services from providers that are separated from primary service providers are obtained to reduce susceptibility to the same threats.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CP-08(03)", "defaultText": null } ], "externalMappings": [ { "id": 554328, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582334", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4122af34-4c8a-5e33-af40-de4c7e8be07e", "parentControlId": 31007, "controlId": "CP-8(3)", "title": "CP-8(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582334" }, { "id": 554329, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582334", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56671514-150d-5a61-99c8-d53ce174251d", "parentControlId": 31007, "controlId": "CP-08(03)", "title": "CP-08(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582334" }, { "id": 554330, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582334", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3841736a-6054-50bd-8e9d-37487a012bd5", "parentControlId": 31007, "controlId": "CP-08(03)", "title": "CP-08(03)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582335" }, { "id": 554331, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582335", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12892822-da73-5ac7-aee5-a54e4c8ddc75", "parentControlId": 31007, "controlId": "CP-08(03)", "title": "CP-08(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582335" }, { "id": 554332, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582335", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a77de56-59f5-59fc-a6ea-9ae3db91ec14", "parentControlId": 31007, "controlId": "CP-08(03)", "title": "CP-08(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582335" }, { "id": 554334, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582335", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a27211e5-f66e-5d70-bc5c-411f338bfef3", "parentControlId": 31007, "controlId": "CP-8(3)", "title": "CP-8(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582335" } ], "id": 31007, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730927", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730927", "catalogueId": 1062, "uuid": "7c9906ab-bac0-5020-a838-fb7664424936", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Separation of Primary / Alternate Providers", "description": "

Control Description

Mechanisms exist to obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-10.2", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-10.2", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69806, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590027", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590027", "securityControlId": 31008, "ccis": [], "uuid": "ce8f54c7-ca20-5d64-8189-7fdc815d83a9", "testId": "BCD-10.3_A01", "test": "the frequency at which to obtain evidence of contingency testing by providers is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-08(04)_ODP[01]", "defaultText": null }, { "id": 69807, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590027", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590027", "securityControlId": 31008, "ccis": [], "uuid": "b349de93-c090-5766-9778-43f99c5f247f", "testId": "BCD-10.3_A02", "test": "the frequency at which to obtain evidence of contingency training by providers is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-08(04)_ODP[02]", "defaultText": null }, { "id": 69808, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590027", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590027", "securityControlId": 31008, "ccis": [], "uuid": "ac11fabb-4332-59d6-bfcd-52aee99aea0e", "testId": "BCD-10.3_A03", "test": "primary telecommunications service providers are required to have contingency plans.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CP-08(04)(a)[01]", "defaultText": null }, { "id": 69809, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590027", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590027", "securityControlId": 31008, "ccis": [], "uuid": "873947b0-c032-5cf4-8552-38f20329f11a", "testId": "BCD-10.3_A04", "test": "alternate telecommunications service providers are required to have contingency plans.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CP-08(04)(a)[02]", "defaultText": null }, { "id": 69810, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590027", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590027", "securityControlId": 31008, "ccis": [], "uuid": "5c1e3840-3d97-5582-bdf7-e8eb1b8107c6", "testId": "BCD-10.3_A05", "test": "provider contingency plans are reviewed to ensure that the plans meet organizational contingency requirements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-08(04)(b)", "defaultText": null }, { "id": 69811, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590027", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590028", "securityControlId": 31008, "ccis": [], "uuid": "3c8e0b59-a41c-5be8-9d4c-43be9d526ee5", "testId": "BCD-10.3_A06", "test": "evidence of contingency testing by providers is obtained.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-08(04)(c)[01]", "defaultText": null }, { "id": 69812, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590028", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590028", "securityControlId": 31008, "ccis": [], "uuid": "7704595f-adf1-54f1-9f3e-553c74bce8ee", "testId": "BCD-10.3_A07", "test": "evidence of contingency training by providers is obtained.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-08(04)(c)[02]", "defaultText": null } ], "externalMappings": [ { "id": 554341, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f14bc40b-6641-552e-874e-aeed2b743490", "parentControlId": 31008, "controlId": "CP-8(4)", "title": "CP-8(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582336" }, { "id": 554342, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2aa07c5-051d-5e9d-be2a-ae032e012e9d", "parentControlId": 31008, "controlId": "CP-08(04)", "title": "CP-08(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582336" }, { "id": 554343, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bbfa668-909b-5128-b397-93f8947f95a6", "parentControlId": 31008, "controlId": "CP-08(04)", "title": "CP-08(04)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582336" }, { "id": 554344, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f77285a-e360-5724-be25-ee3f8379174e", "parentControlId": 31008, "controlId": "CP-08(04)", "title": "CP-08(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582336" }, { "id": 554345, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84c37157-e446-503a-ab48-f61249c9fc88", "parentControlId": 31008, "controlId": "CP-08(04)", "title": "CP-08(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582336" }, { "id": 554346, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "562302d9-204e-595e-ba31-6d7cff1a03bc", "parentControlId": 31008, "controlId": "CP-8(4)", "title": "CP-8(4)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582337" } ], "id": 31008, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730927", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730927", "catalogueId": 1062, "uuid": "a056a2d7-4cd1-5cae-a70a-24926d651b3d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization contractually-require external service providers to have contingency plans that meet organizational contingency requirements?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Provider Contingency Plan", "description": "

Control Description

Mechanisms exist to contractually-require external service providers to have contingency plans that meet organizational contingency requirements.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to contractually-require external service providers to have contingency plans that meet organizational contingency requirements.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-10.3", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-10.3", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69813, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590028", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590028", "securityControlId": 31009, "ccis": [], "uuid": "8158f70d-22e7-56b9-81b3-f7a0c15b2369", "testId": "BCD-10.4_A01", "test": "alternate communication paths for system operations and operational command and control are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-47_ODP", "defaultText": null }, { "id": 69814, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590028", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590028", "securityControlId": 31009, "ccis": [], "uuid": "f3d74506-8fcb-56f2-a437-79f9133a6143", "testId": "BCD-10.4_A02", "test": "alternate communication paths are established for system operations and operational command and control.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-47", "defaultText": null } ], "externalMappings": [ { "id": 554352, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "228d4738-da97-535b-8808-914e35f34d1a", "parentControlId": 31009, "controlId": "SC-47", "title": "SC-47", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582337" }, { "id": 554353, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "debdece6-6d7b-5237-9255-65bd73141a49", "parentControlId": 31009, "controlId": "SC-47", "title": "SC-47", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582337" }, { "id": 554354, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582338", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "606905b4-3b1d-514e-bc36-afc25e4299d3", "parentControlId": 31009, "controlId": "SC-47", "title": "SC-47", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582338" }, { "id": 554356, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582338", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfd84fa7-ceb5-5c75-bd99-18bc6d5e6968", "parentControlId": 31009, "controlId": "SC-47", "title": "SC-47", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582338" } ], "id": 31009, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730928", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730928", "catalogueId": 1062, "uuid": "97e2363b-c404-5a30-9c8e-86e027637838", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain command and control capabilities via alternate communications channels and designating alternative decision makers if primary decision makers are unavailable?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Alternate Communications Channels", "description": "

Control Description

Mechanisms exist to maintain command and control capabilities via alternate communications channels and designating alternative decision makers if primary decision makers are unavailable.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain command and control capabilities via alternate communications channels and designating alternative decision makers if primary decision makers are unavailable.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-10.4", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-10.4", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69815, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590028", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590028", "securityControlId": 31010, "ccis": [], "uuid": "4e337904-061a-5015-805a-96e435936f70", "testId": "BCD-11_A01", "test": "the confidentiality of backup sensitive / regulated data is protected at storage locations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.8.9", "defaultText": null }, { "id": 69816, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590029", "securityControlId": 31010, "ccis": [], "uuid": "2ba577f3-093f-5ecd-940f-451a16467839", "testId": "BCD-11_A02", "test": "system components for which to conduct backups of user-level information are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-09_ODP[01]", "defaultText": null }, { "id": 69817, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590029", "securityControlId": 31010, "ccis": [], "uuid": "aca0f4a2-0482-5fc1-98e6-23985b741339", "testId": "BCD-11_A03", "test": "the frequency at which to conduct backups of user-level information consistent with recovery time and recovery point objectives is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: daily incremental; weekly full", "otherId": "53A_R5_CP-09_ODP[02]", "defaultText": null }, { "id": 69818, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590029", "securityControlId": 31010, "ccis": [], "uuid": "7b6e76d0-8c96-5c6e-bbcf-0f6c1c77dedb", "testId": "BCD-11_A04", "test": "the frequency at which to conduct backups of system-level information consistent with recovery time and recovery point objectives is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: daily incremental; weekly full", "otherId": "53A_R5_CP-09_ODP[03]", "defaultText": null }, { "id": 69819, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590029", "securityControlId": 31010, "ccis": [], "uuid": "fcbb5775-af8b-56d5-a4b8-09bdcc826a7e", "testId": "BCD-11_A05", "test": "the frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: daily incremental; weekly full", "otherId": "53A_R5_CP-09_ODP[04]", "defaultText": null }, { "id": 69820, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59003", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59003", "securityControlId": 31010, "ccis": [], "uuid": "68c330b5-2525-535e-8499-46888f111b9f", "testId": "BCD-11_A06", "test": "backups of user-level information contained in system components are conducted frequently.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-09a.", "defaultText": null }, { "id": 69821, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59003", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59003", "securityControlId": 31010, "ccis": [], "uuid": "1f36819d-c3e5-5980-8aee-745eeb2d7e32", "testId": "BCD-11_A07", "test": "backups of system-level information contained in the system are conducted frequently.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-09b.", "defaultText": null }, { "id": 69822, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59003", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59003", "securityControlId": 31010, "ccis": [], "uuid": "b03e26cc-0fc9-5e18-9714-0f2a6d3760ff", "testId": "BCD-11_A08", "test": "backups of system documentation, including security- and privacy-related documentation are conducted frequently.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-09c.", "defaultText": null }, { "id": 69823, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59003", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59003", "securityControlId": 31010, "ccis": [], "uuid": "1497647b-4739-5b5c-aadf-7fac49ecfa2d", "testId": "BCD-11_A09", "test": "the confidentiality of backup information is protected.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CP-09d.[01]", "defaultText": null }, { "id": 69824, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59003", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59003", "securityControlId": 31010, "ccis": [], "uuid": "a03ef5eb-0b00-5954-aca5-f5fbe2948471", "testId": "BCD-11_A10", "test": "the integrity of backup information is protected.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CP-09d.[02]", "defaultText": null }, { "id": 69825, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590031", "securityControlId": 31010, "ccis": [], "uuid": "5462523a-a3d7-500c-a788-0488db9f716e", "testId": "BCD-11_A11", "test": "the availability of backup information is protected.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CP-09d.[03]", "defaultText": null } ], "externalMappings": [ { "id": 554381, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582341", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0fe8d77-cc30-5b1c-ad2b-07ad58a4564a", "parentControlId": 31010, "controlId": "AVAIL 2.1", "title": "AVAIL 2.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582341" }, { "id": 554382, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582341", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b367573f-6147-5642-931a-79b914d0d764", "parentControlId": 31010, "controlId": "AVAIL 2.2", "title": "AVAIL 2.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582341" }, { "id": 554383, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582341", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "affefb3b-c84c-570f-9fe8-63d342e1ae29", "parentControlId": 31010, "controlId": "SR 7.3 RE 2", "title": "SR 7.3 RE 2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582341" }, { "id": 554384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582341", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d76eb441-5e81-5833-b3e2-71eb93c13706", "parentControlId": 31010, "controlId": "CR 7.3", "title": "CR 7.3", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582341" }, { "id": 554387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582341", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3822aef-3b61-5298-bc07-d00d27b132d5", "parentControlId": 31010, "controlId": "8.13", "title": "8.13", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582341" }, { "id": 554390, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26200ce6-bdcb-5eca-ae3f-9a0a0998b47a", "parentControlId": 31010, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582342" }, { "id": 554391, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf5969f3-21b7-5397-a5cf-a3c52d5137d0", "parentControlId": 31010, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582342" }, { "id": 554392, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12147dc6-522b-5767-9a54-16496d4e9d6f", "parentControlId": 31010, "controlId": "T1005", "title": "T1005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582342" }, { "id": 554393, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bf4324c-52f1-51bc-ad9e-50f23a2bec58", "parentControlId": 31010, "controlId": "T1025", "title": "T1025", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582342" }, { "id": 554394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "adff24e8-aac7-576d-9736-e20c2ec663dc", "parentControlId": 31010, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582342" }, { "id": 554395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "228cff14-79f4-57c7-b830-18c61917a689", "parentControlId": 31010, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582343" }, { "id": 554396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa959904-de95-5542-b00f-666366047f5c", "parentControlId": 31010, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582343" }, { "id": 554397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05e64475-8c63-5c1e-ae85-c996a38cd890", "parentControlId": 31010, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582343" }, { "id": 554398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "791ae40b-1ea1-5529-93d0-54a9d6412fff", "parentControlId": 31010, "controlId": "T1119", "title": "T1119", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582343" }, { "id": 554399, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5596e223-a374-56a0-81df-f8aec7a9339a", "parentControlId": 31010, "controlId": "T1485", "title": "T1485", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582343" }, { "id": 554400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6aae8a7d-8fb9-56c9-bb29-c5f7f4e879b4", "parentControlId": 31010, "controlId": "T1485.001", "title": "T1485.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582343" }, { "id": 554401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abc358d3-9e59-572c-b75b-5fec17df1730", "parentControlId": 31010, "controlId": "T1486", "title": "T1486", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582343" }, { "id": 554402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2cbaeee-e74e-5f32-92a7-780a98d20dbf", "parentControlId": 31010, "controlId": "T1490", "title": "T1490", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582343" }, { "id": 554403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b437d76d-6b04-5c4f-b994-ff21bf765c28", "parentControlId": 31010, "controlId": "T1491", "title": "T1491", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582343" }, { "id": 554404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01a7dd72-833c-5dae-a741-4e25f1d0e665", "parentControlId": 31010, "controlId": "T1491.001", "title": "T1491.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582343" }, { "id": 554405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582344", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0c50362-40ab-5298-a96b-deb16124d245", "parentControlId": 31010, "controlId": "T1491.002", "title": "T1491.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582344" }, { "id": 554406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582344", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70d954ef-a461-5d83-9881-a3d61cef1a60", "parentControlId": 31010, "controlId": "T1561", "title": "T1561", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582344" }, { "id": 554407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582344", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66a2fec9-bcf1-5d23-be6c-b8327743d0f4", "parentControlId": 31010, "controlId": "T1561.001", "title": "T1561.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582344" }, { "id": 554408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582344", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f71d162c-677d-53a9-92f4-ad8abe0fd58f", "parentControlId": 31010, "controlId": "T1561.002", "title": "T1561.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582344" }, { "id": 554409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582344", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "beca387f-dfee-5a24-9e3c-c267b3627b55", "parentControlId": 31010, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582344" }, { "id": 554410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582344", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98387f38-2208-5827-a8f6-bae194659e03", "parentControlId": 31010, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582344" }, { "id": 554411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582344", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a6d35ef-fe5f-56ef-a3bf-e042bd8f098e", "parentControlId": 31010, "controlId": "T1565.003", "title": "T1565.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582344" }, { "id": 554414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d113b96e-eb15-5cff-97e6-82f12a12ea39", "parentControlId": 31010, "controlId": "CP-9", "title": "CP-9", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582345" }, { "id": 554415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef683c84-21d4-57f6-bf23-77dfefda0acd", "parentControlId": 31010, "controlId": "SC-28(2)", "title": "SC-28(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582345" }, { "id": 554416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a3e6246-50db-57d0-b2dd-59ad6610fdb7", "parentControlId": 31010, "controlId": "CP-09", "title": "CP-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582345" }, { "id": 554417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e6b461c-e06a-588b-acfa-5c2c405a5730", "parentControlId": 31010, "controlId": "SC-28(02)", "title": "SC-28(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582345" }, { "id": 554419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d96c7ea-25e2-561a-887e-c23669e54599", "parentControlId": 31010, "controlId": "CP-09", "title": "CP-09", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582345" }, { "id": 554422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b2dbd13-f0ab-51eb-a727-fe554e780a41", "parentControlId": 31010, "controlId": "CP-09", "title": "CP-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582346" }, { "id": 554423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "514e0df1-4b5e-5b16-9c9f-7b012d0c9d73", "parentControlId": 31010, "controlId": "SC-28(02)", "title": "SC-28(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582346" }, { "id": 554424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca019750-7503-5c2c-814e-de2bcf071ca1", "parentControlId": 31010, "controlId": "CP-09", "title": "CP-09", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582346" }, { "id": 554425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc4e82c1-fec4-5938-b9db-bdafd36f13fd", "parentControlId": 31010, "controlId": "CP-09", "title": "CP-09", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582346" }, { "id": 554426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6886f574-6219-52a9-958f-89777442e160", "parentControlId": 31010, "controlId": "CP-09", "title": "CP-09", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582346" }, { "id": 554428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f84059ad-3244-55eb-8885-3e5e61da63df", "parentControlId": 31010, "controlId": "3.8.9", "title": "3.8.9", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582346" }, { "id": 554429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0a83850-b670-53a6-a6ea-9a01c4cd799a", "parentControlId": 31010, "controlId": "03.08.09.a", "title": "03.08.09.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582346" }, { "id": 554431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84543693-c0eb-5abf-9852-52140256314f", "parentControlId": 31010, "controlId": "PR.DS-11", "title": "PR.DS-11", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582347" }, { "id": 554461, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb8dd3c1-e35c-5628-b6a3-3b65c89d96c3", "parentControlId": 31010, "controlId": "RESPONSE-4b", "title": "RESPONSE-4b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58235" }, { "id": 554462, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68f08edb-9f81-5433-95e2-9ef745c96913", "parentControlId": 31010, "controlId": "RESPONSE-4j", "title": "RESPONSE-4j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58235" }, { "id": 554486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48ed3504-b925-5f47-9546-bc1b6eb0b56d", "parentControlId": 31010, "controlId": "CIP-009-6 1.3", "title": "CIP-009-6 1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582353" }, { "id": 554487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7397e99-d463-53f5-b315-4a77a268fa6c", "parentControlId": 31010, "controlId": "CIP-009-6 1.4", "title": "CIP-009-6 1.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582353" }, { "id": 554524, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582357", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d88f7fa2-5967-5d13-8e8d-110561c3c5d9", "parentControlId": 31010, "controlId": "B5.c", "title": "B5.c", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582357" }, { "controlId": "C.9.6", "title": "C.9.6 — CDA Backups", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CP-9", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "6c999a83-ac68-589c-aa68-618e7dc3e4cb", "isPublic": true }, { "controlId": "NEI 08-09 App E.9.6", "title": "NEI 08-09 App E.9.6 — CDA Backups", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.9.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "0ef848f5-6112-553f-8cbf-36450ebbfe8a", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3)", "title": "10 CFR 73.54(d)(3) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.9.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "20c05942-48ec-5b11-ad35-b5f8d754316f", "isPublic": true }, { "controlId": "CIP-009-6-R1", "title": "CIP-009-6-R1 — Recovery Plan for BES Cyber Systems", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b715bdff-feba-5c7b-97ac-04efb50d3dca", "isPublic": true }, { "controlId": "CIP-009-6-1.1", "title": "CIP-009-6-1.1 — Conditions for activation of the recovery plan(s).", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f4e8c10a-3f07-5aa3-967b-936bbb3b7f27", "isPublic": true }, { "controlId": "CIP-009-6-1.2", "title": "CIP-009-6-1.2 — Roles and responsibilities of responders.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "608d0ef1-1181-590c-8117-3c7a97ac4e36", "isPublic": true }, { "controlId": "CIP-009-6-1.3", "title": "CIP-009-6-1.3 — One or more processes for the backup and storage of information required to recover BES Cyber System functionality.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1f88dfae-5a20-5f33-a546-7b9d2a25a5c9", "isPublic": true }, { "controlId": "CIP-009-6-1.4", "title": "CIP-009-6-1.4 — One or more processes to verify the successful completion of the backup processes in Part 1.3 and to address any back...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "25124633-aadc-5a0f-a27a-663245c4a81a", "isPublic": true }, { "controlId": "CIP-009-6-1.5", "title": "CIP-009-6-1.5 — One or more processes to preserve data, per Cyber Asset capability, for determining the cause of a Cyber Security Inc...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "701686aa-2e5c-5476-8ec2-c0a685cf52a3", "isPublic": true }, { "controlId": "NSS-17T-Sec4.8", "title": "NSS-17T-Sec4.8 — Contingency Planning, Backup & Safe-State Recovery", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "899eb416-b3bb-53ad-87c2-c2530dd05e99", "isPublic": true }, { "controlId": "IEC-62645-8.5", "title": "IEC-62645-8.5 — Continuity, Backup, and Recovery of I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "5f292dbe-1bbf-55e6-84a9-489e6ff78b17", "isPublic": true }, { "controlId": "IEC-63096-17.1", "title": "IEC-63096-17.1 — Operational Continuity and Reconstitution of CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "e8a64b15-f867-54b4-b295-1ec53dcfcb9b", "isPublic": true } ], "id": 31010, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730928", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730928", "catalogueId": 1062, "uuid": "ce4cbc97-0d56-56dc-bae0-0efd0c310dba", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs)?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 10.0, "title": "Data Backups", "description": "

Control Description

Mechanisms exist to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).

Evidence Request List (ERL)

E-BCM-10\nE-BCM-11\nE-BCM-12\nE-BCM-13

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ Backups are performed ad-hoc and focus on business-critical Technology Assets, Applications, Services and/or Data (TAASD).\n▪ IT and/or cybersecurity personnel use a backup methodology (e.g., grandfather, father & son rotation) to create backups to support business needs (e.g., Recovery Time Objectives).\n▪ Limited technologies exist to conduct full, incremental or differential backups (e.g., tape/disk, hybrid cloud or direct-to-cloud).\n▪ Backups of sensitive/regulated data are cryptographically protected to prevent the unauthorized disclosure and modification of backup information.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Appropriate TAASD exist to conduct full, incremental and/or differential backups (e.g., tape/disk, hybrid cloud or direct-to-cloud).\n▪ IT personnel configure business-critical Technology Assets, Applications and/or Services to transfer backup data to the alternate site(s) at a rate that is capable of meeting RTOs and RPOs.\n▪ The backup methodology is sufficient to support RTOs and RPOs for critical business functions.\n▪ IT personnel store backups in a secondary location, separate from the primary storage site (e.g., cloud-based storage).

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to create recurring backups of data, software and/or system images, as well as verify the integrity of these backups, to ensure the availability of the data to satisfy Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.9.6
NERC-CIP (2026) Requirements: CIP-009-6-R1", "controlId": "BCD-11", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-11", "references": "

Micro-Small Business (<10 staff)

∙ Disaster Recovery Plan (DRP)\n∙ 3-2-1 backup rule (3 copies, 2 media types, 1 offsite)\n∙ Cloud backup service (e.g., Backblaze B2, iDrive, Veeam Agent Free)

Small Business (10-49 staff)

∙ Disaster Recovery Plan (DRP)\n∙ 3-2-1 backup strategy (on-site + off-site/cloud)\n∙ Cloud backup service (e.g., Acronis, Veeam, Azure Backup)

Medium Business (50-249 staff)

∙ Disaster Recovery Plan (DRP)\n∙ 3-2-1-1 backup strategy (including immutable/offsite copy)\n∙ Enterprise backup solution (e.g., Veeam Backup & Replication, Acronis Cyber Backup)

Large Business (250-999 staff)

∙ Disaster Recovery Plan (DRP)\n∙ Immutable backup copies (air-gapped or object-locked S3/Azure Blob)\n∙ Enterprise backup platform (e.g., Veeam, Commvault, Cohesity)\n∙ Automated backup testing and alerting

Enterprise (>1,000 staff)

∙ Disaster Recovery Plan (DRP)\n∙ Enterprise backup platform with immutable storage (e.g., Commvault, Veeam, Rubrik)\n∙ Ransomware-resilient backup architecture (air-gap or immutable)\n∙ Automated backup validation and recovery testing\n∙ Backup data encrypted at rest and in transit", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69826, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590031", "securityControlId": 31011, "ccis": [], "uuid": "46fdbc12-882b-5f0e-81b0-04bdaf5741b7", "testId": "BCD-11.1_A01", "test": "the frequency at which to test backup information for media reliability is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-09(01)_ODP[01]", "defaultText": null }, { "id": 69827, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590031", "securityControlId": 31011, "ccis": [], "uuid": "ef02542c-5563-568f-9c04-6fc101078c75", "testId": "BCD-11.1_A02", "test": "the frequency at which to test backup information for information integrity is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-09(01)_ODP[02]", "defaultText": null }, { "id": 69828, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590031", "securityControlId": 31011, "ccis": [], "uuid": "a6e04284-a2d4-5552-bbc5-a6eca213bd72", "testId": "BCD-11.1_A03", "test": "backup information is tested frequently to verify media reliability.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-09(01)[01]", "defaultText": null }, { "id": 69829, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590031", "securityControlId": 31011, "ccis": [], "uuid": "5de3c732-f192-5c93-ab47-f77b6df9e099", "testId": "BCD-11.1_A04", "test": "backup information is tested frequently to verify information integrity.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CP-09(01)[02]", "defaultText": null } ], "externalMappings": [ { "id": 554593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582365", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f5d693d-3436-5f89-8a1d-fee5c7afb61c", "parentControlId": 31011, "controlId": "CR 7.3(1)", "title": "CR 7.3(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582365" }, { "id": 554594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582365", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "062b9314-b005-540a-b260-b9d7eeb82ee9", "parentControlId": 31011, "controlId": "8.13", "title": "8.13", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582365" }, { "id": 554597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582365", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8a31eb3-8c83-5a49-9c80-6a3429ab2fd9", "parentControlId": 31011, "controlId": "CP-9(1)", "title": "CP-9(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582365" }, { "id": 554598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca73badb-b14c-5346-8abb-8df34ca75c93", "parentControlId": 31011, "controlId": "CP-09(01)", "title": "CP-09(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582366" }, { "id": 554599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "baba3738-c408-50f0-b42a-8e4279ec3bb7", "parentControlId": 31011, "controlId": "CP-09(01)", "title": "CP-09(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582366" }, { "id": 554600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5783679-b138-50fb-9f4c-609a8e2cff19", "parentControlId": 31011, "controlId": "CP-09(01)", "title": "CP-09(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582366" }, { "id": 554601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ed56465-c4a3-5ccc-961f-7412bb4c0b9c", "parentControlId": 31011, "controlId": "CP-09(01)", "title": "CP-09(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582366" }, { "id": 554602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57df057f-5dfb-57dc-9801-5411244dab31", "parentControlId": 31011, "controlId": "CP-09(01)", "title": "CP-09(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582366" }, { "id": 554604, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a9013b2-c957-5108-9ac9-569e1ae5a72e", "parentControlId": 31011, "controlId": "PR.DS-11", "title": "PR.DS-11", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582366" }, { "id": 554607, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc61b38d-c6ef-5433-854a-811c5e0be1a3", "parentControlId": 31011, "controlId": "RESPONSE-4b", "title": "RESPONSE-4b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582367" }, { "id": 554612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2458aba6-dbb6-510b-a483-e4fa5bc696e5", "parentControlId": 31011, "controlId": "CIP-009-6 1.4", "title": "CIP-009-6 1.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582367" }, { "id": 554613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6bd68d8-cb10-569c-82e2-ff648b71422a", "parentControlId": 31011, "controlId": "CIP-009-6 2.2", "title": "CIP-009-6 2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582367" }, { "controlId": "C.9.6", "title": "C.9.6 — CDA Backups", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CP-9", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "58c00476-e180-5971-a69a-d44cab395e8e", "isPublic": true }, { "controlId": "NEI 08-09 App E.9.6", "title": "NEI 08-09 App E.9.6 — CDA Backups", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.9.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "f389ea36-166f-5860-993e-2ffe25de3659", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3)", "title": "10 CFR 73.54(d)(3) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.9.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "6f58ac47-d559-599d-8cdf-f761a592566e", "isPublic": true }, { "controlId": "CIP-009-6-R2", "title": "CIP-009-6-R2 — Recovery Plan Implementation and Testing", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "41185b69-9de6-52bd-b862-6012bedc9aa6", "isPublic": true }, { "controlId": "CIP-009-6-2.1", "title": "CIP-009-6-2.1 — Test each of the recovery plans referenced in Requirement R1 at least once every 15 calendar months", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d1e7a386-f321-5e3d-99b7-9f752e153fbb", "isPublic": true }, { "controlId": "CIP-009-6-2.2", "title": "CIP-009-6-2.2 — Test a representative sample of information used to recover BES Cyber System functionality at least once every 15 cal...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6d19a1a3-eeab-5f3a-a639-7418c0f6c787", "isPublic": true }, { "controlId": "CIP-009-6-2.3", "title": "CIP-009-6-2.3 — Test each of the recovery plans referenced in Requirement R1 at least once every 36 calendar months through an operat...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-009-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ad99137c-0141-5ee6-ae56-a5f5430f5f63", "isPublic": true }, { "controlId": "NSS-17T-Sec4.8", "title": "NSS-17T-Sec4.8 — Contingency Planning, Backup & Safe-State Recovery", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "5069216e-a47c-5a84-90c6-616f4a7f1d7e", "isPublic": true }, { "controlId": "IEC-62645-8.5", "title": "IEC-62645-8.5 — Continuity, Backup, and Recovery of I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "766bff69-9ceb-529e-83fb-a48fe7b7ba7a", "isPublic": true }, { "controlId": "IEC-63096-17.1", "title": "IEC-63096-17.1 — Operational Continuity and Reconstitution of CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "1d7b435c-0375-5e58-8674-0bbfe153718e", "isPublic": true } ], "id": 31011, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730928", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730928", "catalogueId": 1062, "uuid": "c2fb5f62-1002-57b2-95f8-88993c04829a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization routinely test backups that verify the reliability of the backup process, as well as the integrity and availability of the data?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Testing for Reliability & Integrity", "description": "

Control Description

Mechanisms exist to routinely test backups that verify the reliability of the backup process, as well as the integrity and availability of the data.

Evidence Request List (ERL)

E-BCM-10

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ A random sampling of backups is tested at least annually to verify integrity and recoverability of backed up data.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel perform a random sampling of backups is tested at least semi-annually to verify integrity and recoverability of backed up data.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to routinely test backups that verify the reliability of the backup process, as well as the integrity and availability of the data.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.9.6
NERC-CIP (2026) Requirements: CIP-009-6-R2", "controlId": "BCD-11.1", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-11.1", "references": "

Micro-Small Business (<10 staff)

∙ Randomized data recovery testing

Small Business (10-49 staff)

∙ Randomized data recovery testing

Medium Business (50-249 staff)

∙ Randomized data recovery testing

Large Business (250-999 staff)

∙ Randomized data recovery testing

Enterprise (>1,000 staff)

∙ Randomized data recovery testing", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69830, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590032", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590032", "securityControlId": 31012, "ccis": [], "uuid": "9363b828-10be-5ad4-bbfc-2dbe5187e917", "testId": "BCD-11.2_A01", "test": "critical system software and other security-related information backups to be stored in a separate facility are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-09(03)_ODP", "defaultText": null }, { "id": 69831, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590032", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590032", "securityControlId": 31012, "ccis": [], "uuid": "a2c3965e-de56-55c5-83ad-604d7d4cb172", "testId": "BCD-11.2_A02", "test": "backup copies of critical system software and other security-related information are stored in a separate facility or in a fire rated container that is not collocated with the operational system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-09(03)", "defaultText": null } ], "externalMappings": [ { "id": 554647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582379", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa33faff-6460-5e8f-8fd9-64419779aefb", "parentControlId": 31012, "controlId": "AVAIL 2.4", "title": "AVAIL 2.4", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582379" }, { "id": 554648, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb56ea3d-f768-5884-9a4c-9a2f13d832e0", "parentControlId": 31012, "controlId": "SR 7.3", "title": "SR 7.3", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58238" }, { "id": 554649, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0357911f-0a64-5de5-8449-2db0e37b58f6", "parentControlId": 31012, "controlId": "8.13", "title": "8.13", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58238" }, { "id": 554652, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86948d25-542c-5026-b0b0-ac66ba9f79ff", "parentControlId": 31012, "controlId": "CP-9(3)", "title": "CP-9(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58238" }, { "id": 554653, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2a51a86-26fb-5b40-87ec-a2027483424f", "parentControlId": 31012, "controlId": "CP-09(03)", "title": "CP-09(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58238" }, { "id": 554654, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6f04ad3-6004-5bbe-858e-e16e954a5a8b", "parentControlId": 31012, "controlId": "CP-09(03)", "title": "CP-09(03)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58238" }, { "id": 554655, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51756a11-def1-53bc-ac76-f428a383e4e6", "parentControlId": 31012, "controlId": "CP-09(03)", "title": "CP-09(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58238" }, { "id": 554656, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "961a4003-4010-591a-96ba-0e63108b5431", "parentControlId": 31012, "controlId": "CP-09(03)", "title": "CP-09(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58238" }, { "id": 554669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42fb0ddd-bdd5-5224-90f1-bd1c84d5635b", "parentControlId": 31012, "controlId": "RESPONSE-4k", "title": "RESPONSE-4k", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582382" } ], "id": 31012, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730929", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730929", "catalogueId": 1062, "uuid": "aa66a1a1-b9c0-500c-b1e6-611287eeab85", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization store backup copies of critical software and other security-related information in a separate facility or in a fire-rated container that is not collocated with the system being backed up?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Separate Storage for Critical Information", "description": "

Control Description

Mechanisms exist to store backup copies of critical software and other security-related information in a separate facility or in a fire-rated container that is not collocated with the system being backed up.

Evidence Request List (ERL)

E-AST-08\nE-BCM-11\nE-BCM-12\nE-BCM-13

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ Backup copies of software or licenses/product keys are stored locally in a fire-rated container.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to store backup copies of critical software and other security-related information in a separate facility or in a fire-rated container that is not collocated with the system being backed up.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-11.2", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-11.2", "references": "

Micro-Small Business (<10 staff)

∙ Disaster Recovery Plan (DRP)\n∙ On-site data backup solution\n∙ Off-site data backup service

Small Business (10-49 staff)

∙ Disaster Recovery Plan (DRP)\n∙ On-site data backup solution\n∙ Off-site data backup service

Medium Business (50-249 staff)

∙ Disaster Recovery Plan (DRP)\n∙ On-site data backup solution\n∙ Off-site data backup service

Large Business (250-999 staff)

∙ Disaster Recovery Plan (DRP)\n∙ On-site data backup solution\n∙ Off-site data backup service

Enterprise (>1,000 staff)

∙ Disaster Recovery Plan (DRP)\n∙ On-site data backup solution\n∙ Off-site data backup service", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69834, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590032", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590032", "securityControlId": 31014, "ccis": [], "uuid": "dc647b97-faf3-596a-b667-f327326137d0", "testId": "BCD-11.4_A01", "test": "the confidentiality of backup information is protected.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.8.9\n171A_R3_A.03.08.09.a", "defaultText": null }, { "id": 69835, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590033", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590033", "securityControlId": 31014, "ccis": [], "uuid": "02c0bd2b-9a0a-5266-a704-3c18378b3104", "testId": "BCD-11.4_A02", "test": "backup information to protect against unauthorized disclosure and modification is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-09(08)_ODP", "defaultText": null }, { "id": 69836, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590033", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590033", "securityControlId": 31014, "ccis": [], "uuid": "80b821b3-1741-5bc1-91fe-3499d079bcde", "testId": "BCD-11.4_A03", "test": "cryptographic mechanisms are implemented to prevent the unauthorized disclosure of sensitive / regulated data at backup storage locations.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: all backup files", "otherId": "53A_R5_CP-09(08)", "defaultText": null }, { "id": 69837, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590035", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590035", "securityControlId": 31014, "ccis": [], "uuid": "d7018334-7fb0-5a1d-8bd2-d30bbc356c2a", "testId": "BCD-11.4_A04", "test": "cryptographic mechanisms are implemented to prevent the unauthorized disclosure of CUI at backup storage locations.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.08.09.b", "defaultText": null } ], "externalMappings": [ { "id": 554704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582386", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9927225f-c1a8-57d5-bf4f-b8498ebfe9f8", "parentControlId": 31014, "controlId": "AVAIL 2.4", "title": "AVAIL 2.4", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582386" }, { "id": 554705, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582386", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "210db8ab-8977-5f99-8d8a-313faa3575ea", "parentControlId": 31014, "controlId": "8.13", "title": "8.13", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582386" }, { "id": 554709, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32033665-d8e6-505e-b673-cd6c5cea8bac", "parentControlId": 31014, "controlId": "CP-09(08)", "title": "CP-09(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582387" }, { "id": 554710, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c35a4ed-0d17-530e-9045-c08483f840b3", "parentControlId": 31014, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582387" }, { "id": 554712, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5ce4b52-74e3-5dab-a677-dc90ddbc6ad5", "parentControlId": 31014, "controlId": "CP-09(08)", "title": "CP-09(08)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582387" }, { "id": 554713, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a21e2b48-2f10-5ac7-86c8-c181f990e984", "parentControlId": 31014, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582387" }, { "id": 554714, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1b381b8-dc20-5ab4-b7dc-d8ad9bfa8e7c", "parentControlId": 31014, "controlId": "CP-09(08)", "title": "CP-09(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582387" }, { "id": 554715, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5027d16-00ba-5af9-b82b-fbe47bcf34d4", "parentControlId": 31014, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582387" }, { "id": 554716, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f50fd347-ed76-5776-8cc9-5457de40ea72", "parentControlId": 31014, "controlId": "CP-09(08)", "title": "CP-09(08)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582388" }, { "id": 554717, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4c5a004-a5c6-5b0a-abbf-093f3ef0c389", "parentControlId": 31014, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582388" }, { "id": 554718, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f843783f-b900-5610-9066-798a8b9ad37c", "parentControlId": 31014, "controlId": "CP-09(08)", "title": "CP-09(08)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582388" }, { "id": 554719, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60555f4c-d2de-5c98-b5c0-cd00eb59cae3", "parentControlId": 31014, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582388" }, { "id": 554722, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7f200dc-e61d-5163-890e-01774b6ad359", "parentControlId": 31014, "controlId": "3.8.9", "title": "3.8.9", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582388" }, { "id": 554723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3099688-ff0c-5ed9-876b-ec10e8af860c", "parentControlId": 31014, "controlId": "03.08.09.a", "title": "03.08.09.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582389" }, { "id": 554724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582389", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07662b1d-b514-579c-92f1-aa2c6ff3f171", "parentControlId": 31014, "controlId": "03.08.09.b", "title": "03.08.09.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582389" }, { "id": 554730, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582389", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "290816e6-074e-5589-8e0a-7a393add7b74", "parentControlId": 31014, "controlId": "RESPONSE-4j", "title": "RESPONSE-4j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582389" } ], "id": 31014, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730929", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730929", "catalogueId": 1062, "uuid": "b1d3face-deb1-50fb-89db-4e012c6d9277", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Are cryptographic mechanisms utilized to prevent the unauthorized disclosure and/or modification of backup information?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Cryptographic Protection", "description": "

Control Description

Cryptographic mechanisms exist to prevent the unauthorized disclosure and/or modification of backup information.

Evidence Request List (ERL)

E-BCM-16

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Backups for sensitive/regulated data are cryptographically protected (encrypted and integrity checked) to prevent the unauthorized disclosure and modification of backup information.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational cryptographic capability exists to prevent the unauthorized disclosure and/or modification of backup information.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-11.4", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-11.4", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Data-at-rest cryptography

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Data-at-rest cryptography

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Data-at-rest cryptography

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Data-at-rest cryptography

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Data-at-rest cryptography", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69838, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590036", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590036", "securityControlId": 31015, "ccis": [], "uuid": "4fbd7777-caad-551c-bb9c-085105c7bef0", "testId": "BCD-11.5_A01", "test": "a sample of backup information in the restoration of selected system functions is used as part of contingency plan testing.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-09(02)", "defaultText": null } ], "externalMappings": [ { "id": 554763, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfa68b9c-2d08-5300-8480-efef8a585bef", "parentControlId": 31015, "controlId": "AVAIL 2.3", "title": "AVAIL 2.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582393" }, { "id": 554764, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "604501a0-d1ca-5c00-9041-5f30d2a75e6b", "parentControlId": 31015, "controlId": "SR 7.3 RE 1", "title": "SR 7.3 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582393" }, { "id": 554765, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3467e4ff-30b9-5fda-8779-0dd68c420ac0", "parentControlId": 31015, "controlId": "CP-9(2)", "title": "CP-9(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582393" }, { "id": 554766, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "625bc965-cbcc-5a0d-8065-d9bc37b68480", "parentControlId": 31015, "controlId": "CP-09(02)", "title": "CP-09(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582394" }, { "id": 554767, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3be8cf66-287a-5734-abf7-e6cff73816c8", "parentControlId": 31015, "controlId": "CP-09(02)", "title": "CP-09(02)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582394" }, { "id": 554768, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a199dd0-a6c9-51cd-9f91-8ff142e8845f", "parentControlId": 31015, "controlId": "CP-09(02)", "title": "CP-09(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582394" }, { "id": 554769, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a15fe497-d89e-521a-9e11-d9cfd6b0c50d", "parentControlId": 31015, "controlId": "CP-09(02)", "title": "CP-09(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582394" }, { "id": 554770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb150182-4ff2-5323-9c65-5da1e406a45f", "parentControlId": 31015, "controlId": "PR.DS-11", "title": "PR.DS-11", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582394" } ], "id": 31015, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730929", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73093", "catalogueId": 1062, "uuid": "0f45b84c-3175-5abb-bdaa-6c91c24a847d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize sampling of available backups to test recovery capabilities as part of business continuity plan testing?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Test Restoration Using Sampling", "description": "

Control Description

Mechanisms exist to utilize sampling of available backups to test recovery capabilities as part of business continuity plan testing.

Evidence Request List (ERL)

E-BCM-15

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel perform a random sampling of backups is tested at least semi-annually to verify integrity and recoverability of backed up data.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize sampling of available backups to test recovery capabilities as part of business continuity plan testing.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-11.5", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-11.5", "references": "

Micro-Small Business (<10 staff)

∙ Randomized data recovery testing

Small Business (10-49 staff)

∙ Randomized data recovery testing

Medium Business (50-249 staff)

∙ Randomized data recovery testing

Large Business (250-999 staff)

∙ Randomized data recovery testing

Enterprise (>1,000 staff)

∙ Randomized data recovery testing", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69839, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590036", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590036", "securityControlId": 31016, "ccis": [], "uuid": "e86ea3e0-b5f2-5bd6-81be-7cc21adf7415", "testId": "BCD-11.6_A01", "test": "system backup information is transferred to the alternate storage site for an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-09(05)[01]", "defaultText": null }, { "id": 69840, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590036", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590036", "securityControlId": 31016, "ccis": [], "uuid": "95c5830e-437a-51b9-82a3-0002fac88c93", "testId": "BCD-11.6_A02", "test": "time period consistent with recovery time and recovery point objectives is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-09(05)_ODP[01]", "defaultText": null }, { "id": 69841, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590036", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590036", "securityControlId": 31016, "ccis": [], "uuid": "10c0e515-5838-5047-bb68-d489dedd1a34", "testId": "BCD-11.6_A03", "test": "transfer rate consistent with recovery time and recovery point objectives is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-09(05)_ODP[02]", "defaultText": null }, { "id": 69842, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590037", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590037", "securityControlId": 31016, "ccis": [], "uuid": "789e7897-7510-5ccd-bbf2-ae44e8732909", "testId": "BCD-11.6_A04", "test": "system backup information is transferred to the alternate storage site transfer rate.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CP-09(05)[02]", "defaultText": null } ], "externalMappings": [ { "id": 554792, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9ee78aa-100e-5e7b-b7d9-14d5bc6dd062", "parentControlId": 31016, "controlId": "CP-9(5)", "title": "CP-9(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582397" }, { "id": 554793, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fedf2a0-d666-5700-ab1e-069a6f1c1b64", "parentControlId": 31016, "controlId": "CP-09(05)", "title": "CP-09(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582397" }, { "id": 554794, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "345ceed4-9f52-5972-a259-00b03333ceb3", "parentControlId": 31016, "controlId": "CP-09(05)", "title": "CP-09(05)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582397" }, { "id": 554795, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43e1da57-0eba-5da1-ba4a-8bde40be6828", "parentControlId": 31016, "controlId": "CP-09(05)", "title": "CP-09(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582397" }, { "id": 554796, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d27cce8-c5d3-5b3e-906a-f3d75e3a4ab1", "parentControlId": 31016, "controlId": "CP-09(05)", "title": "CP-09(05)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582397" }, { "id": 554797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "393cdac9-734d-594a-9ec2-da53c1340b1c", "parentControlId": 31016, "controlId": "PR.DS-11", "title": "PR.DS-11", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582397" } ], "id": 31016, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73093", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73093", "catalogueId": 1062, "uuid": "f1284646-9230-5d02-856a-0f0d66f9945d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization transfer backup data to the alternate storage site at a rate that is capable of meeting both Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Transfer to Alternate Storage Site", "description": "

Control Description

Mechanisms exist to transfer backup data to the alternate storage site at a rate that is capable of meeting both Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).

Evidence Request List (ERL)

E-BCM-12

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to transfer backup data to the alternate storage site at a rate that is capable of meeting both Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-11.6", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-11.6", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69843, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590037", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590037", "securityControlId": 31017, "ccis": [], "uuid": "bf707aa7-df18-5217-a139-5845737af39a", "testId": "BCD-11.7_A01", "test": "system backup is conducted by maintaining a redundant secondary system that can be activated without loss of information or disruption to operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-09(06)[02]", "defaultText": null }, { "id": 69844, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590037", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590037", "securityControlId": 31017, "ccis": [], "uuid": "bab6d4cd-9af0-58ba-9428-05726c3728df", "testId": "BCD-11.7_A02", "test": "system backup is conducted by maintaining a redundant secondary system that is not collocated with the primary system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-09(06)[01]", "defaultText": null } ], "externalMappings": [ { "id": 554806, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c6a1446-f85b-5c23-8593-c10b2862bdd1", "parentControlId": 31017, "controlId": "8.14", "title": "8.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582398" }, { "id": 554809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13f6ab7d-ba45-52fa-80b4-190e24d9dd5b", "parentControlId": 31017, "controlId": "CP-9(6)", "title": "CP-9(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582398" }, { "id": 554810, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582399", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2ee73fe-a3d3-5d88-8ac0-15660d5cab42", "parentControlId": 31017, "controlId": "CP-09(06)", "title": "CP-09(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582399" }, { "id": 554811, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582399", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b991327-2276-569f-9526-ea7b6c543c30", "parentControlId": 31017, "controlId": "CP-09(06)", "title": "CP-09(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582399" } ], "id": 31017, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73093", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73093", "catalogueId": 1062, "uuid": "63fb4233-bb91-5d8f-bc34-fd4c9bd7e5b7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain a failover capability, which is not collocated with the primary Technology Asset, Application and/or Service (TAAS), which can be activated with little-to-no loss of information or disruption to operations?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 5.0, "title": "Redundant Secondary System", "description": "

Control Description

Mechanisms exist to maintain a failover capability, which is not collocated with the primary Technology Asset, Application and/or Service (TAAS), which can be activated with little-to-no loss of information or disruption to operations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain a failover capability, which is not collocated with the primary Technology Asset, Application and/or Service (TAAS), which can be activated with little-to-no loss of information or disruption to operations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-11.7", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-11.7", "references": "

Micro-Small Business (<10 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)

Small Business (10-49 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)

Medium Business (50-249 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)

Large Business (250-999 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)

Enterprise (>1,000 staff)

∙ Continuity of Operations Plan (COOP)\n∙ Recovery Time Objectives (RTOs) \n∙ Recovery Point Objectives (RPOs)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69845, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590037", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590037", "securityControlId": 31018, "ccis": [], "uuid": "711d8cdc-710f-53ab-af57-d9ca351930e5", "testId": "BCD-11.8_A01", "test": "critical or sensitive system and organizational operations for which dual authorization is to be enforced are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.1.1e[a]", "defaultText": null }, { "id": 69846, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590038", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590038", "securityControlId": 31018, "ccis": [], "uuid": "b61d14ba-973a-5c9c-984c-e397c15aa09b", "testId": "BCD-11.8_A02", "test": "dual authorization is employed to execute critical or sensitive system and organizational operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.1.1e[b]", "defaultText": null }, { "id": 69847, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590038", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590038", "securityControlId": 31018, "ccis": [], "uuid": "d5e9c19d-0421-5545-9f19-1b3033250f9c", "testId": "BCD-11.8_A03", "test": "backup information for which to enforce dual authorization in order to delete or destroy is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-09(07)_ODP", "defaultText": null }, { "id": 69848, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590038", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590038", "securityControlId": 31018, "ccis": [], "uuid": "ada7dcc2-d42f-57e7-8fcb-c8a2951eec20", "testId": "BCD-11.8_A04", "test": "dual authorization for the deletion or destruction of backup information is enforced.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CP-09(07)", "defaultText": null } ], "externalMappings": [ { "id": 554823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42248b4b-7909-5acf-94a1-6aed01b470a3", "parentControlId": 31018, "controlId": "CP-9(7)", "title": "CP-9(7)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5824" }, { "id": 554824, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c1511cf-0d04-5db6-af02-46059b2726a4", "parentControlId": 31018, "controlId": "CP-09(07)", "title": "CP-09(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5824" }, { "id": 554825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8250ff15-dc7b-519d-bc3a-bb5bdfac2181", "parentControlId": 31018, "controlId": "CP-09(07)", "title": "CP-09(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5824" } ], "id": 31018, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730931", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730931", "catalogueId": 1062, "uuid": "e2de2ed6-8cb0-5f46-9ae6-88f475c0c626", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement and enforce dual authorization for the deletion or destruction of sensitive backup media and data?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Dual Authorization For Backup Media Destruction", "description": "

Control Description

Mechanisms exist to implement and enforce dual authorization for the deletion or destruction of sensitive backup media and data.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enforce dual authorization for the deletion or destruction of sensitive backup media and data.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-11.8", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-11.8", "references": "

Micro-Small Business (<10 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Small Business (10-49 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Medium Business (50-249 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Large Business (250-999 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Enterprise (>1,000 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69849, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590038", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590038", "securityControlId": 31019, "ccis": [], "uuid": "8387dd1b-53d4-5dd5-a5e6-92434238a114", "testId": "BCD-11.9_A01", "test": "Role Based Access Controls (RBAC) are utilized to logically restrict access to backups to privileged users with assigned roles for data backup and recovery operations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69850, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590038", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590038", "securityControlId": 31019, "ccis": [], "uuid": "19b5c7f8-249e-5445-af10-b463a3df04e0", "testId": "BCD-11.9_A02", "test": "Physical Access Controls (PAC) are utilized to physically restrict access to backups to privileged users with assigned roles for data backup and recovery operations.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 554828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b84562b7-f7b5-50a7-8c2f-5924dd50dc82", "parentControlId": 31019, "controlId": "RESPONSE-4j", "title": "RESPONSE-4j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582401" } ], "id": 31019, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730931", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730931", "catalogueId": 1062, "uuid": "1475932b-7527-5080-a9ce-9bd003580138", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict access to backups to privileged users with assigned roles for data backup and recovery operations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Backup Access", "description": "

Control Description

Mechanisms exist to restrict access to backups to privileged users with assigned roles for data backup and recovery operations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict access to backups to privileged users with assigned roles for data backup and recovery operations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-11.9", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-11.9", "references": "

Micro-Small Business (<10 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)

Small Business (10-49 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)

Medium Business (50-249 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)

Large Business (250-999 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)

Enterprise (>1,000 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69852, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590039", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590039", "securityControlId": 31021, "ccis": [], "uuid": "d6ce3f80-4aee-5e3f-987d-21a989ea410c", "testId": "BCD-12_A01", "test": "secure baseline configurations exist for systems, applications and/or services protect the confidentiality and integrity of data being stored, processed and/or transmitted.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69853, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590039", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590039", "securityControlId": 31021, "ccis": [], "uuid": "4b3245ed-4b79-5d8c-b8a4-efcc9a9c5882", "testId": "BCD-12_A02", "test": "systems, applications and/or services are securely recovered / reconstituted to a known, trusted state after a disruption, compromise or failure.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 554857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "024a6c22-80a2-57e3-9307-894e79111dde", "parentControlId": 31021, "controlId": "AVAIL 1.3", "title": "AVAIL 1.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582404" }, { "id": 554858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "196831af-3d3f-53fd-b997-3dc5d0184250", "parentControlId": 31021, "controlId": "AVAIL 2.5", "title": "AVAIL 2.5", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582404" }, { "id": 554859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5886dbe-704b-5f03-8ae6-95a7b9c7a0f9", "parentControlId": 31021, "controlId": "SR 7.4", "title": "SR 7.4", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582404" }, { "id": 554860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06eb2304-5af4-5581-88e8-3c6b3885a93a", "parentControlId": 31021, "controlId": "CR 7.4", "title": "CR 7.4", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582404" }, { "id": 554861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "396fdb4e-f459-5c8e-b186-94d6c7693aa0", "parentControlId": 31021, "controlId": "T1485", "title": "T1485", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582405" }, { "id": 554862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04db7b62-15ce-5097-8aae-a2333921403c", "parentControlId": 31021, "controlId": "T1485.001", "title": "T1485.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582405" }, { "id": 554863, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0eec1113-9539-5fbf-a4ed-88b7167635b0", "parentControlId": 31021, "controlId": "T1486", "title": "T1486", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582405" }, { "id": 554864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9bcaefe1-7e6a-5b59-8163-11cdd832dfe1", "parentControlId": 31021, "controlId": "T1490", "title": "T1490", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582405" }, { "id": 554865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a25e719a-70f3-531a-bfc5-3d77d565ae44", "parentControlId": 31021, "controlId": "T1491", "title": "T1491", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582405" }, { "id": 554866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9cb6511-eb67-50c7-b64f-76309282f3ba", "parentControlId": 31021, "controlId": "T1491.001", "title": "T1491.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582405" }, { "id": 554867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe6a89f7-e6f7-553c-9ea8-f3f37b209201", "parentControlId": 31021, "controlId": "T1491.002", "title": "T1491.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582405" }, { "id": 554868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4dfb53c-937b-5dd7-bd43-c58f3aedd666", "parentControlId": 31021, "controlId": "T1561", "title": "T1561", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582405" }, { "id": 554869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9cf4a470-02ca-587c-bd1d-f016860b6f4a", "parentControlId": 31021, "controlId": "T1561.001", "title": "T1561.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582406" }, { "id": 554870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e42a9689-f3c1-554b-a6f6-c296c3012d64", "parentControlId": 31021, "controlId": "T1561.002", "title": "T1561.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582406" }, { "id": 554871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b14466a-bf18-5315-8690-c096d319958a", "parentControlId": 31021, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582406" }, { "id": 554872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88ba217a-48ef-51df-a103-4c8121045e43", "parentControlId": 31021, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582406" }, { "id": 554873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06fe7ef2-0a72-52d0-b833-60834a1b3144", "parentControlId": 31021, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582406" }, { "id": 554874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c05fca3-fe27-53eb-9efe-1a23463947bf", "parentControlId": 31021, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582406" }, { "id": 554876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0973adf7-99a8-582e-9e7d-f934c8730f25", "parentControlId": 31021, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582406" }, { "id": 554878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6770d2ef-d393-5be0-819c-d2ce680db85e", "parentControlId": 31021, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582407" }, { "id": 554879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92850671-9bbd-5b5b-b479-8ba4e87863d3", "parentControlId": 31021, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582407" }, { "id": 554880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02d45da4-fe63-591a-8d47-3435f4553b64", "parentControlId": 31021, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582407" }, { "id": 554881, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8573c76-36de-5f10-8220-a645c9691264", "parentControlId": 31021, "controlId": "CP-10", "title": "CP-10", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582407" }, { "id": 554882, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bae8acb2-feb2-53b1-82ab-2313379a265b", "parentControlId": 31021, "controlId": "RC", "title": "RC", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582407" }, { "id": 554883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d940bfb2-069a-54f9-803d-aa1d6f3a986a", "parentControlId": 31021, "controlId": "RC.RP-01", "title": "RC.RP-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582407" }, { "id": 554884, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ed19175-939d-5fb0-af5b-c2114182f775", "parentControlId": 31021, "controlId": "RC.RP-05", "title": "RC.RP-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582407" }, { "controlId": "C.9.7", "title": "C.9.7 — Recovery and Reconstitution", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CP-10", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "764f625a-0bae-573d-9498-b9633fdde69f", "isPublic": true }, { "controlId": "NEI 08-09 App E.9.7", "title": "NEI 08-09 App E.9.7 — Recovery and Reconstitution", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.9.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "ae739528-13eb-5159-a57a-493db87d4078", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3)", "title": "10 CFR 73.54(d)(3) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.9.7", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "6765967c-8eaa-55e9-a9a0-b20dd168e42c", "isPublic": true }, { "controlId": "NSS-17T-Sec4.8", "title": "NSS-17T-Sec4.8 — Contingency Planning, Backup & Safe-State Recovery", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "ddedf70a-f244-50b9-aaa3-5a64f7c24880", "isPublic": true }, { "controlId": "IEC-62645-8.5", "title": "IEC-62645-8.5 — Continuity, Backup, and Recovery of I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "14d7ea79-35b9-504b-a31b-cd2735d5249d", "isPublic": true }, { "controlId": "IEC-63096-17.1", "title": "IEC-63096-17.1 — Operational Continuity and Reconstitution of CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "2a5aaeb1-63d4-5711-91c0-78248901a3f5", "isPublic": true } ], "id": 31021, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730932", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730932", "catalogueId": 1062, "uuid": "ad84fea7-74fb-56ff-b1fc-ea449eab3065", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure the secure recovery and reconstitution of Technology Assets, Applications and/or Services (TAAS) to a known state after a disruption, compromise or failure?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Technology Assets, Applications and/or Services (TAAS) Recovery & Reconstitution", "description": "

Control Description

Mechanisms exist to ensure the secure recovery and reconstitution of Technology Assets, Applications and/or Services (TAAS) to a known state after a disruption, compromise or failure.

Evidence Request List (ERL)

E-BCM-15

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure the secure recovery and reconstitution of Technology Assets, Applications and/or Services (TAAS) to a known state after a disruption, compromise or failure.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.9.7", "controlId": "BCD-12", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-12", "references": "

Micro-Small Business (<10 staff)

∙ Virtual machines\n∙ Acronis (https://acronis.com)\n∙ Documented system recovery runbooks

Small Business (10-49 staff)

∙ Virtual machines\n∙ Acronis (https://acronis.com)\n∙ Docker (https://docker.com)\n∙ Documented system recovery runbooks and checklists

Medium Business (50-249 staff)

∙ Virtual machines\n∙ Docker (https://docker.com)\n∙ Acronis Cyber Backup (https://acronis.com)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Documented and tested recovery runbooks

Large Business (250-999 staff)

∙ Enterprise DR platform (e.g., Veeam, Zerto, AWS DRS)\n∙ Docker (https://docker.com)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Tested recovery runbooks with RTO/RPO validation

Enterprise (>1,000 staff)

∙ Enterprise recovery and reconstitution platform (e.g., Commvault, Veeam Enterprise, Rubrik)\n∙ Automated recovery orchestration (e.g., Zerto, AWS DRS)\n∙ IaC-based reconstitution (Terraform, Ansible)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Regularly tested recovery with documented evidence", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69854, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590039", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590039", "securityControlId": 31022, "ccis": [], "uuid": "4f4d4181-fd47-5ffb-aeb3-0ab8cea2f9c9", "testId": "BCD-12.1_A01", "test": "transaction recovery is implemented for systems that are transaction-based.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CP-10(02)", "defaultText": null } ], "externalMappings": [ { "id": 554923, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "759a5b89-f3c9-50b6-862e-8893f7a01b9d", "parentControlId": 31022, "controlId": "CP-10(2)", "title": "CP-10(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582412" }, { "id": 554924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "643e8117-5b68-5cf6-9ff8-5092aaa9bb6b", "parentControlId": 31022, "controlId": "CP-10(02)", "title": "CP-10(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582412" }, { "id": 554925, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c3a383e-36af-524e-8aec-b1024cd9f77c", "parentControlId": 31022, "controlId": "CP-10(02)", "title": "CP-10(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582412" }, { "id": 554926, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efdfaf6e-20e2-5b35-bf96-19feb6d7ea6d", "parentControlId": 31022, "controlId": "CP-10(02)", "title": "CP-10(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582412" }, { "id": 554927, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0cdd645b-c652-56a1-b12f-d0fb7a6fc28b", "parentControlId": 31022, "controlId": "CP-10(02)", "title": "CP-10(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582412" }, { "id": 554928, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9dae024-69f3-5c17-87fe-1c53b182ef15", "parentControlId": 31022, "controlId": "CP-10(02)", "title": "CP-10(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582412" } ], "id": 31022, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730932", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730932", "catalogueId": 1062, "uuid": "789efe97-1a11-526b-a0fc-950d316a25c8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize specialized backup mechanisms that will allow transaction recovery for transaction-based Technology Assets, Applications and/or Services (TAAS) in accordance with Recovery Point Objectives (RPOs)?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Transaction Recovery", "description": "

Control Description

Mechanisms exist to utilize specialized backup mechanisms that will allow transaction recovery for transaction-based Technology Assets, Applications and/or Services (TAAS) in accordance with Recovery Point Objectives (RPOs).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ Backups are performed ad-hoc and focus on business-critical Technology Assets, Applications, Services and/or Data (TAASD).\n▪ IT and/or cybersecurity personnel use a backup methodology (e.g., grandfather, father & son rotation) to create backups to support business needs (e.g., Recovery Time Objectives).

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize specialized backup mechanisms that will allow transaction recovery for transaction-based Technology Assets, Applications and/or Services (TAAS) in accordance with Recovery Point Objectives (RPOs).

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-12.1", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-12.1", "references": "

Micro-Small Business (<10 staff)

∙ Basic business continuity plan\n∙ Regular data backup

Small Business (10-49 staff)

∙ Business continuity plan\n∙ Tested backup and restore procedures

Medium Business (50-249 staff)

∙ Formal BCP/DRP program\n∙ Regular backup testing\n∙ Alternate processing capability

Large Business (250-999 staff)

∙ Enterprise BCP/DRP program\n∙ DR site\n∙ Annual exercises\n∙ RTO/RPO targets

Enterprise (>1,000 staff)

∙ Enterprise BC/DR platform (e.g., Zerto, Veeam Enterprise)\n∙ Dedicated DR site\n∙ Automated failover\n∙ Annual DR exercises", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69855, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59004", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59004", "securityControlId": 31023, "ccis": [], "uuid": "000aed3a-ac99-5dad-a637-1f2842cfebe0", "testId": "BCD-12.2_A01", "test": "system components for which Mean Time to Failure (MTTF) should be determined are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-13_ODP[01]", "defaultText": null }, { "id": 69856, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59004", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59004", "securityControlId": 31023, "ccis": [], "uuid": "e08f2080-7e11-578f-8f9f-8e894e0f83ba", "testId": "BCD-12.2_A02", "test": "Mean Time to Failure (MTTF) is determined for system components in specific environments of operation.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-13a.", "defaultText": null }, { "id": 69857, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59004", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59004", "securityControlId": 31023, "ccis": [], "uuid": "cd1addc9-155e-53c9-9b6e-db4a1a966213", "testId": "BCD-12.2_A03", "test": "Mean Time to Failure (MTTF) substitution criteria to be used as a means to exchange active and standby components are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-13_ODP[02]", "defaultText": null }, { "id": 69858, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59004", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59004", "securityControlId": 31023, "ccis": [], "uuid": "292e7f89-2999-5f95-a7e3-74255b57beac", "testId": "BCD-12.2_A04", "test": "substitute system components and a means to exchange active and standby components are provided in accordance with Mean Time to Failure (MTTF) substitution criteria.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-13b.", "defaultText": null } ], "externalMappings": [ { "id": 554941, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "152a21f2-c79e-5b9c-bcf2-c6fae6dedfe8", "parentControlId": 31023, "controlId": "CR 2.10(b)", "title": "CR 2.10(b)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582414" }, { "id": 554942, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb3884ee-2626-5f97-8da7-d1da117a3e17", "parentControlId": 31023, "controlId": "CR 7.1", "title": "CR 7.1", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582414" }, { "id": 554944, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6afdb875-2a7e-50b7-882c-656ffcb71758", "parentControlId": 31023, "controlId": "CP-10(5)", "title": "CP-10(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582414" }, { "id": 554945, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09c6bfad-5f43-571a-8f52-ec2fade3dc58", "parentControlId": 31023, "controlId": "SI-13", "title": "SI-13", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582414" }, { "id": 554947, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97063186-8963-50f9-be8f-0d59963395a5", "parentControlId": 31023, "controlId": "SI-13", "title": "SI-13", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582414" }, { "id": 554948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1973e0e-7dab-57ea-8058-9d5199ff6e24", "parentControlId": 31023, "controlId": "SI-13", "title": "SI-13", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582415" } ], "id": 31023, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730933", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730933", "catalogueId": 1062, "uuid": "a4a16663-3e20-5f83-8743-e75dc630328b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement real-time or near-real-time failover capability to maintain availability of critical Technology Assets, Applications, Services and/or Data (TAASD)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Failover Capability", "description": "

Control Description

Mechanisms exist to implement real-time or near-real-time failover capability to maintain availability of critical Technology Assets, Applications, Services and/or Data (TAASD).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ Backups are performed ad-hoc and focus on business-critical Technology Assets, Applications, Services and/or Data (TAASD).\n▪ IT and/or cybersecurity personnel use a backup methodology (e.g., grandfather, father & son rotation) to create backups to support business needs (e.g., Recovery Time Objectives).

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement real-time or near-real-time failover capability to maintain availability of critical TAASD.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-12.2", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-12.2", "references": "

Micro-Small Business (<10 staff)

∙ Load balancers\n∙ High Availability (HA) network appliances (e.g., firewalls, routers, switches, etc.)

Small Business (10-49 staff)

∙ Load balancers\n∙ High Availability (HA) network appliances (e.g., firewalls, routers, switches, etc.)

Medium Business (50-249 staff)

∙ Load balancers\n∙ High Availability (HA) network appliances (e.g., firewalls, routers, switches, etc.)

Large Business (250-999 staff)

∙ Load balancers\n∙ High Availability (HA) network appliances (e.g., firewalls, routers, switches, etc.)

Enterprise (>1,000 staff)

∙ Load balancers\n∙ High Availability (HA) network appliances (e.g., firewalls, routers, switches, etc.)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69860, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590041", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590041", "securityControlId": 31025, "ccis": [], "uuid": "5a4803c9-9cbc-5fd9-8780-9a21ffca599b", "testId": "BCD-12.4_A01", "test": "the capability to restore system components within organization-defined restoration time periods from configuration-controlled and integrity-protected information representing a known, operational state for the components is provided.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CP-10(04)", "defaultText": null }, { "id": 69861, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590041", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590041", "securityControlId": 31025, "ccis": [], "uuid": "516c8d89-e50b-5c34-9754-ebc2c42a70c2", "testId": "BCD-12.4_A02", "test": "restoration time period within which to restore system components to a known, operational state is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-10(04)_ODP", "defaultText": null } ], "externalMappings": [ { "id": 554966, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582425", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7610145-1c8c-5921-9f98-add587391ee0", "parentControlId": 31025, "controlId": "AVAIL 1.3", "title": "AVAIL 1.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582425" }, { "id": 554967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582425", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4337a002-e9d2-564d-9cfe-44761761193a", "parentControlId": 31025, "controlId": "CP-10(4)", "title": "CP-10(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582425" }, { "id": 554968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582425", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14d4ba58-9c0c-5a1f-8a7b-21da6c4501e4", "parentControlId": 31025, "controlId": "CP-10(04)", "title": "CP-10(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582425" }, { "id": 554969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582425", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0de629d1-eb57-5deb-99d7-7158013fb38b", "parentControlId": 31025, "controlId": "CP-10(04)", "title": "CP-10(04)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582425" }, { "id": 554970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582425", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09f65451-2c7b-5406-8d93-df50c2e25c9b", "parentControlId": 31025, "controlId": "CP-10(04)", "title": "CP-10(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582425" }, { "id": 554971, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582425", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd85899b-0cf4-5b05-b494-43286c2ff9a0", "parentControlId": 31025, "controlId": "CP-10(04)", "title": "CP-10(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582425" } ], "id": 31025, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730933", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730933", "catalogueId": 1062, "uuid": "df8271cf-d763-5bba-8c3d-736769eba980", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restore Technology Assets, Applications, Services and/or Data (TAASD) within organization-defined restoration time-periods from configuration-controlled and integrity-protected information; representing a known, operational state for the asset?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Restore Within Time Period", "description": "

Control Description

Mechanisms exist to restore Technology Assets, Applications, Services and/or Data (TAASD) within organization-defined restoration time-periods from configuration-controlled and integrity-protected information; representing a known, operational state for the asset.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).\n▪ Backups are performed ad-hoc and focus on business-critical Technology Assets, Applications, Services and/or Data (TAASD).\n▪ IT and/or cybersecurity personnel use a backup methodology (e.g., grandfather, father & son rotation) to create backups to support business needs (e.g., Recovery Time Objectives).

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restore TAASD within organization-defined restoration time-periods from configuration-controlled and integrity-protected information; representing a known, operational state for the asset.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-12.4", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-12.4", "references": "

Micro-Small Business (<10 staff)

∙ Virtual machines\n∙ Acronis (https://acronis.com)

Small Business (10-49 staff)

∙ Virtual machines\n∙ Docker (https://docker.com)\n∙ Acronis (https://acronis.com)

Medium Business (50-249 staff)

∙ Virtual machines\n∙ Docker (https://docker.com)\n∙ Acronis (https://acronis.com)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Docker (https://docker.com)

Large Business (250-999 staff)

∙ Virtual machines\n∙ Docker (https://docker.com)\n∙ Acronis (https://acronis.com)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Docker (https://docker.com)

Enterprise (>1,000 staff)

∙ Virtual machines\n∙ Docker (https://docker.com)\n∙ Acronis (https://acronis.com)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Docker (https://docker.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69862, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590041", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590041", "securityControlId": 31026, "ccis": [], "uuid": "67983739-fdd7-5372-82a3-a4bea2c08093", "testId": "BCD-13_A01", "test": "system components used for recovery and reconstitution are protected.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CP-10(06)", "defaultText": null } ], "externalMappings": [ { "id": 554978, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582426", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb2308e7-5162-567f-9f19-49d7993b111a", "parentControlId": 31026, "controlId": "CP-10(6)", "title": "CP-10(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582426" }, { "id": 554979, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582426", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c11097a-5ecb-5b73-93ed-aad315eacca3", "parentControlId": 31026, "controlId": "CP-10(06)", "title": "CP-10(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582426" }, { "id": 554980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582427", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70ab04c4-bcf1-57bc-9d3f-863750ba510a", "parentControlId": 31026, "controlId": "CP-10(06)", "title": "CP-10(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582427" }, { "id": 554981, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582427", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a67fc313-ed46-572e-92e4-b51ef25a0aff", "parentControlId": 31026, "controlId": "CP-10(06)", "title": "CP-10(06)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582427" }, { "id": 554982, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582427", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43aeecaa-3958-55d9-935b-d6c5e33f2bc2", "parentControlId": 31026, "controlId": "CP-10(06)", "title": "CP-10(06)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582427" }, { "id": 554983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582427", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "086b2f65-25c3-5160-a89b-94511c327807", "parentControlId": 31026, "controlId": "RC.RP-03", "title": "RC.RP-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582427" }, { "controlId": "NSS-17T-Sec4.8", "title": "NSS-17T-Sec4.8 — Contingency Planning, Backup & Safe-State Recovery", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "8d698fac-b79d-5bc1-966e-b8d745bb63cb", "isPublic": true }, { "controlId": "IEC-62645-8.5", "title": "IEC-62645-8.5 — Continuity, Backup, and Recovery of I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "f11e244d-882d-58c3-9312-a164d4c9191a", "isPublic": true }, { "controlId": "IEC-63096-17.1", "title": "IEC-63096-17.1 — Operational Continuity and Reconstitution of CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "b07ba61f-2798-5062-84dd-19c0c7eb9e69", "isPublic": true } ], "id": 31026, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730933", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730933", "catalogueId": 1062, "uuid": "2c101948-d830-5881-a1e9-e273819d70bc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect backup and restoration hardware and software?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Backup & Restoration Hardware Protection", "description": "

Control Description

Mechanisms exist to protect backup and restoration hardware and software.

Evidence Request List (ERL)

E-GOV-10\nE-GOV-11

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs, redundant power, etc.).

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to protect backup and restoration hardware and software.

Level 4 - Quantitatively Controlled: Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-13", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-13", "references": "

Micro-Small Business (<10 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)

Small Business (10-49 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)

Medium Business (50-249 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)

Large Business (250-999 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)

Enterprise (>1,000 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69863, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590042", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590042", "securityControlId": 31027, "ccis": [], "uuid": "1d2c0259-9ae4-57e4-a8e1-a21ed1c31966", "testId": "BCD-13.1_A01", "test": "methods to verify the integrity of backups and other restoration assets are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69864, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590042", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590042", "securityControlId": 31027, "ccis": [], "uuid": "9ad579fd-68c7-5fa5-b10e-26b5a5c696c0", "testId": "BCD-13.1_A02", "test": "the integrity of backups and other restoration assets is verified, prior to using them for restoration.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 554990, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582428", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9eab8bed-c268-58a3-a1ec-4fcae76dbe47", "parentControlId": 31027, "controlId": "RC.RP-03", "title": "RC.RP-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582428" } ], "id": 31027, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730934", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730934", "catalogueId": 1062, "uuid": "5cec2648-0a4a-5f7b-a843-5eb84a3e3160", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization verify the integrity of backups and other restoration assets prior to using them for restoration?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Restoration Integrity Verification", "description": "

Control Description

Mechanisms exist to verify the integrity of backups and other restoration assets prior to using them for restoration.

Evidence Request List (ERL)

E-GOV-10\nE-GOV-11

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to verify the integrity of backups and other restoration assets prior to using them for restoration.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-13.1", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-13.1", "references": "

Micro-Small Business (<10 staff)

∙ Basic business continuity plan\n∙ Regular data backup

Small Business (10-49 staff)

∙ Business continuity plan\n∙ Tested backup and restore procedures

Medium Business (50-249 staff)

∙ Formal BCP/DRP program\n∙ Regular backup testing\n∙ Alternate processing capability

Large Business (250-999 staff)

∙ Enterprise BCP/DRP program\n∙ DR site\n∙ Annual exercises\n∙ RTO/RPO targets

Enterprise (>1,000 staff)

∙ Enterprise BC/DR platform (e.g., Zerto, Veeam Enterprise)\n∙ Dedicated DR site\n∙ Automated failover\n∙ Annual DR exercises", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69867, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590043", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590043", "securityControlId": 31029, "ccis": [], "uuid": "08b35e5d-d492-5e65-a919-56e357b03fac", "testId": "BCD-15_A01", "test": "systems and system components that are or may be hard to replace in a supply chain disruption are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69868, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590043", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590043", "securityControlId": 31029, "ccis": [], "uuid": "51e31bf7-2928-5793-836e-724dd503c3cb", "testId": "BCD-15_A02", "test": "resources are allocated to obtain hard to replace identified systems and system components for critical business functions.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69869, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590043", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590043", "securityControlId": 31029, "ccis": [], "uuid": "dd13159f-2cf9-5db5-85cf-6b06a5b7c8b9", "testId": "BCD-15_A03", "test": "a pool of hard to replace identified systems and system components for critical business functions is maintained.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 554998, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582429", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8a66fd4-cafb-5250-9254-51e934e139e9", "parentControlId": 31029, "controlId": "RESPONSE-4c", "title": "RESPONSE-4c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582429" }, { "id": 554999, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582429", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9016d7f1-4ec1-5c5d-b06b-e32228beab8a", "parentControlId": 31029, "controlId": "RESPONSE-4l", "title": "RESPONSE-4l", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582429" }, { "controlId": "NSS-17T-Sec4.8", "title": "NSS-17T-Sec4.8 — Contingency Planning, Backup & Safe-State Recovery", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7662166a-8154-58e4-9a93-d01d5a75dc11", "isPublic": true }, { "controlId": "IEC-62645-8.5", "title": "IEC-62645-8.5 — Continuity, Backup, and Recovery of I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "a7e023fe-f314-534f-a43f-46be775bad3b", "isPublic": true }, { "controlId": "IEC-63096-17.1", "title": "IEC-63096-17.1 — Operational Continuity and Reconstitution of CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (BCD Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "f2ee61b3-4c44-5759-b0f6-5b328eb03d50", "isPublic": true } ], "id": 31029, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730934", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730934", "catalogueId": 1062, "uuid": "3a351fa4-5c7e-5dc6-b6d6-680d33ca9458", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization purchase and maintain a sufficient reserve of spare hardware to ensure essential missions and business functions can be maintained in the event of a supply chain disruption?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Reserve Hardware", "description": "

Control Description

Mechanisms exist to purchase and maintain a sufficient reserve of spare hardware to ensure essential missions and business functions can be maintained in the event of a supply chain disruption.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to purchase and maintain a sufficient reserve of spare hardware to ensure essential missions and business functions can be maintained in the event of a supply chain disruption.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "BCD-15", "family": "Business Continuity & Disaster Recovery", "enhancements": "", "sortId": "BCD-15", "references": "

Micro-Small Business (<10 staff)

∙ Basic business continuity plan\n∙ Regular data backup

Small Business (10-49 staff)

∙ Business continuity plan\n∙ Tested backup and restore procedures

Medium Business (50-249 staff)

∙ Dedicated recovery environment\n∙ Dedicated recovery hardware

Large Business (250-999 staff)

∙ Dedicated recovery environment\n∙ Dedicated recovery hardware

Enterprise (>1,000 staff)

∙ Dedicated recovery environment\n∙ Dedicated recovery hardware", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69872, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590044", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590044", "securityControlId": 31031, "ccis": [], "uuid": "2d5b6de8-3359-5fae-8bf4-5feaff872773", "testId": "CAP-01_A01", "test": "resources to be allocated to protect the availability of resources are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-06_ODP[01]", "defaultText": null }, { "id": 69873, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590044", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590044", "securityControlId": 31031, "ccis": [], "uuid": "2c403ee8-dcef-5670-a33f-f901ff56828a", "testId": "CAP-01_A02", "test": "controls to protect the availability of resources are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-06_ODP[02]\n53A_R5_SC-06_ODP[03]", "defaultText": null }, { "id": 69874, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590044", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590044", "securityControlId": 31031, "ccis": [], "uuid": "e9c5593e-81f7-5b69-8a14-e5309dc2c20a", "testId": "CAP-01_A03", "test": "the availability of resources is protected by allocating resources per organization-defined criteria.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-06", "defaultText": null }, { "id": 69875, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590044", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590044", "securityControlId": 31031, "ccis": [], "uuid": "22d9aff2-b55e-542b-984a-f9738b87dccf", "testId": "CAP-01_A04", "test": "capacity & performance planning operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69876, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590044", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590044", "securityControlId": 31031, "ccis": [], "uuid": "28d13488-d902-5088-91b0-26d1c2dcc3ce", "testId": "CAP-01_A05", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support capacity & performance planning operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69877, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590045", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590045", "securityControlId": 31031, "ccis": [], "uuid": "26ea66b8-b8ba-5dc9-b938-8701ac632f1d", "testId": "CAP-01_A06", "test": "responsibility and authority for the performance of capacity & performance planning-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69878, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590045", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590045", "securityControlId": 31031, "ccis": [], "uuid": "15e56d13-956f-52bc-b180-3dc0f6faaec2", "testId": "CAP-01_A07", "test": "personnel performing capacity & performance planning-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 555015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582431", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9612bc0d-42c4-5696-a705-1f5d36a96555", "parentControlId": 31031, "controlId": "AVAIL 1.2", "title": "AVAIL 1.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582431" }, { "id": 555016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d00860a0-2d37-5687-9280-e51175e00c7e", "parentControlId": 31031, "controlId": "SR 7.2", "title": "SR 7.2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582432" }, { "id": 555017, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "952ca883-a619-5fed-86c7-54ec2b4707d0", "parentControlId": 31031, "controlId": "CR 7.2", "title": "CR 7.2", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582432" }, { "id": 555018, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66d5e31a-cfe4-58c4-894c-b13e40ca0195", "parentControlId": 31031, "controlId": "8.6", "title": "8.6", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582432" }, { "id": 555022, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b174e5a-0e9f-5554-9913-ce677830b824", "parentControlId": 31031, "controlId": "SC-5", "title": "SC-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582432" }, { "id": 555023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "194a5228-c1d3-5d99-abc1-ef79aaccec8d", "parentControlId": 31031, "controlId": "SC-5(3)", "title": "SC-5(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582432" }, { "id": 555024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f4d687f-923d-5832-911a-0e7839200f2a", "parentControlId": 31031, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582432" }, { "id": 555025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d20a0dcd-529f-506d-8d98-4442d7250c10", "parentControlId": 31031, "controlId": "SC-05(03)", "title": "SC-05(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582433" }, { "id": 555027, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec3226f3-4e03-59c0-8554-1b45c37f5d04", "parentControlId": 31031, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582433" }, { "id": 555028, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "446dcf73-273a-5d0b-a5d7-c558c8b56016", "parentControlId": 31031, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582433" }, { "id": 555029, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec667925-4d35-5e49-b48c-da3e5753f5c7", "parentControlId": 31031, "controlId": "SC-05(03)", "title": "SC-05(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582433" }, { "id": 555030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbf21979-fb34-5a48-92d4-338fb80be9b3", "parentControlId": 31031, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582433" }, { "id": 555031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1dc50445-634a-597b-a733-2c88283676db", "parentControlId": 31031, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582433" }, { "id": 555032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e23972d1-029f-5f92-aaa8-e27edf765b9b", "parentControlId": 31031, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582433" }, { "id": 555034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ca0f8aa-2893-57da-bb32-3e277dfb4800", "parentControlId": 31031, "controlId": "PR.IR-04", "title": "PR.IR-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582434" }, { "id": 555038, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582434", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70d47199-b9dc-58cc-b627-a57300bc6d23", "parentControlId": 31031, "controlId": "ARCHITECTURE-3i", "title": "ARCHITECTURE-3i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582434" } ], "id": 31031, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730935", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730935", "catalogueId": 1062, "uuid": "e7f6830e-6b11-546b-82c3-0c77364e5932", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of capacity management controls to ensure optimal system performance to meet expected and anticipated future capacity requirements?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Capacity & Performance Management", "description": "

Control Description

Mechanisms exist to facilitate the implementation of capacity management controls to ensure optimal system performance to meet expected and anticipated future capacity requirements.

Evidence Request List (ERL)

E-CAP-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Capability & Performance Planning (CAP) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CAP domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Capability management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel work with business stakeholders to identify growth requirements and add capacity accordingly.

Level 2 - Planned & Tracked: Capability & Performance Planning (CAP) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CAP domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CAP domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CAP domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Capability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Capability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Capability & Performance Planning (CAP) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CAP domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CAP domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CAP domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of capacity management controls to ensure optimal system performance to meet expected and anticipated future capacity requirements.

Level 4 - Quantitatively Controlled: Capability & Performance Planning (CAP) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Capability & Performance Planning (CAP) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CAP-01", "family": "Capacity & Performance Planning", "enhancements": "", "sortId": "CAP-01", "references": "

Micro-Small Business (<10 staff)

∙ Manual resource monitoring\n∙ ManageEngine OpManager (https://manageengine.com)

Small Business (10-49 staff)

∙ Manual resource monitoring\n∙ ManageEngine OpManager (https://manageengine.com)

Medium Business (50-249 staff)

∙ Manual resource monitoring\n∙ ManageEngine OpManager (https://manageengine.com)\n∙ Splunk (https://splunk.com)\n∙ Solarwinds (https://solarwinds.com)

Large Business (250-999 staff)

∙ ManageEngine OpManager (https://manageengine.com)\n∙ Splunk (https://splunk.com)\n∙ Solarwinds (https://solarwinds.com)

Enterprise (>1,000 staff)

∙ Splunk (https://splunk.com)\n∙ Solarwinds (https://solarwinds.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69879, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590045", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590045", "securityControlId": 31032, "ccis": [], "uuid": "4378c489-2cca-5280-bfc0-d1d2738316d2", "testId": "CAP-02_A01", "test": "types of denial-of-service events to be protected against or limited are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-05_ODP[01]", "defaultText": null }, { "id": 69880, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590045", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590045", "securityControlId": 31032, "ccis": [], "uuid": "cc2d512e-db4b-5088-b39b-832ca1fb604c", "testId": "CAP-02_A02", "test": "controls by type of denial-of-service event are employed to achieve the denial-of-service protection objective.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-05b.", "defaultText": null }, { "id": 69881, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590045", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590045", "securityControlId": 31032, "ccis": [], "uuid": "64be0798-6f39-503f-97e0-35beefa5108e", "testId": "CAP-02_A03", "test": "resource prioritization is designed to limit negative effects of denial-of-service events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-05_ODP[02]", "defaultText": null }, { "id": 69882, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590046", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590046", "securityControlId": 31032, "ccis": [], "uuid": "9059e1b6-919e-592b-9fd2-b68f21a77feb", "testId": "CAP-02_A04", "test": "controls to achieve the denial-of-service objective by type of denial-of-service event are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-05_ODP[03]", "defaultText": null }, { "id": 69883, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590046", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590046", "securityControlId": 31032, "ccis": [], "uuid": "67457a4c-6a73-5b97-a42e-b5266d6702c3", "testId": "CAP-02_A05", "test": "the effects of types of denial-of-service events are organizationally-defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-05a.", "defaultText": null } ], "externalMappings": [ { "id": 555092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58244", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d537a4e-c6a7-5708-a214-c3c51d323b64", "parentControlId": 31032, "controlId": "T1564.009", "title": "T1564.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58244" }, { "id": 555093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58244", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce3bb09e-f902-517d-b7c0-6c97c8fd8ebc", "parentControlId": 31032, "controlId": "SC-5", "title": "SC-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58244" }, { "id": 555094, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58244", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8826ec9-40aa-57d5-9f88-11e43695e7bd", "parentControlId": 31032, "controlId": "SC-5(1)", "title": "SC-5(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58244" }, { "id": 555095, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "818f6161-7ac2-5d3e-9398-462428e8fc10", "parentControlId": 31032, "controlId": "SC-5(2)", "title": "SC-5(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582441" }, { "id": 555096, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be9dee69-0915-510e-a317-d0980763eb93", "parentControlId": 31032, "controlId": "SC-6", "title": "SC-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582441" }, { "id": 555097, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e846522-6c3f-5a2d-be02-23855d8fd4dd", "parentControlId": 31032, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582441" }, { "id": 555098, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5bcf296-ee55-5af8-b955-99ae91cd089e", "parentControlId": 31032, "controlId": "SC-05(01)", "title": "SC-05(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582441" }, { "id": 555099, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19bcd524-b094-51cc-b0f0-84cb5c19b5ea", "parentControlId": 31032, "controlId": "SC-05(02)", "title": "SC-05(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582441" }, { "id": 555100, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bd9f130-6af6-53a0-86fc-7c763d81cdee", "parentControlId": 31032, "controlId": "SC-06", "title": "SC-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582441" }, { "id": 555103, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "459eac87-9fe4-5f17-b157-6eb25a507cf7", "parentControlId": 31032, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582441" }, { "id": 555104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "282bd8cf-4483-5460-9748-4310d112f5f6", "parentControlId": 31032, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582442" }, { "id": 555105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8740edb3-9230-5640-b740-a396740108d6", "parentControlId": 31032, "controlId": "SC-05(01)", "title": "SC-05(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582442" }, { "id": 555106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3286bf56-70c4-56e9-b00e-40be5c57e6ef", "parentControlId": 31032, "controlId": "SC-05(02)", "title": "SC-05(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582442" }, { "id": 555107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "088a588a-117b-508b-bb3f-31fd0d354bd8", "parentControlId": 31032, "controlId": "SC-06", "title": "SC-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582442" }, { "id": 555108, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c217ebee-e1e6-5601-bb39-9a48fc38aaf9", "parentControlId": 31032, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582442" }, { "id": 555109, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4ed8ef5-dcc6-50b7-a626-c0a2b869e019", "parentControlId": 31032, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582442" }, { "id": 555110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39f657b1-eba1-5c9b-84fc-291c57d2857a", "parentControlId": 31032, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582442" }, { "id": 555112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc6bd719-e2b2-54e7-920a-719b1ed7cf35", "parentControlId": 31032, "controlId": "SC-5", "title": "SC-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582442" }, { "id": 555113, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "daaafc7b-a641-566d-a5a4-9a2394c22b21", "parentControlId": 31032, "controlId": "SC-5(2)", "title": "SC-5(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582443" }, { "id": 555115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fae4a848-e520-5548-814c-b5599259e5b1", "parentControlId": 31032, "controlId": "PR.IR-04", "title": "PR.IR-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582443" }, { "controlId": "B.3.5", "title": "B.3.5 — Resource Priority", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "553e9e56-232c-5277-9c41-2a165e081e45", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.5", "title": "NEI 08-09 App D.3.5 — Resource Priority", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d39a7b7f-85c4-56bd-ada9-969825620af5", "isPublic": true }, { "controlId": "10 CFR 73.54(a)(2)", "title": "10 CFR 73.54(a)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "03990dc9-d66d-52e4-8883-091f37218b2e", "isPublic": true }, { "controlId": "CIP-012-2-1.1", "title": "CIP-012-2-1.1", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a2e80fee-6def-55f6-bccf-9ddfebce6760", "isPublic": true } ], "id": 31032, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730935", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730935", "catalogueId": 1062, "uuid": "eaf3c03d-65dc-59cc-8b34-720ff8ea4e7e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization control resource utilization of Technology Assets, Applications and/or Services (TAAS) that are susceptible to Denial of Service (DoS) attacks to limit and prioritize the use of resources?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Resource Priority", "description": "

Control Description

Mechanisms exist to control resource utilization of Technology Assets, Applications and/or Services (TAAS) that are susceptible to Denial of Service (DoS) attacks to limit and prioritize the use of resources.

Evidence Request List (ERL)

E-CAP-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Capability & Performance Planning (CAP) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CAP domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Capability management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel work with business stakeholders to identify growth requirements and add capacity accordingly.

Level 2 - Planned & Tracked: Capability & Performance Planning (CAP) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CAP domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CAP domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CAP domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Capability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Capability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel work with business stakeholders and process owners to create and maintain infrastructure performance metrics to understand current resource needs.

Level 3 - Well Defined: Capability & Performance Planning (CAP) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CAP domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CAP domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CAP domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to control resource utilization of Technology Assets, Applications and/or Services (TAAS) that are susceptible to Denial of Service (DoS) attacks to limit and prioritize the use of resources.

Level 4 - Quantitatively Controlled: Capability & Performance Planning (CAP) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Capability & Performance Planning (CAP) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.5", "controlId": "CAP-02", "family": "Capacity & Performance Planning", "enhancements": "", "sortId": "CAP-02", "references": "

Micro-Small Business (<10 staff)

∙ Monitor system resource usage periodically

Small Business (10-49 staff)

∙ Capacity monitoring for critical systems\n∙ Resource usage baseline

Medium Business (50-249 staff)

∙ Capacity planning process\n∙ Performance monitoring tools

Large Business (250-999 staff)

∙ Enterprise capacity management program\n∙ Performance monitoring platform (e.g., Dynatrace, New Relic)

Enterprise (>1,000 staff)

∙ Enterprise capacity management platform\n∙ APM tools (e.g., Dynatrace, Datadog)\n∙ Automated scaling", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69884, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590046", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590046", "securityControlId": 31033, "ccis": [], "uuid": "4691fb08-426d-51da-a1ff-85f86b044853", "testId": "CAP-03_A01", "test": "capacity planning is conducted so that the necessary capacity exists during contingency operations for information processing.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-02(02)[01]", "defaultText": null }, { "id": 69885, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590046", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590046", "securityControlId": 31033, "ccis": [], "uuid": "af682d22-0c2b-59ed-a499-06af01962e37", "testId": "CAP-03_A02", "test": "capacity planning is conducted so that the necessary capacity exists during contingency operations for telecommunications.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02(02)[02]", "defaultText": null }, { "id": 69886, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590046", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590046", "securityControlId": 31033, "ccis": [], "uuid": "45725058-be7e-51c5-9fed-8d8fcb0b8763", "testId": "CAP-03_A03", "test": "capacity planning is conducted so that the necessary capacity exists during contingency operations for environmental support.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CP-02(02)[03]", "defaultText": null } ], "externalMappings": [ { "id": 555145, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93f8549f-82f7-50c1-b4ea-f1a86f7cdbc6", "parentControlId": 31033, "controlId": "8.6", "title": "8.6", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582448" }, { "id": 555149, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5bbc7d97-af16-5b34-8658-2810af12c013", "parentControlId": 31033, "controlId": "SC-5", "title": "SC-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582448" }, { "id": 555150, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a42cb9db-cb48-5944-acdb-c9846d7540aa", "parentControlId": 31033, "controlId": "SC-5(2)", "title": "SC-5(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582448" }, { "id": 555151, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "893e2882-bf20-520c-87af-c05d419494d3", "parentControlId": 31033, "controlId": "CP-2(2)", "title": "CP-2(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582449" }, { "id": 555152, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfd29340-2551-55eb-9e94-180e8ad7e766", "parentControlId": 31033, "controlId": "CP-02(02)", "title": "CP-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582449" }, { "id": 555153, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "574d1dfd-1fb4-5981-988b-af1b133d838f", "parentControlId": 31033, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582449" }, { "id": 555154, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d2bce50-2755-5407-99c0-e2a3888df744", "parentControlId": 31033, "controlId": "SC-05(02)", "title": "SC-05(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582449" }, { "id": 555157, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a444f8f1-b6ce-5cce-bd4c-0c2e7daf09b0", "parentControlId": 31033, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582449" }, { "id": 555158, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6442d144-ba2e-5a13-8201-13bd41c058e9", "parentControlId": 31033, "controlId": "CP-02(02)", "title": "CP-02(02)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582449" }, { "id": 555159, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9204ff8-ecbd-5926-b5b1-420344c8e558", "parentControlId": 31033, "controlId": "CP-02(02)", "title": "CP-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582449" }, { "id": 555160, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e77aa2c-7174-584e-802a-8b5e81b824ff", "parentControlId": 31033, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58245" }, { "id": 555161, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "918b11a8-5bb7-51a1-b7bb-6eea985f4ca6", "parentControlId": 31033, "controlId": "SC-05(02)", "title": "SC-05(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58245" }, { "id": 555162, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b61e9923-1830-5bb9-9447-0fa1ce92c348", "parentControlId": 31033, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58245" }, { "id": 555163, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ede4cfb5-6aaa-5320-bea1-96c549b21c8f", "parentControlId": 31033, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58245" }, { "id": 555164, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd8c173a-b7ae-51f7-96a6-9de6fbabc9f4", "parentControlId": 31033, "controlId": "CP-02(02)", "title": "CP-02(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58245" }, { "id": 555165, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa795839-aedc-534c-9728-266e2e4c3b79", "parentControlId": 31033, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58245" }, { "id": 555167, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c3c9a31-070c-5ed1-9d80-767b7f6b6797", "parentControlId": 31033, "controlId": "CP-2(2)", "title": "CP-2(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582451" }, { "id": 555168, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7502b999-66a0-5b7f-8bcd-875f13b05c07", "parentControlId": 31033, "controlId": "SC-5(2)", "title": "SC-5(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582451" }, { "id": 555172, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a80a44d0-1c80-55ce-bf56-572172e40894", "parentControlId": 31033, "controlId": "PR.IR-04", "title": "PR.IR-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582451" } ], "id": 31033, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730936", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730936", "catalogueId": 1062, "uuid": "28e05deb-4031-52ff-a34f-966cc2240265", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct capacity planning so that necessary capacity for information processing, telecommunications and environmental support will exist during contingency operations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Capacity Planning", "description": "

Control Description

Mechanisms exist to conduct capacity planning so that necessary capacity for information processing, telecommunications and environmental support will exist during contingency operations.

Evidence Request List (ERL)

E-CAP-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Capability & Performance Planning (CAP) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CAP domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CAP domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CAP domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Capability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Capability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel work with business stakeholders and process owners to create and maintain infrastructure performance metrics to understand current resource needs.

Level 3 - Well Defined: Capability & Performance Planning (CAP) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CAP domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CAP domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CAP domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conduct capacity planning so that necessary capacity for information processing, telecommunications and environmental support will exist during contingency operations.

Level 4 - Quantitatively Controlled: Capability & Performance Planning (CAP) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Capability & Performance Planning (CAP) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CAP-03", "family": "Capacity & Performance Planning", "enhancements": "", "sortId": "CAP-03", "references": "

Micro-Small Business (<10 staff)

∙ Monitor system resource usage periodically

Small Business (10-49 staff)

∙ Capacity monitoring for critical systems\n∙ Resource usage baseline

Medium Business (50-249 staff)

∙ Capacity planning process\n∙ Performance monitoring tools

Large Business (250-999 staff)

∙ Enterprise capacity management program\n∙ Performance monitoring platform (e.g., Dynatrace, New Relic)

Enterprise (>1,000 staff)

∙ Enterprise capacity management platform\n∙ APM tools (e.g., Dynatrace, Datadog)\n∙ Automated scaling", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69887, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590049", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590049", "securityControlId": 31034, "ccis": [], "uuid": "832d5bf7-61c0-5eec-a80f-bca48f9f2503", "testId": "CAP-04_A01", "test": "the operating state and health status of critical systems, applications and services is centrally-monitored.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 555202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b86da8f-e503-52a6-8f60-30c2aed07f5a", "parentControlId": 31034, "controlId": "PR.IR-04", "title": "PR.IR-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582455" } ], "id": 31034, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730936", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730936", "catalogueId": 1062, "uuid": "081c0284-133d-599e-a7e2-65649a94c5b2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to centrally-monitor and alert on the operating state and health status of critical Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 7.0, "title": "Performance Monitoring", "description": "

Control Description

Automated mechanisms exist to centrally-monitor and alert on the operating state and health status of critical Technology Assets, Applications and/or Services (TAAS).

Evidence Request List (ERL)

E-CAP-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Capability & Performance Planning (CAP) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CAP domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CAP domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CAP domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Capability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Capability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel work with business stakeholders and process owners to create and maintain infrastructure performance metrics to understand current resource needs.

Level 3 - Well Defined: Capability & Performance Planning (CAP) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CAP domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CAP domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CAP domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically centrally-monitor and alert on the operating state and health status of critical Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Capability & Performance Planning (CAP) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Capability & Performance Planning (CAP) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CAP-04", "family": "Capacity & Performance Planning", "enhancements": "", "sortId": "CAP-04", "references": "

Micro-Small Business (<10 staff)

∙ ManageEngine OpManager (https://manageengine.com)

Small Business (10-49 staff)

∙ ManageEngine OpManager (https://manageengine.com)

Medium Business (50-249 staff)

∙ ManageEngine OpManager (https://manageengine.com)\n∙ Splunk (https://splunk.com)\n∙ Solarwinds (https://solarwinds.com)

Large Business (250-999 staff)

∙ ManageEngine OpManager (https://manageengine.com)\n∙ Splunk (https://splunk.com)\n∙ Solarwinds (https://solarwinds.com)

Enterprise (>1,000 staff)

∙ Splunk (https://splunk.com)\n∙ Solarwinds (https://solarwinds.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69888, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59005", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59005", "securityControlId": 31035, "ccis": [], "uuid": "cdf85fe2-d38a-502f-92d4-87fc55cb8d0a", "testId": "CAP-05_A01", "test": "resources needing dynamic expansion (e.g., elasticity) are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69889, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59005", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59005", "securityControlId": 31035, "ccis": [], "uuid": "c7472193-e2b0-5728-8c00-efc2616ded2b", "testId": "CAP-05_A02", "test": "applicable services are configured to dynamically expand the resources available for services, as demand conditions change.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 555207, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67dabb94-d344-5765-bc73-25f6c9cc1215", "parentControlId": 31035, "controlId": "PR.IR-04", "title": "PR.IR-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582455" } ], "id": 31035, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730936", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730936", "catalogueId": 1062, "uuid": "9e289f73-08d4-51d4-8f21-c68126b63634", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization automatically scale the resources available for Technology Assets, Applications and/or Services (TAAS), as demand conditions change?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Elastic Expansion", "description": "

Control Description

Mechanisms exist to automatically scale the resources available for Technology Assets, Applications and/or Services (TAAS), as demand conditions change.

Evidence Request List (ERL)

E-CAP-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Capability & Performance Planning (CAP) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CAP domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CAP domain capabilities are well-documented and kept current by process owners.\n▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CAP domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically scale the resources available for Technology Assets, Applications and/or Services (TAAS), as demand conditions change.

Level 4 - Quantitatively Controlled: Capability & Performance Planning (CAP) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Capability & Performance Planning (CAP) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CAP-05", "family": "Capacity & Performance Planning", "enhancements": "", "sortId": "CAP-05", "references": "

Micro-Small Business (<10 staff)

∙ Monitor system resource usage periodically

Small Business (10-49 staff)

∙ Capacity monitoring for critical systems\n∙ Resource usage baseline

Medium Business (50-249 staff)

∙ Capacity planning process\n∙ Performance monitoring tools

Large Business (250-999 staff)

∙ Enterprise capacity management program\n∙ Performance monitoring platform (e.g., Dynatrace, New Relic)

Enterprise (>1,000 staff)

∙ Enterprise capacity management platform\n∙ APM tools (e.g., Dynatrace, Datadog)\n∙ Automated scaling", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69892, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590051", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590051", "securityControlId": 31037, "ccis": [], "uuid": "ea908f19-84e9-5639-824c-3c10e1c085de", "testId": "CHG-01_A01", "test": "configuration change control activities are coordinated and overseen by organization-defined configuration change control element.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-03g.[01]", "defaultText": null }, { "id": 69893, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590051", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590051", "securityControlId": 31037, "ccis": [], "uuid": "de7161e7-23ce-5883-803a-7631078998dd", "testId": "CHG-01_A02", "test": "configuration change decisions associated with the system are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-03c.", "defaultText": null }, { "id": 69894, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590051", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590051", "securityControlId": 31037, "ccis": [], "uuid": "d4339239-157f-58cf-b84f-98614512b389", "testId": "CHG-01_A03", "test": "approved configuration-controlled changes to the system are implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-03d.", "defaultText": null }, { "id": 69895, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590052", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590052", "securityControlId": 31037, "ccis": [], "uuid": "e8e1960c-95cf-5b09-854a-490ea285137b", "testId": "CHG-01_A04", "test": "the time period to retain records of configuration-controlled changes is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03_ODP[01]", "defaultText": null }, { "id": 69896, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590052", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590052", "securityControlId": 31037, "ccis": [], "uuid": "06c19ebb-67a4-5e3b-bacd-5b953e5eaf10", "testId": "CHG-01_A05", "test": "proposed configuration-controlled changes to the system are reviewed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03b.[01]", "defaultText": null }, { "id": 69897, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590052", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590052", "securityControlId": 31037, "ccis": [], "uuid": "47c380fd-c80b-54e5-b42e-413a76e4d7c9", "testId": "CHG-01_A06", "test": "the configuration change control element responsible for coordinating and overseeing change control activities is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03_ODP[02]", "defaultText": null }, { "id": 69898, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590052", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590052", "securityControlId": 31037, "ccis": [], "uuid": "e3146344-4f8a-5651-8c64-c1f43cd44114", "testId": "CHG-01_A07", "test": "the frequency at which the configuration control element convenes is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03_ODP[03]\n53A_R5_CM-03_ODP[04]", "defaultText": null }, { "id": 69899, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590052", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590052", "securityControlId": 31037, "ccis": [], "uuid": "de87528b-352c-5e3e-9418-383e4ea9fcb4", "testId": "CHG-01_A08", "test": "configuration change conditions that prompt the configuration control element to convene are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03_ODP[05]", "defaultText": null }, { "id": 69900, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590052", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590052", "securityControlId": 31037, "ccis": [], "uuid": "c464552e-9821-5835-81bd-11ff4d1110cc", "testId": "CHG-01_A09", "test": "the types of changes to the system that are configuration-controlled are determined and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03a.", "defaultText": null }, { "id": 69901, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590052", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590052", "securityControlId": 31037, "ccis": [], "uuid": "a98e6a77-8bd1-5b39-a6e4-972db879399f", "testId": "CHG-01_A10", "test": "proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for cybersecurity / data privacy impact analyses.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03b.[02]", "defaultText": null }, { "id": 69902, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590053", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590053", "securityControlId": 31037, "ccis": [], "uuid": "1b6f105a-7bf1-57b2-a5dc-49eddf041bc2", "testId": "CHG-01_A11", "test": "records of configuration-controlled changes to the system are retained for an organization-defined time period.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_CM-03e.", "defaultText": null }, { "id": 69903, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590053", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590053", "securityControlId": 31037, "ccis": [], "uuid": "102f9b59-e4dd-5ba4-81de-205ef89eb9a9", "testId": "CHG-01_A12", "test": "activities associated with configuration-controlled changes to the system are monitored.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-03f.[01]\n171A_R3_A.03.04.03.d[01]", "defaultText": null }, { "id": 69904, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590053", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590053", "securityControlId": 31037, "ccis": [], "uuid": "b02a3e42-3904-5261-81f5-42a9ae25b38e", "testId": "CHG-01_A13", "test": "activities associated with configuration-controlled changes to the system are reviewed.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-03f.[02]\n171A_R3_A.03.04.03.d[02]", "defaultText": null }, { "id": 69905, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590053", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590053", "securityControlId": 31037, "ccis": [], "uuid": "6edb6738-08f0-530c-bd83-9171af1e9576", "testId": "CHG-01_A14", "test": "the configuration control element convenes organization-defined criteria.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CM-03g.[02]", "defaultText": null }, { "id": 69906, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590053", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590053", "securityControlId": 31037, "ccis": [], "uuid": "46b003f5-ad56-5d2e-94ca-0ee23c08f848", "testId": "CHG-01_A15", "test": "change management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69907, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590054", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590054", "securityControlId": 31037, "ccis": [], "uuid": "2105eedf-646b-5dbc-9c96-9a3c22d8919c", "testId": "CHG-01_A16", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support change management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69908, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590054", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590054", "securityControlId": 31037, "ccis": [], "uuid": "a48a1894-1ce7-5e50-bbe6-84df21a77262", "testId": "CHG-01_A17", "test": "responsibility and authority for the performance of change management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69909, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590054", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590054", "securityControlId": 31037, "ccis": [], "uuid": "afbd7f5c-8af7-5b96-9a1e-ca368f8988ff", "testId": "CHG-01_A18", "test": "personnel performing change management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 555245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0062c1f-0575-5736-8c6a-c6f9053fe0f7", "parentControlId": 31037, "controlId": "CM 1.4", "title": "CM 1.4", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58246" }, { "id": 555246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51b57da1-6740-5b5f-961a-814b413a023b", "parentControlId": 31037, "controlId": "6.3", "title": "6.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58246" }, { "id": 555247, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dab5cd3e-8e1f-51db-8a43-e11f588e1dc4", "parentControlId": 31037, "controlId": "8.19", "title": "8.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58246" }, { "id": 555248, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4012dd2-dd87-5ab9-bd03-edece18e100c", "parentControlId": 31037, "controlId": "8.32", "title": "8.32", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58246" }, { "id": 555256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582461", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9dd8e892-fb49-53d8-8f5f-07a830d8628d", "parentControlId": 31037, "controlId": "CM-3", "title": "CM-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582461" }, { "id": 555257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582461", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d3b3290-79e6-52a1-82a2-d32a786c1285", "parentControlId": 31037, "controlId": "CM-03", "title": "CM-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582461" }, { "id": 555259, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582461", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f29b9a24-5bc8-5a96-a478-f4b1d5836691", "parentControlId": 31037, "controlId": "CM-03", "title": "CM-03", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582461" }, { "id": 555261, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a99a399-6a4a-584a-b279-7ad5b44ce6a6", "parentControlId": 31037, "controlId": "CM-03", "title": "CM-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582462" }, { "id": 555262, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "196861fd-d5d1-56ea-afe9-f121cf4d19a9", "parentControlId": 31037, "controlId": "CM-03", "title": "CM-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582462" }, { "id": 555263, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f8c86f5-a781-566b-97c8-ae178347ef28", "parentControlId": 31037, "controlId": "CM-03", "title": "CM-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582462" }, { "id": 555264, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd37dd52-4a93-5f4d-a9fe-9355db4ed7d8", "parentControlId": 31037, "controlId": "CM-3", "title": "CM-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582462" }, { "id": 555265, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1bba77c-4131-5e64-a856-60bde322c8f4", "parentControlId": 31037, "controlId": "CM-3", "title": "CM-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582462" }, { "id": 555268, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ba76745-4f1a-5f29-b743-cf1c1bc7ab50", "parentControlId": 31037, "controlId": "3.4.3", "title": "3.4.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582462" }, { "id": 555269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e982e468-a9c0-5175-8951-b83c160fe3e8", "parentControlId": 31037, "controlId": "03.04.02.b", "title": "03.04.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582463" }, { "id": 555270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "260e0b5f-d5b7-5317-a42c-60309128bdcd", "parentControlId": 31037, "controlId": "03.04.03.a", "title": "03.04.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582463" }, { "id": 555275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e96d3c43-9a8c-52dc-88da-a2d77aa58171", "parentControlId": 31037, "controlId": "ID.RA-07", "title": "ID.RA-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582463" }, { "id": 555305, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7d3732c-7fa4-5dd3-9def-40d3223292f9", "parentControlId": 31037, "controlId": "ASSET-4a", "title": "ASSET-4a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582475" }, { "id": 555306, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35848619-9952-540c-8d03-adbcd8ec7db6", "parentControlId": 31037, "controlId": "ASSET-4c", "title": "ASSET-4c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582475" }, { "id": 555307, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca0106c5-0cce-539e-8a12-72a2adc887a8", "parentControlId": 31037, "controlId": "ASSET-4g", "title": "ASSET-4g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582475" }, { "id": 555322, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582477", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02787150-c2ab-5188-8716-b3bd9d20e1d4", "parentControlId": 31037, "controlId": "CIP-003-8 1.1.7", "title": "CIP-003-8 1.1.7", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582477" }, { "id": 555323, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582477", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7116e9dc-0a07-5b94-98d8-bd803006a969", "parentControlId": 31037, "controlId": "§117.18(b)(6)", "title": "§117.18(b)(6)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582477" }, { "controlId": "A.4.2", "title": "A.4.2 — Change Control", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-3, CM-4, SA-10", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "e8515b9f-d553-5c21-a2ae-816e6284d4a3", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2", "title": "NEI 08-09 Sec 4.2 — Change Control", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "76ec25c3-79c1-553b-9338-e11999e35ced", "isPublic": true }, { "controlId": "10 CFR 73.54(e), 50.59", "title": "10 CFR 73.54(e), 50.59 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "8e2f8fe8-3e09-5732-a2fd-b1f2fa2e3ad1", "isPublic": true }, { "controlId": "CIP-003-8-R4", "title": "CIP-003-8-R4 — CIP Senior Manager Identification and Change Delegation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5d8da821-f2fc-54b9-80f2-68a6d6917634", "isPublic": true }, { "controlId": "NSS-17T-Sec4.5", "title": "NSS-17T-Sec4.5 — Engineering Change Control & Safety-Security Impact Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "c9892871-29eb-5469-9fa2-3cb874488504", "isPublic": true }, { "controlId": "IEC-62645-8.3", "title": "IEC-62645-8.3 — Modification and Change Management in Nuclear I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "1b1e3674-c904-51cd-9b96-aa71ab497da2", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.6", "title": "IEEE-7-4.3.2-5.3.6 — Safety & Security Impact Analysis of Digital Modifications", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "b01e7017-91e8-52cf-a697-2c9b69c36110", "isPublic": true } ], "id": 31037, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730937", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730937", "catalogueId": 1062, "uuid": "864b8e8f-44a0-59e1-ba7b-b6825b85637f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of a change management program?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Change Management Program", "description": "

Control Description

Mechanisms exist to facilitate the implementation of a change management program.

Evidence Request List (ERL)

E-CHG-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Change Management (CHG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CHG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Change management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Documented change control processes are either informal or do not exist.

Level 2 - Planned & Tracked: Change Management (CHG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Change management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Change management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners ensure changes to Technology Assets, Applications and/or Services (TAAS) within the System Development Lifecycle (SDLC) are controlled through formal change control procedures.\n▪ A Change Advisory Board (CAB), or similar function, exists to govern Requests For Change (RFC) to TAAS to ensure security, compliance and resilience.\n▪ The CAB includes a function to review RFCs for cybersecurity and data protection ramifications.\n▪ The CAB notifies affected stakeholders to ensure awareness of the impact of proposed changes.

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of a change management program.

Level 4 - Quantitatively Controlled: Change Management (CHG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.2
NERC-CIP (2026) Requirements: CIP-003-8-R4", "controlId": "CHG-01", "family": "Change Management", "enhancements": "", "sortId": "CHG-01", "references": "

Micro-Small Business (<10 staff)

∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)

Small Business (10-49 staff)

∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)

Medium Business (50-249 staff)

∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)

Large Business (250-999 staff)

∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)

Enterprise (>1,000 staff)

∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69910, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590054", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590054", "securityControlId": 31038, "ccis": [], "uuid": "5ea91428-9e0c-57b8-9399-e2ece4caffce", "testId": "CHG-02_A01", "test": "changes to the system are reviewed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.4.3[b]", "defaultText": null }, { "id": 69911, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590054", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590054", "securityControlId": 31038, "ccis": [], "uuid": "785988d7-9a2d-59b7-a13e-596e436791f4", "testId": "CHG-02_A02", "test": "changes to the system are approved or disapproved.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.4.3[c]", "defaultText": null }, { "id": 69912, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590055", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590055", "securityControlId": 31038, "ccis": [], "uuid": "b6c7c953-c9b0-5bf1-beda-8a3808a204c0", "testId": "CHG-02_A03", "test": "approved configuration-controlled changes to the system are implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.04.03.c[01]", "defaultText": null }, { "id": 69913, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590055", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590055", "securityControlId": 31038, "ccis": [], "uuid": "c64743c9-ef64-560f-bd80-8c2903c3e2d2", "testId": "CHG-02_A04", "test": "changes to the system are logged.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.3[d]", "defaultText": null }, { "id": 69914, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590055", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590055", "securityControlId": 31038, "ccis": [], "uuid": "a703e0fb-39e2-58df-99b4-96ce1becec8a", "testId": "CHG-02_A05", "test": "changes to the system are tracked.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.3[a]", "defaultText": null }, { "id": 69915, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590055", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590055", "securityControlId": 31038, "ccis": [], "uuid": "b8639467-7321-5be3-82f6-b2664c787f3a", "testId": "CHG-02_A06", "test": "the types of changes to the system that are configuration-controlled are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.03.a", "defaultText": null } ], "externalMappings": [ { "id": 555424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8092d441-200f-5e70-a20a-861c3386e499", "parentControlId": 31038, "controlId": "CM 1.4", "title": "CM 1.4", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582489" }, { "id": 555425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aeeb7484-534a-561e-9a7b-6e85a4171ad3", "parentControlId": 31038, "controlId": "DATA 1.3(a)", "title": "DATA 1.3(a)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582489" }, { "id": 555426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1fa7d44-d189-56bc-8829-d10f1dd0d543", "parentControlId": 31038, "controlId": "DATA 1.3(b)", "title": "DATA 1.3(b)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582489" }, { "id": 555427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "111fd33f-10e9-5aa2-b65e-1f34fd55cfca", "parentControlId": 31038, "controlId": "8.19", "title": "8.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582489" }, { "id": 555428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32dab7e5-acfc-526f-a180-227d147f40e3", "parentControlId": 31038, "controlId": "8.32", "title": "8.32", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582489" }, { "id": 555434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84cc7550-8387-5e5b-9826-9b40a8882219", "parentControlId": 31038, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58249" }, { "id": 555435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1131c71-9353-5b99-ab03-aee14bd76958", "parentControlId": 31038, "controlId": "T1059.006", "title": "T1059.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58249" }, { "id": 555436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58caaf3e-5125-52f7-82d6-07c426953eed", "parentControlId": 31038, "controlId": "T1176", "title": "T1176", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58249" }, { "id": 555437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "477f72e3-d621-5fee-9c54-e67b7a8f4db9", "parentControlId": 31038, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58249" }, { "id": 555438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8eea72c8-3707-5acb-9953-93f088d1ad9d", "parentControlId": 31038, "controlId": "T1195.003", "title": "T1195.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58249" }, { "id": 555439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "065a20ab-12a1-5a1a-9255-cb4c72175319", "parentControlId": 31038, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58249" }, { "id": 555440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b507798b-bcc9-52c0-b85f-9b24d48d773b", "parentControlId": 31038, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58249" }, { "id": 555441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eaa3820b-9b61-591a-b3c4-0c235717610c", "parentControlId": 31038, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582491" }, { "id": 555442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b7808b4-7049-59fd-a4d7-476ea16b9f02", "parentControlId": 31038, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582491" }, { "id": 555443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42aa0811-79ff-5155-b727-aefedf7cbdcb", "parentControlId": 31038, "controlId": "T1495", "title": "T1495", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582491" }, { "id": 555444, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a4a4639-6e39-5568-8474-62791b0b9492", "parentControlId": 31038, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582491" }, { "id": 555445, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e75e5eb3-851f-558c-9e0e-01b774807cc6", "parentControlId": 31038, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582491" }, { "id": 555446, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9a5e440-6a74-5e9a-a632-69405f929091", "parentControlId": 31038, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582491" }, { "id": 555447, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad7b67b3-ac78-523e-88ac-658e366d3984", "parentControlId": 31038, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582491" }, { "id": 555448, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55f6f0bc-338b-561d-95f8-428a75470133", "parentControlId": 31038, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582491" }, { "id": 555449, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582492", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf776778-5707-56b0-af10-1024401b7016", "parentControlId": 31038, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582492" }, { "id": 555450, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582492", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc2c8ac7-957b-5370-bf0f-1b130d02dc88", "parentControlId": 31038, "controlId": "T1543.002", "title": "T1543.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582492" }, { "id": 555451, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582492", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "111f97dd-c8f9-52d9-9304-5689be0f9d4f", "parentControlId": 31038, "controlId": "T1546", "title": "T1546", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582492" }, { "id": 555452, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582492", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52473d0c-fc1a-599c-8840-ee10ae4a5542", "parentControlId": 31038, "controlId": "T1547.007", "title": "T1547.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582492" }, { "id": 555453, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582492", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7ccbf0e-2add-5fff-b2e4-f36f051bb4e0", "parentControlId": 31038, "controlId": "T1547.013", "title": "T1547.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582492" }, { "id": 555454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582492", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "487551d2-01a4-5f3f-af17-24181833bd8b", "parentControlId": 31038, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582492" }, { "id": 555455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582492", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18888a4e-42ed-5bb3-a7ab-ca0a44b5b3b9", "parentControlId": 31038, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582492" }, { "id": 555456, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582492", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bae3441b-468c-51d9-b97f-f665391a2ca1", "parentControlId": 31038, "controlId": "T1553.006", "title": "T1553.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582492" }, { "id": 555457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582492", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c32de682-217c-5531-a977-500838e18171", "parentControlId": 31038, "controlId": "T1555", "title": "T1555", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582492" }, { "id": 555458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582493", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25b07849-4e10-57f4-944e-b599b45c6484", "parentControlId": 31038, "controlId": "T1556.008", "title": "T1556.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582493" }, { "id": 555459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582493", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8637263-2941-5bee-b316-bab82faf11dd", "parentControlId": 31038, "controlId": "T1562.008", "title": "T1562.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582493" }, { "id": 555460, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582493", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb06c625-cdbd-56cf-a5a8-7199529a8b59", "parentControlId": 31038, "controlId": "T1562.012", "title": "T1562.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582493" }, { "id": 555461, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582493", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6ffeffd-0e1f-548e-be49-946cbcdfb348", "parentControlId": 31038, "controlId": "T1564.008", "title": "T1564.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582493" }, { "id": 555462, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582493", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d62406a4-8b47-53f8-867c-cac8f1b648b2", "parentControlId": 31038, "controlId": "T1578.005", "title": "T1578.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582493" }, { "id": 555463, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582493", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afcb4027-8cbe-5b9b-9ea3-b552d9e326b4", "parentControlId": 31038, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582493" }, { "id": 555464, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582493", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6c2d522-342f-5300-b0c3-9d03ef629246", "parentControlId": 31038, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582493" }, { "id": 555465, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582493", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82a874cd-0b7c-5b69-b73c-4da3945dca52", "parentControlId": 31038, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582493" }, { "id": 555466, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582494", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7fd2a74-1ee0-5dd5-aeff-059747bbf22e", "parentControlId": 31038, "controlId": "T1647", "title": "T1647", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582494" }, { "id": 555467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582494", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68c819e7-be8b-5583-ab5f-b3277da570b7", "parentControlId": 31038, "controlId": "T1653", "title": "T1653", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582494" }, { "id": 555468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582494", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c8dabaf-6845-5479-9973-febc72e3a844", "parentControlId": 31038, "controlId": "T1666", "title": "T1666", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582494" }, { "id": 555470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582494", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c3e75d5-ecaa-597f-9088-baed3c9656b0", "parentControlId": 31038, "controlId": "CM-3", "title": "CM-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582494" }, { "id": 555471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582494", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42c23514-ab8a-57ec-86aa-7fb76a52c63b", "parentControlId": 31038, "controlId": "CM-03", "title": "CM-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582494" }, { "id": 555472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582494", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39f9e305-86d7-5616-b29b-bce14fbf89de", "parentControlId": 31038, "controlId": "SA-08(31)", "title": "SA-08(31)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582494" }, { "id": 555475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582494", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "545c1269-2eb8-56c1-95a4-1b443e3fde97", "parentControlId": 31038, "controlId": "CM-03", "title": "CM-03", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582494" }, { "id": 555476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582495", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee72b92b-a92f-5580-9835-26bb4a0ec92e", "parentControlId": 31038, "controlId": "CM-03", "title": "CM-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582495" }, { "id": 555477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582495", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88972f70-f25a-5233-b520-1a2baa284274", "parentControlId": 31038, "controlId": "SA-08(31)", "title": "SA-08(31)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582495" }, { "id": 555478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582495", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40aa0e42-3b6b-5912-9498-dd0f30888685", "parentControlId": 31038, "controlId": "CM-03", "title": "CM-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582495" }, { "id": 555479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582495", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ee17a87-d284-596e-933b-5858409299b2", "parentControlId": 31038, "controlId": "CM-03", "title": "CM-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582495" }, { "id": 555481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582495", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1df82346-8da6-5b12-9ac4-a74c248dc276", "parentControlId": 31038, "controlId": "CM-3", "title": "CM-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582495" }, { "id": 555482, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582495", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77222da4-5396-5a31-a837-15cd0bee3803", "parentControlId": 31038, "controlId": "CM-3", "title": "CM-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582495" }, { "id": 555485, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582496", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f337862-54a1-5097-a5ac-3ebc214bf467", "parentControlId": 31038, "controlId": "3.4.3", "title": "3.4.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582496" }, { "id": 555486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582496", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03167f95-031e-5ebb-90b5-1028ed5e81c3", "parentControlId": 31038, "controlId": "03.04.02.b", "title": "03.04.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582496" }, { "id": 555487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582496", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7915ff8e-057f-5cea-8fc9-1d29a561ce47", "parentControlId": 31038, "controlId": "03.04.03.a", "title": "03.04.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582496" }, { "id": 555488, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582496", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa0b9ce9-5dea-57d2-be25-72ab0361864f", "parentControlId": 31038, "controlId": "03.04.03.b", "title": "03.04.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582496" }, { "id": 555489, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582496", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "baca73fa-876b-5897-a4ce-76c823064172", "parentControlId": 31038, "controlId": "03.04.03.c", "title": "03.04.03.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582496" }, { "id": 555497, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582497", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05cbe00b-1274-5336-92bc-691808d9be9a", "parentControlId": 31038, "controlId": "ID.RA-07", "title": "ID.RA-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582497" }, { "id": 555518, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582499", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f902630-1604-5f2f-a7f8-2e0c652c245a", "parentControlId": 31038, "controlId": "ASSET-4b", "title": "ASSET-4b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582499" }, { "id": 555519, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582499", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fed0a3b1-cf33-520f-a89d-828d709ad270", "parentControlId": 31038, "controlId": "ARCHITECTURE-3l", "title": "ARCHITECTURE-3l", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5825" }, { "controlId": "A.4.2", "title": "A.4.2 — Change Control", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-3, CM-4, SA-10", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "2d345fa0-d611-508d-8ffb-f7d6b3848b4d", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2", "title": "NEI 08-09 Sec 4.2 — Change Control", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "0faf0040-9352-5990-bc3a-94acfbce0763", "isPublic": true }, { "controlId": "10 CFR 73.54(e), 50.59", "title": "10 CFR 73.54(e), 50.59 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "c6613fad-4cdf-5173-a390-8b7d09339945", "isPublic": true }, { "controlId": "A.4.2.1", "title": "A.4.2.1 — Configuration Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-1, CM-2, CM-3, CM-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1e34502a-8657-5164-858c-8920d81acaae", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.1", "title": "NEI 08-09 Sec 4.2.1 — Configuration Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "c9fd07ed-02b6-5568-b673-84e16c2bc658", "isPublic": true }, { "controlId": "10 CFR 73.54(e)", "title": "10 CFR 73.54(e) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "6a2024cb-4e10-55c0-b03f-ab79d292fa7d", "isPublic": true }, { "controlId": "A.4.2.3", "title": "A.4.2.3 — Security Reassessment and Authorization", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-6, CA-2, CM-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1c355d77-6acc-5da8-a37a-9f8a4094d523", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.3", "title": "NEI 08-09 Sec 4.2.3 — Security Reassessment and Authorization", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "2466413a-c95d-5ea0-ab75-2230df8ab858", "isPublic": true }, { "controlId": "A.4.2.6", "title": "A.4.2.6 — Application of Security Controls Associated with a Modification or Addition", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-3, PL-2, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "6608f48a-285c-5246-84fa-895e1da5d43b", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.6", "title": "NEI 08-09 Sec 4.2.6 — Application of Security Controls Associated with a Modification or Addition", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "97e66754-b644-55e9-9ad8-4b7bae535c2c", "isPublic": true }, { "controlId": "C.11.4", "title": "C.11.4 — Configuration Change Control", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "3f3cf089-61fe-56ce-a196-c6e1c8ca9834", "isPublic": true }, { "controlId": "NEI 08-09 App E.11.4", "title": "NEI 08-09 App E.11.4 — Configuration Change Control", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.11.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "33ead490-130c-5660-82c1-d05870011f11", "isPublic": true }, { "controlId": "CIP-010-4-R1", "title": "CIP-010-4-R1 — Configuration Change Management and Baseline Documentation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e54f7359-ae5c-50de-8f14-8e8fae845488", "isPublic": true }, { "controlId": "CIP-010-4-1.1", "title": "CIP-010-4-1.1 — Develop a baseline configuration, individually or by group, which shall include the following items: 1.1.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ec8d92ca-9be9-598e-b11c-be623d3856c5", "isPublic": true }, { "controlId": "CIP-010-4-1.1.1", "title": "CIP-010-4-1.1.1 — Operating system(s) (including version) or firmware where no independent operating system exists", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1a7ba099-a861-5dc3-bc9e-c7790dda57e5", "isPublic": true }, { "controlId": "CIP-010-4-1.1.2", "title": "CIP-010-4-1.1.2 — Any commercially available or open-source application software (including version) intentionally installed", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "fcf19dca-442c-54f8-995d-d312d7d2ae06", "isPublic": true }, { "controlId": "CIP-010-4-1.1.3", "title": "CIP-010-4-1.1.3 — Any custom software installed", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "637536a8-ace6-54ad-b8c8-c8e8bf93695a", "isPublic": true }, { "controlId": "CIP-010-4-1.1.4", "title": "CIP-010-4-1.1.4 — Any logical network accessible ports", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0d25a9a3-1042-56c4-9478-9cb85d130762", "isPublic": true }, { "controlId": "CIP-010-4-1.1.5", "title": "CIP-010-4-1.1.5 — Any security patches applied.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2d61a1f2-b79f-5359-a277-92c969f04027", "isPublic": true }, { "controlId": "CIP-010-4-1.2", "title": "CIP-010-4-1.2 — Authorize and document changes that deviate from the existing baseline configuration.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "43ae161f-d528-5112-a201-0ab663459d04", "isPublic": true }, { "controlId": "CIP-010-4-1.3", "title": "CIP-010-4-1.3 — For a change that deviates from the existing baseline configuration, update the baseline configuration as necessary w...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c2256e17-b23b-52f2-89a8-2579631af28e", "isPublic": true }, { "controlId": "CIP-010-4-1.4", "title": "CIP-010-4-1.4 — For a change that deviates from the existing baseline configuration: 1.4.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "103af092-0e72-554b-90ee-ce3924215b1b", "isPublic": true }, { "controlId": "CIP-010-4-1.4.1", "title": "CIP-010-4-1.4.1 — Prior to the change, determine required cyber security controls in CIP-005 and CIP-007 that could be impacted by the...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5ccf56ec-6d47-52b0-94a6-cc57f070d9ad", "isPublic": true }, { "controlId": "CIP-010-4-1.4.2", "title": "CIP-010-4-1.4.2 — Following the change, verify that required cyber security controls determined in 1.4.1 are not adversely affected", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7c59a879-4976-5b29-966b-5aed1b92fa5a", "isPublic": true }, { "controlId": "CIP-010-4-1.4.3", "title": "CIP-010-4-1.4.3 — Document the results of the verification.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "53f319e5-063a-5a47-bab7-0c2baaa2c382", "isPublic": true }, { "controlId": "CIP-010-4-1.5", "title": "CIP-010-4-1.5 — Where technically feasible, for each change that deviates from the existing baseline configuration: 1.5.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "232b83df-a7a4-5353-995b-b7a2521869f9", "isPublic": true }, { "controlId": "CIP-010-4-1.5.1", "title": "CIP-010-4-1.5.1 — Prior to implementing any change in the production environment", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6fbee5fe-bbec-5986-ae3f-2689307e0d24", "isPublic": true }, { "controlId": "CIP-010-4-1.6", "title": "CIP-010-4-1.6 — Prior to a change that deviates from the existing baseline configuration associated with baseline items in Parts 1.1....", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c869b536-7058-5b56-a8df-4ac6016a7ee6", "isPublic": true }, { "controlId": "CIP-010-4-1.6.1", "title": "CIP-010-4-1.6.1 — Verify the identity of the software source", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2837f433-c925-5df6-b39f-261874f5e11f", "isPublic": true }, { "controlId": "CIP-010-4-1.6.2", "title": "CIP-010-4-1.6.2 — Verify the integrity of the software obtained from the software source.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "61f40b31-747b-52b5-8049-d629940d25bb", "isPublic": true }, { "controlId": "NSS-17T-Sec4.5", "title": "NSS-17T-Sec4.5 — Engineering Change Control & Safety-Security Impact Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "e299b858-6530-52c8-b9a1-3222e60774a6", "isPublic": true }, { "controlId": "IEC-62645-8.3", "title": "IEC-62645-8.3 — Modification and Change Management in Nuclear I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "725ec125-c059-507d-85b2-2d9d89f31ed2", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.6", "title": "IEEE-7-4.3.2-5.3.6 — Safety & Security Impact Analysis of Digital Modifications", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "16064966-2b65-5048-8730-9b203236aace", "isPublic": true } ], "id": 31038, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730937", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730937", "catalogueId": 1062, "uuid": "cc3ed9b4-2404-5197-a0a5-4246c59e375a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization govern the technical configuration change control processes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Configuration Change Control", "description": "

Control Description

Mechanisms exist to govern the technical configuration change control processes.

Evidence Request List (ERL)

E-CHG-02\nE-CHG-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Change Management (CHG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CHG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Change management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Requests for Change (RFC) are submitted to IT and/or cybersecurity personnel.\n▪ Documented change control processes are either informal or do not exist.

Level 2 - Planned & Tracked: Change Management (CHG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Change management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Change management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners ensure changes to Technology Assets, Applications and/or Services (TAAS) within the System Development Lifecycle (SDLC) are controlled through formal change control procedures.\n▪ Configuration management practices prevent unauthorized changes by limiting and reviewing permissions to modify TAAS components within a production/operational environment\n▪ A Change Advisory Board (CAB), or similar function, exists to govern Requests For Change (RFC) to TAAS to ensure security, compliance and resilience.\n▪ The CAB includes a function to review RFCs for cybersecurity and data protection ramifications.\n▪ The CAB notifies affected stakeholders to ensure awareness of the impact of proposed changes.\n▪ Unauthorized configuration changes are responded to in accordance with an Incident Response Plan (IRP) to determine if the unauthorized configuration is malicious in nature.

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to govern the technical configuration change control processes.

Level 4 - Quantitatively Controlled: Change Management (CHG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.2, A.4.2.1, A.4.2.3, A.4.2.6, C.11.4
NERC-CIP (2026) Requirements: CIP-010-4-R1", "controlId": "CHG-02", "family": "Change Management", "enhancements": "", "sortId": "CHG-02", "references": "

Micro-Small Business (<10 staff)

∙ Change Control Board (CCB)\n∙ Configuration Management Database (CMDB)\n∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)

Small Business (10-49 staff)

∙ Change Control Board (CCB)\n∙ Configuration Management Database (CMDB)\n∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)

Medium Business (50-249 staff)

∙ Change Control Board (CCB)\n∙ Configuration Management Database (CMDB)\n∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)

Large Business (250-999 staff)

∙ Change Control Board (CCB)\n∙ Configuration Management Database (CMDB)\n∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)

Enterprise (>1,000 staff)

∙ Change Control Board (CCB)\n∙ Configuration Management Database (CMDB)\n∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69916, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590055", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590055", "securityControlId": 31039, "ccis": [], "uuid": "60d32c35-1690-500c-8cb5-b6e41c7aa49b", "testId": "CHG-02.1_A01", "test": "mechanisms used to automate configuration change control are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-03(01)_ODP[01]", "defaultText": null }, { "id": 69917, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590056", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590056", "securityControlId": 31039, "ccis": [], "uuid": "5de9eafc-d873-554e-8f93-e3aae95d7718", "testId": "CHG-02.1_A02", "test": "organization-defined automated mechanisms are used to prohibit changes to the system until designated approvals are received.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-03(01)(d)", "defaultText": null }, { "id": 69918, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590056", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590056", "securityControlId": 31039, "ccis": [], "uuid": "a87563f1-8548-559f-ace7-a9ee89866bde", "testId": "CHG-02.1_A03", "test": "approval authorities to be notified of and request approval for proposed changes to the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03(01)_ODP[02]", "defaultText": null }, { "id": 69919, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590056", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590056", "securityControlId": 31039, "ccis": [], "uuid": "55230d69-0497-5859-9291-72e61eae3c19", "testId": "CHG-02.1_A04", "test": "the time period after which to highlight changes that have not been approved or disapproved is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03(01)_ODP[03]", "defaultText": null }, { "id": 69920, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590056", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590056", "securityControlId": 31039, "ccis": [], "uuid": "65c0cc31-f18b-570e-ae8a-a31f643e8a90", "testId": "CHG-02.1_A05", "test": "personnel to be notified when approved changes are complete is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03(01)_ODP[04]", "defaultText": null }, { "id": 69921, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590056", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590056", "securityControlId": 31039, "ccis": [], "uuid": "8fb94e72-1857-5a98-b785-c41e3b7f069b", "testId": "CHG-02.1_A06", "test": "organization-defined automated mechanisms are used to document proposed changes to the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03(01)(a)", "defaultText": null }, { "id": 69922, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590056", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590056", "securityControlId": 31039, "ccis": [], "uuid": "2186b863-bd2f-5924-accc-d63ff455ca71", "testId": "CHG-02.1_A07", "test": "organization-defined automated mechanisms are used to notify organization-defined approval authorities of proposed changes to the system and request change approval.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03(01)(b)", "defaultText": null }, { "id": 69923, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590057", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590057", "securityControlId": 31039, "ccis": [], "uuid": "64d99470-9d64-54ed-a8ce-2f34b1239199", "testId": "CHG-02.1_A08", "test": "organization-defined automated mechanisms are used to highlight proposed changes to the system that have not been approved or disapproved within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03(01)(c)", "defaultText": null }, { "id": 69924, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590057", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590057", "securityControlId": 31039, "ccis": [], "uuid": "a6248ef4-6861-5f44-95c4-b3ccf5578f29", "testId": "CHG-02.1_A09", "test": "organization-defined automated mechanisms are used to document all changes to the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03(01)(e)", "defaultText": null }, { "id": 69925, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590057", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590057", "securityControlId": 31039, "ccis": [], "uuid": "b8a538fc-7bd1-5e14-b91c-c8b9bd1c047f", "testId": "CHG-02.1_A10", "test": "organization-defined automated mechanisms are used to notify organization-defined personnel when approved changes to the system are completed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03(01)(f)", "defaultText": null }, { "id": 69926, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590057", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590057", "securityControlId": 31039, "ccis": [], "uuid": "276c1290-09a3-5df8-8d1f-9593a0b7cce4", "testId": "CHG-02.1_A11", "test": "proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security impacts.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.03.b[02]", "defaultText": null }, { "id": 69927, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590057", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590057", "securityControlId": 31039, "ccis": [], "uuid": "a739d1db-3d34-5f4b-bc7b-2028b0a37b0e", "testId": "CHG-02.1_A12", "test": "logical access restrictions associated with changes to the system are approved.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.05[05]", "defaultText": null } ], "externalMappings": [ { "id": 555638, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5511628b-fa08-5926-8621-e8f38bbdfd20", "parentControlId": 31039, "controlId": "CM-3(1)", "title": "CM-3(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582521" }, { "id": 555639, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efc74b2d-4f55-5418-a9e4-6d82d83c1f74", "parentControlId": 31039, "controlId": "CM-03(01)", "title": "CM-03(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582521" }, { "id": 555640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a4c25a3-ce08-5fba-b29d-388ebfff50d3", "parentControlId": 31039, "controlId": "CM-03(01)", "title": "CM-03(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582521" }, { "id": 555641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4914aa1-6078-518d-bbbc-98461fe53a62", "parentControlId": 31039, "controlId": "CM-03(01)", "title": "CM-03(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582522" }, { "id": 555642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65fe28d9-941a-5885-aeda-41d135adebd2", "parentControlId": 31039, "controlId": "CM-03(01)", "title": "CM-03(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582522" }, { "id": 555643, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2252f8d4-136b-5dd5-b534-f35e05ad3d36", "parentControlId": 31039, "controlId": "CM-3(1)", "title": "CM-3(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582522" }, { "id": 555646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fd605f8-d6f6-5849-8275-a5af191f85f4", "parentControlId": 31039, "controlId": "03.04.02.b", "title": "03.04.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582522" }, { "id": 555647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a0c5639-b572-534c-a027-537361d1721f", "parentControlId": 31039, "controlId": "03.04.03.a", "title": "03.04.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582522" }, { "id": 555651, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582523", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19744ed9-c9ce-5274-9ad5-57bbeee79435", "parentControlId": 31039, "controlId": "ID.RA-07", "title": "ID.RA-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582523" } ], "id": 31039, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730938", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730938", "catalogueId": 1062, "uuid": "7038fa65-4018-58c0-aff2-f6f620f0774f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prohibit unauthorized changes, unless organization-approved change requests are received?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Prohibition Of Changes", "description": "

Control Description

Mechanisms exist to prohibit unauthorized changes, unless organization-approved change requests are received.

Evidence Request List (ERL)

E-CHG-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Change Management (CHG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CHG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Change management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Requests for Change (RFC) are submitted to IT and/or cybersecurity personnel.\n▪ Prior to changes being made, RFCs are informally reviewed for cybersecurity and/or data protection ramifications.\n▪ Documented change control processes are either informal or do not exist.

Level 2 - Planned & Tracked: Change Management (CHG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Change management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Change management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners ensure changes to Technology Assets, Applications and/or Services (TAAS) within the System Development Lifecycle (SDLC) are controlled through formal change control procedures.\n▪ Configuration management practices prevent unauthorized changes by limiting and reviewing permissions to modify TAAS components within a production/operational environment

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prohibit unauthorized changes, unless organization-approved change requests are received.

Level 4 - Quantitatively Controlled: Change Management (CHG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CHG-02.1", "family": "Change Management", "enhancements": "", "sortId": "CHG-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)\n∙ Manual processes/workflows\n∙ Application whitelisting

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)\n∙ Manual processes/workflows\n∙ Application whitelisting

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)\n∙ Application whitelisting\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)\n∙ Application whitelisting\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)\n∙ Application whitelisting\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69928, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590058", "securityControlId": 31040, "ccis": [], "uuid": "b41b970e-bf50-584a-bcc1-3372d77ec245", "testId": "CHG-02.2_A01", "test": "changes to the system are tested before finalizing the implementation of the changes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-03(02)[01]", "defaultText": null }, { "id": 69929, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590058", "securityControlId": 31040, "ccis": [], "uuid": "096da856-d48d-519e-a144-98e981ef8dd1", "testId": "CHG-02.2_A02", "test": "changes to the system are validated before finalizing the implementation of the changes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-03(02)[02]", "defaultText": null }, { "id": 69930, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590058", "securityControlId": 31040, "ccis": [], "uuid": "edb7c364-95f8-58fa-a1df-28d21585ebab", "testId": "CHG-02.2_A03", "test": "changes to the system are documented before finalizing the implementation of the changes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-03(02)[03]", "defaultText": null }, { "id": 69931, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590058", "securityControlId": 31040, "ccis": [], "uuid": "70f26c4e-5b64-5be1-90a0-37f0e89133d8", "testId": "CHG-02.2_A04", "test": "the frequency at which changes are to be reviewed is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03(07)_ODP[01]", "defaultText": null }, { "id": 69932, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590058", "securityControlId": 31040, "ccis": [], "uuid": "ebd2daf9-8969-56a3-a008-7bf1f0689a6f", "testId": "CHG-02.2_A05", "test": "the circumstances under which changes are to be reviewed are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03(07)_ODP[02]", "defaultText": null }, { "id": 69933, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590058", "securityControlId": 31040, "ccis": [], "uuid": "e61cd17c-c693-5a10-b431-41c341e992bc", "testId": "CHG-02.2_A06", "test": "changes to the system are reviewed organization-defined frequency or when organization-defined circumstances to determine whether unauthorized changes have occurred.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03(07)", "defaultText": null }, { "id": 69934, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590058", "securityControlId": 31040, "ccis": [], "uuid": "0bc35efc-f2d8-560f-ad0e-38901c9d6f28", "testId": "CHG-02.2_A07", "test": "systems or system components that implement the security design principle of secure system modification are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08(31)_ODP", "defaultText": null }, { "id": 69935, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590059", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590059", "securityControlId": 31040, "ccis": [], "uuid": "8e9725bb-17f4-569a-9d1d-b871e38a3817", "testId": "CHG-02.2_A08", "test": "systems or system components implement the security design principle of secure system modification.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SA-08(31)", "defaultText": null }, { "id": 69936, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590059", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590059", "securityControlId": 31040, "ccis": [], "uuid": "4fe431a6-ea80-52f2-b1b6-ac03563fad15", "testId": "CHG-02.2_A09", "test": "approved configuration-controlled changes to the system are documented.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.03.c[02]", "defaultText": null } ], "externalMappings": [ { "id": 555702, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c7eb028-9929-547e-bbaa-fbcc94178e97", "parentControlId": 31040, "controlId": "COMP 3.4", "title": "COMP 3.4", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582529" }, { "id": 555703, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f535b31f-b295-5c8f-ac8c-aef26abcb533", "parentControlId": 31040, "controlId": "SR 3.3", "title": "SR 3.3", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582529" }, { "id": 555704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b42c063-fa62-5cd2-9b83-7d64892fce06", "parentControlId": 31040, "controlId": "8.19", "title": "8.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582529" }, { "id": 555705, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7504a74-24e4-5f0f-842b-245450ea2ce6", "parentControlId": 31040, "controlId": "8.32", "title": "8.32", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582529" }, { "id": 555711, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ee5204e-ca11-55c8-b6e1-408333b5d28e", "parentControlId": 31040, "controlId": "CM-3(2)", "title": "CM-3(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58253" }, { "id": 555712, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a60290ca-d2db-5b2f-a3f0-1541e0c6ea64", "parentControlId": 31040, "controlId": "CM-5(2)", "title": "CM-5(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58253" }, { "id": 555713, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fb02273-6e0c-587b-aa65-36aa2bed642b", "parentControlId": 31040, "controlId": "CM-03(02)", "title": "CM-03(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58253" }, { "id": 555714, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34012d6d-0412-5634-ae79-17a48c8060a3", "parentControlId": 31040, "controlId": "CM-03(07)", "title": "CM-03(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58253" }, { "id": 555715, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "809afa48-c6e7-575a-b0f9-11801b51bc44", "parentControlId": 31040, "controlId": "SA-08(31)", "title": "SA-08(31)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58253" }, { "id": 555718, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582531", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32ce1453-9fde-5ef9-b304-314efdae582f", "parentControlId": 31040, "controlId": "CM-03(02)", "title": "CM-03(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582531" }, { "id": 555719, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582531", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "febb1b12-b2cd-5385-81e9-b3831ce20cc9", "parentControlId": 31040, "controlId": "CM-03(02)", "title": "CM-03(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582531" }, { "id": 555720, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582531", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82722417-8270-5d59-97f6-2f8e3f06dcdf", "parentControlId": 31040, "controlId": "CM-03(07)", "title": "CM-03(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582531" }, { "id": 555721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582531", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd669b3a-0345-5699-86fb-4b941ca24b67", "parentControlId": 31040, "controlId": "SA-08(31)", "title": "SA-08(31)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582531" }, { "id": 555723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582531", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5752ec6-0cef-5a03-be55-7466f2523c54", "parentControlId": 31040, "controlId": "CM-3(2)", "title": "CM-3(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582531" }, { "id": 555726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7faafc4-9b97-5bf4-893f-cf9767830dde", "parentControlId": 31040, "controlId": "NFO - CM-3(2)", "title": "NFO - CM-3(2)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582532" }, { "id": 555727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7a0681c-b4cc-5c3a-9e83-f1c72b69490c", "parentControlId": 31040, "controlId": "03.04.03.b", "title": "03.04.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582532" }, { "id": 555728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11aff337-33ae-5650-8e92-92f8e8b36e35", "parentControlId": 31040, "controlId": "03.04.03.c", "title": "03.04.03.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582532" }, { "id": 555729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf50e21a-98aa-5210-bbcb-7379526c4ed0", "parentControlId": 31040, "controlId": "03.04.04.a", "title": "03.04.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582532" }, { "id": 555730, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86538042-71b8-50ea-a3a9-e68d74925e1b", "parentControlId": 31040, "controlId": "03.04.11.b", "title": "03.04.11.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582532" }, { "id": 555732, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4b203d7-9eb1-5e65-8c1e-3f6f21afd924", "parentControlId": 31040, "controlId": "ID.RA-07", "title": "ID.RA-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582532" }, { "id": 555746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582534", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1320041b-d3aa-547f-bd6f-0ff7e7aecdcc", "parentControlId": 31040, "controlId": "ASSET-4b", "title": "ASSET-4b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582534" }, { "id": 555747, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582534", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06d9f67d-10f0-5706-838b-c372db616f8e", "parentControlId": 31040, "controlId": "ASSET-4c", "title": "ASSET-4c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582534" }, { "id": 555748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582534", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2cb4201-d178-5be1-af8a-5c40659c3bbf", "parentControlId": 31040, "controlId": "ASSET-4d", "title": "ASSET-4d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582534" }, { "id": 555749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582534", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81861c82-25e8-5b64-a28e-ba61052fb8fb", "parentControlId": 31040, "controlId": "ASSET-4f", "title": "ASSET-4f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582534" }, { "id": 555750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582534", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfdf994c-18dc-5584-b2d4-1793cf6009e6", "parentControlId": 31040, "controlId": "ASSET-4h", "title": "ASSET-4h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582534" }, { "id": 555751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582534", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63ac8176-093a-526a-9dd7-407066aad93e", "parentControlId": 31040, "controlId": "ASSET-4i", "title": "ASSET-4i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582534" }, { "id": 555752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582534", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "286891a6-e311-5542-bf60-61ba6609182d", "parentControlId": 31040, "controlId": "THREAT-1h", "title": "THREAT-1h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582534" }, { "id": 555763, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582536", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64daa227-dba2-50c3-8fd3-0c28038a0a6c", "parentControlId": 31040, "controlId": "CIP-010-4 1.4.2", "title": "CIP-010-4 1.4.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582536" }, { "id": 555764, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582536", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3fce9ac-fd11-534b-93a0-c39a37bdb021", "parentControlId": 31040, "controlId": "CIP-010-4 1.5.1", "title": "CIP-010-4 1.5.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582536" }, { "id": 555765, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582536", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a3c11eb-7c7e-584b-baff-0ab5d355e97a", "parentControlId": 31040, "controlId": "CIP-010-4 1.5.2", "title": "CIP-010-4 1.5.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582536" }, { "controlId": "A.4.2.5", "title": "A.4.2.5 — Review and Validation Testing of a Modification or Addition of a Critical Digital Asset", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, CM-3, SA-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "7096345c-9791-579f-af40-14e532b253dd", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.5", "title": "NEI 08-09 Sec 4.2.5 — Review and Validation Testing of a Modification or Addition of a Critical Digital Asset", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "c2983158-e21c-575b-949b-5312c9d120fd", "isPublic": true }, { "controlId": "10 CFR 73.54(e)", "title": "10 CFR 73.54(e) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "dd2648d5-4f2c-5557-bfbc-dac1f1be647b", "isPublic": true }, { "controlId": "NSS-17T-Sec4.5", "title": "NSS-17T-Sec4.5 — Engineering Change Control & Safety-Security Impact Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "c8b60471-7456-592c-821e-d426e2628e37", "isPublic": true }, { "controlId": "IEC-62645-8.3", "title": "IEC-62645-8.3 — Modification and Change Management in Nuclear I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "760f9196-fe0b-5df5-9574-34d768fed66f", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.6", "title": "IEEE-7-4.3.2-5.3.6 — Safety & Security Impact Analysis of Digital Modifications", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "a555046b-38cc-52ba-bf6d-2068864d8a13", "isPublic": true } ], "id": 31040, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730938", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730938", "catalogueId": 1062, "uuid": "4511ff53-7e03-54ea-a37d-e293b1644d64", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization appropriately test and document proposed changes in a non-production environment before changes are implemented in a production environment?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Test, Validate & Document Changes", "description": "

Control Description

Mechanisms exist to appropriately test and document proposed changes in a non-production environment before changes are implemented in a production environment.

Evidence Request List (ERL)

E-CHG-03\nE-CHG-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Change Management (CHG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CHG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Change management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Whenever possible, IT and/or cybersecurity personnel test changes to business-critical Technology Assets, Applications and/or Services (TAAS) on a similarly configured IT environment, prior to widespread production release of the change.

Level 2 - Planned & Tracked: Change Management (CHG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Change management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Change management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners ensure changes to Technology Assets, Applications and/or Services (TAAS) within the System Development Lifecycle (SDLC) are controlled through formal change control procedures.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to test controls after a change is implemented to ensure cybersecurity and/or data protection controls are operating properly.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to document the results from testing changes.

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to appropriately test and document proposed changes in a non-production environment before changes are implemented in a production environment.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.2.5", "controlId": "CHG-02.2", "family": "Change Management", "enhancements": "", "sortId": "CHG-02.2", "references": "

Micro-Small Business (<10 staff)

∙ Change Control Board (CCB)\n∙ Configuration Management Database (CMDB)\n∙ VisibleOps (https://itpi.org)

Small Business (10-49 staff)

∙ Change Control Board (CCB)\n∙ Configuration Management Database (CMDB)\n∙ VisibleOps (https://itpi.org)

Medium Business (50-249 staff)

∙ Change Control Board (CCB)\n∙ Configuration Management Database (CMDB)\n∙ VisibleOps (https://itpi.org)

Large Business (250-999 staff)

∙ Change Control Board (CCB)\n∙ Configuration Management Database (CMDB)\n∙ VisibleOps (https://itpi.org)

Enterprise (>1,000 staff)

∙ Change Control Board (CCB)\n∙ Configuration Management Database (CMDB)\n∙ VisibleOps (https://itpi.org)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69937, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590064", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590064", "securityControlId": 31041, "ccis": [], "uuid": "23994c51-a0c3-5c49-8529-df39c7c3be50", "testId": "CHG-02.3_A01", "test": "the configuration change control element of which the cybersecurity / data privacy representatives are to be members is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: Configuration Control Board (CCB) or similar function", "otherId": "53A_R5_CM-03(04)_ODP[03]", "defaultText": null }, { "id": 69938, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590064", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590064", "securityControlId": 31041, "ccis": [], "uuid": "3b46aa96-0cc5-50ea-818a-46ac789e43b8", "testId": "CHG-02.3_A02", "test": "security representatives required to be members of the change control element are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03(04)_ODP[01]", "defaultText": null }, { "id": 69939, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590064", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590064", "securityControlId": 31041, "ccis": [], "uuid": "acfe4a57-796d-5d0b-bd69-af270ae913d3", "testId": "CHG-02.3_A03", "test": "privacy representatives required to be members of the change control element are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03(04)_ODP[02]", "defaultText": null }, { "id": 69940, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590064", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590064", "securityControlId": 31041, "ccis": [], "uuid": "5747b5be-69ba-5fb3-b158-e2a9fa85d29b", "testId": "CHG-02.3_A04", "test": "organization-defined security representatives are required to be members of the organization-defined configuration change control element.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03(04)[01]", "defaultText": null }, { "id": 69941, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590065", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590065", "securityControlId": 31041, "ccis": [], "uuid": "2cd63973-52b6-584a-bea0-2373f744b469", "testId": "CHG-02.3_A05", "test": "organization-defined privacy representatives are required to be members of the organization-defined configuration change control element.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-03(04)[02]", "defaultText": null } ], "externalMappings": [ { "id": 555813, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582541", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b111220-1c4c-527a-9b90-01c89c8bc576", "parentControlId": 31041, "controlId": "CM-3(4)", "title": "CM-3(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582541" }, { "id": 555814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d70e3258-85e2-59a3-ac16-554c9be2081e", "parentControlId": 31041, "controlId": "CM-03(04)", "title": "CM-03(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582542" }, { "id": 555815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb90ef9b-875f-55ba-9203-ec8c5e67c38e", "parentControlId": 31041, "controlId": "CM-03(04)", "title": "CM-03(04)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582542" }, { "id": 555816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13f729a3-326d-54d5-b6e7-3c61e51ffe57", "parentControlId": 31041, "controlId": "CM-03(04)", "title": "CM-03(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582542" }, { "id": 555817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2904487-1c8b-5b35-9f53-c841938c4ba2", "parentControlId": 31041, "controlId": "CM-03(04)", "title": "CM-03(04)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582542" }, { "id": 555818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0db59ce8-5610-5838-a77c-7555c0e6b412", "parentControlId": 31041, "controlId": "CM-03(04)", "title": "CM-03(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582542" }, { "id": 555819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76131999-ee33-5c0a-9e37-f0c6bf4102a1", "parentControlId": 31041, "controlId": "CM-3(4)", "title": "CM-3(4)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582542" }, { "id": 555822, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582543", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "751ffcb2-bd73-5547-a579-b05b3fe69498", "parentControlId": 31041, "controlId": "03.04.04.a", "title": "03.04.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582543" }, { "id": 555825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582543", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed4cb3ea-d6d8-5d97-84c6-d75145d557e9", "parentControlId": 31041, "controlId": "ASSET-4c", "title": "ASSET-4c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582543" }, { "id": 555826, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582543", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7b52315-e1ad-5c44-8a10-2859fb42f2e2", "parentControlId": 31041, "controlId": "THREAT-1h", "title": "THREAT-1h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582543" } ], "id": 31041, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730938", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730938", "catalogueId": 1062, "uuid": "7458a100-f71d-5488-9dfe-e6770780f006", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization include a cybersecurity and/or data protection representative in the configuration change control review process?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Security, Compliance & Resilience Representative for Asset Lifecycle Changes", "description": "

Control Description

Mechanisms exist to include a cybersecurity and/or data protection representative in the configuration change control review process.

Evidence Request List (ERL)

E-CHG-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Change Management (CHG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Change management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Change management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners ensure changes to Technology Assets, Applications and/or Services (TAAS) within the System Development Lifecycle (SDLC) are controlled through formal change control procedures.

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to include a cybersecurity and/or data protection representative in the configuration change control review process.

Level 4 - Quantitatively Controlled: Change Management (CHG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CHG-02.3", "family": "Change Management", "enhancements": "", "sortId": "CHG-02.3", "references": "

Micro-Small Business (<10 staff)

∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org)

Small Business (10-49 staff)

∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org)

Medium Business (50-249 staff)

∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org)

Large Business (250-999 staff)

∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org)

Enterprise (>1,000 staff)

∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69942, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590065", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590065", "securityControlId": 31042, "ccis": [], "uuid": "8c05018f-5188-55d1-b7e4-2555b6aa96ff", "testId": "CHG-02.4_A01", "test": "security responses to be automatically implemented are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-03(05)_ODP", "defaultText": null }, { "id": 69943, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590065", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590065", "securityControlId": 31042, "ccis": [], "uuid": "7c8c1bbe-5775-5511-b304-74f8879f7c10", "testId": "CHG-02.4_A02", "test": "organization-defined security responses are automatically implemented if baseline configurations are changed in an unauthorized manner.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-03(05)", "defaultText": null }, { "id": 69944, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590065", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590065", "securityControlId": 31042, "ccis": [], "uuid": "65f7014a-4e1d-5df7-a440-36d435373d5c", "testId": "CHG-02.4_A03", "test": "automated mechanisms place misconfigured or unauthorized system components in a quarantine or remediation network.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.4.2e_ODP[1]", "defaultText": null }, { "id": 69945, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590066", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590066", "securityControlId": 31042, "ccis": [], "uuid": "0dbada2c-3202-589c-968d-5157171488ea", "testId": "CHG-02.4_A04", "test": "automated mechanisms to detect misconfigured or unauthorized system components are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.4.2e[a]", "defaultText": null }, { "id": 69946, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590066", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590066", "securityControlId": 31042, "ccis": [], "uuid": "7b5d1a0b-e666-523a-8849-ede311e63f81", "testId": "CHG-02.4_A05", "test": "automated mechanisms are employed to detect misconfigured or unauthorized system components.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.4.2e[b]", "defaultText": null }, { "id": 69947, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590066", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590066", "securityControlId": 31042, "ccis": [], "uuid": "82feb464-18ac-50cb-94c3-1ea6c2fdfc42", "testId": "CHG-02.4_A06", "test": "misconfigured or unauthorized system components are detected.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.4.2e[c]", "defaultText": null }, { "id": 69948, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590066", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590066", "securityControlId": 31042, "ccis": [], "uuid": "030e9db9-4912-54d5-b9e1-aa2f649f2738", "testId": "CHG-02.4_A07", "test": "after detection, system components are removed and/or placed in a quarantine or remediation network to facilitate patching, re-configuration or other mitigations.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.4.2e[d]", "defaultText": null } ], "externalMappings": [ { "id": 555849, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a38f8516-83d9-57bb-b3b6-1149440ba03e", "parentControlId": 31042, "controlId": "CM-3(5)", "title": "CM-3(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582546" }, { "id": 555850, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ca88ecc-eed3-530a-b5b0-f180cabdf2bb", "parentControlId": 31042, "controlId": "CM-03(05)", "title": "CM-03(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582546" }, { "id": 555851, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62ab2a13-09b9-56da-9baf-0097242483f3", "parentControlId": 31042, "controlId": "CM-03(05)", "title": "CM-03(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582546" } ], "id": 31042, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730939", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730939", "catalogueId": 1062, "uuid": "472b1d8b-38ba-5005-9eaf-647835520975", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to implement remediation actions upon the detection of unauthorized baseline configurations change(s)?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Automated Security Response", "description": "

Control Description

Automated mechanisms exist to implement remediation actions upon the detection of unauthorized baseline configurations change(s).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically implement remediation actions upon the detection of unauthorized baseline configurations change(s).

Level 4 - Quantitatively Controlled: Change Management (CHG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CHG-02.4", "family": "Change Management", "enhancements": "", "sortId": "CHG-02.4", "references": "

Micro-Small Business (<10 staff)

∙ Document and approve changes before making them

Small Business (10-49 staff)

∙ Change request form\n∙ Change approval process\n∙ Change log

Medium Business (50-249 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Large Business (250-999 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Enterprise (>1,000 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69949, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590067", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590067", "securityControlId": 31043, "ccis": [], "uuid": "77cb6516-0c22-56cf-9d2d-07d35197e66e", "testId": "CHG-02.5_A01", "test": "controls provided by cryptographic mechanisms that are to be under configuration management are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-03(06)_ODP", "defaultText": null }, { "id": 69950, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590067", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590067", "securityControlId": 31043, "ccis": [], "uuid": "439a230b-538a-539d-8558-efefcff67193", "testId": "CHG-02.5_A02", "test": "cryptographic mechanisms used to provide organization-defined controls are under configuration management.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-03(06)", "defaultText": null } ], "externalMappings": [ { "id": 555857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b460248d-7766-561a-a1d6-dab604081027", "parentControlId": 31043, "controlId": "CM-3(6)", "title": "CM-3(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582547" }, { "id": 555858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdae71a6-9bbf-5cbf-9b36-7f06db2799ca", "parentControlId": 31043, "controlId": "CM-03(06)", "title": "CM-03(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582547" }, { "id": 555859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "970e0c46-be89-595f-9a98-779309d55ea3", "parentControlId": 31043, "controlId": "CM-03(06)", "title": "CM-03(06)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582547" }, { "id": 555860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81d1c9a9-0539-5fc4-b8ac-31c6c4462ebf", "parentControlId": 31043, "controlId": "CM-03(06)", "title": "CM-03(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582547" }, { "id": 555861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00b0bc66-f575-5d8b-8dd0-4b24a212e2dd", "parentControlId": 31043, "controlId": "CM-03(06)", "title": "CM-03(06)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582547" } ], "id": 31043, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730939", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730939", "catalogueId": 1062, "uuid": "e63d060a-75ae-58ef-a6cc-ee1db211426d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization govern assets involved in providing cryptographic protections according to its configuration management processes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Cryptographic Management", "description": "

Control Description

Mechanisms exist to govern assets involved in providing cryptographic protections according to the organization's configuration management processes.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Change Management (CHG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CHG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Change management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Change Management (CHG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Change management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Change management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners ensure changes to Technology Assets, Applications and/or Services (TAAS) within the System Development Lifecycle (SDLC) are controlled through formal change control procedures.

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to govern assets involved in providing cryptographic protections according to the organization's configuration management processes.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CHG-02.5", "family": "Change Management", "enhancements": "", "sortId": "CHG-02.5", "references": "

Micro-Small Business (<10 staff)

∙ Document and approve changes before making them

Small Business (10-49 staff)

∙ Change request form\n∙ Change approval process\n∙ Change log

Medium Business (50-249 staff)

∙ Formal change management process (ITIL-aligned)\n∙ CAB\n∙ Rollback procedures

Large Business (250-999 staff)

∙ Enterprise change management platform (e.g., ServiceNow)\n∙ Formal CAB\n∙ Change risk assessment

Enterprise (>1,000 staff)

∙ Enterprise change management platform (ServiceNow, Jira)\n∙ Formal CAB\n∙ Automated CI/CD change controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69951, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590067", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590067", "securityControlId": 31044, "ccis": [], "uuid": "8371a131-c492-5d9a-bd13-e2aa05d12275", "testId": "CHG-03_A01", "test": "proposed configuration-controlled changes to the system are reviewed with explicit consideration for security impacts.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.4.4\n171A_R3_A.03.04.03.b[01]", "defaultText": null }, { "id": 69952, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590067", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590067", "securityControlId": 31044, "ccis": [], "uuid": "e66332a6-1d85-50a0-a758-3dceabedab76", "testId": "CHG-03_A02", "test": "changes to the system are analyzed to determine potential security impacts prior to change implementation.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-04[01]\n171A_R3_A.03.04.04.a", "defaultText": null }, { "id": 69953, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590067", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590067", "securityControlId": 31044, "ccis": [], "uuid": "e285a452-f7ca-5f48-a194-0fa6877d597c", "testId": "CHG-03_A03", "test": "changes to the system are analyzed to determine potential privacy impacts prior to change implementation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-04[02]", "defaultText": null } ], "externalMappings": [ { "id": 555879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582549", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24863a2f-cf29-5c6f-a208-4e480f87f3d9", "parentControlId": 31044, "controlId": "CM-4", "title": "CM-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582549" }, { "id": 555880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582549", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2363064a-338c-5b50-8729-30c64bf95f6c", "parentControlId": 31044, "controlId": "CM-04", "title": "CM-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582549" }, { "id": 555882, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93a71a6f-3feb-55a8-a57f-58d359af9bd5", "parentControlId": 31044, "controlId": "CM-04", "title": "CM-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58255" }, { "id": 555883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e9ae022-7380-5bc5-a860-ec27432a7ef8", "parentControlId": 31044, "controlId": "CM-04", "title": "CM-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58255" }, { "id": 555884, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b18ceec-1796-53a1-9b96-fe17e5f907d2", "parentControlId": 31044, "controlId": "CM-04", "title": "CM-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58255" }, { "id": 555885, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ea25310-4da2-57ae-9ceb-d0b2d6edefd0", "parentControlId": 31044, "controlId": "CM-04", "title": "CM-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58255" }, { "id": 555886, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c101d145-48ea-575f-a4f5-0cc80158b7ab", "parentControlId": 31044, "controlId": "CM-04", "title": "CM-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58255" }, { "id": 555887, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "695b96d1-7444-551d-9cc5-27cd2e5927ae", "parentControlId": 31044, "controlId": "CM-4", "title": "CM-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58255" }, { "id": 555888, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e37275a-4bf9-5399-bcbd-d29b72c467ba", "parentControlId": 31044, "controlId": "CM-4", "title": "CM-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58255" }, { "id": 555890, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51d05322-9184-5e7e-b470-1a0f40fdf6a5", "parentControlId": 31044, "controlId": "3.4.4", "title": "3.4.4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58255" }, { "id": 555891, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d34c7f96-222b-59aa-be3d-35591ecb6a38", "parentControlId": 31044, "controlId": "03.04.03.b", "title": "03.04.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582551" }, { "id": 555892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e74cb9e8-95bc-5395-9bf3-58f88666fcc2", "parentControlId": 31044, "controlId": "03.04.04.a", "title": "03.04.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582551" }, { "id": 555893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9027e6d-7dac-5cdd-991f-b644365220d8", "parentControlId": 31044, "controlId": "03.04.11.b", "title": "03.04.11.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582551" }, { "id": 555897, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5fa011f0-e472-5d38-b3eb-9db5ceb3ab42", "parentControlId": 31044, "controlId": "ID.RA-07", "title": "ID.RA-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582551" }, { "id": 555912, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04ac9aba-cceb-5d76-9a6f-2df972a200a8", "parentControlId": 31044, "controlId": "ASSET-4c", "title": "ASSET-4c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582553" }, { "id": 555913, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "572a0fae-b96e-511a-9290-fa54208f03b7", "parentControlId": 31044, "controlId": "ASSET-4d", "title": "ASSET-4d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582553" }, { "controlId": "A.4.2.2", "title": "A.4.2.2 — Security Impact Analysis of Changes and Environment", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-4, RA-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "c2988d4b-08b0-5657-a8f3-cd483282c5bd", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.2", "title": "NEI 08-09 Sec 4.2.2 — Security Impact Analysis of Changes and Environment", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "4ef9c3b6-973b-5e27-a7c1-265966d40023", "isPublic": true }, { "controlId": "10 CFR 73.54(e), 73.58", "title": "10 CFR 73.54(e), 73.58 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "ce5f56d1-566a-5acf-92f4-ca425a866b63", "isPublic": true }, { "controlId": "C.11.5", "title": "C.11.5 — Security Impact Analysis of Changes and Environment", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "f88daaf3-89a4-508a-be1b-ef381d7bb17e", "isPublic": true }, { "controlId": "NEI 08-09 App E.11.5", "title": "NEI 08-09 App E.11.5 — Security Impact Analysis of Changes and Environment", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.11.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "951e1e05-36f7-5d7e-928a-17d205471ab4", "isPublic": true }, { "controlId": "NSS-17T-Sec4.5", "title": "NSS-17T-Sec4.5 — Engineering Change Control & Safety-Security Impact Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "594ba5ac-5ede-54e7-9b68-96dd9172d5cd", "isPublic": true }, { "controlId": "IEC-62645-8.3", "title": "IEC-62645-8.3 — Modification and Change Management in Nuclear I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "0fc50d5c-e1bc-56f7-8fd2-095b6e2de994", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.6", "title": "IEEE-7-4.3.2-5.3.6 — Safety & Security Impact Analysis of Digital Modifications", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "913ea16d-f4c4-5ca4-8695-762c54b4c502", "isPublic": true } ], "id": 31044, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730939", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730939", "catalogueId": 1062, "uuid": "0f3f649e-8d40-5a4d-b0db-8e8aafc4b71c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization analyze proposed changes for potential security impacts, prior to the implementation of the change?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Security Impact Analysis for Changes", "description": "

Control Description

Mechanisms exist to analyze proposed changes for potential security impacts, prior to the implementation of the change.

Evidence Request List (ERL)

E-CHG-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Change Management (CHG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CHG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Change management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Prior to changes being made, RFCs are informally reviewed for cybersecurity and/or data protection ramifications.

Level 2 - Planned & Tracked: Change Management (CHG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Change management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Change management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners ensure changes to Technology Assets, Applications and/or Services (TAAS) within the System Development Lifecycle (SDLC) are controlled through formal change control procedures.

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to analyze proposed changes for potential security impacts, prior to the implementation of the change.

Level 4 - Quantitatively Controlled: Change Management (CHG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.2.2, C.11.5", "controlId": "CHG-03", "family": "Change Management", "enhancements": "", "sortId": "CHG-03", "references": "

Micro-Small Business (<10 staff)

∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org)

Small Business (10-49 staff)

∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org)

Medium Business (50-249 staff)

∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org)

Large Business (250-999 staff)

∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org)

Enterprise (>1,000 staff)

∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69954, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590068", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590068", "securityControlId": 31045, "ccis": [], "uuid": "00f77e18-03d9-512e-b59d-018190ff65a8", "testId": "CHG-04_A01", "test": "logical access restrictions associated with changes to the system are defined and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.4.5[e]\n171A_3.4.5[f]\n53A_R5_CM-05[04]", "defaultText": null }, { "id": 69955, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590068", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590068", "securityControlId": 31045, "ccis": [], "uuid": "5ffe6089-fa62-5158-ac5c-3cae131c5202", "testId": "CHG-04_A02", "test": "logical access restrictions associated with changes to the system are enforced.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.4.5[h]\n53A_R5_CM-05[06]", "defaultText": null }, { "id": 69956, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590068", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590068", "securityControlId": 31045, "ccis": [], "uuid": "76e0f05e-7ac8-56c8-8231-5a43e804feac", "testId": "CHG-04_A03", "test": "logical access restrictions associated with changes to the system are approved.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.5[g]\n53A_R5_CM-05[05]", "defaultText": null }, { "id": 69957, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590068", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590068", "securityControlId": 31045, "ccis": [], "uuid": "68712418-e2e5-5303-8ac0-3a5df704633e", "testId": "CHG-04_A04", "test": "physical access restrictions associated with changes to the system are defined and documented.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.5[a]\n171A_3.4.5[b]\n53A_R5_CM-05[01]", "defaultText": null }, { "id": 69958, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590068", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590068", "securityControlId": 31045, "ccis": [], "uuid": "2207231f-3f98-529e-8e3e-9c401fecffac", "testId": "CHG-04_A05", "test": "physical access restrictions associated with changes to the system are approved.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.5[c]\n53A_R5_CM-05[02]", "defaultText": null }, { "id": 69959, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590069", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590069", "securityControlId": 31045, "ccis": [], "uuid": "957e41c0-660a-5810-abd6-ab6366d3b045", "testId": "CHG-04_A06", "test": "physical access restrictions associated with changes to the system are enforced.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.5[d]\n53A_R5_CM-05[03]", "defaultText": null } ], "externalMappings": [ { "id": 555953, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582566", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2630d34-5b66-5b04-8d22-c56c6cfe8ade", "parentControlId": 31045, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582566" }, { "id": 555954, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582566", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae973634-f2d3-5bff-827f-4d71d43141e8", "parentControlId": 31045, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582566" }, { "id": 555955, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582566", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fa3facb-623e-567d-9b65-6ca301a6d291", "parentControlId": 31045, "controlId": "T1003.002", "title": "T1003.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582566" }, { "id": 555956, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582566", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "992d1310-fc87-5fc5-8978-57d639a96a3d", "parentControlId": 31045, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582566" }, { "id": 555957, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582566", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea0608df-019b-55dd-b3e5-5f58a025ded2", "parentControlId": 31045, "controlId": "T1003.004", "title": "T1003.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582566" }, { "id": 555958, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582566", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10227244-7f0f-59f4-86fe-875826101318", "parentControlId": 31045, "controlId": "T1003.005", "title": "T1003.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582566" }, { "id": 555959, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582566", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b4558e7-c4ef-54c0-9e1f-d1dda1846bfc", "parentControlId": 31045, "controlId": "T1003.006", "title": "T1003.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582566" }, { "id": 555960, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582566", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1855005-1188-5ea1-bb34-740fb3702b09", "parentControlId": 31045, "controlId": "T1003.007", "title": "T1003.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582566" }, { "id": 555961, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582566", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22d60b75-2adb-5c12-b5d5-12650c72d4d4", "parentControlId": 31045, "controlId": "T1003.008", "title": "T1003.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582566" }, { "id": 555962, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582567", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "686a0d48-bda6-5ddd-b8de-7374802416fc", "parentControlId": 31045, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582567" }, { "id": 555963, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582567", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b80ed096-322a-59cb-a329-c961bd44f120", "parentControlId": 31045, "controlId": "T1021", "title": "T1021", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582567" }, { "id": 555964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582567", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e067f612-b97c-5247-af86-705d579f537e", "parentControlId": 31045, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582567" }, { "id": 555965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582567", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "799c2384-eeea-52d5-8666-1c5fd3aad72c", "parentControlId": 31045, "controlId": "T1021.002", "title": "T1021.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582567" }, { "id": 555966, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582567", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "407a24ea-dae6-5946-983b-f5a91fe56100", "parentControlId": 31045, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582567" }, { "id": 555967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582567", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bfc181d-3712-5815-b96d-e38f2c58b7ee", "parentControlId": 31045, "controlId": "T1021.004", "title": "T1021.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582567" }, { "id": 555968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582567", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31692a6f-29ad-5fba-9edc-588478734e41", "parentControlId": 31045, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582567" }, { "id": 555969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582567", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22571c78-e443-52ec-8eb2-03772e43ab01", "parentControlId": 31045, "controlId": "T1021.006", "title": "T1021.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582567" }, { "id": 555970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582568", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bea1cfd9-b8c8-5dea-94bc-a1dad41fb81b", "parentControlId": 31045, "controlId": "T1021.008", "title": "T1021.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582568" }, { "id": 555971, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582568", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2fcf528-c5ac-5cb4-a90e-70a26fe83d5f", "parentControlId": 31045, "controlId": "T1047", "title": "T1047", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582568" }, { "id": 555972, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582568", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "709bd689-b8b3-55d9-9b61-e58c2300f28f", "parentControlId": 31045, "controlId": "T1053", "title": "T1053", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582568" }, { "id": 555973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582568", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7deb810a-595a-52b5-958b-9b64fddeddbd", "parentControlId": 31045, "controlId": "T1053.002", "title": "T1053.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582568" }, { "id": 555974, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582568", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0928e890-220c-593a-9a4c-44fc02c44f5e", "parentControlId": 31045, "controlId": "T1053.003", "title": "T1053.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582568" }, { "id": 555975, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582568", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3144bb2-7b95-5898-bd90-cd46457005af", "parentControlId": 31045, "controlId": "T1053.005", "title": "T1053.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582568" }, { "id": 555976, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582568", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95b7f2c4-f1ea-5200-808f-b3f3901cc77d", "parentControlId": 31045, "controlId": "T1053.006", "title": "T1053.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582568" }, { "id": 555977, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582568", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b412bbe3-f3b2-5587-987b-decdcf9a897b", "parentControlId": 31045, "controlId": "T1053.007", "title": "T1053.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582568" }, { "id": 555978, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582568", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4af2902-c6af-54af-b278-6fb8b6f75c45", "parentControlId": 31045, "controlId": "T1055", "title": "T1055", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582568" }, { "id": 555979, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582569", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ced49c6-37fc-5544-9358-ac66c177ab86", "parentControlId": 31045, "controlId": "T1055.008", "title": "T1055.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582569" }, { "id": 555980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582569", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62296027-3b46-5a03-9cec-021219e6f3e9", "parentControlId": 31045, "controlId": "T1056.003", "title": "T1056.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582569" }, { "id": 555981, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582569", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a296fd37-5482-5a2c-b450-9d979ae13039", "parentControlId": 31045, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582569" }, { "id": 555982, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582569", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6d56904-f4d0-5d58-a248-a98bf3355fba", "parentControlId": 31045, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582569" }, { "id": 555983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582569", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ecb21fbf-2643-5398-b824-ad64f2afe31a", "parentControlId": 31045, "controlId": "T1059.006", "title": "T1059.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582569" }, { "id": 555984, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582569", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40cb4ef2-c197-5bef-9865-dfa08cb6b83b", "parentControlId": 31045, "controlId": "T1059.008", "title": "T1059.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582569" }, { "id": 555985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582569", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2778e581-ded0-5a4d-b438-1dcc0c1e7fdd", "parentControlId": 31045, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582569" }, { "id": 555986, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582569", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72169a38-858d-5fa9-91c1-3364422b257d", "parentControlId": 31045, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582569" }, { "id": 555987, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582569", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ce7cfbf-f3d4-5a91-b348-a7fa5a9301fb", "parentControlId": 31045, "controlId": "T1078.002", "title": "T1078.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582569" }, { "id": 555988, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ae1d6fa-31d1-57e6-9586-7282f949f4ac", "parentControlId": 31045, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58257" }, { "id": 555989, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14c95576-fa05-5ba1-9674-2a3fa5538211", "parentControlId": 31045, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58257" }, { "id": 555990, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4da40692-d944-5e61-9842-4f2a955e623d", "parentControlId": 31045, "controlId": "T1098", "title": "T1098", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58257" }, { "id": 555991, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91aef08b-a721-5371-9d55-b5c560fe3d98", "parentControlId": 31045, "controlId": "T1098.001", "title": "T1098.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58257" }, { "id": 555992, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3653080e-61e6-5234-8feb-0f9661329914", "parentControlId": 31045, "controlId": "T1098.002", "title": "T1098.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58257" }, { "id": 555993, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9cbbf576-24df-56b6-9cc3-25029aa4d3c6", "parentControlId": 31045, "controlId": "T1098.003", "title": "T1098.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58257" }, { "id": 555994, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c96cc660-fc15-5568-84b5-4acab242cbb8", "parentControlId": 31045, "controlId": "T1098.004", "title": "T1098.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582571" }, { "id": 555995, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7169fc0-8087-5cec-98d0-ad46d4485802", "parentControlId": 31045, "controlId": "T1098.005", "title": "T1098.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582571" }, { "id": 555996, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72c220da-4b5e-5d03-a09e-fd8cdd9e4f38", "parentControlId": 31045, "controlId": "T1098.007", "title": "T1098.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582571" }, { "id": 555997, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41abdeb3-735f-54cf-ac1f-b6bc71fd9f5b", "parentControlId": 31045, "controlId": "T1134", "title": "T1134", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582571" }, { "id": 555998, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5114683-6f70-5f84-b9d5-33988ebc7ae0", "parentControlId": 31045, "controlId": "T1134.001", "title": "T1134.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582571" }, { "id": 555999, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b012ec33-d0ca-55a2-bad4-9dcb9b81a3e5", "parentControlId": 31045, "controlId": "T1134.002", "title": "T1134.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582571" }, { "id": 556000, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "803f7ecf-933f-5c83-adda-c4192bba4ca5", "parentControlId": 31045, "controlId": "T1134.003", "title": "T1134.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582571" }, { "id": 556001, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9aff3aa9-4092-5a0b-8e7b-91bb93120e8b", "parentControlId": 31045, "controlId": "T1136", "title": "T1136", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582571" }, { "id": 556002, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8dc7780-5e42-529d-ae2b-6815ea00a1b8", "parentControlId": 31045, "controlId": "T1136.001", "title": "T1136.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582571" }, { "id": 556003, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2cfd004-c840-5ffa-9542-19da8b384aa4", "parentControlId": 31045, "controlId": "T1136.002", "title": "T1136.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582571" }, { "id": 556004, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d762af75-b918-51c8-86ea-26742dc9c1f8", "parentControlId": 31045, "controlId": "T1136.003", "title": "T1136.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582572" }, { "id": 556005, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a13b8e75-0f56-5adb-94b3-2e5a84762f00", "parentControlId": 31045, "controlId": "T1137.002", "title": "T1137.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582572" }, { "id": 556006, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75f2e7d8-d0c0-53a2-9531-1994f4f451eb", "parentControlId": 31045, "controlId": "T1176", "title": "T1176", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582572" }, { "id": 556007, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60ab7829-ddab-5e13-9fa5-19a00c9cd584", "parentControlId": 31045, "controlId": "T1185", "title": "T1185", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582572" }, { "id": 556008, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8ac6e73-3f0f-5948-883d-cf1dbaf81b23", "parentControlId": 31045, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582572" }, { "id": 556009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "069621e6-87ed-5732-9b05-4482f2ba93e4", "parentControlId": 31045, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582572" }, { "id": 556010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd7d97c1-61cf-5091-9e49-7f0fac31172e", "parentControlId": 31045, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582572" }, { "id": 556011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9932072-edce-5dc2-a26b-11dfa5d9b970", "parentControlId": 31045, "controlId": "T1195.003", "title": "T1195.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582572" }, { "id": 556012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37f4e2c3-9d33-5a09-8a97-b9691606cc51", "parentControlId": 31045, "controlId": "T1197", "title": "T1197", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582572" }, { "id": 556013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ec3622b-d0d1-5514-8e2c-147f0e90b07e", "parentControlId": 31045, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582573" }, { "id": 556014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e02d032-57d0-5e01-bc84-832d79f249a3", "parentControlId": 31045, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582573" }, { "id": 556015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65854ad5-f7e5-5b67-944e-767bbe746cfc", "parentControlId": 31045, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582573" }, { "id": 556016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f430f996-d800-5325-825f-d2d199ce4aa9", "parentControlId": 31045, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582573" }, { "id": 556017, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a768dc6-9efe-50b8-8e7e-9fb7c194ac17", "parentControlId": 31045, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582573" }, { "id": 556018, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "031dab22-32f6-5eec-b84c-713abb702cd4", "parentControlId": 31045, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582573" }, { "id": 556019, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d428653-6997-5b3b-95f4-aa30fd41efb4", "parentControlId": 31045, "controlId": "T1218.007", "title": "T1218.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582573" }, { "id": 556020, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19b33e5d-d851-5eb0-b278-ae8bb8fc8d1c", "parentControlId": 31045, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582574" }, { "id": 556021, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2351179e-8f8a-5cfc-9606-c0adcecf01b2", "parentControlId": 31045, "controlId": "T1222", "title": "T1222", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582574" }, { "id": 556022, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3cd3591c-d42d-542d-98f2-c1f4b8e264a1", "parentControlId": 31045, "controlId": "T1222.001", "title": "T1222.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582574" }, { "id": 556023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9881b0d3-4b02-566c-b433-b8d1ea6a9db5", "parentControlId": 31045, "controlId": "T1222.002", "title": "T1222.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582574" }, { "id": 556024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f519407-db06-58b3-bc5b-b92a141fc843", "parentControlId": 31045, "controlId": "T1484", "title": "T1484", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582574" }, { "id": 556025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fab19a8-1881-528b-8d07-560ee5d9d2d5", "parentControlId": 31045, "controlId": "T1489", "title": "T1489", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582574" }, { "id": 556026, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73c47d3e-1794-567a-b6ea-d584f19d915f", "parentControlId": 31045, "controlId": "T1495", "title": "T1495", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582574" }, { "id": 556027, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "420efcfd-3f6e-50ae-af41-797c651d90f9", "parentControlId": 31045, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582574" }, { "id": 556028, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a28bfea3-463e-51ac-9596-58d383765d28", "parentControlId": 31045, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582574" }, { "id": 556029, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14bff14c-7698-5466-8e4a-32c9ec485a6a", "parentControlId": 31045, "controlId": "T1525", "title": "T1525", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582575" }, { "id": 556030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "833df3cb-c931-5265-af92-a7465b3d1814", "parentControlId": 31045, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582575" }, { "id": 556031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5038986-0c92-5c03-8ef1-ee852e09abac", "parentControlId": 31045, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582575" }, { "id": 556032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9dbf6a7e-6668-5583-8db1-dab0b3b36bdc", "parentControlId": 31045, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582575" }, { "id": 556033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "886f6586-8c72-5a80-8a6f-06f7256df008", "parentControlId": 31045, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582575" }, { "id": 556034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c78e723-f3bd-59ea-a5e7-7de0a52ec798", "parentControlId": 31045, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582575" }, { "id": 556035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dacbe12f-44fe-598a-b789-a583fb64c8ec", "parentControlId": 31045, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582575" }, { "id": 556036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b3b21d6-d395-5caf-98af-6c8f86413982", "parentControlId": 31045, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582575" }, { "id": 556037, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "126b5c4a-0940-5ef0-aeda-364a21431be4", "parentControlId": 31045, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582575" }, { "id": 556038, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582576", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cbd83cd5-134b-5e5e-9ef1-b63bda50cff9", "parentControlId": 31045, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582576" }, { "id": 556039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582576", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6152841-6f35-5e58-88cb-670dbebd875c", "parentControlId": 31045, "controlId": "T1543.001", "title": "T1543.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582576" }, { "id": 556040, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582576", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "001277cb-1753-5aee-803c-65f0d671f786", "parentControlId": 31045, "controlId": "T1543.002", "title": "T1543.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582576" }, { "id": 556041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582576", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81a6dde4-8d07-5c80-9395-6ed53425b320", "parentControlId": 31045, "controlId": "T1543.003", "title": "T1543.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582576" }, { "id": 556042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582576", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "419d85fc-6382-513c-b07f-abd9e281c49c", "parentControlId": 31045, "controlId": "T1543.004", "title": "T1543.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582576" }, { "id": 556043, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582576", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55074e79-3201-50e9-a2b2-115e4e5d69b0", "parentControlId": 31045, "controlId": "T1546.003", "title": "T1546.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582576" }, { "id": 556044, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582576", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b3cd0d1-313a-55b3-b8db-de5e7f2d041f", "parentControlId": 31045, "controlId": "T1546.016", "title": "T1546.016", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582576" }, { "id": 556045, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582576", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a69d2e1-d13a-5fa9-903a-1ab1060638a6", "parentControlId": 31045, "controlId": "T1547.003", "title": "T1547.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582576" }, { "id": 556046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a95d9d9-3fa7-5d7e-8e9b-a62ee4b68fce", "parentControlId": 31045, "controlId": "T1547.004", "title": "T1547.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582577" }, { "id": 556047, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea296c33-9f89-532e-8aec-e03c876afad0", "parentControlId": 31045, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582577" }, { "id": 556048, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7cb77f5-74bd-508c-a71b-b4fed7ed0cab", "parentControlId": 31045, "controlId": "T1547.007", "title": "T1547.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582577" }, { "id": 556049, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b664f8d-bf9b-5028-82ef-c1c57b1b44a7", "parentControlId": 31045, "controlId": "T1547.009", "title": "T1547.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582577" }, { "id": 556050, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e08e803-345a-5d1d-9918-f7d595bb5c52", "parentControlId": 31045, "controlId": "T1547.012", "title": "T1547.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582577" }, { "id": 556051, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d83c1ba-da23-58de-88b8-dab6aa74a4fe", "parentControlId": 31045, "controlId": "T1547.013", "title": "T1547.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582577" }, { "id": 556052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed7e6098-153d-5b99-a130-1955b78fbd07", "parentControlId": 31045, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582577" }, { "id": 556053, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3168d83-d4ed-53a9-b457-142763fdf783", "parentControlId": 31045, "controlId": "T1548.002", "title": "T1548.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582577" }, { "id": 556054, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0302b1a2-411d-5169-b54d-74766577eda6", "parentControlId": 31045, "controlId": "T1548.003", "title": "T1548.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582577" }, { "id": 556055, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd8a7f5a-21d7-54d7-b444-0cba165120f4", "parentControlId": 31045, "controlId": "T1548.005", "title": "T1548.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582578" }, { "id": 556056, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0257cb3f-f026-5de2-8f9c-b5cb5c97f34b", "parentControlId": 31045, "controlId": "T1548.006", "title": "T1548.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582578" }, { "id": 556057, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db6133b2-5138-5d9e-aeb8-c87b0d669196", "parentControlId": 31045, "controlId": "T1550", "title": "T1550", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582578" }, { "id": 556058, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1752831b-4a2f-56fb-b957-2ff7845de8d3", "parentControlId": 31045, "controlId": "T1550.002", "title": "T1550.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582578" }, { "id": 556059, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb03eee9-b7e9-5ed5-964a-a9c13b979fa0", "parentControlId": 31045, "controlId": "T1550.003", "title": "T1550.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582578" }, { "id": 556060, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23a909ff-80da-5d6d-8722-89d000fba9e3", "parentControlId": 31045, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582578" }, { "id": 556061, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0caec989-a661-5a7f-8b23-a723e53a9533", "parentControlId": 31045, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582578" }, { "id": 556062, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae34f1f0-346c-5d0c-91db-a288664948fa", "parentControlId": 31045, "controlId": "T1552.007", "title": "T1552.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582578" }, { "id": 556063, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "804c1b31-2b9b-50a6-bfb1-bdfe4941673e", "parentControlId": 31045, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582578" }, { "id": 556064, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "697858e2-f2b6-5555-9f9c-4a3babfc3e74", "parentControlId": 31045, "controlId": "T1553.006", "title": "T1553.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582579" }, { "id": 556065, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5efddae4-f32e-5f1b-9b79-988db936f220", "parentControlId": 31045, "controlId": "T1554", "title": "T1554", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582579" }, { "id": 556066, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "088c79c2-2463-57c4-97f4-2935262fb660", "parentControlId": 31045, "controlId": "T1556", "title": "T1556", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582579" }, { "id": 556067, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5791875-0e36-5cd3-8777-5a43f91cb6b3", "parentControlId": 31045, "controlId": "T1556.001", "title": "T1556.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582579" }, { "id": 556068, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a03522b-2d99-5877-863a-580b2197f900", "parentControlId": 31045, "controlId": "T1556.003", "title": "T1556.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582579" }, { "id": 556069, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "100e4c3e-1f61-5c01-b133-0a0880fa6c33", "parentControlId": 31045, "controlId": "T1556.004", "title": "T1556.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582579" }, { "id": 556070, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5050f51-9fdc-5941-9dc1-00e0e50e3f15", "parentControlId": 31045, "controlId": "T1556.008", "title": "T1556.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582579" }, { "id": 556071, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84763b84-0a55-5102-979f-c6b1c585655b", "parentControlId": 31045, "controlId": "T1556.009", "title": "T1556.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582579" }, { "id": 556072, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a188e950-e48a-5dfb-97e8-2ac74cad6ff8", "parentControlId": 31045, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58258" }, { "id": 556073, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8626f28-5fe6-596f-b5d2-445f9617ea31", "parentControlId": 31045, "controlId": "T1558.001", "title": "T1558.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58258" }, { "id": 556074, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7a27b00-cc65-5df6-9181-1385fc97a5ad", "parentControlId": 31045, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58258" }, { "id": 556075, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c27d2f7-6b51-5cab-a4c9-e84a74269b9c", "parentControlId": 31045, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58258" }, { "id": 556076, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1f7a01b-3148-5502-93fb-be9284fc850c", "parentControlId": 31045, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58258" }, { "id": 556077, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a701321b-6b97-5b00-9b57-f98edd819cec", "parentControlId": 31045, "controlId": "T1559.001", "title": "T1559.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58258" }, { "id": 556078, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6efdda89-3757-58f8-978b-1537cb2605ab", "parentControlId": 31045, "controlId": "T1559.003", "title": "T1559.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58258" }, { "id": 556079, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4da71b8e-8793-58b9-8ecc-788c1eebb138", "parentControlId": 31045, "controlId": "T1562", "title": "T1562", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58258" }, { "id": 556080, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31133fcf-f646-507b-bdce-9ac05c29340a", "parentControlId": 31045, "controlId": "T1562.001", "title": "T1562.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58258" }, { "id": 556081, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab0d895b-8e3c-570f-a4c0-71e79cc312a7", "parentControlId": 31045, "controlId": "T1562.002", "title": "T1562.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58258" }, { "id": 556082, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06b49650-5931-544d-a564-9b6997b9c025", "parentControlId": 31045, "controlId": "T1562.004", "title": "T1562.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582581" }, { "id": 556083, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f65d91c-d716-5a08-a3b3-ab1b42d40db1", "parentControlId": 31045, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582581" }, { "id": 556084, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57641495-e67a-54ac-af97-9e6a17108dd8", "parentControlId": 31045, "controlId": "T1562.007", "title": "T1562.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582581" }, { "id": 556085, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c825d3d-576b-562d-ac06-b12b6a90fe49", "parentControlId": 31045, "controlId": "T1562.008", "title": "T1562.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582581" }, { "id": 556086, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84098e44-f22b-58cc-adb9-835a773093fc", "parentControlId": 31045, "controlId": "T1562.009", "title": "T1562.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582581" }, { "id": 556087, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5759ea1-2e37-5329-8724-785542d4220c", "parentControlId": 31045, "controlId": "T1562.011", "title": "T1562.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582581" }, { "id": 556088, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b35d19b-34f8-5030-87b1-bdc8612ac9dc", "parentControlId": 31045, "controlId": "T1562.012", "title": "T1562.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582581" }, { "id": 556089, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b123290-bcaa-5a8d-9ecc-331b95298d7f", "parentControlId": 31045, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582581" }, { "id": 556090, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "151ee3cb-fad6-5871-a4d8-94cdd335bb69", "parentControlId": 31045, "controlId": "T1563.001", "title": "T1563.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582582" }, { "id": 556091, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "279cf1f1-311c-5f4d-b13f-e650a54f5ecf", "parentControlId": 31045, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582582" }, { "id": 556092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3dc0454-1da4-5275-92fe-83708f489fa6", "parentControlId": 31045, "controlId": "T1564.008", "title": "T1564.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582582" }, { "id": 556093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db7e7d2c-ff55-55b3-81cd-8dd948ce2926", "parentControlId": 31045, "controlId": "T1569", "title": "T1569", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582582" }, { "id": 556094, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "824b625e-34e8-50ea-ab80-67e0bf36e675", "parentControlId": 31045, "controlId": "T1569.001", "title": "T1569.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582582" }, { "id": 556095, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "559e32e0-9d48-5675-ba8a-6bfdad420c24", "parentControlId": 31045, "controlId": "T1569.002", "title": "T1569.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582582" }, { "id": 556096, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e019423-5477-54d3-9bbc-a0197a2d8d25", "parentControlId": 31045, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582582" }, { "id": 556097, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06c3be46-6296-590a-98c2-d4a927ff24db", "parentControlId": 31045, "controlId": "T1574.005", "title": "T1574.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582582" }, { "id": 556098, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a416694-5fd7-53e7-8cc9-374af320c6b0", "parentControlId": 31045, "controlId": "T1574.010", "title": "T1574.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582583" }, { "id": 556099, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "024c7b29-8dc0-5207-b4fb-7dc081dbffdf", "parentControlId": 31045, "controlId": "T1574.011", "title": "T1574.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582583" }, { "id": 556100, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b016f90-d92c-5692-b80e-9235369d9477", "parentControlId": 31045, "controlId": "T1574.012", "title": "T1574.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582583" }, { "id": 556101, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8446cff4-bef5-5b83-ac57-f73255ef7fd7", "parentControlId": 31045, "controlId": "T1574.014", "title": "T1574.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582583" }, { "id": 556102, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf68ade5-16cc-5779-ae2d-73d895fcc0ac", "parentControlId": 31045, "controlId": "T1578", "title": "T1578", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582583" }, { "id": 556103, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efd9b5e5-5eb1-5c07-be6f-9f41ea79ea85", "parentControlId": 31045, "controlId": "T1578.001", "title": "T1578.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582583" }, { "id": 556104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a467da8f-f2ba-5de2-9add-e980954d0b08", "parentControlId": 31045, "controlId": "T1578.002", "title": "T1578.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582583" }, { "id": 556105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fae33b44-e973-54b8-af54-d0a35a305879", "parentControlId": 31045, "controlId": "T1578.003", "title": "T1578.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582583" }, { "id": 556106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "437383d5-acdd-5a1f-a254-feeb37cfd53b", "parentControlId": 31045, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582583" }, { "id": 556107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce0c62f8-9acb-5ecb-99f9-4563d5ee8e0d", "parentControlId": 31045, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582583" }, { "id": 556108, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16f3602f-0671-52f8-8186-8d4a57410797", "parentControlId": 31045, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582584" }, { "id": 556109, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0b091e2-7f8a-56f2-a6b4-d651afd827d0", "parentControlId": 31045, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582584" }, { "id": 556110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4a30b77-8c76-57ab-9afe-9f4c6aa75dce", "parentControlId": 31045, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582584" }, { "id": 556111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d94d9895-8ee0-58be-82c1-adcf5f0ed65b", "parentControlId": 31045, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582584" }, { "id": 556112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c17e388-ea5e-5f1b-8de3-202205345fff", "parentControlId": 31045, "controlId": "T1619", "title": "T1619", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582584" }, { "id": 556113, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ede5084-1821-5b39-860f-eebac6992327", "parentControlId": 31045, "controlId": "T1621", "title": "T1621", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582584" }, { "id": 556114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a634c83-9170-53cd-b762-032846e6bb3d", "parentControlId": 31045, "controlId": "T1647", "title": "T1647", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582584" }, { "id": 556115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54b0820e-18da-5a64-8f4a-d8171a556a9c", "parentControlId": 31045, "controlId": "CM-5", "title": "CM-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582584" }, { "id": 556116, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "339052da-b1eb-51ed-920a-d7cbdff52bc4", "parentControlId": 31045, "controlId": "CM-05", "title": "CM-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582585" }, { "id": 556118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "432f7bdd-0610-5e8f-b80e-0cf95c32f6eb", "parentControlId": 31045, "controlId": "CM-05", "title": "CM-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582585" }, { "id": 556119, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5881454-0e33-5fa8-848d-d964e20a0797", "parentControlId": 31045, "controlId": "CM-05", "title": "CM-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582585" }, { "id": 556120, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bcff52a8-914f-5771-9853-4f1af7249cbf", "parentControlId": 31045, "controlId": "CM-05", "title": "CM-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582585" }, { "id": 556121, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83434f5f-f52f-5c51-baaf-11243d0292af", "parentControlId": 31045, "controlId": "CM-05", "title": "CM-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582585" }, { "id": 556122, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08cb356e-4619-54e1-bf2a-350190065622", "parentControlId": 31045, "controlId": "CM-05", "title": "CM-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582585" }, { "id": 556123, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "079ce0b1-80e7-5dbc-bdfa-6444aaa98b3c", "parentControlId": 31045, "controlId": "CM-5", "title": "CM-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582585" }, { "id": 556124, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7434358-329e-5469-b83f-e30576f34e8a", "parentControlId": 31045, "controlId": "CM-5", "title": "CM-5", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582585" }, { "id": 556127, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582586", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de109b90-9a1a-5522-9aa5-73060b562edd", "parentControlId": 31045, "controlId": "3.4.5", "title": "3.4.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582586" }, { "id": 556128, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582586", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5537f035-abb0-5842-9f7d-84de4c4e0a8c", "parentControlId": 31045, "controlId": "03.04.02.b", "title": "03.04.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582586" }, { "id": 556129, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582586", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38f0afb0-f862-5756-b164-4fe4a1943c2f", "parentControlId": 31045, "controlId": "03.04.05", "title": "03.04.05", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582586" }, { "id": 556139, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582587", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91ca79e9-d8d5-58e8-a93d-4c116669a5a3", "parentControlId": 31045, "controlId": "ID.RA-07", "title": "ID.RA-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582587" }, { "id": 556145, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582588", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d26767c6-5d98-5109-b305-c49020baee1e", "parentControlId": 31045, "controlId": "ASSET-4e", "title": "ASSET-4e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582588" }, { "controlId": "B.5.3", "title": "B.5.3 — Changes to File System and Operating System Permissions", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-5, AC-6, SI-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "31e2f863-47de-50f2-adb4-b48cca49c377", "isPublic": true }, { "controlId": "NEI 08-09 App D.5.3", "title": "NEI 08-09 App D.5.3 — Changes to File System and Operating System Permissions", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.5.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "14d35968-3b08-534c-a22b-612c7e1f03b7", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.5.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "fe4917b0-08ae-5c21-a4a8-673b0adebc0b", "isPublic": true }, { "controlId": "C.11.6", "title": "C.11.6 — Access Restrictions for Change", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "0ad93e53-293b-53af-b140-6b8fff7a893a", "isPublic": true }, { "controlId": "NEI 08-09 App E.11.6", "title": "NEI 08-09 App E.11.6 — Access Restrictions for Change", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.11.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6fe988bb-7f27-531f-ac92-a6be1fc7e5c6", "isPublic": true }, { "controlId": "10 CFR 73.54(e)", "title": "10 CFR 73.54(e) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.11.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "a6803bea-1f29-5ebc-81f0-5b6dbe67c9a0", "isPublic": true }, { "controlId": "NSS-17T-Sec4.5", "title": "NSS-17T-Sec4.5 — Engineering Change Control & Safety-Security Impact Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "8c5ce627-654b-5725-a88e-e290c376bbf4", "isPublic": true }, { "controlId": "IEC-62645-8.3", "title": "IEC-62645-8.3 — Modification and Change Management in Nuclear I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "3c321636-ab19-543d-9e95-f9afb37b83c6", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.6", "title": "IEEE-7-4.3.2-5.3.6 — Safety & Security Impact Analysis of Digital Modifications", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "d340ce08-41f2-50a0-9830-1c11d607132f", "isPublic": true } ], "id": 31045, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73094", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73094", "catalogueId": 1062, "uuid": "3ee8dcf3-b4df-547c-abdc-27964e65b9d7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce configuration restrictions in an effort to restrict the ability of users to conduct unauthorized changes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Access Restriction For Change", "description": "

Control Description

Mechanisms exist to enforce configuration restrictions in an effort to restrict the ability of users to conduct unauthorized changes.

Evidence Request List (ERL)

E-HRS-13\nE-IAM-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Change Management (CHG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Change management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Change management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners ensure changes to Technology Assets, Applications and/or Services (TAAS) within the System Development Lifecycle (SDLC) are controlled through formal change control procedures.

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enforce configuration restrictions in an effort to restrict the ability of users to conduct unauthorized changes.

Level 4 - Quantitatively Controlled: Change Management (CHG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.5.3, C.11.6", "controlId": "CHG-04", "family": "Change Management", "enhancements": "", "sortId": "CHG-04", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69960, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590069", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590069", "securityControlId": 31046, "ccis": [], "uuid": "2263b318-ee63-5801-935e-60571c49f4f9", "testId": "CHG-04.1_A01", "test": "mechanisms used to automate the enforcement of access restrictions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-05(01)_ODP", "defaultText": null }, { "id": 69961, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590069", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590069", "securityControlId": 31046, "ccis": [], "uuid": "91005e9b-6856-5670-b86e-ea9a4bf8e6cd", "testId": "CHG-04.1_A02", "test": "access restrictions for change are enforced using organization-defined automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-05(01)(a)", "defaultText": null }, { "id": 69962, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590069", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590069", "securityControlId": 31046, "ccis": [], "uuid": "6ea069ae-770b-5539-b414-8c6f28b9374b", "testId": "CHG-04.1_A03", "test": "audit records of enforcement actions are automatically generated.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CM-05(01)(b)", "defaultText": null } ], "externalMappings": [ { "id": 556177, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582591", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea63ea79-56e8-54bc-a14b-2eae6e061a05", "parentControlId": 31046, "controlId": "CM-5(1)", "title": "CM-5(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582592" }, { "id": 556178, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582592", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7404526d-464f-5556-bad3-80f65f9dab34", "parentControlId": 31046, "controlId": "CM-05(01)", "title": "CM-05(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582592" }, { "id": 556179, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582592", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cba9b498-78ef-5aab-8e63-71048f10e718", "parentControlId": 31046, "controlId": "CM-05(01)", "title": "CM-05(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582592" }, { "id": 556180, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582592", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88ae1f27-6448-54c2-bf5e-7b02436db4cc", "parentControlId": 31046, "controlId": "CM-05(01)", "title": "CM-05(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582592" }, { "id": 556181, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582592", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59fce529-e9b7-51b4-a8c1-4f3524a1f2bd", "parentControlId": 31046, "controlId": "CM-05(01)", "title": "CM-05(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582592" }, { "id": 556182, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582592", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "954d9daa-5c9e-5809-a6e3-ddf82ed567f0", "parentControlId": 31046, "controlId": "CM-5(1)", "title": "CM-5(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582592" } ], "id": 31046, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73094", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73094", "catalogueId": 1062, "uuid": "b6e4a9cf-f2d9-5e69-94db-790e441c4a6d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization perform after-the-fact reviews of configuration change logs to discover any unauthorized changes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Automated Access Enforcement / Auditing", "description": "

Control Description

Mechanisms exist to perform after-the-fact reviews of configuration change logs to discover any unauthorized changes.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to perform after-the-fact reviews of configuration change logs to discover any unauthorized changes.

Level 4 - Quantitatively Controlled: Change Management (CHG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CHG-04.1", "family": "Change Management", "enhancements": "", "sortId": "CHG-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Configuration Management Database (CMDB)

Small Business (10-49 staff)

∙ Configuration Management Database (CMDB)

Medium Business (50-249 staff)

∙ Configuration Management Database (CMDB)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Large Business (250-999 staff)

∙ Configuration Management Database (CMDB)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Enterprise (>1,000 staff)

∙ Configuration Management Database (CMDB)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69963, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590069", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590069", "securityControlId": 31047, "ccis": [], "uuid": "94e3abe7-050a-5d39-b90c-baed5d1854a6", "testId": "CHG-04.2_A01", "test": "software or firmware components requiring verification of a digitally signed certificate before installation are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-14_ODP[01]\n53A_R5_CM-14_ODP[02]", "defaultText": null }, { "id": 69964, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59007", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59007", "securityControlId": 31047, "ccis": [], "uuid": "f8f072a6-0ecd-591c-8dce-b7eebbdddcf2", "testId": "CHG-04.2_A02", "test": "the installation of software or firmware components is prevented unless it is verified that the software has been digitally signed using a certificate recognized and approved by the organization.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-14[01]\n53A_R5_CM-14[02]", "defaultText": null }, { "id": 69965, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59007", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59007", "securityControlId": 31047, "ccis": [], "uuid": "2f5afea3-0c34-5763-8d7e-329da317683f", "testId": "CHG-04.2_A03", "test": "software or firmware components to be authenticated by cryptographic mechanisms prior to installation are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-07(15)_ODP", "defaultText": null }, { "id": 69966, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59007", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59007", "securityControlId": 31047, "ccis": [], "uuid": "62d24957-d34d-55b9-bc6b-c2a2d10dd7a1", "testId": "CHG-04.2_A04", "test": "cryptographic mechanisms are implemented to authenticate software or firmware components prior to installation.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-07(15)", "defaultText": null } ], "externalMappings": [ { "id": 556191, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e8f6ca4-3fdb-5323-b2ca-52814a583bd0", "parentControlId": 31047, "controlId": "CR 3.4(1)", "title": "CR 3.4(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582593" }, { "id": 556192, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8af042c-2c81-5fe7-8cff-935ace04bd73", "parentControlId": 31047, "controlId": "EDR 2.4(1)", "title": "EDR 2.4(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582593" }, { "id": 556193, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7683b14-3468-583c-a6f5-ae503127582f", "parentControlId": 31047, "controlId": "HDR 3.10(1)", "title": "HDR 3.10(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582594" }, { "id": 556194, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582594", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9717399-9b53-5d1e-a3f9-ceccaa8554bb", "parentControlId": 31047, "controlId": "NDR 3.10(1)", "title": "NDR 3.10(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582594" }, { "id": 556195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582594", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0778e0bb-c14c-51ce-aae0-f7464602202e", "parentControlId": 31047, "controlId": "CM-5(3)", "title": "CM-5(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582594" }, { "id": 556196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582594", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de5007e1-4f4b-593d-beee-461478020c8e", "parentControlId": 31047, "controlId": "CM-14", "title": "CM-14", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582594" }, { "id": 556197, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582594", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c96dbc4d-26d1-53a4-bfc8-fd4ffc840e65", "parentControlId": 31047, "controlId": "SI-07(15)", "title": "SI-07(15)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582594" }, { "id": 556198, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582594", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aee841e2-0d0c-5e4b-a573-89af3ec118d4", "parentControlId": 31047, "controlId": "SI-07(15)", "title": "SI-07(15)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582594" }, { "id": 556199, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582594", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3c67dd2-d74c-57eb-8ba7-eefa1e276bb4", "parentControlId": 31047, "controlId": "CM-14", "title": "CM-14", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582594" }, { "id": 556200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582594", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "966e402b-14e9-52f3-a705-1e378674542a", "parentControlId": 31047, "controlId": "SI-07(15)", "title": "SI-07(15)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582594" }, { "id": 556201, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582594", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9cdc7173-416a-5caa-b87c-d78d1e2f0d28", "parentControlId": 31047, "controlId": "SI-07(15)", "title": "SI-07(15)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582594" }, { "id": 556204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582595", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02dda32a-e7ac-5b36-876b-0941ae8b147a", "parentControlId": 31047, "controlId": "CM-14", "title": "CM-14", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582595" }, { "id": 556205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582595", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3365e109-7d62-5f6b-9d23-00c151fd08db", "parentControlId": 31047, "controlId": "SI-7(15)", "title": "SI-7(15)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582595" } ], "id": 31047, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73094", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73094", "catalogueId": 1062, "uuid": "14c86afa-411c-5832-a248-8e5a677441d1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prevent the installation of software and firmware components without verification that the component has been digitally signed using an organization-approved certificate authority?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Signed Components", "description": "

Control Description

Mechanisms exist to prevent the installation of software and firmware components without verification that the component has been digitally signed using an organization-approved certificate authority.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prevent the installation of software and firmware components without verification that the component has been digitally signed using an organization-approved certificate authority.

Level 4 - Quantitatively Controlled: Change Management (CHG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CHG-04.2", "family": "Change Management", "enhancements": "", "sortId": "CHG-04.2", "references": "

Micro-Small Business (<10 staff)

∙ Document and approve changes before making them

Small Business (10-49 staff)

∙ Change request form\n∙ Change approval process\n∙ Change log

Medium Business (50-249 staff)

∙ Formal change management process (ITIL-aligned)\n∙ CAB\n∙ Rollback procedures

Large Business (250-999 staff)

∙ Enterprise change management platform (e.g., ServiceNow)\n∙ Formal CAB\n∙ Change risk assessment

Enterprise (>1,000 staff)

∙ Enterprise change management platform (ServiceNow, Jira)\n∙ Formal CAB\n∙ Automated CI/CD change controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69967, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59007", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59007", "securityControlId": 31048, "ccis": [], "uuid": "dd332346-bafc-5039-b45d-138c9f1dac13", "testId": "CHG-04.3_A01", "test": "critical or sensitive system and organizational operations for which dual authorization is to be enforced are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.1.1e[a]\n53A_R5_CM-05(04)_ODP[01]\n53A_R5_CM-05(04)_ODP[02]", "defaultText": null }, { "id": 69968, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59007", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59007", "securityControlId": 31048, "ccis": [], "uuid": "f99b7b08-a826-5ee9-8b45-f2d32fdedd1a", "testId": "CHG-04.3_A02", "test": "dual authorization is employed to execute critical or sensitive system and organizational operations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "172A_3.1.1e[b]\n53A_R5_CM-05(04)[01]\n53A_R5_CM-05(04)[02]", "defaultText": null } ], "externalMappings": [ { "id": 556217, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68e1bc3f-7b17-5219-ab7b-3fee346c3b1e", "parentControlId": 31048, "controlId": "USER 2.3", "title": "USER 2.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582596" }, { "id": 556218, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa886916-f17d-5ac9-a35c-70a03b073815", "parentControlId": 31048, "controlId": "AC-5", "title": "AC-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582597" }, { "id": 556219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb17ab32-d172-53ca-9676-d24045f6e30d", "parentControlId": 31048, "controlId": "CM-5(4)", "title": "CM-5(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582597" }, { "id": 556220, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "686743ae-4372-59dc-a3d9-a097b07c235d", "parentControlId": 31048, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582597" }, { "id": 556221, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "582ad20a-e4bb-5280-861f-a463f70d895c", "parentControlId": 31048, "controlId": "CM-05(04)", "title": "CM-05(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582597" }, { "id": 556223, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "304bba11-338a-5baa-bf86-0a11d6a560d9", "parentControlId": 31048, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582597" }, { "id": 556224, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f779e7a-97de-52b1-a088-3d91affe5ec9", "parentControlId": 31048, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582597" }, { "id": 556225, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b54d86be-6417-58e0-8ddf-f801a7fe96bd", "parentControlId": 31048, "controlId": "CM-05(04)", "title": "CM-05(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582597" }, { "id": 556226, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d180068d-27d7-508b-98dd-a4742b1b5b7e", "parentControlId": 31048, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582597" }, { "id": 556227, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85f7ba2a-10d0-59d7-a5b2-cec20761e17e", "parentControlId": 31048, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582598" }, { "id": 556229, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bff76e6-19d7-5683-a755-7378ccb98528", "parentControlId": 31048, "controlId": "AC-5", "title": "AC-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582598" }, { "id": 556230, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b7bfb2e-068d-5124-83ff-4832803624d6", "parentControlId": 31048, "controlId": "AC-5", "title": "AC-5", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582598" }, { "controlId": "B.1.5", "title": "B.1.5 — Separation of Functions", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "7ab9f212-32b3-5a2b-bc40-65a0f6904867", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.5", "title": "NEI 08-09 App D.1.5 — Separation of Functions", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "ed4d748e-942b-5fb1-9867-98f1490f65ec", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "ed9176f8-d03d-5bbd-aff7-9cdb6f870e64", "isPublic": true }, { "controlId": "NSS-17T-Sec4.5", "title": "NSS-17T-Sec4.5 — Engineering Change Control & Safety-Security Impact Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "eb9f9437-35f5-560d-955e-9dc28486b30e", "isPublic": true }, { "controlId": "IEC-62645-8.3", "title": "IEC-62645-8.3 — Modification and Change Management in Nuclear I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "4cdb607d-cdd7-518a-9b66-9ffeaee08d79", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.6", "title": "IEEE-7-4.3.2-5.3.6 — Safety & Security Impact Analysis of Digital Modifications", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "b2ad196f-fd5d-594e-88f5-c5968d221931", "isPublic": true } ], "id": 31048, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73094", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730941", "catalogueId": 1062, "uuid": "d59e8d7e-4cd1-561e-b9c1-01ae809d20d3", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce a two-person rule for implementing changes to critical Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Dual Authorization for Change", "description": "

Control Description

Mechanisms exist to enforce a two-person rule for implementing changes to critical Technology Assets, Applications and/or Services (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enforce a two-person rule for implementing changes to critical Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.5", "controlId": "CHG-04.3", "family": "Change Management", "enhancements": "", "sortId": "CHG-04.3", "references": "

Micro-Small Business (<10 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Small Business (10-49 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Medium Business (50-249 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Large Business (250-999 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Enterprise (>1,000 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69969, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590071", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590071", "securityControlId": 31049, "ccis": [], "uuid": "9683f9b3-8bf8-5700-9d9d-82c082b9bd77", "testId": "CHG-04.4_A01", "test": "privileges to change system components within a production or operational environment are limited.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-05(05)(a)[01]", "defaultText": null }, { "id": 69970, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590071", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590071", "securityControlId": 31049, "ccis": [], "uuid": "b13d0a4f-a07c-53b9-aedd-37e2bb9da391", "testId": "CHG-04.4_A02", "test": "logical access restrictions associated with changes to the system are enforced.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.04.05[06]", "defaultText": null }, { "id": 69971, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590071", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590071", "securityControlId": 31049, "ccis": [], "uuid": "f8520842-d859-5fb0-8f79-1752a8c5bcf4", "testId": "CHG-04.4_A03", "test": "the frequency at which to review privileges is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least quarterly", "otherId": "53A_R5_CM-05(05)_ODP[01]", "defaultText": null }, { "id": 69972, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590071", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590071", "securityControlId": 31049, "ccis": [], "uuid": "529fe55a-773e-5aee-9943-f5dab95e297b", "testId": "CHG-04.4_A04", "test": "the frequency at which to reevaluate privileges is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least quarterly", "otherId": "53A_R5_CM-05(05)_ODP[02]", "defaultText": null }, { "id": 69973, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590071", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590071", "securityControlId": 31049, "ccis": [], "uuid": "918abdab-1bf3-5a4e-96fa-e643c0d4df33", "testId": "CHG-04.4_A05", "test": "privileges to change system-related information within a production or operational environment are limited.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CM-05(05)(a)[02]", "defaultText": null }, { "id": 69974, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590072", "securityControlId": 31049, "ccis": [], "uuid": "515e5c0d-ac65-569a-a820-2a03920c470a", "testId": "CHG-04.4_A06", "test": "privileges are reviewed per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least quarterly", "otherId": "53A_R5_CM-05(05)(b)[01]", "defaultText": null }, { "id": 69975, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590072", "securityControlId": 31049, "ccis": [], "uuid": "ffb12048-1046-5dae-b3d1-b69d5e5b07e1", "testId": "CHG-04.4_A07", "test": "privileges are reevaluated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least quarterly", "otherId": "53A_R5_CM-05(05)(b)[02]", "defaultText": null } ], "externalMappings": [ { "id": 556250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71b910ae-e133-5dc3-ac5d-905ceb37b177", "parentControlId": 31049, "controlId": "CM-5(5)", "title": "CM-5(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582601" }, { "id": 556251, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aacb1c52-59ca-508b-84a6-7d71413ff03a", "parentControlId": 31049, "controlId": "CM-05(05)", "title": "CM-05(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582601" }, { "id": 556252, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ee56036-ea93-5f28-9903-becf5b403d96", "parentControlId": 31049, "controlId": "CM-05(05)", "title": "CM-05(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582601" }, { "id": 556254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4e47913-eb81-59f4-b6f1-9a58a545636a", "parentControlId": 31049, "controlId": "03.04.05", "title": "03.04.05", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582601" }, { "id": 556256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ec7f1c0-f183-514d-8ddf-2de70a7a353d", "parentControlId": 31049, "controlId": "ASSET-4e", "title": "ASSET-4e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582602" } ], "id": 31049, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730941", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730941", "catalogueId": 1062, "uuid": "6a61ec4e-6b47-582c-bc60-075267107b48", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization limit operational privileges for implementing changes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Permissions To Implement Changes", "description": "

Control Description

Mechanisms exist to limit operational privileges for implementing changes.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Change Management (CHG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CHG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Change management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Change Management (CHG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Change management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Change management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners ensure changes to Technology Assets, Applications and/or Services (TAAS) within the System Development Lifecycle (SDLC) are controlled through formal change control procedures.

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to limit operational privileges for implementing changes.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CHG-04.4", "family": "Change Management", "enhancements": "", "sortId": "CHG-04.4", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69976, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590072", "securityControlId": 31050, "ccis": [], "uuid": "acd99ae8-2ae6-5dbb-ac81-03e5eb41752e", "testId": "CHG-04.5_A01", "test": "privileges to change software resident within software libraries are limited.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-05(06)", "defaultText": null } ], "externalMappings": [ { "id": 556273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b6f11d9-c201-54d5-af56-d35c4c6eaffc", "parentControlId": 31050, "controlId": "CM-5(6)", "title": "CM-5(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582616" }, { "id": 556274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "135dfa2b-c717-51b7-b76b-f98a14ed940e", "parentControlId": 31050, "controlId": "CM-05(06)", "title": "CM-05(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582616" }, { "id": 556275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "671d96ed-5568-5a88-8ecd-e5c55f561419", "parentControlId": 31050, "controlId": "CM-05(06)", "title": "CM-05(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582616" }, { "id": 556277, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e124a130-ae75-54ba-bfa9-0ac029b6c1f7", "parentControlId": 31050, "controlId": "CM-5(6)", "title": "CM-5(6)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582616" } ], "id": 31050, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730941", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730941", "catalogueId": 1062, "uuid": "940f321c-3584-5e91-bc22-b851c78621dc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict software library privileges to those individuals with a pertinent business need for access?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Library Privileges", "description": "

Control Description

Mechanisms exist to restrict software library privileges to those individuals with a pertinent business need for access.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Change Management (CHG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CHG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Change management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Change Management (CHG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Change management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Change management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners ensure changes to Technology Assets, Applications and/or Services (TAAS) within the System Development Lifecycle (SDLC) are controlled through formal change control procedures.

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict software library privileges to those individuals with a pertinent business need for access.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CHG-04.5", "family": "Change Management", "enhancements": "", "sortId": "CHG-04.5", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69977, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590072", "securityControlId": 31051, "ccis": [], "uuid": "f6fae3b7-6e76-5739-b823-084dc26830a2", "testId": "CHG-05_A01", "test": "as part of the organization's change management processes, stakeholders are alerted to spread awareness of the potential impact(s) from proposed changes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69978, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590072", "securityControlId": 31051, "ccis": [], "uuid": "aef1c473-0378-52e4-9da4-187994425195", "testId": "CHG-05_A02", "test": "changes to the system or system component location where sensitive / regulated data is processed are documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 69979, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590072", "securityControlId": 31051, "ccis": [], "uuid": "0be57481-d601-54c2-b62f-b5fd4708abdb", "testId": "CHG-05_A03", "test": "changes to the system or system component location where sensitive / regulated data is stored are documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 69980, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590073", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590073", "securityControlId": 31051, "ccis": [], "uuid": "fa6c5a55-11b1-50dc-8c78-fdbf2c8cb70e", "testId": "CHG-05_A04", "test": "changes to the system or system component location where CUI is processed are documented.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.04.11.b[01]", "defaultText": null }, { "id": 69981, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590073", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590073", "securityControlId": 31051, "ccis": [], "uuid": "7501ab16-9da8-5d6d-a792-c2c0bffa1c35", "testId": "CHG-05_A05", "test": "changes to the system or system component location where CUI is stored are documented.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.04.11.b[02]", "defaultText": null } ], "externalMappings": [ { "id": 556301, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ba8adff-759b-5c9c-9ef5-142eee35642c", "parentControlId": 31051, "controlId": "CM-9", "title": "CM-9", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582619" }, { "id": 556302, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "543d5ed5-4270-5fdb-aa1e-45fddc78e85f", "parentControlId": 31051, "controlId": "CM-09", "title": "CM-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582619" }, { "id": 556304, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2837f9c4-65e0-58dc-802c-3f4bb0f695aa", "parentControlId": 31051, "controlId": "CM-09", "title": "CM-09", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582619" }, { "id": 556305, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42e54342-b616-5b07-acd9-408fc303ce65", "parentControlId": 31051, "controlId": "CM-09", "title": "CM-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582619" }, { "id": 556306, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c8068f0-1eb2-58dd-82a8-2a9079187898", "parentControlId": 31051, "controlId": "CM-09", "title": "CM-09", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582619" }, { "id": 556307, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44aeb3ca-f2e1-5162-a721-79345bcc978a", "parentControlId": 31051, "controlId": "CM-09", "title": "CM-09", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58262" }, { "id": 556308, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2efbfb85-ee49-5ba3-a2c3-159ae96a7814", "parentControlId": 31051, "controlId": "CM-9", "title": "CM-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58262" }, { "id": 556309, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c0724c4-1041-587d-a76e-82a1346afe89", "parentControlId": 31051, "controlId": "CM-9", "title": "CM-9", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58262" }, { "id": 556312, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5f9d758-d451-57ea-b93a-a637bf89a16a", "parentControlId": 31051, "controlId": "NFO - CM-9", "title": "NFO - CM-9", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58262" }, { "id": 556313, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c23ba0ae-f50e-568f-bcf4-5ef419084bf2", "parentControlId": 31051, "controlId": "03.04.11.b", "title": "03.04.11.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58262" }, { "controlId": "NSS-17T-Sec4.5", "title": "NSS-17T-Sec4.5 — Engineering Change Control & Safety-Security Impact Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "5c6c40c1-e911-5f2d-beea-ab2c9dff2fa4", "isPublic": true }, { "controlId": "IEC-62645-8.3", "title": "IEC-62645-8.3 — Modification and Change Management in Nuclear I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "54603b54-3548-5687-803b-e116b6fe1dd3", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.6", "title": "IEEE-7-4.3.2-5.3.6 — Safety & Security Impact Analysis of Digital Modifications", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "d9a9b633-6eb8-5c9c-a0f4-a4e29bf57f7b", "isPublic": true } ], "id": 31051, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730941", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730942", "catalogueId": 1062, "uuid": "5fbcc069-144b-57ab-a98d-9a36065d7838", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure stakeholders are made aware of and understand the impact of proposed changes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Stakeholder Notification of Changes", "description": "

Control Description

Mechanisms exist to ensure stakeholders are made aware of and understand the impact of proposed changes.

Evidence Request List (ERL)

E-CHG-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Change Management (CHG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CHG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Change management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited information is provided to stakeholders about proposed changes.

Level 2 - Planned & Tracked: Change Management (CHG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Change management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Change management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners ensure changes to Technology Assets, Applications and/or Services (TAAS) within the System Development Lifecycle (SDLC) are controlled through formal change control procedures.

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure stakeholders are made aware of and understand the impact of proposed changes.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CHG-05", "family": "Change Management", "enhancements": "", "sortId": "CHG-05", "references": "

Micro-Small Business (<10 staff)

∙ Change management procedures\n∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)

Small Business (10-49 staff)

∙ Change management procedures\n∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)

Medium Business (50-249 staff)

∙ Change management procedures\n∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)

Large Business (250-999 staff)

∙ Change management procedures\n∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)

Enterprise (>1,000 staff)

∙ Change management procedures\n∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69982, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590073", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590073", "securityControlId": 31052, "ccis": [], "uuid": "8785e7ea-3799-5a17-b2c7-29e0ced9dbbc", "testId": "CHG-06_A01", "test": "security functions to be verified for correct operation are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-06_ODP[01]", "defaultText": null }, { "id": 69983, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590073", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590073", "securityControlId": 31052, "ccis": [], "uuid": "0d3fc705-a186-58c3-b8b5-acfd210b7762", "testId": "CHG-06_A02", "test": "organization-defined activities are initiated when anomalies are discovered.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-06d.\n53A_R5_SI-06_ODP[07]", "defaultText": null }, { "id": 69984, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590073", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590073", "securityControlId": 31052, "ccis": [], "uuid": "4b8765fb-bd70-5c90-a9a5-ca9cb0042dad", "testId": "CHG-06_A03", "test": "the security requirements for the system continue to be satisfied after the system changes have been implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.04.04.b", "defaultText": null }, { "id": 69985, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590074", "securityControlId": 31052, "ccis": [], "uuid": "cea5896a-4237-5e95-8010-8cf09fee3ed2", "testId": "CHG-06_A04", "test": "privacy functions to be verified for correct operation are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-06_ODP[02]", "defaultText": null }, { "id": 69986, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590074", "securityControlId": 31052, "ccis": [], "uuid": "b05a4a9f-5970-5cc8-9ba6-e4edf27cb3a3", "testId": "CHG-06_A05", "test": "system transitional states requiring the verification of cybersecurity / data privacy functions are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-06_ODP[04]", "defaultText": null }, { "id": 69987, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590076", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590076", "securityControlId": 31052, "ccis": [], "uuid": "95d5d61e-8888-5791-aa30-6942e6c4c5d4", "testId": "CHG-06_A06", "test": "the frequency at which to verify the correct operation of cybersecurity / data privacy functions is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-06_ODP[05]", "defaultText": null }, { "id": 69988, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590076", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590076", "securityControlId": 31052, "ccis": [], "uuid": "499f50f1-65d3-5bf3-9013-4039ca216c7d", "testId": "CHG-06_A07", "test": "alternative action(s) to be performed when anomalies are discovered are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-06_ODP[08]", "defaultText": null }, { "id": 69989, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590076", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590076", "securityControlId": 31052, "ccis": [], "uuid": "b1ea97da-7395-5fca-a491-d934c95dab43", "testId": "CHG-06_A08", "test": "cybersecurity / data privacy functions are verified to be operating correctly.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: to include upon system startup and/or restart", "otherId": "53A_R5_SI-06a.[01]\n53A_R5_SI-06b.[01]\n53A_R5_CM-03(02)[01]\n53A_R5_CM-03(02)[02]", "defaultText": null }, { "id": 69990, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590076", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590076", "securityControlId": 31052, "ccis": [], "uuid": "9f0dfd14-0774-5346-b8ed-d1ee9fdf4779", "testId": "CHG-06_A09", "test": "personnel or roles to be alerted of failed cybersecurity / data privacy verification tests is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-06_ODP[06]", "defaultText": null }, { "id": 69991, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590076", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590077", "securityControlId": 31052, "ccis": [], "uuid": "06df6369-ea15-5234-83af-846ca17ae2d9", "testId": "CHG-06_A10", "test": "pertinent personnel or roles is/are alerted to failed cybersecurity / data privacy verification tests.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: to include system administrators and security personnel", "otherId": "53A_R5_SI-06c.[01]\n53A_R5_SI-06c.[02]", "defaultText": null } ], "externalMappings": [ { "id": 556337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1593ceff-7ec6-5fec-a335-78ae72a520f3", "parentControlId": 31052, "controlId": "SR 3.3", "title": "SR 3.3", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582623" }, { "id": 556338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35fdb426-25f0-5cdc-aab3-5078c70af257", "parentControlId": 31052, "controlId": "CR 3.3", "title": "CR 3.3", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582623" }, { "id": 556339, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3f2ea53-6fb5-550d-a891-43500acc5421", "parentControlId": 31052, "controlId": "CR 3.3(1)", "title": "CR 3.3(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582623" }, { "id": 556340, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0250a3a7-a984-5669-b5e6-aef4939a8e78", "parentControlId": 31052, "controlId": "CM-3(2)", "title": "CM-3(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582624" }, { "id": 556341, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69b37c4f-ac6d-5629-9afa-d65b344bc7f2", "parentControlId": 31052, "controlId": "SI-6", "title": "SI-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582624" }, { "id": 556342, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f90b1ea3-e272-5366-96a5-e2425c566ae9", "parentControlId": 31052, "controlId": "CM-03(02)", "title": "CM-03(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582624" }, { "id": 556343, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "321e22e0-45c8-5436-b3a9-9f528629f678", "parentControlId": 31052, "controlId": "SA-08(31)", "title": "SA-08(31)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582624" }, { "id": 556344, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c45a2d97-9dfa-5ccd-a85e-7940975d4c92", "parentControlId": 31052, "controlId": "SI-06", "title": "SI-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582624" }, { "id": 556347, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d580a59-c06b-5987-a85c-cd3b9447341d", "parentControlId": 31052, "controlId": "CM-03(02)", "title": "CM-03(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582624" }, { "id": 556348, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20d8002e-9a5c-54ed-8c38-dd22db513c3a", "parentControlId": 31052, "controlId": "SI-06", "title": "SI-06", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582625" }, { "id": 556349, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6055af1-dfdb-58f0-b9fc-0c794da9cd73", "parentControlId": 31052, "controlId": "CM-03(02)", "title": "CM-03(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582625" }, { "id": 556350, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aaf26adc-ea68-5eb3-ba17-a636bf00328c", "parentControlId": 31052, "controlId": "SA-08(31)", "title": "SA-08(31)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582625" }, { "id": 556351, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5d92333-33f4-5c2f-a123-5567cef652ca", "parentControlId": 31052, "controlId": "SI-06", "title": "SI-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582625" }, { "id": 556352, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55d058ae-01ac-5c68-ae48-2bd42f8a040e", "parentControlId": 31052, "controlId": "CM-03(02)", "title": "CM-03(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582625" }, { "id": 556353, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "772f6ebc-9a70-56a5-973a-b592248de650", "parentControlId": 31052, "controlId": "CM-03(02)", "title": "CM-03(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582625" }, { "id": 556354, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4bf054d-1cb0-53ed-88aa-ec5ef5b8c282", "parentControlId": 31052, "controlId": "SI-06", "title": "SI-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582625" }, { "id": 556357, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7ca939e-dde8-5194-9c56-987592f443fa", "parentControlId": 31052, "controlId": "CM-3(2)", "title": "CM-3(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582626" }, { "id": 556360, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45493731-ecdc-54ca-ab5e-cb047f163901", "parentControlId": 31052, "controlId": "03.04.04.b", "title": "03.04.04.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582626" }, { "id": 556372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0dc66102-b8dd-5771-bd7a-9f9c47731eb7", "parentControlId": 31052, "controlId": "ASSET-4e", "title": "ASSET-4e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582627" }, { "controlId": "C.3.6", "title": "C.3.6 — Security Functionality Verification", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "d79d262b-3cef-58c7-80f1-3b9c1ec581a6", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.6", "title": "NEI 08-09 App E.3.6 — Security Functionality Verification", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "96a7ab6e-46fb-50bb-b8cc-218218b641fc", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.3.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "52a52dac-1554-5f00-9d1e-93bac99f9368", "isPublic": true }, { "controlId": "NSS-17T-Sec4.5", "title": "NSS-17T-Sec4.5 — Engineering Change Control & Safety-Security Impact Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7d16143b-a851-5b28-8bc3-e02d32fffbd1", "isPublic": true }, { "controlId": "IEC-62645-8.3", "title": "IEC-62645-8.3 — Modification and Change Management in Nuclear I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "93d2a883-ca01-5b5f-9034-047e001b206c", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.6", "title": "IEEE-7-4.3.2-5.3.6 — Safety & Security Impact Analysis of Digital Modifications", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "319cf704-2b85-5968-92d2-5070393ed87e", "isPublic": true } ], "id": 31052, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730942", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730942", "catalogueId": 1062, "uuid": "43890250-0c39-5be9-96fd-65c805e98913", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization verify the functionality of cybersecurity and/or data protection controls following implemented changes to ensure applicable controls operate as designed?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Control Functionality Verification", "description": "

Control Description

Mechanisms exist to verify the functionality of security, compliance and resilience controls following implemented changes to ensure applicable controls operate as designed.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Change Management (CHG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Change management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Change management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners ensure changes to Technology Assets, Applications and/or Services (TAAS) within the System Development Lifecycle (SDLC) are controlled through formal change control procedures.

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to verify the functionality of security, compliance and resilience controls following implemented changes to ensure applicable controls operate as designed.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.3.6", "controlId": "CHG-06", "family": "Change Management", "enhancements": "", "sortId": "CHG-06", "references": "

Micro-Small Business (<10 staff)

∙ Information Assurance Program (IAP)\n∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)

Small Business (10-49 staff)

∙ Information Assurance Program (IAP)\n∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)

Medium Business (50-249 staff)

∙ Information Assurance Program (IAP)\n∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)

Large Business (250-999 staff)

∙ Information Assurance Program (IAP)\n∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)

Enterprise (>1,000 staff)

∙ Information Assurance Program (IAP)\n∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69992, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590077", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590077", "securityControlId": 31053, "ccis": [], "uuid": "9a483312-8813-5260-9db3-35b590fbfc1d", "testId": "CHG-06.1_A01", "test": "personnel or roles designated to receive the results of cybersecurity / data privacy function verification is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-06(03)_ODP", "defaultText": null }, { "id": 69993, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590077", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590077", "securityControlId": 31053, "ccis": [], "uuid": "3dd2dc9d-ba9d-5b78-9c2a-054efc188c46", "testId": "CHG-06.1_A02", "test": "the results of security and/or function verification are reported to pertinent personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-06(03)[01]\n53A_R5_SI-06(03)[02]", "defaultText": null } ], "externalMappings": [ { "id": 556397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f92c163-660b-5bd7-b755-069c4f0cb6e4", "parentControlId": 31053, "controlId": "SI-06(03)", "title": "SI-06(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58263" }, { "id": 556398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12bc51f7-c515-5441-af79-63c0d59332b5", "parentControlId": 31053, "controlId": "SI-06(03)", "title": "SI-06(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58263" } ], "id": 31053, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730942", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730942", "catalogueId": 1062, "uuid": "094c29e2-2be5-59d9-ab87-e95da7820e46", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization report the results of cybersecurity and data protection function verification to appropriate organizational management?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Report Verification Results", "description": "

Control Description

Mechanisms exist to report the results of security, compliance and resilience capability verification to appropriate organizational management.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Change Management (CHG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Change management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Change management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners ensure changes to Technology Assets, Applications and/or Services (TAAS) within the System Development Lifecycle (SDLC) are controlled through formal change control procedures.

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to report the results of security, compliance and resilience capability verification to appropriate organizational management.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CHG-06.1", "family": "Change Management", "enhancements": "", "sortId": "CHG-06.1", "references": "

Micro-Small Business (<10 staff)

∙ Change management procedures\n∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org)

Small Business (10-49 staff)

∙ Change management procedures\n∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org)

Medium Business (50-249 staff)

∙ Change management procedures\n∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org)

Large Business (250-999 staff)

∙ Change management procedures\n∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org)

Enterprise (>1,000 staff)

∙ Change management procedures\n∙ Change Control Board (CCB)\n∙ VisibleOps (https://itpi.org)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69994, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590077", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590077", "securityControlId": 31054, "ccis": [], "uuid": "58ac296e-2374-5094-b918-06dad08df4a1", "testId": "CHG-07_A01", "test": "criteria to \"emergency\" changes are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69995, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590077", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590077", "securityControlId": 31054, "ccis": [], "uuid": "4d5fb56b-9f5c-5ecb-aaf5-764527a479cb", "testId": "CHG-07_A02", "test": "change management procedures govern \"emergency\" changes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 556405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582631", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95970023-1379-51b9-92f8-8c6aa3cb5b0e", "parentControlId": 31054, "controlId": "ASSET-4f", "title": "ASSET-4f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582631" }, { "controlId": "NSS-17T-Sec4.5", "title": "NSS-17T-Sec4.5 — Engineering Change Control & Safety-Security Impact Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "f1187059-7868-5292-9a23-7d1df909a9f5", "isPublic": true }, { "controlId": "IEC-62645-8.3", "title": "IEC-62645-8.3 — Modification and Change Management in Nuclear I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "c0c779b3-52ff-5244-9187-31f9ec5f6133", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.6", "title": "IEEE-7-4.3.2-5.3.6 — Safety & Security Impact Analysis of Digital Modifications", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "6b737962-8945-5a80-823e-7273545ef9c9", "isPublic": true } ], "id": 31054, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730943", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730943", "catalogueId": 1062, "uuid": "8fd645e2-823b-5a6c-a149-6be94f55bf73", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization govern change management procedures for \"emergency\" changes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Emergency Changes", "description": "

Control Description

Mechanisms exist to govern change management procedures for \"emergency\" changes.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Change Management (CHG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Change management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Change management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners ensure changes to Technology Assets, Applications and/or Services (TAAS) within the System Development Lifecycle (SDLC) are controlled through formal change control procedures.

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to govern change management procedures for \"emergency\" changes.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CHG-07", "family": "Change Management", "enhancements": "", "sortId": "CHG-07", "references": "", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 69997, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590078", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590078", "securityControlId": 31056, "ccis": [], "uuid": "48094997-cb9e-541e-992b-96dc33031f37", "testId": "CHG-08_A01", "test": "Business processes that require dual approval for any changes that might result in a serious, but adverse impact are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69998, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590078", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590078", "securityControlId": 31056, "ccis": [], "uuid": "818f24de-27bc-545a-ab05-0d9f88f37cbd", "testId": "CHG-08_A02", "test": "Technology Assets, Applications, Services and/or Data (TAASD) that require dual approval for any changes that might result in a serious, but adverse impact are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 69999, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590078", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590078", "securityControlId": 31056, "ccis": [], "uuid": "e920d384-ae63-5446-b3ca-6ba95410b901", "testId": "CHG-08_A03", "test": "Processes and/or technologies are implemented for instances that require dual approval for any changes that might result in a serious incident that could adversely impact operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 556408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582632", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4062bcca-f5fe-50a1-abc1-b60e923e33a3", "parentControlId": 31056, "controlId": "CR 2.1(4)", "title": "CR 2.1(4)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582632" }, { "controlId": "NSS-17T-Sec4.5", "title": "NSS-17T-Sec4.5 — Engineering Change Control & Safety-Security Impact Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "088e323e-e241-5ade-b5f2-3ee23c95d595", "isPublic": true }, { "controlId": "IEC-62645-8.3", "title": "IEC-62645-8.3 — Modification and Change Management in Nuclear I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "84af2131-547c-50d1-b7f2-335f7a420cb5", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.6", "title": "IEEE-7-4.3.2-5.3.6 — Safety & Security Impact Analysis of Digital Modifications", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CHG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "f774ce3c-cbdd-5cd0-8c9d-542a6bf7a7dc", "isPublic": true } ], "id": 31056, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730943", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730943", "catalogueId": 1062, "uuid": "98d8b589-38d2-5602-806c-af5b4513dbdc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require dual approval for any changes that might result in a serious, but adverse impact to:\n(1) Business processes; and/or\n(2) Technology Assets, Applications, Services and/or Data (TAASD)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Dual Approval For High-Impact Environments", "description": "

Control Description

Mechanisms exist to require dual approval for any changes that might result in a serious incident that could adversely impact:\n(1) Business processes; and/or\n(2) Technology Assets, Applications, Services and/or Data (TAASD).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Change Management (CHG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Change management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Change management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business stakeholders and process owners ensure changes to Technology Assets, Applications and/or Services (TAAS) within the System Development Lifecycle (SDLC) are controlled through formal change control procedures.

Level 3 - Well Defined: Change Management (CHG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CHG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CHG domain capabilities are well-documented and kept current by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain CHG domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities (e.g., Change Advisory Board (CAB)) to ensure successful, efficient and secure change management operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CHG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require dual approval for any changes that might result in a serious incident that could adversely impact:\n(1) Business processes; and/or\n(2) Technology Assets, Applications, Services and/or Data (TAASD).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CHG-08", "family": "Embedded Technology", "enhancements": "", "sortId": "CHG-08", "references": "

Micro-Small Business (<10 staff)

∙ Inventory embedded devices and document security settings

Small Business (10-49 staff)

∙ Embedded device inventory\n∙ Default credential change policy

Medium Business (50-249 staff)

∙ Embedded/IoT device security program\n∙ Network segmentation for IoT

Large Business (250-999 staff)

∙ IoT/OT security program\n∙ Network segmentation\n∙ IoT security platform (e.g., Claroty, Armis)

Enterprise (>1,000 staff)

∙ Enterprise IoT/OT security platform (e.g., Claroty, Armis, Dragos)\n∙ Zero-trust IoT architecture", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70000, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590078", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590078", "securityControlId": 31057, "ccis": [], "uuid": "ecaf3027-f220-5411-9fbf-500ebd96b122", "testId": "CLD-01_A01", "test": "the organization facilitates the implementation of cloud management controls to ensure cloud instances are securely configured and maintained.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70001, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590079", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590079", "securityControlId": 31057, "ccis": [], "uuid": "c6899db7-d154-5a8d-977a-795377d105dc", "testId": "CLD-01_A02", "test": "secure baseline configurations exist for cloud-based systems, applications and services to protect the confidentiality, integrity and availability of data being stored, processed and/or transmitted.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null }, { "id": 70002, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590079", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590079", "securityControlId": 31057, "ccis": [], "uuid": "1e75011e-ac2b-512c-b016-13a19ef46c62", "testId": "CLD-01_A03", "test": "cloud management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70003, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590079", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590079", "securityControlId": 31057, "ccis": [], "uuid": "0e2d3d81-8df5-5aaa-bc2f-b3319b64066f", "testId": "CLD-01_A04", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support cloud management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70004, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590079", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590079", "securityControlId": 31057, "ccis": [], "uuid": "39758f2f-102f-5280-bd4c-70f45248bc49", "testId": "CLD-01_A05", "test": "responsibility and authority for the performance of cloud management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70005, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590079", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590079", "securityControlId": 31057, "ccis": [], "uuid": "d42fc1d7-80ff-599d-af4d-2b94a1b3dd13", "testId": "CLD-01_A06", "test": "personnel performing cloud management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 556414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582633", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ec613f0-6a48-5926-92b4-8ebdabfef42c", "parentControlId": 31057, "controlId": "5.23", "title": "5.23", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582633" }, { "id": 556419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582633", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e86e356a-8924-5520-a4ee-f100060464d3", "parentControlId": 31057, "controlId": "3.1.22", "title": "3.1.22", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582633" }, { "id": 556420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68fd2d76-dc9b-5218-abe7-04b757f36eb1", "parentControlId": 31057, "controlId": "NFO–PL-8", "title": "NFO–PL-8", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582634" } ], "id": 31057, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730944", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730944", "catalogueId": 1062, "uuid": "4b409747-ba6e-5d3a-8714-174f04c2980c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of cloud management controls to ensure cloud instances are secure and in-line with industry practices?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Cloud Services", "description": "

Control Description

Mechanisms exist to facilitate the implementation of cloud management controls to ensure cloud instances are secure and in-line with industry practices.

Evidence Request List (ERL)

E-AST-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cloud Security (CLD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CLD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Cloud management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Cloud-based technologies are governed no differently from on-premise network assets (e.g., cloud-based technology is viewed as an extension of the corporate network).

Level 2 - Planned & Tracked: Cloud Security (CLD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CLD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CLD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CLD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cloud management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cloud management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Cloud-based Technology Assets, Applications and/or Services (TAAS) are governed according to the same processes used for on-premises TAAS, where no formal, dedicated cloud governance process exists.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to ensure the architecture for cloud-based technologies supports applicable cybersecurity and data protection requirements.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to identify cybersecurity and data protection requirements for CSP environments, including dedicated and multi-client environments.

Level 3 - Well Defined: Cloud Security (CLD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CLD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CLD domain capabilities are well-documented and kept current by process owners.\n▪ A cloud governance team, or similar function, is appropriately staffed and supported to implement and maintain CLD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cloud governance operations (e.g., multi-cloud governance tools, policy enforcement, cost management, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CLD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of cloud management controls to ensure cloud instances are secure and in-line with industry practices.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CLD-01", "family": "Cloud Security", "enhancements": "", "sortId": "CLD-01", "references": "

Micro-Small Business (<10 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70008, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59008", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59008", "securityControlId": 31060, "ccis": [], "uuid": "d9c64b82-e7a2-532a-87cb-cec1eef74f57", "testId": "CLD-02_A01", "test": "a cloud security architecture is defined to address cloud employments that support the organization's mission.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70009, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59008", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59008", "securityControlId": 31060, "ccis": [], "uuid": "b9f2311f-0d1c-518e-a1a0-e3a373eda2e8", "testId": "CLD-02_A02", "test": "the cloud security architecture supports the organization's technology strategy to securely design, configure and maintain cloud employments.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 556521, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582645", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dad3b62c-d53d-511a-b72a-ae2de68fb101", "parentControlId": 31060, "controlId": "5.23", "title": "5.23", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582645" }, { "id": 556529, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582646", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a33f6c27-1020-5eca-96e0-a5a51420cd01", "parentControlId": 31060, "controlId": "3.1.22", "title": "3.1.22", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582646" }, { "id": 556530, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582646", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "deb3b3c8-2c9c-59ae-9397-d47d473bf74d", "parentControlId": 31060, "controlId": "NFO–PL-8", "title": "NFO–PL-8", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582646" } ], "id": 31060, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730945", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730945", "catalogueId": 1062, "uuid": "8aa59789-b5b3-53f5-973f-dcd411241ded", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure the cloud security architecture supports its technology strategy to securely design, configure and maintain cloud employments?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Cloud Security Architecture", "description": "

Control Description

Mechanisms exist to ensure the cloud security architecture supports the organization's technology strategy to securely design, configure and maintain cloud employments.

Evidence Request List (ERL)

E-TDA-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cloud Security (CLD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CLD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Cloud management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Cloud-based technologies are governed no differently from on-premise network assets (e.g., cloud-based technology is viewed as an extension of the corporate network).

Level 2 - Planned & Tracked: Cloud Security (CLD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CLD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CLD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CLD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cloud management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cloud management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Cloud-based Technology Assets, Applications and/or Services (TAAS) are governed according to the same processes used for on-premises TAAS, where no formal, dedicated cloud governance process exists.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to ensure the architecture for cloud-based technologies supports applicable cybersecurity and data protection requirements.

Level 3 - Well Defined: Cloud Security (CLD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CLD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CLD domain capabilities are well-documented and kept current by process owners.\n▪ A cloud governance team, or similar function, is appropriately staffed and supported to implement and maintain CLD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cloud governance operations (e.g., multi-cloud governance tools, policy enforcement, cost management, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CLD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure the cloud security architecture supports the organization's technology strategy to securely design, configure and maintain cloud employments.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CLD-02", "family": "Cloud Security", "enhancements": "", "sortId": "CLD-02", "references": "

Micro-Small Business (<10 staff)

∙ System Security & Privacy Plan (SSPP)

Small Business (10-49 staff)

∙ System Security & Privacy Plan (SSPP)

Medium Business (50-249 staff)

∙ Architectural review board\n∙ System Security & Privacy Plan (SSPP)\n∙ Security architecture roadmaps

Large Business (250-999 staff)

∙ Steering committee\n∙ Architectural review board\n∙ System Security & Privacy Plan (SSPP)\n∙ Security architecture roadmaps

Enterprise (>1,000 staff)

∙ Steering committee\n∙ Architectural review board\n∙ System Security & Privacy Plan (SSPP)\n∙ Security architecture roadmaps", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70010, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590081", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590081", "securityControlId": 31061, "ccis": [], "uuid": "7ef1270f-7d62-56b6-b009-187b4d600101", "testId": "CLD-03_A01", "test": "cloud security management subnets are logically isolated.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(29)_ODP[01]", "defaultText": null }, { "id": 70011, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590081", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590081", "securityControlId": 31061, "ccis": [], "uuid": "2a8ccbd1-81eb-5a0e-a45d-2072ebbdd76e", "testId": "CLD-03_A02", "test": "cloud security management subnet system components and functions to be isolated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(29)_ODP[02]", "defaultText": null }, { "id": 70012, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590081", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590081", "securityControlId": 31061, "ccis": [], "uuid": "65947d45-10c7-5e36-9e6f-2b5c5a63eac0", "testId": "CLD-03_A03", "test": "organization-defined criteria are used to isolate cloud security management subnets.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(29)", "defaultText": null } ], "externalMappings": [ { "id": 556561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fa19e34-0e99-5bb0-9825-0507bf8e3823", "parentControlId": 31061, "controlId": "SC-07(29)", "title": "SC-07(29)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58265" }, { "id": 556563, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed3603b8-96d4-58ce-b60e-dc1e9057f376", "parentControlId": 31061, "controlId": "SC-07(29)", "title": "SC-07(29)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58265" }, { "id": 556564, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38cecfe6-5f00-5c3a-80f1-03a9ef405fa1", "parentControlId": 31061, "controlId": "SC-07(29)", "title": "SC-07(29)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58265" }, { "id": 556565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58731c47-4737-55d8-8cfb-8bd1bd660526", "parentControlId": 31061, "controlId": "SC-07(29)", "title": "SC-07(29)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58265" }, { "id": 556566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582651", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1a62032-66f5-5f70-9d67-3007bb6f3e7d", "parentControlId": 31061, "controlId": "SC-07(29)", "title": "SC-07(29)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582651" }, { "id": 556568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582651", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a0ac7c4-c667-556c-b145-8499e4ace41f", "parentControlId": 31061, "controlId": "3.13.2", "title": "3.13.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582651" }, { "id": 556569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582651", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8926e23b-7971-572e-9261-4360d7370600", "parentControlId": 31061, "controlId": "NFO–PL-8", "title": "NFO–PL-8", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582651" } ], "id": 31061, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730945", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730945", "catalogueId": 1062, "uuid": "9f4a062c-30a8-5ee3-acae-d1ccd4c5b20a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization host security-specific technologies in a dedicated subnet?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Cloud Infrastructure Security Subnet", "description": "

Control Description

Mechanisms exist to host security-specific technologies in a dedicated subnet.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cloud Security (CLD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CLD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CLD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CLD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cloud management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cloud management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Cloud-based Technology Assets, Applications and/or Services (TAAS) are governed according to the same processes used for on-premises TAAS, where no formal, dedicated cloud governance process exists.\n▪ The cloud infrastructure incorporates a managed security zone to house cybersecurity and data protection tools.

Level 3 - Well Defined: Cloud Security (CLD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CLD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CLD domain capabilities are well-documented and kept current by process owners.\n▪ A cloud governance team, or similar function, is appropriately staffed and supported to implement and maintain CLD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cloud governance operations (e.g., multi-cloud governance tools, policy enforcement, cost management, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CLD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to host security-specific technologies in a dedicated subnet.

Level 4 - Quantitatively Controlled: Compliance (CPL) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CLD-03", "family": "Cloud Security", "enhancements": "", "sortId": "CLD-03", "references": "

Micro-Small Business (<10 staff)

∙ Enable default security settings on cloud accounts (MFA, basic firewall rules)

Small Business (10-49 staff)

∙ Cloud security policy\n∙ Enable cloud provider security baseline controls

Medium Business (50-249 staff)

∙ Cloud security program\n∙ CSPM tool (e.g., Microsoft Defender for Cloud)

Large Business (250-999 staff)

∙ Enterprise CSPM/CWPP (e.g., Wiz, Prisma Cloud)\n∙ Cloud security architecture review

Enterprise (>1,000 staff)

∙ Enterprise CNAPP (e.g., Wiz, Prisma Cloud, CrowdStrike Falcon)\n∙ DevSecOps cloud integration", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70013, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590081", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590081", "securityControlId": 31062, "ccis": [], "uuid": "278faaba-de75-5f46-8104-363fcbe30e1e", "testId": "CLD-04_A01", "test": "information/data exchange supports secure data portability.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70014, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590082", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590082", "securityControlId": 31062, "ccis": [], "uuid": "9dcde27e-f79b-55bb-8e98-039433eb571d", "testId": "CLD-04_A02", "test": "information processing interoperability is supported.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 556590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eeb67eae-15fc-502e-a71d-f3c195ab47d0", "parentControlId": 31062, "controlId": "5.23", "title": "5.23", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582653" }, { "id": 556591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582662", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8efc4d90-d8cd-568c-8ada-2e602a2ef643", "parentControlId": 31062, "controlId": "8.26", "title": "8.26", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582662" } ], "id": 31062, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730945", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730945", "catalogueId": 1062, "uuid": "10a47d02-7732-5f75-ad56-7bfa669b4af3", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure support for secure interoperability between components with Application Programming Interfaces (APIs)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Application Programming Interface (API) Security", "description": "

Control Description

Mechanisms exist to ensure support for secure interoperability between components with Application Programming Interfaces (APIs).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cloud Security (CLD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CLD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CLD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CLD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cloud management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cloud management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Cloud-based Technology Assets, Applications and/or Services (TAAS) are governed according to the same processes used for on-premises TAAS, where no formal, dedicated cloud governance process exists.

Level 3 - Well Defined: Cloud Security (CLD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CLD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CLD domain capabilities are well-documented and kept current by process owners.\n▪ A cloud governance team, or similar function, is appropriately staffed and supported to implement and maintain CLD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cloud governance operations (e.g., multi-cloud governance tools, policy enforcement, cost management, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CLD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure support for secure interoperability between components with Application Programming Interfaces (APIs).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CLD-04", "family": "Cloud Security", "enhancements": "", "sortId": "CLD-04", "references": "

Micro-Small Business (<10 staff)

∙ Enable default security settings on cloud accounts (MFA, basic firewall rules)

Small Business (10-49 staff)

∙ Cloud security policy\n∙ Enable cloud provider security baseline controls

Medium Business (50-249 staff)

∙ Cloud security program\n∙ CSPM tool (e.g., Microsoft Defender for Cloud)

Large Business (250-999 staff)

∙ Enterprise CSPM/CWPP (e.g., Wiz, Prisma Cloud)\n∙ Cloud security architecture review

Enterprise (>1,000 staff)

∙ Enterprise CNAPP (e.g., Wiz, Prisma Cloud, CrowdStrike Falcon)\n∙ DevSecOps cloud integration", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70018, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590083", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590083", "securityControlId": 31065, "ccis": [], "uuid": "42f09a60-6703-5f30-8522-0a2c52c3b4ea", "testId": "CLD-06_A01", "test": "multi-tenant owned / managed assets (physical and virtual) are designed and governed such that provider and customer (tenant) user access is appropriately segmented from other tenant users.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 556606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582664", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7089e1f4-0717-5db4-a56e-749c14b099a1", "parentControlId": 31065, "controlId": "5.23", "title": "5.23", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582664" }, { "id": 556608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582664", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b1af8cc-0f1f-5125-9acb-44963fe8b2fa", "parentControlId": 31065, "controlId": "3.1.22", "title": "3.1.22", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582664" } ], "id": 31065, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730946", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730946", "catalogueId": 1062, "uuid": "7e58039f-18cc-5966-993d-1264aa6e098b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure multi-tenant owned or managed assets (physical and virtual) are designed and governed such that provider and customer (tenant) user access is appropriately segmented from other tenant users?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Multi-Tenant Environments", "description": "

Control Description

Mechanisms exist to ensure multi-tenant owned or managed assets (physical and virtual) are designed and governed such that provider and customer (tenant) user access is appropriately segmented from other tenant users.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cloud Security (CLD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CLD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CLD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CLD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cloud management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cloud management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Cloud-based Technology Assets, Applications and/or Services (TAAS) are governed according to the same processes used for on-premises TAAS, where no formal, dedicated cloud governance process exists.

Level 3 - Well Defined: Cloud Security (CLD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CLD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CLD domain capabilities are well-documented and kept current by process owners.\n▪ A cloud governance team, or similar function, is appropriately staffed and supported to implement and maintain CLD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cloud governance operations (e.g., multi-cloud governance tools, policy enforcement, cost management, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CLD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure multi-tenant owned or managed assets (physical and virtual) are designed and governed such that provider and customer (tenant) user access is appropriately segmented from other tenant users.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CLD-06", "family": "Cloud Security", "enhancements": "", "sortId": "CLD-06", "references": "

Micro-Small Business (<10 staff)

∙ System Security & Privacy Plan (SSPP)

Small Business (10-49 staff)

∙ System Security & Privacy Plan (SSPP)

Medium Business (50-249 staff)

∙ Architectural review board\n∙ System Security & Privacy Plan (SSPP)\n∙ Security architecture roadmaps

Large Business (250-999 staff)

∙ Steering committee\n∙ Architectural review board\n∙ System Security & Privacy Plan (SSPP)\n∙ Security architecture roadmaps

Enterprise (>1,000 staff)

∙ Steering committee\n∙ Architectural review board\n∙ System Security & Privacy Plan (SSPP)\n∙ Security architecture roadmaps", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70019, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590083", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590083", "securityControlId": 31066, "ccis": [], "uuid": "59caed04-249f-5942-91a4-30dbca39b6f0", "testId": "CLD-06.1_A01", "test": "a documented Customer Responsibility Matrix (CRM) delineates assigned responsibilities for controls between the Cloud Service Provider (CSP) and its customers.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 556644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582669", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0cba51b8-c3f6-51ae-85e6-a0c113d58e9c", "parentControlId": 31066, "controlId": "4.3(c)", "title": "4.3(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582669" }, { "id": 556645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582669", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4eb1afed-67d9-5958-a00c-b3d2d5d6e31e", "parentControlId": 31066, "controlId": "5.23", "title": "5.23", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582669" } ], "id": 31066, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730947", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730947", "catalogueId": 1062, "uuid": "779b9aba-b103-5050-bedc-f620eace1c3a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization formally document a Customer Responsibility Matrix (CRM), delineating assigned responsibilities for security, compliance and resilience controls between the Cloud Service Provider (CSP) and its customers?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Customer Responsibility Matrix (CRM)", "description": "

Control Description

Mechanisms exist to formally document a Customer Responsibility Matrix (CRM), delineating assigned responsibilities for security, compliance and resilience controls between the Cloud Service Provider (CSP) and its customers.

Evidence Request List (ERL)

E-CPL-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cloud Security (CLD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CLD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Cloud management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ A Shared Responsibility Matrix (SRM), or similar Customer Responsibility Matrix (CRM), is documented for each Cloud Service Provider (CSP) instance.

Level 2 - Planned & Tracked: Cloud Security (CLD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CLD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CLD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CLD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cloud management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cloud management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Cloud-based Technology Assets, Applications and/or Services (TAAS) are governed according to the same processes used for on-premises TAAS, where no formal, dedicated cloud governance process exists.\n▪ A Shared Responsibility Matrix (SRM), or similar Customer Responsibility Matrix (CRM), is documented for each Cloud Service Providers (CSPs) instance that takes into account differences between Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS) methodologies.

Level 3 - Well Defined: Cloud Security (CLD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CLD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CLD domain capabilities are well-documented and kept current by process owners.\n▪ A cloud governance team, or similar function, is appropriately staffed and supported to implement and maintain CLD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cloud governance operations (e.g., multi-cloud governance tools, policy enforcement, cost management, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CLD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to formally document a Customer Responsibility Matrix (CRM), delineating assigned responsibilities for security, compliance and resilience controls between the Cloud Service Provider (CSP) and its customers.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CLD-06.1", "family": "Cloud Security", "enhancements": "", "sortId": "CLD-06.1", "references": "

Micro-Small Business (<10 staff)

∙ Customer Responsibility Matrix (CRM)\n∙ Shared Responsibility Matrix (SRM)\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix

Small Business (10-49 staff)

∙ Customer Responsibility Matrix (CRM)\n∙ Shared Responsibility Matrix (SRM)\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix

Medium Business (50-249 staff)

∙ Customer Responsibility Matrix (CRM)\n∙ Shared Responsibility Matrix (SRM)\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix

Large Business (250-999 staff)

∙ Customer Responsibility Matrix (CRM)\n∙ Shared Responsibility Matrix (SRM)\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix

Enterprise (>1,000 staff)

∙ Customer Responsibility Matrix (CRM)\n∙ Shared Responsibility Matrix (SRM)\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70026, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590084", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590084", "securityControlId": 31072, "ccis": [], "uuid": "abc564c7-02ff-5daa-a40a-e7b68a8c79b9", "testId": "CLD-09_A01", "test": "locations where information processing and data storage is/are to be restricted are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(05)_ODP[01]\n53A_R5_SA-09(05)_ODP[02]", "defaultText": null }, { "id": 70027, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590085", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590085", "securityControlId": 31072, "ccis": [], "uuid": "cc1ef577-fb5f-5552-a6e6-d0a36728be49", "testId": "CLD-09_A02", "test": "requirements or conditions for restricting the location of information processing, information storage or information services are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(05)_ODP[03]", "defaultText": null }, { "id": 70028, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590085", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590085", "securityControlId": 31072, "ccis": [], "uuid": "1a39560d-64f1-5049-b172-f2ccb6e8c139", "testId": "CLD-09_A03", "test": "based on requirements, information processing, information storage or information services is/are restricted to locations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(05)", "defaultText": null }, { "id": 70029, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590085", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590085", "securityControlId": 31072, "ccis": [], "uuid": "2d936832-04ff-527d-aaf4-8884b61ab2ed", "testId": "CLD-09_A04", "test": "the geographic location of information processing and data storage is restricted to facilities located within the legal jurisdictional boundary of the United States.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_SA-09(08)", "defaultText": null } ], "externalMappings": [ { "id": 556676, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a91d4182-8e7c-55fa-8b6e-2f5e6a99cb6a", "parentControlId": 31072, "controlId": "5.23", "title": "5.23", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582673" }, { "id": 556678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c97b7f52-ff66-5e6d-a402-ee5e7caf2365", "parentControlId": 31072, "controlId": "SA-9(5)", "title": "SA-9(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582673" }, { "id": 556679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0947c83c-d597-5d46-9b05-43c78afa9bfe", "parentControlId": 31072, "controlId": "SA-09(05)", "title": "SA-09(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582673" }, { "id": 556680, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d669a49-3f4a-5f5b-8fd3-a5e14f3a47c9", "parentControlId": 31072, "controlId": "SA-09(08)", "title": "SA-09(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582673" }, { "id": 556683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "baeb4281-dd05-5fb9-854c-5cf55ffbd20a", "parentControlId": 31072, "controlId": "SA-09(05)", "title": "SA-09(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582673" }, { "id": 556684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb0074bc-5f64-545d-9535-0ab781fa6597", "parentControlId": 31072, "controlId": "SA-09(08)", "title": "SA-09(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582673" }, { "id": 556685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582674", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "241042f3-dd59-5f23-9d5d-781adbe0265b", "parentControlId": 31072, "controlId": "SA-9(5)", "title": "SA-9(5)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582674" }, { "id": 556699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582675", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39e0ddda-cf77-5072-bb33-0ea0db95064b", "parentControlId": 31072, "controlId": "9-3.c", "title": "9-3.c", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582675" } ], "id": 31072, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730949", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730949", "catalogueId": 1062, "uuid": "28beeb22-528a-597e-ac1c-80f418a7ed67", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization control the location of cloud processing/storage based on business requirements that includes statutory, regulatory and contractual obligations?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 10.0, "title": "Geolocation Requirements for Processing, Storage and Service Locations", "description": "

Control Description

Mechanisms exist to control the location of cloud processing/storage based on business requirements that includes statutory, regulatory and contractual obligations.

Evidence Request List (ERL)

E-AST-06\nE-AST-23\nE-DCH-15

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cloud Security (CLD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CLD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Cloud management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Geolocation requirements for sensitive/regulated data types identify restrictions on transfer of data to third-countries or international organizations.

Level 2 - Planned & Tracked: Cloud Security (CLD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CLD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CLD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CLD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cloud management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cloud management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Cloud-based Technology Assets, Applications and/or Services (TAAS) are governed according to the same processes used for on-premises TAAS, where no formal, dedicated cloud governance process exists.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to govern geolocation requirements for sensitive/regulated data types, including the transfer of data to third-countries or international organizations.

Level 3 - Well Defined: Cloud Security (CLD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CLD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CLD domain capabilities are well-documented and kept current by process owners.\n▪ A cloud governance team, or similar function, is appropriately staffed and supported to implement and maintain CLD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cloud governance operations (e.g., multi-cloud governance tools, policy enforcement, cost management, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CLD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to control the location of cloud processing/storage based on business requirements that includes statutory, regulatory and contractual obligations.

Level 4 - Quantitatively Controlled: Compliance (CPL) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Cloud Security (CLD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CLD-09", "family": "Cloud Security", "enhancements": "", "sortId": "CLD-09", "references": "

Micro-Small Business (<10 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Small Business (10-49 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Medium Business (50-249 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Large Business (250-999 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Enterprise (>1,000 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70030, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590085", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590085", "securityControlId": 31073, "ccis": [], "uuid": "a8a39bfa-e60b-50b2-ac35-880b967ef16b", "testId": "CLD-10_A01", "test": "sensitive / regulated data in public cloud providers is identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70031, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590086", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590086", "securityControlId": 31073, "ccis": [], "uuid": "411a4e62-d4ff-5840-b69e-3a1fc10c15e8", "testId": "CLD-10_A02", "test": "the storage of sensitive / regulated data in public cloud providers is controlled.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 556729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9904636c-dfd6-5354-b8ab-391a9f2ee2fd", "parentControlId": 31073, "controlId": "3.1.22", "title": "3.1.22", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582679" } ], "id": 31073, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730949", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730949", "catalogueId": 1062, "uuid": "e6d1c81b-78af-5823-8a20-434f8131f8b0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization limit and manage the storage of sensitive/regulated data in public cloud providers?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Sensitive Data In Public Cloud Providers", "description": "

Control Description

Mechanisms exist to limit and manage the storage of sensitive/regulated data in public cloud providers.

Evidence Request List (ERL)

E-AST-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cloud Security (CLD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CLD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Cloud management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Cloud Security (CLD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CLD domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CLD domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CLD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cloud management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cloud management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Cloud-based Technology Assets, Applications and/or Services (TAAS) are governed according to the same processes used for on-premises TAAS, where no formal, dedicated cloud governance process exists.

Level 3 - Well Defined: Cloud Security (CLD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CLD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CLD domain capabilities are well-documented and kept current by process owners.\n▪ A cloud governance team, or similar function, is appropriately staffed and supported to implement and maintain CLD domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cloud governance operations (e.g., multi-cloud governance tools, policy enforcement, cost management, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CLD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to limit and manage the storage of sensitive/regulated data in public cloud providers.

Level 4 - Quantitatively Controlled: Compliance (CPL) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CLD-10", "family": "Cloud Security", "enhancements": "", "sortId": "CLD-10", "references": "

Micro-Small Business (<10 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Security and network architecture diagrams\n∙ Data Flow Diagram (DFD)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Small Business (10-49 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Security and network architecture diagrams\n∙ Data Flow Diagram (DFD)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Medium Business (50-249 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Security and network architecture diagrams\n∙ Data Flow Diagram (DFD)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Large Business (250-999 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Security and network architecture diagrams\n∙ Data Flow Diagram (DFD)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Enterprise (>1,000 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Security and network architecture diagrams\n∙ Data Flow Diagram (DFD)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70039, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590099", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590099", "securityControlId": 31081, "ccis": [], "uuid": "738ac2df-2b58-51b5-90a4-48d6b8d8730b", "testId": "CPL-01_A01", "test": "the organization analyzes its business practices to determine applicable statutory, regulatory and/or contractual obligations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70040, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5901", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5901", "securityControlId": 31081, "ccis": [], "uuid": "69c41443-8733-5450-9142-b4c713395617", "testId": "CPL-01_A02", "test": "compliance management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70041, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5901", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5901", "securityControlId": 31081, "ccis": [], "uuid": "8eb2cf5f-1d17-5129-8728-e5a320c5aab8", "testId": "CPL-01_A03", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support compliance management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70042, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5901", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5901", "securityControlId": 31081, "ccis": [], "uuid": "6d37d346-a7f6-532b-ba52-56c106d74e24", "testId": "CPL-01_A04", "test": "responsibility and authority for the performance of compliance management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70043, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590101", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590101", "securityControlId": 31081, "ccis": [], "uuid": "cf1e3df5-f88b-5f20-9896-fcfff91c103a", "testId": "CPL-01_A05", "test": "personnel performing compliance management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 556803, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca334c5e-5e06-54a0-87a9-a329dd88aba1", "parentControlId": 31081, "controlId": "4.1", "title": "4.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582688" }, { "id": 556804, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03ebc65d-402d-5d31-9676-e6c7966080af", "parentControlId": 31081, "controlId": "9.1", "title": "9.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582688" }, { "id": 556805, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be784771-7192-5244-9e6b-5247ff268299", "parentControlId": 31081, "controlId": "9.2.1", "title": "9.2.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582688" }, { "id": 556806, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d28df4f-9f57-56e1-ab13-fd093c6d2dc5", "parentControlId": 31081, "controlId": "9.2.2", "title": "9.2.2", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582688" }, { "id": 556807, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2074d13b-74af-591b-aee7-0760e9e3e614", "parentControlId": 31081, "controlId": "5.31", "title": "5.31", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582688" }, { "id": 556808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f56d16ed-f5e8-5c64-9994-eb499474d4e1", "parentControlId": 31081, "controlId": "8.34", "title": "8.34", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582688" }, { "id": 556826, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f71a69d3-003b-53c9-91a1-f973e81b6bf1", "parentControlId": 31081, "controlId": "PL-1", "title": "PL-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58269" }, { "id": 556827, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da8114b9-4623-5dc6-a53a-1c9104553311", "parentControlId": 31081, "controlId": "PM-8", "title": "PM-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582691" }, { "id": 556828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71f9b949-eecd-5949-91f5-d1ce9c9584f0", "parentControlId": 31081, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582691" }, { "id": 556829, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c9852d6-5bcd-5d23-97b2-4d025f7697fc", "parentControlId": 31081, "controlId": "PM-08", "title": "PM-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582691" }, { "id": 556832, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e31ba4e-ec8a-55c0-aee1-7386df7aa96b", "parentControlId": 31081, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582691" }, { "id": 556834, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c89c160c-2aca-5a81-b4ec-ad5d9c4423c8", "parentControlId": 31081, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582691" }, { "id": 556835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73cf0e68-14cc-5e52-9b83-78d480001293", "parentControlId": 31081, "controlId": "PM-08", "title": "PM-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582691" }, { "id": 556836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83dc2d1e-2ea3-55b2-acce-2509e411a949", "parentControlId": 31081, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582692" }, { "id": 556837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc0481ef-30b8-5b5a-b1a7-352b4491448e", "parentControlId": 31081, "controlId": "PM-08", "title": "PM-08", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582692" }, { "id": 556838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9263a74d-45c9-56f7-af2c-3bca099a41d7", "parentControlId": 31081, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582692" }, { "id": 556839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ad78daa-55e7-57b1-a5c9-05ed7dba219b", "parentControlId": 31081, "controlId": "PM-08", "title": "PM-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582692" }, { "id": 556840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3dc080b-b045-57f0-80c2-91f031638682", "parentControlId": 31081, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582692" }, { "id": 556841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d373389c-afa8-55d1-a9e6-9f0b7f97c87b", "parentControlId": 31081, "controlId": "PM-08", "title": "PM-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582692" }, { "id": 556842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7c76496-0006-5de6-812a-d1a018c1df3c", "parentControlId": 31081, "controlId": "PL-1", "title": "PL-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582692" }, { "id": 556843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6eff1195-f3ee-5c0d-89b1-dc775fc730b2", "parentControlId": 31081, "controlId": "PM-8", "title": "PM-8", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582692" }, { "id": 556844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582693", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "617e9b54-f5ba-52f6-a08a-b4631ac47f89", "parentControlId": 31081, "controlId": "PL-1", "title": "PL-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582693" }, { "id": 556847, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582693", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2582ae66-d566-599e-93e7-e99b1712eb0a", "parentControlId": 31081, "controlId": "NFO - PL-1", "title": "NFO - PL-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582693" }, { "id": 556848, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582693", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da5f7d1d-f3ce-5199-9edd-fa5dae7b5b8c", "parentControlId": 31081, "controlId": "03.04.11.a", "title": "03.04.11.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582693" }, { "id": 556849, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582693", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3f39c48-b3d4-5cc5-accc-b0add8c95e2b", "parentControlId": 31081, "controlId": "03.12.01", "title": "03.12.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582693" }, { "id": 556852, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582693", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5839bcb-cc76-52ba-b30d-ad6877536bdb", "parentControlId": 31081, "controlId": "GV.OC", "title": "GV.OC", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582693" }, { "id": 556853, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582693", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f78d7e5-89ce-59e2-8113-3a4d86a79f16", "parentControlId": 31081, "controlId": "GV.OC-03", "title": "GV.OC-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582693" }, { "id": 556854, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582694", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58d0860a-ee83-5a16-bb4d-98ff4625e242", "parentControlId": 31081, "controlId": "GV.SC-05", "title": "GV.SC-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582694" }, { "id": 556855, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582694", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5d84258-1b3b-5ca1-942d-2595e6b21c03", "parentControlId": 31081, "controlId": "PR", "title": "PR", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582694" }, { "id": 556889, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84f98677-5ba8-5d38-8a7a-7e268b068ff9", "parentControlId": 31081, "controlId": "PROGRAM-1g", "title": "PROGRAM-1g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582698" }, { "id": 556939, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582712", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11921aa0-6466-59ec-99c2-9fb3c1954dca", "parentControlId": 31081, "controlId": "CIP-003-8 1.1.9", "title": "CIP-003-8 1.1.9", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582712" }, { "id": 556940, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582712", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "161cd053-02c1-55a2-a67f-e8fa300334b4", "parentControlId": 31081, "controlId": "CIP-003-8 1.2.6", "title": "CIP-003-8 1.2.6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582712" }, { "id": 556941, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582712", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a674db12-dc5a-5d77-8cd8-869aa985f435", "parentControlId": 31081, "controlId": "§117.18(f)", "title": "§117.18(f)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582712" }, { "id": 556942, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582712", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "088c3ce6-b2c6-5f86-88a7-8d151ca4459b", "parentControlId": 31081, "controlId": "9-2.d", "title": "9-2.d", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582712" }, { "id": 556943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582712", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37df546d-1444-5c46-8772-57ea094e734d", "parentControlId": 31081, "controlId": "9-5", "title": "9-5", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582712" }, { "id": 556944, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582712", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5fe0649-aff8-5bbf-8309-bce234a457b3", "parentControlId": 31081, "controlId": "11-2", "title": "11-2", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582712" }, { "id": 556945, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582712", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0035fceb-adf3-5b44-9d3e-ff601824681d", "parentControlId": 31081, "controlId": "11-3.b(2)", "title": "11-3.b(2)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582712" }, { "id": 556946, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582713", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7187514f-15ff-5ed6-9c34-fd6e7e26e038", "parentControlId": 31081, "controlId": "11-6", "title": "11-6", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582713" }, { "id": 556947, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582713", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de28f3dc-8522-52d2-889e-a6cb4cc90ac0", "parentControlId": 31081, "controlId": "13-3", "title": "13-3", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582713" }, { "id": 556948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582713", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f5f6978-e791-5834-b30d-36ed56917356", "parentControlId": 31081, "controlId": "13-3.a", "title": "13-3.a", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582713" }, { "id": 556949, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582713", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b300ab95-e7f0-5342-8df4-85cfb220f63b", "parentControlId": 31081, "controlId": "13-4", "title": "13-4", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582713" }, { "controlId": "A.3.1.1", "title": "A.3.1.1 — Security Assessment and Authorization", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-1, PL-1, PM-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a29ba078-3f51-55e9-a7b6-b219a49c1992", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.1", "title": "NEI 08-09 Sec 3.1.1 — Security Assessment and Authorization", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "200dc2f7-13e6-5f07-aed3-69367ef64b47", "isPublic": true }, { "controlId": "10 CFR 73.54(b)(2)", "title": "10 CFR 73.54(b)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "1cb085c8-2a53-500c-b6f8-ae3a4e5a7d7d", "isPublic": true }, { "controlId": "A.4.3", "title": "A.4.3 — Cyber Security Program Review", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-1, CA-2, CA-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "62a22821-0329-5183-a541-2a3295df5890", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.3", "title": "NEI 08-09 Sec 4.3 — Cyber Security Program Review", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e7298e08-6b2b-51e8-86c4-dd21c15ac235", "isPublic": true }, { "controlId": "10 CFR 73.54(g), 73.55(m)", "title": "10 CFR 73.54(g), 73.55(m) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "585dfa03-6bb4-57df-a072-5e2471494e89", "isPublic": true } ], "id": 31081, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730952", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730952", "catalogueId": 1062, "uuid": "d283da9b-c556-5a73-b719-af6f8bcee4ac", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the identification and implementation of relevant statutory, regulatory and contractual controls?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 10.0, "title": "Statutory, Regulatory & Contractual Compliance", "description": "

Control Description

Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.

Evidence Request List (ERL)

E-CPL-01\nE-GOV-10

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Compliance (CPL) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CPL domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Compliance management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Compliance efforts are narrowly-limited to certain compliance requirements.\n▪ IT and/or cybersecurity personnel use an informal process to govern statutory, regulatory and contractual compliance obligations.

Level 2 - Planned & Tracked: Compliance (CPL) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Compliance management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Compliance management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ External compliance requirements for cybersecurity and data privacy are identified and documented, based on applicable laws, regulations and contractual obligations.\n▪ IT and/or cybersecurity perform an informal annual review of existing compliance requirements and research evolving or new requirements.

Level 3 - Well Defined: Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.1, A.4.3", "controlId": "CPL-01", "family": "Compliance", "enhancements": "", "sortId": "CPL-01", "references": "

Micro-Small Business (<10 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)\n∙ Governance, Risk and Compliance (GRC) solution (e.g., SCFConnect, SureCloud, Ostendio, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Small Business (10-49 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)\n∙ Governance, Risk and Compliance (GRC) solution (e.g., SCFConnect, SureCloud, Ostendio, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Medium Business (50-249 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)\n∙ Governance, Risk and Compliance (GRC) solution (e.g., SCFConnect, SureCloud, Ostendio, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Steering committee

Large Business (250-999 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Steering committee

Enterprise (>1,000 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Steering committee", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70044, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590101", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590101", "securityControlId": 31082, "ccis": [], "uuid": "109ca9c1-469c-5f9c-968c-7053fc6fb8cb", "testId": "CPL-01.1_A01", "test": "instances of non-compliance with statutory, regulatory and/or contractual obligations are documented, including the reason(s) for non-compliance.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70045, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590101", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590101", "securityControlId": 31082, "ccis": [], "uuid": "1734ea47-4005-5514-9f19-f95f5fea0561", "testId": "CPL-01.1_A02", "test": "instances of non-compliance with statutory, regulatory and/or contractual obligations are formally-reviewed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70046, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590101", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590101", "securityControlId": 31082, "ccis": [], "uuid": "f203a70f-a703-5f12-b40b-e2c7297937ad", "testId": "CPL-01.1_A03", "test": "instances of non-compliance with statutory, regulatory and/or contractual obligations are centrally-governed to maintain appropriate situational awareness.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70047, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590101", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590102", "securityControlId": 31082, "ccis": [], "uuid": "071bf137-2939-5cfe-9e02-9fe74cb5415a", "testId": "CPL-01.1_A04", "test": "instances of non-compliance with statutory, regulatory and/or contractual obligations are assigned to individuals or teams for remediation.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70048, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590102", "securityControlId": 31082, "ccis": [], "uuid": "89b75eba-60f3-5518-b7af-4296ca6d91df", "testId": "CPL-01.1_A05", "test": "remediation plans for instances of non-compliance with statutory, regulatory and/or contractual obligations are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 557279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582761", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3ba9ac2-073f-514a-afc6-9bd37d7378e4", "parentControlId": 31082, "controlId": "9.1", "title": "9.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582761" }, { "id": 557280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582761", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8008b23-2460-54d1-9780-c1ec551fa0d0", "parentControlId": 31082, "controlId": "9.1(a)", "title": "9.1(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582761" }, { "id": 557281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582761", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca9aa66f-022d-56b3-a0d8-8683196c451e", "parentControlId": 31082, "controlId": "9.1(b)", "title": "9.1(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582761" }, { "id": 557282, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582762", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d983683-a5b8-5a73-b39b-8fc652826dee", "parentControlId": 31082, "controlId": "9.1(c)", "title": "9.1(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582762" }, { "id": 557283, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582762", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fcb903c-2fe1-54be-95c2-3ecf3f874312", "parentControlId": 31082, "controlId": "9.1(d)", "title": "9.1(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582762" }, { "id": 557284, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582762", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e24798fa-be5c-550d-9e94-91a2e4c89bd7", "parentControlId": 31082, "controlId": "9.1(e)", "title": "9.1(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582762" }, { "id": 557285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582762", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2515d7cd-33e7-5fea-972b-d712ec03c4f9", "parentControlId": 31082, "controlId": "9.1(f)", "title": "9.1(f)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582762" }, { "id": 557286, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582762", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c19141ac-922d-5e41-9537-06ddaf92dbbd", "parentControlId": 31082, "controlId": "10.2", "title": "10.2", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582762" }, { "id": 557287, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582762", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04792474-219d-598b-98ea-fb3bebdf5bf6", "parentControlId": 31082, "controlId": "10.2(a)", "title": "10.2(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582762" }, { "id": 557288, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582762", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ce26afb-785c-5f0b-afda-bfa2748b5245", "parentControlId": 31082, "controlId": "10.2(a)(1)", "title": "10.2(a)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582762" }, { "id": 557289, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582762", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed8370b8-6975-54db-92fa-70c29416e582", "parentControlId": 31082, "controlId": "10.2(a)(2)", "title": "10.2(a)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582762" }, { "id": 557290, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582762", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "216c54bc-e807-5519-be26-c265ad8b0ee9", "parentControlId": 31082, "controlId": "10.2(b)", "title": "10.2(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582762" }, { "id": 557291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582763", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e760d0fc-92b6-5a6b-be11-a75afa183d5b", "parentControlId": 31082, "controlId": "10.2(b)(1)", "title": "10.2(b)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582763" }, { "id": 557292, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582763", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03d9d489-bf17-5055-8caf-04412187d7fe", "parentControlId": 31082, "controlId": "10.2(b)(2)", "title": "10.2(b)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582763" }, { "id": 557293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582763", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6bcc5e6-d80a-53de-80f4-cc499e08b31c", "parentControlId": 31082, "controlId": "10.2(b)(3)", "title": "10.2(b)(3)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582763" }, { "id": 557294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582763", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d72c717-d747-5ad5-99ba-697de5c75a5b", "parentControlId": 31082, "controlId": "10.2(c)", "title": "10.2(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582763" }, { "id": 557295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582763", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a802ab81-cf33-5849-93ee-0b8d76c0b037", "parentControlId": 31082, "controlId": "10.2(d)", "title": "10.2(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582763" }, { "id": 557296, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582763", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e06d734d-15fc-541d-99b2-bade867bc703", "parentControlId": 31082, "controlId": "10.2(e)", "title": "10.2(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582763" }, { "id": 557297, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582763", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e091b244-8ebe-5a61-a11d-21295d34d3c1", "parentControlId": 31082, "controlId": "10.2(f)", "title": "10.2(f)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582764" }, { "id": 557298, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582764", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8dd049f8-d107-5543-af01-8fcf5eedf091", "parentControlId": 31082, "controlId": "10.2(g)", "title": "10.2(g)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582764" }, { "id": 557309, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae265903-4ef2-5594-909c-3cd19010b987", "parentControlId": 31082, "controlId": "03.12.02.a.01", "title": "03.12.02.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582765" }, { "id": 557316, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be5312f5-3719-59eb-8ea2-602e910b5f47", "parentControlId": 31082, "controlId": "RISK-2l", "title": "RISK-2l", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582766" }, { "id": 557317, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e23501a1-95e6-50b9-acef-f20734f42049", "parentControlId": 31082, "controlId": "ARCHITECTURE-1i", "title": "ARCHITECTURE-1i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582766" }, { "controlId": "C.13.3", "title": "C.13.3 — Corrective Action Program", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-5, IR-4, PM-14", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "75323ebc-b58a-5306-acbb-3001eb947132", "isPublic": true }, { "controlId": "NEI 08-09 App E.13.3 (CAP)", "title": "NEI 08-09 App E.13.3 (CAP) — Corrective Action Program", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.13.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "bdde2b98-0cdb-58d9-a1ea-94f2cd29097c", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3), 73.55(b)(10)", "title": "10 CFR 73.54(d)(3), 73.55(b)(10) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.13.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "e793c08b-eb4b-5a5a-afb2-5dff242739c9", "isPublic": true } ], "id": 31082, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730952", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730952", "catalogueId": 1062, "uuid": "fda9f293-c16b-5b89-8397-74b17d4073e6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization document and review instances of non-compliance with statutory, regulatory and/or contractual obligations to develop appropriate risk mitigation actions?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Non-Compliance Oversight", "description": "

Control Description

Mechanisms exist to document and review instances of non-compliance with statutory, regulatory and/or contractual obligations to develop appropriate risk mitigation actions.

Evidence Request List (ERL)

E-CPL-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Compliance (CPL) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Compliance management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Compliance management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ External compliance requirements for cybersecurity and data privacy are identified and documented, based on applicable laws, regulations and contractual obligations.\n▪ IT and/or cybersecurity perform an informal annual review of existing compliance requirements and research evolving or new requirements.

Level 3 - Well Defined: Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to document and review instances of non-compliance with statutory, regulatory and/or contractual obligations to develop appropriate risk mitigation actions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.13.3", "controlId": "CPL-01.1", "family": "Compliance", "enhancements": "", "sortId": "CPL-01.1", "references": "

Micro-Small Business (<10 staff)

∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Small Business (10-49 staff)

∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Medium Business (50-249 staff)

∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Large Business (250-999 staff)

∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Enterprise (>1,000 staff)

∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70049, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590102", "securityControlId": 31083, "ccis": [], "uuid": "c1a4904b-6d4c-50b9-997e-1f4cfdf5676e", "testId": "CPL-01.2_A01", "test": "the organization's applicable cybersecurity / data privacy controls are determined through the analysis of business practices to determine required statutory, regulatory and/or contractual compliance obligations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70050, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590102", "securityControlId": 31083, "ccis": [], "uuid": "1932ccd6-70cd-5795-a47a-574c7a277e43", "testId": "CPL-01.2_A02", "test": "a recurring process exists to validate the scope of cybersecurity / data privacy controls that are determined to meet statutory, regulatory and/or contractual compliance obligations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 557361, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e962293c-75a7-5f97-85e4-6306cc841822", "parentControlId": 31083, "controlId": "SM-5", "title": "SM-5", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582771" }, { "id": 557368, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582772", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb731203-b725-58af-96a7-ba086a3cdc87", "parentControlId": 31083, "controlId": "4.3", "title": "4.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582772" }, { "id": 557369, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582772", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37b1f319-b43b-586b-8c35-d7c494dfd0ed", "parentControlId": 31083, "controlId": "4.3(a)", "title": "4.3(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582772" }, { "id": 557370, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582772", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac2ec185-7ddd-5439-bfb5-8a8542db1052", "parentControlId": 31083, "controlId": "4.3(b)", "title": "4.3(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582772" }, { "id": 557371, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582772", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d3eb446-9ce4-5822-b835-3dc0f4ee122a", "parentControlId": 31083, "controlId": "4.3(c)", "title": "4.3(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582772" }, { "id": 557372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582772", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7129e920-5255-51ce-807a-09ceb9e71d37", "parentControlId": 31083, "controlId": "9.1", "title": "9.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582772" }, { "id": 557380, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "412c7994-1e84-5628-8bdc-0f9a2f57b6a9", "parentControlId": 31083, "controlId": "03.04.11.a", "title": "03.04.11.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582773" }, { "id": 557381, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e168a97e-8eb8-53ca-b59c-919933c4814d", "parentControlId": 31083, "controlId": "03.15.02.a.04", "title": "03.15.02.a.04", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582773" }, { "id": 557385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582774", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22553cc7-71da-5787-9be4-0e73d4d25104", "parentControlId": 31083, "controlId": "GV.SC-05", "title": "GV.SC-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582774" } ], "id": 31083, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730952", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730952", "catalogueId": 1062, "uuid": "7f58e6a6-b8a5-54b7-aaed-d077a7a6cc33", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization document and validate the scope of security, compliance and resilience controls that are determined to meet statutory, regulatory and/or contractual compliance obligations?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 10.0, "title": "Compliance Scope", "description": "

Control Description

Mechanisms exist to document and validate the scope of security, compliance and resilience controls that are determined to meet statutory, regulatory and/or contractual compliance obligations.

Evidence Request List (ERL)

E-AST-02\nE-CPL-02\nE-GOV-10

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Compliance (CPL) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Compliance management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Compliance management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ External compliance requirements for cybersecurity and data privacy are identified and documented, based on applicable laws, regulations and contractual obligations.\n▪ IT and/or cybersecurity perform an informal annual review of existing compliance requirements and research evolving or new requirements.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to perform compliance scoping of control applicability for statutory, regulatory and/or contractual compliance obligations.

Level 3 - Well Defined: Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to document and validate the scope of security, compliance and resilience controls that are determined to meet statutory, regulatory and/or contractual compliance obligations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CPL-01.2", "family": "Compliance", "enhancements": "", "sortId": "CPL-01.2", "references": "

Micro-Small Business (<10 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)

Small Business (10-49 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)

Medium Business (50-249 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)

Large Business (250-999 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)

Enterprise (>1,000 staff)

∙ Unified Scoping Guide (https://unified-scoping-guide.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70051, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590102", "securityControlId": 31084, "ccis": [], "uuid": "9bffe75a-07a0-5d6a-b6b9-a2a3fce39dc0", "testId": "CPL-01.3_A01", "test": "a capability exists to demonstrate conformity with applicable cybersecurity and data protection laws, regulations and/or contractual obligations.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 70052, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590103", "securityControlId": 31084, "ccis": [], "uuid": "d23c1dff-bbf2-5188-aa56-9cc3659ebe38", "testId": "CPL-01.3_A02", "test": "personnel or roles to whom the assignment of being able to demonstrate conformity is assigned.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 557427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582779", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf007e4e-8ee1-5271-b0b1-27b9fe04ab57", "parentControlId": 31084, "controlId": "ARCHITECTURE-1i", "title": "ARCHITECTURE-1i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582779" } ], "id": 31084, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730953", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730953", "catalogueId": 1062, "uuid": "c458bf29-d110-5610-ada3-15cddb367c55", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure the organization is able to demonstrate security, compliance and/or resilience capability conformity with applicable cybersecurity and data protection laws, regulations and/or contractual obligations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Ability To Demonstrate Conformity", "description": "

Control Description

Mechanisms exist to ensure the organization is able to demonstrate security, compliance and/or resilience capability conformity with applicable cybersecurity and data protection laws, regulations and/or contractual obligations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Compliance (CPL) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Compliance management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Compliance management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ External compliance requirements for cybersecurity and data privacy are identified and documented, based on applicable laws, regulations and contractual obligations.

Level 3 - Well Defined: Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure the organization is able to demonstrate security, compliance and/or resilience capability conformity with applicable cybersecurity and data protection laws, regulations and/or contractual obligations.

Level 4 - Quantitatively Controlled: Compliance (CPL) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CPL-01.3", "family": "Compliance", "enhancements": "", "sortId": "CPL-01.3", "references": "

Micro-Small Business (<10 staff)

∙ Document applicable regulatory requirements in a checklist

Small Business (10-49 staff)

∙ Compliance checklist\n∙ Annual compliance review

Medium Business (50-249 staff)

∙ Compliance management program\n∙ Regulatory mapping\n∙ Compliance calendar

Large Business (250-999 staff)

∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Compliance team

Enterprise (>1,000 staff)

∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Dedicated compliance team\n∙ Automated compliance monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70053, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590103", "securityControlId": 31085, "ccis": [], "uuid": "48c11d11-9d68-5a8e-a9aa-deeeabc350b6", "testId": "CPL-01.4_A01", "test": "assessments are conducted to demonstrate conformity with applicable cybersecurity and data protection laws, regulations and/or contractual obligations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 557473, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c598c8b1-8720-5144-a56e-0ab2cf4afe78", "parentControlId": 31085, "controlId": "ARCHITECTURE-1i", "title": "ARCHITECTURE-1i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582784" }, { "id": 557510, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582788", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8cf2f6d-3c72-5ed4-9d27-f3bb336fee92", "parentControlId": 31085, "controlId": "A2.c", "title": "A2.c", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582788" }, { "controlId": "A.4.1.1", "title": "A.4.1.1 — Periodic Assessment of Security Controls", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, CA-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "4ac96f15-de11-5651-ac48-ea9adb7c18c4", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.1.1", "title": "NEI 08-09 Sec 4.1.1 — Periodic Assessment of Security Controls", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.1.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "45690792-d31d-512f-a611-58230d2b51b6", "isPublic": true }, { "controlId": "10 CFR 73.54(g)", "title": "10 CFR 73.54(g) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.1.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "e811b22f-c3ca-5b60-81c1-baa0d6d64702", "isPublic": true } ], "id": 31085, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730953", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730953", "catalogueId": 1062, "uuid": "1e04a433-054e-5dba-b784-c7e8da2e5ff2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct assessments to demonstrate security, compliance and/or resilience capability conformity with applicable cybersecurity and data protection laws, regulations and/or contractual obligations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Conformity Assessment", "description": "

Control Description

Mechanisms exist to conduct assessments to demonstrate security, compliance and/or resilience capability conformity with applicable cybersecurity and data protection laws, regulations and/or contractual obligations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Compliance (CPL) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Compliance management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Compliance management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ External compliance requirements for cybersecurity and data privacy are identified and documented, based on applicable laws, regulations and contractual obligations.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to assigned cybersecurity and/or data protection controls to comply with specific compliance requirements.

Level 3 - Well Defined: Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conduct assessments to demonstrate security, compliance and/or resilience capability conformity with applicable cybersecurity and data protection laws, regulations and/or contractual obligations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.1.1", "controlId": "CPL-01.4", "family": "Compliance", "enhancements": "", "sortId": "CPL-01.4", "references": "

Micro-Small Business (<10 staff)

∙ Document applicable regulatory requirements in a checklist

Small Business (10-49 staff)

∙ Compliance checklist\n∙ Annual compliance review

Medium Business (50-249 staff)

∙ Compliance management program\n∙ Regulatory mapping\n∙ Compliance calendar

Large Business (250-999 staff)

∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Compliance team

Enterprise (>1,000 staff)

∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Dedicated compliance team\n∙ Automated compliance monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70054, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590103", "securityControlId": 31086, "ccis": [], "uuid": "3f2dfbe7-0c3e-5943-8c34-7023a23051dd", "testId": "CPL-01.5_A01", "test": "a declaration of conformity is generated for each conformity assessment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 557520, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd8e37c7-3aad-5918-b8cf-8c6e06b59122", "parentControlId": 31086, "controlId": "§117.18(c)(1)(i)", "title": "§117.18(c)(1)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58279" } ], "id": 31086, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730953", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730953", "catalogueId": 1062, "uuid": "98a85f2a-7daa-53c7-94c5-68579a1319b3", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization generate a declaration of conformity for each conformity assessment, where the document:\n(1) Is concise;\n(2) Unambiguously reflects the current status;\n(3) Is physically or electronically signed; and\n(4) Where possible, is machine readable?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Declaration of Conformity", "description": "

Control Description

Mechanisms exist to generate a declaration of conformity for each conformity assessment, where the document:\n(1) Is concise;\n(2) Unambiguously reflects the current status;\n(3) Is physically or electronically signed; and\n(4) Where possible, is machine readable.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Compliance (CPL) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Compliance management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Compliance management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ External compliance requirements for cybersecurity and data privacy are identified and documented, based on applicable laws, regulations and contractual obligations.\n▪ A formal report is generated for each security assessment/audit with sufficient details to understand the organization's ability to demonstrate conformity with its requirements.

Level 3 - Well Defined: Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to generate a declaration of conformity for each conformity assessment, where the document:\n(1) Is concise;\n(2) Unambiguously reflects the current status;\n(3) Is physically or electronically signed; and\n(4) Where possible, is machine readable.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CPL-01.5", "family": "Compliance", "enhancements": "", "sortId": "CPL-01.5", "references": "

Micro-Small Business (<10 staff)

∙ Document applicable regulatory requirements in a checklist

Small Business (10-49 staff)

∙ Compliance checklist\n∙ Annual compliance review

Medium Business (50-249 staff)

∙ Compliance management program\n∙ Regulatory mapping\n∙ Compliance calendar

Large Business (250-999 staff)

∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Compliance team

Enterprise (>1,000 staff)

∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Dedicated compliance team\n∙ Automated compliance monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70063, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590105", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590105", "securityControlId": 31090, "ccis": [], "uuid": "6a24f9fa-3c4e-5f4a-a015-2845c2bd610b", "testId": "CPL-02_A01", "test": "a compliance catalog of applicable laws, regulations and contractual obligations are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70064, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590106", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590106", "securityControlId": 31090, "ccis": [], "uuid": "7b6bbb0e-f07f-5393-a2bf-5b88a3ec5dd3", "testId": "CPL-02_A02", "test": "a continuous monitoring strategy is developed for cybersecurity / data privacy controls.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-07[01]", "defaultText": null }, { "id": 70065, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59011", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59011", "securityControlId": 31090, "ccis": [], "uuid": "271dcc8f-7d67-5fe2-8ffa-1d885744272d", "testId": "CPL-02_A03", "test": "continuous control monitoring is implemented in accordance with the organization's continuous monitoring strategy.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-07[02]", "defaultText": null }, { "id": 70066, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59011", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59011", "securityControlId": 31090, "ccis": [], "uuid": "f9d62e19-1b22-5818-9c1e-c4824701e0a6", "testId": "CPL-02_A04", "test": "the frequency of cybersecurity / data privacy control assessments is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least every 12 months and after any significant incidents or significant changes occur", "otherId": "171A_3.12.1[a]\n53A_R5_CA-07_ODP[02]\n53A_R5_CA-07_ODP[03]\n53A_R5_CA-07b.[01]\n53A_R5_CA-07b.[02]", "defaultText": null }, { "id": 70067, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590111", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590111", "securityControlId": 31090, "ccis": [], "uuid": "f18a2952-16d6-5db9-843b-c25823f8c3fb", "testId": "CPL-02_A05", "test": "cybersecurity / data privacy controls are assessed with the defined frequency to determine if the controls are effective in their application.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least annually", "otherId": "171A_3.12.1[b]\n53A_R5_CA-07c.", "defaultText": null }, { "id": 70068, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590111", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590111", "securityControlId": 31090, "ccis": [], "uuid": "f311f804-7700-5544-b03d-fd821556293b", "testId": "CPL-02_A06", "test": "cybersecurity / data privacy controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.12.3", "defaultText": null }, { "id": 70069, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590111", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590111", "securityControlId": 31090, "ccis": [], "uuid": "3673b509-9c7c-5c2c-8e1b-5067a8ee01cd", "testId": "CPL-02_A07", "test": "personnel or roles to whom the cybersecurity / data privacy status of the system is reported are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-07_ODP[04]\n53A_R5_CA-07_ODP[06]", "defaultText": null }, { "id": 70070, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590111", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590111", "securityControlId": 31090, "ccis": [], "uuid": "70efc5a8-8589-58c9-bbe3-b39ac9c1db44", "testId": "CPL-02_A08", "test": "the frequency at which the cybersecurity / data privacy status of the system is reported is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-07_ODP[05]\n53A_R5_CA-07_ODP[07]", "defaultText": null }, { "id": 70071, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590111", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590111", "securityControlId": 31090, "ccis": [], "uuid": "f90d8cb3-336b-5a06-9884-2b89d78bc968", "testId": "CPL-02_A09", "test": "system-level continuous monitoring includes reporting the cybersecurity / data privacy status of the system to pertinent personnel or roles according to an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-07g.[01]\n53A_R5_CA-07g.[02]", "defaultText": null }, { "id": 70072, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590111", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590111", "securityControlId": 31090, "ccis": [], "uuid": "e4bd9321-23f6-5d02-99b9-fc32667c3a86", "testId": "CPL-02_A10", "test": "control monitoring metrics are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-07_ODP[01]\n53A_R5_CA-07a.", "defaultText": null }, { "id": 70073, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590112", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590112", "securityControlId": 31090, "ccis": [], "uuid": "617c819b-c75e-5f2e-8ab2-94663838d11a", "testId": "CPL-02_A11", "test": "system-level continuous monitoring includes ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-07d.", "defaultText": null }, { "id": 70074, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590112", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590112", "securityControlId": 31090, "ccis": [], "uuid": "d4528f8a-5954-5caa-9c5a-bc41113b45a8", "testId": "CPL-02_A12", "test": "system-level continuous monitoring includes correlation and analysis of information generated by control assessments and monitoring.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-07e.", "defaultText": null }, { "id": 70075, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590112", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590112", "securityControlId": 31090, "ccis": [], "uuid": "b91378e8-b517-5937-9502-840a726b91a9", "testId": "CPL-02_A13", "test": "system-level continuous monitoring includes response actions to address the results of the analysis of control assessment and monitoring information.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-07f.", "defaultText": null }, { "id": 70076, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590112", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590112", "securityControlId": 31090, "ccis": [], "uuid": "67475c40-e168-593a-8153-19c1a9f7cd52", "testId": "CPL-02_A14", "test": "the personnel or roles for reporting the security status of organizational systems to is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-31_ODP[04]", "defaultText": null }, { "id": 70077, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590112", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590112", "securityControlId": 31090, "ccis": [], "uuid": "12856745-18e5-50c7-96c1-5f5b1ae7a9a9", "testId": "CPL-02_A15", "test": "the personnel or roles for reporting the privacy status of organizational systems to is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-31_ODP[05]", "defaultText": null }, { "id": 70078, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590112", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590112", "securityControlId": 31090, "ccis": [], "uuid": "65a70006-5ac6-5931-80b7-0d31172ad8c5", "testId": "CPL-02_A16", "test": "the frequency at which to report the security status of organizational systems is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-31_ODP[06]", "defaultText": null }, { "id": 70079, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590112", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590112", "securityControlId": 31090, "ccis": [], "uuid": "cbd71548-332c-5ff0-b57f-36b16fcaf76b", "testId": "CPL-02_A17", "test": "the frequency at which to report the privacy status of organizational systems is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-31_ODP[07]", "defaultText": null }, { "id": 70080, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590113", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590113", "securityControlId": 31090, "ccis": [], "uuid": "71006717-5ad8-5782-8b85-0f0cf0f1d6db", "testId": "CPL-02_A18", "test": "an organization-wide continuous monitoring strategy is developed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-31\n53A_R5_PM-31_ODP[01]", "defaultText": null }, { "id": 70081, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590113", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590113", "securityControlId": 31090, "ccis": [], "uuid": "e338be9a-009a-58bc-aa70-ce8085ce1857", "testId": "CPL-02_A19", "test": "continuous monitoring programs are implemented that include establishing metrics to be monitored.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-31a.", "defaultText": null }, { "id": 70082, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590113", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590113", "securityControlId": 31090, "ccis": [], "uuid": "52a390dc-6258-5ce8-893b-535585a42d94", "testId": "CPL-02_A20", "test": "continuous monitoring programs are implemented that establish frequency for monitoring.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-31b.[01]\n53A_R5_PM-31_ODP[02]", "defaultText": null }, { "id": 70083, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590113", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590113", "securityControlId": 31090, "ccis": [], "uuid": "2e85b86c-2d62-5742-8884-927bddab397f", "testId": "CPL-02_A21", "test": "continuous monitoring programs are implemented that establish frequency for assessment of control effectiveness.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-31b.[02]\n53A_R5_PM-31_ODP[03]", "defaultText": null }, { "id": 70084, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590113", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590113", "securityControlId": 31090, "ccis": [], "uuid": "035b688c-ba90-5c9f-a433-4f9a80af373e", "testId": "CPL-02_A22", "test": "continuous monitoring programs are implemented that include monitoring metrics on an ongoing basis in accordance with the continuous monitoring strategy.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-31c.", "defaultText": null }, { "id": 70085, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590114", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590114", "securityControlId": 31090, "ccis": [], "uuid": "13cb5cbb-f104-54b1-862b-a9fe4b4405c5", "testId": "CPL-02_A23", "test": "continuous monitoring programs are implemented that include correlating information generated by control assessments and monitoring.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-31d.[01]", "defaultText": null }, { "id": 70086, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590114", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590114", "securityControlId": 31090, "ccis": [], "uuid": "1b89d3a7-7db5-51c4-855a-0b097730f014", "testId": "CPL-02_A24", "test": "continuous monitoring programs are implemented that include analyzing information generated by control assessments and monitoring.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-31d.[02]", "defaultText": null }, { "id": 70087, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590118", "securityControlId": 31090, "ccis": [], "uuid": "130143f3-5244-5e37-bdf8-bd7e82078963", "testId": "CPL-02_A25", "test": "continuous monitoring programs are implemented that include response actions to address the analysis of control assessment information.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-31e.[01]", "defaultText": null }, { "id": 70088, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590118", "securityControlId": 31090, "ccis": [], "uuid": "fc2cc935-2aae-52c2-99f5-9b3dfd3233e1", "testId": "CPL-02_A26", "test": "continuous monitoring programs are implemented that include response actions to address the analysis of monitoring information.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-31e.[02]", "defaultText": null }, { "id": 70089, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590119", "securityControlId": 31090, "ccis": [], "uuid": "ad138a6d-81be-5e2b-afd6-3a8b0d124c7d", "testId": "CPL-02_A27", "test": "continuous monitoring programs are implemented that include reporting the security status of organizational systems to personnel or roles frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-31f.[01]", "defaultText": null }, { "id": 70090, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590119", "securityControlId": 31090, "ccis": [], "uuid": "feb2041c-05f0-5527-a980-fb22cc33a8e7", "testId": "CPL-02_A28", "test": "continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to personnel or roles frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-31f.[02]", "defaultText": null }, { "id": 70091, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590119", "securityControlId": 31090, "ccis": [], "uuid": "bd324cef-aac7-5260-91b6-50310fd3d091", "testId": "CPL-02_A29", "test": "a system-level continuous monitoring strategy is developed.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.12.03[01]", "defaultText": null }, { "id": 70092, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590119", "securityControlId": 31090, "ccis": [], "uuid": "74294797-2f67-5870-8458-62a608112b1a", "testId": "CPL-02_A30", "test": "ongoing monitoring is included in the continuous monitoring strategy.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.12.03[03]", "defaultText": null }, { "id": 70093, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59012", "securityControlId": 31090, "ccis": [], "uuid": "ce6242c5-2640-5721-8854-454732f33961", "testId": "CPL-02_A31", "test": "security assessments are included in the continuous monitoring strategy.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.12.03[04]", "defaultText": null } ], "externalMappings": [ { "id": 557597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c501aa79-77e1-5de6-a082-64a458788a1d", "parentControlId": 31090, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582807" }, { "id": 557598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "905b1192-c4c9-5e8a-9d0c-d6460bcf3b21", "parentControlId": 31090, "controlId": "10.1", "title": "10.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582807" }, { "id": 557599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2dd09dee-1223-5861-b737-04d808ba542f", "parentControlId": 31090, "controlId": "5.31", "title": "5.31", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582807" }, { "id": 557600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35bcccfa-74e2-5286-882e-c2720aaaaccf", "parentControlId": 31090, "controlId": "5.36", "title": "5.36", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582807" }, { "id": 557601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48a399f1-eca8-5a8d-9886-330fa17cc556", "parentControlId": 31090, "controlId": "6.8", "title": "6.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582807" }, { "id": 557602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582808", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0bec6bd-d2e5-5e8d-9d18-0a59347186c3", "parentControlId": 31090, "controlId": "8.8", "title": "8.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582808" }, { "id": 557603, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582808", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0cb6e6f4-cb43-5876-b667-0d0b7eaeaee3", "parentControlId": 31090, "controlId": "8.34", "title": "8.34", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582808" }, { "id": 557617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b29f72aa-291b-5117-b229-c0cedfd6a757", "parentControlId": 31090, "controlId": "T1001", "title": "T1001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58281" }, { "id": 557618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ef70e64-3872-5785-8103-3f665760c2e0", "parentControlId": 31090, "controlId": "T1001.001", "title": "T1001.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58281" }, { "id": 557619, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06943fc2-19eb-52b2-a6bc-7043621ecc29", "parentControlId": 31090, "controlId": "T1001.002", "title": "T1001.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58281" }, { "id": 557620, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6caad679-39b4-5e28-b679-5c5355c53059", "parentControlId": 31090, "controlId": "T1001.003", "title": "T1001.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58281" }, { "id": 557621, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20ad85d6-fa60-5b34-a353-6909b3c72bfd", "parentControlId": 31090, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58281" }, { "id": 557622, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04878cbc-92bd-5774-8372-9aa1cfbec942", "parentControlId": 31090, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58281" }, { "id": 557623, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d72f7ff-e548-5a0f-9e55-62702a2a01e7", "parentControlId": 31090, "controlId": "T1003.002", "title": "T1003.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58281" }, { "id": 557624, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9512441d-253e-53f4-810a-15f9fc4c28e0", "parentControlId": 31090, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58281" }, { "id": 557625, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582811", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce88bd77-7c51-5d9d-b64f-46157ab19e66", "parentControlId": 31090, "controlId": "T1003.004", "title": "T1003.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582811" }, { "id": 557626, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582811", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d531c92c-dd5a-58b2-8641-668c7e7f56f3", "parentControlId": 31090, "controlId": "T1003.005", "title": "T1003.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582811" }, { "id": 557627, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582811", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eefd02d2-d1c5-52e6-8306-7e04bcfedff7", "parentControlId": 31090, "controlId": "T1003.006", "title": "T1003.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582811" }, { "id": 557628, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582811", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40446d95-0a4d-5d64-a118-4b9404829283", "parentControlId": 31090, "controlId": "T1003.007", "title": "T1003.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582811" }, { "id": 557629, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582811", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff0cab95-2b87-536a-8c12-67b4ec47f071", "parentControlId": 31090, "controlId": "T1003.008", "title": "T1003.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582811" }, { "id": 557630, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582811", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "052582a9-1c3d-5fea-bd4c-e467af49c680", "parentControlId": 31090, "controlId": "T1008", "title": "T1008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582811" }, { "id": 557631, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582811", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c87d2a50-fb15-534f-ac76-20317fe5e3ef", "parentControlId": 31090, "controlId": "T1021.002", "title": "T1021.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582811" }, { "id": 557632, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582811", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1983cf1b-d218-5129-b9be-e0b9c20f4fa5", "parentControlId": 31090, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582811" }, { "id": 557633, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582811", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43bb2ecd-e9e4-55cf-85fa-c8ba0c2b00ef", "parentControlId": 31090, "controlId": "T1029", "title": "T1029", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582811" }, { "id": 557634, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f8f155e-19a1-5c71-80c0-d2437773098c", "parentControlId": 31090, "controlId": "T1030", "title": "T1030", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582812" }, { "id": 557635, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38b7f814-fb53-51b3-80d9-733d014527b3", "parentControlId": 31090, "controlId": "T1036", "title": "T1036", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582812" }, { "id": 557636, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "529ce5ff-d92d-5b83-aab9-b62d29393207", "parentControlId": 31090, "controlId": "T1036.003", "title": "T1036.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582812" }, { "id": 557637, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bcc43d5-5ac2-55cc-9a36-9b33a27fa253", "parentControlId": 31090, "controlId": "T1036.005", "title": "T1036.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582812" }, { "id": 557638, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7ee7b34-6c6b-5ada-8301-5512e41a9227", "parentControlId": 31090, "controlId": "T1036.007", "title": "T1036.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582812" }, { "id": 557639, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd38bf04-4d10-5273-9dcd-bbd4bdbc3c89", "parentControlId": 31090, "controlId": "T1037", "title": "T1037", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582812" }, { "id": 557640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93136f85-78ac-5430-80e5-ea51b74543b2", "parentControlId": 31090, "controlId": "T1037.002", "title": "T1037.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582812" }, { "id": 557641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "578c766f-25d6-52eb-8171-aba5336dd47b", "parentControlId": 31090, "controlId": "T1037.003", "title": "T1037.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582812" }, { "id": 557642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582813", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e58bacd1-ce7f-5974-9cd1-00f29cdac255", "parentControlId": 31090, "controlId": "T1037.004", "title": "T1037.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582813" }, { "id": 557643, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582813", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5faf9dbe-2e38-5d39-8f94-723266076a21", "parentControlId": 31090, "controlId": "T1037.005", "title": "T1037.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582813" }, { "id": 557644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582813", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a84a389c-c7f4-579f-8ed9-4dce18572ff2", "parentControlId": 31090, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582813" }, { "id": 557645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582813", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ac9e56c-ff8e-5be4-88ba-662c4bf9345e", "parentControlId": 31090, "controlId": "T1046", "title": "T1046", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582813" }, { "id": 557646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582813", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9135cc7-897a-5208-88bf-abf60550d345", "parentControlId": 31090, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582813" }, { "id": 557647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582813", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff0f7bcc-fbf8-5086-b66b-48f3c3d9e7e9", "parentControlId": 31090, "controlId": "T1048.001", "title": "T1048.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582813" }, { "id": 557648, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582813", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e335b01b-c689-57fe-a7d8-409cfb2c92c8", "parentControlId": 31090, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582813" }, { "id": 557649, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582813", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a332c285-3fa1-5053-87f3-a72892b87600", "parentControlId": 31090, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582813" }, { "id": 557650, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582813", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f782abf2-60e8-580a-80d2-4ec79fb72b86", "parentControlId": 31090, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582813" }, { "id": 557651, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47d3cf13-ac95-588e-9f09-787687df181b", "parentControlId": 31090, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582814" }, { "id": 557652, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53660158-0ecf-5f21-9012-6ef2b77c7df4", "parentControlId": 31090, "controlId": "T1053.006", "title": "T1053.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582814" }, { "id": 557653, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96ea437d-87ba-5663-9add-7393c97c0bdd", "parentControlId": 31090, "controlId": "T1055.009", "title": "T1055.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582814" }, { "id": 557654, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6891b848-f518-5e95-b677-ceebb322b606", "parentControlId": 31090, "controlId": "T1056.002", "title": "T1056.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582814" }, { "id": 557655, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17a90210-2da7-5921-be45-0faaf741907d", "parentControlId": 31090, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582814" }, { "id": 557656, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec2a1c0c-f353-5af9-8c36-5cc1f3192e2a", "parentControlId": 31090, "controlId": "T1059.005", "title": "T1059.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582814" }, { "id": 557657, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fac2fd8-28ee-53bb-a17a-a83ef042287e", "parentControlId": 31090, "controlId": "T1059.007", "title": "T1059.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582814" }, { "id": 557658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86341fd1-c97c-56f1-ae15-5f3586ec6408", "parentControlId": 31090, "controlId": "T1059.010", "title": "T1059.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582814" }, { "id": 557659, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "696f294e-da61-5e65-853c-a09ee98fd83a", "parentControlId": 31090, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582814" }, { "id": 557660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30528508-772f-5f44-a670-f7e672fcaf3a", "parentControlId": 31090, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582815" }, { "id": 557661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c71aa34b-c3ad-5713-bdbd-7794e4824b45", "parentControlId": 31090, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582815" }, { "id": 557662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ced1e2f-1c21-57fe-b37d-2d5ae6ed933c", "parentControlId": 31090, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582815" }, { "id": 557663, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2cf04b03-181a-5cb5-9b14-70b141c04c93", "parentControlId": 31090, "controlId": "T1070.003", "title": "T1070.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582815" }, { "id": 557664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd5b1823-8485-5138-b203-5d7f86cefb8c", "parentControlId": 31090, "controlId": "T1070.007", "title": "T1070.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582815" }, { "id": 557665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fceb9ab-afb0-52ac-bbce-9baae1dc8e4c", "parentControlId": 31090, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582815" }, { "id": 557666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac50e6cd-b9ad-50ef-8d6a-ea112b1791a8", "parentControlId": 31090, "controlId": "T1070.009", "title": "T1070.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582815" }, { "id": 557667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec06faec-e436-55be-86af-360fa4b61acb", "parentControlId": 31090, "controlId": "T1071", "title": "T1071", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582815" }, { "id": 557668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582816", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c959c6bc-6342-54b8-9a33-3b2bd34b61d4", "parentControlId": 31090, "controlId": "T1071.001", "title": "T1071.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582816" }, { "id": 557669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582816", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8f1e7f1-54ac-5925-90b0-e33a63b084ef", "parentControlId": 31090, "controlId": "T1071.002", "title": "T1071.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582816" }, { "id": 557670, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582816", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce51baaa-2673-52f2-b862-3b5d9e6c5e61", "parentControlId": 31090, "controlId": "T1071.003", "title": "T1071.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582816" }, { "id": 557671, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582816", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "026c2295-b0a0-510b-a223-368adb12442a", "parentControlId": 31090, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582816" }, { "id": 557672, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582816", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed6e8e2d-2739-5cf5-8161-1d38a5926808", "parentControlId": 31090, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582816" }, { "id": 557673, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582816", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a721a493-a7ba-5b92-99df-c952a406356a", "parentControlId": 31090, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582816" }, { "id": 557674, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582816", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fd903cb-511a-522a-9fcb-387808c5bb03", "parentControlId": 31090, "controlId": "T1078.001", "title": "T1078.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582816" }, { "id": 557675, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582816", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8cba15d-fc9a-57f0-bbbd-116f33400d3b", "parentControlId": 31090, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582816" }, { "id": 557676, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582816", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "008faee8-a3ea-5f4a-98c8-6a68e6db7fab", "parentControlId": 31090, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582816" }, { "id": 557677, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582817", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58c59f83-d715-58d6-ab16-e56d1116d9fe", "parentControlId": 31090, "controlId": "T1080", "title": "T1080", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582817" }, { "id": 557678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582817", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d81f60aa-bff0-57bc-9f6e-700f5ac8e946", "parentControlId": 31090, "controlId": "T1090", "title": "T1090", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582817" }, { "id": 557679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582817", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a170b284-4a39-5d18-9ea5-c3bc5d02407b", "parentControlId": 31090, "controlId": "T1090.001", "title": "T1090.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582817" }, { "id": 557680, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582817", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb47a113-7463-5534-aeda-80a006c59ecb", "parentControlId": 31090, "controlId": "T1090.002", "title": "T1090.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582817" }, { "id": 557681, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582817", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "254d3997-af15-5c8e-8393-e9bfa7e911ca", "parentControlId": 31090, "controlId": "T1090.003", "title": "T1090.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582817" }, { "id": 557682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582817", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a614ab1-65f2-58e8-8d09-5c8d097e52e0", "parentControlId": 31090, "controlId": "T1095", "title": "T1095", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582817" }, { "id": 557683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582817", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "379e9f3e-9ae7-5fdc-ad78-52bedb444b76", "parentControlId": 31090, "controlId": "T1102", "title": "T1102", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582817" }, { "id": 557684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582817", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4d8ab87-7e2c-5aa5-96cc-876f982c9e4f", "parentControlId": 31090, "controlId": "T1102.001", "title": "T1102.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582817" }, { "id": 557685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582817", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eed24b7a-debe-5b06-9d00-96947ac93d4d", "parentControlId": 31090, "controlId": "T1102.002", "title": "T1102.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582817" }, { "id": 557686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582817", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffc85d1c-cfd5-59b1-9498-73620dd32096", "parentControlId": 31090, "controlId": "T1102.003", "title": "T1102.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582818" }, { "id": 557687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582818", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f86616f-9683-53df-9ed3-c180cda256eb", "parentControlId": 31090, "controlId": "T1104", "title": "T1104", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582818" }, { "id": 557688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582818", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75444fa0-0f42-5692-a094-9ccdab0e0082", "parentControlId": 31090, "controlId": "T1105", "title": "T1105", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582818" }, { "id": 557689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582818", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e9bac94-a57c-5579-a80b-bb833c18c2a0", "parentControlId": 31090, "controlId": "T1110", "title": "T1110", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582818" }, { "id": 557690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582818", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "865830bf-8dec-5dc3-8c0d-6d2f9bead877", "parentControlId": 31090, "controlId": "T1110.001", "title": "T1110.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582818" }, { "id": 557691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582818", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7ef8ee6-db78-5aaf-be36-d0ec8c1f932f", "parentControlId": 31090, "controlId": "T1110.002", "title": "T1110.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582818" }, { "id": 557692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582818", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63228452-6c76-56bd-a52f-f75e3bdc29c3", "parentControlId": 31090, "controlId": "T1110.003", "title": "T1110.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582818" }, { "id": 557693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582818", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a43a1d26-debc-5049-87de-559e09871cf7", "parentControlId": 31090, "controlId": "T1110.004", "title": "T1110.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582818" }, { "id": 557694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582818", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8327c8d-bfde-556b-9858-2f03746b5687", "parentControlId": 31090, "controlId": "T1111", "title": "T1111", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582819" }, { "id": 557695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b31a8f55-18c2-508c-82dd-f746ad66c780", "parentControlId": 31090, "controlId": "T1132", "title": "T1132", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582819" }, { "id": 557696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "246f9eba-bb80-541a-ae5c-ebd5c5600685", "parentControlId": 31090, "controlId": "T1132.001", "title": "T1132.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582819" }, { "id": 557697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a42cc12c-a0f6-5776-8ea8-156a3a179c68", "parentControlId": 31090, "controlId": "T1132.002", "title": "T1132.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582819" }, { "id": 557698, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27a5979a-55da-568a-977e-795a057b3f24", "parentControlId": 31090, "controlId": "T1176", "title": "T1176", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582819" }, { "id": 557699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64adbc60-d2e3-5d88-a324-a30eb24bc3ca", "parentControlId": 31090, "controlId": "T1185", "title": "T1185", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582819" }, { "id": 557700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25bd6c9a-9b98-5262-aa8e-ca8192d20793", "parentControlId": 31090, "controlId": "T1187", "title": "T1187", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582819" }, { "id": 557701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "537a3961-0f6f-54b3-b555-d382453ea41f", "parentControlId": 31090, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582819" }, { "id": 557702, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56b07c29-88c8-5abf-a2ef-b3c5096a573d", "parentControlId": 31090, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582819" }, { "id": 557703, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9c40266-f4ef-5a81-b2ae-b2c7e8ad9932", "parentControlId": 31090, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582819" }, { "id": 557704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ecb711d-64f6-545a-9bd7-01dca6936a54", "parentControlId": 31090, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58282" }, { "id": 557705, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a250a65-b7d1-5c00-b29f-60585889605b", "parentControlId": 31090, "controlId": "T1195.002", "title": "T1195.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58282" }, { "id": 557706, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa5b9778-22b4-5d4b-ab10-cfcdea0b56aa", "parentControlId": 31090, "controlId": "T1197", "title": "T1197", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58282" }, { "id": 557707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06087564-b5fc-51c3-95f0-ffdd3f9c180c", "parentControlId": 31090, "controlId": "T1201", "title": "T1201", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58282" }, { "id": 557708, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eee50e24-8fba-5bfd-a454-52e28c76b64e", "parentControlId": 31090, "controlId": "T1203", "title": "T1203", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58282" }, { "id": 557709, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f195fd8-b79d-5dd9-aa31-962b25f4740b", "parentControlId": 31090, "controlId": "T1204", "title": "T1204", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58282" }, { "id": 557710, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68dbe29a-5ff0-5594-aa00-8525b924c651", "parentControlId": 31090, "controlId": "T1204.001", "title": "T1204.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58282" }, { "id": 557711, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5086d3f-4627-5a61-b2a4-ef0ac368cc49", "parentControlId": 31090, "controlId": "T1204.002", "title": "T1204.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58282" }, { "id": 557712, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64cc3529-7bd2-5a9f-9909-394c34d4b1ed", "parentControlId": 31090, "controlId": "T1204.003", "title": "T1204.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58282" }, { "id": 557713, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8785180-36f8-5e9b-87de-f6ee930940f5", "parentControlId": 31090, "controlId": "T1205", "title": "T1205", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582821" }, { "id": 557714, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91c93246-f1e1-556a-8eda-4616871ce1f5", "parentControlId": 31090, "controlId": "T1205.001", "title": "T1205.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582821" }, { "id": 557715, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d17adf12-b18a-589f-b0a2-3749429e4053", "parentControlId": 31090, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582821" }, { "id": 557716, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9da05124-a2b1-5bf1-81cb-8a00df18e1dd", "parentControlId": 31090, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582821" }, { "id": 557717, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2402183e-52ed-55ba-817c-e798e1df9c14", "parentControlId": 31090, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582821" }, { "id": 557718, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5dd72976-3417-5efd-9436-8d051c74caa0", "parentControlId": 31090, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582821" }, { "id": 557719, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "952c27f3-8f13-5e97-af79-8b74aa73e1b3", "parentControlId": 31090, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582821" }, { "id": 557720, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "308c7382-9a75-52b9-ab02-cd7ccc6e82f8", "parentControlId": 31090, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582822" }, { "id": 557721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76598261-7638-53d9-821a-3caa04d11f10", "parentControlId": 31090, "controlId": "T1213.003", "title": "T1213.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582822" }, { "id": 557722, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aef9c6f7-e720-5379-bc2a-2c2b0061b611", "parentControlId": 31090, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582822" }, { "id": 557723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a58a80ee-c22e-58d1-923d-7d40fdc1449d", "parentControlId": 31090, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582822" }, { "id": 557724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9564540a-8617-583e-94f3-f510d3b85c71", "parentControlId": 31090, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582822" }, { "id": 557725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46095f3d-7442-5205-a285-fe823fe3d038", "parentControlId": 31090, "controlId": "T1218.002", "title": "T1218.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582822" }, { "id": 557726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c2c19c3-ea16-53b8-ad36-27ff2866f766", "parentControlId": 31090, "controlId": "T1218.010", "title": "T1218.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582822" }, { "id": 557727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ce9eb1f-bdb2-5fe9-a8c1-3a7d74141c34", "parentControlId": 31090, "controlId": "T1218.011", "title": "T1218.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582822" }, { "id": 557728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25c4babc-926e-5a12-b01b-a35c4f464cb9", "parentControlId": 31090, "controlId": "T1218.012", "title": "T1218.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582822" }, { "id": 557729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdb519ed-5baf-53bc-af9a-eef9ab0b7945", "parentControlId": 31090, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582823" }, { "id": 557730, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582823", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76d0ad38-c6f4-5bf6-8d25-dddfaf9d7fcb", "parentControlId": 31090, "controlId": "T1219", "title": "T1219", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582823" }, { "id": 557731, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582823", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5732ecd-974b-5b0a-98ac-81dd704ec966", "parentControlId": 31090, "controlId": "T1221", "title": "T1221", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582823" }, { "id": 557732, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582823", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f8ae7e0-8776-58f0-916a-af99e8526891", "parentControlId": 31090, "controlId": "T1222", "title": "T1222", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582823" }, { "id": 557733, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582823", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd844abf-e627-566c-a331-7cbe3827519e", "parentControlId": 31090, "controlId": "T1222.001", "title": "T1222.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582823" }, { "id": 557734, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582823", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ff2cdb9-adf7-5a59-a387-5aa741257ef6", "parentControlId": 31090, "controlId": "T1222.002", "title": "T1222.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582823" }, { "id": 557735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582823", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4438a3fd-5508-5774-ad50-c1b3072f9a21", "parentControlId": 31090, "controlId": "T1489", "title": "T1489", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582823" }, { "id": 557736, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582823", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88a08f35-908a-597a-bc49-81b481be01c2", "parentControlId": 31090, "controlId": "T1498", "title": "T1498", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582823" }, { "id": 557737, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582823", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffdb08ba-55c0-5947-b230-0df9fbf4887d", "parentControlId": 31090, "controlId": "T1498.001", "title": "T1498.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582823" }, { "id": 557738, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582823", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5737645f-f357-5656-b444-515674324bbe", "parentControlId": 31090, "controlId": "T1498.002", "title": "T1498.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582823" }, { "id": 557739, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21a46466-8fe9-5d6b-bb34-a9ced8d0b110", "parentControlId": 31090, "controlId": "T1499", "title": "T1499", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582824" }, { "id": 557740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9516f52a-125a-5bb9-a762-755c6d2a6db8", "parentControlId": 31090, "controlId": "T1499.001", "title": "T1499.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582824" }, { "id": 557741, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8887c70e-460d-5468-923a-f3e848104b83", "parentControlId": 31090, "controlId": "T1499.002", "title": "T1499.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582824" }, { "id": 557742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fcaa0be-3ee5-5e69-b9ee-0ef084cc0e03", "parentControlId": 31090, "controlId": "T1499.003", "title": "T1499.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582824" }, { "id": 557743, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "052ac632-b7d9-5443-9456-3c4780567e90", "parentControlId": 31090, "controlId": "T1499.004", "title": "T1499.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582824" }, { "id": 557744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35e738e3-1dce-567d-8f09-3d37bd6b7f62", "parentControlId": 31090, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582824" }, { "id": 557745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71a91f18-0557-5a00-bc1a-66e1738bb4dc", "parentControlId": 31090, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582824" }, { "id": 557746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15b120bb-0b79-56b3-850f-8563f79b58d4", "parentControlId": 31090, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582824" }, { "id": 557747, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e848da44-a1c8-5a5b-b3b5-67bc4b900f62", "parentControlId": 31090, "controlId": "T1539", "title": "T1539", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582825" }, { "id": 557748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f38b3d20-e94a-5262-8e80-c92469dff996", "parentControlId": 31090, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582825" }, { "id": 557749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e987520-9d18-59e7-b4b3-7ed31c2644b2", "parentControlId": 31090, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582825" }, { "id": 557750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cce614d8-9d10-5818-8947-6754c1dece3e", "parentControlId": 31090, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582825" }, { "id": 557751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15728358-f920-59de-9f73-957b92627152", "parentControlId": 31090, "controlId": "T1543.002", "title": "T1543.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582825" }, { "id": 557752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a2c7d88-6b54-5d2f-9fb4-9a5d684a9706", "parentControlId": 31090, "controlId": "T1546.003", "title": "T1546.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582825" }, { "id": 557753, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e10286ac-40bd-5c3c-839b-e90f976b763a", "parentControlId": 31090, "controlId": "T1546.004", "title": "T1546.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582825" }, { "id": 557754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17d1e807-2900-52f2-9b9b-ed153ba1ba13", "parentControlId": 31090, "controlId": "T1546.013", "title": "T1546.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582825" }, { "id": 557755, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63790e00-351d-58fc-9abb-b8dca3e87161", "parentControlId": 31090, "controlId": "T1546.016", "title": "T1546.016", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582825" }, { "id": 557756, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39e8fcb3-93d6-50d4-933a-609b3942115c", "parentControlId": 31090, "controlId": "T1547.003", "title": "T1547.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582826" }, { "id": 557757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c291afc4-57ff-56ac-a4ee-d88e8c8e9b13", "parentControlId": 31090, "controlId": "T1547.013", "title": "T1547.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582826" }, { "id": 557758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08361635-c0d0-5ca2-802f-a11050ce2653", "parentControlId": 31090, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582826" }, { "id": 557759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf3e78a4-4c7c-5c3d-99ba-0274b1075975", "parentControlId": 31090, "controlId": "T1548.003", "title": "T1548.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582826" }, { "id": 557760, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34d8db5e-5868-5577-8210-b3b6b7adf6d6", "parentControlId": 31090, "controlId": "T1548.006", "title": "T1548.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582826" }, { "id": 557761, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26f85b01-39ac-5c52-87a9-90bde7be43ab", "parentControlId": 31090, "controlId": "T1550.003", "title": "T1550.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582826" }, { "id": 557762, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8d6a58b-2943-5013-8e98-a638b7f74860", "parentControlId": 31090, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582826" }, { "id": 557763, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46d47bd5-a5a0-5fee-9cd7-7fd1184efc6a", "parentControlId": 31090, "controlId": "T1552.001", "title": "T1552.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582826" }, { "id": 557764, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "522316a2-0fa0-5f6b-ad6f-457b212e9ca5", "parentControlId": 31090, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582826" }, { "id": 557765, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e92605c0-7a47-5ff6-8918-893133038235", "parentControlId": 31090, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582827" }, { "id": 557766, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c9128d0-f3a2-5089-9592-75f51f6c01a9", "parentControlId": 31090, "controlId": "T1552.005", "title": "T1552.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582827" }, { "id": 557767, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d043b2b-6e5e-5792-8ce2-f493ae922b73", "parentControlId": 31090, "controlId": "T1553.003", "title": "T1553.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582827" }, { "id": 557768, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09cf4fc3-1c6f-5fd6-af04-d65e1bacc623", "parentControlId": 31090, "controlId": "T1555", "title": "T1555", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582827" }, { "id": 557769, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20884b2a-c7f8-54b1-8593-08a6397f6c31", "parentControlId": 31090, "controlId": "T1555.001", "title": "T1555.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582827" }, { "id": 557770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bad476da-f3e9-55ac-9250-ae25299cd364", "parentControlId": 31090, "controlId": "T1555.002", "title": "T1555.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582827" }, { "id": 557771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13278b12-9cd6-545b-90fb-721b48108fb2", "parentControlId": 31090, "controlId": "T1556", "title": "T1556", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582827" }, { "id": 557772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "754fc9ae-ac58-5b9d-aab4-3e4865000e20", "parentControlId": 31090, "controlId": "T1556.001", "title": "T1556.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582827" }, { "id": 557773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f19b779-73cd-5d30-be45-ee99f77e3c0d", "parentControlId": 31090, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582828" }, { "id": 557774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a957bda-9f47-529a-95a8-dc5f20fd0053", "parentControlId": 31090, "controlId": "T1557.001", "title": "T1557.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582828" }, { "id": 557775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efa90858-3eb2-5f28-9ba6-53ae7da3feee", "parentControlId": 31090, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582828" }, { "id": 557776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4c3d55c-fd38-55e6-b4e7-74dfb667c5d3", "parentControlId": 31090, "controlId": "T1557.003", "title": "T1557.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582828" }, { "id": 557777, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "773d5abb-f7dd-51b9-9e1a-a044cb21a85c", "parentControlId": 31090, "controlId": "T1557.004", "title": "T1557.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582828" }, { "id": 557778, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "313e89e0-8b33-55ea-ad2a-0c221d6ad04d", "parentControlId": 31090, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582828" }, { "id": 557779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4fcb82b-af2b-5e4c-97c2-4b909f72aa70", "parentControlId": 31090, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582828" }, { "id": 557780, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10fa00b8-bca7-59a0-b16a-f1240329b4e1", "parentControlId": 31090, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582828" }, { "id": 557781, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd5c10e6-cceb-5b90-9a91-da35237384fe", "parentControlId": 31090, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582828" }, { "id": 557782, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8922f371-2dad-5ef5-abc4-aa40268c700b", "parentControlId": 31090, "controlId": "T1558.005", "title": "T1558.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582829" }, { "id": 557783, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "199073e4-eb6f-5042-b699-051b1f530ddc", "parentControlId": 31090, "controlId": "T1562", "title": "T1562", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582829" }, { "id": 557784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1ee5c61-0774-5173-a157-db58526acee0", "parentControlId": 31090, "controlId": "T1562.001", "title": "T1562.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582829" }, { "id": 557785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ee69db1-2e60-5710-8b02-477bb97101de", "parentControlId": 31090, "controlId": "T1562.002", "title": "T1562.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582829" }, { "id": 557786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "385a9174-20b2-5ccf-a0d4-bff63cf83189", "parentControlId": 31090, "controlId": "T1562.004", "title": "T1562.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582829" }, { "id": 557787, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "987b10fb-39ec-5b2d-90ae-8531fee6b411", "parentControlId": 31090, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582829" }, { "id": 557788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f26410e-c12d-5e5f-95bf-708fff702b75", "parentControlId": 31090, "controlId": "T1563.001", "title": "T1563.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582829" }, { "id": 557789, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d21cb8b-f225-5ed0-8f7f-2a7d709df5c2", "parentControlId": 31090, "controlId": "T1564.004", "title": "T1564.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582829" }, { "id": 557790, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92585aa0-804a-5c4e-a121-851674961cba", "parentControlId": 31090, "controlId": "T1564.010", "title": "T1564.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582829" }, { "id": 557791, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c21453e6-3475-5401-938e-ba9fb46aedb2", "parentControlId": 31090, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58283" }, { "id": 557792, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78709890-488b-5444-bbd1-48f427222e31", "parentControlId": 31090, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58283" }, { "id": 557793, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "355fd12a-a89f-5b18-bbf8-a4f57c944df4", "parentControlId": 31090, "controlId": "T1565.003", "title": "T1565.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58283" }, { "id": 557794, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8638bf11-f216-5145-9afe-0ebb6ba20785", "parentControlId": 31090, "controlId": "T1566", "title": "T1566", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58283" }, { "id": 557795, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "067971a1-7d53-5a75-9740-c4124212a045", "parentControlId": 31090, "controlId": "T1566.001", "title": "T1566.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58283" }, { "id": 557796, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4043df71-df83-5344-a427-c0cf8f336dc3", "parentControlId": 31090, "controlId": "T1566.002", "title": "T1566.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58283" }, { "id": 557797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3202773-79d7-5790-8aa7-48fae8a72bd9", "parentControlId": 31090, "controlId": "T1566.003", "title": "T1566.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58283" }, { "id": 557798, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95959cf4-2da9-5b16-ad9c-1bdb7d4aab3a", "parentControlId": 31090, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58283" }, { "id": 557799, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea540b87-288a-59a5-9aa8-b5dea71e068f", "parentControlId": 31090, "controlId": "T1568", "title": "T1568", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58283" }, { "id": 557800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e659885-f62f-5d8d-a82a-4442d0d4f08a", "parentControlId": 31090, "controlId": "T1568.002", "title": "T1568.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582831" }, { "id": 557801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62effb63-6c7e-5de6-9b39-f8a2a80c8e9f", "parentControlId": 31090, "controlId": "T1569", "title": "T1569", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582831" }, { "id": 557802, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c5bdde3-fd37-584d-8388-eaca11b0a3c3", "parentControlId": 31090, "controlId": "T1569.002", "title": "T1569.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582831" }, { "id": 557803, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82cb9307-7df2-549c-bd31-bb5fe16a4e34", "parentControlId": 31090, "controlId": "T1570", "title": "T1570", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582831" }, { "id": 557804, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18889a40-7d4a-5fdc-aaef-9afdbeeccb74", "parentControlId": 31090, "controlId": "T1571", "title": "T1571", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582831" }, { "id": 557805, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e4f576b-852e-5259-883f-f20dc60d4c43", "parentControlId": 31090, "controlId": "T1572", "title": "T1572", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582831" }, { "id": 557806, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91fd0b5a-f630-5dc3-993b-981e14b7339a", "parentControlId": 31090, "controlId": "T1573", "title": "T1573", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582831" }, { "id": 557807, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa850454-771f-5720-8cc3-e5b8acba9c21", "parentControlId": 31090, "controlId": "T1573.001", "title": "T1573.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582831" }, { "id": 557808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7548916f-4780-53c4-b2c4-0f0633d50f57", "parentControlId": 31090, "controlId": "T1573.002", "title": "T1573.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582831" }, { "id": 557809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5acaad9-aeec-57ab-a7a6-195cc444ce3c", "parentControlId": 31090, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582832" }, { "id": 557810, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4d0d2a0-4459-5570-b0f6-7414a477ee40", "parentControlId": 31090, "controlId": "T1574.004", "title": "T1574.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582832" }, { "id": 557811, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "640418de-634d-5d36-84d6-d5cc467624cf", "parentControlId": 31090, "controlId": "T1574.007", "title": "T1574.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582832" }, { "id": 557812, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bed725d-f1f7-526b-9042-1d513c3570eb", "parentControlId": 31090, "controlId": "T1574.008", "title": "T1574.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582832" }, { "id": 557813, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e17157c6-3bd8-5e45-8fb4-3181e647b41f", "parentControlId": 31090, "controlId": "T1574.009", "title": "T1574.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582832" }, { "id": 557814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88f57e5a-11cd-5f6f-b62a-3b57056d2a93", "parentControlId": 31090, "controlId": "T1574.013", "title": "T1574.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582832" }, { "id": 557815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ac875a7-45a5-54cd-a30c-fa207bea3e97", "parentControlId": 31090, "controlId": "T1574.014", "title": "T1574.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582832" }, { "id": 557816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582845", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afd7dba5-c8d4-5acf-89ea-6f3ba2ad5b95", "parentControlId": 31090, "controlId": "T1598", "title": "T1598", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582845" }, { "id": 557817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582845", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58ea5195-b802-5f13-934e-6acc28a199bd", "parentControlId": 31090, "controlId": "T1598.001", "title": "T1598.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582845" }, { "id": 557818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582845", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce99e916-f2fb-5452-ae98-c40ffde06b83", "parentControlId": 31090, "controlId": "T1598.002", "title": "T1598.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582845" }, { "id": 557819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7b058b4-d8fd-5410-9ef0-d69e9b26e60d", "parentControlId": 31090, "controlId": "T1598.003", "title": "T1598.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582846" }, { "id": 557820, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a175d67d-cd12-5fc9-86f0-85800b5039e6", "parentControlId": 31090, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582846" }, { "id": 557821, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57cca3f3-5856-50d0-a981-4445a06ffc95", "parentControlId": 31090, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582846" }, { "id": 557822, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf6b1331-ae3f-5c90-b002-fadba66e8da4", "parentControlId": 31090, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582846" }, { "id": 557823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83211ffb-eec9-56e9-95e4-dca53c4ae6f7", "parentControlId": 31090, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582846" }, { "id": 557824, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "151f1eca-a54f-5b08-8b8e-153372eac555", "parentControlId": 31090, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582846" }, { "id": 557825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9be78948-72fe-59cf-8ca1-3113ef9eb586", "parentControlId": 31090, "controlId": "T1622", "title": "T1622", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582846" }, { "id": 557826, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66a0ed47-825c-5560-9559-26fbaaee14ee", "parentControlId": 31090, "controlId": "T1647", "title": "T1647", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582846" }, { "id": 557833, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "190dfd6d-4ac0-5e0a-9a2e-d6d02bec1d8e", "parentControlId": 31090, "controlId": "CA-7", "title": "CA-7", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582847" }, { "id": 557834, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a262eec0-8338-548f-a713-c00313282519", "parentControlId": 31090, "controlId": "CA-7(1)", "title": "CA-7(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582847" }, { "id": 557835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "088e71e8-abeb-5ae9-8cdc-4d5971eb7b9e", "parentControlId": 31090, "controlId": "PM-14", "title": "PM-14", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582847" }, { "id": 557836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582848", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c7b736f-e4cf-5bc7-bcba-300bf9f9bace", "parentControlId": 31090, "controlId": "CA-07", "title": "CA-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582848" }, { "id": 557837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582848", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4af615de-a285-530d-93ab-9d17881bb26f", "parentControlId": 31090, "controlId": "CA-07(01)", "title": "CA-07(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582848" }, { "id": 557838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582848", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c8e62c0-c9d4-5975-9cbc-6360e24ba0f5", "parentControlId": 31090, "controlId": "PM-14", "title": "PM-14", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582848" }, { "id": 557842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87bff7cd-263b-5098-9689-e166fc9b6e40", "parentControlId": 31090, "controlId": "CA-07", "title": "CA-07", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582849" }, { "id": 557843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f3ad3bd-5b30-564c-8dd0-f129ac3a6b65", "parentControlId": 31090, "controlId": "CA-07(01)", "title": "CA-07(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582849" }, { "id": 557845, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc0dc682-e363-5af9-9024-425dfe816113", "parentControlId": 31090, "controlId": "CA-07", "title": "CA-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582849" }, { "id": 557846, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9dd0bd1-bf41-52e3-893d-3f0f7b198969", "parentControlId": 31090, "controlId": "CA-07(01)", "title": "CA-07(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582849" }, { "id": 557847, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5066e87-6d89-5ee8-a075-367a23efc36a", "parentControlId": 31090, "controlId": "PM-14", "title": "PM-14", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582849" }, { "id": 557848, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "435accda-49b9-5ce0-aefc-4eac77e7613d", "parentControlId": 31090, "controlId": "CA-07", "title": "CA-07", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582849" }, { "id": 557849, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4002d03a-1050-557b-8680-a2bc6a955eb0", "parentControlId": 31090, "controlId": "PM-14", "title": "PM-14", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582849" }, { "id": 557850, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4a608b8-b8ba-53dd-803f-f949eec27ae6", "parentControlId": 31090, "controlId": "CA-07", "title": "CA-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582849" }, { "id": 557851, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e6bfe3a-80fd-5518-854b-5e43ef00cf8a", "parentControlId": 31090, "controlId": "PM-14", "title": "PM-14", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582849" }, { "id": 557852, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5084a063-4fa5-5c27-9d31-cdf7beefa48b", "parentControlId": 31090, "controlId": "CA-07", "title": "CA-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58285" }, { "id": 557853, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f688078c-85bf-5a60-bc3b-cd45ceecba63", "parentControlId": 31090, "controlId": "PM-14", "title": "PM-14", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58285" }, { "id": 557854, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b73ddd4-bd73-5d2f-bbdd-9bbba0109975", "parentControlId": 31090, "controlId": "CA-7", "title": "CA-7", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58285" }, { "id": 557855, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "201041a0-02bf-5511-903b-fde73b81f10e", "parentControlId": 31090, "controlId": "PM-14", "title": "PM-14", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58285" }, { "id": 557858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "853a30f5-15c9-554c-abc9-b57345648cd5", "parentControlId": 31090, "controlId": "3.12.1", "title": "3.12.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58285" }, { "id": 557859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "571525ba-6f95-53d8-bfcc-7aa9f9b7e31f", "parentControlId": 31090, "controlId": "3.12.3", "title": "3.12.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58285" }, { "id": 557860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b492976d-96ef-5014-91f9-17d8ccb0dc91", "parentControlId": 31090, "controlId": "03.12.01", "title": "03.12.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58285" }, { "id": 557861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582851", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76f7efbe-2e2a-5445-b697-a3884cd648c0", "parentControlId": 31090, "controlId": "03.12.03", "title": "03.12.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582851" }, { "id": 557868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582851", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8a51ccb-5864-5bd1-9ce9-478304c0ad97", "parentControlId": 31090, "controlId": "GV.OC-03", "title": "GV.OC-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582851" }, { "id": 557912, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582856", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9aad0843-ba16-5983-8143-1d5c85813715", "parentControlId": 31090, "controlId": "RISK-4c", "title": "RISK-4c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582856" }, { "id": 557913, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582856", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5610add7-d691-5a5c-844a-f831fc74a330", "parentControlId": 31090, "controlId": "ARCHITECTURE-1i", "title": "ARCHITECTURE-1i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582857" }, { "id": 557914, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582857", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "727b8c9d-612f-5722-933e-ec97c0ee721c", "parentControlId": 31090, "controlId": "PROGRAM-2h", "title": "PROGRAM-2h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582857" }, { "controlId": "A.4.2.4", "title": "A.4.2.4 — Updating Cyber Security Practices", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-1, SI-5, CA-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "e38cd5dc-c97d-52e3-a3bf-9ffbac1fa7c0", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.4", "title": "NEI 08-09 Sec 4.2.4 — Updating Cyber Security Practices", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e92212f1-f0f3-5a56-b54d-f2858e8577e8", "isPublic": true }, { "controlId": "10 CFR 73.54(g)", "title": "10 CFR 73.54(g) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "41681550-e85d-5e50-8efe-954356c78d17", "isPublic": true }, { "controlId": "C.13.3", "title": "C.13.3 — Corrective Action Program", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-5, IR-4, PM-14", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "34145fc0-c1cf-5b0d-8ab2-14806f50761d", "isPublic": true }, { "controlId": "NEI 08-09 App E.13.3 (CAP)", "title": "NEI 08-09 App E.13.3 (CAP) — Corrective Action Program", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.13.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "fa4e27a1-eee6-59eb-9b5e-f6d5fe88ec3a", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3), 73.55(b)(10)", "title": "10 CFR 73.54(d)(3), 73.55(b)(10) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.13.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "654ba92f-74fd-5016-9e9b-173effda2066", "isPublic": true } ], "id": 31090, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730954", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730954", "catalogueId": 1062, "uuid": "28960602-9b12-5153-a69d-91d5e587c2c9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Security, Compliance & Resilience Controls Oversight", "description": "

Control Description

Mechanisms exist to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.

Evidence Request List (ERL)

E-CPL-07\nE-CPL-09\nE-GOV-04\nE-GOV-05\nE-GOV-06\nE-GOV-13\nE-RSK-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Compliance (CPL) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Compliance management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Compliance management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ External compliance requirements for cybersecurity and data privacy are identified and documented, based on applicable laws, regulations and contractual obligations.\n▪ IT and/or cybersecurity personnel use an entity-defined set of controls to conduct cybersecurity and data protection control assessments.\n▪ A formal report is generated for each security assessment/audit with sufficient details to understand the organization's ability to demonstrate conformity with its requirements.

Level 3 - Well Defined: Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide a security, compliance and resilience controls oversight function that reports to the organization's executive leadership.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.2.4, C.13.3", "controlId": "CPL-02", "family": "Compliance", "enhancements": "", "sortId": "CPL-02", "references": "

Micro-Small Business (<10 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Small Business (10-49 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Medium Business (50-249 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Steering committee

Large Business (250-999 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Steering committee

Enterprise (>1,000 staff)

∙ SCF Security, Compliance & Resilience Management System (SCRMS)\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)\n∙ Steering committee", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70094, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59012", "securityControlId": 31091, "ccis": [], "uuid": "ef30a634-eb38-5521-a7fc-662d1479b3ae", "testId": "CPL-02.1_A01", "test": "an internal audit function exists that is comprised of stakeholders who have the subject matter expertise to serve in an advisory capability on audit-related matters.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70095, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59012", "securityControlId": 31091, "ccis": [], "uuid": "3f4e1acf-6277-52f0-8341-055b1b352fa0", "testId": "CPL-02.1_A02", "test": "an internal audit function formally defines audit-related priorities for the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70096, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59012", "securityControlId": 31091, "ccis": [], "uuid": "37188018-58e9-5d65-9fb4-7da934c39ca2", "testId": "CPL-02.1_A03", "test": "an internal audit function tracks audit findings that require remediation efforts.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70097, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590121", "securityControlId": 31091, "ccis": [], "uuid": "e9c1040b-0f40-5081-9217-052abe292cea", "testId": "CPL-02.1_A04", "test": "an internal audit function provides the organization's executive leadership with insights into the appropriateness of the organization's technology and information governance processes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70098, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590121", "securityControlId": 31091, "ccis": [], "uuid": "c36ef9f1-09fe-52e0-9dee-90fe4e2046a8", "testId": "CPL-02.1_A05", "test": "the frequency at which to assess the security requirements for the system and its environment of operation is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least every 12 months and after any significant incidents or significant changes occur", "otherId": "171A_R3_A.03.12.01.ODP[01]", "defaultText": null } ], "externalMappings": [ { "id": 558110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "965f45f7-f3e2-513f-b5ba-8e349601cce6", "parentControlId": 31091, "controlId": "9.2.1", "title": "9.2.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58288" }, { "id": 558111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2c2babd-f35f-541b-aa7e-1c2bdb31d843", "parentControlId": 31091, "controlId": "9.2.1(a)(1)", "title": "9.2.1(a)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58288" }, { "id": 558112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10cbdc5e-8579-5965-b380-0855508e5a45", "parentControlId": 31091, "controlId": "9.2.1(a)(2)", "title": "9.2.1(a)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58288" }, { "id": 558113, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "450e0a93-4e7c-5098-bf1f-1c8ef487ec62", "parentControlId": 31091, "controlId": "9.2.1(b)", "title": "9.2.1(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58288" }, { "id": 558114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "265b528f-d041-5685-b427-0ad5115f9e10", "parentControlId": 31091, "controlId": "9.2.2", "title": "9.2.2", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58288" }, { "id": 558115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56b329a0-3258-56a8-bf94-4e35f999adfc", "parentControlId": 31091, "controlId": "9.2.2(a)", "title": "9.2.2(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58288" }, { "id": 558116, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1a5b903-8d56-56fb-8227-b36e87bfc277", "parentControlId": 31091, "controlId": "9.2.2(b)", "title": "9.2.2(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582881" }, { "id": 558117, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67812f2e-51ce-5f9d-9f53-2dd02784989c", "parentControlId": 31091, "controlId": "9.2.2(c)", "title": "9.2.2(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582881" }, { "id": 558118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fd0cf8a-7369-56f5-8520-126037ea0b52", "parentControlId": 31091, "controlId": "5.35", "title": "5.35", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582881" }, { "id": 558119, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c085bfc-0f9b-514d-81cc-cfb9aa505fcc", "parentControlId": 31091, "controlId": "8.34", "title": "8.34", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582881" }, { "id": 558137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582883", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cd9bba9-d940-535e-99c1-d6f1c4c60996", "parentControlId": 31091, "controlId": "3.12.1", "title": "3.12.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582883" }, { "id": 558138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582883", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e4ba6fa-2ab7-5e62-bf49-a10ad93324c4", "parentControlId": 31091, "controlId": "03.12.01", "title": "03.12.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582883" } ], "id": 31091, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730955", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730955", "catalogueId": 1062, "uuid": "47909bb2-0ea4-5856-8d47-864d4b206c0b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement an internal audit function that is capable of providing senior organization management with insights into the appropriateness of its technology and information governance processes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Internal Audit Function", "description": "

Control Description

Mechanisms exist to implement an internal audit function that is capable of providing senior organization management with insights into the appropriateness of the organization's technology and information governance processes.

Evidence Request List (ERL)

E-CPL-04\nE-CPL-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement an internal audit function that is capable of providing senior organization management with insights into the appropriateness of the organization's technology and information governance processes.

Level 4 - Quantitatively Controlled: Compliance (CPL) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CPL-02.1", "family": "Compliance", "enhancements": "", "sortId": "CPL-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Internal audit program

Small Business (10-49 staff)

∙ Internal audit program

Medium Business (50-249 staff)

∙ Internal audit program

Large Business (250-999 staff)

∙ Internal audit program

Enterprise (>1,000 staff)

∙ Internal audit program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70102, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590122", "securityControlId": 31094, "ccis": [], "uuid": "fc662f96-c167-5096-b62f-d267b9e0c45f", "testId": "CPL-03_A01", "test": "the frequency at which to assess controls in the system and its environment of operation is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-02_ODP[01]", "defaultText": null }, { "id": 70103, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590122", "securityControlId": 31094, "ccis": [], "uuid": "dfe8e710-2004-5650-8405-43a88c87d0fd", "testId": "CPL-03_A02", "test": "an appropriate assessor or assessment team is selected for the type of assessment to be conducted.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02a.", "defaultText": null }, { "id": 70104, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590122", "securityControlId": 31094, "ccis": [], "uuid": "8e0ca5e7-ec13-5d51-a43b-996e24fddf19", "testId": "CPL-03_A03", "test": "the security requirements for the system and its environment of operation are assessed per an organization-defined frequency to determine if the requirements have been satisfied.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "SCF Created", "defaultText": null }, { "id": 70105, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590122", "securityControlId": 31094, "ccis": [], "uuid": "c9e92d66-47b3-527b-9d67-da259a4079ee", "testId": "CPL-03_A04", "test": "individuals or roles to whom control assessment results are to be provided are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02_ODP[02]", "defaultText": null }, { "id": 70106, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590122", "securityControlId": 31094, "ccis": [], "uuid": "cd3bf913-6e5c-5679-87b5-17145a94106f", "testId": "CPL-03_A05", "test": "a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02b.01", "defaultText": null }, { "id": 70107, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590122", "securityControlId": 31094, "ccis": [], "uuid": "0ac91fff-a69f-5188-af74-001b5124d48a", "testId": "CPL-03_A06", "test": "a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02b.02", "defaultText": null }, { "id": 70108, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590123", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590123", "securityControlId": 31094, "ccis": [], "uuid": "670fbb7a-3a3a-5f34-948b-a0ab1b61f33d", "testId": "CPL-03_A07", "test": "a control assessment plan is developed that describes the scope of the assessment, including the assessment environment.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02b.03[01]", "defaultText": null }, { "id": 70109, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590123", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590123", "securityControlId": 31094, "ccis": [], "uuid": "60aa43fb-6d85-5e04-bbca-f2f7666687f2", "testId": "CPL-03_A08", "test": "a control assessment plan is developed that describes the scope of the assessment, including the assessment team.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02b.03[02]", "defaultText": null }, { "id": 70110, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590123", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590123", "securityControlId": 31094, "ccis": [], "uuid": "4fd1190c-b8f4-5b5a-b4bd-c1e02886302a", "testId": "CPL-03_A09", "test": "a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02b.03[03]", "defaultText": null }, { "id": 70111, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590123", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590123", "securityControlId": 31094, "ccis": [], "uuid": "d3b197c0-2390-5d88-95de-313189210c04", "testId": "CPL-03_A10", "test": "the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02c.", "defaultText": null }, { "id": 70112, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590124", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590124", "securityControlId": 31094, "ccis": [], "uuid": "8d6d78df-f254-5d6f-ac2a-5f27acf65a24", "testId": "CPL-03_A11", "test": "the security requirements for the system and its environment of operation are assessed to determine if the requirements have been satisfied.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months, or when there are significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.12.01", "defaultText": null } ], "externalMappings": [ { "id": 558243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd83fdcb-0314-5d22-adba-6c601f7c644e", "parentControlId": 31094, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582904" }, { "id": 558244, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eea0e6c9-4527-5936-b1b8-c91799768e70", "parentControlId": 31094, "controlId": "9.1", "title": "9.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582904" }, { "id": 558245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "281161f2-58f6-57c7-9822-1ae54d641cfd", "parentControlId": 31094, "controlId": "9.1(a)", "title": "9.1(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582904" }, { "id": 558246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3469eb5e-3903-53f6-bebf-fcce337f16ae", "parentControlId": 31094, "controlId": "9.1(b)", "title": "9.1(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582904" }, { "id": 558247, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2bc2584-e8fb-5600-9ca2-7db0cd98f2bc", "parentControlId": 31094, "controlId": "9.1(c)", "title": "9.1(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582905" }, { "id": 558248, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0fc9a370-0492-570d-923c-18629a662f73", "parentControlId": 31094, "controlId": "9.1(d)", "title": "9.1(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582905" }, { "id": 558249, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7336e465-0d25-5458-a17b-d77c8f684a8f", "parentControlId": 31094, "controlId": "9.1(e)", "title": "9.1(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582905" }, { "id": 558250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d195248f-1c86-580a-aaae-12eef90a28d7", "parentControlId": 31094, "controlId": "9.1(f)", "title": "9.1(f)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582905" }, { "id": 558251, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e78642d2-b99b-58cf-b5eb-185f0ac4e095", "parentControlId": 31094, "controlId": "5.35", "title": "5.35", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582905" }, { "id": 558252, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f4bf020-bb21-5bf4-92c6-4d97b79ed211", "parentControlId": 31094, "controlId": "5.36", "title": "5.36", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582905" }, { "id": 558253, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18ab8f8c-54ae-51d9-895e-3849c994fb05", "parentControlId": 31094, "controlId": "8.34", "title": "8.34", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582905" }, { "id": 558266, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1fb1740-d25c-5a90-a503-c2917ef96f5e", "parentControlId": 31094, "controlId": "CA-2", "title": "CA-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582907" }, { "id": 558267, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76340352-35a9-5bce-afe5-03f586cef899", "parentControlId": 31094, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582907" }, { "id": 558269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "946f013d-d91f-5e4c-b370-dfac1993ecbe", "parentControlId": 31094, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582907" }, { "id": 558271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a56e641-dcce-5ae7-bcde-90bb97f2dbea", "parentControlId": 31094, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582907" }, { "id": 558272, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5bac1cf-ffe6-5eeb-8523-4eb82b359ae3", "parentControlId": 31094, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582908" }, { "id": 558273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2518989-6024-59ac-b1ea-678f5214bbfa", "parentControlId": 31094, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582908" }, { "id": 558274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60eb0688-77e2-5302-a6e5-850db47c1385", "parentControlId": 31094, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582908" }, { "id": 558275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5a68535-374e-50d1-aac5-f1d43d06e6c9", "parentControlId": 31094, "controlId": "CA-2", "title": "CA-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582908" }, { "id": 558276, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb2e11cd-551d-5b70-abf6-1031d7d6fa8c", "parentControlId": 31094, "controlId": "CA-2", "title": "CA-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582908" }, { "id": 558279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca155f43-e709-5c14-8627-fdce550a0054", "parentControlId": 31094, "controlId": "3.12.1", "title": "3.12.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582908" }, { "id": 558280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "108e0e5a-1192-572d-96d8-bf556dad8873", "parentControlId": 31094, "controlId": "03.12.01", "title": "03.12.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582908" }, { "id": 558281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70af6c0f-a713-5216-b911-7aa5841007b6", "parentControlId": 31094, "controlId": "03.12.03", "title": "03.12.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582909" }, { "id": 558284, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b582dd9f-a30f-579d-936b-78db4532fb03", "parentControlId": 31094, "controlId": "ID.IM-01", "title": "ID.IM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582909" }, { "id": 558285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95e20fdc-c47a-5c06-8f6e-75a3f0b292d7", "parentControlId": 31094, "controlId": "ID.IM-02", "title": "ID.IM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582909" } ], "id": 31094, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730961", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730961", "catalogueId": 1062, "uuid": "ca4375a0-4d44-5921-a76b-9c3bea1cf120", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization regularly review processes and documented procedures to ensure conformity with the organization's security, compliance and/or resilience policies, standards and other applicable requirements?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 10.0, "title": "Security, Compliance & Resilience Assessments", "description": "

Control Description

Mechanisms exist to regularly review processes and documented procedures to ensure conformity with the organization's security, compliance and/or resilience policies, standards and other applicable requirements.

Evidence Request List (ERL)

E-CPL-05\nE-CPL-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Compliance (CPL) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CPL domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Compliance management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Compliance efforts are narrowly-limited to certain compliance requirements.\n▪ IT and/or cybersecurity personnel use an informal process to govern statutory, regulatory and contractual compliance obligations. \n▪ IT and/or cybersecurity personnel self-identify a set of controls that are used to conduct cybersecurity and data privacy control assessments. \n▪ For specific statutory, regulatory and/or contractual obligations, stakeholders may contract with a third-party auditor/assessor to perform an independent assessment of cybersecurity and data protection controls.

Level 2 - Planned & Tracked: Compliance (CPL) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Compliance management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Compliance management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ External compliance requirements for cybersecurity and data privacy are identified and documented, based on applicable laws, regulations and contractual obligations.\n▪ IT and/or cybersecurity personnel use an entity-defined set of controls to conduct cybersecurity and data protection control assessments.

Level 3 - Well Defined: Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to regularly review processes and documented procedures to ensure conformity with the organization's security, compliance and/or resilience policies, standards and other applicable requirements.

Level 4 - Quantitatively Controlled: Compliance (CPL) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CPL-03", "family": "Compliance", "enhancements": "", "sortId": "CPL-03", "references": "

Micro-Small Business (<10 staff)

∙ Information Assurance Program (IAP)\n∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Small Business (10-49 staff)

∙ Information Assurance Program (IAP)\n∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Medium Business (50-249 staff)

∙ Information Assurance Program (IAP)\n∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Large Business (250-999 staff)

∙ Information Assurance Program (IAP)\n∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Enterprise (>1,000 staff)

∙ Information Assurance Program (IAP)\n∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)\n∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70113, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590124", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590124", "securityControlId": 31095, "ccis": [], "uuid": "41b7e077-ba07-55e3-84f1-32a42b88ce0a", "testId": "CPL-03.1_A01", "test": "independent assessors or assessment teams are employed to monitor in-scope controls on an ongoing basis.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-07(01)", "defaultText": null } ], "externalMappings": [ { "id": 558432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582926", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7e16806-1ac7-51db-9788-f05b19d438be", "parentControlId": 31095, "controlId": "5.35", "title": "5.35", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582926" }, { "id": 558436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582927", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f05eaea-b1c8-530b-b124-490e1a59f703", "parentControlId": 31095, "controlId": "CA-7(1)", "title": "CA-7(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582927" }, { "id": 558437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582927", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05942678-7d80-5ce1-87fc-3ae353dd18d9", "parentControlId": 31095, "controlId": "CA-07(01)", "title": "CA-07(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582927" }, { "id": 558439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582927", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a022263-f25b-5587-ab7a-b594775ab221", "parentControlId": 31095, "controlId": "CA-07(01)", "title": "CA-07(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582927" }, { "id": 558440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582927", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7424e4cb-908e-509d-b410-dfd17724bd10", "parentControlId": 31095, "controlId": "CA-07(01)", "title": "CA-07(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582927" }, { "id": 558441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582927", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fcc50c76-616b-59a4-b751-b18d8de4e920", "parentControlId": 31095, "controlId": "CA-07(01)", "title": "CA-07(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582927" }, { "id": 558442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582927", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "233744de-79d7-5ea3-81b7-18b35bd94dfc", "parentControlId": 31095, "controlId": "CA-07(01)", "title": "CA-07(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582927" }, { "id": 558443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582928", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b63fe424-8fc4-5d08-b8ef-1a7fc8b86ffe", "parentControlId": 31095, "controlId": "NFO - CA-7(1)", "title": "NFO - CA-7(1)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582928" } ], "id": 31095, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730962", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730962", "catalogueId": 1062, "uuid": "3498e0f5-d35f-59cf-b26f-14cafdfb5bf3", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize independent assessors to evaluate security, compliance and resilience at planned intervals or when the Technology Asset, Application and/or Service (TAAS) undergoes significant changes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Independent Assessors", "description": "

Control Description

Mechanisms exist to utilize independent assessors to evaluate security, compliance and resilience at planned intervals or when the Technology Asset, Application and/or Service (TAAS) undergoes significant changes.

Evidence Request List (ERL)

E-CPL-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Compliance (CPL) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CPL domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Compliance management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Compliance efforts are narrowly-limited to certain compliance requirements.\n▪ IT and/or cybersecurity personnel use an informal process to govern statutory, regulatory and contractual compliance obligations. \n▪ For specific statutory, regulatory and/or contractual obligations, stakeholders may contract with a third-party auditor/assessor to perform an independent assessment of cybersecurity and data protection controls.

Level 2 - Planned & Tracked: Compliance (CPL) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Compliance management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Compliance management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ External compliance requirements for cybersecurity and data privacy are identified and documented, based on applicable laws, regulations and contractual obligations.\n▪ IT and/or cybersecurity use an impartial member of its team or a third-party assessor to perform an independent assessment of cybersecurity and data protection controls.

Level 3 - Well Defined: Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize independent assessors to evaluate security, compliance and resilience at planned intervals or when the Technology Asset, Application and/or Service (TAAS) undergoes significant changes.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CPL-03.1", "family": "Compliance", "enhancements": "", "sortId": "CPL-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Information Assurance Program (IAP)\n∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)

Small Business (10-49 staff)

∙ Information Assurance Program (IAP)\n∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)

Medium Business (50-249 staff)

∙ Information Assurance Program (IAP)\n∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)

Large Business (250-999 staff)

∙ Information Assurance Program (IAP)\n∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)

Enterprise (>1,000 staff)

∙ Information Assurance Program (IAP)\n∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70114, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590124", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590124", "securityControlId": 31096, "ccis": [], "uuid": "5cb820e3-f780-5957-9402-0b4a96df1048", "testId": "CPL-03.2_A01", "test": "controls are assessed in the system and its environment of operation per an organization-defined assessment frequency to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting established security requirements.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-02d.[01]", "defaultText": null }, { "id": 70115, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590124", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590124", "securityControlId": 31096, "ccis": [], "uuid": "db7a23e0-3872-5421-9803-889ce29889f3", "testId": "CPL-03.2_A02", "test": "a control assessment report is produced that documents the results of the assessment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02e.", "defaultText": null }, { "id": 70116, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590125", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590125", "securityControlId": 31096, "ccis": [], "uuid": "12983b5d-ec08-5785-b837-90994276b14f", "testId": "CPL-03.2_A03", "test": "controls are assessed in the system and its environment of operation per an organization-defined assessment frequency to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting established privacy requirements.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-02d.[02]", "defaultText": null }, { "id": 70117, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590125", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590125", "securityControlId": 31096, "ccis": [], "uuid": "a47987e4-7f7c-5475-919b-28e0270b6446", "testId": "CPL-03.2_A04", "test": "the results of the control assessment are provided to individuals or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02f.", "defaultText": null }, { "id": 70118, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590125", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590125", "securityControlId": 31096, "ccis": [], "uuid": "0982ba02-fa08-54d3-93ea-ee9a14aa505d", "testId": "CPL-03.2_A05", "test": "a system-level continuous monitoring strategy is implemented.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.12.03[02]", "defaultText": null } ], "externalMappings": [ { "id": 558519, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "796061b2-b8bc-5ee7-96ad-f16a9b4b0b5e", "parentControlId": 31096, "controlId": "5.35", "title": "5.35", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582945" }, { "id": 558520, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efa61e89-54bb-5568-9dbf-f7e137aaad40", "parentControlId": 31096, "controlId": "5.36", "title": "5.36", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582945" }, { "id": 558521, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "164e464f-5124-5498-ba79-e845b3ea4bcc", "parentControlId": 31096, "controlId": "8.8", "title": "8.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582945" }, { "id": 558532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582946", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03e670e2-fe97-5e6b-a763-95f33249d4f5", "parentControlId": 31096, "controlId": "CA-2", "title": "CA-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582946" }, { "id": 558533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582946", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "036a0982-86d5-52af-bdcb-8e40637b54ca", "parentControlId": 31096, "controlId": "RA-3", "title": "RA-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582946" }, { "id": 558534, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1228c1b-5cdb-5306-a5eb-477602ae873b", "parentControlId": 31096, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582947" }, { "id": 558535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d412ddb-360a-57d0-9d83-1cb8c83eef15", "parentControlId": 31096, "controlId": "RA-03", "title": "RA-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582947" }, { "id": 558538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "006b90b6-18ec-50f3-b887-74f9d772c12f", "parentControlId": 31096, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582947" }, { "id": 558539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fb81a15-3814-5d04-b657-f5f827f2e001", "parentControlId": 31096, "controlId": "RA-03", "title": "RA-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582947" }, { "id": 558541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89ed29e9-2cbe-58cd-90a7-dd9d7083ee35", "parentControlId": 31096, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582948" }, { "id": 558542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd85cce1-715b-56d6-97e6-a28954a4e796", "parentControlId": 31096, "controlId": "RA-03", "title": "RA-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582948" }, { "id": 558543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87e5d431-22d3-5b5c-9ce6-3cacf8ba51b1", "parentControlId": 31096, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582948" }, { "id": 558544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b12a1226-6f34-5efc-a581-992566dc118b", "parentControlId": 31096, "controlId": "RA-03", "title": "RA-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582948" }, { "id": 558545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "251ad0ac-0a4a-5e2c-9161-2450e5d47dae", "parentControlId": 31096, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582948" }, { "id": 558546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "461c0e0e-5cf8-5e6e-aa9f-d5975e2c9232", "parentControlId": 31096, "controlId": "RA-03", "title": "RA-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582948" }, { "id": 558547, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ec67081-8290-5d40-a1f9-52c54b78b007", "parentControlId": 31096, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582948" }, { "id": 558548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17460ba5-3017-5181-9c05-5c764d10f9b3", "parentControlId": 31096, "controlId": "RA-03", "title": "RA-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582948" }, { "id": 558549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa2e60f6-4bfe-5afd-a456-2101be045e79", "parentControlId": 31096, "controlId": "CA-2", "title": "CA-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582948" }, { "id": 558550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34ddcd88-2292-564c-b06f-bbc120b8ae5b", "parentControlId": 31096, "controlId": "RA-3", "title": "RA-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582949" }, { "id": 558551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f32d28a-1c1c-5608-8871-0e0e59dc6312", "parentControlId": 31096, "controlId": "CA-2", "title": "CA-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582949" }, { "id": 558552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab71ff26-bab5-5515-863b-15490d316bcd", "parentControlId": 31096, "controlId": "RA-3", "title": "RA-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582949" }, { "id": 558558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "314b7657-f5e3-57f2-af6f-b5895478f667", "parentControlId": 31096, "controlId": "03.04.08.c", "title": "03.04.08.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582949" }, { "id": 558559, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8002bf5c-f385-5d4b-bb5c-053180cbc168", "parentControlId": 31096, "controlId": "03.12.03", "title": "03.12.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58295" }, { "id": 558561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e91bd91-85a2-5166-8904-f9ef74d2fbcd", "parentControlId": 31096, "controlId": "ID.IM-01", "title": "ID.IM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58295" }, { "id": 558562, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56d68bcc-858f-594e-8833-326798a77ebe", "parentControlId": 31096, "controlId": "ID.IM-02", "title": "ID.IM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58295" }, { "id": 558583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582953", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0265446-1d7b-583c-b27f-c51886b333d0", "parentControlId": 31096, "controlId": "RISK-4c", "title": "RISK-4c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582953" }, { "id": 558584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582953", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b44c13f6-faa9-5560-9dda-60ad6f2d41fe", "parentControlId": 31096, "controlId": "ARCHITECTURE-1i", "title": "ARCHITECTURE-1i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582953" }, { "id": 558610, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582956", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1720452b-7c7b-57c2-9f8f-5d4370204a03", "parentControlId": 31096, "controlId": "CIP-006-6 R3", "title": "CIP-006-6 R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582956" }, { "id": 558611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582956", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3a4ad3c-36a3-598c-8314-8506b784fb57", "parentControlId": 31096, "controlId": "CIP-006-6 3.1", "title": "CIP-006-6 3.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582956" }, { "controlId": "CIP-006-6-R3", "title": "CIP-006-6-R3 — Physical Access Control System Maintenance and Testing", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c1289dae-c5dc-5dd6-be7e-8868485a15f4", "isPublic": true } ], "id": 31096, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730962", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730962", "catalogueId": 1062, "uuid": "54b0a1a8-b9e4-5832-9bee-61a31f5e906f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization regularly review Technology Assets, Applications and/or Services (TAAS) for adherence to the organization's security, compliance and/or resilience policies and standards?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 8.0, "title": "Functional Review Of Security, Compliance & Resilience Controls", "description": "

Control Description

Mechanisms exist to regularly review Technology Assets, Applications and/or Services (TAAS) for adherence to the organization's security, compliance and/or resilience policies and standards.

Evidence Request List (ERL)

E-CPL-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Compliance (CPL) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Compliance management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Compliance management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ External compliance requirements for cybersecurity and data privacy are identified and documented, based on applicable laws, regulations and contractual obligations.\n▪ IT and/or cybersecurity personnel use an entity-defined set of controls to conduct cybersecurity and data protection control assessments.

Level 3 - Well Defined: Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to regularly review Technology Assets, Applications and/or Services (TAAS) for adherence to the organization's security, compliance and/or resilience policies and standards.

Level 4 - Quantitatively Controlled: Compliance (CPL) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

NERC-CIP (2026) Requirements: CIP-006-6-R3", "controlId": "CPL-03.2", "family": "Compliance", "enhancements": "", "sortId": "CPL-03.2", "references": "

Micro-Small Business (<10 staff)

∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)\n∙ Regular/yearly policy and standards review process

Small Business (10-49 staff)

∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)\n∙ Regular/yearly policy and standards review process

Medium Business (50-249 staff)

∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)\n∙ Regular/yearly policy and standards review process

Large Business (250-999 staff)

∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)\n∙ Regular/yearly policy and standards review process

Enterprise (>1,000 staff)

∙ Control Validation Testing (CVT) / Security Test & Evaluation (STE)\n∙ Regular/yearly policy and standards review process", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70125, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590127", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590127", "securityControlId": 31102, "ccis": [], "uuid": "94d3edbb-c284-50ac-8c3e-3d32cea28f2c", "testId": "CPL-04_A01", "test": "an internal audit function formally defines audit-related priorities for the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70126, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590127", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590127", "securityControlId": 31102, "ccis": [], "uuid": "0523805b-17fb-5780-bdc6-d3ea34c62663", "testId": "CPL-04_A02", "test": "audits are thoughtfully planned to minimize the impact of audit-related activities on business operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 558693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582965", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "310b9fca-26ac-56d7-a9c1-d49ba9e644f9", "parentControlId": 31102, "controlId": "5.35", "title": "5.35", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582965" }, { "id": 558694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582965", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d625b0fe-f210-5000-afda-8c592cf52a23", "parentControlId": 31102, "controlId": "8.34", "title": "8.34", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582965" } ], "id": 31102, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730964", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730964", "catalogueId": 1062, "uuid": "9421b939-50e2-5b18-8cfa-457fffd2f4fa", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization thoughtfully plan audits by including input from operational risk and compliance partners to minimize the impact of audit-related activities on business operations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Audit Activities", "description": "

Control Description

Mechanisms exist to thoughtfully plan audits by including input from operational risk and compliance partners to minimize the impact of audit-related activities on business operations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Compliance (CPL) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Compliance management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Compliance management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ External compliance requirements for cybersecurity and data privacy are identified and documented, based on applicable laws, regulations and contractual obligations.

Level 3 - Well Defined: Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to thoughtfully plan audits by including input from operational risk and compliance partners to minimize the impact of audit-related activities on business operations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CPL-04", "family": "Compliance", "enhancements": "", "sortId": "CPL-04", "references": "

Micro-Small Business (<10 staff)

∙ Internal audit program

Small Business (10-49 staff)

∙ Internal audit program

Medium Business (50-249 staff)

∙ Internal audit program

Large Business (250-999 staff)

∙ Internal audit program

Enterprise (>1,000 staff)

∙ Internal audit program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70168, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590142", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590142", "securityControlId": 31121, "ccis": [], "uuid": "b139e483-876f-52d9-b9d9-c6e7253665b0", "testId": "CFG-01_A01", "test": "the scope for the configuration management plan is organization-wide.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-01_ODP[03]", "defaultText": null }, { "id": 70169, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590142", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590142", "securityControlId": 31121, "ccis": [], "uuid": "ac8a5fbe-53fa-5030-83eb-949eecdb4388", "testId": "CFG-01_A02", "test": "the types of changes to the system that are configuration-controlled are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.04.03.a", "defaultText": null }, { "id": 70170, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590142", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590143", "securityControlId": 31121, "ccis": [], "uuid": "e3cd6230-da65-564f-933a-c2713d591f2c", "testId": "CFG-01_A03", "test": "a configuration management plan for systems, applications and services is developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-09[01]", "defaultText": null }, { "id": 70171, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590143", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590143", "securityControlId": 31121, "ccis": [], "uuid": "e2704996-e8a8-500a-9c62-cadfa6a2acc1", "testId": "CFG-01_A04", "test": "a configuration management plan for systems, applications and services is implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-09[02]", "defaultText": null }, { "id": 70172, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590143", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590143", "securityControlId": 31121, "ccis": [], "uuid": "6064db9d-743b-50b7-b891-d35696f7d35e", "testId": "CFG-01_A05", "test": "the current configuration management policy is reviewed / updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CM-01c.01[01]", "defaultText": null }, { "id": 70173, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590143", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590143", "securityControlId": 31121, "ccis": [], "uuid": "5a0ba233-dc7c-5c16-96d1-a1c8af9f4436", "testId": "CFG-01_A06", "test": "the current configuration management policy is reviewed / updated following organization-defined events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-01c.01[02]", "defaultText": null }, { "id": 70174, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590143", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590143", "securityControlId": 31121, "ccis": [], "uuid": "79e38876-093f-51d9-82e2-b530defbb803", "testId": "CFG-01_A07", "test": "personnel or roles to review and approve the configuration management plan is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-09_ODP", "defaultText": null }, { "id": 70175, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590144", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590144", "securityControlId": 31121, "ccis": [], "uuid": "94c97a68-0dd2-5f35-b4a2-a87b3c5b69dc", "testId": "CFG-01_A08", "test": "the configuration management plan addresses roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-09a.[01]", "defaultText": null }, { "id": 70176, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590144", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590144", "securityControlId": 31121, "ccis": [], "uuid": "eb0dbb75-8500-51bf-aada-c81faf066fda", "testId": "CFG-01_A09", "test": "the configuration management plan addresses responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-09a.[02]", "defaultText": null }, { "id": 70177, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590144", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590144", "securityControlId": 31121, "ccis": [], "uuid": "c487197a-53fe-5d0b-bd42-363ca3f0bfd0", "testId": "CFG-01_A10", "test": "the configuration management plan addresses configuration management processes and procedures.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-09a.[03]", "defaultText": null }, { "id": 70178, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590144", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590144", "securityControlId": 31121, "ccis": [], "uuid": "2ec0c5d4-33de-5c6c-a3c1-cc605f6c7d92", "testId": "CFG-01_A11", "test": "the configuration management plan establishes a process for identifying configuration items throughout the system development life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-09b.[01]", "defaultText": null }, { "id": 70179, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590144", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590144", "securityControlId": 31121, "ccis": [], "uuid": "7c8a4e1c-5f80-558a-9a68-230b9ccfadd0", "testId": "CFG-01_A12", "test": "the configuration management plan establishes a process for managing the configuration of the configuration items.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-09b.[02]", "defaultText": null }, { "id": 70180, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590145", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590145", "securityControlId": 31121, "ccis": [], "uuid": "0de5802f-512e-50ea-92c5-4f1098e69ff6", "testId": "CFG-01_A13", "test": "the configuration management plan defines the configuration items for the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-09c.[01]", "defaultText": null }, { "id": 70181, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590145", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590145", "securityControlId": 31121, "ccis": [], "uuid": "8cb44af1-a71f-5065-a7b7-e15aa9f13ebb", "testId": "CFG-01_A14", "test": "the configuration management plan places the configuration items under configuration management.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-09c.[02]", "defaultText": null }, { "id": 70182, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590145", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590145", "securityControlId": 31121, "ccis": [], "uuid": "3b260f68-b56f-5ebc-a397-83ee129e4a3d", "testId": "CFG-01_A15", "test": "the configuration management plan is reviewed and approved by organization-defined personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-09d.", "defaultText": null }, { "id": 70183, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590145", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590145", "securityControlId": 31121, "ccis": [], "uuid": "67659258-451f-5f2f-aea8-df6512f72b0f", "testId": "CFG-01_A16", "test": "the configuration management plan is protected from unauthorized disclosure.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-09e.[01]", "defaultText": null }, { "id": 70184, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590145", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590145", "securityControlId": 31121, "ccis": [], "uuid": "50045dfc-be46-5b02-935b-e1d6afb43934", "testId": "CFG-01_A17", "test": "the configuration management plan is protected from unauthorized modification.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-09e.[02]", "defaultText": null }, { "id": 70185, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590145", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590145", "securityControlId": 31121, "ccis": [], "uuid": "4881bb0e-5f3b-5d90-982d-acb0a0661883", "testId": "CFG-01_A18", "test": "configuration management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70186, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590145", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590145", "securityControlId": 31121, "ccis": [], "uuid": "80d05239-1ba2-51bb-a62d-fc14e6b858be", "testId": "CFG-01_A19", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support configuration management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70187, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590148", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590148", "securityControlId": 31121, "ccis": [], "uuid": "a994d943-a934-5c21-aa76-637b02349a88", "testId": "CFG-01_A20", "test": "responsibility and authority for the performance of configuration management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70188, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590148", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590148", "securityControlId": 31121, "ccis": [], "uuid": "a5286c45-2c83-52e9-aef1-8f3dbbe2a724", "testId": "CFG-01_A21", "test": "personnel performing configuration management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 558878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1510967-adee-5e2b-81f7-e3639f05e919", "parentControlId": 31121, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582998" }, { "id": 558879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9267cf18-97ef-5d04-ae7a-034970ccfb27", "parentControlId": 31121, "controlId": "8.9", "title": "8.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582998" }, { "id": 558880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78c2b03f-5075-5dc9-bff0-09f1f29bed37", "parentControlId": 31121, "controlId": "8.12", "title": "8.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582998" }, { "id": 558885, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d8b1ae2-772f-534c-a1ff-9e6c5b8d54d4", "parentControlId": 31121, "controlId": "CM-1", "title": "CM-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582998" }, { "id": 558886, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "711627c1-ab21-5fd7-98cb-2771e5054572", "parentControlId": 31121, "controlId": "CM-9", "title": "CM-9", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582999" }, { "id": 558887, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f82bf91-99b0-5a6f-9bca-e8e80d927fc5", "parentControlId": 31121, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582999" }, { "id": 558888, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d61d0c1-b5fa-560d-8504-1a474e2f1b22", "parentControlId": 31121, "controlId": "CM-09", "title": "CM-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582999" }, { "id": 558891, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a22f1398-3aef-5e08-8660-b384dad8d71f", "parentControlId": 31121, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582999" }, { "id": 558892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.582999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d266f604-ea16-5a38-8dc5-fa1953c394de", "parentControlId": 31121, "controlId": "CM-09", "title": "CM-09", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.582999" }, { "id": 558894, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0eb6fde8-5fa4-5f7d-9a68-dec423f1f998", "parentControlId": 31121, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583" }, { "id": 558895, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fb3b17e-2ed6-5581-8f70-eeae36850a08", "parentControlId": 31121, "controlId": "CM-09", "title": "CM-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583" }, { "id": 558896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67de0629-2d4f-5be1-bacc-7f13b26da7fd", "parentControlId": 31121, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583" }, { "id": 558897, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0b28c02-bcb6-53a8-883c-71cf0c04cbd1", "parentControlId": 31121, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583" }, { "id": 558898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1708d50a-74f6-593f-b7c5-252b7e3ced0f", "parentControlId": 31121, "controlId": "CM-09", "title": "CM-09", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583" }, { "id": 558899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d597a1c-93c4-5b11-8d53-0aba1a2c5a53", "parentControlId": 31121, "controlId": "CM-01", "title": "CM-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583" }, { "id": 558900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "057c279a-9125-5696-89af-73d7832d2209", "parentControlId": 31121, "controlId": "CM-09", "title": "CM-09", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583" }, { "id": 558901, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2c78805-aeac-53d8-b2d2-2c5927d8fd79", "parentControlId": 31121, "controlId": "CM-1", "title": "CM-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583" }, { "id": 558902, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec60c3c2-fda8-50de-b7ee-4d5e185e1f30", "parentControlId": 31121, "controlId": "CM-9", "title": "CM-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583001" }, { "id": 558903, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a3926b6-fde6-551c-9842-47c297045500", "parentControlId": 31121, "controlId": "CM-1", "title": "CM-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583001" }, { "id": 558904, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf0267c0-1fc8-53c9-abc5-ad693f4fe44d", "parentControlId": 31121, "controlId": "CM-9", "title": "CM-9", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583001" }, { "id": 558910, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac7cf7a8-77c8-5280-b71d-99adfc90469c", "parentControlId": 31121, "controlId": "NFO - CM-1", "title": "NFO - CM-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583001" }, { "id": 558911, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f9af474-ae40-57cb-bf4d-baa6c643e75d", "parentControlId": 31121, "controlId": "NFO - CM-9", "title": "NFO - CM-9", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583001" }, { "id": 558912, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b7ac568-3195-5119-ae4f-0d594453e762", "parentControlId": 31121, "controlId": "03.04.01.a", "title": "03.04.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583002" }, { "id": 558915, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f06dced-903f-582b-8b82-2fd9fb793d50", "parentControlId": 31121, "controlId": "PR.PS", "title": "PR.PS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583002" }, { "id": 558916, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "944a2385-611b-5a39-b757-0be684abfb7f", "parentControlId": 31121, "controlId": "PR.PS-01", "title": "PR.PS-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583002" }, { "id": 558917, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d61f695-0e3a-56d3-b953-85147637e9e0", "parentControlId": 31121, "controlId": "PR.PS-05", "title": "PR.PS-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583002" }, { "id": 558953, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcd59d8b-4970-543e-a1da-e80e3b69204e", "parentControlId": 31121, "controlId": "CIP-003-8 1.1.7", "title": "CIP-003-8 1.1.7", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583007" }, { "id": 558954, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b6e8760-0071-5007-8b10-32acb8325686", "parentControlId": 31121, "controlId": "CIP-010-3 R1", "title": "CIP-010-3 R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583007" }, { "id": 558988, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583011", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1944e02-2478-5def-aa58-c9d07b07ef3f", "parentControlId": 31121, "controlId": "B4", "title": "B4", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583011" }, { "id": 558989, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583011", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dedbd5bf-031a-5740-918b-37f5903cea6a", "parentControlId": 31121, "controlId": "B4.c", "title": "B4.c", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583011" }, { "controlId": "A.4.2", "title": "A.4.2 — Change Control", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-3, CM-4, SA-10", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "4d51811d-cd9b-57c2-bf13-74c8a127109d", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2", "title": "NEI 08-09 Sec 4.2 — Change Control", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "2dae8a38-bd06-5c98-967f-373e1ac89058", "isPublic": true }, { "controlId": "10 CFR 73.54(e), 50.59", "title": "10 CFR 73.54(e), 50.59 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "4ba1ed9d-a7c2-5784-bf0c-64faf6869f98", "isPublic": true }, { "controlId": "A.4.2.1", "title": "A.4.2.1 — Configuration Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-1, CM-2, CM-3, CM-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1d5200bf-d644-5b59-9801-df49679f93d2", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.1", "title": "NEI 08-09 Sec 4.2.1 — Configuration Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "5227ac22-4503-55cf-bef7-31a3e0da31f7", "isPublic": true }, { "controlId": "10 CFR 73.54(e)", "title": "10 CFR 73.54(e) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "bb01438b-c26f-5a1b-b16b-2a11bd77994d", "isPublic": true }, { "controlId": "C.11.1", "title": "C.11.1 — Configuration Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-1, CM-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "bb54fcc3-4c68-52ea-8558-5df8abb3b1a2", "isPublic": true }, { "controlId": "NEI 08-09 App E.11.1", "title": "NEI 08-09 App E.11.1 — Configuration Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.11.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "c4924f2a-3d58-58c0-ab49-144ea7819002", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(4), (e)", "title": "10 CFR 73.54(d)(4), (e) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.11.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "dba8be85-955b-5c11-a1fb-9e2a9811e958", "isPublic": true }, { "controlId": "C.11.2", "title": "C.11.2 — Configuration Management Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "d37543dd-65af-57a9-8946-9cb419ac9934", "isPublic": true }, { "controlId": "NEI 08-09 App E.11.2", "title": "NEI 08-09 App E.11.2 — Configuration Management Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.11.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "4cc8bd31-84cb-55f3-ba1d-f3d43f2993da", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(4)", "title": "10 CFR 73.54(d)(4) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.11.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "dc845043-96c4-5da5-863b-19b2f8a158f1", "isPublic": true }, { "controlId": "CIP-010-4-R1", "title": "CIP-010-4-R1 — Configuration Change Management and Baseline Documentation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "609080c8-32cb-58be-b47b-738f8d96d35b", "isPublic": true }, { "controlId": "CIP-010-4-1.1", "title": "CIP-010-4-1.1 — Develop a baseline configuration, individually or by group, which shall include the following items: 1.1.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "43e1e6ff-3965-562b-b7ca-ec5e1917fb7e", "isPublic": true }, { "controlId": "CIP-010-4-1.1.1", "title": "CIP-010-4-1.1.1 — Operating system(s) (including version) or firmware where no independent operating system exists", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b7a35dca-0082-5167-8b81-48bfd40d44d6", "isPublic": true }, { "controlId": "CIP-010-4-1.1.2", "title": "CIP-010-4-1.1.2 — Any commercially available or open-source application software (including version) intentionally installed", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "42961d32-f666-5076-8c54-b5360d8663fd", "isPublic": true }, { "controlId": "CIP-010-4-1.1.3", "title": "CIP-010-4-1.1.3 — Any custom software installed", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b631dd79-cc75-5215-8260-df5495efefad", "isPublic": true }, { "controlId": "CIP-010-4-1.1.4", "title": "CIP-010-4-1.1.4 — Any logical network accessible ports", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "28202f1f-5862-578f-99d9-cdfad92931a2", "isPublic": true }, { "controlId": "CIP-010-4-1.1.5", "title": "CIP-010-4-1.1.5 — Any security patches applied.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e5475977-087f-5eee-a42d-79eda0c65f58", "isPublic": true }, { "controlId": "CIP-010-4-1.2", "title": "CIP-010-4-1.2 — Authorize and document changes that deviate from the existing baseline configuration.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b02088a9-035d-5741-9787-c509f703be68", "isPublic": true }, { "controlId": "CIP-010-4-1.3", "title": "CIP-010-4-1.3 — For a change that deviates from the existing baseline configuration, update the baseline configuration as necessary w...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "de659790-1fb3-547c-a26c-0c30b3450a7c", "isPublic": true }, { "controlId": "CIP-010-4-1.4", "title": "CIP-010-4-1.4 — For a change that deviates from the existing baseline configuration: 1.4.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "95dc4a85-b825-5427-8369-487ad445a996", "isPublic": true }, { "controlId": "CIP-010-4-1.4.1", "title": "CIP-010-4-1.4.1 — Prior to the change, determine required cyber security controls in CIP-005 and CIP-007 that could be impacted by the...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1d2851ec-a389-5464-879f-9910e75be2a4", "isPublic": true }, { "controlId": "CIP-010-4-1.4.2", "title": "CIP-010-4-1.4.2 — Following the change, verify that required cyber security controls determined in 1.4.1 are not adversely affected", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2b364f6f-8d32-5ea5-95d5-2d0c41aec4c3", "isPublic": true }, { "controlId": "CIP-010-4-1.4.3", "title": "CIP-010-4-1.4.3 — Document the results of the verification.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "09222269-c771-5575-9931-ea540b9602bd", "isPublic": true }, { "controlId": "CIP-010-4-1.5", "title": "CIP-010-4-1.5 — Where technically feasible, for each change that deviates from the existing baseline configuration: 1.5.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "50542054-563b-5fe8-acfd-e13b6e48a353", "isPublic": true }, { "controlId": "CIP-010-4-1.5.1", "title": "CIP-010-4-1.5.1 — Prior to implementing any change in the production environment", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "05be9c31-da58-516e-9109-ef05fcb8dbc3", "isPublic": true }, { "controlId": "CIP-010-4-1.6", "title": "CIP-010-4-1.6 — Prior to a change that deviates from the existing baseline configuration associated with baseline items in Parts 1.1....", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "96024aee-effa-557c-91fa-ba12bea65c27", "isPublic": true }, { "controlId": "CIP-010-4-1.6.1", "title": "CIP-010-4-1.6.1 — Verify the identity of the software source", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c9204da6-5f52-57f5-9728-031d6f43c10f", "isPublic": true }, { "controlId": "CIP-010-4-1.6.2", "title": "CIP-010-4-1.6.2 — Verify the integrity of the software obtained from the software source.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3fc83a60-7f67-577b-b6ad-955af81b3534", "isPublic": true }, { "controlId": "NSS-17T-Sec6.4", "title": "NSS-17T-Sec6.4 — System Hardening & Baseline Configuration Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "5ef0e1a1-294f-5cbe-b31d-37ee92d075ed", "isPublic": true }, { "controlId": "IEC-62645-7.2", "title": "IEC-62645-7.2 — I&C System Hardening and Least Functionality", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "6b806a0b-adbb-511c-861d-964b0bd029d5", "isPublic": true }, { "controlId": "IEC-63096-12.5", "title": "IEC-63096-12.5 — Control of Operational Software and Baseline Configurations", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "50f9f583-adee-5e73-9a2b-16278aca1cc1", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.5", "title": "IEEE-7-4.3.2-5.3.5 — Software Configuration Management in Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "4b2cf7c6-e4c9-556d-8896-2137028b816c", "isPublic": true } ], "id": 31121, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73097", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73097", "catalogueId": 1062, "uuid": "dcec8b3a-37c2-5f92-9e15-b25d29c1ff3c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of configuration management controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Configuration Management Program", "description": "

Control Description

Mechanisms exist to facilitate the implementation of configuration management controls.

Evidence Request List (ERL)

E-AST-01\nE-AST-27

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of configuration management controls.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.2, A.4.2.1, C.11.1, C.11.2
NERC-CIP (2026) Requirements: CIP-010-4-R1", "controlId": "CFG-01", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-01", "references": "

Micro-Small Business (<10 staff)

∙ Configuration Management (CM) program\n∙ Change control program

Small Business (10-49 staff)

∙ Configuration Management (CM) program\n∙ Change control program

Medium Business (50-249 staff)

∙ Configuration Management (CM) program\n∙ Change control program

Large Business (250-999 staff)

∙ Configuration Management (CM) program\n∙ Change control program

Enterprise (>1,000 staff)

∙ Configuration Management (CM) program\n∙ Change control program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70189, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590148", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590148", "securityControlId": 31122, "ccis": [], "uuid": "d2a29072-e715-59b2-a9ba-c519d4100411", "testId": "CFG-01.1_A01", "test": "the responsibility for developing the configuration management process is assigned to organizational personnel who are not directly involved in system development.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_CM-09(01)", "defaultText": null } ], "externalMappings": [ { "id": 559011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9429d841-c0cb-510e-8112-dfda1d6cae47", "parentControlId": 31122, "controlId": "8.9", "title": "8.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583013" }, { "id": 559013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583014", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cca64107-9e9c-555b-943c-a68ff8eb8586", "parentControlId": 31122, "controlId": "CM-9(1)", "title": "CM-9(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583014" }, { "id": 559014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583014", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d43cf5ef-c96d-5e6d-8f7f-496218997246", "parentControlId": 31122, "controlId": "CM-09(01)", "title": "CM-09(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583014" }, { "id": 559015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583014", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4829853c-5911-564b-a3ce-456d028e20e3", "parentControlId": 31122, "controlId": "CM-09(01)", "title": "CM-09(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583014" }, { "id": 559016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583014", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18e33050-19fd-5469-b1f3-0294b89d8ecc", "parentControlId": 31122, "controlId": "CM-9(1)", "title": "CM-9(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583014" } ], "id": 31122, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73097", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73097", "catalogueId": 1062, "uuid": "40e2a6d1-218f-5477-bbca-b1714f945968", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement a segregation of duties for configuration management that prevents developers from performing production configuration management duties?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Assignment of Responsibility", "description": "

Control Description

Mechanisms exist to implement a segregation of duties for configuration management that prevents developers from performing production configuration management duties.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement a segregation of duties for configuration management that prevents developers from performing production configuration management duties.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CFG-01.1", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70190, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590148", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590148", "securityControlId": 31123, "ccis": [], "uuid": "60b116fb-f190-5105-8d34-aa220dc2de3e", "testId": "CFG-02_A01", "test": "a current baseline configuration for systems, applications and services is developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.4.1[a]\n171A_3.4.2[a]\n53A_R5_CM-02a.[01]", "defaultText": null }, { "id": 70191, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590149", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590149", "securityControlId": 31123, "ccis": [], "uuid": "cba2eb6b-084d-5ea8-816d-151e3c1131f3", "testId": "CFG-02_A02", "test": "the baseline configuration includes hardware, software, firmware and documentation.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.4.1[b]", "defaultText": null }, { "id": 70192, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590149", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590149", "securityControlId": 31123, "ccis": [], "uuid": "b0105d73-d889-5438-8ac9-ffc5871b4f78", "testId": "CFG-02_A03", "test": "security configuration settings for information technology products employed in the system are enforced.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.4.2[b]\n53A_R5_CM-06b.", "defaultText": null }, { "id": 70193, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590149", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590149", "securityControlId": 31123, "ccis": [], "uuid": "80cdb328-a8f9-5ab6-b41f-dced73a92895", "testId": "CFG-02_A04", "test": "the baseline configuration is maintained (reviewed / updated) throughout the system development life cycle under configuration control.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.4.1[c]\n53A_R5_CM-02a.[02]", "defaultText": null }, { "id": 70194, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590149", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590149", "securityControlId": 31123, "ccis": [], "uuid": "5a4b1dd6-b433-5d2b-ba04-84cb41af33fb", "testId": "CFG-02_A05", "test": "configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using organization-defined common secure configurations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-06a.", "defaultText": null }, { "id": 70195, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59015", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59015", "securityControlId": 31123, "ccis": [], "uuid": "860fdfe2-dbb3-5029-a9ca-12f699b35c21", "testId": "CFG-02_A06", "test": "thresholds to which attack surfaces are to be reduced are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_SA-15(05)_ODP", "defaultText": null }, { "id": 70196, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59015", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59015", "securityControlId": 31123, "ccis": [], "uuid": "c34c1dca-63fc-5260-875a-1d85ff238b7b", "testId": "CFG-02_A07", "test": "the developer of the system, system component or system service is required to reduce attack surfaces to organization-defined thresholds.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_SA-15(05)", "defaultText": null }, { "id": 70197, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59015", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59015", "securityControlId": 31123, "ccis": [], "uuid": "2247a200-5a71-5f27-85f9-7bc84984c850", "testId": "CFG-02_A08", "test": "a control baseline for the system is selected.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PL-10", "defaultText": null }, { "id": 70198, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59015", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59015", "securityControlId": 31123, "ccis": [], "uuid": "6c90f2d1-f6fe-5970-9cb7-ed64dc67c0c0", "testId": "CFG-02_A09", "test": "approved authorizations are enforced for controlling the flow of CUI within the system.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.01.03[01]", "defaultText": null }, { "id": 70199, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59015", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59015", "securityControlId": 31123, "ccis": [], "uuid": "6e436f5f-77be-567c-a198-232703045be2", "testId": "CFG-02_A10", "test": "configuration requirements are established for each type of wireless access to the system.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.16.a[03]", "defaultText": null }, { "id": 70200, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59015", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59015", "securityControlId": 31123, "ccis": [], "uuid": "303cea55-d742-5451-aa19-cf31d9a536f3", "testId": "CFG-02_A11", "test": "wireless networking capabilities not intended for use are disabled prior to issuance and deployment.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.16.c", "defaultText": null }, { "id": 70201, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59015", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59015", "securityControlId": 31123, "ccis": [], "uuid": "6f65e857-d0fc-5d9f-8573-93ecf2446f12", "testId": "CFG-02_A12", "test": "configuration requirements are established for mobile devices.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.18.a[02]", "defaultText": null }, { "id": 70202, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590151", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590151", "securityControlId": 31123, "ccis": [], "uuid": "b87b3c1b-129a-5e30-85d4-49fcb14626da", "testId": "CFG-02_A13", "test": "audit logging tools are protected from unauthorized access, modification, and deletion.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.3.8[d]\n171A_3.3.8[e]\n171A_3.3.8[f]\n171A_R3_A.03.03.08.a[02]", "defaultText": null }, { "id": 70203, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590151", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590151", "securityControlId": 31123, "ccis": [], "uuid": "881cdd7e-d0b8-5398-b1ee-fd9bdbecd796", "testId": "CFG-02_A14", "test": "a current baseline configuration of the system is developed.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.01.a[01]", "defaultText": null }, { "id": 70204, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590151", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590151", "securityControlId": 31123, "ccis": [], "uuid": "3e05e887-6aeb-5f88-99ff-c1ea48b33ad9", "testId": "CFG-02_A15", "test": "a current baseline configuration of the system is maintained under configuration control.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.01.a[02]", "defaultText": null }, { "id": 70205, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590151", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590151", "securityControlId": 31123, "ccis": [], "uuid": "b93f96f3-09d3-5883-9aee-2abd25b5ff1b", "testId": "CFG-02_A16", "test": "the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements are established and documented: .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: Apply the appropriate use of common security configurations available from the National Institute of Standards and Technology’s National Checklist Program (NCP) website (https://ncp.nist.gov/repository) and prevent remote devices from simultaneously establishing nonremote connections with organizational systems and communicating via some other unauthorized connection to\nresources in external networks. Document any deviations from the published standard or source document.", "otherId": "171A_R3_A.03.04.02.a[01]", "defaultText": null }, { "id": 70206, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590151", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590151", "securityControlId": 31123, "ccis": [], "uuid": "95bf53ed-e311-55bb-878b-c05b7260541d", "testId": "CFG-02_A17", "test": "the following configuration settings for the system are implemented: .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: Apply the appropriate use of common security configurations available from the National Institute of Standards and Technology’s National Checklist Program (NCP) website (https://ncp.nist.gov/repository) and prevent remote devices from simultaneously establishing nonremote connections with organizational systems and communicating via some other unauthorized connection to\nresources in external networks. Document any deviations from the published standard or source document.", "otherId": "171A_R3_A.03.04.02.a[02]", "defaultText": null }, { "id": 70207, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590151", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590151", "securityControlId": 31123, "ccis": [], "uuid": "e133d46e-dd04-5e9d-8353-055a3387a352", "testId": "CFG-02_A18", "test": "functions to be prohibited or restricted are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.06.ODP[01]", "defaultText": null }, { "id": 70208, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590152", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590152", "securityControlId": 31123, "ccis": [], "uuid": "160f1beb-2ce4-5c2f-abe7-5d4ba27d1fe8", "testId": "CFG-02_A19", "test": "ports to be prohibited or restricted are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.06.ODP[02]", "defaultText": null }, { "id": 70209, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590152", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590152", "securityControlId": 31123, "ccis": [], "uuid": "18dec781-c2c7-5a02-ac5f-86160047801d", "testId": "CFG-02_A20", "test": "protocols to be prohibited or restricted are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.06.ODP[03]", "defaultText": null }, { "id": 70210, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590152", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590152", "securityControlId": 31123, "ccis": [], "uuid": "9c3fbc5b-55aa-5a76-8d49-7a148a1b1f7d", "testId": "CFG-02_A21", "test": "connections to be prohibited or restricted are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.06.ODP[04]", "defaultText": null }, { "id": 70211, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590152", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590152", "securityControlId": 31123, "ccis": [], "uuid": "aea61e90-f0d6-5af5-9ac6-0f54bb1e86ab", "testId": "CFG-02_A22", "test": "services to be prohibited or restricted are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.06.ODP[05]", "defaultText": null }, { "id": 70212, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590153", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590153", "securityControlId": 31123, "ccis": [], "uuid": "8c8bb856-9580-5716-9bb6-230ea9c0b660", "testId": "CFG-02_A23", "test": "the use of the following functions is prohibited or restricted: .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: Guidance: Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and endpoint protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system.", "otherId": "171A_R3_A.03.04.06.b[01]", "defaultText": null }, { "id": 70213, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590153", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590153", "securityControlId": 31123, "ccis": [], "uuid": "0765ad8f-bacc-5d02-8d99-70fb9ee77c1d", "testId": "CFG-02_A24", "test": "the use of the following ports is prohibited or restricted: .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: Guidance: Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and endpoint protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system.", "otherId": "171A_R3_A.03.04.06.b[02]", "defaultText": null }, { "id": 70214, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590153", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590153", "securityControlId": 31123, "ccis": [], "uuid": "24dd1e6d-f301-562f-b19d-4203083d3400", "testId": "CFG-02_A25", "test": "the use of the following protocols is prohibited or restricted: .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: Guidance: Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and endpoint protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system.", "otherId": "171A_R3_A.03.04.06.b[03]", "defaultText": null }, { "id": 70215, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590153", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590153", "securityControlId": 31123, "ccis": [], "uuid": "ca3abb4b-9519-5575-b54c-1a4e573a0c4f", "testId": "CFG-02_A26", "test": "the use of the following connections is prohibited or restricted: .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: Guidance: Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and endpoint protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system.", "otherId": "171A_R3_A.03.04.06.b[04]", "defaultText": null }, { "id": 70216, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590153", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590153", "securityControlId": 31123, "ccis": [], "uuid": "c7d8424a-e4d0-5dbe-8b0e-17c365bb33a5", "testId": "CFG-02_A27", "test": "the use of the following services is prohibited or restricted: .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: Guidance: Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and endpoint protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system.", "otherId": "171A_R3_A.03.04.06.b[05]", "defaultText": null }, { "id": 70217, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590154", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590154", "securityControlId": 31123, "ccis": [], "uuid": "939f1960-b79b-5d0f-86f0-d40b842061da", "testId": "CFG-02_A28", "test": "replay-resistant authentication mechanisms for access to privileged accounts are implemented.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.04[01]", "defaultText": null }, { "id": 70218, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590154", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590154", "securityControlId": 31123, "ccis": [], "uuid": "8cc34ccd-4f45-56e7-bf49-10bf8ad35221", "testId": "CFG-02_A29", "test": "replay-resistant authentication mechanisms for access to non-privileged accounts are implemented.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.04[02]", "defaultText": null }, { "id": 70219, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590154", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590154", "securityControlId": 31123, "ccis": [], "uuid": "b9e51cee-74e0-5839-8929-cff0d4b928fa", "testId": "CFG-02_A30", "test": "passwords are only transmitted over cryptographically protected channels.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.07.c", "defaultText": null }, { "id": 70220, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590154", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590154", "securityControlId": 31123, "ccis": [], "uuid": "57decab1-5f31-55e5-9409-2b90fb396b01", "testId": "CFG-02_A31", "test": "passwords are stored in a cryptographically protected form.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.07.d", "defaultText": null }, { "id": 70221, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590154", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590154", "securityControlId": 31123, "ccis": [], "uuid": "c9f412b1-44cc-5a93-8bb2-cb3893cfcb92", "testId": "CFG-02_A32", "test": "a new password is selected upon first use after account recovery.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.07.e", "defaultText": null }, { "id": 70222, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590154", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590154", "securityControlId": 31123, "ccis": [], "uuid": "37bad4f5-d28d-584c-ab98-c933a45cf8a8", "testId": "CFG-02_A33", "test": "organization-defined composition and complexity rules for passwords are enforced.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 70223, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590154", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590155", "securityControlId": 31123, "ccis": [], "uuid": "5309d3cc-c7fb-5878-bcf2-bf4d4587bbdd", "testId": "CFG-02_A34", "test": "replay resistance is implemented in the establishment of nonlocal maintenance and diagnostic sessions.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.07.05.b[02]", "defaultText": null }, { "id": 70224, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590155", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590155", "securityControlId": 31123, "ccis": [], "uuid": "fbe400ae-be38-5ced-98f1-e73148a8b10d", "testId": "CFG-02_A35", "test": "the following composition and complexity rules for passwords are enforced: .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: SDP values:\n(1) Must have a minimum length of 16 characters.\n(2) Contains a string of characters that does not include the user’s account name or full name.", "otherId": "171A_R3_A.03.05.07.f", "defaultText": null } ], "externalMappings": [ { "id": 559101, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583024", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9339932a-beef-5e2d-a208-d3d0b0704ba8", "parentControlId": 31123, "controlId": "CM 1.3", "title": "CM 1.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583024" }, { "id": 559102, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583024", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce69d289-758d-507b-806d-446d980c2a00", "parentControlId": 31123, "controlId": "NET 2.1(a)", "title": "NET 2.1(a)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583024" }, { "id": 559103, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583024", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c47c99bf-bd87-5a8d-b89f-5d33ee98ad58", "parentControlId": 31123, "controlId": "NET 2.1(c)", "title": "NET 2.1(c)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583024" }, { "id": 559104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583024", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9e2b704-aafd-575d-a58f-89e10c1a04d7", "parentControlId": 31123, "controlId": "NET 2.3", "title": "NET 2.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583024" }, { "id": 559105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583024", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2e3dcf6-f6d8-53c4-89d1-ae208f49957a", "parentControlId": 31123, "controlId": "NET 3.3", "title": "NET 3.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583024" }, { "id": 559106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583024", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33ce312b-7d48-528c-b72b-b0c6a2b7d41c", "parentControlId": 31123, "controlId": "COMP 1.1", "title": "COMP 1.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583024" }, { "id": 559107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583024", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67614e2b-a0aa-5f1d-8cc4-ed91a3263d60", "parentControlId": 31123, "controlId": "USER 1.7", "title": "USER 1.7", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583024" }, { "id": 559108, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0687cdc1-c089-551c-b39b-5fbe991bfc72", "parentControlId": 31123, "controlId": "USER 1.8", "title": "USER 1.8", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583025" }, { "id": 559109, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6eb0a6ec-ffc2-5c21-957e-3929a4fdbe73", "parentControlId": 31123, "controlId": "SR 2.2", "title": "SR 2.2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583025" }, { "id": 559110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37d4c065-fb32-55a8-97a6-b8eb28e69720", "parentControlId": 31123, "controlId": "SR 7.6", "title": "SR 7.6", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583025" }, { "id": 559111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87d0370b-dc8d-5e95-b0cb-a1ffd23a6339", "parentControlId": 31123, "controlId": "CR 2.2", "title": "CR 2.2", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583025" }, { "id": 559112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7acb9a26-5b8b-533f-b044-af762a64cec0", "parentControlId": 31123, "controlId": "CR 7.6", "title": "CR 7.6", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583025" }, { "id": 559117, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64586172-8002-514a-8187-16c2e32f34fc", "parentControlId": 31123, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583034" }, { "id": 559118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c14e252-f20a-5cc3-ab57-5ef37a878171", "parentControlId": 31123, "controlId": "8.5", "title": "8.5", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583034" }, { "id": 559119, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f1a0261-ba7a-5727-9e53-a49fcbe24342", "parentControlId": 31123, "controlId": "8.9", "title": "8.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583034" }, { "id": 559120, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a8f609d-3aec-52b4-9a9d-cce9085b836b", "parentControlId": 31123, "controlId": "8.12", "title": "8.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583034" }, { "id": 559121, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b87745c-4e44-51cd-b863-7a3bac6ce0a3", "parentControlId": 31123, "controlId": "8.25", "title": "8.25", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583034" }, { "id": 559122, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "707e94fe-9007-5b3b-8b9d-32690e3cf4a5", "parentControlId": 31123, "controlId": "8.26", "title": "8.26", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583034" }, { "id": 559131, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43a54e2b-3283-59f9-9732-7e125ee470dc", "parentControlId": 31123, "controlId": "T1001", "title": "T1001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583035" }, { "id": 559132, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8250de09-51fd-5cdb-919a-913734960b12", "parentControlId": 31123, "controlId": "T1001.001", "title": "T1001.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583036" }, { "id": 559133, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a8e3f82-be1a-5244-88f3-d7f6d632579d", "parentControlId": 31123, "controlId": "T1001.002", "title": "T1001.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583036" }, { "id": 559134, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65bfff56-80fb-5a2c-8bcd-74d451e88cba", "parentControlId": 31123, "controlId": "T1001.003", "title": "T1001.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583036" }, { "id": 559135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "875ad51f-543d-5557-8636-9f59c508cbb7", "parentControlId": 31123, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583036" }, { "id": 559136, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84f73bdc-7cab-5238-8b0f-85d8371aba6a", "parentControlId": 31123, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583036" }, { "id": 559137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a248ee7-1d1b-5640-a8ed-a2406969dca0", "parentControlId": 31123, "controlId": "T1003.002", "title": "T1003.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583036" }, { "id": 559138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f82ebf2-494e-5c03-8d95-1908074f980e", "parentControlId": 31123, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583036" }, { "id": 559139, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aebcc5e3-4838-56cf-8320-2c616884ce8d", "parentControlId": 31123, "controlId": "T1003.004", "title": "T1003.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583036" }, { "id": 559140, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89e8dc4b-8bf3-58fd-893c-e5a98b513917", "parentControlId": 31123, "controlId": "T1003.005", "title": "T1003.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583036" }, { "id": 559141, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7965ab9c-822e-5005-8b7b-1e9d72a74624", "parentControlId": 31123, "controlId": "T1003.006", "title": "T1003.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583037" }, { "id": 559142, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "783026a4-43ba-5ed7-8fad-de3af0ded5c1", "parentControlId": 31123, "controlId": "T1003.007", "title": "T1003.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583037" }, { "id": 559143, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d320e5b2-e92c-530d-858a-4c6c298aa10f", "parentControlId": 31123, "controlId": "T1003.008", "title": "T1003.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583037" }, { "id": 559144, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa24a1cc-fd8c-54a5-ba03-4f85a20aec57", "parentControlId": 31123, "controlId": "T1008", "title": "T1008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583037" }, { "id": 559145, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e26ba41-fcdc-5e3f-b04d-2eaf3f16f32e", "parentControlId": 31123, "controlId": "T1011", "title": "T1011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583037" }, { "id": 559146, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b3e52d0-3a1c-5f2f-9275-f4258962af48", "parentControlId": 31123, "controlId": "T1011.001", "title": "T1011.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583037" }, { "id": 559147, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b33dbced-05e9-5043-ba6b-c5f67368c810", "parentControlId": 31123, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583037" }, { "id": 559148, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fbe34fa-02dc-577b-8df4-d05a8e9fd0f4", "parentControlId": 31123, "controlId": "T1021", "title": "T1021", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583037" }, { "id": 559149, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583038", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f79891c8-b601-5bc7-bdf1-1e7352ae6a4c", "parentControlId": 31123, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583038" }, { "id": 559150, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583038", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5db8e32-ec44-535d-85e0-7f3654750ce4", "parentControlId": 31123, "controlId": "T1021.002", "title": "T1021.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583038" }, { "id": 559151, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583038", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36213503-a69d-5e0d-bfd4-874c3a5b33c7", "parentControlId": 31123, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583038" }, { "id": 559152, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583038", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa813b56-5425-5a87-b5ca-1cf8aee66cd8", "parentControlId": 31123, "controlId": "T1021.004", "title": "T1021.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583038" }, { "id": 559153, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583038", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ff5f1b3-6f26-50dd-ba48-889fd2fe01cf", "parentControlId": 31123, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583038" }, { "id": 559154, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583038", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc3a0f17-0a9d-5c62-84d9-ce905b397796", "parentControlId": 31123, "controlId": "T1021.006", "title": "T1021.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583038" }, { "id": 559155, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583038", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d80f4f5c-82be-533c-a41b-9ca6354d1781", "parentControlId": 31123, "controlId": "T1021.008", "title": "T1021.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583038" }, { "id": 559156, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583038", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6352761-59e2-502d-a9e1-9fedcae39ecf", "parentControlId": 31123, "controlId": "T1027", "title": "T1027", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583038" }, { "id": 559157, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583038", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48d3db76-45c3-570e-b3e4-3519890f80b4", "parentControlId": 31123, "controlId": "T1027.010", "title": "T1027.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583038" }, { "id": 559158, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "706f56c5-3723-5a91-a7c0-f5e08ece529b", "parentControlId": 31123, "controlId": "T1029", "title": "T1029", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583039" }, { "id": 559159, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b33e0b3-0b44-5d41-adbe-1862c82a2268", "parentControlId": 31123, "controlId": "T1030", "title": "T1030", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583039" }, { "id": 559160, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22253fed-372d-5b49-915f-dfe927e41be2", "parentControlId": 31123, "controlId": "T1036", "title": "T1036", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583039" }, { "id": 559161, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d9fd88f-fa26-5b77-9875-c1f1ab65186e", "parentControlId": 31123, "controlId": "T1036.001", "title": "T1036.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583039" }, { "id": 559162, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e408bfaf-053b-53b5-93e7-4c3c61161b23", "parentControlId": 31123, "controlId": "T1036.003", "title": "T1036.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583039" }, { "id": 559163, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d7b847f-18e6-59d3-b1fd-3a1397c2cd9a", "parentControlId": 31123, "controlId": "T1036.005", "title": "T1036.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583039" }, { "id": 559164, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59777720-f2e0-5222-b43f-33e11e2e3e38", "parentControlId": 31123, "controlId": "T1036.007", "title": "T1036.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583039" }, { "id": 559165, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfb807d4-24e4-5ba5-bd18-3721553662fa", "parentControlId": 31123, "controlId": "T1036.010", "title": "T1036.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583039" }, { "id": 559166, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "841be51d-181e-5242-ba6f-f0f64e8f5749", "parentControlId": 31123, "controlId": "T1037", "title": "T1037", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58304" }, { "id": 559167, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1c53435-79cd-5a06-867e-9f9a8d02bdc4", "parentControlId": 31123, "controlId": "T1037.002", "title": "T1037.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58304" }, { "id": 559168, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcb6d86c-f468-5643-b5eb-4e121d1d4c16", "parentControlId": 31123, "controlId": "T1037.003", "title": "T1037.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58304" }, { "id": 559169, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6a69d4f-84be-5892-9a92-594c54ddd283", "parentControlId": 31123, "controlId": "T1037.004", "title": "T1037.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58304" }, { "id": 559170, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0effb1bd-e56b-549b-af8b-3b0646a8b2bb", "parentControlId": 31123, "controlId": "T1037.005", "title": "T1037.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58304" }, { "id": 559171, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a47db98-110c-515a-97d6-11952320e655", "parentControlId": 31123, "controlId": "T1046", "title": "T1046", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583041" }, { "id": 559172, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81aa72db-9358-5529-b9cf-18719cd8ff3b", "parentControlId": 31123, "controlId": "T1047", "title": "T1047", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583041" }, { "id": 559173, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4228656d-42bb-576e-8d29-5c7c2f141048", "parentControlId": 31123, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583041" }, { "id": 559174, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94615500-895e-54ef-b573-dc538baa13b9", "parentControlId": 31123, "controlId": "T1048.001", "title": "T1048.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583041" }, { "id": 559175, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09564c67-1bb6-549c-aa9a-b072fc1305c5", "parentControlId": 31123, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583041" }, { "id": 559176, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c55aa0e-be84-5c55-b93a-5c27b5ef4691", "parentControlId": 31123, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583041" }, { "id": 559177, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f74887d4-891f-5629-9716-75fda7bf27cc", "parentControlId": 31123, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583041" }, { "id": 559178, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26218ea0-451e-5513-b432-72d49034850f", "parentControlId": 31123, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583041" }, { "id": 559179, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "229dffe9-fc86-5078-b08f-dac2b4ecfc6f", "parentControlId": 31123, "controlId": "T1053", "title": "T1053", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583042" }, { "id": 559180, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c0fe717-3c65-5665-a088-162d15b3d1f0", "parentControlId": 31123, "controlId": "T1053.002", "title": "T1053.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583042" }, { "id": 559181, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e5834a6-e3a7-5710-985f-115c2c466fff", "parentControlId": 31123, "controlId": "T1053.003", "title": "T1053.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583042" }, { "id": 559182, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ad1ffcd-ab81-5593-8afd-0f88ed8709de", "parentControlId": 31123, "controlId": "T1053.005", "title": "T1053.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583042" }, { "id": 559183, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5fdac2f-158d-54f2-877f-e0e81c7fc485", "parentControlId": 31123, "controlId": "T1053.006", "title": "T1053.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583042" }, { "id": 559184, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "258ef900-360e-5683-84dc-a370e10ff67d", "parentControlId": 31123, "controlId": "T1055", "title": "T1055", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583042" }, { "id": 559185, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f95900cd-fe01-530f-9d32-8fda89cc00c3", "parentControlId": 31123, "controlId": "T1055.008", "title": "T1055.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583042" }, { "id": 559186, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d046826a-2c78-5255-86aa-b7b00c9d13f8", "parentControlId": 31123, "controlId": "T1056.003", "title": "T1056.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583042" }, { "id": 559187, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89bfbbce-f98e-5e13-b350-0738e39b0742", "parentControlId": 31123, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583042" }, { "id": 559188, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27405243-5349-5f6e-aa71-303f6963522e", "parentControlId": 31123, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583043" }, { "id": 559189, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c6c2c32-4301-535f-b174-b81e907abbaf", "parentControlId": 31123, "controlId": "T1059.002", "title": "T1059.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583043" }, { "id": 559190, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd343f18-da35-54ed-a90e-816258f4a89c", "parentControlId": 31123, "controlId": "T1059.003", "title": "T1059.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583043" }, { "id": 559191, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64028178-e9fc-5e59-b54e-fe9cdd0dd822", "parentControlId": 31123, "controlId": "T1059.004", "title": "T1059.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583043" }, { "id": 559192, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c25e924c-0722-56a5-a8ca-5f14f2f47ae7", "parentControlId": 31123, "controlId": "T1059.005", "title": "T1059.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583043" }, { "id": 559193, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10ae2561-63c2-51f8-9b03-aa7f0099aa36", "parentControlId": 31123, "controlId": "T1059.006", "title": "T1059.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583043" }, { "id": 559194, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a68711b4-eaf7-58c7-b750-d8d95858498a", "parentControlId": 31123, "controlId": "T1059.007", "title": "T1059.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583043" }, { "id": 559195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8ce8f08-eb48-50a0-98ae-79d8b3b3a870", "parentControlId": 31123, "controlId": "T1059.008", "title": "T1059.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583044" }, { "id": 559196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd97ff0f-a8e6-5333-a5d9-525c98336088", "parentControlId": 31123, "controlId": "T1059.010", "title": "T1059.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583044" }, { "id": 559197, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a3d5ab1-d7dd-52be-b332-fc930cb0119b", "parentControlId": 31123, "controlId": "T1059.011", "title": "T1059.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583044" }, { "id": 559198, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65fcc9d9-f443-5d6a-9de4-8f7c6ba8473b", "parentControlId": 31123, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583044" }, { "id": 559199, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a861bcd2-4945-568d-b11e-5f88648f3e14", "parentControlId": 31123, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583044" }, { "id": 559200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ee780af-277a-5764-a70e-7496803d16f3", "parentControlId": 31123, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583044" }, { "id": 559201, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d41868da-83ee-52b9-842f-e0b9d03ee5c5", "parentControlId": 31123, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583044" }, { "id": 559202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "721405d8-5ea2-5dcf-a471-0e0373eb5a4c", "parentControlId": 31123, "controlId": "T1070.003", "title": "T1070.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583044" }, { "id": 559203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9d8a00c-3369-5735-9732-afbc852651a9", "parentControlId": 31123, "controlId": "T1070.007", "title": "T1070.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583044" }, { "id": 559204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fec6da23-2d17-5995-bc02-1ee8e45649cb", "parentControlId": 31123, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583045" }, { "id": 559205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49b52d80-7562-50c9-84a6-912291e4b733", "parentControlId": 31123, "controlId": "T1070.009", "title": "T1070.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583045" }, { "id": 559206, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd32cad2-9b20-54e5-8a9d-ace9d37fc36c", "parentControlId": 31123, "controlId": "T1071", "title": "T1071", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583045" }, { "id": 559207, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0be3390-7664-5e75-a455-f488dea061d5", "parentControlId": 31123, "controlId": "T1071.001", "title": "T1071.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583045" }, { "id": 559208, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45c5e5b9-d882-576f-a063-1d82e0948b07", "parentControlId": 31123, "controlId": "T1071.002", "title": "T1071.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583045" }, { "id": 559209, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3ca6d6f-68d7-51a1-b859-335219ce9f40", "parentControlId": 31123, "controlId": "T1071.003", "title": "T1071.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583045" }, { "id": 559210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4aecb372-3dd5-5661-8dab-b1c54ada4ad5", "parentControlId": 31123, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583045" }, { "id": 559211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5b45000-8697-5325-ac13-89997bb36ae8", "parentControlId": 31123, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583045" }, { "id": 559212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed6004d0-c77c-5b36-9ae1-8f4cab319ba6", "parentControlId": 31123, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583045" }, { "id": 559213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91573ea8-fb9e-54fe-82a1-33106762bfb1", "parentControlId": 31123, "controlId": "T1078.002", "title": "T1078.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583046" }, { "id": 559214, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9ac0e11-ecc4-5405-b60b-a1efff3efe60", "parentControlId": 31123, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583046" }, { "id": 559215, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dba66194-0ffc-5bb1-bfc8-5c1c323bb0e7", "parentControlId": 31123, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583047" }, { "id": 559216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da4a1ffd-2be6-5340-b39d-7a8a37f5c231", "parentControlId": 31123, "controlId": "T1080", "title": "T1080", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583047" }, { "id": 559217, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d925bdb7-b10f-5d09-829a-f83b642de2b5", "parentControlId": 31123, "controlId": "T1087", "title": "T1087", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583048" }, { "id": 559218, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d716694-ae6a-5dd1-90cc-d59f6bcdee4b", "parentControlId": 31123, "controlId": "T1087.001", "title": "T1087.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583048" }, { "id": 559219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9914c07-9f2a-54cf-a46e-6e1b86c7cdee", "parentControlId": 31123, "controlId": "T1087.002", "title": "T1087.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583048" }, { "id": 559220, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fd4475f-b4d0-571a-acfb-4194a8c68685", "parentControlId": 31123, "controlId": "T1090", "title": "T1090", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583048" }, { "id": 559221, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "184242f1-9e9c-5d2d-89c7-7ebbfe024b11", "parentControlId": 31123, "controlId": "T1090.001", "title": "T1090.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583048" }, { "id": 559222, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1570ea4e-4e9e-5a94-ba58-e3e9c58330d2", "parentControlId": 31123, "controlId": "T1090.002", "title": "T1090.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583048" }, { "id": 559223, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33f6aa59-c50b-5c78-b4de-e30919c41b18", "parentControlId": 31123, "controlId": "T1090.003", "title": "T1090.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583048" }, { "id": 559224, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "124b1135-8aea-5676-a02e-25c7dd104c1e", "parentControlId": 31123, "controlId": "T1091", "title": "T1091", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583048" }, { "id": 559225, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "496b2787-5f98-5222-b4db-426760400549", "parentControlId": 31123, "controlId": "T1092", "title": "T1092", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583049" }, { "id": 559226, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb75f41e-1795-58fc-83ea-6365f126adff", "parentControlId": 31123, "controlId": "T1095", "title": "T1095", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583049" }, { "id": 559227, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9aaf8fd-acc0-5460-a287-6ab3f7215b76", "parentControlId": 31123, "controlId": "T1098", "title": "T1098", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583049" }, { "id": 559228, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae6c806e-7101-5027-b2fb-e62d07ca6be4", "parentControlId": 31123, "controlId": "T1098.001", "title": "T1098.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583049" }, { "id": 559229, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab166ad2-97ca-5d5c-bf57-1cfa1f505e27", "parentControlId": 31123, "controlId": "T1098.002", "title": "T1098.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583049" }, { "id": 559230, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0c0b058-b404-5227-9684-e945521fccfb", "parentControlId": 31123, "controlId": "T1098.003", "title": "T1098.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583049" }, { "id": 559231, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb00a70d-4325-5c38-89ce-2cc4798d2382", "parentControlId": 31123, "controlId": "T1098.004", "title": "T1098.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583049" }, { "id": 559232, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5781dbac-95d6-525a-90c2-217db3724a23", "parentControlId": 31123, "controlId": "T1098.005", "title": "T1098.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583049" }, { "id": 559233, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76080741-d0a7-5ffb-9af2-4198a8420bb9", "parentControlId": 31123, "controlId": "T1098.007", "title": "T1098.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583049" }, { "id": 559234, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "349c8d86-c71d-51c7-8098-f534e0fc5ab3", "parentControlId": 31123, "controlId": "T1102", "title": "T1102", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583049" }, { "id": 559235, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa72d405-7685-5f3e-b6d7-3d304b141fd3", "parentControlId": 31123, "controlId": "T1102.001", "title": "T1102.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58305" }, { "id": 559236, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33689f61-5611-514e-b097-24a8623dc7b1", "parentControlId": 31123, "controlId": "T1102.002", "title": "T1102.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58305" }, { "id": 559237, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "decb3731-b582-528b-aecb-128098905286", "parentControlId": 31123, "controlId": "T1102.003", "title": "T1102.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58305" }, { "id": 559238, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17bdef62-6525-532e-97b3-bf445cf05cb4", "parentControlId": 31123, "controlId": "T1104", "title": "T1104", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58305" }, { "id": 559239, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38918b64-033e-525d-9abd-8bdd42ca2e05", "parentControlId": 31123, "controlId": "T1105", "title": "T1105", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58305" }, { "id": 559240, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4102db7-1ca1-5aa0-9f1b-1d470ebca8f0", "parentControlId": 31123, "controlId": "T1106", "title": "T1106", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58305" }, { "id": 559241, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a12da863-2795-5c09-9d33-6e9217927788", "parentControlId": 31123, "controlId": "T1110", "title": "T1110", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58305" }, { "id": 559242, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "349d1f69-3f6f-5d74-ba3a-caac1b8a060d", "parentControlId": 31123, "controlId": "T1110.001", "title": "T1110.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583051" }, { "id": 559243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70979533-3778-5edd-8d11-5f8a4522554a", "parentControlId": 31123, "controlId": "T1110.002", "title": "T1110.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583051" }, { "id": 559244, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c216433-2d66-5b9f-9187-c8819c269983", "parentControlId": 31123, "controlId": "T1110.003", "title": "T1110.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583051" }, { "id": 559245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d4addfa-b3d7-50a7-8253-6cebea045a9e", "parentControlId": 31123, "controlId": "T1110.004", "title": "T1110.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583051" }, { "id": 559246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4726c074-de1b-5ed3-9067-3906910a9038", "parentControlId": 31123, "controlId": "T1111", "title": "T1111", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583051" }, { "id": 559247, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d52e1a3-a604-5d94-9145-648fe19e6f3e", "parentControlId": 31123, "controlId": "T1114", "title": "T1114", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583051" }, { "id": 559248, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2aed1282-c56c-54df-9433-32ae5bc55989", "parentControlId": 31123, "controlId": "T1114.002", "title": "T1114.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583051" }, { "id": 559249, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca4a77b6-9ed0-50bb-9565-d569d914b632", "parentControlId": 31123, "controlId": "T1114.003", "title": "T1114.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583051" }, { "id": 559250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "126a4817-00f0-55c0-a76a-73e9188548be", "parentControlId": 31123, "controlId": "T1119", "title": "T1119", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583051" }, { "id": 559251, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6371216c-bf0b-5c00-917a-06b831590270", "parentControlId": 31123, "controlId": "T1127", "title": "T1127", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583051" }, { "id": 559252, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "086c39ea-35e5-5cf9-95ab-9d262b1ccf15", "parentControlId": 31123, "controlId": "T1127.001", "title": "T1127.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583052" }, { "id": 559253, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "105f68d1-d472-5e04-8546-db3064e22681", "parentControlId": 31123, "controlId": "T1127.002", "title": "T1127.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583052" }, { "id": 559254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74dea98e-fecd-5eb2-94c1-229143f9055b", "parentControlId": 31123, "controlId": "T1129", "title": "T1129", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583052" }, { "id": 559255, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e82c239-1387-5988-83e0-f1711f173718", "parentControlId": 31123, "controlId": "T1132", "title": "T1132", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583052" }, { "id": 559256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bf22829-ce8a-5c65-b92d-08e172f34bff", "parentControlId": 31123, "controlId": "T1132.001", "title": "T1132.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583052" }, { "id": 559257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "793635a4-5064-5983-8ad7-163a2508013e", "parentControlId": 31123, "controlId": "T1132.002", "title": "T1132.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583052" }, { "id": 559258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76fbfb6d-5f27-56eb-91db-bd4b313f43ed", "parentControlId": 31123, "controlId": "T1133", "title": "T1133", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583052" }, { "id": 559259, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52aacc23-0032-548a-88a7-aab0d55744d9", "parentControlId": 31123, "controlId": "T1134", "title": "T1134", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583052" }, { "id": 559260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e292a08b-87e2-558e-a6e6-5f4fb1934a58", "parentControlId": 31123, "controlId": "T1134.001", "title": "T1134.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583052" }, { "id": 559261, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae829240-5fd2-5b25-84ab-d4c08dd9900a", "parentControlId": 31123, "controlId": "T1134.002", "title": "T1134.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583053" }, { "id": 559262, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "452d1a70-025a-5bd2-a305-7f721b9cff2e", "parentControlId": 31123, "controlId": "T1134.003", "title": "T1134.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583053" }, { "id": 559263, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70af3748-3d5d-543f-8526-0285ccf2dd03", "parentControlId": 31123, "controlId": "T1134.005", "title": "T1134.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583053" }, { "id": 559264, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ab5de93-bf46-56c7-8e1c-74402b1684e0", "parentControlId": 31123, "controlId": "T1135", "title": "T1135", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583053" }, { "id": 559265, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78612ba3-9919-5c9d-87e8-f5089ab0b8f3", "parentControlId": 31123, "controlId": "T1136", "title": "T1136", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583053" }, { "id": 559266, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46802847-ed3a-5296-82e3-1e5351cf1f45", "parentControlId": 31123, "controlId": "T1136.001", "title": "T1136.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583054" }, { "id": 559267, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8789d580-2fb3-5f0a-bd72-b0eaa14d334f", "parentControlId": 31123, "controlId": "T1136.002", "title": "T1136.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583054" }, { "id": 559268, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0663f2fb-bfda-5e49-b38e-a51a8704d59d", "parentControlId": 31123, "controlId": "T1136.003", "title": "T1136.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583054" }, { "id": 559269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "624a54dc-63b1-5f0a-9457-ae6e491f57ed", "parentControlId": 31123, "controlId": "T1137", "title": "T1137", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583054" }, { "id": 559270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbef526e-100b-536d-88b4-6c6e2d9ac0e3", "parentControlId": 31123, "controlId": "T1137.001", "title": "T1137.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583054" }, { "id": 559271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6d5149f-9384-5c9d-971c-caa92bd3c1fd", "parentControlId": 31123, "controlId": "T1137.002", "title": "T1137.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583054" }, { "id": 559272, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9867d8c5-12bb-586f-86e5-0d758cd6a260", "parentControlId": 31123, "controlId": "T1137.003", "title": "T1137.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583054" }, { "id": 559273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9bbce65d-3c07-524b-896a-8ebbbcbe44b7", "parentControlId": 31123, "controlId": "T1137.004", "title": "T1137.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583054" }, { "id": 559274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1afb85d4-d35f-566a-b219-118248137a3b", "parentControlId": 31123, "controlId": "T1137.005", "title": "T1137.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583054" }, { "id": 559275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2749127-91b1-5099-8835-e196ccaf67c1", "parentControlId": 31123, "controlId": "T1137.006", "title": "T1137.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583055" }, { "id": 559276, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91ae9178-82cd-52b0-a5fe-74510eba53b7", "parentControlId": 31123, "controlId": "T1176", "title": "T1176", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583055" }, { "id": 559277, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f481ffc0-cff8-59c1-8908-8029a24a79c3", "parentControlId": 31123, "controlId": "T1185", "title": "T1185", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583055" }, { "id": 559278, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83006dcd-fe53-5619-9b05-780095530c7f", "parentControlId": 31123, "controlId": "T1187", "title": "T1187", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583055" }, { "id": 559279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b74d8099-d96b-5efc-8e32-52507d6bb323", "parentControlId": 31123, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583055" }, { "id": 559280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "978855fa-8bc1-5e3b-a86e-891bcbfcd8b4", "parentControlId": 31123, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583055" }, { "id": 559281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a2b2cec-ef1f-5017-8a6d-e54f3d47fbd7", "parentControlId": 31123, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583055" }, { "id": 559282, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76d3cb22-eb83-5a46-bed8-6b3f94543c15", "parentControlId": 31123, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583055" }, { "id": 559283, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f2651cd-129b-5e2e-9d10-1c7895e1e84e", "parentControlId": 31123, "controlId": "T1195.003", "title": "T1195.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583055" }, { "id": 559284, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df27d8bb-2aec-570d-ae2c-87c88e5f37c5", "parentControlId": 31123, "controlId": "T1197", "title": "T1197", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583055" }, { "id": 559285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e4a0533-2a3d-58b6-8109-6be6929692d8", "parentControlId": 31123, "controlId": "T1199", "title": "T1199", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583056" }, { "id": 559286, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86f7400f-051d-5172-8e9b-a47805daaed8", "parentControlId": 31123, "controlId": "T1201", "title": "T1201", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583056" }, { "id": 559287, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5e23987-5832-51ff-8a9c-1a6afefd8f8c", "parentControlId": 31123, "controlId": "T1204", "title": "T1204", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583056" }, { "id": 559288, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd2022fe-4677-5891-89be-fdcc8c812ba6", "parentControlId": 31123, "controlId": "T1204.001", "title": "T1204.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583056" }, { "id": 559289, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64d29a12-801c-58a2-bc38-e1562189f2cb", "parentControlId": 31123, "controlId": "T1204.002", "title": "T1204.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583056" }, { "id": 559290, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7560c85-476e-5163-91c4-ddcfebdbc800", "parentControlId": 31123, "controlId": "T1204.003", "title": "T1204.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583056" }, { "id": 559291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1defb709-06e3-5d60-8453-3bdc58f449c0", "parentControlId": 31123, "controlId": "T1205", "title": "T1205", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583056" }, { "id": 559292, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03f8c397-ca77-57ad-98d7-57082fd7be84", "parentControlId": 31123, "controlId": "T1205.001", "title": "T1205.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583056" }, { "id": 559293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "457dc083-2ccb-5a2f-b039-a5cb93484d3c", "parentControlId": 31123, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583057" }, { "id": 559294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6bcef07-818a-5250-be3f-f5b5d85ca1d6", "parentControlId": 31123, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583057" }, { "id": 559295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3651869c-4ab7-583c-b3b4-819c825922c3", "parentControlId": 31123, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583057" }, { "id": 559296, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb3328e3-bdcf-59b2-a772-6f93b56a9d8c", "parentControlId": 31123, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583057" }, { "id": 559297, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a02f5e26-cb21-5672-b17d-ef4d3b6e7f57", "parentControlId": 31123, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583057" }, { "id": 559298, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9192f8af-2ec4-509a-8c5a-176f4bd01084", "parentControlId": 31123, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583057" }, { "id": 559299, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a53cfb8-7b5f-56cf-a5e0-71186a6938c3", "parentControlId": 31123, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583057" }, { "id": 559300, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1646391d-ae93-5912-9040-b2d0aa7d6288", "parentControlId": 31123, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583057" }, { "id": 559301, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74d296a7-2605-542e-bc77-b58f7c8a1721", "parentControlId": 31123, "controlId": "T1216", "title": "T1216", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583057" }, { "id": 559302, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ebf4a93-0c3f-51f4-a54c-a6154d90be47", "parentControlId": 31123, "controlId": "T1216.001", "title": "T1216.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583058" }, { "id": 559303, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e586897b-a365-5a4a-a8d3-6c83416c6b79", "parentControlId": 31123, "controlId": "T1216.002", "title": "T1216.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583058" }, { "id": 559304, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97f60797-34ce-55d7-a72e-a6ce96cdacfa", "parentControlId": 31123, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583058" }, { "id": 559305, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92f70b06-81f9-5aaa-bcb0-5b8cbe76d89f", "parentControlId": 31123, "controlId": "T1218.001", "title": "T1218.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583058" }, { "id": 559306, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a428316c-7089-54e1-be5f-3c50209bd73e", "parentControlId": 31123, "controlId": "T1218.002", "title": "T1218.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583058" }, { "id": 559307, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05e8b295-9a49-5736-81cf-904948ab6fbe", "parentControlId": 31123, "controlId": "T1218.003", "title": "T1218.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583058" }, { "id": 559308, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67dfffc8-3b31-5fa0-87f6-2c2c01d6b37a", "parentControlId": 31123, "controlId": "T1218.004", "title": "T1218.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583058" }, { "id": 559309, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e61983c-f5bc-5000-91c5-112aabfe34ab", "parentControlId": 31123, "controlId": "T1218.005", "title": "T1218.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583058" }, { "id": 559310, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "580f6c93-e9fb-5206-95f9-46d9fedebee7", "parentControlId": 31123, "controlId": "T1218.007", "title": "T1218.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583058" }, { "id": 559311, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "482b9f31-c9e8-5424-94a0-fcf5262e3f4f", "parentControlId": 31123, "controlId": "T1218.008", "title": "T1218.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583059" }, { "id": 559312, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa049749-6362-5205-b1d8-da56bf9cb86a", "parentControlId": 31123, "controlId": "T1218.009", "title": "T1218.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583059" }, { "id": 559313, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65f2e591-243e-56e1-bce4-fbb5c9b8d00f", "parentControlId": 31123, "controlId": "T1218.012", "title": "T1218.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583059" }, { "id": 559314, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f7e58f3-384e-59cf-acf0-6d4d303b45f1", "parentControlId": 31123, "controlId": "T1218.013", "title": "T1218.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583059" }, { "id": 559315, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "510f08d1-281b-53bb-8d9b-8869b5f308d7", "parentControlId": 31123, "controlId": "T1218.014", "title": "T1218.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583059" }, { "id": 559316, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a700cf4-9bfb-57bc-844b-bee56619cef2", "parentControlId": 31123, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583059" }, { "id": 559317, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c08a35df-b605-5b12-9ed1-4ae0c4af35d3", "parentControlId": 31123, "controlId": "T1219", "title": "T1219", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58306" }, { "id": 559318, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a178a153-c783-50c2-b0ea-684c75abd834", "parentControlId": 31123, "controlId": "T1220", "title": "T1220", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58306" }, { "id": 559319, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca227f9c-9a61-5e02-8638-86e26e6246e8", "parentControlId": 31123, "controlId": "T1221", "title": "T1221", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58306" }, { "id": 559320, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f13d2f6-71f5-5b17-8b7f-0675587fc4aa", "parentControlId": 31123, "controlId": "T1222", "title": "T1222", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58306" }, { "id": 559321, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "964779af-689c-581e-95eb-786c1047ad30", "parentControlId": 31123, "controlId": "T1222.001", "title": "T1222.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58306" }, { "id": 559322, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d921d086-e802-5591-8ac9-2d2be63b4637", "parentControlId": 31123, "controlId": "T1222.002", "title": "T1222.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58306" }, { "id": 559323, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fa5726d-dcaf-5b89-88c1-2f5c4ffc73a6", "parentControlId": 31123, "controlId": "T1482", "title": "T1482", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58306" }, { "id": 559324, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "284ebc01-e459-5229-9571-2591d612aa09", "parentControlId": 31123, "controlId": "T1484", "title": "T1484", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58306" }, { "id": 559325, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9baadfc4-7fc0-54f7-aa90-adbe8713fce2", "parentControlId": 31123, "controlId": "T1485", "title": "T1485", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583061" }, { "id": 559326, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "182bf3a0-8f62-58ad-b661-5c4d323fc5d6", "parentControlId": 31123, "controlId": "T1486", "title": "T1486", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583061" }, { "id": 559327, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8a14781-6131-5ecf-bc2e-eb5b6bf00b16", "parentControlId": 31123, "controlId": "T1489", "title": "T1489", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583061" }, { "id": 559328, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9ecddfc-4202-55bf-b67f-ce73239ce2e6", "parentControlId": 31123, "controlId": "T1490", "title": "T1490", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583061" }, { "id": 559329, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58a5a086-0955-5f9f-a8e3-ea5c8ba88f0a", "parentControlId": 31123, "controlId": "T1491", "title": "T1491", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583061" }, { "id": 559330, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09d2b4b9-5958-56db-ac69-c4fdca3fc11d", "parentControlId": 31123, "controlId": "T1491.001", "title": "T1491.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583061" }, { "id": 559331, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2946395-0c1e-5a8f-9144-97799cba216a", "parentControlId": 31123, "controlId": "T1491.002", "title": "T1491.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583061" }, { "id": 559332, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19de79d5-c6dc-5c9a-9b0a-9b6f93f69497", "parentControlId": 31123, "controlId": "T1495", "title": "T1495", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583061" }, { "id": 559333, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a3dff65-9cfc-5e3e-bc13-7f50f9b98e48", "parentControlId": 31123, "controlId": "T1498", "title": "T1498", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583061" }, { "id": 559334, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7b3e78e-0c6e-5f3a-9e61-1739bec05e83", "parentControlId": 31123, "controlId": "T1498.001", "title": "T1498.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583061" }, { "id": 559335, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "588fb800-c43c-517d-b7a4-904b402f37d4", "parentControlId": 31123, "controlId": "T1498.002", "title": "T1498.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583062" }, { "id": 559336, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5225242-209c-53ab-961d-f8c71d6e47c9", "parentControlId": 31123, "controlId": "T1499", "title": "T1499", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583062" }, { "id": 559337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a6d7f71-b7d0-55b5-abb6-3aa60ef846e0", "parentControlId": 31123, "controlId": "T1499.001", "title": "T1499.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583062" }, { "id": 559338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe13b8b9-8c19-570f-b374-e609591c092a", "parentControlId": 31123, "controlId": "T1499.002", "title": "T1499.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583062" }, { "id": 559339, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ef38eaf-f2a5-557a-a694-2d56cc540b35", "parentControlId": 31123, "controlId": "T1499.003", "title": "T1499.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583062" }, { "id": 559340, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5517f4ad-9606-561d-80ef-0e2d75a189d9", "parentControlId": 31123, "controlId": "T1499.004", "title": "T1499.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583062" }, { "id": 559341, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41ff83e5-5916-5637-b3da-58493eed4cd2", "parentControlId": 31123, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583062" }, { "id": 559342, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ffd3e84-6418-5975-8ded-122de28d958e", "parentControlId": 31123, "controlId": "T1505.001", "title": "T1505.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583063" }, { "id": 559343, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "324e2655-fea8-55fa-8251-a81caabc67f1", "parentControlId": 31123, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583063" }, { "id": 559344, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2401f87c-e715-56ff-a00c-a6c57c0a9941", "parentControlId": 31123, "controlId": "T1505.003", "title": "T1505.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583063" }, { "id": 559345, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b86c223-9e6e-5d37-bbcb-d1a6b0422f01", "parentControlId": 31123, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583063" }, { "id": 559346, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0ac9287-6683-5024-a03a-8fb8b0ba7496", "parentControlId": 31123, "controlId": "T1505.005", "title": "T1505.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583063" }, { "id": 559347, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59eb28e7-08ee-50b6-a368-3c34224d1b64", "parentControlId": 31123, "controlId": "T1525", "title": "T1525", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583063" }, { "id": 559348, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a00a95a-f157-540a-a5d5-86c3e6d93c79", "parentControlId": 31123, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583063" }, { "id": 559349, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "936263c9-f6be-5ad9-a4b6-4a9388d59985", "parentControlId": 31123, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583063" }, { "id": 559350, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb6e78be-b6ec-5c94-b7ea-7f9b86558f45", "parentControlId": 31123, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583063" }, { "id": 559351, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57bc104e-5bb3-55d2-9861-fb60e6481351", "parentControlId": 31123, "controlId": "T1539", "title": "T1539", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583064" }, { "id": 559352, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb427cb7-8b77-51f9-bdaf-a0d639b85528", "parentControlId": 31123, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583064" }, { "id": 559353, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38ca9774-bd94-5d50-b2f9-635074964b7b", "parentControlId": 31123, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583064" }, { "id": 559354, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a7e30d6-303e-543c-8952-a97f508b6abe", "parentControlId": 31123, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583064" }, { "id": 559355, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acc7b92c-ca82-52ba-9451-fd5d677edb6b", "parentControlId": 31123, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583064" }, { "id": 559356, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ef1a921-d9e9-527a-9b70-12872c75ea3e", "parentControlId": 31123, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583064" }, { "id": 559357, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b98ff021-8f12-548d-a763-368f6dde9f4e", "parentControlId": 31123, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583064" }, { "id": 559358, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6ef8dee-fe91-5280-8207-5d43fdaf037a", "parentControlId": 31123, "controlId": "T1543.001", "title": "T1543.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583064" }, { "id": 559359, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "857df54e-e09a-5a77-8287-3bdb05208f2a", "parentControlId": 31123, "controlId": "T1543.002", "title": "T1543.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583064" }, { "id": 559360, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3aadf126-662f-559e-aaf1-74316fa8b1c2", "parentControlId": 31123, "controlId": "T1543.003", "title": "T1543.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583065" }, { "id": 559361, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5533390d-6187-5360-81a2-924de76dfb15", "parentControlId": 31123, "controlId": "T1543.004", "title": "T1543.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583065" }, { "id": 559362, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae53380a-47a5-5518-b937-68e6a021a65d", "parentControlId": 31123, "controlId": "T1546", "title": "T1546", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583065" }, { "id": 559363, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d9d871c-0ccc-5995-9c43-b772e6a97dbd", "parentControlId": 31123, "controlId": "T1546.002", "title": "T1546.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583065" }, { "id": 559364, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cbf81988-f193-5c83-832c-623df2fc9592", "parentControlId": 31123, "controlId": "T1546.003", "title": "T1546.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583065" }, { "id": 559365, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06cd3ddf-36cb-5650-8e10-27e986b59bdf", "parentControlId": 31123, "controlId": "T1546.004", "title": "T1546.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583065" }, { "id": 559366, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f7f067d-4c19-548a-9dae-16ccf33acba4", "parentControlId": 31123, "controlId": "T1546.006", "title": "T1546.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583065" }, { "id": 559367, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6355ce5-0bad-5029-aa43-fb0254edf36d", "parentControlId": 31123, "controlId": "T1546.008", "title": "T1546.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583066" }, { "id": 559368, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f36bbe9-4f07-5ecc-9adb-423a0d279969", "parentControlId": 31123, "controlId": "T1546.010", "title": "T1546.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583066" }, { "id": 559369, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a1cf27a-8e4e-5e10-bfa3-682e3e6378f7", "parentControlId": 31123, "controlId": "T1546.013", "title": "T1546.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583066" }, { "id": 559370, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb93c596-b483-53a0-a127-303ed1cc9c43", "parentControlId": 31123, "controlId": "T1546.014", "title": "T1546.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583066" }, { "id": 559371, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2bbf935-ca5e-5f39-ad83-566a5b686e97", "parentControlId": 31123, "controlId": "T1546.016", "title": "T1546.016", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583066" }, { "id": 559372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d787ad5d-80d6-515b-9073-93583a4c1012", "parentControlId": 31123, "controlId": "T1547.002", "title": "T1547.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583066" }, { "id": 559373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65eb0600-1c5d-5c18-a47c-d127a1fe66b7", "parentControlId": 31123, "controlId": "T1547.003", "title": "T1547.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583066" }, { "id": 559374, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "260788e6-7041-5c45-8b10-8e862e6ce250", "parentControlId": 31123, "controlId": "T1547.005", "title": "T1547.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583066" }, { "id": 559375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "106d101b-b2c6-5897-b2f2-35970f8bef02", "parentControlId": 31123, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583066" }, { "id": 559376, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03ee126b-ba28-53c7-bcbc-816134121328", "parentControlId": 31123, "controlId": "T1547.007", "title": "T1547.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583066" }, { "id": 559377, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583067", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f39e780f-9be8-5905-ac41-9088a84c2326", "parentControlId": 31123, "controlId": "T1547.008", "title": "T1547.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583067" }, { "id": 559378, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583067", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15138784-8cea-5ea5-b865-f23b78a7510d", "parentControlId": 31123, "controlId": "T1547.009", "title": "T1547.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583067" }, { "id": 559379, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583067", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06651dbe-9845-5474-970b-1ef84ca4c9f0", "parentControlId": 31123, "controlId": "T1547.013", "title": "T1547.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583067" }, { "id": 559380, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583067", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "681d9df1-9608-59d6-b09f-dfe716e80744", "parentControlId": 31123, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583067" }, { "id": 559381, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583067", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76ee507a-d579-5b27-830b-2f70495c0d40", "parentControlId": 31123, "controlId": "T1548.001", "title": "T1548.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583067" }, { "id": 559382, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583067", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58598eeb-d314-5c11-8e39-3bf4b79d824a", "parentControlId": 31123, "controlId": "T1548.002", "title": "T1548.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583067" }, { "id": 559383, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583067", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1a9ae01-702b-5897-9cd2-64901a3b15ac", "parentControlId": 31123, "controlId": "T1548.003", "title": "T1548.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583067" }, { "id": 559384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583067", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97ee3df1-87af-56ad-bc3f-b7ed6d27ce6c", "parentControlId": 31123, "controlId": "T1548.004", "title": "T1548.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583067" }, { "id": 559385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583067", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b99d0daf-4848-504e-bf09-485e30ae7552", "parentControlId": 31123, "controlId": "T1548.006", "title": "T1548.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583067" }, { "id": 559386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583068", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4d17711-7641-52c1-8171-353fea8bcbe5", "parentControlId": 31123, "controlId": "T1550", "title": "T1550", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583068" }, { "id": 559387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583068", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee78bfa1-2f47-5671-9853-a85391784e1e", "parentControlId": 31123, "controlId": "T1550.001", "title": "T1550.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583068" }, { "id": 559388, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583068", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fa612b7-a0c2-5e02-8e9f-7100af00b4e5", "parentControlId": 31123, "controlId": "T1550.002", "title": "T1550.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583068" }, { "id": 559389, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583068", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5de72b9f-18f0-597b-9351-719399306be2", "parentControlId": 31123, "controlId": "T1550.003", "title": "T1550.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583068" }, { "id": 559390, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583068", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31d2f5fc-0982-5282-be19-620f74c4264a", "parentControlId": 31123, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583068" }, { "id": 559391, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583068", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78647f83-b34f-56bb-bfa5-feb363c64a58", "parentControlId": 31123, "controlId": "T1552.001", "title": "T1552.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583068" }, { "id": 559392, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583068", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78bcce54-c1b6-5a36-b211-45dc3213e63b", "parentControlId": 31123, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583068" }, { "id": 559393, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583068", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1caebb79-6ce2-5d1d-bd6c-0140644637bb", "parentControlId": 31123, "controlId": "T1552.003", "title": "T1552.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583068" }, { "id": 559394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79d50f6a-2cec-53c2-b897-b0bedb440037", "parentControlId": 31123, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583069" }, { "id": 559395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d6a7914-3c4c-5c8e-873e-a3f2bdefe699", "parentControlId": 31123, "controlId": "T1552.005", "title": "T1552.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583069" }, { "id": 559396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a5d50cc-d9b0-5eec-bcf1-a025efa8c37a", "parentControlId": 31123, "controlId": "T1552.006", "title": "T1552.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583069" }, { "id": 559397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a11e2ad-3e82-5aee-a26b-e1cb7f9c5eec", "parentControlId": 31123, "controlId": "T1552.007", "title": "T1552.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583069" }, { "id": 559398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "507f1d25-929e-5fa5-97cc-2c722dc8b386", "parentControlId": 31123, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583069" }, { "id": 559399, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d2ec947-5d25-50a3-8d63-2a5d2174152f", "parentControlId": 31123, "controlId": "T1553.001", "title": "T1553.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583069" }, { "id": 559400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73410495-a7b1-5529-a326-a1cf24cc111b", "parentControlId": 31123, "controlId": "T1553.003", "title": "T1553.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583069" }, { "id": 559401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa1291af-6403-5822-ac94-72d4f17b15dd", "parentControlId": 31123, "controlId": "T1553.004", "title": "T1553.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583069" }, { "id": 559402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "726cf1db-5496-5a91-9c7e-cd4cf94193dd", "parentControlId": 31123, "controlId": "T1553.005", "title": "T1553.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583069" }, { "id": 559403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76a9b64a-343c-5798-b4ba-55b0a957985e", "parentControlId": 31123, "controlId": "T1553.006", "title": "T1553.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58307" }, { "id": 559404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fe3bddb-67ea-5007-be7c-0b380ea962d6", "parentControlId": 31123, "controlId": "T1554", "title": "T1554", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58307" }, { "id": 559405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10aec34f-d3a2-575b-b556-e5adf79c4904", "parentControlId": 31123, "controlId": "T1555.004", "title": "T1555.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58307" }, { "id": 559406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d594d714-546a-57ea-8841-c384d2e6467b", "parentControlId": 31123, "controlId": "T1555.005", "title": "T1555.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58307" }, { "id": 559407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6820b594-aed5-5cb3-9b69-79ce150aa969", "parentControlId": 31123, "controlId": "T1556", "title": "T1556", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58307" }, { "id": 559408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68e71d67-5b26-5b24-a26e-b53f2ccb3ace", "parentControlId": 31123, "controlId": "T1556.001", "title": "T1556.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58307" }, { "id": 559409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb7b0d61-e571-5dea-b17a-d79ecee9aa74", "parentControlId": 31123, "controlId": "T1556.002", "title": "T1556.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58307" }, { "id": 559410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d59edb1-9794-5682-8e25-e637089b7cde", "parentControlId": 31123, "controlId": "T1556.003", "title": "T1556.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58307" }, { "id": 559411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0682eb6-0d99-56ed-9ddb-570cab9c6a5f", "parentControlId": 31123, "controlId": "T1556.004", "title": "T1556.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58307" }, { "id": 559412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583071", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73228bbb-e45e-562f-ac1e-69d9ea866c49", "parentControlId": 31123, "controlId": "T1556.008", "title": "T1556.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583071" }, { "id": 559413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583071", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0789f4c-729b-5ca0-aa41-a4e18d6ee083", "parentControlId": 31123, "controlId": "T1556.009", "title": "T1556.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583071" }, { "id": 559414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583071", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6d47280-dafd-5c4c-9b52-b769895b8f1c", "parentControlId": 31123, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583071" }, { "id": 559415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583071", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43bcd08e-0f36-524f-a7c0-63b73c2cdb33", "parentControlId": 31123, "controlId": "T1557.001", "title": "T1557.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583071" }, { "id": 559416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583071", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5c9d433-5912-5067-97ff-77d4d0ceda10", "parentControlId": 31123, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583071" }, { "id": 559417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583071", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5b92b75-2923-5eb3-99cd-65852aa4dbf8", "parentControlId": 31123, "controlId": "T1557.003", "title": "T1557.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583071" }, { "id": 559418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583071", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd46deb1-5849-5994-a511-0195a9a7b81c", "parentControlId": 31123, "controlId": "T1557.004", "title": "T1557.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583071" }, { "id": 559419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583072", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be83b38e-1b76-59cb-8066-352f0819efbf", "parentControlId": 31123, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583072" }, { "id": 559420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583072", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3fb8099-d0dc-5a63-b95d-e88a936d4c74", "parentControlId": 31123, "controlId": "T1558.001", "title": "T1558.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583072" }, { "id": 559421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583072", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bce5da67-79ee-510d-84d9-51c788b3b1df", "parentControlId": 31123, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583072" }, { "id": 559422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583072", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7e8e1fc-bfc2-5283-84ec-6084683585cf", "parentControlId": 31123, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583072" }, { "id": 559423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583072", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e112b371-b3e5-585e-bdf7-22d35c48be58", "parentControlId": 31123, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583072" }, { "id": 559424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583072", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d117fe36-08d3-5600-a02b-6e6e0024d657", "parentControlId": 31123, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583072" }, { "id": 559425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583072", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da8689cc-3fa4-5f8b-9378-695d4e6eab06", "parentControlId": 31123, "controlId": "T1559.001", "title": "T1559.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583072" }, { "id": 559426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583072", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95130454-e329-589b-b6b6-22c54293ff79", "parentControlId": 31123, "controlId": "T1559.002", "title": "T1559.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583072" }, { "id": 559427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583072", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7b69691-d23d-5139-a632-2f7b16539ae4", "parentControlId": 31123, "controlId": "T1559.003", "title": "T1559.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583072" }, { "id": 559428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583072", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50a87561-840e-5e3a-80a7-977488b986b8", "parentControlId": 31123, "controlId": "T1560", "title": "T1560", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583073" }, { "id": 559429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583073", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "008a1e84-335f-5b52-b1ba-936f4da310e3", "parentControlId": 31123, "controlId": "T1560.001", "title": "T1560.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583073" }, { "id": 559430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583073", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a4eebe3-322a-5028-a536-f9a1d0673202", "parentControlId": 31123, "controlId": "T1561", "title": "T1561", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583073" }, { "id": 559431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583073", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b7fce72-1d00-5c3d-ad92-046e7438841a", "parentControlId": 31123, "controlId": "T1561.001", "title": "T1561.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583073" }, { "id": 559432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583073", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff2f89a1-787a-50d2-ad7c-c10ab992a6ef", "parentControlId": 31123, "controlId": "T1561.002", "title": "T1561.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583073" }, { "id": 559433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583073", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cabc00ab-7188-5ee9-a6cd-b92515e83659", "parentControlId": 31123, "controlId": "T1562", "title": "T1562", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583073" }, { "id": 559434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583073", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36efe405-1b47-5c9f-862a-3ee8b4ce4973", "parentControlId": 31123, "controlId": "T1562.001", "title": "T1562.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583073" }, { "id": 559435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583073", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ce750ce-f3cd-5eae-b882-98c52c56d5f1", "parentControlId": 31123, "controlId": "T1562.002", "title": "T1562.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583073" }, { "id": 559436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583073", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e525e91f-638a-520d-bb90-7746248fab76", "parentControlId": 31123, "controlId": "T1562.003", "title": "T1562.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583073" }, { "id": 559437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583073", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5930720d-ab30-5e87-9d34-6878d6b2459f", "parentControlId": 31123, "controlId": "T1562.004", "title": "T1562.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583073" }, { "id": 559438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583074", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6218d75f-7092-545f-adce-1ae4dc7c7054", "parentControlId": 31123, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583074" }, { "id": 559439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583074", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09387837-2a6b-50a3-ba16-dbed88f2c024", "parentControlId": 31123, "controlId": "T1562.009", "title": "T1562.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583074" }, { "id": 559440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583074", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2827f44d-ec80-57fd-b48b-9a6a630cc1d9", "parentControlId": 31123, "controlId": "T1562.010", "title": "T1562.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583074" }, { "id": 559441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "648c8cb3-f9c3-5b84-bcd0-5c98b3b3f20a", "parentControlId": 31123, "controlId": "T1562.011", "title": "T1562.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583082" }, { "id": 559442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1009e66a-60f0-5404-9f4e-7318ca62db36", "parentControlId": 31123, "controlId": "T1562.012", "title": "T1562.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583082" }, { "id": 559443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65c7b6d3-ee1e-5daa-8504-96375d5b3618", "parentControlId": 31123, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583082" }, { "id": 559444, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65299f46-250a-5496-95bf-b680804452c0", "parentControlId": 31123, "controlId": "T1563.001", "title": "T1563.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583083" }, { "id": 559445, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5cfece2-90cc-5f2f-9355-a0bcd56d78b9", "parentControlId": 31123, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583083" }, { "id": 559446, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79910a4a-8897-551d-b960-afb0bc050d84", "parentControlId": 31123, "controlId": "T1564.002", "title": "T1564.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583083" }, { "id": 559447, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20aa33cb-241d-5276-8f2a-4dfc15329191", "parentControlId": 31123, "controlId": "T1564.006", "title": "T1564.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583083" }, { "id": 559448, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "339e15fc-7c18-5c8d-a496-40b0f46015e9", "parentControlId": 31123, "controlId": "T1564.007", "title": "T1564.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583083" }, { "id": 559449, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a15319ab-40c4-52dc-9f3a-3d203911bb21", "parentControlId": 31123, "controlId": "T1564.009", "title": "T1564.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583083" }, { "id": 559450, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6454e8a-f4cd-536b-ac4d-12d3cdb86911", "parentControlId": 31123, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583083" }, { "id": 559451, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e9862cc-5f8f-55d5-9f17-b912fc894451", "parentControlId": 31123, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583083" }, { "id": 559452, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45e63e8c-c27d-533a-a68f-cb86bc641f6d", "parentControlId": 31123, "controlId": "T1565.002", "title": "T1565.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583083" }, { "id": 559453, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a9f7725-9cad-5e39-a1a1-a4c1f8361d3e", "parentControlId": 31123, "controlId": "T1565.003", "title": "T1565.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583084" }, { "id": 559454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35fbb138-45f0-5435-a0bf-f5eb220b75cd", "parentControlId": 31123, "controlId": "T1566", "title": "T1566", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583084" }, { "id": 559455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78de8506-a814-56ae-99f5-3139c5c11a02", "parentControlId": 31123, "controlId": "T1566.001", "title": "T1566.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583084" }, { "id": 559456, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d18cba4a-0e56-53c9-9f1e-852c604efc06", "parentControlId": 31123, "controlId": "T1566.002", "title": "T1566.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583084" }, { "id": 559457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8588d602-e56c-5330-ad28-f362fd64e187", "parentControlId": 31123, "controlId": "T1569", "title": "T1569", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583084" }, { "id": 559458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0e3dba1-301f-54ff-a1d1-ae8a78dabdf3", "parentControlId": 31123, "controlId": "T1569.002", "title": "T1569.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583084" }, { "id": 559459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbef34b3-c4ff-5f6c-ae19-262f10889ff6", "parentControlId": 31123, "controlId": "T1570", "title": "T1570", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583084" }, { "id": 559460, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11acb36c-aef7-5760-831f-9ec8d73f220d", "parentControlId": 31123, "controlId": "T1571", "title": "T1571", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583084" }, { "id": 559461, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4799942-257f-5829-ad8d-621e2b214a22", "parentControlId": 31123, "controlId": "T1572", "title": "T1572", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583084" }, { "id": 559462, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3404230-7645-5870-b8ee-bcc6d9de691f", "parentControlId": 31123, "controlId": "T1573", "title": "T1573", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583085" }, { "id": 559463, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7cf08a79-e56a-5168-a03d-ec490d4699d5", "parentControlId": 31123, "controlId": "T1573.001", "title": "T1573.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583085" }, { "id": 559464, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "270a6a1a-45e6-5c2a-a13a-3a0136d8e963", "parentControlId": 31123, "controlId": "T1573.002", "title": "T1573.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583085" }, { "id": 559465, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3af1259-8ad2-5851-8c5f-27424b4399ca", "parentControlId": 31123, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583085" }, { "id": 559466, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2079080-50a5-525f-8c0e-146d7c530855", "parentControlId": 31123, "controlId": "T1574.001", "title": "T1574.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583085" }, { "id": 559467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f16834d-5939-52fb-8425-0a6ea6f2b958", "parentControlId": 31123, "controlId": "T1574.004", "title": "T1574.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583085" }, { "id": 559468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e016fda-1558-585a-bbfb-4221317a7a2f", "parentControlId": 31123, "controlId": "T1574.005", "title": "T1574.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583085" }, { "id": 559469, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f03523b-49ec-519e-bae6-68ecf52ed62d", "parentControlId": 31123, "controlId": "T1574.006", "title": "T1574.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583086" }, { "id": 559470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acfd83b5-8788-5e5f-898e-4f0a27528eb9", "parentControlId": 31123, "controlId": "T1574.007", "title": "T1574.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583086" }, { "id": 559471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3de60dda-777f-5baf-a6ad-e2f891a4131b", "parentControlId": 31123, "controlId": "T1574.008", "title": "T1574.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583086" }, { "id": 559472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a620668b-9e4d-5ddd-9172-e38cc417d373", "parentControlId": 31123, "controlId": "T1574.009", "title": "T1574.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583086" }, { "id": 559473, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ffa6412-f031-5603-ba44-29ce7400778e", "parentControlId": 31123, "controlId": "T1574.010", "title": "T1574.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583086" }, { "id": 559474, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b61d775a-08bf-5dd1-88bd-6725de10ee37", "parentControlId": 31123, "controlId": "T1574.013", "title": "T1574.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583086" }, { "id": 559475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3b532e8-662b-5961-8d45-8e7a290ce621", "parentControlId": 31123, "controlId": "T1574.014", "title": "T1574.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583086" }, { "id": 559476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2e9639a-d725-5ebc-bf8e-6ffdefb6e22a", "parentControlId": 31123, "controlId": "T1578", "title": "T1578", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583086" }, { "id": 559477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c17cccb2-c5fb-528b-bc20-42bb07a0310a", "parentControlId": 31123, "controlId": "T1578.001", "title": "T1578.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583086" }, { "id": 559478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0763715f-db54-53f6-bbcf-dff7be0534c9", "parentControlId": 31123, "controlId": "T1578.002", "title": "T1578.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583087" }, { "id": 559479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4461f21-0043-5ec6-ba85-88bbe31f70af", "parentControlId": 31123, "controlId": "T1578.003", "title": "T1578.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583087" }, { "id": 559480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "858f33cb-58df-593e-af26-ebe8770d3ff0", "parentControlId": 31123, "controlId": "T1590.002", "title": "T1590.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583087" }, { "id": 559481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3c32902-3868-580f-9282-ab585e9af37e", "parentControlId": 31123, "controlId": "T1598", "title": "T1598", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583087" }, { "id": 559482, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e4e7135-6ecf-5811-90ab-2717dcea977a", "parentControlId": 31123, "controlId": "T1598.002", "title": "T1598.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583087" }, { "id": 559483, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ef7d161-e131-581a-a883-6dbdc786a767", "parentControlId": 31123, "controlId": "T1598.003", "title": "T1598.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583087" }, { "id": 559484, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96e003bd-317a-5fcf-bc43-692ee1b35420", "parentControlId": 31123, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583087" }, { "id": 559485, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c8528bf-e51c-52a5-9adc-90e0b5666aea", "parentControlId": 31123, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583087" }, { "id": 559486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65ab4205-ac69-59b2-9224-7339f77ba3d5", "parentControlId": 31123, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583087" }, { "id": 559487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa1a502a-4057-5fe4-a921-c8e532398a7a", "parentControlId": 31123, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583088" }, { "id": 559488, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87483b86-c103-5600-9bf9-3eb5ecaefd4b", "parentControlId": 31123, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583088" }, { "id": 559489, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65124772-c027-5339-8011-24581f6b455d", "parentControlId": 31123, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583088" }, { "id": 559490, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e73b459-7bfb-531b-9d3e-12ac3c24181f", "parentControlId": 31123, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583088" }, { "id": 559491, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f3fad20-e1fd-58ce-8d68-6b003299eec5", "parentControlId": 31123, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583088" }, { "id": 559492, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b9ac470-68f6-5fc3-8be1-b598c4328382", "parentControlId": 31123, "controlId": "T1609", "title": "T1609", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583088" }, { "id": 559493, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37bd722e-98ac-59f1-ab28-18466fd425bb", "parentControlId": 31123, "controlId": "T1610", "title": "T1610", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583088" }, { "id": 559494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6185c484-ebaa-5c38-9604-58ed8bd44c7d", "parentControlId": 31123, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583089" }, { "id": 559495, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2c14cde-6750-5715-96d3-ebe2ea3f54eb", "parentControlId": 31123, "controlId": "T1612", "title": "T1612", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583089" }, { "id": 559496, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a69dd02-1d27-5978-82a1-db711974f0be", "parentControlId": 31123, "controlId": "T1613", "title": "T1613", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583089" }, { "id": 559497, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "534faa9d-26ed-5455-8ef3-8d62f9cd786d", "parentControlId": 31123, "controlId": "T1622", "title": "T1622", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583089" }, { "id": 559498, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c89c606-afb2-5863-a9fa-3ede57bbc600", "parentControlId": 31123, "controlId": "T1647", "title": "T1647", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583089" }, { "id": 559499, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5aa7cc86-611d-5104-ba60-9450b63b5fb8", "parentControlId": 31123, "controlId": "T1648", "title": "T1648", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583089" }, { "id": 559500, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0fe9d427-1304-58dd-9d9f-90630944f249", "parentControlId": 31123, "controlId": "T1653", "title": "T1653", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583089" }, { "id": 559511, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1604d20c-cb42-58f2-a60a-160f8d04aa8f", "parentControlId": 31123, "controlId": "CM-2", "title": "CM-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58309" }, { "id": 559512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45fc6c85-a00f-591e-8bff-2069329383c8", "parentControlId": 31123, "controlId": "CM-2(3)", "title": "CM-2(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58309" }, { "id": 559513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c729bae4-133e-541a-b858-f03528687d59", "parentControlId": 31123, "controlId": "CM-6", "title": "CM-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583091" }, { "id": 559514, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d434815-6bb2-55f8-99b8-da17c431b583", "parentControlId": 31123, "controlId": "SA-8", "title": "SA-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583091" }, { "id": 559515, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d759da0-04cf-5114-af84-33f644c529dc", "parentControlId": 31123, "controlId": "CM-02", "title": "CM-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583091" }, { "id": 559516, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9818c8b5-008c-500a-8a16-2899e7092478", "parentControlId": 31123, "controlId": "CM-06", "title": "CM-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583091" }, { "id": 559517, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79f39b57-9ce7-5952-a681-c5ad81d1f5b6", "parentControlId": 31123, "controlId": "PL-10", "title": "PL-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583091" }, { "id": 559518, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ff0acbd-bad8-525b-a5db-93e83dabb876", "parentControlId": 31123, "controlId": "SA-08", "title": "SA-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583091" }, { "id": 559519, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40077e08-e4ca-5e2a-b8c9-d6bdc9b28dee", "parentControlId": 31123, "controlId": "SA-15(05)", "title": "SA-15(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583091" }, { "id": 559524, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583092", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca618cf9-c2f3-5d99-a817-c2c4a7d71b2f", "parentControlId": 31123, "controlId": "CM-02", "title": "CM-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583092" }, { "id": 559525, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583092", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63c7bf58-1dab-566d-adbd-86d77a354a45", "parentControlId": 31123, "controlId": "CM-06", "title": "CM-06", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583092" }, { "id": 559526, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583092", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "403d069f-9bbe-5532-8274-061c8fde8868", "parentControlId": 31123, "controlId": "PL-10", "title": "PL-10", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583092" }, { "id": 559527, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583092", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7640a5c4-296f-581c-bf0b-aece7a242bf2", "parentControlId": 31123, "controlId": "SA-08", "title": "SA-08", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583092" }, { "id": 559530, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583093", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2736a611-e5f5-59b3-b975-86aa491675d4", "parentControlId": 31123, "controlId": "CM-02", "title": "CM-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583093" }, { "id": 559531, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583093", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e56baf43-a00d-58af-a640-905d46c04977", "parentControlId": 31123, "controlId": "CM-06", "title": "CM-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583093" }, { "id": 559532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583093", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0e58733-c834-5f68-bc7f-64560581f355", "parentControlId": 31123, "controlId": "PL-10", "title": "PL-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583093" }, { "id": 559533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583093", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21624e54-175d-545b-a0bd-3e1029284cb2", "parentControlId": 31123, "controlId": "SA-08", "title": "SA-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583093" }, { "id": 559534, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583093", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67e5a909-bff5-594d-96c7-9c483bdc97e7", "parentControlId": 31123, "controlId": "SA-15(05)", "title": "SA-15(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583093" }, { "id": 559535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583093", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03e5fa89-6d42-5e9e-af53-67bb823e0ae5", "parentControlId": 31123, "controlId": "CM-02", "title": "CM-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583093" }, { "id": 559536, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583093", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e6f030b-d935-5372-944a-6e38a0a00238", "parentControlId": 31123, "controlId": "CM-06", "title": "CM-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583093" }, { "id": 559537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583093", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b91a4d68-bd5f-5d58-8ea2-16b364797fd1", "parentControlId": 31123, "controlId": "PL-10", "title": "PL-10", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583093" }, { "id": 559538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583093", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc9e8d2b-b7a1-58b2-875a-e231e5e00468", "parentControlId": 31123, "controlId": "SA-08", "title": "SA-08", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583094" }, { "id": 559539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583094", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13015a4a-1556-573e-8673-351ed0d5c843", "parentControlId": 31123, "controlId": "CM-02", "title": "CM-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583094" }, { "id": 559540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583094", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0c1ea95-8eef-5b3c-a0b7-187228963ddd", "parentControlId": 31123, "controlId": "CM-06", "title": "CM-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583094" }, { "id": 559541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583094", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cfc3af21-2d66-5c4e-af18-c8766431e4b7", "parentControlId": 31123, "controlId": "PL-10", "title": "PL-10", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583094" }, { "id": 559542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583094", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5eb08a52-0712-5099-927e-a93299d62287", "parentControlId": 31123, "controlId": "SA-08", "title": "SA-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583094" }, { "id": 559543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583094", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1a5055b-2434-57c3-8c01-a045c93809d9", "parentControlId": 31123, "controlId": "CM-02", "title": "CM-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583094" }, { "id": 559544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583094", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90a0b37f-db0b-5120-9078-fbc41c3ca2ab", "parentControlId": 31123, "controlId": "CM-06", "title": "CM-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583094" }, { "id": 559545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583094", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f858c6e5-a8f1-546d-a1e3-38b8dc968705", "parentControlId": 31123, "controlId": "PL-10", "title": "PL-10", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583094" }, { "id": 559546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583095", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab200bdf-9507-5035-bd59-49b9777e2431", "parentControlId": 31123, "controlId": "SA-08", "title": "SA-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583095" }, { "id": 559548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583095", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4853b36d-83d4-58ca-9ee2-8d31716b7767", "parentControlId": 31123, "controlId": "CM-2", "title": "CM-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583095" }, { "id": 559549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583095", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5dfd1293-148a-5101-aad0-7387ce0f6774", "parentControlId": 31123, "controlId": "CM-6", "title": "CM-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583095" }, { "id": 559550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583095", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d22fc0a2-ef57-5f14-831b-162a8e627ee2", "parentControlId": 31123, "controlId": "PL-10", "title": "PL-10", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583095" }, { "id": 559551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583095", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11d10395-45db-5a01-8143-2a14353724ca", "parentControlId": 31123, "controlId": "SA-8", "title": "SA-8", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583095" }, { "id": 559552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583095", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fae2962-382a-5b31-8525-a227d59bbe7b", "parentControlId": 31123, "controlId": "CM-2", "title": "CM-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583095" }, { "id": 559553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583095", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a6c9f4e-dc37-5591-a104-fd5541c7b6ae", "parentControlId": 31123, "controlId": "CM-6", "title": "CM-6", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583095" }, { "id": 559554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583095", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b704b3c-eca6-5c81-ba23-098323496c92", "parentControlId": 31123, "controlId": "PL-10", "title": "PL-10", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583095" }, { "id": 559555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583095", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19b22b36-793a-522d-bbaf-9fba4dd877f1", "parentControlId": 31123, "controlId": "SA-8", "title": "SA-8", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583096" }, { "id": 559556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a10715c-f73c-5131-bf0d-f86271bac4a8", "parentControlId": 31123, "controlId": "CM-2", "title": "CM-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583096" }, { "id": 559557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4093fcd-c417-5ae3-9382-7e65c61ab44d", "parentControlId": 31123, "controlId": "CM-6", "title": "CM-6", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583096" }, { "id": 559567, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11d7631f-6430-52a6-adbb-9c7a3f7a015c", "parentControlId": 31123, "controlId": "3.3.3", "title": "3.3.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583097" }, { "id": 559568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c951ce51-a93e-57a5-a6c9-80168379ae9a", "parentControlId": 31123, "controlId": "3.4.1", "title": "3.4.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583097" }, { "id": 559569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ea08411-1745-521e-8a49-ec43eaa21755", "parentControlId": 31123, "controlId": "3.4.2", "title": "3.4.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583097" }, { "id": 559570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb2f25b2-c6e3-5f96-87e5-234c0e8399b2", "parentControlId": 31123, "controlId": "03.01.01.h", "title": "03.01.01.h", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583097" }, { "id": 559571, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2ffc44a-f2d8-57e7-9af2-2d8200d639a0", "parentControlId": 31123, "controlId": "03.01.08.a", "title": "03.01.08.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583097" }, { "id": 559572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4897a74-c841-5f3f-9e2c-8ac26fcc8533", "parentControlId": 31123, "controlId": "03.01.08.b", "title": "03.01.08.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583098" }, { "id": 559573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4729a83-cbcd-558f-9cb2-9b522b08a6fe", "parentControlId": 31123, "controlId": "03.01.09", "title": "03.01.09", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583098" }, { "id": 559574, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c654eefb-3c11-50bd-b00c-29984d519cf4", "parentControlId": 31123, "controlId": "03.01.10.a", "title": "03.01.10.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583098" }, { "id": 559575, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "039cd009-09e1-57ca-9e36-59c47430909e", "parentControlId": 31123, "controlId": "03.01.10.b", "title": "03.01.10.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583098" }, { "id": 559576, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "599843df-a12c-5fd0-854a-3e227082553e", "parentControlId": 31123, "controlId": "03.01.10.c", "title": "03.01.10.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583098" }, { "id": 559577, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd200148-708d-568a-bed4-58659060457a", "parentControlId": 31123, "controlId": "03.01.11", "title": "03.01.11", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583098" }, { "id": 559578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa9e0ac3-1a20-5ee1-b506-1be78a9e7c67", "parentControlId": 31123, "controlId": "03.01.12.a", "title": "03.01.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583098" }, { "id": 559579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10c18c26-68e8-587e-b5c3-a607b84639be", "parentControlId": 31123, "controlId": "03.01.16.a", "title": "03.01.16.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583098" }, { "id": 559580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "801dfcb5-024c-5c11-ba05-da2f3845829f", "parentControlId": 31123, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583098" }, { "id": 559581, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1069f43-9e7a-5cca-9d8c-12b80835ac01", "parentControlId": 31123, "controlId": "03.04.01.a", "title": "03.04.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583099" }, { "id": 559582, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "659de7d7-1e0d-55d0-a216-8a3286cc2839", "parentControlId": 31123, "controlId": "03.04.02.a", "title": "03.04.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583099" }, { "id": 559583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d53f8bb-bc91-5002-a1d6-6eaf9dc6eac3", "parentControlId": 31123, "controlId": "03.04.06.a", "title": "03.04.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583099" }, { "id": 559584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75638f49-0037-524f-a98b-395756d4026f", "parentControlId": 31123, "controlId": "03.04.06.b", "title": "03.04.06.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583099" }, { "id": 559585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10552111-2b6c-59b3-b484-a19777e54d6c", "parentControlId": 31123, "controlId": "03.04.06.d", "title": "03.04.06.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583099" }, { "id": 559586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ff68139-bba5-5eca-bc62-ad63f90fc841", "parentControlId": 31123, "controlId": "03.05.07.d", "title": "03.05.07.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583099" }, { "id": 559587, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad6332c4-b83d-5a0b-96be-0c1ffed75bff", "parentControlId": 31123, "controlId": "03.05.07.e", "title": "03.05.07.e", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583099" }, { "id": 559588, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c47f6e3-3fd6-50c3-9bc0-794ec4c6aac4", "parentControlId": 31123, "controlId": "03.05.07.f", "title": "03.05.07.f", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583099" }, { "id": 559589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36249aaa-ea63-5611-a8ac-dcf324f9100a", "parentControlId": 31123, "controlId": "03.05.12.d", "title": "03.05.12.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583099" }, { "id": 559590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "887ebc8c-c0d3-5043-941b-85cdebca6b6d", "parentControlId": 31123, "controlId": "03.08.07.a", "title": "03.08.07.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5831" }, { "id": 559591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07c8c0a8-2875-5bf0-9ec2-4cf4e9796341", "parentControlId": 31123, "controlId": "03.13.12.b", "title": "03.13.12.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5831" }, { "id": 559626, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583104", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c21a5fc8-0cd6-55d1-8182-00056fa35e3b", "parentControlId": 31123, "controlId": "PR.DS-10", "title": "PR.DS-10", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583104" }, { "id": 559627, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583104", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "630502b5-12e2-53cb-bcbe-ceb509221bec", "parentControlId": 31123, "controlId": "PR.PS", "title": "PR.PS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583104" }, { "id": 559628, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583104", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03db37d9-b556-595f-9b41-0058f8016d20", "parentControlId": 31123, "controlId": "PR.PS-05", "title": "PR.PS-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583104" }, { "id": 559740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48e84fc8-9664-548f-8f9d-ec3c216ac242", "parentControlId": 31123, "controlId": "ASSET-3a", "title": "ASSET-3a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583117" }, { "id": 559741, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2f0f605-ccd4-5c80-93cf-3863f3d11557", "parentControlId": 31123, "controlId": "ASSET-3b", "title": "ASSET-3b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583117" }, { "id": 559742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "adbef6f9-ff66-5429-86eb-abbab8e6d598", "parentControlId": 31123, "controlId": "ASSET-3c", "title": "ASSET-3c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583117" }, { "id": 559743, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58f2f572-10cf-55f6-9aa2-445e551793c8", "parentControlId": 31123, "controlId": "SITUATION-1c", "title": "SITUATION-1c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583117" }, { "id": 559744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2a443e6-6dd5-58aa-9c99-d40571921325", "parentControlId": 31123, "controlId": "SITUATION-1d", "title": "SITUATION-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583117" }, { "id": 559745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a04156b9-a2b5-5fc1-9343-22cdd9b235a9", "parentControlId": 31123, "controlId": "ARCHITECTURE-2e", "title": "ARCHITECTURE-2e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583118" }, { "id": 559746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fddb0f01-dd73-56c1-8737-e37d05d6d39a", "parentControlId": 31123, "controlId": "ARCHITECTURE-3b", "title": "ARCHITECTURE-3b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583118" }, { "id": 559747, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "814d1e73-2623-543a-bd53-6aedc440dd34", "parentControlId": 31123, "controlId": "ARCHITECTURE-3d", "title": "ARCHITECTURE-3d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583118" }, { "id": 559748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82e15564-e044-5ff2-89c9-acee9708aff6", "parentControlId": 31123, "controlId": "ARCHITECTURE-3e", "title": "ARCHITECTURE-3e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583118" }, { "id": 559749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f236399-28dd-5783-b33e-ac74e9c08298", "parentControlId": 31123, "controlId": "ARCHITECTURE-3f", "title": "ARCHITECTURE-3f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583118" }, { "id": 559750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1c6cac7-95e8-5da6-b413-5bbf074c0fc9", "parentControlId": 31123, "controlId": "ARCHITECTURE-3g", "title": "ARCHITECTURE-3g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583118" }, { "id": 559751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2aa77d9-be5b-5cef-81b0-047b50cfeb25", "parentControlId": 31123, "controlId": "ARCHITECTURE-3h", "title": "ARCHITECTURE-3h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583118" }, { "id": 559752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1dd6e17-7ec0-527f-a572-43b5ec8c3df2", "parentControlId": 31123, "controlId": "ARCHITECTURE-3l", "title": "ARCHITECTURE-3l", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583118" }, { "id": 559877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583141", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a05ad376-08a2-5633-a166-ee4d99a77421", "parentControlId": 31123, "controlId": "CIP-010-4 1.1", "title": "CIP-010-4 1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583141" }, { "id": 559878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583141", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1b82888-de85-5173-8b39-46a1d739b78b", "parentControlId": 31123, "controlId": "CIP-010-4 1.1.1", "title": "CIP-010-4 1.1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583141" }, { "id": 559879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583141", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e97b4ca-ac5c-5d0c-89df-bac9676fa66c", "parentControlId": 31123, "controlId": "CIP-010-4 1.1.2", "title": "CIP-010-4 1.1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583141" }, { "id": 559880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583142", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92985756-2677-5ba3-9ae2-b2552c612e10", "parentControlId": 31123, "controlId": "CIP-010-4 1.1.3", "title": "CIP-010-4 1.1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583142" }, { "id": 559881, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583142", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bacccef6-51ef-540c-aa8a-a40f52c2342e", "parentControlId": 31123, "controlId": "CIP-010-4 1.1.4", "title": "CIP-010-4 1.1.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583142" }, { "id": 559882, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583142", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cd3c466-78a8-51b4-b8de-32fa8d34da02", "parentControlId": 31123, "controlId": "CIP-010-4 1.1.5", "title": "CIP-010-4 1.1.5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583142" }, { "id": 559883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583142", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0745094-2a88-5efa-90de-c9ea0b33c409", "parentControlId": 31123, "controlId": "CIP-010-4 2.1", "title": "CIP-010-4 2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583142" }, { "id": 559969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bc3a3c0-1cf3-52ef-902a-16d1cb09e606", "parentControlId": 31123, "controlId": "B4", "title": "B4", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583152" }, { "id": 559970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12ef7a6b-b37e-5ca1-86bf-c4dc6fa10ada", "parentControlId": 31123, "controlId": "B4.b", "title": "B4.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583152" }, { "controlId": "A.4.2.1", "title": "A.4.2.1 — Configuration Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-1, CM-2, CM-3, CM-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "aee26844-91fd-5ab2-9df9-788f370cb930", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.1", "title": "NEI 08-09 Sec 4.2.1 — Configuration Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "85a516c9-965c-50a9-99ac-be7db45558d8", "isPublic": true }, { "controlId": "10 CFR 73.54(e)", "title": "10 CFR 73.54(e) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "09a4ba2d-5b61-5372-bf6c-45860f0ade23", "isPublic": true }, { "controlId": "B.5.3", "title": "B.5.3 — Changes to File System and Operating System Permissions", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-5, AC-6, SI-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "6de6082d-90e8-5d83-8ca7-1f9299ee1c12", "isPublic": true }, { "controlId": "NEI 08-09 App D.5.3", "title": "NEI 08-09 App D.5.3 — Changes to File System and Operating System Permissions", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.5.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "c63da637-a191-5057-b3f7-7d0db6cdf531", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.5.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "cf341aaa-14a2-512c-84bc-47cf807ca7b5", "isPublic": true }, { "controlId": "B.5.4", "title": "B.5.4 — Hardware Configuration", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-6, CM-7, MP-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "19df641d-d20c-5da5-97ed-e6b6167d3c69", "isPublic": true }, { "controlId": "NEI 08-09 App D.5.4", "title": "NEI 08-09 App D.5.4 — Hardware Configuration", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.5.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "f25afd32-5994-5428-a6eb-89df87deb073", "isPublic": true }, { "controlId": "C.11.3", "title": "C.11.3 — Baseline Configuration", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1012e757-3c96-5035-b490-632af0477439", "isPublic": true }, { "controlId": "NEI 08-09 App E.11.3", "title": "NEI 08-09 App E.11.3 — Baseline Configuration", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.11.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "a6e4f338-2aba-5f03-83f6-793e7d684d1f", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(4)", "title": "10 CFR 73.54(d)(4) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.11.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "adb4e564-a7c2-5f9b-a8b7-26f4c09bd431", "isPublic": true }, { "controlId": "C.11.7", "title": "C.11.7 — Configuration Settings", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "b54227dc-3588-5731-9458-cd1f89c684e7", "isPublic": true }, { "controlId": "NEI 08-09 App E.11.7", "title": "NEI 08-09 App E.11.7 — Configuration Settings", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.11.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d648b2f1-c1e3-53ef-8013-7f1ad6b321c6", "isPublic": true }, { "controlId": "CIP-010-4-R1", "title": "CIP-010-4-R1 — Configuration Change Management and Baseline Documentation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "bf2ca338-5179-53d4-827d-e8eacd6b5c6d", "isPublic": true }, { "controlId": "CIP-010-4-1.1", "title": "CIP-010-4-1.1 — Develop a baseline configuration, individually or by group, which shall include the following items: 1.1.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "71e043bc-c57d-518d-a26d-99e89562fd25", "isPublic": true }, { "controlId": "CIP-010-4-1.1.1", "title": "CIP-010-4-1.1.1 — Operating system(s) (including version) or firmware where no independent operating system exists", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "274b541a-79db-55c4-b0d1-f3d798041ae4", "isPublic": true }, { "controlId": "CIP-010-4-1.1.2", "title": "CIP-010-4-1.1.2 — Any commercially available or open-source application software (including version) intentionally installed", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2bc7964b-0d65-5b47-a6ca-ceb21e2322a3", "isPublic": true }, { "controlId": "CIP-010-4-1.1.3", "title": "CIP-010-4-1.1.3 — Any custom software installed", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f2163bba-ce92-59a2-a262-8d5e586a7979", "isPublic": true }, { "controlId": "CIP-010-4-1.1.4", "title": "CIP-010-4-1.1.4 — Any logical network accessible ports", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d8b6c0a4-5828-5a6b-a9a3-68dc8716cde6", "isPublic": true }, { "controlId": "CIP-010-4-1.1.5", "title": "CIP-010-4-1.1.5 — Any security patches applied.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "38dc1dde-4872-59ab-8aa1-98dd39a3c539", "isPublic": true }, { "controlId": "CIP-010-4-1.2", "title": "CIP-010-4-1.2 — Authorize and document changes that deviate from the existing baseline configuration.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b4c31521-053a-531d-b762-95ecc5789cdb", "isPublic": true }, { "controlId": "CIP-010-4-1.3", "title": "CIP-010-4-1.3 — For a change that deviates from the existing baseline configuration, update the baseline configuration as necessary w...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e836d69e-cc89-5927-9e0a-df36623c664c", "isPublic": true }, { "controlId": "CIP-010-4-1.4", "title": "CIP-010-4-1.4 — For a change that deviates from the existing baseline configuration: 1.4.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6f2d8df3-1a14-5dd9-a5d7-82e33f6b43da", "isPublic": true }, { "controlId": "CIP-010-4-1.4.1", "title": "CIP-010-4-1.4.1 — Prior to the change, determine required cyber security controls in CIP-005 and CIP-007 that could be impacted by the...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0cb2fc9a-c4dd-53be-adfd-5b40f43451be", "isPublic": true }, { "controlId": "CIP-010-4-1.4.2", "title": "CIP-010-4-1.4.2 — Following the change, verify that required cyber security controls determined in 1.4.1 are not adversely affected", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0d47dd28-0760-59dc-be06-737cf66c82c6", "isPublic": true }, { "controlId": "CIP-010-4-1.4.3", "title": "CIP-010-4-1.4.3 — Document the results of the verification.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "87c0ae2e-ffbd-5f61-9c46-eda64250e389", "isPublic": true }, { "controlId": "CIP-010-4-1.5", "title": "CIP-010-4-1.5 — Where technically feasible, for each change that deviates from the existing baseline configuration: 1.5.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6cc70bf2-8cb9-5428-865a-82abf7896a8b", "isPublic": true }, { "controlId": "CIP-010-4-1.5.1", "title": "CIP-010-4-1.5.1 — Prior to implementing any change in the production environment", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ea391388-58e0-58ea-977c-ad1cb1f2f21e", "isPublic": true }, { "controlId": "CIP-010-4-1.6", "title": "CIP-010-4-1.6 — Prior to a change that deviates from the existing baseline configuration associated with baseline items in Parts 1.1....", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "82925523-e956-5a0e-9c2f-f1b50181dc0b", "isPublic": true }, { "controlId": "CIP-010-4-1.6.1", "title": "CIP-010-4-1.6.1 — Verify the identity of the software source", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a666919e-2e80-53f9-b0a3-e9b39ff2abdf", "isPublic": true }, { "controlId": "CIP-010-4-1.6.2", "title": "CIP-010-4-1.6.2 — Verify the integrity of the software obtained from the software source.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8159eb22-8484-5a19-9667-6bcc6522087a", "isPublic": true }, { "controlId": "NSS-17T-Sec6.4", "title": "NSS-17T-Sec6.4 — System Hardening & Baseline Configuration Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "48937cd5-cb27-543d-b059-5efd70e1c3a6", "isPublic": true }, { "controlId": "IEC-62645-7.2", "title": "IEC-62645-7.2 — I&C System Hardening and Least Functionality", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "2fbff12e-f2c7-5d89-b64d-80cb2af8d9d0", "isPublic": true }, { "controlId": "IEC-63096-12.5", "title": "IEC-63096-12.5 — Control of Operational Software and Baseline Configurations", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "2b8b6141-07bb-5490-ac96-6dc5985f7584", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.5", "title": "IEEE-7-4.3.2-5.3.5 — Software Configuration Management in Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "e7b5acc4-7f18-5330-b742-56693cd2f13c", "isPublic": true } ], "id": 31123, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730971", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730971", "catalogueId": 1062, "uuid": "0d47b24a-e627-5a1b-a1c2-e99d15476708", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted system hardening standards?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Secure Baseline Configurations", "description": "

Control Description

Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted system hardening standards.

Evidence Request List (ERL)

E-AST-12\nE-AST-13\nE-AST-14\nE-AST-15\nE-AST-16\nE-AST-17\nE-AST-18\nE-AST-19\nE-AST-20\nE-AST-21

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).\n▪ The restrictiveness of the SBCs are commensurate with the criticality of the TAAS and/or sensitivity of the data being protected, in accordance with applicable laws, regulations and frameworks.\n▪ Tailored SBC are created for higher-risk operating environments and/or for TAAS that store, process or transmit sensitive/regulated data.

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted system hardening standards.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.2.1, B.5.3, B.5.4, C.11.3, C.11.7
NERC-CIP (2026) Requirements: CIP-010-4-R1", "controlId": "CFG-02", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-02", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70225, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590155", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590155", "securityControlId": 31124, "ccis": [], "uuid": "6de3e319-f2d9-5ba4-a223-69814ad451af", "testId": "CFG-02.1_A01", "test": "the circumstances requiring baseline configuration review / update are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-02_ODP[02]", "defaultText": null }, { "id": 70226, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590155", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590155", "securityControlId": 31124, "ccis": [], "uuid": "d8a165ac-c364-572e-85bf-96a621ed1c94", "testId": "CFG-02.1_A02", "test": "the baseline configuration of the system is reviewed / updated when required due to organization-defined circumstances.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: at least annually and when a significant change occurs", "otherId": "53A_R5_CM-02b.02", "defaultText": null }, { "id": 70227, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590156", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590156", "securityControlId": 31124, "ccis": [], "uuid": "51f56ada-0d3c-59cf-b3ce-40cb43444925", "testId": "CFG-02.1_A03", "test": "the frequency of baseline configuration review / update is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least annually", "otherId": "171A_R3_A.03.04.01.ODP[01]\n53A_R5_CM-02_ODP[01]", "defaultText": null }, { "id": 70228, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590156", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590156", "securityControlId": 31124, "ccis": [], "uuid": "2915870d-7b17-5e7c-b125-d210b8e412ca", "testId": "CFG-02.1_A04", "test": "the baseline configuration of the system is reviewed per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually and when a significant change occurs", "otherId": "53A_R5_CM-02b.01", "defaultText": null }, { "id": 70229, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590156", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590156", "securityControlId": 31124, "ccis": [], "uuid": "21f8a4d1-8259-58b9-8488-43034d4efb55", "testId": "CFG-02.1_A05", "test": "the baseline configuration of the system is updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: when a significant change occurs", "otherId": "SCF Created", "defaultText": null }, { "id": 70230, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590156", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590156", "securityControlId": 31124, "ccis": [], "uuid": "50440b02-f36c-5b3e-9326-fdfaa27ea7b8", "testId": "CFG-02.1_A06", "test": "the baseline configuration of the system is reviewed when system components are installed or modified.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.01.b[03]\n53A_R5_CM-02b.03", "defaultText": null }, { "id": 70231, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590156", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590156", "securityControlId": 31124, "ccis": [], "uuid": "734f2a80-ece8-56e3-9d30-9ca3f17b324b", "testId": "CFG-02.1_A07", "test": "the baseline configuration of the system is updated when system components are installed or modified.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.01.b[04]\n53A_R5_CM-02b.03", "defaultText": null }, { "id": 70232, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590156", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590156", "securityControlId": 31124, "ccis": [], "uuid": "500a374e-e7a9-534d-a43c-ed17703e4301", "testId": "CFG-02.1_A08", "test": "the system is reviewed to identify unnecessary or nonsecure functions, ports, protocols, connections, and services.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months, when any system functions, ports, protocols, or services changes are made, and after any significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.04.06.c", "defaultText": null }, { "id": 70233, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590157", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590157", "securityControlId": 31124, "ccis": [], "uuid": "4e9997dc-8b29-580c-9185-468e65e34e8a", "testId": "CFG-02.1_A09", "test": "the baseline configuration of the system is reviewed .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months and after any significant incidents or significant changes occur", "otherId": "171A_R3_A.03.04.01.b[01]", "defaultText": null }, { "id": 70234, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590157", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590157", "securityControlId": 31124, "ccis": [], "uuid": "85258ac2-32c7-532a-a898-1a3388e1b3ad", "testId": "CFG-02.1_A10", "test": "the baseline configuration of the system is updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months and after any significant incidents or significant changes occur", "otherId": "171A_R3_A.03.04.01.b[02]", "defaultText": null } ], "externalMappings": [ { "id": 560093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583175", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efdb6f29-f495-512f-84bd-2278c535090b", "parentControlId": 31124, "controlId": "8.9", "title": "8.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583175" }, { "id": 560096, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583176", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fab25db-0445-5bcf-b6f5-348f5bc36e98", "parentControlId": 31124, "controlId": "CM-2(1)", "title": "CM-2(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583176" }, { "id": 560097, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583176", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bff1a01-8a6d-5659-a463-0a6192507a33", "parentControlId": 31124, "controlId": "CM-2(3)", "title": "CM-2(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583176" }, { "id": 560098, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583176", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f67b418-ab8c-50c0-bbd7-30baa2772c6b", "parentControlId": 31124, "controlId": "CM-02", "title": "CM-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583176" }, { "id": 560100, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583176", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "249f311b-20e2-5f0c-838d-2dfa899e0310", "parentControlId": 31124, "controlId": "CM-02", "title": "CM-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583176" }, { "id": 560101, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583176", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b16edba8-9c02-56d9-81e9-38d0455fdaf1", "parentControlId": 31124, "controlId": "CM-02", "title": "CM-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583176" }, { "id": 560102, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583176", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cbb1a9f3-a27d-5614-b33c-838c4b7397a3", "parentControlId": 31124, "controlId": "CM-02", "title": "CM-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583176" }, { "id": 560103, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583176", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "841ca9ab-5ed7-570e-afac-758ff74066b3", "parentControlId": 31124, "controlId": "CM-02", "title": "CM-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583176" }, { "id": 560104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583176", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d512685d-426a-5621-8f37-dde25a69c482", "parentControlId": 31124, "controlId": "CM-02", "title": "CM-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583176" }, { "id": 560105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583177", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bab63e6f-5a3c-5cd1-aaba-532d438fe798", "parentControlId": 31124, "controlId": "CM-2", "title": "CM-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583177" }, { "id": 560106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583177", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43ea172d-6f92-5c0a-a56f-206b446bc9a6", "parentControlId": 31124, "controlId": "CM-2", "title": "CM-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583177" }, { "id": 560107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583177", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e50cd0ae-41b9-59f4-ae15-e905d7f84745", "parentControlId": 31124, "controlId": "CM-2", "title": "CM-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583177" }, { "id": 560110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583177", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3747894b-c4c8-5362-8229-776dade4fd3d", "parentControlId": 31124, "controlId": "3.3.3", "title": "3.3.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583177" }, { "id": 560111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583177", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1902c6ec-bac8-5658-92d4-61b929e2af01", "parentControlId": 31124, "controlId": "NFO - CM-2(1)", "title": "NFO - CM-2(1)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583177" }, { "id": 560112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583177", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a3dde88-aa00-5301-b841-608ec018699a", "parentControlId": 31124, "controlId": "03.04.01.b", "title": "03.04.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583177" }, { "id": 560113, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583177", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcd8b100-23fc-51c2-8490-eec8227b200b", "parentControlId": 31124, "controlId": "03.04.02.b", "title": "03.04.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583177" }, { "id": 560121, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583179", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab22d029-bef1-5826-b463-73d3062ee064", "parentControlId": 31124, "controlId": "PR.PS", "title": "PR.PS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583179" }, { "id": 560128, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583179", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b00221eb-a7f0-568e-ae4b-e42724898c2e", "parentControlId": 31124, "controlId": "ASSET-3d", "title": "ASSET-3d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583179" }, { "id": 560129, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583179", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b3e6b60-ff85-5eec-a05f-e2d8344a9d91", "parentControlId": 31124, "controlId": "ASSET-3e", "title": "ASSET-3e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583179" }, { "id": 560143, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583181", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef762a19-9920-5d9b-ad7e-b1e211b6bba4", "parentControlId": 31124, "controlId": "CIP-010-4 1.3", "title": "CIP-010-4 1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583181" }, { "id": 560144, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583181", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14b9473d-292e-5a72-b0ac-8a4a77a66012", "parentControlId": 31124, "controlId": "CIP-010-4 2.1", "title": "CIP-010-4 2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583181" }, { "controlId": "C.11.7", "title": "C.11.7 — Configuration Settings", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "c415c199-d11a-507d-b0c0-b2d6a62bbb18", "isPublic": true }, { "controlId": "NEI 08-09 App E.11.7", "title": "NEI 08-09 App E.11.7 — Configuration Settings", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.11.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "a7344189-cf20-5187-9e6d-e90a72788ffa", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(4)", "title": "10 CFR 73.54(d)(4) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.11.7", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "945a123a-178d-564c-9ddf-d943b8cb030a", "isPublic": true }, { "controlId": "NSS-17T-Sec6.4", "title": "NSS-17T-Sec6.4 — System Hardening & Baseline Configuration Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "3f76f606-b4fd-585c-8f37-e41494413432", "isPublic": true }, { "controlId": "IEC-62645-7.2", "title": "IEC-62645-7.2 — I&C System Hardening and Least Functionality", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "ee50d9ed-2877-5c9b-885a-a35ed40cd728", "isPublic": true }, { "controlId": "IEC-63096-12.5", "title": "IEC-63096-12.5 — Control of Operational Software and Baseline Configurations", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "f4257a2f-df13-5224-a8c9-59eb1798d2a0", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.5", "title": "IEEE-7-4.3.2-5.3.5 — Software Configuration Management in Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "7261cc66-bed3-586d-a3f9-288f7230e8af", "isPublic": true } ], "id": 31124, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730971", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730971", "catalogueId": 1062, "uuid": "9765dfdd-092e-5da5-850d-a70a68421c12", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization review and update baseline configurations:\n (1) At least annually;\n (2) When required due to so; or\n (3) As part of system component installations and upgrades?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Reviews & Updates", "description": "

Control Description

Mechanisms exist to review and update baseline configurations:\n(1) At least annually;\n(2) When required due to so; or\n(3) As part of system component installations and upgrades.

Evidence Request List (ERL)

E-AST-12

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).\n▪ IT and/or cybersecurity personnel perform an annual review of existing configurations to ensure security objectives are still being met.

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to review and update baseline configurations:\n(1) At least annually;\n(2) When required due to so; or\n(3) As part of system component installations and upgrades.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.11.7", "controlId": "CFG-02.1", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Configuration Management (CM) program\n∙ Change control program

Small Business (10-49 staff)

∙ Configuration Management (CM) program\n∙ Change control program

Medium Business (50-249 staff)

∙ Configuration Management (CM) program\n∙ Change control program

Large Business (250-999 staff)

∙ Configuration Management (CM) program\n∙ Change control program

Enterprise (>1,000 staff)

∙ Configuration Management (CM) program\n∙ Change control program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70235, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590157", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590157", "securityControlId": 31125, "ccis": [], "uuid": "3488a85d-2c16-50ee-b6c5-69813892f371", "testId": "CFG-02.2_A01", "test": "system components for which to manage, apply and verify configuration settings are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-06(01)_ODP[01]\n53A_R5_CM-06(01)_ODP[03]\n53A_R5_CM-06(01)_ODP[04]", "defaultText": null }, { "id": 70236, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590157", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590157", "securityControlId": 31125, "ccis": [], "uuid": "c705babb-c1ad-5915-b6c1-063dd811fb40", "testId": "CFG-02.2_A02", "test": "automated discovery and management tools are employed to maintain an up-to-date, complete, accurate and readily available inventory of system components.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "172A_3.4.3e[c]\n53A_R5_CM-02(02)[03]\n53A_R5_CM-02(02)[04]\n53A_R5_CM-06(01)[01]\n53A_R5_CM-06(01)[02]\n53A_R5_CM-06(01)[03]", "defaultText": null }, { "id": 70237, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590164", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590164", "securityControlId": 31125, "ccis": [], "uuid": "bf69c68c-1b68-517e-94e3-bcb0fac044e5", "testId": "CFG-02.2_A03", "test": "automated discovery and management tools for the inventory of system components are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "172A_3.4.3e[a]\n53A_R5_CM-02(02)_ODP\n53A_R5_CM-06(01)_ODP[02]", "defaultText": null }, { "id": 70238, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590164", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590164", "securityControlId": 31125, "ccis": [], "uuid": "2218838a-7c56-543e-ad9a-c90d85409b4c", "testId": "CFG-02.2_A04", "test": "an up-to-date, complete, accurate and readily available inventory of system components exists.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "172A_3.4.3e[b]\n53A_R5_CM-02(02)[01]\n53A_R5_CM-02(02)[02]", "defaultText": null }, { "id": 70239, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590164", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590164", "securityControlId": 31125, "ccis": [], "uuid": "797b40e8-cafd-5d45-9420-da38324dcc11", "testId": "CFG-02.2_A05", "test": "activities associated with configuration-controlled changes to the system are monitored.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.03.d[01]", "defaultText": null }, { "id": 70240, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590164", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590164", "securityControlId": 31125, "ccis": [], "uuid": "88b5f731-db16-5bd3-affa-8cd06cfbb505", "testId": "CFG-02.2_A06", "test": "activities associated with configuration-controlled changes to the system are reviewed.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.03.d[02]", "defaultText": null } ], "externalMappings": [ { "id": 560191, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4368ec71-1bca-5594-a5eb-5439b1e47ca1", "parentControlId": 31125, "controlId": "CM 1.3", "title": "CM 1.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583187" }, { "id": 560192, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51b507d5-5bee-583e-b46e-eec0b92ee4de", "parentControlId": 31125, "controlId": "SR 3.3 RE 1", "title": "SR 3.3 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583187" }, { "id": 560193, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de6b6c70-3c11-591d-acbe-7618cd353312", "parentControlId": 31125, "controlId": "SR 3.3 RE 2", "title": "SR 3.3 RE 2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583187" }, { "id": 560194, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8bcba6c-9590-5867-a3d6-7dcf48ed2a91", "parentControlId": 31125, "controlId": "SR 7.6 RE 1", "title": "SR 7.6 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583188" }, { "id": 560195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed47b41a-f33f-5f22-8ce1-81fb4d50b028", "parentControlId": 31125, "controlId": "CR 7.6(1)", "title": "CR 7.6(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583188" }, { "id": 560197, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14dd482a-9232-5603-9118-c2e098046154", "parentControlId": 31125, "controlId": "CM-2(2)", "title": "CM-2(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583188" }, { "id": 560198, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24c79962-0c5f-5c76-aced-777ffe08a8d7", "parentControlId": 31125, "controlId": "CM-6(1)", "title": "CM-6(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583188" }, { "id": 560199, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5daf0f3-cea8-55f4-b81d-8a8be32ce05f", "parentControlId": 31125, "controlId": "CM-02(02)", "title": "CM-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583188" }, { "id": 560200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2eee0cd1-2594-5e02-b130-bd3de9230714", "parentControlId": 31125, "controlId": "CM-06(01)", "title": "CM-06(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583188" }, { "id": 560201, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c92bfb34-b7fd-5890-9bac-e56ebd031ca5", "parentControlId": 31125, "controlId": "CM-02(02)", "title": "CM-02(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583188" }, { "id": 560202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3029d1e0-390c-5cf9-a2dd-8597bac59096", "parentControlId": 31125, "controlId": "CM-06(01)", "title": "CM-06(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583188" }, { "id": 560203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ac07971-051b-57fe-8eec-610017033089", "parentControlId": 31125, "controlId": "CM-02(02)", "title": "CM-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583189" }, { "id": 560204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "581c8b42-6e08-58ad-831e-8f1b9a4f1614", "parentControlId": 31125, "controlId": "CM-06(01)", "title": "CM-06(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583189" }, { "id": 560205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "223992dc-5710-5117-bdeb-2950eae3adee", "parentControlId": 31125, "controlId": "CM-02(02)", "title": "CM-02(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583189" }, { "id": 560206, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3e4e9ea-22d3-50cc-98e0-2d77b474a2ac", "parentControlId": 31125, "controlId": "CM-02(02)", "title": "CM-02(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583189" }, { "id": 560207, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5bfc2b28-0f72-5a7e-91da-f135c48ebac0", "parentControlId": 31125, "controlId": "CM-06(01)", "title": "CM-06(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583189" }, { "id": 560208, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4b1c9df-7989-5417-83b3-4a96b497ba5e", "parentControlId": 31125, "controlId": "CM-6(1)", "title": "CM-6(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583189" }, { "id": 560210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0388fcf5-3c56-540a-b884-c37f9cd22d02", "parentControlId": 31125, "controlId": "03.04.02.b", "title": "03.04.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583189" }, { "id": 560211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e943870-694a-589a-b5f7-1d99f6e147fd", "parentControlId": 31125, "controlId": "03.04.03.d", "title": "03.04.03.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583189" }, { "id": 560220, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bf77139-ff32-5bc6-b0bb-34653202d457", "parentControlId": 31125, "controlId": "ASSET-3e", "title": "ASSET-3e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583191" }, { "controlId": "CIP-010-4-R2", "title": "CIP-010-4-R2 — Configuration Monitoring for Unauthorized Changes", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "de6bb0e3-6517-5df9-9436-df4cb70f9ce5", "isPublic": true }, { "controlId": "CIP-010-4-2.1", "title": "CIP-010-4-2.1 — Monitor at least once every 35 calendar days for changes to the baseline configuration (as described in Requirement R...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5960ac8e-965d-5e9d-9887-efe3e97335d2", "isPublic": true }, { "controlId": "NSS-17T-Sec6.4", "title": "NSS-17T-Sec6.4 — System Hardening & Baseline Configuration Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "14556418-cf03-521e-ac8a-1c77f2e68763", "isPublic": true }, { "controlId": "IEC-62645-7.2", "title": "IEC-62645-7.2 — I&C System Hardening and Least Functionality", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "05f11915-9789-55f5-a738-b44cbbe23a31", "isPublic": true }, { "controlId": "IEC-63096-12.5", "title": "IEC-63096-12.5 — Control of Operational Software and Baseline Configurations", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "f2164e7c-d45d-5e1c-bd65-576c7dea754e", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.5", "title": "IEEE-7-4.3.2-5.3.5 — Software Configuration Management in Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "06b2689b-538f-559f-bbf0-1989a6f9ddca", "isPublic": true } ], "id": 31125, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730971", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730971", "catalogueId": 1062, "uuid": "dd2908f3-a027-5e67-8b21-e98a75d5bd87", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to govern and report on baseline configurations of Technology Assets, Applications and/or Services (TAAS) through Continuous Diagnostics and Mitigation (CDM), or similar technologies?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 7.0, "title": "Automated Central Management & Verification", "description": "

Control Description

Automated mechanisms exist to govern and report on baseline configurations of Technology Assets, Applications and/or Services (TAAS) through Continuous Diagnostics and Mitigation (CDM), or similar technologies.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically govern and report on baseline configurations of Technology Assets, Applications and/or Services (TAAS) through Continuous Diagnostics and Mitigation (CDM), or similar technologies.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

NERC-CIP (2026) Requirements: CIP-010-4-R2", "controlId": "CFG-02.2", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-02.2", "references": "

Micro-Small Business (<10 staff)

∙ ManageEngine Vulnerability Manager Plus (https://manageengine.com)

Small Business (10-49 staff)

∙ ManageEngine Vulnerability Manager Plus (https://manageengine.com)

Medium Business (50-249 staff)

∙ ManageEngine Vulnerability Manager Plus (https://manageengine.com)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Large Business (250-999 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Enterprise (>1,000 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70241, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590165", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590165", "securityControlId": 31126, "ccis": [], "uuid": "bd06c85e-1b67-55c5-96b1-df11ca8e302c", "testId": "CFG-02.3_A01", "test": "the number of previous baseline configuration versions to be retained is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-02(03)_ODP", "defaultText": null }, { "id": 70242, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590165", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590165", "securityControlId": 31126, "ccis": [], "uuid": "0e9c0d2f-9f3e-52b2-875e-64f859b1d991", "testId": "CFG-02.3_A02", "test": "organization-defined number of previous baseline configuration version(s) of the system is/are retained to support rollback.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "53A_R5_CM-02(03)", "defaultText": null } ], "externalMappings": [ { "id": 560254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4a5b335-1e23-5f62-83de-4edb33e2c0c6", "parentControlId": 31126, "controlId": "CM-2(3)", "title": "CM-2(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583195" }, { "id": 560255, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3f7cc1b-bb56-55c1-bf4a-f792847bbfe5", "parentControlId": 31126, "controlId": "CM-02(03)", "title": "CM-02(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583195" }, { "id": 560256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a6a73fb-aebf-5857-a4ad-8204eb0e6243", "parentControlId": 31126, "controlId": "CM-02(03)", "title": "CM-02(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583195" }, { "id": 560257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "215ce68b-9574-5840-81ed-0eb2d9700ca7", "parentControlId": 31126, "controlId": "CM-02(03)", "title": "CM-02(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583195" }, { "id": 560258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61623d54-6871-58e1-b008-6395b736d53b", "parentControlId": 31126, "controlId": "CM-02(03)", "title": "CM-02(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583195" }, { "id": 560259, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a210097-f9cc-52de-a6e2-d42d63477e34", "parentControlId": 31126, "controlId": "CM-02(03)", "title": "CM-02(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583195" } ], "id": 31126, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730972", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730972", "catalogueId": 1062, "uuid": "f083851c-db0d-52b2-858d-784ed96d5ca9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization retain previous versions of baseline configuration to support roll back?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Retention Of Previous Configurations", "description": "

Control Description

Mechanisms exist to retain previous versions of baseline configuration to support roll back.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).\n▪ Historical versions of configurations are maintained for troubleshooting and forensics purposes.

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to retain previous versions of baseline configuration to support roll back.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CFG-02.3", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-02.3", "references": "

Micro-Small Business (<10 staff)

∙ Document baseline configurations for key systems

Small Business (10-49 staff)

∙ Configuration baseline documentation\n∙ CIS Benchmark hardening guides

Medium Business (50-249 staff)

∙ Configuration management program\n∙ Automated baseline assessment (e.g., CIS-CAT)

Large Business (250-999 staff)

∙ Enterprise CMDB\n∙ Automated configuration compliance scanning

Enterprise (>1,000 staff)

∙ Enterprise configuration management platform (e.g., Ansible, Puppet)\n∙ CMDB\n∙ Drift detection and remediation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70243, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590165", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590165", "securityControlId": 31127, "ccis": [], "uuid": "24ed5faf-479c-5d0e-8606-5b835898e9f7", "testId": "CFG-02.4_A01", "test": "a baseline configuration for system development environments that is managed separately from the operational baseline configuration is maintained.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-02(06)[01]", "defaultText": null }, { "id": 70244, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590165", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590165", "securityControlId": 31127, "ccis": [], "uuid": "371b1875-683e-5e46-abaa-37b6911e45ba", "testId": "CFG-02.4_A02", "test": "a baseline configuration for test environments that is managed separately from the operational baseline configuration is maintained.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CM-02(06)[02]", "defaultText": null } ], "externalMappings": [ { "id": 560270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583197", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83b6c08c-7e03-562e-875f-e91455635450", "parentControlId": 31127, "controlId": "8.25", "title": "8.25", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583197" }, { "id": 560272, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583197", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff7748c8-3343-5a14-9875-781094a2efbe", "parentControlId": 31127, "controlId": "CM-2(6)", "title": "CM-2(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583197" }, { "id": 560273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583197", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf530c63-5aa8-5232-91ba-731118d18975", "parentControlId": 31127, "controlId": "CM-02(06)", "title": "CM-02(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583197" }, { "id": 560274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583197", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5230dae2-9265-555e-9b49-5adcd6f84230", "parentControlId": 31127, "controlId": "CM-02(06)", "title": "CM-02(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583197" }, { "id": 560275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583197", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "031ef0dc-fbc7-5379-ab46-f81f8be31a7b", "parentControlId": 31127, "controlId": "CM-2(6)", "title": "CM-2(6)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583197" } ], "id": 31127, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730972", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730972", "catalogueId": 1062, "uuid": "62aa8e26-9e95-5bea-bc76-a855088a11fe", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization manage baseline configurations for development and test environments separately from operational baseline configurations to minimize the risk of unintentional changes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Development & Test Environment Configurations", "description": "

Control Description

Mechanisms exist to manage baseline configurations for development and test environments separately from operational baseline configurations to minimize the risk of unintentional changes.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).\n▪ Deviations from approved baseline configurations are handled on a case-by-case basis by IT/cybersecurity personnel. Acceptance of any deviations from baselines must be informed by performance of a risk assessment.\n▪ IT/cybersecurity personnel use an informal process to design, build and maintain secure configurations for test, development, staging and production environments, including the implementation of appropriate cybersecurity and data protection controls.

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).\n▪ The restrictiveness of the SBCs are commensurate with the criticality of the TAAS and/or sensitivity of the data being protected, in accordance with applicable laws, regulations and frameworks.\n▪ Tailored SBC are created for higher-risk operating environments and/or for TAAS that store, process or transmit sensitive/regulated data.

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to manage baseline configurations for development and test environments separately from operational baseline configurations to minimize the risk of unintentional changes.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CFG-02.4", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-02.4", "references": "

Micro-Small Business (<10 staff)

∙ Document baseline configurations for key systems

Small Business (10-49 staff)

∙ Configuration baseline documentation\n∙ CIS Benchmark hardening guides

Medium Business (50-249 staff)

∙ Configuration management program\n∙ Automated baseline assessment (e.g., CIS-CAT)

Large Business (250-999 staff)

∙ Enterprise CMDB\n∙ Automated configuration compliance scanning

Enterprise (>1,000 staff)

∙ Enterprise configuration management platform (e.g., Ansible, Puppet)\n∙ CMDB\n∙ Drift detection and remediation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70245, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590165", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590165", "securityControlId": 31128, "ccis": [], "uuid": "b7d3f054-c494-5dd1-afe9-d6cae0425846", "testId": "CFG-02.5_A01", "test": "security requirements to be applied to the system or system components when individuals return from travel are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-02(07)_ODP[01]\n171A_R3_A.03.04.12.ODP[02]", "defaultText": null }, { "id": 70246, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590166", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590166", "securityControlId": 31128, "ccis": [], "uuid": "94adb900-3118-5193-b822-be6ac26aecb1", "testId": "CFG-02.5_A02", "test": "organization-defined systems or system components with organization-defined configurations are issued to individuals traveling to locations that the organization deems to be of significant risk.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-02(07)(a)\n53A_R5_CM-02(07)_ODP[03]", "defaultText": null }, { "id": 70247, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590166", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590166", "securityControlId": 31128, "ccis": [], "uuid": "50ed2d44-e919-5dad-9398-aa4d54f30aa3", "testId": "CFG-02.5_A03", "test": "organization-defined controls are applied to the systems or system components when the individuals return from travel.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CM-02(07)(b)", "defaultText": null }, { "id": 70248, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590166", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590166", "securityControlId": 31128, "ccis": [], "uuid": "9c5fd6fa-993b-59b6-85d8-600b75dd69c0", "testId": "CFG-02.5_A04", "test": "configurations for systems or system components to be issued to individuals traveling to high-risk locations are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-02(07)_ODP[02]\n172A_3.14.3e_ODP[1]\n172A_3.14.3e[a]\n172A_3.14.3e[b]\n171A_R3_A.03.04.12.ODP[01]", "defaultText": null } ], "externalMappings": [ { "id": 560306, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50f2f19b-8b8c-5f0d-ba56-4c1a79ba6d23", "parentControlId": 31128, "controlId": "8.12", "title": "8.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583201" }, { "id": 560309, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e511683-b817-5cd3-b66b-d7970f16d8f9", "parentControlId": 31128, "controlId": "CM-2(7)", "title": "CM-2(7)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583201" }, { "id": 560310, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "805fb403-38db-5938-bfa5-315fb496eba4", "parentControlId": 31128, "controlId": "CM-02(07)", "title": "CM-02(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583201" }, { "id": 560311, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c56183e-be38-5d2d-af54-392f7196e7d5", "parentControlId": 31128, "controlId": "CM-07(06)", "title": "CM-07(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583201" }, { "id": 560312, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8675f4a-0691-5c34-bdcb-11815e2bc6df", "parentControlId": 31128, "controlId": "CM-07(07)", "title": "CM-07(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583201" }, { "id": 560313, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "197ad047-6a89-5999-93d9-8f0725dee51e", "parentControlId": 31128, "controlId": "CM-07(09)", "title": "CM-07(09)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583202" }, { "id": 560314, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f77a68a2-016c-5b86-ad93-7a591d5f0183", "parentControlId": 31128, "controlId": "CM-02(07)", "title": "CM-02(07)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583202" }, { "id": 560315, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "365031fa-4c85-5c88-af8f-37142acc07bd", "parentControlId": 31128, "controlId": "CM-02(07)", "title": "CM-02(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583202" }, { "id": 560316, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12801fa3-79a3-5085-a079-ed35bb97076a", "parentControlId": 31128, "controlId": "CM-07(06)", "title": "CM-07(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583202" }, { "id": 560317, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd2079f6-9cfc-5956-a83e-963b3f7414f7", "parentControlId": 31128, "controlId": "CM-07(07)", "title": "CM-07(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583202" }, { "id": 560318, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d410abab-747d-5560-880f-86987fcbd1c9", "parentControlId": 31128, "controlId": "CM-07(09)", "title": "CM-07(09)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583202" }, { "id": 560319, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b54e820-e584-5629-9105-3a4a1d72edfb", "parentControlId": 31128, "controlId": "CM-02(07)", "title": "CM-02(07)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583203" }, { "id": 560320, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4dbcab08-54b0-5092-b246-f2f3b8a70ceb", "parentControlId": 31128, "controlId": "CM-02(07)", "title": "CM-02(07)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583203" }, { "id": 560324, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f13eb82b-7035-52dc-9891-50c8b6936db0", "parentControlId": 31128, "controlId": "CM-7(6)", "title": "CM-7(6)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583203" }, { "id": 560325, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "501d3efe-a3c5-5ca4-b3aa-14f7c6f88b62", "parentControlId": 31128, "controlId": "CM-7(7)", "title": "CM-7(7)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583203" }, { "id": 560326, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70adb37d-cb43-5af3-b8b0-90e9770b7b3c", "parentControlId": 31128, "controlId": "CM-7(9)", "title": "CM-7(9)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583203" }, { "id": 560332, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2cc1b284-c6af-56cd-b5f9-ee4513470b98", "parentControlId": 31128, "controlId": "NFO - CM-2(7)", "title": "NFO - CM-2(7)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583204" }, { "id": 560333, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50febb31-c9fc-52b3-82b2-8e9e0b43cf66", "parentControlId": 31128, "controlId": "03.04.01.a", "title": "03.04.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583204" }, { "id": 560334, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86d50093-4d40-5097-9b8a-2e3ccecd172a", "parentControlId": 31128, "controlId": "03.04.02.a", "title": "03.04.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583204" }, { "id": 560335, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e156e2c-5bdc-54c0-b794-566a4347ddc9", "parentControlId": 31128, "controlId": "03.04.06.a", "title": "03.04.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583204" }, { "id": 560336, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "808687cd-4894-5885-8b4f-625b4ba85978", "parentControlId": 31128, "controlId": "03.04.06.b", "title": "03.04.06.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583204" }, { "id": 560337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b68b1f40-76f4-59bb-ba78-9b512d8f85d5", "parentControlId": 31128, "controlId": "03.04.06.d", "title": "03.04.06.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583204" }, { "id": 560338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583205", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3072cb33-5ddc-56f0-b2e7-4539538274c1", "parentControlId": 31128, "controlId": "03.04.12.a", "title": "03.04.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583205" }, { "id": 560342, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583205", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db668504-840b-528e-b447-6e79f89fd80f", "parentControlId": 31128, "controlId": "PR.PS", "title": "PR.PS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583205" }, { "id": 560421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6777729-daa8-5630-9ae1-f55b57fc8708", "parentControlId": 31128, "controlId": "SITUATION-1f", "title": "SITUATION-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583222" }, { "id": 560422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49f3a5c5-d7cc-5985-8fca-95c858a3b0ba", "parentControlId": 31128, "controlId": "ARCHITECTURE-3k", "title": "ARCHITECTURE-3k", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583222" } ], "id": 31128, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730972", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730972", "catalogueId": 1062, "uuid": "4ed8becf-d0bf-5495-bde0-40ebac7c6a4e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization configure Technology Assets, Applications and/or Services (TAAS) utilized in high-risk areas with more restrictive baseline configurations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Configure Technology Assets, Applications and/or Services (TAAS) for High-Risk Areas", "description": "

Control Description

Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) utilized in high-risk areas with more restrictive baseline configurations.

Evidence Request List (ERL)

E-AST-12\nE-AST-13\nE-AST-14\nE-AST-15\nE-AST-16\nE-AST-17\nE-AST-18\nE-AST-19\nE-AST-20\nE-AST-21\nE-AST-33

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).\n▪ The restrictiveness of the SBCs are commensurate with the criticality of the TAAS and/or sensitivity of the data being protected, in accordance with applicable laws, regulations and frameworks.\n▪ Tailored SBC are created for higher-risk operating environments and/or for TAAS that store, process or transmit sensitive/regulated data.

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to configure Technology Assets, Applications and/or Services (TAAS) utilized in high-risk areas with more restrictive baseline configurations.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CFG-02.5", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-02.5", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70250, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590167", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590167", "securityControlId": 31130, "ccis": [], "uuid": "dabf1933-fc62-5862-860a-f7bef3ec755b", "testId": "CFG-02.7_A01", "test": "configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using common secure configurations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-06a.", "defaultText": null }, { "id": 70251, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590167", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590167", "securityControlId": 31130, "ccis": [], "uuid": "56f99254-72af-57c7-972b-8e1a40a2c403", "testId": "CFG-02.7_A02", "test": "changes to the configuration settings are controlled in accordance with organizational policies and procedures.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-06d.[02]\n53A_R5_CM-06b.", "defaultText": null }, { "id": 70252, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590167", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590167", "securityControlId": 31130, "ccis": [], "uuid": "0202aece-a4b7-5779-b431-9d93bc8230d9", "testId": "CFG-02.7_A03", "test": "any deviations from established configuration settings are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-06c.[01]\n171A_R3_A.03.04.02.b[01]", "defaultText": null }, { "id": 70253, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590167", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590167", "securityControlId": 31130, "ccis": [], "uuid": "dd128aed-fea5-553c-8f76-ab0adbf05b5c", "testId": "CFG-02.7_A04", "test": "any deviations from established configuration settings are approved.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-06c.[02]\n171A_R3_A.03.04.02.b[02]", "defaultText": null }, { "id": 70254, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590167", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590167", "securityControlId": 31130, "ccis": [], "uuid": "c361a978-a224-582b-a6d8-ff1c4630a4b3", "testId": "CFG-02.7_A05", "test": "common secure configurations to establish and document configuration settings for components employed within the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-06_ODP[01]", "defaultText": null }, { "id": 70255, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590167", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590167", "securityControlId": 31130, "ccis": [], "uuid": "9bbdf24c-87d1-5691-bedd-6e2331b85f0b", "testId": "CFG-02.7_A06", "test": "system components for which approval of deviations is needed are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-06_ODP[02]", "defaultText": null }, { "id": 70256, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590168", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590168", "securityControlId": 31130, "ccis": [], "uuid": "941fd96d-fa94-58d7-8642-26731744b2eb", "testId": "CFG-02.7_A07", "test": "operational requirements necessitating approval of deviations are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-06_ODP[03]", "defaultText": null }, { "id": 70257, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590168", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590168", "securityControlId": 31130, "ccis": [], "uuid": "1ea14e1f-bc6d-5881-9f6f-0d3ead0c0a46", "testId": "CFG-02.7_A08", "test": "changes to the configuration settings are monitored in accordance with organizational policies and procedures.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-06d.[01]", "defaultText": null } ], "externalMappings": [ { "id": 560506, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583233", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72e23fc7-992d-5c93-9129-2b077992d06c", "parentControlId": 31130, "controlId": "CM-6", "title": "CM-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583233" }, { "id": 560507, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583233", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7386755e-0c60-5594-8645-3975af1644f0", "parentControlId": 31130, "controlId": "CM-06", "title": "CM-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583233" }, { "id": 560509, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583233", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4868fa9e-c951-5765-9c85-8fb5ce0e4d94", "parentControlId": 31130, "controlId": "CM-06", "title": "CM-06", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583233" }, { "id": 560510, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a53dea1-902d-5225-a882-2d30873b7b01", "parentControlId": 31130, "controlId": "CM-06", "title": "CM-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583234" }, { "id": 560511, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8a202de-e2e1-5b2e-b6d7-f15ee148e745", "parentControlId": 31130, "controlId": "CM-06", "title": "CM-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583234" }, { "id": 560512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1a64287-97f5-543b-adb2-079f22758126", "parentControlId": 31130, "controlId": "CM-06", "title": "CM-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583234" }, { "id": 560513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41e5243b-862e-5b5a-86cc-7327f4337d01", "parentControlId": 31130, "controlId": "CM-06", "title": "CM-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583234" }, { "id": 560514, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e04f3f4d-2381-5298-8043-34001e514840", "parentControlId": 31130, "controlId": "CM-6", "title": "CM-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583234" }, { "id": 560515, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acda8579-e3d5-59a6-8e0d-32bd38d1bbb5", "parentControlId": 31130, "controlId": "CM-6", "title": "CM-6", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583234" }, { "id": 560516, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7a87673-7850-58a5-9f51-d5b9688da4b5", "parentControlId": 31130, "controlId": "CM-6", "title": "CM-6", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583235" }, { "id": 560519, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70a5deb9-433f-5fcb-be07-9f26350431d6", "parentControlId": 31130, "controlId": "03.04.01.a", "title": "03.04.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583235" }, { "id": 560520, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a177a55-f466-52a4-97b0-38377deb6102", "parentControlId": 31130, "controlId": "03.04.02.b", "title": "03.04.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583235" }, { "id": 560536, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92966854-c5db-54b6-bfd3-95487b5c36c8", "parentControlId": 31130, "controlId": "CIP-010-4 1.2", "title": "CIP-010-4 1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583237" }, { "id": 560537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "609b20e9-e729-55a2-9ae4-f5d8a221c336", "parentControlId": 31130, "controlId": "CIP-010-4 1.4", "title": "CIP-010-4 1.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583237" }, { "id": 560538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4af74da6-5bed-5860-a0b1-bc7167e72da1", "parentControlId": 31130, "controlId": "CIP-010-4 1.4.3", "title": "CIP-010-4 1.4.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583237" }, { "id": 560539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "171d65f3-7495-5d91-9557-d223ff530e29", "parentControlId": 31130, "controlId": "CIP-010-4 1.5", "title": "CIP-010-4 1.5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583237" }, { "id": 560540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "670b1c69-8246-5fb1-b6aa-1474e3af24fc", "parentControlId": 31130, "controlId": "CIP-010-4 1.6", "title": "CIP-010-4 1.6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583237" } ], "id": 31130, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730973", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730973", "catalogueId": 1062, "uuid": "263773a1-0d48-516b-91bb-e473b337481c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization document, assess risk and approve or deny deviations to standardized configurations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Approved Configuration Deviations", "description": "

Control Description

Mechanisms exist to document, assess risk and approve or deny deviations to standardized configurations.

Evidence Request List (ERL)

E-AST-33

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).\n▪ Any deviations from approved baseline configurations are reviewed, approved and documented on a case-by-case basis by IT and/or cybersecurity personnel.\n▪ Deviations to baseline configurations are required to have a risk assessment and the business process owner's acceptance of the risk(s) associated with the deviation.

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to document, assess risk and approve or deny deviations to standardized configurations.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CFG-02.7", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-02.7", "references": "

Micro-Small Business (<10 staff)

∙ Manual exception management process

Small Business (10-49 staff)

∙ Manual exception management process

Medium Business (50-249 staff)

∙ Manual exception management process\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Large Business (250-999 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Enterprise (>1,000 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70258, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590168", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590168", "securityControlId": 31131, "ccis": [], "uuid": "599d3eab-f129-59a9-89b6-96ed12f91cc1", "testId": "CFG-02.8_A01", "test": "actions to be taken upon an unauthorized change are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-06(02)_ODP[01]", "defaultText": null }, { "id": 70259, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590168", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590168", "securityControlId": 31131, "ccis": [], "uuid": "634bb723-0609-54f0-87c9-04c24afaeea3", "testId": "CFG-02.8_A02", "test": "organization-defined actions are taken in response to unauthorized changes to organization-defined configuration settings.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-06(02)", "defaultText": null }, { "id": 70260, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590168", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590168", "securityControlId": 31131, "ccis": [], "uuid": "469d990e-59e0-53cd-9385-2a2407c1d4f2", "testId": "CFG-02.8_A03", "test": "configuration settings requiring action upon an unauthorized change are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-06(02)_ODP[02]", "defaultText": null } ], "externalMappings": [ { "id": 560554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73771616-9308-5bc4-b170-818bb4ea0b3c", "parentControlId": 31131, "controlId": "CM-6(2)", "title": "CM-6(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583239" }, { "id": 560555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b69dc24-1523-580e-9aa9-61f6d38946ce", "parentControlId": 31131, "controlId": "CM-06(02)", "title": "CM-06(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583239" }, { "id": 560556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae48a200-fd9f-50c6-bb3f-e3112567d52e", "parentControlId": 31131, "controlId": "CM-06(02)", "title": "CM-06(02)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583239" }, { "id": 560557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56d0bea0-5d21-5658-a8b1-26a2e7b0c070", "parentControlId": 31131, "controlId": "CM-06(02)", "title": "CM-06(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583239" }, { "id": 560558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "142819e0-b6a4-58c7-8caf-5ad9cc9ff093", "parentControlId": 31131, "controlId": "CM-06(02)", "title": "CM-06(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583239" }, { "id": 560559, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "158a2a1d-6628-5824-b7d0-29f798ddddf3", "parentControlId": 31131, "controlId": "CM-6(2)", "title": "CM-6(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583239" } ], "id": 31131, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730974", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730974", "catalogueId": 1062, "uuid": "7c3bec92-04ba-5950-bd58-c9cb880bf252", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization respond to unauthorized changes to configuration settings as security incidents?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Respond To Unauthorized Changes", "description": "

Control Description

Mechanisms exist to respond to unauthorized changes to configuration settings as security incidents.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to verify the functionality of security controls when anomalies or misconfigurations are discovered.

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to respond to unauthorized changes to configuration settings as security incidents.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CFG-02.8", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-02.8", "references": "

Micro-Small Business (<10 staff)

∙ Incident Response Plan (IRP)

Small Business (10-49 staff)

∙ Incident Response Plan (IRP)

Medium Business (50-249 staff)

∙ Incident Response Plan (IRP)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Large Business (250-999 staff)

∙ Incident Response Plan (IRP)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Enterprise (>1,000 staff)

∙ Incident Response Plan (IRP)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70261, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590169", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590169", "securityControlId": 31132, "ccis": [], "uuid": "95533bc5-9cbb-50ce-8159-30c520e8f2d8", "testId": "CFG-02.9_A01", "test": "the selected control baseline is tailored by applying specified tailoring actions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PL-11", "defaultText": null }, { "id": 70262, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590169", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590169", "securityControlId": 31132, "ccis": [], "uuid": "420e9ec2-5eaa-58b0-beea-02b7c1e6d93f", "testId": "CFG-02.9_A02", "test": "additional information for audit records is provided, as needed.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.03.02.b", "defaultText": null } ], "externalMappings": [ { "id": 560584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583242", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7978c634-499e-5f30-abb6-97aca3d40faa", "parentControlId": 31132, "controlId": "PL-11", "title": "PL-11", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583242" }, { "id": 560585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583242", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "159f787e-10e8-5542-a2ca-1a70e2586d4c", "parentControlId": 31132, "controlId": "PL-11", "title": "PL-11", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583242" }, { "id": 560586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583243", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "002ddede-9438-5697-9837-90a4ab2fb176", "parentControlId": 31132, "controlId": "PL-11", "title": "PL-11", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583243" }, { "id": 560587, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583243", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "705eac88-dc23-5c29-8371-3931412d8c61", "parentControlId": 31132, "controlId": "PL-11", "title": "PL-11", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583243" }, { "id": 560588, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583243", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1159db2d-5cc6-5139-b7a1-2d9edfe0dfdc", "parentControlId": 31132, "controlId": "PL-11", "title": "PL-11", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583243" }, { "id": 560589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583243", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "614a53d5-a527-5249-bc3a-19622d53a3f6", "parentControlId": 31132, "controlId": "PL-11", "title": "PL-11", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583243" }, { "id": 560590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583243", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0875c5a8-d14d-5ad9-bf1c-cb247c6501a5", "parentControlId": 31132, "controlId": "3.3.3", "title": "3.3.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583243" }, { "id": 560591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583243", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65845215-9345-5472-a97c-71e727ebed23", "parentControlId": 31132, "controlId": "03.03.02.b", "title": "03.03.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583243" }, { "id": 560592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583243", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3f77e71-9b07-5865-b004-84be066cfc3a", "parentControlId": 31132, "controlId": "03.04.01.a", "title": "03.04.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583243" }, { "id": 560593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583243", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3352771e-0623-561f-8e85-6fbf32307279", "parentControlId": 31132, "controlId": "03.04.02.a", "title": "03.04.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583243" }, { "id": 560594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583244", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a65bb22a-4104-5f6c-bb3e-5d84df8f8133", "parentControlId": 31132, "controlId": "03.04.02.b", "title": "03.04.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583244" }, { "id": 560595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583244", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b72b41fa-a2e4-56e4-8bca-42fa631a38cc", "parentControlId": 31132, "controlId": "03.04.06.a", "title": "03.04.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583244" }, { "id": 560596, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583244", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffe0eba7-b9a3-57d5-a553-0fe887583efe", "parentControlId": 31132, "controlId": "03.04.08.a", "title": "03.04.08.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583244" }, { "id": 560597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583244", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23514b4d-8395-5db9-9f5f-6b8520d545b1", "parentControlId": 31132, "controlId": "03.04.12.a", "title": "03.04.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583244" }, { "id": 560598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583244", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aebcdb81-9339-50c6-ada0-f2641536edb0", "parentControlId": 31132, "controlId": "03.13.11", "title": "03.13.11", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583244" }, { "id": 560605, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77a77ae9-e290-57ed-8391-fcc500798970", "parentControlId": 31132, "controlId": "ASSET-3d", "title": "ASSET-3d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583245" }, { "id": 560606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff9ac597-f367-52c3-819a-f69b024adc6a", "parentControlId": 31132, "controlId": "SITUATION-1f", "title": "SITUATION-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583245" }, { "id": 560607, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf4a1c46-84db-5215-ab5d-65de85c24545", "parentControlId": 31132, "controlId": "ARCHITECTURE-3h", "title": "ARCHITECTURE-3h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583245" }, { "id": 560618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20016689-0804-51d0-8d12-7abddb211f90", "parentControlId": 31132, "controlId": "CIP-010-4 1.4.1", "title": "CIP-010-4 1.4.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583246" }, { "id": 560619, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89c4a70e-95d0-5439-8a9a-caefb2ada00b", "parentControlId": 31132, "controlId": "CIP-010-4 1.6.1", "title": "CIP-010-4 1.6.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583246" }, { "id": 560620, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fc4ea4f-7cfd-51f8-b432-eb95a88210d9", "parentControlId": 31132, "controlId": "CIP-010-4 1.6.2", "title": "CIP-010-4 1.6.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583247" } ], "id": 31132, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730974", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730974", "catalogueId": 1062, "uuid": "9d0e74ad-a203-56e0-a784-06ead86cc874", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization allow baseline controls to be specialized or customized by applying a defined set of tailoring actions that are specific to:\n (1) Mission / business functions;\n (2) Operational environment;\n (3) Specific threats or vulnerabilities; or\n (4) Other conditions or situations that could affect mission / business success?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Baseline Tailoring", "description": "

Control Description

Mechanisms exist to allow baseline controls to be specialized or customized by applying a defined set of tailoring actions that are specific to:\n(1) Mission / business functions;\n(2) Operational environment;\n(3) Specific threats or vulnerabilities; or\n(4) Other conditions or situations that could affect mission / business success.

Evidence Request List (ERL)

E-AST-33\nE-GOV-20

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).\n▪ Deviations from approved baseline configurations are handled on a case-by-case basis by IT/cybersecurity personnel. Acceptance of any deviations from baselines must be informed by performance of a risk assessment.\n▪ As necessary, enhanced security requirements are developed for unattended systems (e.g., kiosks, ATMs, etc.) and point of sale devices.

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).\n▪ Tailored SBC are created for higher-risk operating environments and/or for TAAS that store, process or transmit sensitive/regulated data.\n▪ IT and/or cybersecurity personnel perform an annual review of existing configurations to ensure security objectives are still being met.

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to allow baseline controls to be specialized or customized by applying a defined set of tailoring actions that are specific to:\n(1) Mission / business functions;\n(2) Operational environment;\n(3) Specific threats or vulnerabilities; or\n(4) Other conditions or situations that could affect mission / business success.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CFG-02.9", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-02.9", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides\n∙ ManageEngine Vulnerability Manager Plus (https://manageengine.com)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides\n∙ ManageEngine Vulnerability Manager Plus (https://manageengine.com)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides\n∙ ManageEngine Vulnerability Manager Plus (https://manageengine.com)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70263, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590169", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590169", "securityControlId": 31133, "ccis": [], "uuid": "71f98aa6-ae62-5332-a027-a0679b61020e", "testId": "CFG-03_A01", "test": "configuration settings for the system that reflect the most restrictive mode consistent with operational requirements are defined (e.g., principle of least functionality).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.4.6[a]\n53A_R5_CM-07_ODP[01]", "defaultText": null }, { "id": 70264, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590169", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590169", "securityControlId": 31133, "ccis": [], "uuid": "5952942c-52c8-5fcc-aeff-3efe4c69c451", "testId": "CFG-03_A02", "test": "systems are configured to provide only the defined essential capabilities, where unnecessary or nonsecure functions, ports, protocols, connections, and services are disabled or removed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.4.6[b]\n53A_R5_CM-07a.", "defaultText": null }, { "id": 70265, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59017", "securityControlId": 31133, "ccis": [], "uuid": "fb7573e1-8d5e-5081-a02a-35e34f6b4527", "testId": "CFG-03_A03", "test": "functions to be prohibited or restricted are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-07_ODP[02]", "defaultText": null }, { "id": 70266, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59017", "securityControlId": 31133, "ccis": [], "uuid": "e63bb6af-f12c-55c2-a2cb-ddd789118f5e", "testId": "CFG-03_A04", "test": "ports to be prohibited or restricted are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-07_ODP[03]", "defaultText": null }, { "id": 70267, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59017", "securityControlId": 31133, "ccis": [], "uuid": "ada31e55-e914-5078-be30-35f577b3e2bf", "testId": "CFG-03_A05", "test": "protocols to be prohibited or restricted are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-07_ODP[04]", "defaultText": null }, { "id": 70268, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59017", "securityControlId": 31133, "ccis": [], "uuid": "4a0edbbd-0f07-527f-8dd7-0c73f71cc4e2", "testId": "CFG-03_A06", "test": "software to be prohibited or restricted is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-07_ODP[05]", "defaultText": null }, { "id": 70269, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59017", "securityControlId": 31133, "ccis": [], "uuid": "c3c826bf-9034-53cd-8362-45af6e42e720", "testId": "CFG-03_A07", "test": "services to be prohibited or restricted are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-07_ODP[06]", "defaultText": null }, { "id": 70270, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59017", "securityControlId": 31133, "ccis": [], "uuid": "2b3c7a71-a878-5e98-b988-0df77f5ecb44", "testId": "CFG-03_A08", "test": "the use of organization-defined functions is prohibited or restricted.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_CM-07b.[01]", "defaultText": null }, { "id": 70271, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59017", "securityControlId": 31133, "ccis": [], "uuid": "d9a1866b-b050-5c4b-9820-401e9a0c9c16", "testId": "CFG-03_A09", "test": "the use of organization-defined ports is prohibited or restricted.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_CM-07b.[02]", "defaultText": null }, { "id": 70272, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59017", "securityControlId": 31133, "ccis": [], "uuid": "a1d8e873-f72c-567c-ab1d-e866e7ecf5ab", "testId": "CFG-03_A10", "test": "the use of organization-defined protocols is prohibited or restricted.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_CM-07b.[03]", "defaultText": null }, { "id": 70273, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590171", "securityControlId": 31133, "ccis": [], "uuid": "1aea3fd5-a012-5583-9b38-d56402136470", "testId": "CFG-03_A11", "test": "the use of organization-defined software is prohibited or restricted.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_CM-07b.[04]", "defaultText": null }, { "id": 70274, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590171", "securityControlId": 31133, "ccis": [], "uuid": "d439b452-ce78-578d-a2ab-af4d754f8684", "testId": "CFG-03_A12", "test": "the use of organization-defined services is prohibited or restricted.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_CM-07b.[05]", "defaultText": null }, { "id": 70275, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590171", "securityControlId": 31133, "ccis": [], "uuid": "992778b5-845e-56c2-9a04-8609e9ba0ccc", "testId": "CFG-03_A13", "test": "configuration settings for the system reflect the most restrictive mode consistent with operational requirements are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.02.ODP[01]", "defaultText": null }, { "id": 70276, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590171", "securityControlId": 31133, "ccis": [], "uuid": "2df52f57-ce48-5a8c-859c-0f2991a61af1", "testId": "CFG-03_A14", "test": "unnecessary or nonsecure functions, ports, protocols, connections, and services are disabled or removed.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.06.d", "defaultText": null } ], "externalMappings": [ { "id": 560662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f10a7111-7624-50f3-bb04-7215c48603bc", "parentControlId": 31133, "controlId": "SR 7.7", "title": "SR 7.7", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583251" }, { "id": 560663, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd2c51db-473a-50f6-b486-14d002f7c9d6", "parentControlId": 31133, "controlId": "CR 2.2", "title": "CR 2.2", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583251" }, { "id": 560664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28459383-90b7-5ebf-b1a8-8c5d29ddd8bd", "parentControlId": 31133, "controlId": "CR 7.7", "title": "CR 7.7", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583252" }, { "id": 560666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80700f0a-e979-53ef-bfc3-8898040adad6", "parentControlId": 31133, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583252" }, { "id": 560667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94dae078-30f2-534e-8694-320f15bb76ca", "parentControlId": 31133, "controlId": "8.9", "title": "8.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583252" }, { "id": 560668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44020884-5b99-594f-91d1-762d0b3bb3e5", "parentControlId": 31133, "controlId": "8.12", "title": "8.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583252" }, { "id": 560672, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f976d5e0-c56a-5669-8f5e-1a9d351080fb", "parentControlId": 31133, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583253" }, { "id": 560673, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b436104-6524-5fc4-8535-a52cfa7d54e3", "parentControlId": 31133, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583253" }, { "id": 560674, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1b0dfe7-b9db-5951-aac6-1d8a1286a620", "parentControlId": 31133, "controlId": "T1003.002", "title": "T1003.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583253" }, { "id": 560675, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "018c0c36-2429-5af1-b4ec-aee6213ab60d", "parentControlId": 31133, "controlId": "T1003.005", "title": "T1003.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583253" }, { "id": 560676, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0132e2b1-9058-50be-8c92-73c859234c0b", "parentControlId": 31133, "controlId": "T1008", "title": "T1008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583253" }, { "id": 560677, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ad75538-c76b-527a-8833-001a9e924bb8", "parentControlId": 31133, "controlId": "T1011", "title": "T1011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583253" }, { "id": 560678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28f94df4-eede-532b-8bef-c220f8196976", "parentControlId": 31133, "controlId": "T1011.001", "title": "T1011.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583253" }, { "id": 560679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6dd96aae-10ed-5203-a073-b17b00f0b111", "parentControlId": 31133, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583253" }, { "id": 560680, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d090b58b-fd3e-5c82-9617-60fe8ca010e4", "parentControlId": 31133, "controlId": "T1021", "title": "T1021", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583253" }, { "id": 560681, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebbac9e7-e406-5821-b0c0-8be7bb626a4c", "parentControlId": 31133, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583254" }, { "id": 560682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06d26a39-8f8b-5281-a0aa-4ed8a1ccaaca", "parentControlId": 31133, "controlId": "T1021.002", "title": "T1021.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583254" }, { "id": 560683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6ac623d-ef60-5fc3-9948-fb6e254f7e6b", "parentControlId": 31133, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583254" }, { "id": 560684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "544384ea-4db6-5a71-afc2-1a6846f3d498", "parentControlId": 31133, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583254" }, { "id": 560685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7460f4f5-0d52-5d0b-a2f8-eec39e05ad97", "parentControlId": 31133, "controlId": "T1021.006", "title": "T1021.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583254" }, { "id": 560686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9db1febd-cd66-516d-89ec-20eebf084b5b", "parentControlId": 31133, "controlId": "T1021.008", "title": "T1021.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583254" }, { "id": 560687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "334998b3-e3b5-5f31-9f49-543d8dffc513", "parentControlId": 31133, "controlId": "T1027", "title": "T1027", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583254" }, { "id": 560688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec6df639-3f49-51c6-8c4b-ac17a6a300cc", "parentControlId": 31133, "controlId": "T1036", "title": "T1036", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583254" }, { "id": 560689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "514a6aff-eec2-5254-9429-992f6efc6d63", "parentControlId": 31133, "controlId": "T1036.005", "title": "T1036.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583254" }, { "id": 560690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "deb7c439-dbe4-5ea4-90d7-b7f07bd5aa03", "parentControlId": 31133, "controlId": "T1036.007", "title": "T1036.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583254" }, { "id": 560691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a2d17d2-5472-5ca4-aadb-f211b978c2ad", "parentControlId": 31133, "controlId": "T1036.008", "title": "T1036.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583255" }, { "id": 560692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96699c0a-c533-52ff-9ba6-70baa98e53d4", "parentControlId": 31133, "controlId": "T1037", "title": "T1037", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583255" }, { "id": 560693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb366f85-03d9-5bc4-978b-f4abee9cdc9b", "parentControlId": 31133, "controlId": "T1037.001", "title": "T1037.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583255" }, { "id": 560694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18e357ed-32c7-560e-9631-06a9c6260fcc", "parentControlId": 31133, "controlId": "T1040", "title": "T1040", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583255" }, { "id": 560695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "434ba068-1997-591b-bd24-d641b5cc155c", "parentControlId": 31133, "controlId": "T1046", "title": "T1046", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583255" }, { "id": 560696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b864349-4c03-5623-a281-e06912615292", "parentControlId": 31133, "controlId": "T1047", "title": "T1047", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583255" }, { "id": 560697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7edce020-6189-5cc7-b745-c41f6ffd5741", "parentControlId": 31133, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583255" }, { "id": 560698, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7b66412-e045-5aa6-80c7-8bd402721734", "parentControlId": 31133, "controlId": "T1048.001", "title": "T1048.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583255" }, { "id": 560699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0948c1d0-b9f8-5ecc-91d1-46b6e5f3b3c1", "parentControlId": 31133, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583256" }, { "id": 560700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3e49d84-2e2c-56c0-904e-cb45ae8b09cb", "parentControlId": 31133, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583256" }, { "id": 560701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94e07ae6-29a3-5f65-9690-8f6d31985dee", "parentControlId": 31133, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583256" }, { "id": 560702, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d44e4532-638c-589c-bf37-c268838060bc", "parentControlId": 31133, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583256" }, { "id": 560703, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55293d6d-97be-5786-872e-8335e4ca26b4", "parentControlId": 31133, "controlId": "T1053", "title": "T1053", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583256" }, { "id": 560704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcc00543-7d8f-5477-b8f0-bf5b760674ee", "parentControlId": 31133, "controlId": "T1053.002", "title": "T1053.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583256" }, { "id": 560705, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fae24c6b-3a8a-5c48-800d-dee0c51cc497", "parentControlId": 31133, "controlId": "T1053.005", "title": "T1053.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583256" }, { "id": 560706, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7087d6f5-556e-535c-ab91-226d142ecd73", "parentControlId": 31133, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583256" }, { "id": 560707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db3e012e-14b8-5b32-b8da-25779a026bc0", "parentControlId": 31133, "controlId": "T1059.005", "title": "T1059.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583256" }, { "id": 560708, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12aaf42a-4421-52aa-bbdf-3429be7b34e3", "parentControlId": 31133, "controlId": "T1059.007", "title": "T1059.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583257" }, { "id": 560709, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b762a07a-e535-5971-9dac-a0052d35a452", "parentControlId": 31133, "controlId": "T1059.009", "title": "T1059.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583257" }, { "id": 560710, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b31c831-de43-5824-b69b-24540215a248", "parentControlId": 31133, "controlId": "T1059.010", "title": "T1059.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583257" }, { "id": 560711, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ebb427a-1ffe-5698-9d96-bd2eb5e69888", "parentControlId": 31133, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583257" }, { "id": 560712, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48cd22ca-c50d-5181-8a4d-a47efdd1dec7", "parentControlId": 31133, "controlId": "T1071", "title": "T1071", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583257" }, { "id": 560713, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47e914de-a3db-5da2-a879-61e9e5b5d414", "parentControlId": 31133, "controlId": "T1071.001", "title": "T1071.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583257" }, { "id": 560714, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c298bb27-ba9a-54fb-80e1-9abb035aad20", "parentControlId": 31133, "controlId": "T1071.002", "title": "T1071.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583257" }, { "id": 560715, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97f0939b-0505-532d-adde-1db6503749c4", "parentControlId": 31133, "controlId": "T1071.003", "title": "T1071.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583257" }, { "id": 560716, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "765afc97-c5a0-5130-aae3-9f841fe0d8bb", "parentControlId": 31133, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583258" }, { "id": 560717, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1075c847-e528-5c40-8290-d8a014957bf4", "parentControlId": 31133, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583258" }, { "id": 560718, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09200668-f920-5f06-b84a-b5e97892ab8f", "parentControlId": 31133, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583258" }, { "id": 560719, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c934e10-98c2-5862-b3e7-de1002a96cc2", "parentControlId": 31133, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583258" }, { "id": 560720, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa793b15-23e5-50ba-b322-b287382079f6", "parentControlId": 31133, "controlId": "T1080", "title": "T1080", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583258" }, { "id": 560721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c8bb795-b75b-5778-9812-58114ad8020e", "parentControlId": 31133, "controlId": "T1087", "title": "T1087", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583258" }, { "id": 560722, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3abe3706-9b64-5183-a64a-ffcb33618bed", "parentControlId": 31133, "controlId": "T1087.001", "title": "T1087.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583258" }, { "id": 560723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3696f59-1314-5979-821f-765b37783012", "parentControlId": 31133, "controlId": "T1087.002", "title": "T1087.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583258" }, { "id": 560724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1925ae5a-248b-5bde-a66c-894a276dcc7e", "parentControlId": 31133, "controlId": "T1090", "title": "T1090", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583258" }, { "id": 560725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09763d37-79de-57cf-b5fd-69ab736d444c", "parentControlId": 31133, "controlId": "T1090.001", "title": "T1090.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583259" }, { "id": 560726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ca0efc0-1f9d-5946-8e18-d7cbb5d62777", "parentControlId": 31133, "controlId": "T1090.002", "title": "T1090.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583259" }, { "id": 560727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "faf5808c-e449-5488-b9f8-249439a5ed52", "parentControlId": 31133, "controlId": "T1090.003", "title": "T1090.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583259" }, { "id": 560728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29280399-5529-5881-9444-68f8930ed095", "parentControlId": 31133, "controlId": "T1092", "title": "T1092", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583259" }, { "id": 560729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "733860c6-344d-59bf-9ab5-b8eebdaee45b", "parentControlId": 31133, "controlId": "T1095", "title": "T1095", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583259" }, { "id": 560730, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b1c4b4f-63f9-5849-891a-25adccc0eb7f", "parentControlId": 31133, "controlId": "T1098", "title": "T1098", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583259" }, { "id": 560731, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "426acfd7-242e-5298-aca7-95ed80a66724", "parentControlId": 31133, "controlId": "T1098.001", "title": "T1098.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583259" }, { "id": 560732, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f0c2458-1b79-5e80-8376-9fbbbeb57da2", "parentControlId": 31133, "controlId": "T1098.004", "title": "T1098.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583259" }, { "id": 560733, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48ce9e56-2434-5b04-a403-9e294a43f7e8", "parentControlId": 31133, "controlId": "T1098.007", "title": "T1098.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583259" }, { "id": 560734, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd1bfad9-d70c-502d-8be7-98a5cec3f6aa", "parentControlId": 31133, "controlId": "T1102", "title": "T1102", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58326" }, { "id": 560735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9fee719-6ee2-50c4-a226-c48e6cc6b876", "parentControlId": 31133, "controlId": "T1102.001", "title": "T1102.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58326" }, { "id": 560736, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27b83269-5046-5387-b45c-e9ec2ed9bb07", "parentControlId": 31133, "controlId": "T1102.002", "title": "T1102.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58326" }, { "id": 560737, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "740e0363-a5d5-5a57-8ccf-ca5bb16570e0", "parentControlId": 31133, "controlId": "T1102.003", "title": "T1102.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58326" }, { "id": 560738, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43f3b40b-a216-5a81-b041-c2177a26d023", "parentControlId": 31133, "controlId": "T1104", "title": "T1104", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58326" }, { "id": 560739, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a729d42b-ab1a-566d-9a01-e65f54593fbf", "parentControlId": 31133, "controlId": "T1105", "title": "T1105", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58326" }, { "id": 560740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9883155a-4761-51ab-a99f-2fef1dbe3222", "parentControlId": 31133, "controlId": "T1106", "title": "T1106", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58326" }, { "id": 560741, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0717c93f-6546-5e77-a9e4-31b1c34d7d9a", "parentControlId": 31133, "controlId": "T1112", "title": "T1112", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583269" }, { "id": 560742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99e8154b-1e0e-5395-bee6-7901499847a7", "parentControlId": 31133, "controlId": "T1127", "title": "T1127", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583269" }, { "id": 560743, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2f5e8d6-c772-5e01-bf7f-b7b58a1307f7", "parentControlId": 31133, "controlId": "T1127.002", "title": "T1127.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583269" }, { "id": 560744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62dac77b-96a7-5c36-9a4a-b1a6a9a2d25a", "parentControlId": 31133, "controlId": "T1129", "title": "T1129", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583269" }, { "id": 560745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c041f237-809f-538c-bd78-090c5dd4fdb8", "parentControlId": 31133, "controlId": "T1133", "title": "T1133", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583269" }, { "id": 560746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39222750-7686-5132-9209-f6703d3bac61", "parentControlId": 31133, "controlId": "T1135", "title": "T1135", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583269" }, { "id": 560747, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f90cf2a7-e063-54a8-9e65-3ff99c53e1bc", "parentControlId": 31133, "controlId": "T1136", "title": "T1136", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583269" }, { "id": 560748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "316dc392-0790-5651-ba88-c1b786c68971", "parentControlId": 31133, "controlId": "T1136.002", "title": "T1136.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583269" }, { "id": 560749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d4476d3-fdff-52a7-8dbd-c413aebde876", "parentControlId": 31133, "controlId": "T1136.003", "title": "T1136.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58327" }, { "id": 560750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04e6ebe9-0c15-58cd-b269-e1c061ad2937", "parentControlId": 31133, "controlId": "T1176", "title": "T1176", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58327" }, { "id": 560751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39f95ffe-36fc-5631-9210-ed6e1ef941c2", "parentControlId": 31133, "controlId": "T1187", "title": "T1187", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58327" }, { "id": 560752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35c68eba-e88a-5ca0-977e-d87b1bda8027", "parentControlId": 31133, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58327" }, { "id": 560753, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87e4a33e-15c4-596e-82b1-804309856b5f", "parentControlId": 31133, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58327" }, { "id": 560754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ddc5268d-1f3a-5f73-a295-d9911f12c918", "parentControlId": 31133, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58327" }, { "id": 560755, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a60a219-cac8-51c4-8c58-dfea7ed7271e", "parentControlId": 31133, "controlId": "T1195.002", "title": "T1195.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58327" }, { "id": 560756, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c74a5c1-2edb-59cd-b604-3d5049d02a39", "parentControlId": 31133, "controlId": "T1197", "title": "T1197", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58327" }, { "id": 560757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b82fa4e1-c510-58b0-b999-96d1d17979e2", "parentControlId": 31133, "controlId": "T1199", "title": "T1199", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58327" }, { "id": 560758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf919965-aaaa-5fbd-9017-fee046e55f44", "parentControlId": 31133, "controlId": "T1204", "title": "T1204", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583271" }, { "id": 560759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbdd54e6-3044-552b-b303-f46469f3f7b1", "parentControlId": 31133, "controlId": "T1204.001", "title": "T1204.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583271" }, { "id": 560760, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3faac36-25bc-5892-946d-306eceba14d6", "parentControlId": 31133, "controlId": "T1204.002", "title": "T1204.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583271" }, { "id": 560761, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0fd934f9-7b4d-5572-b84e-1ecd043251d4", "parentControlId": 31133, "controlId": "T1204.003", "title": "T1204.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583271" }, { "id": 560762, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "047f30de-47fd-5352-9d4e-d1cf3ddb365a", "parentControlId": 31133, "controlId": "T1205", "title": "T1205", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583271" }, { "id": 560763, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7f8f97c-5cf6-5f19-8977-ddeeacba18b1", "parentControlId": 31133, "controlId": "T1205.001", "title": "T1205.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583271" }, { "id": 560764, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ba4b982-610b-5c7f-87bc-27e2aeb50d74", "parentControlId": 31133, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583271" }, { "id": 560765, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a75f0057-a7c9-5139-af6b-243306d39d86", "parentControlId": 31133, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583271" }, { "id": 560766, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f8ad4be-3891-5c39-bf25-87f8c61ff23b", "parentControlId": 31133, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583272" }, { "id": 560767, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1956aaf7-9f7e-5c85-8868-30f9815cd941", "parentControlId": 31133, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583272" }, { "id": 560768, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e102e728-e25e-5305-b4b7-31e531db8ed3", "parentControlId": 31133, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583272" }, { "id": 560769, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40aba1b9-9f45-59b4-a553-4dcb3caa89c7", "parentControlId": 31133, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583272" }, { "id": 560770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b04ae3a-e65e-57d1-afcd-28cbecb15711", "parentControlId": 31133, "controlId": "T1216", "title": "T1216", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583272" }, { "id": 560771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f65da621-d33a-5c1a-9588-28c78b5157a3", "parentControlId": 31133, "controlId": "T1216.001", "title": "T1216.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583272" }, { "id": 560772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d527416-8ce3-56f1-944d-aea0a875688e", "parentControlId": 31133, "controlId": "T1216.002", "title": "T1216.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583272" }, { "id": 560773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f6e4808-9454-5bf5-9ed3-f4fe9e6cdd9d", "parentControlId": 31133, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583272" }, { "id": 560774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bcc06c4b-c983-5ba7-8ebe-40a3b724327d", "parentControlId": 31133, "controlId": "T1218.001", "title": "T1218.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583272" }, { "id": 560775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fce5232-4c9e-547d-97e1-9dd8b118640e", "parentControlId": 31133, "controlId": "T1218.002", "title": "T1218.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583273" }, { "id": 560776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db20df51-0b09-5d98-ac6a-32410197e913", "parentControlId": 31133, "controlId": "T1218.003", "title": "T1218.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583273" }, { "id": 560777, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6ccab56-e06b-5d1a-a66d-e1e921f91fcc", "parentControlId": 31133, "controlId": "T1218.004", "title": "T1218.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583273" }, { "id": 560778, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46e28a95-c3b0-5e72-8b52-26ccda4c8e6e", "parentControlId": 31133, "controlId": "T1218.005", "title": "T1218.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583273" }, { "id": 560779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c67dc85-4b71-5893-9ffd-4d60c136a696", "parentControlId": 31133, "controlId": "T1218.007", "title": "T1218.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583273" }, { "id": 560780, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81eef912-45d8-5804-a14a-66152176ebd0", "parentControlId": 31133, "controlId": "T1218.008", "title": "T1218.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583273" }, { "id": 560781, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05733a93-1546-59b5-91b4-c0b284a5b8a2", "parentControlId": 31133, "controlId": "T1218.009", "title": "T1218.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583273" }, { "id": 560782, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6044345-13e2-5d50-9229-f46122a91aef", "parentControlId": 31133, "controlId": "T1218.012", "title": "T1218.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583273" }, { "id": 560783, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4f1ee74-5240-509a-8523-92fa5a7cc616", "parentControlId": 31133, "controlId": "T1218.013", "title": "T1218.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583273" }, { "id": 560784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1babe0ec-d66b-54f3-8dac-3c139e2fbfd7", "parentControlId": 31133, "controlId": "T1218.014", "title": "T1218.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583274" }, { "id": 560785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f7c8b4e-179f-59ac-b808-0773c7b026ff", "parentControlId": 31133, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583274" }, { "id": 560786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7a40a98-3560-5998-a010-9095f8ea570f", "parentControlId": 31133, "controlId": "T1219", "title": "T1219", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583274" }, { "id": 560787, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4ec030b-2af7-55be-89f0-5148902781fa", "parentControlId": 31133, "controlId": "T1220", "title": "T1220", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583274" }, { "id": 560788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdeb9ec5-d1f6-5508-88a9-88f8d9a84085", "parentControlId": 31133, "controlId": "T1221", "title": "T1221", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583274" }, { "id": 560789, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e220eb43-5ca2-5a0d-8b83-5ad21405cf31", "parentControlId": 31133, "controlId": "T1482", "title": "T1482", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583274" }, { "id": 560790, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00a566d0-8308-5ccc-a3e3-3accda314ac0", "parentControlId": 31133, "controlId": "T1484", "title": "T1484", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583274" }, { "id": 560791, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8240b54-aa1b-53f9-b7a9-64999762c85b", "parentControlId": 31133, "controlId": "T1489", "title": "T1489", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583275" }, { "id": 560792, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39832e42-d949-5708-ba2e-05e3f03c8fcc", "parentControlId": 31133, "controlId": "T1490", "title": "T1490", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583275" }, { "id": 560793, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac384415-c187-54e9-86ae-a25f5ec6122a", "parentControlId": 31133, "controlId": "T1498", "title": "T1498", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583275" }, { "id": 560794, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc437a62-dbfe-5772-94eb-517427d13b89", "parentControlId": 31133, "controlId": "T1498.001", "title": "T1498.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583275" }, { "id": 560795, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99da6db8-cb37-5fe5-99af-4fcea9687aeb", "parentControlId": 31133, "controlId": "T1498.002", "title": "T1498.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583275" }, { "id": 560796, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8046543d-3383-52c5-aafd-c87a76d97dfa", "parentControlId": 31133, "controlId": "T1499", "title": "T1499", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583275" }, { "id": 560797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b01d7d62-2309-537e-b392-d299fd56ae54", "parentControlId": 31133, "controlId": "T1499.001", "title": "T1499.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583275" }, { "id": 560798, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f2d2d08-9f26-560b-9a4d-87c67e140532", "parentControlId": 31133, "controlId": "T1499.002", "title": "T1499.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583275" }, { "id": 560799, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ee366bd-9048-59c3-b9c2-446dd1b6d414", "parentControlId": 31133, "controlId": "T1499.003", "title": "T1499.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583275" }, { "id": 560800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6e4a483-2e2f-5989-b981-15c9f41ef967", "parentControlId": 31133, "controlId": "T1499.004", "title": "T1499.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583275" }, { "id": 560801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2428bfc3-5004-5898-8e2a-6938be024e1c", "parentControlId": 31133, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583276" }, { "id": 560802, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9201bd8e-355a-5ce7-8772-dee310cb5105", "parentControlId": 31133, "controlId": "T1525", "title": "T1525", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583276" }, { "id": 560803, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f482781-df44-5d54-90e8-bf258c1df6e2", "parentControlId": 31133, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583276" }, { "id": 560804, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4fdfb60-280e-56fd-91a3-b8eae20dd66e", "parentControlId": 31133, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583276" }, { "id": 560805, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0db2cae6-d77f-500a-be7e-8ebdcd2d9700", "parentControlId": 31133, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583276" }, { "id": 560806, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "472b4542-77e3-5dbf-b52e-4dde10f59c45", "parentControlId": 31133, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583276" }, { "id": 560807, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e189dd3-9006-5a5b-8211-208749a46032", "parentControlId": 31133, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583276" }, { "id": 560808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e793fd5-b630-5ad2-bbe6-3b0c6d1955a3", "parentControlId": 31133, "controlId": "T1546.002", "title": "T1546.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583276" }, { "id": 560809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b932903-d5bf-5e4c-ab75-0c1e4acd0885", "parentControlId": 31133, "controlId": "T1546.006", "title": "T1546.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583276" }, { "id": 560810, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93af2e6b-4d3e-51df-9170-07c2ca04c2a9", "parentControlId": 31133, "controlId": "T1546.008", "title": "T1546.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583277" }, { "id": 560811, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afcc5f0a-2cb8-570c-8ef2-325c43f50427", "parentControlId": 31133, "controlId": "T1546.009", "title": "T1546.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583277" }, { "id": 560812, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b37833db-14e1-5a73-adbd-3c15d438eb0f", "parentControlId": 31133, "controlId": "T1546.010", "title": "T1546.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583277" }, { "id": 560813, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2832ac8f-804c-5240-a7f1-a66fa20f9a06", "parentControlId": 31133, "controlId": "T1547.004", "title": "T1547.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583277" }, { "id": 560814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a822cb88-04ed-55be-b03d-c773247ed73b", "parentControlId": 31133, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583277" }, { "id": 560815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89170eb3-a44f-5466-9c4f-605f03b25787", "parentControlId": 31133, "controlId": "T1547.007", "title": "T1547.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583277" }, { "id": 560816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10b12075-f7b0-5e40-bb58-0caae2d6bb4d", "parentControlId": 31133, "controlId": "T1547.009", "title": "T1547.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583277" }, { "id": 560817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67f0b627-bbf7-5f04-9831-2b36e436db51", "parentControlId": 31133, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583278" }, { "id": 560818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f8a7535-0b76-5da4-b464-5a8e855156e6", "parentControlId": 31133, "controlId": "T1548.001", "title": "T1548.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583278" }, { "id": 560819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "545000ef-962b-5a1d-bfdd-0feabccf3425", "parentControlId": 31133, "controlId": "T1548.003", "title": "T1548.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583278" }, { "id": 560820, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3114eb38-938a-5c46-9508-a773df7437fd", "parentControlId": 31133, "controlId": "T1548.004", "title": "T1548.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583278" }, { "id": 560821, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02b48458-6df1-5ac9-82dd-7c1a6f4f9619", "parentControlId": 31133, "controlId": "T1548.006", "title": "T1548.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583278" }, { "id": 560822, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7caf7f3a-5025-5c0d-9a55-17196bba7ae6", "parentControlId": 31133, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583278" }, { "id": 560823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e42a80f3-5c4a-5243-92d4-a41162911f67", "parentControlId": 31133, "controlId": "T1552.003", "title": "T1552.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583278" }, { "id": 560824, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05ad5eed-241f-58e3-9e04-0df0a6af9aca", "parentControlId": 31133, "controlId": "T1552.005", "title": "T1552.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583278" }, { "id": 560825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "005f3942-d7bf-57f9-a9dc-5909ed2703bd", "parentControlId": 31133, "controlId": "T1552.007", "title": "T1552.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583278" }, { "id": 560826, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf07aca9-7e91-5b55-976e-9e9def05cfbc", "parentControlId": 31133, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583278" }, { "id": 560827, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86eceb9d-8da7-53d7-bfb2-e4510404285e", "parentControlId": 31133, "controlId": "T1553.001", "title": "T1553.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583279" }, { "id": 560828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f958d03f-5cc1-5b6e-b06b-83d5038f7468", "parentControlId": 31133, "controlId": "T1553.003", "title": "T1553.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583279" }, { "id": 560829, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cdae1c0c-b281-5d60-8b66-742151f86bca", "parentControlId": 31133, "controlId": "T1553.004", "title": "T1553.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583279" }, { "id": 560830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69b6b72e-e601-596c-a144-a4d7698bdbb5", "parentControlId": 31133, "controlId": "T1553.005", "title": "T1553.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583279" }, { "id": 560831, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94e4151e-3161-5bc8-90d5-a1329977edfb", "parentControlId": 31133, "controlId": "T1553.006", "title": "T1553.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583279" }, { "id": 560832, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a56fbd0b-f7ee-551d-8d73-79d8bf112a8f", "parentControlId": 31133, "controlId": "T1555.004", "title": "T1555.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583279" }, { "id": 560833, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9aad5c55-fc02-5627-bf5f-1ae94769219a", "parentControlId": 31133, "controlId": "T1555.006", "title": "T1555.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583279" }, { "id": 560834, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2047ab07-80bf-50b6-8166-14b38cc61e3b", "parentControlId": 31133, "controlId": "T1556", "title": "T1556", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583279" }, { "id": 560835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d734d6cb-5839-555c-9fbc-6d66778d4321", "parentControlId": 31133, "controlId": "T1556.002", "title": "T1556.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583279" }, { "id": 560836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46db3b08-a0f8-5802-9ea5-8925a0d2b105", "parentControlId": 31133, "controlId": "T1556.008", "title": "T1556.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58328" }, { "id": 560837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58328", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9460f33-46d9-528f-944e-48bff8d9446b", "parentControlId": 31133, "controlId": "T1556.009", "title": "T1556.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58328" }, { "id": 560838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58328", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9a7617b-9577-5bb5-9b43-7cd27391bf4a", "parentControlId": 31133, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58328" }, { "id": 560839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58328", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14c62768-a41e-586d-ad25-289443109d0b", "parentControlId": 31133, "controlId": "T1557.001", "title": "T1557.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58328" }, { "id": 560840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58328", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fb54290-7927-5057-acf6-f621a9e97403", "parentControlId": 31133, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58328" }, { "id": 560841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58328", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fbc8381-d426-5173-b35e-a043bdfe7836", "parentControlId": 31133, "controlId": "T1557.003", "title": "T1557.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58328" }, { "id": 560842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58328", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ad5b054-f166-5145-8476-29ce9b6f6559", "parentControlId": 31133, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58328" }, { "id": 560843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58328", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29e9a6c5-69ea-55d0-bd60-6132a9344d19", "parentControlId": 31133, "controlId": "T1559.002", "title": "T1559.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58328" }, { "id": 560844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad30117b-8563-512b-83fb-52d698bd6c41", "parentControlId": 31133, "controlId": "T1559.003", "title": "T1559.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583281" }, { "id": 560845, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6630951-19f0-51c9-a00f-778fce011b08", "parentControlId": 31133, "controlId": "T1562", "title": "T1562", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583281" }, { "id": 560846, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f09015f-f3e4-5c92-99f4-8b0e9448fecf", "parentControlId": 31133, "controlId": "T1562.001", "title": "T1562.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583281" }, { "id": 560847, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3c00e3a-39d3-5b7b-a569-6691bf27336a", "parentControlId": 31133, "controlId": "T1562.002", "title": "T1562.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583281" }, { "id": 560848, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "faab5d0d-f3cb-59ea-9607-96af0e1a5e6f", "parentControlId": 31133, "controlId": "T1562.003", "title": "T1562.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583281" }, { "id": 560849, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e20df1a-5491-57c1-82b9-cdaec249c0d7", "parentControlId": 31133, "controlId": "T1562.004", "title": "T1562.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583281" }, { "id": 560850, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a5e5882-9c70-5740-a298-2de3caaccf19", "parentControlId": 31133, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583281" }, { "id": 560851, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b1d4b38-36c1-5647-8029-0c62a81b3add", "parentControlId": 31133, "controlId": "T1562.009", "title": "T1562.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583281" }, { "id": 560852, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "596676a2-ab60-5119-93fc-16c620e3d99f", "parentControlId": 31133, "controlId": "T1562.010", "title": "T1562.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583281" }, { "id": 560853, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d87dec05-e571-566a-9073-6caf5746ce18", "parentControlId": 31133, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583282" }, { "id": 560854, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e98a0a2-c3b7-5659-a28e-601cc652cacf", "parentControlId": 31133, "controlId": "T1563.001", "title": "T1563.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583282" }, { "id": 560855, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0419062d-a681-58a6-bb38-a7028df55c83", "parentControlId": 31133, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583282" }, { "id": 560856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f80ef8ba-3412-5361-9c2f-a18912039460", "parentControlId": 31133, "controlId": "T1564.002", "title": "T1564.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583282" }, { "id": 560857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17327942-9285-5c88-8677-e0e7e4501c54", "parentControlId": 31133, "controlId": "T1564.003", "title": "T1564.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583282" }, { "id": 560858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96acf5d5-ba5f-59db-b0e2-361cc2a7f2ca", "parentControlId": 31133, "controlId": "T1564.006", "title": "T1564.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583282" }, { "id": 560859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be11de07-4822-5f52-9a71-0078596a51b7", "parentControlId": 31133, "controlId": "T1564.008", "title": "T1564.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583282" }, { "id": 560860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74be3f4a-5d3c-5787-bc9a-9e0a6109fa8d", "parentControlId": 31133, "controlId": "T1564.009", "title": "T1564.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583282" }, { "id": 560861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11217392-ff05-5ad2-8d5e-b00b34b72753", "parentControlId": 31133, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583282" }, { "id": 560862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5827f59d-7027-526f-ac72-9b8d30bab027", "parentControlId": 31133, "controlId": "T1565.003", "title": "T1565.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583282" }, { "id": 560863, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8aa9f5c-cdba-55e9-83de-3c3efd63e6f8", "parentControlId": 31133, "controlId": "T1569", "title": "T1569", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583283" }, { "id": 560864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c89c731-e33e-536e-b247-22f0b510e1a0", "parentControlId": 31133, "controlId": "T1569.002", "title": "T1569.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583283" }, { "id": 560865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92a84e17-bfa0-53af-8f20-630420a86be5", "parentControlId": 31133, "controlId": "T1570", "title": "T1570", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583283" }, { "id": 560866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e47e2f0b-4f0e-5b28-9864-f4ea378b21ba", "parentControlId": 31133, "controlId": "T1571", "title": "T1571", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583283" }, { "id": 560867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "204d3333-9974-5f33-97d6-17778b73abb9", "parentControlId": 31133, "controlId": "T1572", "title": "T1572", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583283" }, { "id": 560868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13f63f46-138a-5d5c-b568-7e57d5947c36", "parentControlId": 31133, "controlId": "T1573", "title": "T1573", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583283" }, { "id": 560869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40dd4e23-0962-5122-8db5-24227eb8c021", "parentControlId": 31133, "controlId": "T1573.001", "title": "T1573.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583283" }, { "id": 560870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ddfcaf9-23ec-5af3-b872-2009f6455c66", "parentControlId": 31133, "controlId": "T1573.002", "title": "T1573.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583283" }, { "id": 560871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90ee6327-396a-5b96-8e24-ec8b20d7c931", "parentControlId": 31133, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583284" }, { "id": 560872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b941ebba-59cf-5712-9acc-eb9493223f0e", "parentControlId": 31133, "controlId": "T1574.001", "title": "T1574.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583284" }, { "id": 560873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce1b86ac-4c92-567e-b448-e50e5273b625", "parentControlId": 31133, "controlId": "T1574.006", "title": "T1574.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583284" }, { "id": 560874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a9c49e3-60cb-5edd-87d4-7b0c7c79a77d", "parentControlId": 31133, "controlId": "T1574.007", "title": "T1574.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583284" }, { "id": 560875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fcd96d5-87df-5603-be2c-473bce4c433c", "parentControlId": 31133, "controlId": "T1574.008", "title": "T1574.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583284" }, { "id": 560876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aace61b1-6cb9-5455-a27b-e78ef92ac205", "parentControlId": 31133, "controlId": "T1574.009", "title": "T1574.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583284" }, { "id": 560877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96be291a-8e15-52cc-bd1f-6d6860132b1a", "parentControlId": 31133, "controlId": "T1574.012", "title": "T1574.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583284" }, { "id": 560878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94ff1d7d-df4c-5016-ab0e-7d484b7a6792", "parentControlId": 31133, "controlId": "T1574.014", "title": "T1574.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583284" }, { "id": 560879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "877f89d4-73ef-5e65-a685-d23472129250", "parentControlId": 31133, "controlId": "T1590.002", "title": "T1590.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583284" }, { "id": 560880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9eff2733-4bd4-5f7f-a5ea-c227d1107b3c", "parentControlId": 31133, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583285" }, { "id": 560881, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4de9c092-5f9d-52ea-b52e-79dd566ca443", "parentControlId": 31133, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583285" }, { "id": 560882, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4fce119-ded7-5f04-a128-29b27d69a805", "parentControlId": 31133, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583285" }, { "id": 560883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30fd9cf9-526e-57c2-9d8d-896681921661", "parentControlId": 31133, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583285" }, { "id": 560884, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29507870-da5a-5260-a292-496921afb734", "parentControlId": 31133, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583285" }, { "id": 560885, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33b97db8-d3dd-5d1c-a505-f9318d7263e4", "parentControlId": 31133, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583285" }, { "id": 560886, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4fe3366-7ac3-5383-aaf3-fdfeebafb627", "parentControlId": 31133, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583285" }, { "id": 560887, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29a6d447-f166-5112-bae8-8787eb5d7c69", "parentControlId": 31133, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583285" }, { "id": 560888, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec9b0ab5-5ea8-5ebd-a287-d8752e9a4126", "parentControlId": 31133, "controlId": "T1609", "title": "T1609", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583286" }, { "id": 560889, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1be8bad6-0279-5129-84bd-9cea055a539c", "parentControlId": 31133, "controlId": "T1610", "title": "T1610", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583286" }, { "id": 560890, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c78a98c2-c306-5171-a966-bf072e4a15bc", "parentControlId": 31133, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583286" }, { "id": 560891, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2be2ffa5-ce32-5680-80bd-7c3ccd5ccfcc", "parentControlId": 31133, "controlId": "T1612", "title": "T1612", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583286" }, { "id": 560892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70fe4396-3a2b-5963-9d55-b36252a4257c", "parentControlId": 31133, "controlId": "T1613", "title": "T1613", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583286" }, { "id": 560893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a377b09-7d09-559b-b3c9-7a32490d0992", "parentControlId": 31133, "controlId": "T1622", "title": "T1622", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583286" }, { "id": 560894, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "511db75c-2bb6-537a-9e69-ae0ef6af10f4", "parentControlId": 31133, "controlId": "T1647", "title": "T1647", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583286" }, { "id": 560895, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f41c74a-21cc-5444-8362-92d8c43cdf62", "parentControlId": 31133, "controlId": "T1648", "title": "T1648", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583286" }, { "id": 560896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3da93eab-7aa8-5029-8ac1-955a32823aba", "parentControlId": 31133, "controlId": "T1653", "title": "T1653", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583287" }, { "id": 560900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e47911a-2009-55d9-8d20-008bbd147fff", "parentControlId": 31133, "controlId": "CM-7", "title": "CM-7", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583287" }, { "id": 560901, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c72c9687-d527-5a25-aa73-6ef5636d700f", "parentControlId": 31133, "controlId": "CM-07", "title": "CM-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583287" }, { "id": 560902, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b7f93ea-1cba-550c-bcd5-3b3b0aecb02b", "parentControlId": 31133, "controlId": "CM-07", "title": "CM-07", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583287" }, { "id": 560903, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65bf07de-32ec-5581-ace8-113f4be37bf7", "parentControlId": 31133, "controlId": "CM-07", "title": "CM-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583287" }, { "id": 560904, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "505cdf45-17ba-5cd3-8ed5-bf9d55017347", "parentControlId": 31133, "controlId": "CM-07", "title": "CM-07", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583288" }, { "id": 560905, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c67f0320-036e-55dd-95d1-f81e043029cb", "parentControlId": 31133, "controlId": "CM-07", "title": "CM-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583288" }, { "id": 560906, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87f53155-19ff-579e-a675-b35981cb1178", "parentControlId": 31133, "controlId": "CM-07", "title": "CM-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583288" }, { "id": 560907, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7406657-3d94-5bb6-93db-06ccb111f90e", "parentControlId": 31133, "controlId": "CM-7", "title": "CM-7", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583288" }, { "id": 560908, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45329bbc-42aa-524c-a855-22ec268f98ef", "parentControlId": 31133, "controlId": "CM-7", "title": "CM-7", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583288" }, { "id": 560909, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6567049-ac08-5a00-84e2-c5de441da215", "parentControlId": 31133, "controlId": "CM-7", "title": "CM-7", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583288" }, { "id": 560911, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2db6676-b03f-5770-94e6-286aa5e8242a", "parentControlId": 31133, "controlId": "3.4.6", "title": "3.4.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583288" }, { "id": 560912, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d9a6b2a-9be3-599c-bcc9-f17569f58621", "parentControlId": 31133, "controlId": "03.04.02.a", "title": "03.04.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583288" }, { "id": 560913, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dee5ca7d-966f-5d04-a0ad-bcd5d9447c73", "parentControlId": 31133, "controlId": "03.04.06.a", "title": "03.04.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583289" }, { "id": 560914, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e45e8d2-38bc-5623-8e64-81e2e24467d5", "parentControlId": 31133, "controlId": "03.04.06.b", "title": "03.04.06.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583289" }, { "id": 560915, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "972ef614-2273-5fa6-9ba6-136412bf1e6b", "parentControlId": 31133, "controlId": "03.04.06.d", "title": "03.04.06.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583289" }, { "id": 560916, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8b7d3e3-a56b-5269-8ccc-e33d7f74f938", "parentControlId": 31133, "controlId": "03.04.08.a", "title": "03.04.08.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583289" }, { "id": 560921, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58329", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f129178-cb29-5a58-90d2-3190a54d123a", "parentControlId": 31133, "controlId": "PR.PS-05", "title": "PR.PS-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58329" }, { "id": 560954, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22ec3aa9-7b05-5aa0-8c1e-637e83c337e8", "parentControlId": 31133, "controlId": "ARCHITECTURE-3d", "title": "ARCHITECTURE-3d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583294" }, { "id": 560966, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72484cd3-e4fc-572e-8c0f-7fed17d0a02f", "parentControlId": 31133, "controlId": "CIP-007-6 1.1", "title": "CIP-007-6 1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583295" }, { "controlId": "B.1.16", "title": "B.1.16 — “Open/Insecure” Protocol Restrictions", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-7, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "65c0405f-c614-51df-90ce-b144c7d44732", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.16", "title": "NEI 08-09 App D.1.16 — “Open/Insecure” Protocol Restrictions", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.16", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "ea1831e9-b59d-50fb-8053-29440e203729", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.16", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "42fd0d52-e805-5a7a-95a2-b429a8a4d9e5", "isPublic": true }, { "controlId": "B.5.1", "title": "B.5.1 — Removal of Unnecessary Services and Programs", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "7b6ecfed-39fe-590b-89e6-2128ba2c0ec1", "isPublic": true }, { "controlId": "NEI 08-09 App D.5.1", "title": "NEI 08-09 App D.5.1 — Removal of Unnecessary Services and Programs", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.5.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "28616dff-f804-50ed-80fe-15a2342a53a2", "isPublic": true }, { "controlId": "B.5.4", "title": "B.5.4 — Hardware Configuration", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-6, CM-7, MP-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1a26033d-a244-5157-a248-a9a4e7302555", "isPublic": true }, { "controlId": "NEI 08-09 App D.5.4", "title": "NEI 08-09 App D.5.4 — Hardware Configuration", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.5.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "53369fe9-deea-550e-8b75-27b4fe7c4f85", "isPublic": true }, { "controlId": "C.11.8", "title": "C.11.8 — Least Functionality", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a2152fdf-1448-5cc2-899e-607ce2f9fda7", "isPublic": true }, { "controlId": "NEI 08-09 App E.11.8", "title": "NEI 08-09 App E.11.8 — Least Functionality", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.11.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "35543f09-bfe8-5489-9f25-7fa43d4d8099", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(4)", "title": "10 CFR 73.54(d)(4) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.11.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "c1dd07c3-852b-56c4-8b26-a8af9d2506b6", "isPublic": true }, { "controlId": "CIP-007-6-R1", "title": "CIP-007-6-R1 — System Security Management - Ports and Services", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c8150c16-3659-5563-8656-ba9db21ec10a", "isPublic": true }, { "controlId": "CIP-007-6-1.1", "title": "CIP-007-6-1.1 — Where technically feasible, enable only logical network accessible ports that have been determined to be needed by th...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "27241599-21ae-5945-9459-55d72910c782", "isPublic": true }, { "controlId": "CIP-007-6-1.2", "title": "CIP-007-6-1.2 — Protect against the use of unnecessary physical input/output ports used for network connectivity, console commands, o...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "084e3159-d84e-56c5-868b-c3ae879f298a", "isPublic": true }, { "controlId": "NSS-17T-Sec6.4", "title": "NSS-17T-Sec6.4 — System Hardening & Baseline Configuration Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "381c4c8a-a980-526c-9b28-f9969b57f185", "isPublic": true }, { "controlId": "IEC-62645-7.2", "title": "IEC-62645-7.2 — I&C System Hardening and Least Functionality", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "31d8e9de-8e6e-5263-81c1-ee1ade885302", "isPublic": true }, { "controlId": "IEC-63096-12.5", "title": "IEC-63096-12.5 — Control of Operational Software and Baseline Configurations", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "7a32a6c9-043f-5f2e-ac09-fde2343371f2", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.5", "title": "IEEE-7-4.3.2-5.3.5 — Software Configuration Management in Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "60947179-f73a-5aff-8c86-15ccfa038fa8", "isPublic": true } ], "id": 31133, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730975", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730975", "catalogueId": 1062, "uuid": "aee60897-1496-5210-8c79-4cebfee32c76", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization configure systems to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Least Functionality", "description": "

Control Description

Mechanisms exist to configure systems to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.

Evidence Request List (ERL)

E-AST-12\nE-AST-13\nE-AST-14\nE-AST-15\nE-AST-16\nE-AST-17\nE-AST-18\nE-AST-19\nE-AST-20\nE-AST-21

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).\n▪ The restrictiveness of the SBCs are commensurate with the criticality of the TAAS and/or sensitivity of the data being protected, in accordance with applicable laws, regulations and frameworks.

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to configure systems to provide only essential capabilities by specifically prohibiting or restricting the use of ports, protocols, and/or services.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.16, B.5.1, B.5.4, C.11.8
NERC-CIP (2026) Requirements: CIP-007-6-R1", "controlId": "CFG-03", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-03", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)\n∙ Center for Internet Security (CIS) Benchmarks\n∙ Original Equipment Manufacturer (OEM) security guides", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70277, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590171", "securityControlId": 31134, "ccis": [], "uuid": "ae9cadf6-cf7a-5584-9c0e-fbc6334f87f0", "testId": "CFG-03.1_A01", "test": "the frequency at which to review the system to identify unnecessary or nonsecure functions, ports, protocols, connections, or services is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least quarterly or when there is a change", "otherId": "53A_R5_CM-07(01)(a)\n53A_R5_CM-07(01)_ODP[01]\n171A_R3_A.03.04.06.ODP[06]", "defaultText": null }, { "id": 70278, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590171", "securityControlId": 31134, "ccis": [], "uuid": "625e8ec6-7561-5795-9263-6976810e386a", "testId": "CFG-03.1_A02", "test": "organization-defined functions, ports, protocols, software and services deemed to be unnecessary and/or non-secure are disabled or removed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-07(01)(b)[01]\n53A_R5_CM-07(01)(b)[02]\n53A_R5_CM-07(01)(b)[03]\n53A_R5_CM-07(01)(b)[04]\n53A_R5_CM-07(01)(b)[05]", "defaultText": null }, { "id": 70279, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590172", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590172", "securityControlId": 31134, "ccis": [], "uuid": "00360ff2-0ef7-5c85-a406-1b408a922f75", "testId": "CFG-03.1_A03", "test": "essential programs are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.7[a]", "defaultText": null }, { "id": 70280, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590172", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590172", "securityControlId": 31134, "ccis": [], "uuid": "868f2f53-128f-530c-b223-33fc4e1be4f2", "testId": "CFG-03.1_A04", "test": "essential functions are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.7[d]", "defaultText": null }, { "id": 70281, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590172", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590172", "securityControlId": 31134, "ccis": [], "uuid": "3e486f95-f2ee-5e06-b9c4-7207e992bad6", "testId": "CFG-03.1_A05", "test": "essential ports are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.7[g]", "defaultText": null }, { "id": 70282, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590172", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590172", "securityControlId": 31134, "ccis": [], "uuid": "c1d97e50-9e0e-55eb-8a15-befebcfb8358", "testId": "CFG-03.1_A06", "test": "essential protocols are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.7[j]", "defaultText": null }, { "id": 70283, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590172", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590172", "securityControlId": 31134, "ccis": [], "uuid": "0557e837-c628-5710-aaef-8d8bd1e7df07", "testId": "CFG-03.1_A07", "test": "essential services are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.7[m]", "defaultText": null }, { "id": 70284, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590172", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590172", "securityControlId": 31134, "ccis": [], "uuid": "5a739f19-1d05-5b3b-83ab-2b2f942f01be", "testId": "CFG-03.1_A08", "test": "the use of nonessential programs is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.7[b]", "defaultText": null }, { "id": 70285, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590172", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590172", "securityControlId": 31134, "ccis": [], "uuid": "9228ca57-9223-5ddf-b83e-341d6e93fdaf", "testId": "CFG-03.1_A09", "test": "the use of nonessential programs is restricted, disabled or prevented as defined.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.4.7[c]", "defaultText": null }, { "id": 70286, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590172", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590172", "securityControlId": 31134, "ccis": [], "uuid": "a5dfa11f-464b-5d24-842e-a495cca94650", "testId": "CFG-03.1_A10", "test": "the use of nonessential functions is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.7[e]", "defaultText": null }, { "id": 70287, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590174", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590174", "securityControlId": 31134, "ccis": [], "uuid": "655ac06c-d4f1-5ea7-aa01-8ece1d6148ed", "testId": "CFG-03.1_A11", "test": "the use of nonessential functions is restricted, disabled or prevented as defined.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.4.7[f]", "defaultText": null }, { "id": 70288, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590174", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590174", "securityControlId": 31134, "ccis": [], "uuid": "992406bb-4507-54c8-a914-f867a3c7eaae", "testId": "CFG-03.1_A12", "test": "the use of nonessential ports is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.7[h]", "defaultText": null }, { "id": 70289, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590174", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590174", "securityControlId": 31134, "ccis": [], "uuid": "a2b9d97a-e241-5907-9ec3-93c15f85c692", "testId": "CFG-03.1_A13", "test": "the use of nonessential protocols is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.7[k]", "defaultText": null }, { "id": 70290, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590174", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590174", "securityControlId": 31134, "ccis": [], "uuid": "21f59cdf-be9e-5325-9503-2b0daf157a6b", "testId": "CFG-03.1_A14", "test": "the use of nonessential ports is restricted, disabled or prevented as defined.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.4.7[i]", "defaultText": null }, { "id": 70291, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590174", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590174", "securityControlId": 31134, "ccis": [], "uuid": "ae7ab0e6-3054-5dbc-b551-be917ce632bf", "testId": "CFG-03.1_A15", "test": "the use of nonessential protocols is restricted, disabled or prevented as defined.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.4.7[l]", "defaultText": null }, { "id": 70292, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590174", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590174", "securityControlId": 31134, "ccis": [], "uuid": "c62e379f-e874-5423-9bbf-a0f0f299e643", "testId": "CFG-03.1_A16", "test": "the use of nonessential services is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.7[n]", "defaultText": null }, { "id": 70293, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590174", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590174", "securityControlId": 31134, "ccis": [], "uuid": "e065881e-e80f-5cbe-be6e-d4f4e8707d81", "testId": "CFG-03.1_A17", "test": "the use of nonessential services is restricted, disabled or prevented as defined.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.4.7[o]", "defaultText": null }, { "id": 70294, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590175", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590175", "securityControlId": 31134, "ccis": [], "uuid": "769ec057-bf30-5a7b-8cf3-5c97a525e8fa", "testId": "CFG-03.1_A18", "test": "functions to be disabled or removed when deemed unnecessary or non-secure are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-07(01)_ODP[02]", "defaultText": null }, { "id": 70295, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590175", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590175", "securityControlId": 31134, "ccis": [], "uuid": "9770fe83-f3e3-5b3a-9cbb-b674a08bc34c", "testId": "CFG-03.1_A19", "test": "ports to be disabled or removed when deemed unnecessary or non-secure are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-07(01)_ODP[03]", "defaultText": null }, { "id": 70296, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590175", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590175", "securityControlId": 31134, "ccis": [], "uuid": "e8318c2b-73c0-5c6f-9e3a-e000871accee", "testId": "CFG-03.1_A20", "test": "protocols to be disabled or removed when deemed unnecessary or non-secure are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-07(01)_ODP[04]", "defaultText": null }, { "id": 70297, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590175", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590175", "securityControlId": 31134, "ccis": [], "uuid": "564e0279-8329-5183-9ddd-7a0f911330ea", "testId": "CFG-03.1_A21", "test": "software to be disabled or removed when deemed unnecessary or non-secure is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-07(01)_ODP[05]", "defaultText": null }, { "id": 70298, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590175", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590175", "securityControlId": 31134, "ccis": [], "uuid": "fbba93d7-209c-5722-9696-34ced0292b7e", "testId": "CFG-03.1_A22", "test": "services to be disabled or removed when deemed unnecessary or non-secure are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-07(01)_ODP[06]", "defaultText": null } ], "externalMappings": [ { "id": 561023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f87e5a64-fa15-5175-bf53-af47a3166a57", "parentControlId": 31134, "controlId": "8.8", "title": "8.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583302" }, { "id": 561024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6e8ba5c-71da-533a-b212-cd60efd95339", "parentControlId": 31134, "controlId": "8.27", "title": "8.27", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583302" }, { "id": 561030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e308c2c0-d236-55db-a024-df7db4deff72", "parentControlId": 31134, "controlId": "CM-7(1)", "title": "CM-7(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583302" }, { "id": 561031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b8d7726-5512-5e76-a13a-5d6bc248841c", "parentControlId": 31134, "controlId": "CM-07(01)", "title": "CM-07(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583302" }, { "id": 561032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25229b4b-cc76-55e9-b20f-479269ff7504", "parentControlId": 31134, "controlId": "CM-07(01)", "title": "CM-07(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583303" }, { "id": 561033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44c43551-d3df-58fc-a775-2d879276cd00", "parentControlId": 31134, "controlId": "CM-07(01)", "title": "CM-07(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583303" }, { "id": 561034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4bc36ce3-c9c3-5d15-b34c-22c0afea00b1", "parentControlId": 31134, "controlId": "CM-07(01)", "title": "CM-07(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583303" }, { "id": 561035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18871566-5628-5053-aaa3-6a242b1e7137", "parentControlId": 31134, "controlId": "CM-07(01)", "title": "CM-07(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583303" }, { "id": 561036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21d00795-f018-5745-898b-69068055c0d5", "parentControlId": 31134, "controlId": "CM-7(1)", "title": "CM-7(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583303" }, { "id": 561039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5f1aa57-36e8-587c-bd0c-2ebc9eaf55f3", "parentControlId": 31134, "controlId": "3.4.7", "title": "3.4.7", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583303" }, { "id": 561040, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35f69a4b-21e8-5f02-8eef-0b0640f009ca", "parentControlId": 31134, "controlId": "03.04.06.c", "title": "03.04.06.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583303" }, { "id": 561041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff15d3c8-fdcc-5cbd-b9eb-01f8b17f6b04", "parentControlId": 31134, "controlId": "03.04.08.c", "title": "03.04.08.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583304" }, { "controlId": "B.5.1", "title": "B.5.1 — Removal of Unnecessary Services and Programs", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "2360cf9c-1e45-5432-812a-624a6042c154", "isPublic": true }, { "controlId": "NEI 08-09 App D.5.1", "title": "NEI 08-09 App D.5.1 — Removal of Unnecessary Services and Programs", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.5.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "020ea7e5-ff9d-567a-b254-0c47fb9eb1f3", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.5.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "6fa1675a-c37f-55bb-8b04-2dd4bee5ca33", "isPublic": true }, { "controlId": "NSS-17T-Sec6.4", "title": "NSS-17T-Sec6.4 — System Hardening & Baseline Configuration Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b1c0e1a0-e7d3-5321-a637-30e610608409", "isPublic": true }, { "controlId": "IEC-62645-7.2", "title": "IEC-62645-7.2 — I&C System Hardening and Least Functionality", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "dd979dd4-396c-5d74-a7ac-afc959cd9e95", "isPublic": true }, { "controlId": "IEC-63096-12.5", "title": "IEC-63096-12.5 — Control of Operational Software and Baseline Configurations", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "c8af4c1a-bc6a-5003-afe2-e690c3057011", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.5", "title": "IEEE-7-4.3.2-5.3.5 — Software Configuration Management in Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "a46ad711-faea-5669-866e-1328788fbf57", "isPublic": true } ], "id": 31134, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730975", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730975", "catalogueId": 1062, "uuid": "0062cfb0-0d3e-5cfe-917b-c4c3edd5f660", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization periodically review system configurations to identify and disable unnecessary and/or non-secure functions, ports, protocols and services?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Periodic Review", "description": "

Control Description

Mechanisms exist to periodically review system configurations to identify and disable unnecessary and/or non-secure functions, ports, protocols and services.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Configurations are reviewed only when new operating systems or versions of applications are released.

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to periodically review system configurations to identify and disable unnecessary and/or non-secure functions, ports, protocols and services.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.5.1", "controlId": "CFG-03.1", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Configuration Management (CM) program\n∙ Change control program

Small Business (10-49 staff)

∙ Configuration Management (CM) program\n∙ Change control program

Medium Business (50-249 staff)

∙ Configuration Management (CM) program\n∙ Change control program

Large Business (250-999 staff)

∙ Configuration Management (CM) program\n∙ Change control program

Enterprise (>1,000 staff)

∙ Configuration Management (CM) program\n∙ Change control program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70299, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590176", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590176", "securityControlId": 31135, "ccis": [], "uuid": "bb9677cf-fb76-5a41-8454-534deff4c04a", "testId": "CFG-03.2_A01", "test": "policies, rules of behavior, and/or access agreements regarding unauthorized software program usage and restrictions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-07(02)_ODP[01]\n53A_R5_CM-07(02)_ODP[02]", "defaultText": null }, { "id": 70300, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590176", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590176", "securityControlId": 31135, "ccis": [], "uuid": "0cf76656-524e-5c08-8388-c0de63c85e36", "testId": "CFG-03.2_A02", "test": "program execution is prevented in accordance with organization-defined criteria (e.g., policies, rules of behavior, and/or access agreements).
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-07(02)\n53A_R5_CM-07(02)_ODP[01]", "defaultText": null } ], "externalMappings": [ { "id": 561117, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0fae4e5-e880-50ee-a5de-825a37cfda24", "parentControlId": 31135, "controlId": "CM-7(2)", "title": "CM-7(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583321" }, { "id": 561118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7704e5ef-f00b-5638-a413-01c6644bde6b", "parentControlId": 31135, "controlId": "CM-07(02)", "title": "CM-07(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583321" }, { "id": 561120, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5eb62ad9-ec61-535d-b21b-1566eb3275e7", "parentControlId": 31135, "controlId": "CM-07(02)", "title": "CM-07(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583322" }, { "id": 561121, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8bdce6d-7d8d-512f-9f2d-e2bb6469ad83", "parentControlId": 31135, "controlId": "CM-07(02)", "title": "CM-07(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583322" }, { "id": 561123, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7bf13f0-fc47-592c-9615-79dd5e76cf79", "parentControlId": 31135, "controlId": "3.4.7", "title": "3.4.7", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583322" }, { "id": 561124, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0141c498-1350-579f-b6f6-f180256c29fd", "parentControlId": 31135, "controlId": "03.04.08.b", "title": "03.04.08.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583322" }, { "id": 561125, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b45a7d4b-b49b-5760-8e89-3c7140dffbb4", "parentControlId": 31135, "controlId": "PR.PS-05", "title": "PR.PS-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583322" } ], "id": 31135, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730975", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730975", "catalogueId": 1062, "uuid": "f52032e4-0927-54de-bb92-96cfc5f00abe", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization configure systems to prevent the execution of unauthorized software programs?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Prevent Unauthorized Software Execution", "description": "

Control Description

Mechanisms exist to configure systems to prevent the execution of unauthorized software programs.

Evidence Request List (ERL)

E-AST-20\nE-AST-21

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to configure systems to prevent the execution of unauthorized software programs.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CFG-03.2", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-03.2", "references": "

Micro-Small Business (<10 staff)

∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)

Small Business (10-49 staff)

∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)

Medium Business (50-249 staff)

∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Large Business (250-999 staff)

∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Enterprise (>1,000 staff)

∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70301, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590176", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590176", "securityControlId": 31136, "ccis": [], "uuid": "75398581-6a13-5e14-87f5-44fdea14a09f", "testId": "CFG-03.3_A01", "test": "a policy and/or process specifying whether whitelisting or blacklisting is to be implemented is specified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.8[a]", "defaultText": null }, { "id": 70302, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590176", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590176", "securityControlId": 31136, "ccis": [], "uuid": "4543496d-bcbe-5f6b-afd3-ba683e5c5eae", "testId": "CFG-03.3_A02", "test": "the software allowed to execute under whitelisting or denied use under blacklisting is specified.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.4.8[b]", "defaultText": null }, { "id": 70303, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590176", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590176", "securityControlId": 31136, "ccis": [], "uuid": "e0558156-ac1e-59b7-bc57-e55ec8a0b424", "testId": "CFG-03.3_A03", "test": "whitelisting to allow the execution of authorized software or blacklisting to prevent the use of unauthorized software is implemented as specified.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.4.8[c]", "defaultText": null }, { "id": 70304, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590176", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590176", "securityControlId": 31136, "ccis": [], "uuid": "c8a4fa89-fb1f-5423-89e1-72cad976978a", "testId": "CFG-03.3_A04", "test": "registration requirements for functions, ports, protocols and services are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-07(03)_ODP", "defaultText": null }, { "id": 70305, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590177", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590177", "securityControlId": 31136, "ccis": [], "uuid": "b9b7978d-c2f2-5bfa-8c64-90b89a2efc70", "testId": "CFG-03.3_A05", "test": "an allow-all, deny-by-exception policy is employed to prohibit the execution of unauthorized software programs on the system.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_CM-07(04)(b)", "defaultText": null }, { "id": 70306, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590177", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590177", "securityControlId": 31136, "ccis": [], "uuid": "31f0f5ea-d93b-5f5e-99e4-350e774cc099", "testId": "CFG-03.3_A06", "test": "the list of unauthorized software programs is reviewed / updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least quarterly or when there is a change", "otherId": "53A_R5_CM-07(04)(c)", "defaultText": null }, { "id": 70307, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590177", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590177", "securityControlId": 31136, "ccis": [], "uuid": "ff29b853-a2a8-50de-8e8c-eed9328957fd", "testId": "CFG-03.3_A07", "test": "organization-defined registration requirements are complied with.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CM-07(03)", "defaultText": null }, { "id": 70308, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590177", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590177", "securityControlId": 31136, "ccis": [], "uuid": "a5863218-66e7-5173-9f13-78981f61f9c9", "testId": "CFG-03.3_A08", "test": "software programs not authorized to execute on the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-07(04)_ODP[01]", "defaultText": null }, { "id": 70309, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590177", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590177", "securityControlId": 31136, "ccis": [], "uuid": "47f816d7-b9c1-5e2b-9368-04265018b69d", "testId": "CFG-03.3_A09", "test": "frequency at which to review / update the list of unauthorized software programs is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least quarterly or when there is a change", "otherId": "53A_R5_CM-07(04)_ODP[02]", "defaultText": null }, { "id": 70310, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590177", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590177", "securityControlId": 31136, "ccis": [], "uuid": "d62de563-6562-5b80-9941-056c3740ebd5", "testId": "CFG-03.3_A10", "test": "organization-defined software programs are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-07(04)(a)\n53A_R5_CM-07(05)(a)", "defaultText": null }, { "id": 70311, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590177", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590177", "securityControlId": 31136, "ccis": [], "uuid": "475749e2-b605-5cbf-a21f-ff04a150fad2", "testId": "CFG-03.3_A11", "test": "software programs authorized to execute on the system are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-07(05)_ODP[01]\n171A_R3_A.03.04.08.a", "defaultText": null }, { "id": 70312, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590186", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590186", "securityControlId": 31136, "ccis": [], "uuid": "9f12aa62-18d0-5daf-8a6c-08e42d700883", "testId": "CFG-03.3_A12", "test": "the frequency at which to review and update the list of authorized software programs is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least quarterly or when there is a change", "otherId": "53A_R5_CM-07(05)_ODP[02]\n171A_R3_A.03.04.08.ODP[01]", "defaultText": null }, { "id": 70313, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590187", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590187", "securityControlId": 31136, "ccis": [], "uuid": "0253f84e-4492-555c-8b4e-d84d00bdac6c", "testId": "CFG-03.3_A13", "test": "a deny-all, allow-by-exception policy for the execution of authorized software programs on the system is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_CM-07(05)(b)\n171A_R3_A.03.04.08.b", "defaultText": null }, { "id": 70314, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590187", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590187", "securityControlId": 31136, "ccis": [], "uuid": "e6f6a6cf-f030-52df-89ab-0450f46fd579", "testId": "CFG-03.3_A14", "test": "the list of authorized software programs is reviewed / updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least quarterly or when there is a change", "otherId": "53A_R5_CM-07(05)(c)", "defaultText": null }, { "id": 70315, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590187", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590187", "securityControlId": 31136, "ccis": [], "uuid": "7e2da0f5-b747-52a3-b817-7e98af8db860", "testId": "CFG-03.3_A15", "test": "the automatic execution of mobile code in organization-defined software applications is prevented.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-18(04)[01]", "defaultText": null }, { "id": 70316, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590187", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590187", "securityControlId": 31136, "ccis": [], "uuid": "b628b848-ea05-527f-a02c-5d4a03448481", "testId": "CFG-03.3_A16", "test": "organization-defined actions are enforced prior to executing mobile code.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-18(04)[02]", "defaultText": null }, { "id": 70317, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590187", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590187", "securityControlId": 31136, "ccis": [], "uuid": "dca76f1a-6cca-5868-bd77-eaf270e125fb", "testId": "CFG-03.3_A17", "test": "the use of mobile code is controlled.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.13.13.b[03]", "defaultText": null } ], "externalMappings": [ { "id": 561158, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "841d4639-2a07-531b-afbe-8be40dadcb84", "parentControlId": 31136, "controlId": "CM-7(4)", "title": "CM-7(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583326" }, { "id": 561159, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79c2565e-4705-5e7e-873b-2cd0dd9dc7fa", "parentControlId": 31136, "controlId": "CM-7(5)", "title": "CM-7(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583326" }, { "id": 561160, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f26ce01d-6f51-58bb-92c4-6803a9a4e103", "parentControlId": 31136, "controlId": "SC-18(4)", "title": "SC-18(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583326" }, { "id": 561161, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cfeb8ad-ca39-51c3-aedd-650837749a90", "parentControlId": 31136, "controlId": "CM-07(04)", "title": "CM-07(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583326" }, { "id": 561162, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ddea15b-efd1-5934-89a6-b705bdc7f4c3", "parentControlId": 31136, "controlId": "CM-07(05)", "title": "CM-07(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583326" }, { "id": 561163, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b57047a-d400-5873-b42e-2c681750c042", "parentControlId": 31136, "controlId": "SC-18(04)", "title": "SC-18(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583326" }, { "id": 561165, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a991681b-b7d6-54d1-a40b-c7c672af5c86", "parentControlId": 31136, "controlId": "CM-07(05)", "title": "CM-07(05)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583327" }, { "id": 561166, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b26e8041-5e0f-579e-b661-9dad148e34b4", "parentControlId": 31136, "controlId": "CM-07(04)", "title": "CM-07(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583327" }, { "id": 561167, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f82b36df-91fc-5329-b552-d77fdabbc329", "parentControlId": 31136, "controlId": "CM-07(05)", "title": "CM-07(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583327" }, { "id": 561168, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "904a3d2e-31fe-5601-b6c4-2e1211a69275", "parentControlId": 31136, "controlId": "SC-18(04)", "title": "SC-18(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583327" }, { "id": 561169, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07bf4833-cb3d-560b-ad9f-927787ba377e", "parentControlId": 31136, "controlId": "CM-07(05)", "title": "CM-07(05)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583327" }, { "id": 561170, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a38eaeb7-2869-5f44-b852-1cb66a6e9687", "parentControlId": 31136, "controlId": "CM-07(05)", "title": "CM-07(05)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583327" }, { "id": 561173, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583328", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be0d5895-73e4-566c-a000-ed8ea52e6479", "parentControlId": 31136, "controlId": "CM-7(4)", "title": "CM-7(4)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583328" }, { "id": 561174, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583328", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fd8a216-0448-5c09-9f06-9f4a3f3ba304", "parentControlId": 31136, "controlId": "CM-7(5)", "title": "CM-7(5)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583328" }, { "id": 561178, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583328", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47ee4f12-8421-5f79-916d-cc50be4ba768", "parentControlId": 31136, "controlId": "3.4.8", "title": "3.4.8", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583328" }, { "id": 561179, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583328", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "446841df-db8b-57d7-9603-5b0890a21949", "parentControlId": 31136, "controlId": "03.04.08.a", "title": "03.04.08.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583328" }, { "id": 561180, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583329", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7da7256-3280-5981-b53b-1fd4a0ad3df2", "parentControlId": 31136, "controlId": "03.04.08.b", "title": "03.04.08.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583329" }, { "id": 561181, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583329", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2fd6fcf-72f0-5221-baea-00f884a5c944", "parentControlId": 31136, "controlId": "03.13.13.a", "title": "03.13.13.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583329" }, { "id": 561182, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583329", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acb617f1-9df1-55a4-b278-db8d5407205b", "parentControlId": 31136, "controlId": "03.13.13.b", "title": "03.13.13.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583329" }, { "id": 561194, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58333", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b36d8850-813c-57c6-83c4-0b1a1aa76701", "parentControlId": 31136, "controlId": "ARCHITECTURE-3m", "title": "ARCHITECTURE-3m", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58333" } ], "id": 31136, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730975", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730975", "catalogueId": 1062, "uuid": "a9626ec0-dce7-5ddf-977a-3abd258bac6f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization explicitly allow (allowlist / whitelist) and/or block (denylist / blacklist) applications that are authorized to execute on systems?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Explicitly Allow / Deny Applications", "description": "

Control Description

Mechanisms exist to explicitly allow (allowlist / whitelist) and/or block (denylist / blacklist) applications that are authorized to execute on systems.

Evidence Request List (ERL)

E-AST-31

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to explicitly allow (allowlist / whitelist) and/or block (denylist / blacklist) applications that are authorized to execute on systems.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CFG-03.3", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-03.3", "references": "

Micro-Small Business (<10 staff)

∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)

Small Business (10-49 staff)

∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)

Medium Business (50-249 staff)

∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Large Business (250-999 staff)

∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Enterprise (>1,000 staff)

∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70318, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590188", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590188", "securityControlId": 31137, "ccis": [], "uuid": "83700859-422c-5fe7-8957-d5ab4f9547bc", "testId": "CFG-03.4_A01", "test": "safeguards to securely provision split tunneling are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_SC-07(07)_ODP", "defaultText": null }, { "id": 70319, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590188", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590188", "securityControlId": 31137, "ccis": [], "uuid": "9de6fad2-abd1-5b64-aaf8-495351c85049", "testId": "CFG-03.4_A02", "test": "remote devices are prevented from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks (e.g., split tunneling).
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.13.7\n53A_R5_SC-07(07)", "defaultText": null } ], "externalMappings": [ { "id": 561253, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5fcd0a4a-2b88-56f1-9ee1-af7b30fe374d", "parentControlId": 31137, "controlId": "SC-7(7)", "title": "SC-7(7)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583337" }, { "id": 561254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07a8b21b-dc79-5f7d-a672-917a0132600c", "parentControlId": 31137, "controlId": "SC-07(07)", "title": "SC-07(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583337" }, { "id": 561255, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8baacdf-2f0e-57ef-b6aa-47b4f9d0620f", "parentControlId": 31137, "controlId": "SC-07(07)", "title": "SC-07(07)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583337" }, { "id": 561256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bd73601-985c-53d1-a095-25e78f24ac5c", "parentControlId": 31137, "controlId": "SC-07(07)", "title": "SC-07(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583337" }, { "id": 561257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6751b99-9d6b-5483-bbf0-861743acec0f", "parentControlId": 31137, "controlId": "SC-07(07)", "title": "SC-07(07)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583337" }, { "id": 561258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583338", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "042cc62b-d282-50c8-a788-1f5656af504c", "parentControlId": 31137, "controlId": "SC-07(07)", "title": "SC-07(07)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583338" }, { "id": 561259, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583338", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5dca4903-8f4b-5543-9fd2-068b8b0be766", "parentControlId": 31137, "controlId": "3.13.7", "title": "3.13.7", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583338" } ], "id": 31137, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730976", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730976", "catalogueId": 1062, "uuid": "70fa4257-1b4c-58c5-93c4-a098215ee93b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prevent split tunneling for remote devices unless the split tunnel is securely provisioned using organization-defined safeguards?\n\nPrevent split tunneling for remote devices unless the split tunnel is securely provisioned using organization-defined safeguards?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Split Tunneling", "description": "

Control Description

Mechanisms exist to prevent split tunneling for remote devices unless the split tunnel is securely provisioned using organization-defined safeguards.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prevent split tunneling for remote devices unless the split tunnel is securely provisioned using organization-defined safeguards.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CFG-03.4", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-03.4", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70320, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590188", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590188", "securityControlId": 31138, "ccis": [], "uuid": "7e249890-9c6d-5252-8b7b-d36f95896a65", "testId": "CFG-04_A01", "test": "software and associated documentation are used in accordance with contract agreements and copyright laws.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-10a.", "defaultText": null }, { "id": 70321, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590188", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590188", "securityControlId": 31138, "ccis": [], "uuid": "4f29cc8f-057c-5985-ba9e-e2bc13cd9489", "testId": "CFG-04_A02", "test": "the use of software and associated documentation protected by quantity licenses is tracked to control copying and distribution.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CM-10b.", "defaultText": null }, { "id": 70322, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590188", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590188", "securityControlId": 31138, "ccis": [], "uuid": "5cbfc986-36dd-5fff-9976-e9c8704bbf97", "testId": "CFG-04_A03", "test": "the use of peer-to-peer file sharing technology is controlled and documented to ensure that peer-to-peer file sharing is not used for the unauthorized distribution, display, performance or reproduction of copyrighted work.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-10c.", "defaultText": null } ], "externalMappings": [ { "id": 561295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09737ff3-07ea-5128-b083-c7ca7d10424f", "parentControlId": 31138, "controlId": "T1546.008", "title": "T1546.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583347" }, { "id": 561296, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fea6ca76-f7e0-58ee-92b5-7fe904a60438", "parentControlId": 31138, "controlId": "T1546.013", "title": "T1546.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583347" }, { "id": 561297, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c2eaee3-d15a-5e7c-a829-ad7717379f78", "parentControlId": 31138, "controlId": "T1550.001", "title": "T1550.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583347" }, { "id": 561298, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e816d036-0fc2-5d19-a35e-d9400646821f", "parentControlId": 31138, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583348" }, { "id": 561299, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "404833c5-2078-5ec4-9df1-7c865f18efac", "parentControlId": 31138, "controlId": "T1553.004", "title": "T1553.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583348" }, { "id": 561300, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fda7222-c7ce-5c2e-a125-c9d90fbc98b5", "parentControlId": 31138, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583348" }, { "id": 561301, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13d9db6e-cf86-54d5-a014-fefafff49f56", "parentControlId": 31138, "controlId": "T1559.002", "title": "T1559.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583348" }, { "id": 561302, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3b518b9-5208-586f-aecf-b21c9e24cb04", "parentControlId": 31138, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583348" }, { "id": 561303, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e46b6ada-8610-5e75-922a-a9cf385e1b0c", "parentControlId": 31138, "controlId": "T1562.009", "title": "T1562.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583348" }, { "id": 561304, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3e358d1-9c91-57d0-8de2-c7aae7f581a2", "parentControlId": 31138, "controlId": "CM-10", "title": "CM-10", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583348" }, { "id": 561305, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d52c600-4aa8-5d59-9cab-da38c82fd4b2", "parentControlId": 31138, "controlId": "CM-10", "title": "CM-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583348" }, { "id": 561306, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a12a2c4-c302-5b3c-8ff8-51bd54ed8b11", "parentControlId": 31138, "controlId": "CM-10", "title": "CM-10", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583348" }, { "id": 561307, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0757deb6-0f43-552b-99a6-d715581803df", "parentControlId": 31138, "controlId": "CM-10", "title": "CM-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583349" }, { "id": 561308, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99f64e84-93c2-5d19-9ac1-95e188ca18dd", "parentControlId": 31138, "controlId": "CM-10", "title": "CM-10", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583349" }, { "id": 561309, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de9b6b25-75bd-50d2-9606-b6513219ed63", "parentControlId": 31138, "controlId": "CM-10", "title": "CM-10", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583349" }, { "id": 561310, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a182dc43-5b71-53f6-9903-b8afb7644f6c", "parentControlId": 31138, "controlId": "CM-10", "title": "CM-10", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583349" }, { "id": 561311, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9db18b2d-6ef2-5102-9aec-5696dd9735b2", "parentControlId": 31138, "controlId": "CM-10", "title": "CM-10", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583349" }, { "id": 561312, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "647a0c43-380f-5e0f-b034-4bdb2b59948a", "parentControlId": 31138, "controlId": "CM-10", "title": "CM-10", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583349" }, { "id": 561315, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e82cb09c-ffda-5ddd-a56f-07508e59bdf2", "parentControlId": 31138, "controlId": "03.13.13.b", "title": "03.13.13.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583349" }, { "controlId": "NSS-17T-Sec6.4", "title": "NSS-17T-Sec6.4 — System Hardening & Baseline Configuration Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "c1e2ab3f-cf65-519e-ab38-74a45d75188e", "isPublic": true }, { "controlId": "IEC-62645-7.2", "title": "IEC-62645-7.2 — I&C System Hardening and Least Functionality", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "2c07cb3b-6e3a-57b8-924b-f015af8e93fe", "isPublic": true }, { "controlId": "IEC-63096-12.5", "title": "IEC-63096-12.5 — Control of Operational Software and Baseline Configurations", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "a7586a09-4f47-5c72-8476-51cdb2b48551", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.5", "title": "IEEE-7-4.3.2-5.3.5 — Software Configuration Management in Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "5c0ba1ca-ea3c-5244-981c-b76b2becfe3c", "isPublic": true } ], "id": 31138, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730976", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730976", "catalogueId": 1062, "uuid": "37e01387-5cb5-53a0-b76d-30c82050bc9a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce software usage restrictions to comply with applicable contract agreements and copyright laws?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Software Usage Restrictions", "description": "

Control Description

Mechanisms exist to enforce software usage restrictions to comply with applicable contract agreements and copyright laws.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enforce software usage restrictions to comply with applicable contract agreements and copyright laws.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CFG-04", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-04", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70323, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590188", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590188", "securityControlId": 31139, "ccis": [], "uuid": "c2a5b3bf-3b3f-58cf-b6c7-429ebd34794e", "testId": "CFG-04.1_A01", "test": "restrictions on the use of open-source software are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-10(01)_ODP", "defaultText": null }, { "id": 70324, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590189", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590189", "securityControlId": 31139, "ccis": [], "uuid": "bb9a3392-494f-50ef-afda-ecfb768461cf", "testId": "CFG-04.1_A02", "test": "organization-defined restrictions are established for the use of open-source software.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-10(01)", "defaultText": null } ], "externalMappings": [ { "id": 561336, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb2b16af-7d03-55ac-bc2a-28e89a4cda8c", "parentControlId": 31139, "controlId": "CM-10(1)", "title": "CM-10(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583353" }, { "id": 561337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55568f43-7e76-5cfc-88e2-25e01bdebaa1", "parentControlId": 31139, "controlId": "CM-10(01)", "title": "CM-10(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583353" }, { "id": 561338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c93b9ad5-4636-5289-88f0-eec7bc98c81b", "parentControlId": 31139, "controlId": "CM-10(01)", "title": "CM-10(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583353" }, { "id": 561339, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f338dab-8df5-590f-ae75-e2b0f6ee3588", "parentControlId": 31139, "controlId": "CM-8(10)", "title": "CM-8(10)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583353" }, { "id": 561340, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0755b7a-b08e-5ba3-a865-70e4848c27b0", "parentControlId": 31139, "controlId": "CM-10(1)", "title": "CM-10(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583353" }, { "id": 561344, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583354", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4683220c-9b52-515b-a552-137940704043", "parentControlId": 31139, "controlId": "03.13.13.b", "title": "03.13.13.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583354" } ], "id": 31139, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730977", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730977", "catalogueId": 1062, "uuid": "acf49181-119a-5eb3-87eb-f25e47005018", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish parameters for the secure use of open source software?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Open Source Software", "description": "

Control Description

Mechanisms exist to establish parameters for the secure use of open source software.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to establish parameters for the secure use of open source software.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CFG-04.1", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-04.1", "references": "

Micro-Small Business (<10 staff)

∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)

Small Business (10-49 staff)

∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)

Medium Business (50-249 staff)

∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Large Business (250-999 staff)

∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Enterprise (>1,000 staff)

∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70329, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59019", "securityControlId": 31141, "ccis": [], "uuid": "269a345d-772d-5e5d-a8c3-b73055f13f6f", "testId": "CFG-05_A01", "test": "policies governing the installation of software by users are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.9[b]\n53A_R5_CM-11_ODP[01]\n53A_R5_CM-11a.", "defaultText": null }, { "id": 70330, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59019", "securityControlId": 31141, "ccis": [], "uuid": "f6d31e0d-be10-5ad8-9754-cacbac29b386", "testId": "CFG-05_A02", "test": "methods used to enforce software installation policies are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-11_ODP[02]", "defaultText": null }, { "id": 70331, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59019", "securityControlId": 31141, "ccis": [], "uuid": "828ab78b-cf7b-55ad-bd92-8575e0c93c70", "testId": "CFG-05_A03", "test": "software installation policies are enforced through organization-defined methods.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-11b.", "defaultText": null }, { "id": 70332, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59019", "securityControlId": 31141, "ccis": [], "uuid": "34160bb1-a2b3-5b30-9844-5ec967ed2250", "testId": "CFG-05_A04", "test": "installation of software by users is monitored.
PPTDF Applicability: Technology
Assessment Rigor: 2
SCF Defined Parameters: Continuously", "otherId": "171A_3.4.9[c]\n53A_R5_CM-11_ODP[03]\n53A_R5_CM-11c.", "defaultText": null }, { "id": 70333, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59019", "securityControlId": 31141, "ccis": [], "uuid": "84bc5f6a-b564-5ca4-96ef-c8ad28f2ce97", "testId": "CFG-05_A05", "test": "configuration settings prevent the ability of non-privileged users to install unauthorized software.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.4.9[a]", "defaultText": null } ], "externalMappings": [ { "id": 561381, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df031434-13e3-5181-bc1c-748dddc293ef", "parentControlId": 31141, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583358" }, { "id": 561382, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "324bf877-04c4-592f-91f9-528a46fdd3b8", "parentControlId": 31141, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583359" }, { "id": 561383, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8dee9c0c-e4e4-57e5-9d03-02f6b9af0b1c", "parentControlId": 31141, "controlId": "T1059.006", "title": "T1059.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583359" }, { "id": 561384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fce37437-945c-5dc9-a722-6e826088cdbe", "parentControlId": 31141, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583359" }, { "id": 561385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36d657c1-79d9-568b-832a-71a87e69f3fe", "parentControlId": 31141, "controlId": "T1176", "title": "T1176", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583359" }, { "id": 561386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1ec6441-bf09-51bc-b76e-2bed05aa5029", "parentControlId": 31141, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583359" }, { "id": 561387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eff36b09-108e-5c6d-be3d-b15f6d9e9569", "parentControlId": 31141, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583359" }, { "id": 561388, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b404a73-40fa-512f-8f4f-3852c1efeb01", "parentControlId": 31141, "controlId": "T1195.002", "title": "T1195.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583359" }, { "id": 561389, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04151fed-ad75-5ed7-872f-dc925bd3cb5d", "parentControlId": 31141, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583359" }, { "id": 561390, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7052f5b9-1b4d-54e2-b0b2-7409e9f4d8f1", "parentControlId": 31141, "controlId": "T1218.001", "title": "T1218.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583359" }, { "id": 561391, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0323d89a-27d6-5ecd-aeda-8f52c334c8c3", "parentControlId": 31141, "controlId": "T1218.002", "title": "T1218.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58336" }, { "id": 561392, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b21a4667-51d9-5a85-aa51-993964ab5e27", "parentControlId": 31141, "controlId": "T1218.003", "title": "T1218.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58336" }, { "id": 561393, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "478853be-4900-538d-84fd-0cb8820dfb79", "parentControlId": 31141, "controlId": "T1218.004", "title": "T1218.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58336" }, { "id": 561394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10322b91-2cbc-53db-ba60-d5d15cf8060d", "parentControlId": 31141, "controlId": "T1218.005", "title": "T1218.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58336" }, { "id": 561395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e3a6b11-14b0-5b1f-9cfe-948741137fae", "parentControlId": 31141, "controlId": "T1218.008", "title": "T1218.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58336" }, { "id": 561396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1a254b7-df78-5d43-b315-02c4a81e768d", "parentControlId": 31141, "controlId": "T1218.009", "title": "T1218.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58336" }, { "id": 561397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81c83b8a-4939-54ee-8218-233a3defa8b0", "parentControlId": 31141, "controlId": "T1218.012", "title": "T1218.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58336" }, { "id": 561398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ea5c467-5518-50c5-a4d0-de91b9b933a6", "parentControlId": 31141, "controlId": "T1218.013", "title": "T1218.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58336" }, { "id": 561399, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28890011-64c5-5f81-984a-c82359e27030", "parentControlId": 31141, "controlId": "T1218.014", "title": "T1218.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583361" }, { "id": 561400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5c9c435-034a-52a6-9109-18e60717e358", "parentControlId": 31141, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583361" }, { "id": 561401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d671837a-3480-5382-92c5-2d512e168fb4", "parentControlId": 31141, "controlId": "T1505.001", "title": "T1505.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583361" }, { "id": 561402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea607b5e-98ad-5ed6-98d3-fade50acf3a4", "parentControlId": 31141, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583361" }, { "id": 561403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1cacae0-e77d-5005-a3c7-52a3b641ac98", "parentControlId": 31141, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583361" }, { "id": 561404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50abab02-d81a-54a3-8ee5-db9239bbc0ec", "parentControlId": 31141, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583361" }, { "id": 561405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca4edf48-021e-5b5e-9132-bc6ed601ad9a", "parentControlId": 31141, "controlId": "T1543.001", "title": "T1543.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583361" }, { "id": 561406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3869ac56-905c-5362-ab02-e5dba8469a9c", "parentControlId": 31141, "controlId": "T1543.002", "title": "T1543.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583361" }, { "id": 561407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f7315de-87e0-5a1d-b0f9-070acc5ca45b", "parentControlId": 31141, "controlId": "T1543.003", "title": "T1543.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583361" }, { "id": 561408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7acf39d-16ff-59af-a44a-a51539fea47d", "parentControlId": 31141, "controlId": "T1543.004", "title": "T1543.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583362" }, { "id": 561409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c7477b2-d698-5fd7-881e-66096f32b3cb", "parentControlId": 31141, "controlId": "T1547.013", "title": "T1547.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583362" }, { "id": 561410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f571a7b6-bd3f-5982-910e-fc253be7a430", "parentControlId": 31141, "controlId": "T1550.001", "title": "T1550.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583362" }, { "id": 561411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22099f21-856e-5793-b9c8-246d357df0b5", "parentControlId": 31141, "controlId": "T1564.009", "title": "T1564.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583362" }, { "id": 561412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "239ca4f4-78de-5a59-8ded-91b31d86ea48", "parentControlId": 31141, "controlId": "T1569", "title": "T1569", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583362" }, { "id": 561413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbf2a211-f73f-5e6f-9d73-a9681e051fb5", "parentControlId": 31141, "controlId": "T1569.001", "title": "T1569.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583362" }, { "id": 561414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5201f44a-da3c-5cd9-93b4-097979ea1089", "parentControlId": 31141, "controlId": "CM-11", "title": "CM-11", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583362" }, { "id": 561415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08594000-38fa-5fc2-84fd-d338368ffe44", "parentControlId": 31141, "controlId": "CM-11", "title": "CM-11", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583362" }, { "id": 561416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f95ff580-3640-52d6-8dc1-03e01c432dee", "parentControlId": 31141, "controlId": "CM-11(02)", "title": "CM-11(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583363" }, { "id": 561419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a114e990-16ab-5801-826b-e14b0b76a0e4", "parentControlId": 31141, "controlId": "CM-11", "title": "CM-11", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583363" }, { "id": 561420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "556e9bde-27a4-534b-9d15-92c721998746", "parentControlId": 31141, "controlId": "CM-11", "title": "CM-11", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583363" }, { "id": 561421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff883620-3403-571f-b2ae-a1e02c01a2ad", "parentControlId": 31141, "controlId": "CM-11(02)", "title": "CM-11(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583363" }, { "id": 561422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "911ac5bf-79c6-5988-b682-33de7de6b2fd", "parentControlId": 31141, "controlId": "CM-11", "title": "CM-11", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583363" }, { "id": 561423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "404f53cc-d2e8-55c3-8e44-495bc584c49a", "parentControlId": 31141, "controlId": "CM-11", "title": "CM-11", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583363" }, { "id": 561424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b57b166a-4868-555b-b29b-b4f323e946a9", "parentControlId": 31141, "controlId": "CM-11", "title": "CM-11", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583363" }, { "id": 561425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583364", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44b42600-e578-5c01-b317-e333b01495ad", "parentControlId": 31141, "controlId": "CM-11", "title": "CM-11", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583364" }, { "id": 561426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583364", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fe28ac5-30c5-5633-ad82-bb8fdf20a4c2", "parentControlId": 31141, "controlId": "CM-11", "title": "CM-11", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583364" }, { "id": 561429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583364", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1029ec03-484e-575c-84e1-11f0f64a9cb1", "parentControlId": 31141, "controlId": "3.4.9", "title": "3.4.9", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583364" }, { "id": 561430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583364", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a07eec20-2254-5f06-b221-a7b840c825ba", "parentControlId": 31141, "controlId": "03.13.13.b", "title": "03.13.13.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583364" }, { "id": 561433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583364", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba56837f-7f60-59a0-9745-73a2db7b99df", "parentControlId": 31141, "controlId": "PR.PS-05", "title": "PR.PS-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583364" }, { "controlId": "NSS-17T-Sec6.4", "title": "NSS-17T-Sec6.4 — System Hardening & Baseline Configuration Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "52875a39-fd9b-5bc5-b3d4-e280a3a78dfb", "isPublic": true }, { "controlId": "IEC-62645-7.2", "title": "IEC-62645-7.2 — I&C System Hardening and Least Functionality", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "c961f2b3-ecc2-5e80-93f9-f1ca6b0a2c18", "isPublic": true }, { "controlId": "IEC-63096-12.5", "title": "IEC-63096-12.5 — Control of Operational Software and Baseline Configurations", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "a0f85a94-8a3f-5290-b97d-7fb5a2bb6c7d", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.5", "title": "IEEE-7-4.3.2-5.3.5 — Software Configuration Management in Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "8a6eaf08-8b40-50c7-b85c-41953953ae20", "isPublic": true } ], "id": 31141, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730977", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730977", "catalogueId": 1062, "uuid": "169e440f-3105-59f7-8f35-a2fd66ce17ef", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict the ability of non-privileged users to install unauthorized software?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "User-Installed Software", "description": "

Control Description

Mechanisms exist to restrict the ability of non-privileged users to install unauthorized software.

Evidence Request List (ERL)

E-AST-01\nE-AST-21\nE-IAM-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict the ability of non-privileged users to install unauthorized software.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CFG-05", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-05", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Privileged Account Management (PAM)\n∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Privileged Account Management (PAM)\n∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Privileged Account Management (PAM)\n∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Privileged Account Management (PAM)\n∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Privileged Account Management (PAM)\n∙ whitelisting / blacklisting applications\n∙ Microsoft Windows Defender Application Control (WDAC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70334, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59019", "securityControlId": 31142, "ccis": [], "uuid": "15cdf9d3-612f-57b5-95a2-1b399cd00973", "testId": "CFG-05.1_A01", "test": "compliance with software installation policies is enforced using organization-defined automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-11(03)[01]", "defaultText": null }, { "id": 70335, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590191", "securityControlId": 31142, "ccis": [], "uuid": "d775282b-a136-5efa-896a-2ef75028fac0", "testId": "CFG-05.1_A02", "test": "the frequency at which automated mechanisms are used to detect the presence of unauthorized hardware, software and/or firmware within the system is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: automated mechanisms with a maximum five-minute delay in detection", "otherId": "53A_R5_CM-08(03)_ODP[04]", "defaultText": null }, { "id": 70336, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590191", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590191", "securityControlId": 31142, "ccis": [], "uuid": "f11c6c4e-72bf-59b2-b0cf-b854d7856edf", "testId": "CFG-05.1_A03", "test": "automated mechanisms used to monitor compliance are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-11(03)_ODP[02]", "defaultText": null } ], "externalMappings": [ { "id": 561470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ca44c17-604a-5176-b09d-2b73733a32c2", "parentControlId": 31142, "controlId": "CM-11(1)", "title": "CM-11(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583369" }, { "id": 561471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7029cf12-ea63-5282-be8b-c71931a7dfd6", "parentControlId": 31142, "controlId": "CM-08(03)", "title": "CM-08(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583369" }, { "id": 561472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25e8395f-092e-52bc-bbf7-0cdef9cca8d1", "parentControlId": 31142, "controlId": "CM-11(03)", "title": "CM-11(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583369" }, { "id": 561475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "333644c7-1ce3-5376-b833-fae0ea8701c3", "parentControlId": 31142, "controlId": "CM-08(03)", "title": "CM-08(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58337" }, { "id": 561476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a178d394-40b8-50fc-bda6-e4e9e5f73943", "parentControlId": 31142, "controlId": "CM-08(03)", "title": "CM-08(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58337" }, { "id": 561477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "468a21db-d803-5859-8d61-bc676c452c1c", "parentControlId": 31142, "controlId": "CM-11(03)", "title": "CM-11(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58337" }, { "id": 561478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fb86b69-7276-59ef-9427-ed9a12f90982", "parentControlId": 31142, "controlId": "CM-08(03)", "title": "CM-08(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58337" }, { "id": 561479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f747abec-b308-527e-ba45-dd21a8567a01", "parentControlId": 31142, "controlId": "CM-08(03)", "title": "CM-08(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58337" } ], "id": 31142, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730978", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730978", "catalogueId": 1062, "uuid": "0078bf2f-a87b-58ee-8c0b-36e8b2f2a010", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization configure systems to generate an alert when the unauthorized installation of software is detected?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Unauthorized Installation Alerts", "description": "

Control Description

Mechanisms exist to configure systems to generate an alert when the unauthorized installation of software is detected.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).\n▪ Secure baseline configurations generate logs that contain sufficient information to establish necessary details of activity and allow for forensics analysis.

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to configure systems to generate an alert when the unauthorized installation of software is detected.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CFG-05.1", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-05.1", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Windows Defender Application Control (WDAC)

Small Business (10-49 staff)

∙ Microsoft Windows Defender Application Control (WDAC)

Medium Business (50-249 staff)

∙ Microsoft Windows Defender Application Control (WDAC)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Large Business (250-999 staff)

∙ Microsoft Windows Defender Application Control (WDAC)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Enterprise (>1,000 staff)

∙ Microsoft Windows Defender Application Control (WDAC)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70337, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590193", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590193", "securityControlId": 31143, "ccis": [], "uuid": "e2e0691c-eb17-5038-bfff-52f8c9a09121", "testId": "CFG-05.2_A01", "test": "user installation of software is allowed only with explicit privileged status.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-11(02)", "defaultText": null } ], "externalMappings": [ { "id": 561504, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583373", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23cd645f-aa47-565a-9029-b6949495162e", "parentControlId": 31143, "controlId": "CM-11(2)", "title": "CM-11(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583373" }, { "id": 561505, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583373", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fc05d05-95e6-5076-8cde-05c6b052f52e", "parentControlId": 31143, "controlId": "CM-11(02)", "title": "CM-11(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583373" }, { "id": 561507, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583373", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3b700d3-5c90-5660-8154-d7ab57ae60da", "parentControlId": 31143, "controlId": "CM-11(02)", "title": "CM-11(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583373" } ], "id": 31143, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730978", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730978", "catalogueId": 1062, "uuid": "a24930e1-4d7d-5422-a1c6-06759671febc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization configure systems to prevent the installation of software, unless the action is performed by a privileged user or service?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Restrict Roles Permitted To Install Software", "description": "

Control Description

Mechanisms exist to configure systems to prevent the installation of software, unless the action is performed by a privileged user or service.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to configure systems to prevent the installation of software, unless the action is performed by a privileged user or service.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CFG-05.2", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-05.2", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70338, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590193", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590193", "securityControlId": 31144, "ccis": [], "uuid": "6c5320d3-38fc-573d-a3c0-53582f0b3e1d", "testId": "CFG-06_A01", "test": "the circumstances under which changes are to be prevented or restricted are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-03(08)_ODP", "defaultText": null }, { "id": 70339, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590193", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590193", "securityControlId": 31144, "ccis": [], "uuid": "f73992a3-3454-5cde-8e6e-942df7bc62a3", "testId": "CFG-06_A02", "test": "changes to the configuration of the system are prevented or restricted under organization-defined circumstances.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-03(08)", "defaultText": null }, { "id": 70340, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590193", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590193", "securityControlId": 31144, "ccis": [], "uuid": "3fad39c8-7525-5b88-99c2-5cf834605f6a", "testId": "CFG-06_A03", "test": "automated mechanisms used to enforce configuration enforcement are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-11(03)_ODP[01]", "defaultText": null }, { "id": 70341, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590193", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590193", "securityControlId": 31144, "ccis": [], "uuid": "67162f85-9edc-5b0e-b79e-a8363175313d", "testId": "CFG-06_A04", "test": "automated mechanisms used to monitor configuration enforcement are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-11(03)_ODP[02]", "defaultText": null }, { "id": 70342, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590194", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590194", "securityControlId": 31144, "ccis": [], "uuid": "278d3fa9-20f2-5de8-92e6-0a58c47232ec", "testId": "CFG-06_A05", "test": "compliance with software installation policies is enforced using automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CM-11(03)[01]", "defaultText": null }, { "id": 70343, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590194", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590194", "securityControlId": 31144, "ccis": [], "uuid": "3e6096d9-9cee-5d9f-8fbe-a5028afe66eb", "testId": "CFG-06_A06", "test": "compliance with software installation policies is monitored using automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CM-11(03)[02]", "defaultText": null } ], "externalMappings": [ { "id": 561529, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583385", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c10ea246-299d-592e-8e90-0d2b73134a1a", "parentControlId": 31144, "controlId": "CM-03(08)", "title": "CM-03(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583385" }, { "id": 561530, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583385", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "213791e8-34eb-5d46-a6ac-ae2f617ff5c4", "parentControlId": 31144, "controlId": "CM-11(03)", "title": "CM-11(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583385" }, { "id": 561532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583385", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d45e263d-779c-5914-9f1c-890f7f48c87c", "parentControlId": 31144, "controlId": "CM-03(08)", "title": "CM-03(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583385" }, { "id": 561533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583385", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9852327-3e73-5051-b77b-d277c1691e29", "parentControlId": 31144, "controlId": "CM-11(03)", "title": "CM-11(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583385" }, { "id": 561534, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583385", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "411316fe-12d5-5d08-b67a-13cc3d098a93", "parentControlId": 31144, "controlId": "CM-3(8)", "title": "CM-3(8)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583385" }, { "id": 561537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583385", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00858d91-2df9-56b8-985d-26bedaea3744", "parentControlId": 31144, "controlId": "03.04.02.a", "title": "03.04.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583385" }, { "id": 561538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583386", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c613e1e3-bbdd-55e2-b998-223842001a7a", "parentControlId": 31144, "controlId": "03.04.02.b", "title": "03.04.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583386" }, { "id": 561539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583386", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f4d117a-7348-5194-8077-a03270328e8b", "parentControlId": 31144, "controlId": "03.04.03.a", "title": "03.04.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583386" }, { "controlId": "NSS-17T-Sec6.4", "title": "NSS-17T-Sec6.4 — System Hardening & Baseline Configuration Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7b74fc01-1e0b-5e11-ad5a-a8ecaba4fadb", "isPublic": true }, { "controlId": "IEC-62645-7.2", "title": "IEC-62645-7.2 — I&C System Hardening and Least Functionality", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "fe2aea96-a370-51cc-9d14-9295d40818e6", "isPublic": true }, { "controlId": "IEC-63096-12.5", "title": "IEC-63096-12.5 — Control of Operational Software and Baseline Configurations", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "7e5a62b3-4835-5c5b-af0c-d519c00cbafe", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.5", "title": "IEEE-7-4.3.2-5.3.5 — Software Configuration Management in Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "163cbc9d-5c00-50d2-ba98-d35e5bf1696e", "isPublic": true } ], "id": 31144, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730978", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730978", "catalogueId": 1062, "uuid": "5b47d9ac-deb5-5c8e-9686-1ca83a2c1c1e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to monitor, enforce and report on configurations for endpoint devices?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 7.0, "title": "Configuration Enforcement", "description": "

Control Description

Automated mechanisms exist to monitor, enforce and report on configurations for endpoint devices.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically monitor, enforce and report on configurations for endpoint devices.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "CFG-06", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-06", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Windows Defender Application Control (WDAC)

Small Business (10-49 staff)

∙ Microsoft Windows Defender Application Control (WDAC)

Medium Business (50-249 staff)

∙ Microsoft Windows Defender Application Control (WDAC)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Large Business (250-999 staff)

∙ Microsoft Windows Defender Application Control (WDAC)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Enterprise (>1,000 staff)

∙ Microsoft Windows Defender Application Control (WDAC)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70344, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590194", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590194", "securityControlId": 31145, "ccis": [], "uuid": "5be9e5ef-89a2-5f4f-8674-966deab80189", "testId": "CFG-06.1_A01", "test": "unauthorized deviations from an approved baseline are identified and automated resiliency actions are implemented to remediate the unauthorized change.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 561568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583389", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a8f5c12-537a-5271-8457-b0fa22fddc9a", "parentControlId": 31145, "controlId": "HDR 3.11(1)", "title": "HDR 3.11(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583389" }, { "id": 561569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58339", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2e1a302-bda3-5137-b01e-5079472e178d", "parentControlId": 31145, "controlId": "NDR 3.11(1)", "title": "NDR 3.11(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58339" }, { "id": 561570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58339", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "776d6995-5fe6-5a5e-a6f7-bc29ff23368d", "parentControlId": 31145, "controlId": "CM-03(08)", "title": "CM-03(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58339" }, { "id": 561571, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58339", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b49c69b3-7cf6-5815-971f-640cfd26635d", "parentControlId": 31145, "controlId": "CM-11(03)", "title": "CM-11(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58339" }, { "id": 561573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58339", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e17d04c-19d4-5c9e-a28f-db9d7ac8a31d", "parentControlId": 31145, "controlId": "CM-03(08)", "title": "CM-03(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58339" }, { "id": 561574, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58339", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19f396c7-8a43-5563-beb8-8b630f966a66", "parentControlId": 31145, "controlId": "CM-11(03)", "title": "CM-11(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58339" } ], "id": 31145, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730979", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730979", "catalogueId": 1062, "uuid": "aa973eeb-ac9d-5b7a-af14-1212d2de9497", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to identify unauthorized deviations from an approved baseline and implement automated resiliency actions to remediate the unauthorized change?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 3.0, "title": "Integrity Assurance & Enforcement (IAE)", "description": "

Control Description

Automated mechanisms exist to identify unauthorized deviations from an approved baseline and implement automated resiliency actions to remediate the unauthorized change.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically identify unauthorized deviations from an approved baseline and implement automated resiliency actions to remediate the unauthorized change.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CFG-06.1", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-06.1", "references": "

Micro-Small Business (<10 staff)

∙ Document baseline configurations for key systems

Small Business (10-49 staff)

∙ Configuration baseline documentation\n∙ CIS Benchmark hardening guides

Medium Business (50-249 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Large Business (250-999 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Enterprise (>1,000 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70345, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590194", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590194", "securityControlId": 31146, "ccis": [], "uuid": "48851d8b-e59f-511b-b441-2c2b46f920fb", "testId": "CFG-07_A01", "test": "automated mechanisms used to perform Zero-Touch Provisioning (ZTP) are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70346, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590195", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590195", "securityControlId": 31146, "ccis": [], "uuid": "f858e631-c82d-5396-8123-b130316cd05f", "testId": "CFG-07_A02", "test": "an automated mechanism performs Zero-Touch Provisioning (ZTP) to deploy secure baseline configurations upon devices being added to a network.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 561595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa03ac60-d0b6-5785-ad19-521a6587302b", "parentControlId": 31146, "controlId": "HDR 3.13(b)", "title": "HDR 3.13(b)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583393" }, { "controlId": "NSS-17T-Sec6.4", "title": "NSS-17T-Sec6.4 — System Hardening & Baseline Configuration Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b565f7b5-34d3-5e61-b19e-d3b22fb9907d", "isPublic": true }, { "controlId": "IEC-62645-7.2", "title": "IEC-62645-7.2 — I&C System Hardening and Least Functionality", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "7318f415-4fe2-5e3c-a925-4f030fe07214", "isPublic": true }, { "controlId": "IEC-63096-12.5", "title": "IEC-63096-12.5 — Control of Operational Software and Baseline Configurations", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "1af3a96c-a949-5aff-97ba-6fa61b2229d5", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.5", "title": "IEEE-7-4.3.2-5.3.5 — Software Configuration Management in Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "5d47466a-5d00-5079-8fe7-b808f549dca4", "isPublic": true } ], "id": 31146, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730979", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730979", "catalogueId": 1062, "uuid": "609d4b83-239b-5973-af86-3ca783081192", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement Zero-Touch Provisioning (ZTP), or similar technology, to automatically and securely configure devices upon being added to a network?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Zero-Touch Provisioning (ZTP)", "description": "

Control Description

Mechanisms exist to implement Zero-Touch Provisioning (ZTP), or similar technology, to automatically and securely configure devices upon being added to a network.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement Zero-Touch Provisioning (ZTP), or similar technology, to automatically and securely configure devices upon being added to a network.

Level 4 - Quantitatively Controlled: Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CFG-07", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-07", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70347, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590195", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590195", "securityControlId": 31147, "ccis": [], "uuid": "4968a3a3-1a26-5bcb-9a28-5ad068402416", "testId": "CFG-08_A01", "test": "information types requiring restricted access to data repositories are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-03(11)_ODP", "defaultText": null }, { "id": 70348, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590195", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590195", "securityControlId": 31147, "ccis": [], "uuid": "425227ec-3aa6-5bf3-9efd-6fef83a34c2f", "testId": "CFG-08_A02", "test": "access to data repositories containing organization-defined information types is restricted.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-03(11)", "defaultText": null }, { "id": 70349, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590195", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590195", "securityControlId": 31147, "ccis": [], "uuid": "856fbc31-965f-5340-a11c-c74110db44d3", "testId": "CFG-08_A03", "test": "approved authorizations for logical access to CUI are enforced in accordance with applicable access control policies.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.01.02[01]", "defaultText": null } ], "externalMappings": [ { "id": 561596, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24c224dd-662e-59ee-ac7b-96ed0e6ed9f4", "parentControlId": 31147, "controlId": "AC-03(11)", "title": "AC-03(11)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583393" }, { "id": 561599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29b80a32-6507-5907-bb48-c5a1e2c52ee6", "parentControlId": 31147, "controlId": "AC-03(11)", "title": "AC-03(11)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583393" }, { "id": 561600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a838c76-2d20-522a-8023-f841bd78149b", "parentControlId": 31147, "controlId": "AC-03(11)", "title": "AC-03(11)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583393" }, { "id": 561602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a4a74d5-de79-50e7-addb-26b987721fd2", "parentControlId": 31147, "controlId": "03.01.02", "title": "03.01.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583394" }, { "controlId": "NSS-17T-Sec6.4", "title": "NSS-17T-Sec6.4 — System Hardening & Baseline Configuration Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "aa60d1b1-159a-5bf3-8dd6-064af950a1a6", "isPublic": true }, { "controlId": "IEC-62645-7.2", "title": "IEC-62645-7.2 — I&C System Hardening and Least Functionality", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "c36a6b84-6bdf-5e06-8195-3fc6259c3b3e", "isPublic": true }, { "controlId": "IEC-63096-12.5", "title": "IEC-63096-12.5 — Control of Operational Software and Baseline Configurations", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "bc603795-e871-500b-8b5f-3a68b8c96436", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.5", "title": "IEEE-7-4.3.2-5.3.5 — Software Configuration Management in Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CFG Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "5d179ece-2e62-5b8f-b03b-2bb8a4aa20b7", "isPublic": true } ], "id": 31147, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73098", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73098", "catalogueId": 1062, "uuid": "95163232-ae25-5385-b9b6-bc5ecbbe823d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization configure Technology Assets, Applications and/or Services (TAAS) to restrict access to sensitive/regulated data?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Sensitive / Regulated Data Access Enforcement", "description": "

Control Description

Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to restrict access to sensitive/regulated data.

Evidence Request List (ERL)

E-DCH-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to configure Technology Assets, Applications and/or Services (TAAS) to restrict access to sensitive/regulated data.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CFG-08", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-08", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70350, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590195", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590195", "securityControlId": 31148, "ccis": [], "uuid": "982058ab-2a36-5de5-be47-6551ac423136", "testId": "CFG-08.1_A01", "test": "an automated mechanism generates event logs whenever sensitive / regulated data is collected, created, updated, deleted and/or archived.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 561613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583395", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7201ed68-9147-58ea-8f3b-89b7b3ff0759", "parentControlId": 31148, "controlId": "DM-2(1)", "title": "DM-2(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583395" } ], "id": 31148, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73098", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73098", "catalogueId": 1062, "uuid": "41ede8b4-99eb-5d5d-970e-8a408c9cb244", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to generate event logs whenever sensitive/regulated data is collected, created, updated, deleted and/or archived?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 7.0, "title": "Sensitive / Regulated Data Actions", "description": "

Control Description

Automated mechanisms exist to generate event logs whenever sensitive/regulated data is collected, created, updated, deleted and/or archived.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 2 - Planned & Tracked: Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 3 - Well Defined: Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.\n▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically generate event logs whenever sensitive/regulated data is collected, created, updated, deleted and/or archived.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CFG-08.1", "family": "Configuration Management", "enhancements": "", "sortId": "CFG-08.1", "references": "

Micro-Small Business (<10 staff)

∙ Document baseline configurations for key systems

Small Business (10-49 staff)

∙ Configuration baseline documentation\n∙ CIS Benchmark hardening guides

Medium Business (50-249 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Large Business (250-999 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Enterprise (>1,000 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70351, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590196", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590196", "securityControlId": 31149, "ccis": [], "uuid": "1a23695a-0756-5b70-bf04-f835a68ff705", "testId": "MON-01_A01", "test": "the continuous monitoring program is organization-wide.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-01_ODP[03]", "defaultText": null }, { "id": 70352, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590196", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590196", "securityControlId": 31149, "ccis": [], "uuid": "bea7aea6-c9f7-5795-bbd8-8e774701bcab", "testId": "MON-01_A02", "test": "monitoring objectives to detect attacks and indicators of potential attacks on the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04_ODP[01]", "defaultText": null }, { "id": 70353, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590196", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590196", "securityControlId": 31149, "ccis": [], "uuid": "a9a8bf51-cf33-50d5-9206-4b6fa3b256a7", "testId": "MON-01_A03", "test": "techniques and methods used to identify unauthorized use of the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04_ODP[02]", "defaultText": null }, { "id": 70354, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590196", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590196", "securityControlId": 31149, "ccis": [], "uuid": "eb49011e-e9d4-59f0-a1b1-2d807cd112a8", "testId": "MON-01_A04", "test": "system monitoring information to be provided to personnel or roles is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-04_ODP[03]\n53A_R5_SI-04g.", "defaultText": null }, { "id": 70355, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590196", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590196", "securityControlId": 31149, "ccis": [], "uuid": "85ffc400-092c-58b1-b06f-24c889d95b9c", "testId": "MON-01_A05", "test": "personnel or roles to whom system monitoring information is to be provided is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-04_ODP[04]", "defaultText": null }, { "id": 70356, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590196", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590196", "securityControlId": 31149, "ccis": [], "uuid": "cdd16b8d-acc9-5902-b2c2-545e1fff47de", "testId": "MON-01_A06", "test": "a frequency for providing system monitoring to personnel or roles is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-04_ODP[05]\n53A_R5_SI-04_ODP[06]", "defaultText": null }, { "id": 70357, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590197", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590197", "securityControlId": 31149, "ccis": [], "uuid": "1a752581-e344-5e8f-b1de-eca4b24ef8b3", "testId": "MON-01_A07", "test": "the level of system monitoring activity is adjusted when there is a change in risk to organizational operations and assets, individuals, other organizations or the Nation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-04e.", "defaultText": null }, { "id": 70358, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590197", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590197", "securityControlId": 31149, "ccis": [], "uuid": "8b799598-a684-5cc9-a970-fb7c09a4ea96", "testId": "MON-01_A08", "test": "a legal opinion regarding system monitoring activities is obtained.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-04f.", "defaultText": null }, { "id": 70359, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590197", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590197", "securityControlId": 31149, "ccis": [], "uuid": "4d046d77-7f9b-5ca6-9a3f-395253aee22b", "testId": "MON-01_A09", "test": "the system is monitored to detect attacks.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.14.06.a.01[01]", "defaultText": null }, { "id": 70360, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590197", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590197", "securityControlId": 31149, "ccis": [], "uuid": "d31f00bb-2cec-5843-a075-354541a84ce6", "testId": "MON-01_A10", "test": "the system is monitored to detect indicators of potential attacks.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.14.06.a.01[02]", "defaultText": null }, { "id": 70361, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590197", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590197", "securityControlId": 31149, "ccis": [], "uuid": "3c14b679-e224-54c8-8aaf-ceb10bc268ad", "testId": "MON-01_A11", "test": "the system is monitored to detect unauthorized connections.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.14.06.a.02", "defaultText": null }, { "id": 70362, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590198", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590198", "securityControlId": 31149, "ccis": [], "uuid": "5c1fb3ab-48f5-5bad-af2e-01ecae5ee01c", "testId": "MON-01_A12", "test": "event monitoring operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70363, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590198", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590198", "securityControlId": 31149, "ccis": [], "uuid": "a09c915a-599c-52b7-bdad-a6c3e5c32b05", "testId": "MON-01_A13", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support event monitoring operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70364, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590198", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590198", "securityControlId": 31149, "ccis": [], "uuid": "7b6d9c65-22bb-5f94-8e98-b9348f0a19cf", "testId": "MON-01_A14", "test": "responsibility and authority for the performance of event monitoring-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70365, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590198", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590198", "securityControlId": 31149, "ccis": [], "uuid": "5c1de24b-e341-5cb1-b9cf-81138982bcca", "testId": "MON-01_A15", "test": "personnel performing event monitoring-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 561650, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583399", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20c23329-deb5-5931-97dc-b03b51764299", "parentControlId": 31149, "controlId": "SR 6.2", "title": "SR 6.2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583399" }, { "id": 561651, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5834", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4dab9930-351a-55ef-b7f8-f17f1430bd99", "parentControlId": 31149, "controlId": "CR 6.2", "title": "CR 6.2", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5834" }, { "id": 561652, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5834", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b131c0bb-5917-52d2-b32a-e7333103726e", "parentControlId": 31149, "controlId": "8.15", "title": "8.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5834" }, { "id": 561653, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5834", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4cedf13-f464-53ac-8f17-c959aa4f9434", "parentControlId": 31149, "controlId": "8.16", "title": "8.16", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5834" }, { "id": 561657, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5834", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e827385-2140-5f3c-9b9e-2e20ff0ac9f3", "parentControlId": 31149, "controlId": "T1001", "title": "T1001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5834" }, { "id": 561658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5834", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58f30817-8d20-5aca-8868-056d6abae99b", "parentControlId": 31149, "controlId": "T1001.001", "title": "T1001.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5834" }, { "id": 561659, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5834", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e667878-5dc9-5205-a284-b535e8e8934b", "parentControlId": 31149, "controlId": "T1001.002", "title": "T1001.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5834" }, { "id": 561660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3927ca9-b9d5-5c56-813e-1f7f4e84b854", "parentControlId": 31149, "controlId": "T1001.003", "title": "T1001.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583401" }, { "id": 561661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d4efa04-ae7d-53a7-a591-a98931cb0363", "parentControlId": 31149, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583401" }, { "id": 561662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a58faaa9-b5dc-5c5e-b022-0cfaf66c7149", "parentControlId": 31149, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583401" }, { "id": 561663, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a859a18f-485b-5d33-98c7-998f8ee6e1d6", "parentControlId": 31149, "controlId": "T1003.002", "title": "T1003.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583401" }, { "id": 561664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc609080-d16d-56d0-b8ed-2b050e7af0da", "parentControlId": 31149, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583401" }, { "id": 561665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6005d9dd-c0d7-5063-aab7-b8bf573f0c74", "parentControlId": 31149, "controlId": "T1003.004", "title": "T1003.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583401" }, { "id": 561666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6694c73-70f0-5ed8-ac4e-0e152bbfd452", "parentControlId": 31149, "controlId": "T1003.005", "title": "T1003.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583401" }, { "id": 561667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c62f887-81d3-55b0-bd43-3a5010f2a8ce", "parentControlId": 31149, "controlId": "T1003.006", "title": "T1003.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583401" }, { "id": 561668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "790b551d-0d35-53af-9990-246574294b40", "parentControlId": 31149, "controlId": "T1003.007", "title": "T1003.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583402" }, { "id": 561669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583402", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2f52a60-97b3-562a-bfb8-ac800d452080", "parentControlId": 31149, "controlId": "T1003.008", "title": "T1003.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583402" }, { "id": 561670, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583402", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1f90cb7-9af7-5c17-99c1-1c7dd1d98b58", "parentControlId": 31149, "controlId": "T1005", "title": "T1005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583402" }, { "id": 561671, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583402", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55b74178-8a50-5969-b93b-f145ce24173d", "parentControlId": 31149, "controlId": "T1008", "title": "T1008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583402" }, { "id": 561672, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583402", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8685fae-d152-5452-af44-8fcb289de884", "parentControlId": 31149, "controlId": "T1011", "title": "T1011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583402" }, { "id": 561673, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583402", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40e5ad97-504d-59ea-b173-74e5a1c0f704", "parentControlId": 31149, "controlId": "T1011.001", "title": "T1011.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583402" }, { "id": 561674, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583402", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94882020-ae7c-5178-a2ee-81b613787a20", "parentControlId": 31149, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583402" }, { "id": 561675, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583402", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40f3f5f4-fc57-50c5-8579-8996571bb284", "parentControlId": 31149, "controlId": "T1021", "title": "T1021", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583402" }, { "id": 561676, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583402", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7da57864-7e51-51a6-95b6-c15946ee143d", "parentControlId": 31149, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583402" }, { "id": 561677, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583402", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5ed637a-fe6c-5c30-afd6-ff182765b6bd", "parentControlId": 31149, "controlId": "T1021.002", "title": "T1021.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583402" }, { "id": 561678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583403", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc4e1a4b-f4d7-5f17-84e7-c5b70036040f", "parentControlId": 31149, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583403" }, { "id": 561679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583403", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b44a6e06-ab5b-5cb5-a1b6-fc7110eee3a8", "parentControlId": 31149, "controlId": "T1021.004", "title": "T1021.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583403" }, { "id": 561680, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583403", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6889f6e-5ad1-5ab4-8038-932fed0d4c70", "parentControlId": 31149, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583403" }, { "id": 561681, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583403", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b575b091-5085-5c4c-8df3-6a22cb83f770", "parentControlId": 31149, "controlId": "T1021.006", "title": "T1021.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583403" }, { "id": 561682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583403", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ef2cdf3-eb8f-520c-acf9-d69bafb89481", "parentControlId": 31149, "controlId": "T1021.008", "title": "T1021.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583403" }, { "id": 561683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583403", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8aab4ab5-4e2a-580a-b04a-7aba953da110", "parentControlId": 31149, "controlId": "T1025", "title": "T1025", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583403" }, { "id": 561684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583403", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0958b85-b18f-5d88-931b-0ff3033fbd99", "parentControlId": 31149, "controlId": "T1027", "title": "T1027", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583403" }, { "id": 561685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583403", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25418a9d-47cd-588e-b2bf-d0c0fd79630a", "parentControlId": 31149, "controlId": "T1027.002", "title": "T1027.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583403" }, { "id": 561686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e580f48-8f22-5181-b84e-b96d4d3c78b2", "parentControlId": 31149, "controlId": "T1027.007", "title": "T1027.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583404" }, { "id": 561687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3086c7d1-a5f9-5e88-8850-5f403e70d5d0", "parentControlId": 31149, "controlId": "T1027.008", "title": "T1027.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583404" }, { "id": 561688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3359dbf7-dad5-52c2-9aef-2dd4744923e1", "parentControlId": 31149, "controlId": "T1027.009", "title": "T1027.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583404" }, { "id": 561689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8e8cac2-ccaf-5c34-85c0-eaf9895c1472", "parentControlId": 31149, "controlId": "T1027.010", "title": "T1027.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583404" }, { "id": 561690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ff5f063-f137-5a2f-866b-ec4c8671e0b0", "parentControlId": 31149, "controlId": "T1027.011", "title": "T1027.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583404" }, { "id": 561691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c129fe86-adfe-5637-bd5a-b73d12fdf68c", "parentControlId": 31149, "controlId": "T1027.012", "title": "T1027.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583405" }, { "id": 561692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2830571f-17f3-507b-b105-e2d182f7eba4", "parentControlId": 31149, "controlId": "T1029", "title": "T1029", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583405" }, { "id": 561693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50d6cd5c-3ae5-5cdd-ba72-7723fbe4bf3a", "parentControlId": 31149, "controlId": "T1030", "title": "T1030", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583405" }, { "id": 561694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5a68429-a08b-5088-a2a9-ad646baa254d", "parentControlId": 31149, "controlId": "T1036", "title": "T1036", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583405" }, { "id": 561695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03b358a2-b5e1-5365-806a-1a377ba8dbd5", "parentControlId": 31149, "controlId": "T1036.001", "title": "T1036.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583405" }, { "id": 561696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e495a97-3ad9-5eba-b153-6b037db28392", "parentControlId": 31149, "controlId": "T1036.003", "title": "T1036.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583405" }, { "id": 561697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3972ebbd-6238-524b-ad45-02bff47c0125", "parentControlId": 31149, "controlId": "T1036.005", "title": "T1036.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583405" }, { "id": 561698, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec6c30af-3608-53ca-8293-1af1ec1c8a82", "parentControlId": 31149, "controlId": "T1036.007", "title": "T1036.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583405" }, { "id": 561699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbd49987-08d1-53c8-b943-0188daa7089c", "parentControlId": 31149, "controlId": "T1036.008", "title": "T1036.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583405" }, { "id": 561700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55f153e7-6c4b-59ae-9052-461786c17745", "parentControlId": 31149, "controlId": "T1036.010", "title": "T1036.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583405" }, { "id": 561701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68bd2832-e05c-51d9-8cf7-0659eb19f329", "parentControlId": 31149, "controlId": "T1037", "title": "T1037", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583406" }, { "id": 561702, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d13d209-7a39-5bb9-b664-ae8ea432bf57", "parentControlId": 31149, "controlId": "T1037.002", "title": "T1037.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583406" }, { "id": 561703, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bef71c7-13e1-5813-afb8-79fcefa0694b", "parentControlId": 31149, "controlId": "T1037.003", "title": "T1037.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583406" }, { "id": 561704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91ed126e-36ea-532b-a545-4c712953dff7", "parentControlId": 31149, "controlId": "T1037.004", "title": "T1037.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583406" }, { "id": 561705, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a216ea7-1a24-59d2-9652-966b013fd803", "parentControlId": 31149, "controlId": "T1037.005", "title": "T1037.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583406" }, { "id": 561706, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c196731d-0f8c-58c4-ad27-d424a7d2fcbf", "parentControlId": 31149, "controlId": "T1040", "title": "T1040", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583406" }, { "id": 561707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c196993f-2510-5976-b797-6041045772a2", "parentControlId": 31149, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583406" }, { "id": 561708, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f80a39b5-ce37-53b4-aa8a-13201021aa9c", "parentControlId": 31149, "controlId": "T1046", "title": "T1046", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583406" }, { "id": 561709, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "381f21b6-7803-53c1-875b-52f9d0d4ebc6", "parentControlId": 31149, "controlId": "T1047", "title": "T1047", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583406" }, { "id": 561710, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c96f5672-de1e-5d65-9bd9-92c5de4ab069", "parentControlId": 31149, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583407" }, { "id": 561711, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef328fc8-74cc-5abf-856a-c0d8d8aad3c0", "parentControlId": 31149, "controlId": "T1048.001", "title": "T1048.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583407" }, { "id": 561712, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0b1f888-e741-5081-99d9-f2c589ba9dd7", "parentControlId": 31149, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583407" }, { "id": 561713, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ca48925-e430-502b-95c5-483767069b60", "parentControlId": 31149, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583407" }, { "id": 561714, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65128e15-5f92-5668-ac3a-82e2d54b29c6", "parentControlId": 31149, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583407" }, { "id": 561715, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41586ea9-5b35-5a3a-9acd-b3ba7073363d", "parentControlId": 31149, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583407" }, { "id": 561716, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f7c2c86-8772-58e9-8150-65f0265f5a04", "parentControlId": 31149, "controlId": "T1053", "title": "T1053", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583407" }, { "id": 561717, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40a5f23f-6a95-5f92-93ef-faae978c4d15", "parentControlId": 31149, "controlId": "T1053.002", "title": "T1053.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583408" }, { "id": 561718, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c66ac31a-8b4f-5cde-83f8-daa544fcae12", "parentControlId": 31149, "controlId": "T1053.003", "title": "T1053.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583408" }, { "id": 561719, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb21ecee-d500-54f1-8aae-1b86f78cd759", "parentControlId": 31149, "controlId": "T1053.005", "title": "T1053.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583408" }, { "id": 561720, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "432cc202-ad88-5d2a-8231-711884dd2cf4", "parentControlId": 31149, "controlId": "T1053.006", "title": "T1053.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583408" }, { "id": 561721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2e13233-dd62-53ac-81ec-9f14dc0f6d20", "parentControlId": 31149, "controlId": "T1055", "title": "T1055", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583408" }, { "id": 561722, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb265b1c-17bd-5aac-a1cf-02b4945e77b3", "parentControlId": 31149, "controlId": "T1055.001", "title": "T1055.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583408" }, { "id": 561723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "933bd5e0-51f9-5427-89c7-b86650e0c091", "parentControlId": 31149, "controlId": "T1055.002", "title": "T1055.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583408" }, { "id": 561724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a508ca2-0f79-5f8c-adfd-1f6eeb34598c", "parentControlId": 31149, "controlId": "T1055.003", "title": "T1055.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583408" }, { "id": 561725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc968607-79ca-5960-890e-60edc66772bf", "parentControlId": 31149, "controlId": "T1055.004", "title": "T1055.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583409" }, { "id": 561726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "befdbc2a-e850-5b65-a2a3-25b2ccd10140", "parentControlId": 31149, "controlId": "T1055.005", "title": "T1055.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583409" }, { "id": 561727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d9ef62b-66e7-5e57-a200-8693c8e1220d", "parentControlId": 31149, "controlId": "T1055.008", "title": "T1055.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583409" }, { "id": 561728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a54d5de-8640-5258-a044-27bc5488cd6a", "parentControlId": 31149, "controlId": "T1055.009", "title": "T1055.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583409" }, { "id": 561729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85a6eb96-882c-5928-803f-783b908228ed", "parentControlId": 31149, "controlId": "T1055.011", "title": "T1055.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583409" }, { "id": 561730, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b05150d-a6d6-5ea9-90e1-33349c11c9bc", "parentControlId": 31149, "controlId": "T1055.012", "title": "T1055.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583409" }, { "id": 561731, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98cac007-e42e-5aac-9aef-9b2b6fb6c25a", "parentControlId": 31149, "controlId": "T1055.013", "title": "T1055.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583409" }, { "id": 561732, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c402c45-5b26-58e6-947a-f6644f84a131", "parentControlId": 31149, "controlId": "T1055.014", "title": "T1055.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583409" }, { "id": 561733, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "518c2eb6-3a67-5084-9bf6-5df4aba84f9e", "parentControlId": 31149, "controlId": "T1056.002", "title": "T1056.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583409" }, { "id": 561734, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58341", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c30c3474-558d-56d3-b7b8-27e3619ce573", "parentControlId": 31149, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58341" }, { "id": 561735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58341", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aea10f69-5787-5ae0-8337-d54de7587cfd", "parentControlId": 31149, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58341" }, { "id": 561736, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58341", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53918856-fdde-50cc-95f6-e89a3d8e145f", "parentControlId": 31149, "controlId": "T1059.002", "title": "T1059.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58341" }, { "id": 561737, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58341", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e6e9e51-7a3f-5630-9144-29bc6d09ade6", "parentControlId": 31149, "controlId": "T1059.003", "title": "T1059.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58341" }, { "id": 561738, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58341", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "237e1dae-3b14-59bd-8ddd-6b1e332146e0", "parentControlId": 31149, "controlId": "T1059.004", "title": "T1059.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58341" }, { "id": 561739, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58341", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "932e7533-4f2a-556c-bc4d-44513991475d", "parentControlId": 31149, "controlId": "T1059.005", "title": "T1059.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58341" }, { "id": 561740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58341", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0af8f20e-79ce-5a31-b2b3-d7497c0bfec8", "parentControlId": 31149, "controlId": "T1059.006", "title": "T1059.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58341" }, { "id": 561741, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58341", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf3cde2d-01ba-503c-9337-7dc9f011fb00", "parentControlId": 31149, "controlId": "T1059.007", "title": "T1059.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58341" }, { "id": 561742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b873b2f-a2a2-5d92-84e6-40b339909140", "parentControlId": 31149, "controlId": "T1059.008", "title": "T1059.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583411" }, { "id": 561743, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4eca31f2-26ee-521b-b47e-5519b71e687f", "parentControlId": 31149, "controlId": "T1059.009", "title": "T1059.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583411" }, { "id": 561744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5e47ee3-f638-527e-8394-6c3fa4cec7f9", "parentControlId": 31149, "controlId": "T1059.010", "title": "T1059.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583411" }, { "id": 561745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20c90690-bd22-541b-b300-8e45500d197c", "parentControlId": 31149, "controlId": "T1059.011", "title": "T1059.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583411" }, { "id": 561746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae3992d0-fb41-52fc-8a56-28fef9a0f3e0", "parentControlId": 31149, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583411" }, { "id": 561747, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74edd45e-5a48-5969-9cef-20150cdacdf0", "parentControlId": 31149, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583411" }, { "id": 561748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e93fc954-34b6-5ebd-9ac7-92eb090692af", "parentControlId": 31149, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583411" }, { "id": 561749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6759e37-ebd0-5dc9-888c-97d8feb7cf5f", "parentControlId": 31149, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583411" }, { "id": 561750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a07a642-360f-5a77-8e74-b89d0a71be4e", "parentControlId": 31149, "controlId": "T1070.003", "title": "T1070.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583411" }, { "id": 561751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7949ae26-5472-5ae0-aed9-a433af6612cc", "parentControlId": 31149, "controlId": "T1070.007", "title": "T1070.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583411" }, { "id": 561752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5f5c27a-3bae-5ddf-909a-a4461933a615", "parentControlId": 31149, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583412" }, { "id": 561753, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d52b3367-eda8-5b99-bc53-f14712f92e8a", "parentControlId": 31149, "controlId": "T1070.009", "title": "T1070.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583412" }, { "id": 561754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd704bd1-081e-5228-a872-17b327f60451", "parentControlId": 31149, "controlId": "T1070.010", "title": "T1070.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583412" }, { "id": 561755, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2c2dad3-6c2e-5415-b12d-727be125363f", "parentControlId": 31149, "controlId": "T1071", "title": "T1071", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583412" }, { "id": 561756, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76642f3a-f4e8-5d41-8572-20afd4047c70", "parentControlId": 31149, "controlId": "T1071.001", "title": "T1071.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583412" }, { "id": 561757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b11aff05-6b30-5773-9ddf-bcfb67e2b652", "parentControlId": 31149, "controlId": "T1071.002", "title": "T1071.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583412" }, { "id": 561758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6aa686e2-8f0a-5310-a596-f0a6a630a65f", "parentControlId": 31149, "controlId": "T1071.003", "title": "T1071.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583412" }, { "id": 561759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7989169b-e0c9-5cf7-a76e-aec3c08257ff", "parentControlId": 31149, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583412" }, { "id": 561760, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9cf8bde5-ede3-5f53-a13e-8a3be0bc654c", "parentControlId": 31149, "controlId": "T1071.005", "title": "T1071.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583412" }, { "id": 561761, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583413", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2c4ae14-e95c-5b76-a608-1b5b8b20cdb5", "parentControlId": 31149, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583413" }, { "id": 561762, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583413", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5fdf0564-5d46-52b5-a969-1f4260fd7418", "parentControlId": 31149, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583413" }, { "id": 561763, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583413", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09c8ea64-8205-504e-8bc5-bc00c164dab9", "parentControlId": 31149, "controlId": "T1078.001", "title": "T1078.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583413" }, { "id": 561764, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583413", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5927d7c3-ad7e-570c-b89d-07ac4ec2e2f3", "parentControlId": 31149, "controlId": "T1078.002", "title": "T1078.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583413" }, { "id": 561765, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583413", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0974fefe-0f95-52cb-8592-ba14a990e459", "parentControlId": 31149, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583413" }, { "id": 561766, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583413", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eacc5ff5-d80c-59b8-b9d0-d90844aa65c0", "parentControlId": 31149, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583413" }, { "id": 561767, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583413", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58ece804-bfdb-5277-b72d-d7d1b26b98c6", "parentControlId": 31149, "controlId": "T1080", "title": "T1080", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583413" }, { "id": 561768, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "416ba1f8-ee33-5797-b9ef-78f1b7697d31", "parentControlId": 31149, "controlId": "T1087", "title": "T1087", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583414" }, { "id": 561769, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9946eb28-1cad-5d0e-a907-a0019d231f99", "parentControlId": 31149, "controlId": "T1087.001", "title": "T1087.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583414" }, { "id": 561770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00b63b2a-f091-50a0-bc8c-fb58cf497139", "parentControlId": 31149, "controlId": "T1087.002", "title": "T1087.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583414" }, { "id": 561771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b61a7a6d-0dd0-5874-87eb-3941d606d402", "parentControlId": 31149, "controlId": "T1090", "title": "T1090", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583414" }, { "id": 561772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c733340b-a061-5663-91d7-0061f53125ec", "parentControlId": 31149, "controlId": "T1090.001", "title": "T1090.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583414" }, { "id": 561773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ce04b1a-7695-5692-98b5-f39634a52a0a", "parentControlId": 31149, "controlId": "T1090.002", "title": "T1090.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583414" }, { "id": 561774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "771f48e8-196e-5a60-bd00-988e575191bf", "parentControlId": 31149, "controlId": "T1091", "title": "T1091", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583414" }, { "id": 561775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3408a2ba-b503-54ae-bb32-f8d7c5ab88d5", "parentControlId": 31149, "controlId": "T1092", "title": "T1092", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583414" }, { "id": 561776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a9282d8-98ff-5273-b6cb-76c6dc9b5d2d", "parentControlId": 31149, "controlId": "T1095", "title": "T1095", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583414" }, { "id": 561777, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43d8578c-2f25-5077-a664-bfc9f488a07e", "parentControlId": 31149, "controlId": "T1098", "title": "T1098", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583415" }, { "id": 561778, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5a7fa5c-3bab-541d-b2b1-3ace47626dcf", "parentControlId": 31149, "controlId": "T1098.001", "title": "T1098.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583415" }, { "id": 561779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b5d3b60-8a9c-5f3e-82f4-65cd635f3c97", "parentControlId": 31149, "controlId": "T1098.002", "title": "T1098.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583415" }, { "id": 561780, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a4328a4-cfed-5d38-bfb9-ef7f1b8d3e15", "parentControlId": 31149, "controlId": "T1098.003", "title": "T1098.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583415" }, { "id": 561781, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f1a0895-2eb5-54fb-90aa-9ce4718d9d3e", "parentControlId": 31149, "controlId": "T1098.004", "title": "T1098.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583415" }, { "id": 561782, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca4741cb-b3e3-5fd3-9ded-ba4489ae7c6e", "parentControlId": 31149, "controlId": "T1098.007", "title": "T1098.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583415" }, { "id": 561783, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0f56a1d-98fc-51a5-b0fc-bb7bc1033871", "parentControlId": 31149, "controlId": "T1102", "title": "T1102", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583415" }, { "id": 561784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1d7b1e3-2870-5106-a125-1d7dac386960", "parentControlId": 31149, "controlId": "T1102.001", "title": "T1102.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583415" }, { "id": 561785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2489309-0e2b-593c-a9e5-4547c86224c7", "parentControlId": 31149, "controlId": "T1102.002", "title": "T1102.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583415" }, { "id": 561786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5c54061-a1e3-564a-9df7-a0c0feb87141", "parentControlId": 31149, "controlId": "T1102.003", "title": "T1102.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583416" }, { "id": 561787, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b90afd7-55bc-52d1-848c-73f0322078f0", "parentControlId": 31149, "controlId": "T1104", "title": "T1104", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583416" }, { "id": 561788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6517ef7-55d1-5a1e-9864-2460ffed0853", "parentControlId": 31149, "controlId": "T1105", "title": "T1105", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583416" }, { "id": 561789, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33f2f3c5-8338-52d4-a8c0-c272689f0e5e", "parentControlId": 31149, "controlId": "T1106", "title": "T1106", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583416" }, { "id": 561790, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60407c2d-dfc4-51a2-930f-948b1f371f6e", "parentControlId": 31149, "controlId": "T1110", "title": "T1110", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583416" }, { "id": 561791, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb15c232-3b60-5581-94a4-c4b16cac7570", "parentControlId": 31149, "controlId": "T1110.001", "title": "T1110.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583416" }, { "id": 561792, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e5f12ec-7317-51bf-b11e-6b4f083c7fc7", "parentControlId": 31149, "controlId": "T1110.002", "title": "T1110.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583416" }, { "id": 561793, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583417", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "676196a9-5981-5b99-94b6-ca978cb10d2b", "parentControlId": 31149, "controlId": "T1110.003", "title": "T1110.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583417" }, { "id": 561794, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583417", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12e4dafc-cb71-5e44-8b39-683210ccc60b", "parentControlId": 31149, "controlId": "T1110.004", "title": "T1110.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583417" }, { "id": 561795, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583417", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab0b2836-0404-5923-8787-49cb43506b53", "parentControlId": 31149, "controlId": "T1111", "title": "T1111", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583417" }, { "id": 561796, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583417", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99cab464-e82a-5376-83e9-90e011eb8bb3", "parentControlId": 31149, "controlId": "T1114", "title": "T1114", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583417" }, { "id": 561797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583417", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "656c0c28-7b96-5274-9f55-f41d903f5949", "parentControlId": 31149, "controlId": "T1114.001", "title": "T1114.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583417" }, { "id": 561798, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583417", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e069c568-d89d-5f56-9af5-cb5dc39c411c", "parentControlId": 31149, "controlId": "T1114.002", "title": "T1114.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583417" }, { "id": 561799, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583417", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd79eb02-b049-5e8d-b4bb-ffe3d8fe65f0", "parentControlId": 31149, "controlId": "T1114.003", "title": "T1114.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583417" }, { "id": 561800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583417", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b2d48ae-88ce-5ec2-9922-41e16b0b0cc4", "parentControlId": 31149, "controlId": "T1119", "title": "T1119", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583417" }, { "id": 561801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583417", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1f57eef-2c5e-51d8-977d-654be7ab90bc", "parentControlId": 31149, "controlId": "T1127", "title": "T1127", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583417" }, { "id": 561802, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583417", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdfebe18-c93e-5a5d-94f9-fbcda198648d", "parentControlId": 31149, "controlId": "T1127.001", "title": "T1127.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583417" }, { "id": 561803, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583418", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0dca398-9ce2-57d5-b89a-38a87bad00df", "parentControlId": 31149, "controlId": "T1127.002", "title": "T1127.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583418" }, { "id": 561804, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583418", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d2e7630-47e8-54c1-995e-8ce8cc244c6f", "parentControlId": 31149, "controlId": "T1129", "title": "T1129", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583418" }, { "id": 561805, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583418", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55412e4d-eb25-52de-bf0b-0d7720e5adec", "parentControlId": 31149, "controlId": "T1132", "title": "T1132", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583418" }, { "id": 561806, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583418", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9973a997-1ad0-5f7b-b40f-c6916acaff15", "parentControlId": 31149, "controlId": "T1132.001", "title": "T1132.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583418" }, { "id": 561807, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583418", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "989dbd0e-8430-5244-bd1b-e854f9372a3d", "parentControlId": 31149, "controlId": "T1132.002", "title": "T1132.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583418" }, { "id": 561808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583418", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78e767e1-e664-58cd-b82a-2209c46f9320", "parentControlId": 31149, "controlId": "T1133", "title": "T1133", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583418" }, { "id": 561809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583418", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce1c3e82-bc1d-5d17-88f1-8e042f9af0bb", "parentControlId": 31149, "controlId": "T1135", "title": "T1135", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583418" }, { "id": 561810, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583418", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1a984f8-1e10-53a4-a8b9-bff00a21352d", "parentControlId": 31149, "controlId": "T1136", "title": "T1136", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583418" }, { "id": 561811, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583418", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cc07994-6bbe-5357-a8fb-908d3c04ea27", "parentControlId": 31149, "controlId": "T1136.001", "title": "T1136.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583418" }, { "id": 561812, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3079252-c44e-5a19-9e85-191c5943b4cf", "parentControlId": 31149, "controlId": "T1136.002", "title": "T1136.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583419" }, { "id": 561813, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19ed7cb7-5468-5a1d-81ca-a75f1ad7d7ba", "parentControlId": 31149, "controlId": "T1136.003", "title": "T1136.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583419" }, { "id": 561814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e658fbc-3188-5262-943f-7e6a834cb54f", "parentControlId": 31149, "controlId": "T1137", "title": "T1137", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583419" }, { "id": 561815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df6861ae-8272-5e5e-bae3-248f9ed58069", "parentControlId": 31149, "controlId": "T1137.001", "title": "T1137.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583419" }, { "id": 561816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "958e3dea-8337-5c12-90de-24a47396751d", "parentControlId": 31149, "controlId": "T1176", "title": "T1176", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583419" }, { "id": 561817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5089972-a70f-5002-8454-54ceb002cad9", "parentControlId": 31149, "controlId": "T1185", "title": "T1185", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583419" }, { "id": 561818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82f25029-66cf-5a76-b9d5-5ea7a555ce81", "parentControlId": 31149, "controlId": "T1187", "title": "T1187", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583419" }, { "id": 561819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cacd03cb-7967-5e81-affc-b3d959598aa7", "parentControlId": 31149, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58342" }, { "id": 561820, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2edb818a-b3ac-56c0-bd34-9f6f6138b007", "parentControlId": 31149, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58342" }, { "id": 561821, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583594", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc39906d-ea74-5996-bb2a-e9b7d6841a2d", "parentControlId": 31149, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583594" }, { "id": 561822, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583595", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8784032e-717e-5f51-8fe3-32adbd712a19", "parentControlId": 31149, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583595" }, { "id": 561823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583595", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77124573-3c9c-5b9b-b390-3e7ef4ce462e", "parentControlId": 31149, "controlId": "T1197", "title": "T1197", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583595" }, { "id": 561824, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583595", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d27f3ca-423a-5144-a6fa-273a20e4ea70", "parentControlId": 31149, "controlId": "T1201", "title": "T1201", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583595" }, { "id": 561825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583595", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57e2c170-3482-5654-a970-b8f06efb7ee9", "parentControlId": 31149, "controlId": "T1203", "title": "T1203", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583595" }, { "id": 561826, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583595", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4baf0f95-d9ba-5d41-9d62-c531c0d27294", "parentControlId": 31149, "controlId": "T1204", "title": "T1204", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583595" }, { "id": 561827, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583595", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f5aa290-fae9-5b1f-b194-eb50bdbdba56", "parentControlId": 31149, "controlId": "T1204.001", "title": "T1204.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583595" }, { "id": 561828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583595", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ce9fcf2-9f63-56f9-be16-f7192766dd8b", "parentControlId": 31149, "controlId": "T1204.002", "title": "T1204.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583596" }, { "id": 561829, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99212966-d7bb-54f7-956a-eb8782fe9897", "parentControlId": 31149, "controlId": "T1204.003", "title": "T1204.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583596" }, { "id": 561830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf350343-dd00-52e8-95bf-deeab49a1c2e", "parentControlId": 31149, "controlId": "T1205", "title": "T1205", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583596" }, { "id": 561831, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "629708ea-4da2-5937-880e-2042c1dff078", "parentControlId": 31149, "controlId": "T1205.001", "title": "T1205.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583596" }, { "id": 561832, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f320a042-e3b4-5473-b041-d97545a5476d", "parentControlId": 31149, "controlId": "T1205.002", "title": "T1205.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583596" }, { "id": 561833, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c111b67-5004-5d00-a0a2-f84438684e3e", "parentControlId": 31149, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583596" }, { "id": 561834, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "732554c5-e878-516b-8e63-ca609728536e", "parentControlId": 31149, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583596" }, { "id": 561835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09b15ab6-667c-5bd0-8526-cbd9cb559618", "parentControlId": 31149, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583596" }, { "id": 561836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3208c204-4b4a-5af7-8704-8f703d1be9f2", "parentControlId": 31149, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583596" }, { "id": 561837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea62c425-6394-5d47-9a4b-b81d542426c5", "parentControlId": 31149, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583597" }, { "id": 561838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77361690-ddf7-5716-9a68-8dbe9dc34de1", "parentControlId": 31149, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583597" }, { "id": 561839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63649620-a4d6-55a1-a575-27416ed0da7f", "parentControlId": 31149, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583597" }, { "id": 561840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af491209-7a5d-51eb-89c3-d9962949a225", "parentControlId": 31149, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583597" }, { "id": 561841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "967cccf9-6907-552c-9f61-bf278a34b8b3", "parentControlId": 31149, "controlId": "T1216", "title": "T1216", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583606" }, { "id": 561842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c533066-1838-5157-ae92-4bf099818a39", "parentControlId": 31149, "controlId": "T1216.001", "title": "T1216.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583606" }, { "id": 561843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4027646-16cd-52c5-8db6-125eeea4e7af", "parentControlId": 31149, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583606" }, { "id": 561844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "923db7af-fdcc-59d2-9ed7-34fbb4d3355f", "parentControlId": 31149, "controlId": "T1218.001", "title": "T1218.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583606" }, { "id": 561845, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26b05bfc-d25e-596d-9055-36a77ff82a25", "parentControlId": 31149, "controlId": "T1218.002", "title": "T1218.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583606" }, { "id": 561846, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583607", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eeca8c62-f4db-5e95-91a6-109cc4873bef", "parentControlId": 31149, "controlId": "T1218.003", "title": "T1218.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583607" }, { "id": 561847, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583607", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f92ef77-303c-5f76-908e-4df58dceaffd", "parentControlId": 31149, "controlId": "T1218.004", "title": "T1218.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583607" }, { "id": 561848, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583607", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3dd8a730-0643-59a8-8908-8bf49cc5d395", "parentControlId": 31149, "controlId": "T1218.005", "title": "T1218.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583607" }, { "id": 561849, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583607", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78fc74d5-33ce-5a9f-9f6d-a7184bf32784", "parentControlId": 31149, "controlId": "T1218.008", "title": "T1218.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583607" }, { "id": 561850, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583607", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f6f5546-5142-5360-ac70-36d0e8ff020f", "parentControlId": 31149, "controlId": "T1218.009", "title": "T1218.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583607" }, { "id": 561851, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583607", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97e6484d-1de7-527d-a469-b35c6d44954a", "parentControlId": 31149, "controlId": "T1218.010", "title": "T1218.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583607" }, { "id": 561852, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583607", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "934d0ed3-eea6-5c39-bc70-3e34de68e8cf", "parentControlId": 31149, "controlId": "T1218.011", "title": "T1218.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583607" }, { "id": 561853, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583607", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d9bb4f9-e888-5144-a2de-1b6351e61654", "parentControlId": 31149, "controlId": "T1218.012", "title": "T1218.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583607" }, { "id": 561854, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583607", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c767844e-56aa-5bd0-8732-1cb0a07feb19", "parentControlId": 31149, "controlId": "T1218.013", "title": "T1218.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583607" }, { "id": 561855, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61351960-3287-5eab-9580-01a303e5fe4d", "parentControlId": 31149, "controlId": "T1218.014", "title": "T1218.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583608" }, { "id": 561856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb8ce6ec-48aa-59bb-bcd1-1b81b03dbcfb", "parentControlId": 31149, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583608" }, { "id": 561857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a43afa99-ec85-5bf2-b62d-ed04aaf25a5d", "parentControlId": 31149, "controlId": "T1219", "title": "T1219", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583608" }, { "id": 561858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7cecde6c-4227-5484-ab0c-d81e6b3f400f", "parentControlId": 31149, "controlId": "T1220", "title": "T1220", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583608" }, { "id": 561859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4f5ec53-2e37-5ee8-8406-5e88f6f255e8", "parentControlId": 31149, "controlId": "T1221", "title": "T1221", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583608" }, { "id": 561860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0dee86c4-51c5-5a07-8f13-7dd752f6dfb3", "parentControlId": 31149, "controlId": "T1222", "title": "T1222", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583608" }, { "id": 561861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33a43703-2ac8-5184-b638-b5887eb7b635", "parentControlId": 31149, "controlId": "T1222.001", "title": "T1222.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583608" }, { "id": 561862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2766798f-5958-585d-998b-6b0ff75ed82c", "parentControlId": 31149, "controlId": "T1222.002", "title": "T1222.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583608" }, { "id": 561863, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58c46102-5b6a-5c63-b06b-d3bd22b2ab50", "parentControlId": 31149, "controlId": "T1484", "title": "T1484", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583608" }, { "id": 561864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0e2e400-87ed-5162-8e39-2c29d5d73195", "parentControlId": 31149, "controlId": "T1485", "title": "T1485", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583609" }, { "id": 561865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d7d0127-38c2-524c-b7b3-9b26c6909d75", "parentControlId": 31149, "controlId": "T1486", "title": "T1486", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583609" }, { "id": 561866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01f94119-4c9b-536e-83a9-f1e5141a485b", "parentControlId": 31149, "controlId": "T1489", "title": "T1489", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583609" }, { "id": 561867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ce66497-d809-5980-a126-5853235a16c1", "parentControlId": 31149, "controlId": "T1490", "title": "T1490", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583609" }, { "id": 561868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a17936b-ac23-5128-aa0a-6597eb8078c9", "parentControlId": 31149, "controlId": "T1491", "title": "T1491", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583609" }, { "id": 561869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27f5689b-d66f-5cce-b2d8-b40e370153f8", "parentControlId": 31149, "controlId": "T1491.001", "title": "T1491.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583609" }, { "id": 561870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4213c32e-2084-575e-be7d-eb9b1539c26f", "parentControlId": 31149, "controlId": "T1491.002", "title": "T1491.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58361" }, { "id": 561871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9eaa4430-4bf0-5cd6-9f6f-0a5027de6be7", "parentControlId": 31149, "controlId": "T1499", "title": "T1499", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58361" }, { "id": 561872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af427ca8-d031-570f-a7b5-5cbcace13898", "parentControlId": 31149, "controlId": "T1499.001", "title": "T1499.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58361" }, { "id": 561873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78f40359-a1e1-5448-9b37-f5aaaf3a65b4", "parentControlId": 31149, "controlId": "T1499.002", "title": "T1499.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58361" }, { "id": 561874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36cd5339-09a6-52f0-9249-fc23ec842e47", "parentControlId": 31149, "controlId": "T1499.003", "title": "T1499.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58361" }, { "id": 561875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7ccc8e2-d77a-5acf-8cf0-5460b166a97d", "parentControlId": 31149, "controlId": "T1499.004", "title": "T1499.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58361" }, { "id": 561876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c166c3c2-18a5-54ce-9d9f-b921d3dc4e66", "parentControlId": 31149, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58361" }, { "id": 561877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "660e9f01-edc8-5d3e-a863-bc1214dd668e", "parentControlId": 31149, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58361" }, { "id": 561878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76bc27a4-59d5-5f78-820f-1863269fb98c", "parentControlId": 31149, "controlId": "T1505.003", "title": "T1505.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58361" }, { "id": 561879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9a16ebd-13e5-5023-ae73-b4bed5522f66", "parentControlId": 31149, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583611" }, { "id": 561880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82753499-a34e-5abd-af0e-03c55619a21c", "parentControlId": 31149, "controlId": "T1505.005", "title": "T1505.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583611" }, { "id": 561881, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1d38263-c362-5a94-ae36-b3206c3e61df", "parentControlId": 31149, "controlId": "T1525", "title": "T1525", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583611" }, { "id": 561882, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "676706de-0dfe-55b4-874b-8d9fdfa1eb8c", "parentControlId": 31149, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583611" }, { "id": 561883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94d68cb4-bd4a-5be7-ab76-d9159a0f8f19", "parentControlId": 31149, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583611" }, { "id": 561884, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1132c8b4-91e0-5d38-a249-3778ef9779d9", "parentControlId": 31149, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583611" }, { "id": 561885, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93b5cbd2-ac51-5c8b-8761-d44b747ec01c", "parentControlId": 31149, "controlId": "T1539", "title": "T1539", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583611" }, { "id": 561886, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7da38925-d804-5feb-b8b7-1dca2c511aa1", "parentControlId": 31149, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583611" }, { "id": 561887, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "227a5829-8352-565d-b765-8c9b0c9e6a00", "parentControlId": 31149, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583612" }, { "id": 561888, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c38f48bd-3d32-5e6e-b2f1-afd2bb42d20a", "parentControlId": 31149, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583612" }, { "id": 561889, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b12396cc-29d7-5cc6-ae11-1328655b0903", "parentControlId": 31149, "controlId": "T1543.002", "title": "T1543.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583612" }, { "id": 561890, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d258680-50b7-5ba8-bacc-99353e6e9f5e", "parentControlId": 31149, "controlId": "T1546.002", "title": "T1546.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583612" }, { "id": 561891, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "941a7ece-f788-5c9b-a269-6c72c4f08510", "parentControlId": 31149, "controlId": "T1546.003", "title": "T1546.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583612" }, { "id": 561892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7cabe31-1dd7-5719-9a5a-24ae06bf06ab", "parentControlId": 31149, "controlId": "T1546.004", "title": "T1546.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583612" }, { "id": 561893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0079f7bd-18ce-5442-82ef-6a0b78713fb8", "parentControlId": 31149, "controlId": "T1546.006", "title": "T1546.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583612" }, { "id": 561894, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84642274-2415-5b43-bcf4-efdd4933288d", "parentControlId": 31149, "controlId": "T1546.008", "title": "T1546.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583612" }, { "id": 561895, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e88057c-78b8-52b0-a984-0702110675c3", "parentControlId": 31149, "controlId": "T1546.013", "title": "T1546.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583613" }, { "id": 561896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0996fa3-636c-5ca0-b580-dec2fb2fc688", "parentControlId": 31149, "controlId": "T1546.014", "title": "T1546.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583613" }, { "id": 561897, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1493f63c-655c-5cf9-995a-6ede3cb517ab", "parentControlId": 31149, "controlId": "T1546.016", "title": "T1546.016", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583613" }, { "id": 561898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2092d2c4-abee-5edd-849f-8513c5dc8c1c", "parentControlId": 31149, "controlId": "T1547.002", "title": "T1547.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583613" }, { "id": 561899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ba5fd2b-1f31-5e88-9b1a-9d73361a3f02", "parentControlId": 31149, "controlId": "T1547.003", "title": "T1547.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583613" }, { "id": 561900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "421259b5-5c61-5ac4-872e-8865433ecbad", "parentControlId": 31149, "controlId": "T1547.004", "title": "T1547.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583613" }, { "id": 561901, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8faf9cb3-ead7-5aaf-a3f4-d40787176c39", "parentControlId": 31149, "controlId": "T1547.005", "title": "T1547.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583613" }, { "id": 561902, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b240b7a4-e69b-51dd-ac63-79dbfe46103d", "parentControlId": 31149, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583613" }, { "id": 561903, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35d916a9-d427-5709-8fe9-4d8b087b26e2", "parentControlId": 31149, "controlId": "T1547.007", "title": "T1547.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583613" }, { "id": 561904, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da421e8d-74b9-5822-93a3-785859fbef28", "parentControlId": 31149, "controlId": "T1547.008", "title": "T1547.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583614" }, { "id": 561905, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea8c5087-c29c-514e-a031-468b3f3105b6", "parentControlId": 31149, "controlId": "T1547.009", "title": "T1547.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583614" }, { "id": 561906, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83c934d6-9c58-55c3-86f3-5c391ee5c152", "parentControlId": 31149, "controlId": "T1547.012", "title": "T1547.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583614" }, { "id": 561907, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "848474d8-f8f6-5918-8a4d-18ff39833f8b", "parentControlId": 31149, "controlId": "T1547.013", "title": "T1547.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583614" }, { "id": 561908, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ea33684-58ae-5920-a552-dc35f1a00402", "parentControlId": 31149, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583614" }, { "id": 561909, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbde4c4b-1661-5a92-9e75-b9d8092f23e6", "parentControlId": 31149, "controlId": "T1548.001", "title": "T1548.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583614" }, { "id": 561910, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f278455-d1fb-53dd-ac15-5d5581020a6e", "parentControlId": 31149, "controlId": "T1548.002", "title": "T1548.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583614" }, { "id": 561911, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "261ca5e1-262e-5d71-bda1-091606644c09", "parentControlId": 31149, "controlId": "T1548.003", "title": "T1548.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583614" }, { "id": 561912, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9068b1a7-48d1-509a-a436-bdeae9913000", "parentControlId": 31149, "controlId": "T1548.004", "title": "T1548.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583614" }, { "id": 561913, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f59919cc-17a1-5e2b-a1d8-00d394ae2494", "parentControlId": 31149, "controlId": "T1548.006", "title": "T1548.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583615" }, { "id": 561914, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b18b1525-af58-5c4b-b455-5927150e15c7", "parentControlId": 31149, "controlId": "T1550.001", "title": "T1550.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583615" }, { "id": 561915, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b2ed8af-514a-516f-b585-8fce86249ada", "parentControlId": 31149, "controlId": "T1550.003", "title": "T1550.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583615" }, { "id": 561916, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5545cc40-c204-5c00-9eec-95091b319df7", "parentControlId": 31149, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583615" }, { "id": 561917, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f12c2b7-9b26-549a-865b-7169f49804ef", "parentControlId": 31149, "controlId": "T1552.001", "title": "T1552.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583615" }, { "id": 561918, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8dd7523-5e1e-59c8-a3ec-2b3bd1057784", "parentControlId": 31149, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583615" }, { "id": 561919, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b5a5ce8-22f5-50d3-9f8a-0a1e22f3c66a", "parentControlId": 31149, "controlId": "T1552.003", "title": "T1552.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583615" }, { "id": 561920, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ed11e54-ab2b-55c0-8d9c-4832fca23f2d", "parentControlId": 31149, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583616" }, { "id": 561921, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "053e9347-9c70-552b-9ecf-4884f7c8538e", "parentControlId": 31149, "controlId": "T1552.005", "title": "T1552.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583616" }, { "id": 561922, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fd3a71e-3b9d-5125-b9c8-926e14657cd9", "parentControlId": 31149, "controlId": "T1552.006", "title": "T1552.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583616" }, { "id": 561923, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d42469d-a1d7-528f-b9d3-ee4de6d78f15", "parentControlId": 31149, "controlId": "T1552.008", "title": "T1552.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583616" }, { "id": 561924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df28407b-426f-5bca-8fa4-bc8a7e605926", "parentControlId": 31149, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583616" }, { "id": 561925, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91dcd5c4-97fb-58f4-9303-1d4f8895bf44", "parentControlId": 31149, "controlId": "T1553.001", "title": "T1553.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583616" }, { "id": 561926, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3214e911-cec2-5c5a-93a0-dd0f4e55090c", "parentControlId": 31149, "controlId": "T1553.003", "title": "T1553.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583616" }, { "id": 561927, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff6fa99f-595b-5462-8c30-8606037db75c", "parentControlId": 31149, "controlId": "T1553.004", "title": "T1553.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583616" }, { "id": 561928, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ab7a142-db2c-5a9b-a650-4edf881c8c79", "parentControlId": 31149, "controlId": "T1553.005", "title": "T1553.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583616" }, { "id": 561929, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f348e486-6af2-5d4c-8e50-7a57292a0f32", "parentControlId": 31149, "controlId": "T1555", "title": "T1555", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583616" }, { "id": 561930, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "305ead5d-3707-5a5f-9457-685082df67ac", "parentControlId": 31149, "controlId": "T1555.001", "title": "T1555.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583617" }, { "id": 561931, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2df40ebf-eb27-50ac-be59-a3513a32120c", "parentControlId": 31149, "controlId": "T1555.002", "title": "T1555.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583617" }, { "id": 561932, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15e24382-5d40-5a37-b5a1-b1a8893c9312", "parentControlId": 31149, "controlId": "T1555.004", "title": "T1555.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583617" }, { "id": 561933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0a8987c-21f0-5244-a976-7d7fccd45554", "parentControlId": 31149, "controlId": "T1555.005", "title": "T1555.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583617" }, { "id": 561934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb419c95-653a-5182-87cf-044a5a2e8a25", "parentControlId": 31149, "controlId": "T1556", "title": "T1556", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583617" }, { "id": 561935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e088a33-d3d6-51cd-9f47-940ed2ea6e97", "parentControlId": 31149, "controlId": "T1556.001", "title": "T1556.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583617" }, { "id": 561936, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea1701e9-0c6d-54a9-a817-eba67b779010", "parentControlId": 31149, "controlId": "T1556.002", "title": "T1556.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583617" }, { "id": 561937, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7d8d1ea-b2c0-56e0-95e6-3dece90b0743", "parentControlId": 31149, "controlId": "T1556.003", "title": "T1556.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583617" }, { "id": 561938, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84e69871-5cce-53f5-aa27-c8d1edf44442", "parentControlId": 31149, "controlId": "T1556.004", "title": "T1556.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583617" }, { "id": 561939, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fe4def5-b9d6-5ccd-80b1-c4b83a9201c1", "parentControlId": 31149, "controlId": "T1556.008", "title": "T1556.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583618" }, { "id": 561940, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed481c97-e737-53b8-a0d5-67c21badf306", "parentControlId": 31149, "controlId": "T1556.009", "title": "T1556.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583618" }, { "id": 561941, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0446d281-1c8e-5c1a-ad9f-09b0d5bd7d84", "parentControlId": 31149, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583618" }, { "id": 561942, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e6d3144-c380-5ff4-a5dd-5c63a752dd0f", "parentControlId": 31149, "controlId": "T1557.001", "title": "T1557.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583618" }, { "id": 561943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07cdeb40-7a39-56d0-9174-bb93ff4f1414", "parentControlId": 31149, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583618" }, { "id": 561944, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b7abb8d-e7d4-5ca6-ab7a-746e0808bb62", "parentControlId": 31149, "controlId": "T1557.003", "title": "T1557.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583618" }, { "id": 561945, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "111dce4a-3de4-54e9-8bd2-6363f03db820", "parentControlId": 31149, "controlId": "T1557.004", "title": "T1557.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583618" }, { "id": 561946, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9d345f7-7ec4-58b8-be8b-13a3e0690475", "parentControlId": 31149, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583618" }, { "id": 561947, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "785769d5-3b9d-56b2-a5f8-7dcd48df0214", "parentControlId": 31149, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583619" }, { "id": 561948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "062809a2-e7c4-5c6a-9228-b813669416a6", "parentControlId": 31149, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583619" }, { "id": 561949, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82493cc2-45dd-536a-8808-db236db54a06", "parentControlId": 31149, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583619" }, { "id": 561950, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d0cf25e-470c-5a41-b61d-aeabfbffa1d4", "parentControlId": 31149, "controlId": "T1558.005", "title": "T1558.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583619" }, { "id": 561951, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63f6030c-c018-5427-892e-5a0382a613fb", "parentControlId": 31149, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583619" }, { "id": 561952, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b18ba8c-4e0a-5904-8d40-e200af0f9c19", "parentControlId": 31149, "controlId": "T1559.002", "title": "T1559.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583619" }, { "id": 561953, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "559ba4eb-5d87-53d2-81be-dabafe1d9672", "parentControlId": 31149, "controlId": "T1559.003", "title": "T1559.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583619" }, { "id": 561954, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "162a7c85-3684-573b-bfb3-67857f85a6c0", "parentControlId": 31149, "controlId": "T1560", "title": "T1560", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583619" }, { "id": 561955, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "047963f4-1ae9-5e1a-9b12-eedde86803f3", "parentControlId": 31149, "controlId": "T1560.001", "title": "T1560.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583619" }, { "id": 561956, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b3dfc45-d1cb-553c-96e4-83b7f8d9c8a0", "parentControlId": 31149, "controlId": "T1561", "title": "T1561", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58362" }, { "id": 561957, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "224bb736-f89f-52e8-a0a7-a3261b0768de", "parentControlId": 31149, "controlId": "T1561.001", "title": "T1561.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58362" }, { "id": 561958, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8bbae0f-a5cb-5363-b40e-45288c5210a3", "parentControlId": 31149, "controlId": "T1561.002", "title": "T1561.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58362" }, { "id": 561959, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f48c271d-8c7f-572d-bc56-ad9f5d6b2e1e", "parentControlId": 31149, "controlId": "T1562", "title": "T1562", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58362" }, { "id": 561960, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f005549-4b51-583d-a2ec-b8726f87a1f1", "parentControlId": 31149, "controlId": "T1562.001", "title": "T1562.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58362" }, { "id": 561961, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b554df0-afae-5603-b273-0570dbc656d3", "parentControlId": 31149, "controlId": "T1562.002", "title": "T1562.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58362" }, { "id": 561962, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a3435bd-06aa-52eb-af37-79a7e2815ae3", "parentControlId": 31149, "controlId": "T1562.003", "title": "T1562.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58362" }, { "id": 561963, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "230b4f83-b2ec-55eb-94b7-175b0a2f9044", "parentControlId": 31149, "controlId": "T1562.004", "title": "T1562.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58362" }, { "id": 561964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb73a005-030f-58d9-b20a-1cfe2ae68b2e", "parentControlId": 31149, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58362" }, { "id": 561965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0cb888e2-bbec-569c-bcbd-a268374a88b8", "parentControlId": 31149, "controlId": "T1562.010", "title": "T1562.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583621" }, { "id": 561966, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b629d926-e6a3-52b2-b417-01db74b08439", "parentControlId": 31149, "controlId": "T1562.011", "title": "T1562.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583621" }, { "id": 561967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "570250c6-3ddf-5051-b3a0-73111d6649e6", "parentControlId": 31149, "controlId": "T1562.012", "title": "T1562.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583621" }, { "id": 561968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4b68ae4-d666-5c43-9f24-0170c4c20063", "parentControlId": 31149, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583621" }, { "id": 561969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e036f788-286e-58a6-82f6-378e4341cbed", "parentControlId": 31149, "controlId": "T1563.001", "title": "T1563.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583621" }, { "id": 561970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b15f0965-70eb-5158-9bc8-237fcc3d7a6f", "parentControlId": 31149, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583621" }, { "id": 561971, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57fcedc2-be86-56af-ba81-7da72ce9c990", "parentControlId": 31149, "controlId": "T1564.002", "title": "T1564.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583621" }, { "id": 561972, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2afa530f-6328-5bbf-81ce-e759076c5f72", "parentControlId": 31149, "controlId": "T1564.004", "title": "T1564.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583621" }, { "id": 561973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35547c70-dc98-5cf7-887b-69ea949e364a", "parentControlId": 31149, "controlId": "T1564.006", "title": "T1564.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583622" }, { "id": 561974, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5283cb99-63b2-5b9d-9868-c54791bc40a2", "parentControlId": 31149, "controlId": "T1564.007", "title": "T1564.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583622" }, { "id": 561975, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8da1ded1-28b2-510a-bb8b-bce4c331c2d0", "parentControlId": 31149, "controlId": "T1564.008", "title": "T1564.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583622" }, { "id": 561976, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0825d04f-a5a7-52b9-adaa-267f17251518", "parentControlId": 31149, "controlId": "T1564.009", "title": "T1564.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583622" }, { "id": 561977, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6540960-8b60-5186-868e-9370c4207df2", "parentControlId": 31149, "controlId": "T1564.010", "title": "T1564.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583622" }, { "id": 561978, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dde4feae-0324-5c6c-b7e9-80ebec42b7bd", "parentControlId": 31149, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583622" }, { "id": 561979, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc856d08-b1f5-5be8-b852-780c6b584312", "parentControlId": 31149, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583622" }, { "id": 561980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "297e484a-f1bc-51a7-8903-86650a10bf88", "parentControlId": 31149, "controlId": "T1565.002", "title": "T1565.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583622" }, { "id": 561981, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32b63244-9738-5999-9abc-53450cfd36cf", "parentControlId": 31149, "controlId": "T1565.003", "title": "T1565.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583622" }, { "id": 561982, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0cb17fe-0ca0-5faa-9f28-7ff1d97f6613", "parentControlId": 31149, "controlId": "T1566", "title": "T1566", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583623" }, { "id": 561983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da3f8d1a-cfca-568a-9b3a-5a1dc75edbb3", "parentControlId": 31149, "controlId": "T1566.001", "title": "T1566.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583623" }, { "id": 561984, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "478f4d73-58e5-5cb2-8564-70e6bf6ac764", "parentControlId": 31149, "controlId": "T1566.002", "title": "T1566.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583623" }, { "id": 561985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41e95ce5-44d5-56aa-97fc-94d943f005c7", "parentControlId": 31149, "controlId": "T1566.003", "title": "T1566.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583623" }, { "id": 561986, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fce67fcc-2cbd-5158-9435-f120984fb381", "parentControlId": 31149, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583623" }, { "id": 561987, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0504adb-9efc-5171-9598-90a7f3d23fea", "parentControlId": 31149, "controlId": "T1568", "title": "T1568", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583623" }, { "id": 561988, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "235ae56c-80cf-5fbc-92fb-e7cb6a33c865", "parentControlId": 31149, "controlId": "T1568.002", "title": "T1568.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583623" }, { "id": 561989, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07117a17-ebb6-59b2-b93b-58cbb5c35157", "parentControlId": 31149, "controlId": "T1569", "title": "T1569", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583623" }, { "id": 561990, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17bbe559-caf0-5cbb-8819-d3d391b6a744", "parentControlId": 31149, "controlId": "T1569.002", "title": "T1569.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583623" }, { "id": 561991, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79493e54-52f1-5077-ae68-518b89572788", "parentControlId": 31149, "controlId": "T1570", "title": "T1570", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583624" }, { "id": 561992, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f11873d-0cd6-50b5-a051-d869fc0e1fb2", "parentControlId": 31149, "controlId": "T1571", "title": "T1571", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583624" }, { "id": 561993, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "394de755-c367-529a-af1a-a69bafcc4ace", "parentControlId": 31149, "controlId": "T1572", "title": "T1572", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583624" }, { "id": 561994, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e719e155-ae0c-5218-bc89-b9738de6945b", "parentControlId": 31149, "controlId": "T1573", "title": "T1573", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583624" }, { "id": 561995, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9a2c7ee-b734-5922-a132-cba4af0eac5b", "parentControlId": 31149, "controlId": "T1573.001", "title": "T1573.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583624" }, { "id": 561996, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "730ad652-7150-5300-8433-b712777d3df8", "parentControlId": 31149, "controlId": "T1573.002", "title": "T1573.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583624" }, { "id": 561997, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46d30f5d-6a4b-5d14-9b85-64c8c4f582f6", "parentControlId": 31149, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583624" }, { "id": 561998, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbe9ae04-7ff3-57df-ad9a-ed2b17a15897", "parentControlId": 31149, "controlId": "T1574.001", "title": "T1574.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583624" }, { "id": 561999, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20a6c5c4-8ac0-55bc-a155-e384d1a57b9e", "parentControlId": 31149, "controlId": "T1574.004", "title": "T1574.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583625" }, { "id": 562000, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e885a208-0d2c-5782-a223-eda966b6bf20", "parentControlId": 31149, "controlId": "T1574.005", "title": "T1574.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583625" }, { "id": 562001, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "608f2020-9729-5b01-9837-df8ec27e2269", "parentControlId": 31149, "controlId": "T1574.007", "title": "T1574.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583625" }, { "id": 562002, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94114136-8094-50b2-934b-a68c263613b6", "parentControlId": 31149, "controlId": "T1574.008", "title": "T1574.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583625" }, { "id": 562003, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "113767e9-8244-5132-bab6-b0576000ca60", "parentControlId": 31149, "controlId": "T1574.009", "title": "T1574.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583625" }, { "id": 562004, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21dc3c2d-641e-588f-ac77-fc7c6bb3ae4b", "parentControlId": 31149, "controlId": "T1574.010", "title": "T1574.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583625" }, { "id": 562005, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00e3cbb8-7d37-5fe0-8f0d-343c7d692e19", "parentControlId": 31149, "controlId": "T1574.013", "title": "T1574.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583625" }, { "id": 562006, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b770409-9642-5441-abcb-ca437e10a2ec", "parentControlId": 31149, "controlId": "T1574.014", "title": "T1574.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583625" }, { "id": 562007, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9595a45-1595-5a78-a6da-68d9529d78e9", "parentControlId": 31149, "controlId": "T1578", "title": "T1578", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583626" }, { "id": 562008, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10722330-573d-530c-8263-8e5af44d2a8f", "parentControlId": 31149, "controlId": "T1578.001", "title": "T1578.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583626" }, { "id": 562009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf12de7d-7c1d-5ace-805c-abc764707e73", "parentControlId": 31149, "controlId": "T1578.002", "title": "T1578.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583626" }, { "id": 562010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3f72889-eb65-500c-8d5d-ee2763a24693", "parentControlId": 31149, "controlId": "T1578.003", "title": "T1578.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583626" }, { "id": 562011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ccf8f28-7953-5f81-ac19-d460df6b29ac", "parentControlId": 31149, "controlId": "T1598", "title": "T1598", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583626" }, { "id": 562012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9bf3b9b0-ec59-5604-b0be-d9eb2193a2a9", "parentControlId": 31149, "controlId": "T1598.001", "title": "T1598.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583626" }, { "id": 562013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8584833-25c1-5960-a8ac-3468ba7b9a9c", "parentControlId": 31149, "controlId": "T1598.002", "title": "T1598.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583626" }, { "id": 562014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a62b05d4-26df-532d-905a-3f8d64e39cf4", "parentControlId": 31149, "controlId": "T1598.003", "title": "T1598.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583626" }, { "id": 562015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8852985f-ac10-538e-a7a5-704fd83f596a", "parentControlId": 31149, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583626" }, { "id": 562016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07600f21-c7ae-5a7e-9c60-848af819ea80", "parentControlId": 31149, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583627" }, { "id": 562017, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "daa62001-210d-5109-8dec-a3264ec7fe41", "parentControlId": 31149, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583627" }, { "id": 562018, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b6157c0-e190-530c-8148-092daec04048", "parentControlId": 31149, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583627" }, { "id": 562019, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c771792-3019-54dc-9695-77b042a0aaba", "parentControlId": 31149, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583627" }, { "id": 562020, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e4f7360-e327-5a96-bbc7-3a2319837c17", "parentControlId": 31149, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583627" }, { "id": 562021, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8237a621-c972-5e76-827e-80fc6a652d52", "parentControlId": 31149, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583627" }, { "id": 562022, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c3689ca-54db-5fbb-9818-5509eee6e3dd", "parentControlId": 31149, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583627" }, { "id": 562023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "455ed06b-78b2-5313-8ceb-6b0d499a2c77", "parentControlId": 31149, "controlId": "T1610", "title": "T1610", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583627" }, { "id": 562024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18a26a20-46cf-5339-bdf7-65058bdce0dd", "parentControlId": 31149, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583628" }, { "id": 562025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4e0cd6c-c360-57a6-b0a3-cedb21bd5e30", "parentControlId": 31149, "controlId": "T1612", "title": "T1612", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583628" }, { "id": 562026, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16569c3e-58ef-5d62-a3ac-4d48b1a61ab0", "parentControlId": 31149, "controlId": "T1613", "title": "T1613", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583628" }, { "id": 562027, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b8ede67-4190-56fb-b91c-b79ee6fe8489", "parentControlId": 31149, "controlId": "T1622", "title": "T1622", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583628" }, { "id": 562028, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "202f2aca-a9ae-5388-a80a-c3c53ededd4e", "parentControlId": 31149, "controlId": "T1647", "title": "T1647", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583628" }, { "id": 562029, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3cb7cd6-72ca-5f12-b507-3505e75314bf", "parentControlId": 31149, "controlId": "T1648", "title": "T1648", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583628" }, { "id": 562030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed5d5d10-4d7b-54c4-b4ac-6f0c65c46add", "parentControlId": 31149, "controlId": "T1651", "title": "T1651", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583628" }, { "id": 562031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdfbf154-ffe4-5b1e-b180-6e4f123884e2", "parentControlId": 31149, "controlId": "T1653", "title": "T1653", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583628" }, { "id": 562038, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8888aac1-b1c2-56ed-99a4-048549343505", "parentControlId": 31149, "controlId": "AU-1", "title": "AU-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583629" }, { "id": 562039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ecceaf20-c127-5514-a9c2-db186c0f39c5", "parentControlId": 31149, "controlId": "SI-4", "title": "SI-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583629" }, { "id": 562040, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2a5a3c2-737d-5f2e-bfd0-189f9021ef38", "parentControlId": 31149, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583629" }, { "id": 562041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7af4bc2-b9c7-54ba-a831-13b55019cd4c", "parentControlId": 31149, "controlId": "PM-31", "title": "PM-31", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58363" }, { "id": 562042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a389a7a-79fe-5e00-a81a-b111a7d2143e", "parentControlId": 31149, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58363" }, { "id": 562046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b57871c5-0b78-56a1-9374-c68473c62b28", "parentControlId": 31149, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58363" }, { "id": 562047, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4bee282-08a1-5447-a361-ece48783bd33", "parentControlId": 31149, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58363" }, { "id": 562050, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "091e4f77-1598-5a68-9e6f-806cc4126b58", "parentControlId": 31149, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583631" }, { "id": 562051, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583631", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78cb57d9-9fb3-590c-9b86-c4d275c75c0c", "parentControlId": 31149, "controlId": "PM-31", "title": "PM-31", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583631" }, { "id": 562052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583631", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc7c852d-0c31-576f-93d6-40824db46389", "parentControlId": 31149, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583631" }, { "id": 562053, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583631", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79695ba4-b4ae-51d9-b158-37c102d33f25", "parentControlId": 31149, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583631" }, { "id": 562054, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583631", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59c91772-5f5d-51a2-8b4c-2b8c83ba23d6", "parentControlId": 31149, "controlId": "PM-31", "title": "PM-31", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583631" }, { "id": 562055, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583631", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5e0fd7e-403a-5fae-aea6-272df15eecf0", "parentControlId": 31149, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583631" }, { "id": 562056, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583631", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9eeb182-b29e-561f-9fdf-97353295fa17", "parentControlId": 31149, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583631" }, { "id": 562057, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583631", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0dc7dd86-7d1d-571f-8d74-a68cd8fe8120", "parentControlId": 31149, "controlId": "PM-31", "title": "PM-31", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583631" }, { "id": 562058, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583631", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "894bd28c-0468-5b8a-80ca-e837cd742398", "parentControlId": 31149, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583631" }, { "id": 562059, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583631", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54b116dc-fd25-5cc1-a631-4016eb1492e1", "parentControlId": 31149, "controlId": "AU-01", "title": "AU-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583631" }, { "id": 562060, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583632", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "205b1a91-5cca-5af2-92ed-c638d8292a8c", "parentControlId": 31149, "controlId": "PM-31", "title": "PM-31", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583632" }, { "id": 562061, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583632", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf23fba7-a9b6-553e-9893-23f7fe3943af", "parentControlId": 31149, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583632" }, { "id": 562063, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583632", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6662b86a-5480-5be9-bee5-30a5ac260eff", "parentControlId": 31149, "controlId": "AU-1", "title": "AU-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583632" }, { "id": 562064, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583632", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "530bd75b-cf85-5a22-9cbb-df043c8da3cf", "parentControlId": 31149, "controlId": "PM-31", "title": "PM-31", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583632" }, { "id": 562065, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583632", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b12c29bb-6a40-5f34-a8af-8abf2f0e3054", "parentControlId": 31149, "controlId": "SI-4", "title": "SI-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583632" }, { "id": 562066, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583632", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17562a60-9c4d-57be-a702-0aa090010350", "parentControlId": 31149, "controlId": "AU-1", "title": "AU-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583632" }, { "id": 562067, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583632", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c241cbbb-271c-55a4-a820-0bd4c0ddb861", "parentControlId": 31149, "controlId": "SI-4", "title": "SI-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583632" }, { "id": 562068, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583633", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c42af3f4-2b37-5671-a4d2-cc9142b12fd4", "parentControlId": 31149, "controlId": "SI-4", "title": "SI-4", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583633" }, { "id": 562078, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01c73738-abaa-5d14-a415-28327f6ae937", "parentControlId": 31149, "controlId": "3.3.3", "title": "3.3.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583634" }, { "id": 562079, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "742397d9-bdf4-5e15-91cf-ab9e2f77bd16", "parentControlId": 31149, "controlId": "3.14.6", "title": "3.14.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583634" }, { "id": 562080, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b39b842a-9a5d-5774-a215-b9839f10a531", "parentControlId": 31149, "controlId": "NFO - AU-1", "title": "NFO - AU-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583634" }, { "id": 562081, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16480ac5-fec1-587d-86eb-b6c7933b4292", "parentControlId": 31149, "controlId": "03.03.01.a", "title": "03.03.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583634" }, { "id": 562082, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b756fc8e-4b01-553f-9f2c-4981d85dca92", "parentControlId": 31149, "controlId": "03.12.03", "title": "03.12.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583634" }, { "id": 562083, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45bd4fb6-72c7-5229-85d5-32705ba23d8e", "parentControlId": 31149, "controlId": "03.14.06.a", "title": "03.14.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583634" }, { "id": 562091, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583635", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ba4b749-5003-526f-b6d2-c8d7d6fe64d5", "parentControlId": 31149, "controlId": "PR.PS-04", "title": "PR.PS-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583635" }, { "id": 562092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583635", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e420ea7-1244-537e-bfee-dd91949cf2aa", "parentControlId": 31149, "controlId": "DE.CM-01", "title": "DE.CM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583635" }, { "id": 562093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583635", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd683854-b513-5d61-834e-124919dcd220", "parentControlId": 31149, "controlId": "DE.CM-03", "title": "DE.CM-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583635" }, { "id": 562094, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc97f115-68fe-5fe0-975f-2688d3927e5a", "parentControlId": 31149, "controlId": "DE.CM-06", "title": "DE.CM-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583636" }, { "id": 562095, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "098a07c8-aa59-5d89-a298-25edbea91030", "parentControlId": 31149, "controlId": "DE.CM-09", "title": "DE.CM-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583636" }, { "id": 562096, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49fddc3e-f952-50e9-ab0d-ec2d443e8af9", "parentControlId": 31149, "controlId": "DE.AE", "title": "DE.AE", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583636" }, { "id": 562148, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583642", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb23ed12-092c-5f8d-95b8-b8a43a98a29b", "parentControlId": 31149, "controlId": "SITUATION-1a", "title": "SITUATION-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583642" }, { "id": 562149, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583642", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e7d0faf-1f8e-5e87-92b4-e53ddc836b7d", "parentControlId": 31149, "controlId": "SITUATION-2c", "title": "SITUATION-2c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583642" }, { "id": 562150, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583642", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eebc2027-f513-56e6-8ab5-73e477dab7dc", "parentControlId": 31149, "controlId": "SITUATION-3g", "title": "SITUATION-3g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583642" }, { "id": 562256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583665", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "885bf5d5-92ea-51c5-88cc-68040711e84d", "parentControlId": 31149, "controlId": "C1", "title": "C1", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583665" }, { "controlId": "A.4", "title": "A.4 — Maintaining the Cyber Security Program", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-7, PM-6, SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "910a9e9c-b1aa-5c0b-9ecc-19fae4f4b408", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.0", "title": "NEI 08-09 Sec 4.0 — Maintaining the Cyber Security Program", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "73ae9077-8fdf-5f3c-8021-8e189040a7f1", "isPublic": true }, { "controlId": "10 CFR 73.54(g)", "title": "10 CFR 73.54(g) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "12c1b9c2-cebd-5a40-b2aa-fdb931865656", "isPublic": true }, { "controlId": "A.4.1", "title": "A.4.1 — Continuous Monitoring and Assessment", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-7, SI-4, RA-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "304b5764-a996-57d8-beff-323e7885b3e0", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.1", "title": "NEI 08-09 Sec 4.1 — Continuous Monitoring and Assessment", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "9a92ef4d-a30a-5269-b032-ef892f0bfa79", "isPublic": true }, { "controlId": "A.4.1.2", "title": "A.4.1.2 — Effectiveness Analysis", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, CA-7, RA-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "46c6dac8-88cb-5029-868d-f4b9f77a6dff", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.1.2", "title": "NEI 08-09 Sec 4.1.2 — Effectiveness Analysis", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.1.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "dfecf97c-cfb4-51c4-ac27-3c9ace9c42f6", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.1.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "3d3f5ed0-17c4-502c-a4b2-d2c464031466", "isPublic": true }, { "controlId": "A.4.2.4", "title": "A.4.2.4 — Updating Cyber Security Practices", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-1, SI-5, CA-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "405054ab-34e0-56be-ae2c-514d64895fbb", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.4", "title": "NEI 08-09 Sec 4.2.4 — Updating Cyber Security Practices", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "8e1f1e89-c275-589e-b52b-5b0be823ca9c", "isPublic": true }, { "controlId": "B.1.18", "title": "B.1.18 — Insecure and Rogue Connections", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, CA-9, SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "233b4f11-7608-5a81-b371-04c6b3837d94", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.18", "title": "NEI 08-09 App D.1.18 — Insecure and Rogue Connections", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.18", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "38a36e6e-8b1a-579b-9fab-e8caae5868b9", "isPublic": true }, { "controlId": "B.2.1", "title": "B.2.1 — Audit and Accountability Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "46d8c8b3-e628-5a1d-8444-c380745ff0df", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.1", "title": "NEI 08-09 App D.2.1 — Audit and Accountability Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e952fe39-17d1-5ba7-94f3-522f27356801", "isPublic": true }, { "controlId": "B.5.2", "title": "B.5.2 — Host Intrusion Detection System", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "420ed1f2-b5de-5c74-88a5-93574664260d", "isPublic": true }, { "controlId": "NEI 08-09 App D.5.2", "title": "NEI 08-09 App D.5.2 — Host Intrusion Detection System", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.5.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "87533a29-a251-55cf-851e-2c127426cf11", "isPublic": true }, { "controlId": "C.3.4", "title": "C.3.4 — Monitoring Tools and Techniques", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "be038097-611b-55c2-87e9-296575591fba", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.4", "title": "NEI 08-09 App E.3.4 — Monitoring Tools and Techniques", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "32aca5fd-f975-5f25-9fb9-79c823129dfc", "isPublic": true }, { "controlId": "CIP-007-6-R4", "title": "CIP-007-6-R4 — Security Event Monitoring", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "19d16018-63dd-532d-a7ce-17e394dbb4f5", "isPublic": true }, { "controlId": "CIP-007-6-4.1", "title": "CIP-007-6-4.1 — Log events at the BES Cyber System level (per BES Cyber System capability) or at the Cyber Asset level (per Cyber Ass...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d3588817-f49c-5b8d-9404-7c7c565f4109", "isPublic": true }, { "controlId": "CIP-007-6-4.1.1", "title": "CIP-007-6-4.1.1 — Detected successful login attempts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b723ebf6-f048-5ec4-86d5-ba96b7f4f7cb", "isPublic": true }, { "controlId": "CIP-007-6-4.1.2", "title": "CIP-007-6-4.1.2 — Detected failed access attempts and failed login attempts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "cac91de3-24ce-595e-8457-7a2bd3733564", "isPublic": true }, { "controlId": "CIP-007-6-4.1.3", "title": "CIP-007-6-4.1.3 — Detected malicious code.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a24b1a56-27b9-5306-8ede-e471f9f1016a", "isPublic": true }, { "controlId": "CIP-007-6-4.2", "title": "CIP-007-6-4.2 — Generate alerts for security events that the Responsible Entity determines necessitates an alert, that includes, as a...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1a7c6c45-a195-590d-ac93-ffc36a9b1e4d", "isPublic": true }, { "controlId": "CIP-007-6-4.2.1", "title": "CIP-007-6-4.2.1 — Detected malicious code from Part 4.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "16d34763-f060-567b-8180-32703474d039", "isPublic": true }, { "controlId": "CIP-007-6-4.2.2", "title": "CIP-007-6-4.2.2 — Detected failure of Part 4.1 event logging.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3d1bb051-e10a-525b-b8a9-87bf16ebdc08", "isPublic": true }, { "controlId": "CIP-007-6-4.3", "title": "CIP-007-6-4.3 — Where technically feasible, retain applicable event logs identified in Part 4.1 for at least the last 90 consecutive...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "deb2611f-6e3b-5414-82ac-4e8eeaa74967", "isPublic": true }, { "controlId": "CIP-007-6-4.4", "title": "CIP-007-6-4.4 — Review a summarization or sampling of logged events as determined by the Responsible Entity at intervals no greater t...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "31f96ee1-d2e6-557f-965d-7cb1d15b577c", "isPublic": true }, { "controlId": "CIP-010-4-R2", "title": "CIP-010-4-R2 — Configuration Monitoring for Unauthorized Changes", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c679dc9a-5cab-5504-8689-24bb37ea1368", "isPublic": true }, { "controlId": "CIP-010-4-2.1", "title": "CIP-010-4-2.1 — Monitor at least once every 35 calendar days for changes to the baseline configuration (as described in Requirement R...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "fd87ae8e-200e-59b5-904c-65e3856601e6", "isPublic": true }, { "controlId": "CIP-015-1-R1", "title": "CIP-015-1-R1 — Internal Network Security Monitoring (INSM) Processes", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "09ae6790-66ca-5580-ba90-065657503d66", "isPublic": true }, { "controlId": "CIP-015-1-1.1", "title": "CIP-015-1-1.1 — Implement, using a risk-based rationale, network data feed(s) to monitor network activity", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-015-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "16531620-71f2-59e2-8291-c0c131a40c05", "isPublic": true }, { "controlId": "CIP-015-1-1.2", "title": "CIP-015-1-1.2 — Implement one or more method(s) to detect anomalous network activity using the network data feed(s) from Part 1.1.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-015-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6a4e780a-9eaa-51d8-bafa-98f57c2bbc79", "isPublic": true }, { "controlId": "CIP-015-1-1.3", "title": "CIP-015-1-1.3 — Implement one or more method(s) to evaluate anomalous network activity detected in Part 1.2", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-015-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "76c1a5ee-769c-5ef3-aedd-d52a010b6824", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "aced2dbe-1082-5414-b0d8-984768cbbaf1", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "b6dc1687-d967-5854-a298-7f32a13a9c4e", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "932dd97d-3772-506b-a328-62c71641edec", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "d508f02c-d2f2-5228-9ea6-66e97f45bbd7", "isPublic": true } ], "id": 31149, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73098", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73098", "catalogueId": 1062, "uuid": "655c985a-2dd8-51a1-88b1-fffe4c893dd0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of enterprise-wide monitoring controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Continuous Monitoring", "description": "

Control Description

Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.

Evidence Request List (ERL)

E-MON-01\nE-MON-06\nE-MON-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.\n▪ Generating event logs and the review of those event logs is narrowly-focused to business-critical Technology Assets, Applications, Services and/or Data (TAASD).

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to facilitate the implementation of enterprise-wide monitoring controls.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4, A.4.1, A.4.1.2, A.4.2.4, B.1.18, B.2.1, B.5.2, C.3.4
NERC-CIP (2026) Requirements: CIP-007-6-R4, CIP-010-4-R2, CIP-015-1-R1", "controlId": "MON-01", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-01", "references": "

Micro-Small Business (<10 staff)

∙ Centralized event logging\n∙ Managed Security Services Provider (MSSP)\n∙ Cloud-native SIEM (e.g., Microsoft Sentinel free tier, Elastic SIEM free)

Small Business (10-49 staff)

∙ Centralized event logging\n∙ Managed Security Services Provider (MSSP)\n∙ Cloud SIEM (e.g., Microsoft Sentinel, Elastic SIEM, Sumo Logic)

Medium Business (50-249 staff)

∙ Centralized event logging\n∙ Security Incident Event Management (SIEM) (e.g., Splunk, Microsoft Sentinel, IBM QRadar)\n∙ Managed Security Services Provider (MSSP)\n∙ Security Operations Center (SOC)

Large Business (250-999 staff)

∙ Centralized event logging\n∙ Security Incident Event Management (SIEM) (e.g., Splunk, Microsoft Sentinel, IBM QRadar)\n∙ Managed Security Services Provider (MSSP)\n∙ Security Operations Center (SOC) with 24/7 coverage

Enterprise (>1,000 staff)

∙ Enterprise SIEM platform (e.g., Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel)\n∙ 24/7 Security Operations Center (SOC)\n∙ Security Orchestration, Automation & Response (SOAR)\n∙ Threat intelligence integration\n∙ Managed Detection & Response (MDR) or in-house SOC", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70366, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590199", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590199", "securityControlId": 31150, "ccis": [], "uuid": "5ee0f4d9-8e23-5ccd-8013-3ceb4e39fb0a", "testId": "MON-01.1_A01", "test": "visibility into network traffic at external system interfaces is provided to optimize the effectiveness of monitoring devices.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(25)[01]", "defaultText": null }, { "id": 70367, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590199", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590199", "securityControlId": 31150, "ccis": [], "uuid": "59257c2e-4bb3-5e29-9e84-5b01d1556254", "testId": "MON-01.1_A02", "test": "visibility into network traffic at key internal system interfaces is provided to optimize the effectiveness of monitoring devices.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(25)[02]", "defaultText": null }, { "id": 70368, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590199", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590199", "securityControlId": 31150, "ccis": [], "uuid": "ebf20639-473a-5083-ba01-6a0d4030d397", "testId": "MON-01.1_A03", "test": "individual intrusion detection tools are connected to a system-wide intrusion detection system.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_SI-04(01)[01]", "defaultText": null }, { "id": 70369, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590199", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590199", "securityControlId": 31150, "ccis": [], "uuid": "87dc376b-a7a6-5f84-a12d-bfdb802180e6", "testId": "MON-01.1_A04", "test": "individual intrusion detection tools are configured into a system-wide intrusion detection system.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_SI-04(01)[02]", "defaultText": null } ], "externalMappings": [ { "id": 562318, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583672", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bf9766e-d681-5eb6-9b8e-5d3358693692", "parentControlId": 31150, "controlId": "8.16", "title": "8.16", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583672" }, { "id": 562321, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b11bede8-2f52-5813-b51b-607f1ad24eb9", "parentControlId": 31150, "controlId": "SI-4(1)", "title": "SI-4(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583673" }, { "id": 562322, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c218e4f-5a4a-533a-8f87-fdc6be9f8c57", "parentControlId": 31150, "controlId": "SI-04(01)", "title": "SI-04(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583673" }, { "id": 562323, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be682e2d-99ed-5738-9c93-da5e1ce40280", "parentControlId": 31150, "controlId": "SI-04(25)", "title": "SI-04(25)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583673" }, { "id": 562325, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "814547a7-0e58-542a-b9d6-2a1539c8a69e", "parentControlId": 31150, "controlId": "SI-04(01)", "title": "SI-04(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583673" }, { "id": 562326, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e89591c-6c8d-5b48-a825-ad6966d887bd", "parentControlId": 31150, "controlId": "SI-04(25)", "title": "SI-04(25)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583673" }, { "id": 562329, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583674", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93e96e97-5e84-5f86-9e3b-ac58044b06c2", "parentControlId": 31150, "controlId": "03.13.01.a", "title": "03.13.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583674" }, { "id": 562331, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583674", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa181d6c-54c2-5528-8bbe-fbc5d6b1d018", "parentControlId": 31150, "controlId": "DE.CM-01", "title": "DE.CM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583674" }, { "id": 562358, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01261208-7cee-5079-b2e5-29b3afcb00e8", "parentControlId": 31150, "controlId": "§117.15(d)(2)", "title": "§117.15(d)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583677" }, { "id": 562359, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6d1a29e-3699-557b-b76e-d3ef3e702932", "parentControlId": 31150, "controlId": "§117.15(d)(2)(i)", "title": "§117.15(d)(2)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583677" }, { "id": 562360, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9cd43c3-dbe4-5725-a443-98eadda41373", "parentControlId": 31150, "controlId": "§117.15(d)(2)(i)(A)", "title": "§117.15(d)(2)(i)(A)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583677" }, { "id": 562361, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc94e522-616c-5c81-bfbe-3a3f1d8e1a07", "parentControlId": 31150, "controlId": "§117.15(d)(2)(i)(B)", "title": "§117.15(d)(2)(i)(B)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583677" }, { "id": 562362, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa065bad-1272-5dda-9aa3-b256044d6595", "parentControlId": 31150, "controlId": "§117.15(d)(2)(i)(C)", "title": "§117.15(d)(2)(i)(C)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583677" }, { "id": 562363, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e31a980-6851-5aed-91f7-73f6c26c8b31", "parentControlId": 31150, "controlId": "§117.15(d)(2)(i)(D)", "title": "§117.15(d)(2)(i)(D)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583677" }, { "id": 562364, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db0fa3bd-ee58-5187-9728-20d5a3450b05", "parentControlId": 31150, "controlId": "§117.15(d)(2)(i)(E)", "title": "§117.15(d)(2)(i)(E)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583677" }, { "id": 562365, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f530282f-ad41-56ba-bac7-ba94a01a677e", "parentControlId": 31150, "controlId": "§117.15(d)(2)(ii)", "title": "§117.15(d)(2)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583678" }, { "id": 562366, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ae9af27-4f42-5410-b11b-e433c3e41f08", "parentControlId": 31150, "controlId": "§117.15(d)(2)(iii)", "title": "§117.15(d)(2)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583678" }, { "id": 562367, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6b89b66-a887-54ef-92ee-bf4678a0ad61", "parentControlId": 31150, "controlId": "§117.15(d)(2)(iv)", "title": "§117.15(d)(2)(iv)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583678" }, { "id": 562368, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d67e309-3511-5e8f-b442-fd54abe0c964", "parentControlId": 31150, "controlId": "§117.15(d)(2)(v)", "title": "§117.15(d)(2)(v)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583678" }, { "controlId": "B.1.20", "title": "B.1.20 — Proprietary Protocol Visibility", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-4, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a94edcdd-008d-518f-a707-e142361c50c8", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.20", "title": "NEI 08-09 App D.1.20 — Proprietary Protocol Visibility", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.20", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "b4b768c7-deee-572c-bf1d-5be96ccecaee", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.20", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "2776f41d-f7fc-5b89-8612-9fb13a9a5c29", "isPublic": true }, { "controlId": "B.5.2", "title": "B.5.2 — Host Intrusion Detection System", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "554fb651-a8ce-5244-a973-303bb93e5f68", "isPublic": true }, { "controlId": "NEI 08-09 App D.5.2", "title": "NEI 08-09 App D.5.2 — Host Intrusion Detection System", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.5.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "775cb4dd-9ef4-5d2f-943d-4bb725f77024", "isPublic": true }, { "controlId": "C.3.4", "title": "C.3.4 — Monitoring Tools and Techniques", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1e9dc182-6b46-5ed5-9802-8181fa7ab5af", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.4", "title": "NEI 08-09 App E.3.4 — Monitoring Tools and Techniques", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "705c1617-fac8-534f-b0e7-bb8dd07bbbf8", "isPublic": true }, { "controlId": "CIP-015-1-R1", "title": "CIP-015-1-R1 — Internal Network Security Monitoring (INSM) Processes", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d20f9901-7443-5164-88a0-52f488624b3c", "isPublic": true }, { "controlId": "CIP-015-1-1.1", "title": "CIP-015-1-1.1 — Implement, using a risk-based rationale, network data feed(s) to monitor network activity", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-015-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4e760665-b550-5c7d-ba92-4f6a71581ae6", "isPublic": true }, { "controlId": "CIP-015-1-1.2", "title": "CIP-015-1-1.2 — Implement one or more method(s) to detect anomalous network activity using the network data feed(s) from Part 1.1.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-015-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "744cd8eb-5363-5002-b7a8-445052783fd1", "isPublic": true }, { "controlId": "CIP-015-1-1.3", "title": "CIP-015-1-1.3 — Implement one or more method(s) to evaluate anomalous network activity detected in Part 1.2", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-015-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "62cedc7c-ec03-595f-9d79-569a05b33e81", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "9c415f18-ae00-5ee7-af8c-368b820d92bf", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "fa4343de-0306-5083-bff0-f7583ebc78dc", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "8d0cc4fc-a7ad-5e66-8afb-a044752e38b3", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "3b66dbbf-3a4a-5c0f-b54b-993999aaad66", "isPublic": true } ], "id": 31150, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730981", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730981", "catalogueId": 1062, "uuid": "8c816fb3-287a-55a1-b25c-4f302a68aef5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement Intrusion Detection / Prevention Systems (IDS / IPS) technologies on critical systems, key network segments and network choke points?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Intrusion Detection & Prevention Systems (IDS & IPS)", "description": "

Control Description

Mechanisms exist to implement Intrusion Detection / Prevention Systems (IDS / IPS) technologies on critical systems, key network segments and network choke points.

Evidence Request List (ERL)

E-MON-01\nE-MON-06\nE-MON-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to implement Intrusion Detection / Prevention Systems (IDS / IPS) technologies on critical systems, key network segments and network choke points.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.20, B.5.2, C.3.4
NERC-CIP (2026) Requirements: CIP-015-1-R1", "controlId": "MON-01.1", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Intrusion Detection / Prevention Systems (IDS/IPS)\n∙ Next-Generation Firewall (NGFW) with IPS (e.g., Fortinet FortiGate, Palo Alto)

Small Business (10-49 staff)

∙ Intrusion Detection / Prevention Systems (IDS/IPS)\n∙ Next-Generation Firewall (NGFW) with built-in IPS (e.g., Fortinet, Palo Alto)

Medium Business (50-249 staff)

∙ Intrusion Detection / Prevention Systems (IDS/IPS)\n∙ Next-Generation Firewall (NGFW) with IPS\n∙ Extended Detection and Response (XDR) (e.g., CrowdStrike Falcon, SentinelOne, Microsoft Defender XDR)

Large Business (250-999 staff)

∙ Intrusion Detection / Prevention Systems (IDS/IPS)\n∙ Extended Detection and Response (XDR) (e.g., CrowdStrike Falcon, Palo Alto Cortex XDR)\n∙ Network Detection and Response (NDR) (e.g., Darktrace, ExtraHop)

Enterprise (>1,000 staff)

∙ Enterprise IDS/IPS integrated with SIEM\n∙ Extended Detection and Response (XDR) (e.g., CrowdStrike Falcon, Palo Alto Cortex XDR)\n∙ Network Detection and Response (NDR) (e.g., Darktrace, ExtraHop, Vectra AI)\n∙ AI-driven anomaly detection", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70370, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590199", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590199", "securityControlId": 31151, "ccis": [], "uuid": "afba1cae-32ff-5ee6-b227-ae36fba1231f", "testId": "MON-01.2_A01", "test": "automated tools and mechanisms are employed to support a near real-time analysis of events.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(02)", "defaultText": null } ], "externalMappings": [ { "id": 562406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583682", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "153ff2f1-d7d0-5dc0-b820-bbd48a6caea9", "parentControlId": 31151, "controlId": "8.16", "title": "8.16", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583682" }, { "id": 562410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "953dab6d-68df-5d57-bee3-6cf911f7e026", "parentControlId": 31151, "controlId": "SI-4(2)", "title": "SI-4(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583683" }, { "id": 562411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32f61c19-c125-56c4-af6d-c0b6c9268180", "parentControlId": 31151, "controlId": "SC-48", "title": "SC-48", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583683" }, { "id": 562412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85048205-3043-5770-9b98-6fd523749432", "parentControlId": 31151, "controlId": "SI-04(02)", "title": "SI-04(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583683" }, { "id": 562414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21f0caab-4fb5-53fe-b270-144cccc5b6af", "parentControlId": 31151, "controlId": "SI-04(02)", "title": "SI-04(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583683" }, { "id": 562415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec29896e-36cb-526d-8916-6a63df26a9a8", "parentControlId": 31151, "controlId": "SC-48", "title": "SC-48", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583683" }, { "id": 562416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48ed98a5-ecf2-5d47-a29d-b1def1618080", "parentControlId": 31151, "controlId": "SI-04(02)", "title": "SI-04(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583684" }, { "id": 562417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d01e9bb-9b9b-5a20-8777-c24658e7de8e", "parentControlId": 31151, "controlId": "SI-04(02)", "title": "SI-04(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583684" }, { "id": 562418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "609a2318-5950-5351-a36c-586a3b8cd088", "parentControlId": 31151, "controlId": "SI-04(02)", "title": "SI-04(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583684" }, { "id": 562438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d929af35-2ff0-5ed8-b000-bf39390e475a", "parentControlId": 31151, "controlId": "RESPONSE-1d", "title": "RESPONSE-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583686" }, { "controlId": "C.3.4", "title": "C.3.4 — Monitoring Tools and Techniques", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "4a2087b6-af41-5573-8415-13a2008b88eb", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.4", "title": "NEI 08-09 App E.3.4 — Monitoring Tools and Techniques", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "ee5faba0-4b53-5dc1-92ac-b424be09de8b", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.3.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "fff2482e-96de-5757-83f1-cf876636a46d", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "6bde181c-c657-5154-bb02-74c6a474af50", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "160c724f-9805-55c4-8635-35bcc60d0df5", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "b3984c27-0d99-537f-91ad-8b8052bb5941", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "ebebca6c-8d23-5e90-931c-3aebb8febff7", "isPublic": true } ], "id": 31151, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730981", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730981", "catalogueId": 1062, "uuid": "7fbcd177-5d23-5cbb-82ef-8836c7d789fa", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support near real-time analysis and incident escalation?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Automated Tools for Real-Time Analysis", "description": "

Control Description

Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support near real-time analysis and incident escalation.

Evidence Request List (ERL)

E-MON-01\nE-MON-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A log aggregator, or similar automated tool, provides an event log report generation capability to aid in detecting and assessing anomalous activities on business-critical TAASD.\n▪ IT and/or cybersecurity personnel configure alerts for critical or sensitive data that is stored, transmitted and processed on assets.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support near real-time analysis and incident escalation.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.3.4", "controlId": "MON-01.2", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-01.2", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)\n∙ Cloud SIEM with automated alerting (e.g., Microsoft Sentinel, Elastic SIEM)

Small Business (10-49 staff)

∙ Managed Security Services Provider (MSSP)\n∙ Cloud SIEM (e.g., Microsoft Sentinel, Sumo Logic)\n∙ Automated alert rules for common attack patterns

Medium Business (50-249 staff)

∙ Security Incident Event Management (SIEM) (e.g., Splunk, Microsoft Sentinel, IBM QRadar)\n∙ Security Orchestration, Automation & Response (SOAR) (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ Extended Detection and Response (XDR)

Large Business (250-999 staff)

∙ SIEM with automated analytics (e.g., Splunk, Microsoft Sentinel)\n∙ Security Orchestration, Automation & Response (SOAR) (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ Extended Detection and Response (XDR)\n∙ User and Entity Behavior Analytics (UEBA)

Enterprise (>1,000 staff)

∙ Enterprise SIEM with AI/ML-driven analytics (e.g., Splunk ES, IBM QRadar with AI)\n∙ SOAR platform for automated response (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ XDR / MDR platform\n∙ UEBA integrated with SIEM\n∙ Threat hunting capability", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70371, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5902", "securityControlId": 31152, "ccis": [], "uuid": "800ed975-3194-53a8-8823-f7bf13ab8c5a", "testId": "MON-01.3_A01", "test": "criteria for unusual or unauthorized activities or conditions for inbound communications traffic are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(04)(a)[01]", "defaultText": null }, { "id": 70372, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5902", "securityControlId": 31152, "ccis": [], "uuid": "8c87096d-7bba-575e-b99f-1253664b4a72", "testId": "MON-01.3_A02", "test": "criteria for unusual or unauthorized activities or conditions for outbound communications traffic are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(04)(a)[02]", "defaultText": null }, { "id": 70373, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5902", "securityControlId": 31152, "ccis": [], "uuid": "92067dc1-37b6-51b3-8011-f98b15607260", "testId": "MON-01.3_A03", "test": "unusual or unauthorized activities or conditions that are to be monitored in outbound communications traffic are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(04)_ODP[04]", "defaultText": null }, { "id": 70374, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5902", "securityControlId": 31152, "ccis": [], "uuid": "c1d5257e-cdbc-5c65-8121-4ce03790ac7a", "testId": "MON-01.3_A04", "test": "inbound communications traffic is monitored to detect unusual or unauthorized activities or conditions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.14.6[b]\n171A_R3_A.03.14.06.c[01]", "defaultText": null }, { "id": 70375, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5902", "securityControlId": 31152, "ccis": [], "uuid": "7cd1ef81-3416-5850-913c-5b967164669e", "testId": "MON-01.3_A05", "test": "outbound communications traffic is monitored to detect unusual or unauthorized activities or conditions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.14.6[c]\n171A_R3_A.03.14.06.c[02]", "defaultText": null }, { "id": 70376, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5902", "securityControlId": 31152, "ccis": [], "uuid": "6417d752-53a6-5628-b63e-b596ec4231e3", "testId": "MON-01.3_A06", "test": "anomalous or suspicious behavior is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "172A_3.14.2e[a]", "defaultText": null }, { "id": 70377, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5902", "securityControlId": 31152, "ccis": [], "uuid": "cf6e0ddd-adf4-5d44-822e-2c4c22b1430b", "testId": "MON-01.3_A07", "test": "systems, applications and services are monitored to detect attacks and indicators of potential attacks.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.14.6[a]", "defaultText": null }, { "id": 70378, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5902", "securityControlId": 31152, "ccis": [], "uuid": "d770d96f-64b4-5058-9be6-ddd69b46a132", "testId": "MON-01.3_A08", "test": "communications at external managed interfaces to the system are monitored.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.13.01.a[01]\n53A_R5_SI-04(04)(b)[01]\n53A_R5_SI-04(04)_ODP[02]", "defaultText": null }, { "id": 70379, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5902", "securityControlId": 31152, "ccis": [], "uuid": "5d35884a-7019-5149-b4fd-f6b55d56ed07", "testId": "MON-01.3_A09", "test": "communications at key internal managed interfaces within the system are monitored.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.13.01.a[03]\n53A_R5_SI-04(04)(b)[02]\n53A_R5_SI-04(04)_ODP[03]", "defaultText": null }, { "id": 70380, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590201", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590201", "securityControlId": 31152, "ccis": [], "uuid": "5ef77f8d-e9ff-5872-9175-fa3510ce418f", "testId": "MON-01.3_A10", "test": "the frequency at which to monitor inbound communications traffic for unusual or unauthorized activities or conditions is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: continuous", "otherId": "53A_R5_SI-04(04)_ODP[01]", "defaultText": null } ], "externalMappings": [ { "id": 562480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c57d1ba8-fbe5-5a0c-ae38-9d8b521f64d4", "parentControlId": 31152, "controlId": "ORG 2.2(b)", "title": "ORG 2.2(b)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583691" }, { "id": 562481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "540064da-45fb-509b-9fa1-0a5dbbc97d28", "parentControlId": 31152, "controlId": "8.16", "title": "8.16", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583691" }, { "id": 562485, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51098168-64fe-52cb-8bd8-bcd48a233dbb", "parentControlId": 31152, "controlId": "SI-4(4)", "title": "SI-4(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583691" }, { "id": 562486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97d72ba7-ecfe-5998-a2a2-3333183e3cf5", "parentControlId": 31152, "controlId": "SI-04(04)", "title": "SI-04(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583692" }, { "id": 562487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f509ce6-8656-58aa-91e6-eabe80ca9c5b", "parentControlId": 31152, "controlId": "SI-04(04)", "title": "SI-04(04)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583692" }, { "id": 562488, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84bcb2df-9a23-507f-aba8-b82091c0e3a8", "parentControlId": 31152, "controlId": "SI-04(04)", "title": "SI-04(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583692" }, { "id": 562489, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7af66422-ef56-5ede-93d5-15ad1c621c15", "parentControlId": 31152, "controlId": "SI-04(04)", "title": "SI-04(04)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583692" }, { "id": 562490, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7061306c-4cf7-5462-bf40-809faa34cb18", "parentControlId": 31152, "controlId": "SI-04(04)", "title": "SI-04(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583692" }, { "id": 562492, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583701", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bbe2d32-e934-520d-8d5a-27e22605f43f", "parentControlId": 31152, "controlId": "3.14.6", "title": "3.14.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583701" }, { "id": 562493, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583701", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "458bbb22-e9d0-5516-aa69-2c84780ac974", "parentControlId": 31152, "controlId": "03.13.01.a", "title": "03.13.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583701" }, { "id": 562494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583701", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbd51a10-e56d-55cf-a03b-b1e1c0909a2c", "parentControlId": 31152, "controlId": "03.14.06.c", "title": "03.14.06.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583701" }, { "id": 562502, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583702", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65777094-6c87-5b96-aa29-6ad8bbbae957", "parentControlId": 31152, "controlId": "DE.CM-01", "title": "DE.CM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583702" }, { "id": 562509, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2d81498-41a2-5389-8c22-f0ee58c65684", "parentControlId": 31152, "controlId": "SITUATION-2b", "title": "SITUATION-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583703" }, { "controlId": "B.1.18", "title": "B.1.18 — Insecure and Rogue Connections", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, CA-9, SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "2f31263e-c4d3-5830-9a17-eaf181925957", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.18", "title": "NEI 08-09 App D.1.18 — Insecure and Rogue Connections", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.18", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "8d242b62-e154-5148-b248-9bacf41c6f8d", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.18", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "c5b2b1ab-544a-5d03-b05a-9b434c07694f", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec6", "title": "CIP-003-9-Attachment1-Sec6", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2899ab87-d907-5663-988c-0fc87e3e718e", "isPublic": true }, { "controlId": "CIP-015-1-R1", "title": "CIP-015-1-R1 — Internal Network Security Monitoring (INSM) Processes", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "52a54c00-66d1-5c61-82ea-9fbe5350b6b9", "isPublic": true }, { "controlId": "CIP-015-1-1.1", "title": "CIP-015-1-1.1 — Implement, using a risk-based rationale, network data feed(s) to monitor network activity", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-015-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8e8b4498-1f91-5d59-96fd-23f9ea594b79", "isPublic": true }, { "controlId": "CIP-015-1-1.2", "title": "CIP-015-1-1.2 — Implement one or more method(s) to detect anomalous network activity using the network data feed(s) from Part 1.1.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-015-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e67ba2d6-a1c6-5d0c-9521-1bebd24d07cc", "isPublic": true }, { "controlId": "CIP-015-1-1.3", "title": "CIP-015-1-1.3 — Implement one or more method(s) to evaluate anomalous network activity detected in Part 1.2", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-015-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "da8b4a2b-886b-58fb-880d-f910c120d318", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d2c47322-995e-558d-a480-17c10f1c3e69", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "f0ba43e6-546a-5b67-9f86-ae06e7ab86e2", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "3ac46968-d5b4-52fc-a340-5dd412e6bd66", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "e445ea2d-59f6-5e86-a78a-38ce095f469f", "isPublic": true } ], "id": 31152, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730981", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730981", "catalogueId": 1062, "uuid": "6b650e04-f348-5ec0-af9e-8ed2b91ce574", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization continuously monitor inbound and outbound communications traffic for unusual or unauthorized activities or conditions?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Inbound & Outbound Communications Traffic", "description": "

Control Description

Mechanisms exist to continuously monitor inbound and outbound communications traffic for unusual or unauthorized activities or conditions.

Evidence Request List (ERL)

E-MON-01\nE-MON-06\nE-MON-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.\n▪ Generating event logs and the review of those event logs is narrowly-focused to business-critical Technology Assets, Applications, Services and/or Data (TAASD).

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to continuously monitor inbound and outbound communications traffic for unusual or unauthorized activities or conditions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.18
NERC-CIP (2026) Requirements: CIP-015-1-R1", "controlId": "MON-01.3", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-01.3", "references": "

Micro-Small Business (<10 staff)

∙ Intrusion Detection / Prevention Systems (IDS / IPS)

Small Business (10-49 staff)

∙ Intrusion Detection / Prevention Systems (IDS / IPS)

Medium Business (50-249 staff)

∙ Intrusion Detection / Prevention Systems (IDS / IPS)\n∙ Extended Detection and Response (XDR)

Large Business (250-999 staff)

∙ Intrusion Detection / Prevention Systems (IDS / IPS)\n∙ Extended Detection and Response (XDR)

Enterprise (>1,000 staff)

∙ Intrusion Detection / Prevention Systems (IDS / IPS)\n∙ Extended Detection and Response (XDR)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70381, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590201", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590201", "securityControlId": 31153, "ccis": [], "uuid": "2c4b26e0-0e16-51ce-9346-2054cc3cf160", "testId": "MON-01.4_A01", "test": "audit records contain information that establishes what type of event occurred.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.03.02.a.01", "defaultText": null }, { "id": 70382, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590201", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590201", "securityControlId": 31153, "ccis": [], "uuid": "3e2ef3f7-eefc-5c95-b866-fab3d0dd0a2a", "testId": "MON-01.4_A02", "test": "audit records for the selected event types and audit record content are generated.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70383, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590201", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590201", "securityControlId": 31153, "ccis": [], "uuid": "dfdd6561-cb89-50a2-8f4e-5cec1c2c9aa4", "testId": "MON-01.4_A03", "test": "personnel or roles to be alerted when indications of compromise or potential compromise occur is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(05)_ODP[01]", "defaultText": null }, { "id": 70384, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590201", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590201", "securityControlId": 31153, "ccis": [], "uuid": "858fbe22-a022-554e-ae10-8bc00adebf28", "testId": "MON-01.4_A04", "test": "compromise indicators are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(05)_ODP[02]", "defaultText": null }, { "id": 70385, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590201", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590201", "securityControlId": 31153, "ccis": [], "uuid": "25690cbe-b57f-5a81-a8f6-9d18d5517829", "testId": "MON-01.4_A05", "test": "personnel or roles are alerted when system-generated compromise indicators occur.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(05)", "defaultText": null }, { "id": 70386, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590202", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590202", "securityControlId": 31153, "ccis": [], "uuid": "644eb8c8-199b-5cbd-81f5-bd57407d247e", "testId": "MON-01.4_A06", "test": "audit records for the selected event types and audit record content specified in 03.03.01 and 03.03.02 are generated.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.03.03.a", "defaultText": null } ], "externalMappings": [ { "id": 562547, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583708", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "026195d0-f9e8-5343-9de3-f0511ab70829", "parentControlId": 31153, "controlId": "EVENT 1.4", "title": "EVENT 1.4", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583708" }, { "id": 562548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583708", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db6b3209-aa4d-53e8-9465-520db5be37af", "parentControlId": 31153, "controlId": "SR 2.8", "title": "SR 2.8", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583708" }, { "id": 562549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583708", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "551b34bf-dff5-58ab-8f64-20ce78f98945", "parentControlId": 31153, "controlId": "CR 2.8", "title": "CR 2.8", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583708" }, { "id": 562551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583709", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10cb6954-43f9-5b34-8e05-3a68e33cd187", "parentControlId": 31153, "controlId": "8.15", "title": "8.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583709" }, { "id": 562556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583709", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ea46dd3-4d32-5cee-ba59-941430263a4b", "parentControlId": 31153, "controlId": "SI-4(5)", "title": "SI-4(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583709" }, { "id": 562557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583709", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21197865-3065-5355-b3c5-92e51b1a37ac", "parentControlId": 31153, "controlId": "SI-04(05)", "title": "SI-04(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583709" }, { "id": 562558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8dca8f0-bfac-563b-9966-f77d2c2497d6", "parentControlId": 31153, "controlId": "SI-04(05)", "title": "SI-04(05)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58371" }, { "id": 562560, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ebd5362-098b-505a-a610-ad685c658d7b", "parentControlId": 31153, "controlId": "SI-04(05)", "title": "SI-04(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58371" }, { "id": 562561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc2b214c-a154-5c0a-ac57-261a62f187f1", "parentControlId": 31153, "controlId": "SI-04(05)", "title": "SI-04(05)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58371" }, { "id": 562562, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f65048f6-b4c1-5932-a375-67892d5ab6e9", "parentControlId": 31153, "controlId": "SI-04(05)", "title": "SI-04(05)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58371" }, { "id": 562563, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fce037de-d9d2-57b1-a3d3-b7c39dc5e187", "parentControlId": 31153, "controlId": "NFO - SI-4(5)", "title": "NFO - SI-4(5)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58371" }, { "id": 562564, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22347d6a-1984-5bab-9a30-d2a8198dca67", "parentControlId": 31153, "controlId": "03.03.01.a", "title": "03.03.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58371" }, { "id": 562565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d61269de-b5e3-5ec6-971b-741f66704d03", "parentControlId": 31153, "controlId": "03.03.03.a", "title": "03.03.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58371" }, { "id": 562566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64f7dbb7-e520-5bcf-a34e-cf1f470d5c0c", "parentControlId": 31153, "controlId": "03.14.06.a.01", "title": "03.14.06.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583711" }, { "id": 562567, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae4e1036-35e1-5aec-b4eb-9a7e910aefa1", "parentControlId": 31153, "controlId": "03.14.06.b", "title": "03.14.06.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583711" }, { "id": 562568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0150127b-5563-50a3-8bd1-d7f4daa26005", "parentControlId": 31153, "controlId": "03.14.06.c", "title": "03.14.06.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583711" }, { "id": 562572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7c10501-69a0-5fac-8fb5-9d5329cb0eeb", "parentControlId": 31153, "controlId": "PR.PS-04", "title": "PR.PS-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583711" }, { "id": 562573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23fc97cd-3406-53e3-978c-24da9546cd32", "parentControlId": 31153, "controlId": "DE.CM-01", "title": "DE.CM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583711" }, { "id": 562611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f9ce3c9-303d-5f9e-90eb-554e2f97f3c5", "parentControlId": 31153, "controlId": "SITUATION-1a", "title": "SITUATION-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583716" }, { "id": 562612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d75fc601-9729-5ca6-afbb-e491938f79d6", "parentControlId": 31153, "controlId": "SITUATION-1b", "title": "SITUATION-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583716" }, { "id": 562613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "729406e8-de3c-5308-b984-26cd21a41802", "parentControlId": 31153, "controlId": "SITUATION-1c", "title": "SITUATION-1c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583716" }, { "id": 562614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94b2479e-f0da-5882-b5f7-0415f2037301", "parentControlId": 31153, "controlId": "SITUATION-1d", "title": "SITUATION-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583716" }, { "id": 562615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc3f1e74-e83b-5480-b947-605c5f4f7a87", "parentControlId": 31153, "controlId": "SITUATION-1f", "title": "SITUATION-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583716" }, { "id": 562616, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e037fa7-6124-5de6-9b06-cb23eacbd1ef", "parentControlId": 31153, "controlId": "SITUATION-2e", "title": "SITUATION-2e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583716" }, { "id": 562628, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583718", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c36460d-a070-5bdf-a09e-96184fe268f5", "parentControlId": 31153, "controlId": "CIP-007-6 4.1", "title": "CIP-007-6 4.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583718" }, { "id": 562629, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583718", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fef0dddf-09e7-582d-a99f-74a4ecd41616", "parentControlId": 31153, "controlId": "CIP-007-6 4.2", "title": "CIP-007-6 4.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583718" }, { "id": 562641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583719", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "923fdd24-ac3b-53de-b070-2030e7447fa1", "parentControlId": 31153, "controlId": "C1.a", "title": "C1.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583719" }, { "id": 562642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583719", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06d72306-274d-591f-9d15-491221c2cfb9", "parentControlId": 31153, "controlId": "C1.c", "title": "C1.c", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583719" } ], "id": 31153, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730982", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730982", "catalogueId": 1062, "uuid": "bbd7a1a9-4434-5caf-9bb7-8d9462309acc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization generate, monitor, correlate and respond to alerts from physical, cybersecurity, data protection and supply chain activities to achieve integrated situational awareness?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 7.0, "title": "System Generated Alerts", "description": "

Control Description

Mechanisms exist to generate, monitor, correlate and respond to alerts from physical, cybersecurity, data protection and supply chain activities to achieve integrated situational awareness.

Evidence Request List (ERL)

E-END-03\nE-MON-01\nE-MON-06\nE-MON-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ SBC enforce logging to link system access to individual users or service accounts using a non-repudiation capability to protect against an individual falsely denying having performed a particular action.\n▪ SBC enforce local security event logging and forward those logs to a centralized log repository to provide an alternate audit capability in the event of a failure in the primary audit capability.\n▪ A log aggregator, or similar automated tool, provides an event log report generation capability to aid in detecting and assessing anomalous activities on business-critical TAASD.\n▪ IT and/or cybersecurity personnel configure alerts for critical or sensitive data that is stored, transmitted and processed on assets.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to generate, monitor, correlate and respond to alerts from physical, cybersecurity, data protection and supply chain activities to achieve integrated situational awareness.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-01.4", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-01.4", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70387, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590204", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590204", "securityControlId": 31154, "ccis": [], "uuid": "1f8c098d-1b2f-556c-b39b-562edc5112b6", "testId": "MON-01.5_A01", "test": "a wireless intrusion detection system is employed to detect potential compromises or breaches.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(14)[03]", "defaultText": null }, { "id": 70388, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590205", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590205", "securityControlId": 31154, "ccis": [], "uuid": "c482fe3b-47c7-5a7c-9d43-20f38416feb8", "testId": "MON-01.5_A02", "test": "an intrusion detection system is employed to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(15)", "defaultText": null }, { "id": 70389, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590205", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590205", "securityControlId": 31154, "ccis": [], "uuid": "ea44671a-d5cd-570a-a85d-9e7973f6392e", "testId": "MON-01.5_A03", "test": "a wireless intrusion detection system is employed to identify rogue wireless devices.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-04(14)[01]", "defaultText": null }, { "id": 70390, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590205", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590205", "securityControlId": 31154, "ccis": [], "uuid": "d85485dd-2b22-5d5f-9b51-ae87e383335b", "testId": "MON-01.5_A04", "test": "a wireless intrusion detection system is employed to detect attack attempts on the system.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-04(14)[02]", "defaultText": null } ], "externalMappings": [ { "id": 562660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583722", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a88c62d9-944d-52ce-af23-a53d57393930", "parentControlId": 31154, "controlId": "SR 2.2 RE 1", "title": "SR 2.2 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583722" }, { "id": 562661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583722", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea45833c-e636-548a-ac18-0d2c9010e572", "parentControlId": 31154, "controlId": "SI-4(14)", "title": "SI-4(14)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583722" }, { "id": 562662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583722", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a11238c-3f1e-5e5b-98da-2b804438314e", "parentControlId": 31154, "controlId": "SI-4(15)", "title": "SI-4(15)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583722" }, { "id": 562663, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583722", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98dc75ad-e574-5427-80e4-97530f1fe62e", "parentControlId": 31154, "controlId": "SI-04(14)", "title": "SI-04(14)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583722" }, { "id": 562664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583723", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80b66b41-3038-5bf3-88b7-9a270cfde41a", "parentControlId": 31154, "controlId": "SI-04(14)", "title": "SI-04(14)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583723" }, { "id": 562665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583723", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d97967af-bf70-557c-b585-00b0739b5594", "parentControlId": 31154, "controlId": "SI-04(14)", "title": "SI-04(14)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583723" }, { "id": 562666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583723", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13d94317-00fc-5889-b451-b36efeab63ad", "parentControlId": 31154, "controlId": "SI-04(14)", "title": "SI-04(14)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583723" } ], "id": 31154, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730982", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730982", "catalogueId": 1062, "uuid": "1fad8c9a-d118-5ee0-a930-36e7096c7547", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization monitor wireless network segments for:\n(1) Rogue wireless devices; and\n(2) Anomalous and/or hostile activities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Wireless Network Monitoring", "description": "

Control Description

Mechanisms exist to monitor wireless network segments for:\n(1) Rogue wireless devices; and\n(2) Anomalous and/or hostile activities.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to monitor wireless network segments for:\n(1) Rogue wireless devices; and\n(2) Anomalous and/or hostile activities.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-01.5", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-01.5", "references": "

Micro-Small Business (<10 staff)

∙ Wireless Intrusion Detection / Protection Systems (WIDS / WIPS)

Small Business (10-49 staff)

∙ Wireless Intrusion Detection / Protection Systems (WIDS / WIPS)

Medium Business (50-249 staff)

∙ Wireless Intrusion Detection / Protection Systems (WIDS / WIPS)\n∙ Extended Detection and Response (XDR)

Large Business (250-999 staff)

∙ Wireless Intrusion Detection / Protection Systems (WIDS / WIPS)\n∙ Extended Detection and Response (XDR)

Enterprise (>1,000 staff)

∙ Wireless Intrusion Detection / Protection Systems (WIDS / WIPS)\n∙ Extended Detection and Response (XDR)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70391, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590205", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590205", "securityControlId": 31155, "ccis": [], "uuid": "29453eae-cd7c-56e4-a971-3fbc69ba1909", "testId": "MON-01.6_A01", "test": "host-based monitoring mechanisms to be implemented on system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(23)_ODP[01]", "defaultText": null }, { "id": 70392, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590205", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590205", "securityControlId": 31155, "ccis": [], "uuid": "190525b4-4bb2-540f-9188-ca68da765b5f", "testId": "MON-01.6_A02", "test": "system components where host-based monitoring is to be implemented are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(23)_ODP[02]", "defaultText": null }, { "id": 70393, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590206", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590206", "securityControlId": 31155, "ccis": [], "uuid": "d05604b1-d772-5c35-bf32-1819e59b9725", "testId": "MON-01.6_A03", "test": "host-based monitoring mechanisms are implemented on system components.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(23)", "defaultText": null } ], "externalMappings": [ { "id": 562681, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0c45f83-3259-53c2-a3fd-2d82440fd978", "parentControlId": 31155, "controlId": "SI-4(23)", "title": "SI-4(23)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583725" }, { "id": 562682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55101634-11e9-59e6-b172-01780169071e", "parentControlId": 31155, "controlId": "SI-04(23)", "title": "SI-04(23)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583725" }, { "id": 562683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef7faffc-1e6e-53b6-88a8-b7f6fb4cb01b", "parentControlId": 31155, "controlId": "SI-04(23)", "title": "SI-04(23)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583725" } ], "id": 31155, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730982", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730982", "catalogueId": 1062, "uuid": "8fd0c7c7-4775-569e-b710-63c38f0995c3", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS) to actively alert on or block unwanted activities and send logs to a Security Incident Event Manager (SIEM), or similar automated tool, to maintain situational awareness?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Host-Based Devices", "description": "

Control Description

Mechanisms exist to utilize Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS) to actively alert on or block unwanted activities and send logs to a Security Incident Event Manager (SIEM), or similar automated tool, to maintain situational awareness.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to utilize Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS) to actively alert on or block unwanted activities and send logs to a Security Incident Event Manager (SIEM), or similar automated tool, to maintain situational awareness.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-01.6", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-01.6", "references": "

Micro-Small Business (<10 staff)

∙ Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS)

Small Business (10-49 staff)

∙ Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS)

Medium Business (50-249 staff)

∙ Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS) \n∙ Extended Detection and Response (XDR)

Large Business (250-999 staff)

∙ Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS) \n∙ Extended Detection and Response (XDR)

Enterprise (>1,000 staff)

∙ Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS) \n∙ Extended Detection and Response (XDR)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70394, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590206", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590206", "securityControlId": 31156, "ccis": [], "uuid": "59355404-b676-53ae-8205-0187ef29a219", "testId": "MON-01.7_A01", "test": "integrity verification tools are employed to detect unauthorized changes to organization-defined software, firmware and/or information.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-07a.[01]\n53A_R5_SI-07a.[02]\n53A_R5_SI-07a.[03]", "defaultText": null }, { "id": 70395, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590206", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590206", "securityControlId": 31156, "ccis": [], "uuid": "532f604a-46c2-5855-ba67-9ee4a54b1165", "testId": "MON-01.7_A02", "test": "organization-defined actions are taken when unauthorized changes to the software, firmware and/or information, are detected;
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-07b.[01]\n53A_R5_SI-07b.[02]\n53A_R5_SI-07b.[03]", "defaultText": null } ], "externalMappings": [ { "id": 562694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67d16c0f-043b-54f3-a962-9992280d98e2", "parentControlId": 31156, "controlId": "DATA 1.7", "title": "DATA 1.7", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583727" }, { "id": 562695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf380f71-70af-57cb-9a6f-38e57d366d23", "parentControlId": 31156, "controlId": "SR 3.4", "title": "SR 3.4", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583727" }, { "id": 562696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6197b79-2f02-5722-9bb5-61b97470ae50", "parentControlId": 31156, "controlId": "SR 3.4 RE 1", "title": "SR 3.4 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583727" }, { "id": 562697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a640be6f-004d-58ba-a85f-ffaf14cea1d0", "parentControlId": 31156, "controlId": "CR 3.4(2)", "title": "CR 3.4(2)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583727" }, { "id": 562699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a689c1c-588a-522b-97c6-fd9628debabc", "parentControlId": 31156, "controlId": "SI-04(24)", "title": "SI-04(24)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583727" }, { "id": 562702, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1405bee2-4cf8-5f3c-8975-5e0ad269f88c", "parentControlId": 31156, "controlId": "SI-04(24)", "title": "SI-04(24)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583727" }, { "id": 562704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583728", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ac9862a-3e50-5ea7-ad22-ce0fbe3d3816", "parentControlId": 31156, "controlId": "DE.CM-09", "title": "DE.CM-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583728" } ], "id": 31156, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730983", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730983", "catalogueId": 1062, "uuid": "a8d8658d-bf6c-5171-82a6-a2be93618d6e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize a File Integrity Monitor (FIM), or similar change-detection technology, on critical Technology Assets, Applications and/or Services (TAAS) to generate alerts for unauthorized modifications?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "File Integrity Monitoring (FIM)", "description": "

Control Description

Mechanisms exist to utilize a File Integrity Monitor (FIM), or similar change-detection technology, on critical Technology Assets, Applications and/or Services (TAAS) to generate alerts for unauthorized modifications.

Evidence Request List (ERL)

E-MON-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to utilize a File Integrity Monitor (FIM), or similar change-detection technology, on critical Technology Assets, Applications and/or Services (TAAS) to generate alerts for unauthorized modifications.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-01.7", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-01.7", "references": "

Micro-Small Business (<10 staff)

∙ File Integrity Monitoring (FIM) via endpoint security tool (e.g., OSSEC free, Wazuh free)

Small Business (10-49 staff)

∙ File Integrity Monitor (FIM) (e.g., Wazuh free, OSSEC, Tripwire free edition)

Medium Business (50-249 staff)

∙ File Integrity Monitor (FIM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netwrix.com)\n∙ Wazuh (free, open-source) (https://wazuh.com)

Large Business (250-999 staff)

∙ File Integrity Monitor (FIM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netwrix.com)\n∙ Tripwire Enterprise (https://tripwire.com)

Enterprise (>1,000 staff)

∙ Enterprise FIM solution (e.g., Tripwire Enterprise, CimTrak, Qualys FIM)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ FIM integrated with SIEM for real-time alerting\n∙ CIS Control 10 (Malware Defenses) alignment", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70396, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590206", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590206", "securityControlId": 31157, "ccis": [], "uuid": "eb44df28-d1bf-5142-9fe8-091b6157ccb8", "testId": "MON-01.8_A01", "test": "the frequency at which system audit records are reviewed and analyzed is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least weekly", "otherId": "171A_R3_A.03.03.05.ODP[01]", "defaultText": null }, { "id": 70397, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590207", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590207", "securityControlId": 31157, "ccis": [], "uuid": "4130fa02-f84e-574d-8767-300988d3ee48", "testId": "MON-01.8_A02", "test": "system audit records are reviewed and analyzed per an organization-defined frequency for indications and the potential impact of inappropriate or unusual activity.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least weekly", "otherId": "171A_3.3.3[a]\n171A_3.3.3[b]", "defaultText": null }, { "id": 70398, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590207", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590207", "securityControlId": 31157, "ccis": [], "uuid": "bffeb422-4e79-50c4-8ec1-d7a3c0861eca", "testId": "MON-01.8_A03", "test": "response actions to system security alerts and advisories are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.14.3[a]", "defaultText": null }, { "id": 70399, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590207", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590207", "securityControlId": 31157, "ccis": [], "uuid": "c6e60ebc-f5bb-58e7-8566-96eb76da28cb", "testId": "MON-01.8_A04", "test": "system security alerts and advisories are monitored.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.14.3[b]", "defaultText": null }, { "id": 70400, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590207", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590207", "securityControlId": 31157, "ccis": [], "uuid": "38268d69-c9e0-5f9d-9ee8-6efb71ea8072", "testId": "MON-01.8_A05", "test": "actions in response to system security alerts and advisories are taken.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.14.3[c]", "defaultText": null }, { "id": 70401, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590207", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590207", "securityControlId": 31157, "ccis": [], "uuid": "14c71372-73f2-50aa-9aa3-e6e3d5d36f03", "testId": "MON-01.8_A06", "test": "the frequency of event types selected for logging are reviewed and updated.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least weekly", "otherId": "171A_R3_A.03.03.01.ODP[02]", "defaultText": null }, { "id": 70402, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590207", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590207", "securityControlId": 31157, "ccis": [], "uuid": "2017bbe7-260c-50e2-b665-15f53d6c12b6", "testId": "MON-01.8_A07", "test": "event types being logged are updated based on the review.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.3.3[c]", "defaultText": null }, { "id": 70403, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590207", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590207", "securityControlId": 31157, "ccis": [], "uuid": "015de686-1c75-532e-b183-be2a0a3b80fd", "testId": "MON-01.8_A08", "test": "a process for determining when to review logged events is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.3.3[a]", "defaultText": null }, { "id": 70404, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590208", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590208", "securityControlId": 31157, "ccis": [], "uuid": "36adbbba-2592-5ae7-a137-8ed2c38d9260", "testId": "MON-01.8_A09", "test": "the event types selected for logging are reviewed .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months and after any significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.03.01.b[01]", "defaultText": null }, { "id": 70405, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590208", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590208", "securityControlId": 31157, "ccis": [], "uuid": "bf444578-49cb-5602-8530-a72bbbe5b7cb", "testId": "MON-01.8_A10", "test": "system audit records are reviewed and analyzed for indications and the potential impact of inappropriate or unusual activity.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least weekly", "otherId": "171A_R3_A.03.03.05.a", "defaultText": null } ], "externalMappings": [ { "id": 562757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7c715eb-2be8-52c1-a136-6cc5221b32d0", "parentControlId": 31157, "controlId": "EVENT 1.2", "title": "EVENT 1.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583734" }, { "id": 562758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d046dace-4f81-55af-8300-ddb90e9b3a66", "parentControlId": 31157, "controlId": "EVENT 1.7", "title": "EVENT 1.7", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583734" }, { "id": 562764, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "527b14d1-b2fd-5b55-886d-38838380b2d9", "parentControlId": 31157, "controlId": "8.16", "title": "8.16", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583735" }, { "id": 562769, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a1d5c8c-bf53-50b6-9fe8-8987b13855c6", "parentControlId": 31157, "controlId": "AU-2(3)", "title": "AU-2(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583736" }, { "id": 562770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c00889ec-426b-519d-95a2-edbf88ee68b1", "parentControlId": 31157, "controlId": "AU-02", "title": "AU-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583736" }, { "id": 562772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4e3d149-f268-5236-acee-f6612aa19b2c", "parentControlId": 31157, "controlId": "AU-02", "title": "AU-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583736" }, { "id": 562775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2265823-b099-5a5a-a959-dfd6f47f865b", "parentControlId": 31157, "controlId": "AU-02", "title": "AU-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583736" }, { "id": 562776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1a1cf3d-b0b2-58d4-b240-cf17276101a3", "parentControlId": 31157, "controlId": "AU-02", "title": "AU-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583736" }, { "id": 562777, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2523e71e-a37b-5763-b0f4-e4cdbd6a410a", "parentControlId": 31157, "controlId": "AU-02", "title": "AU-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583736" }, { "id": 562778, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a14f468-1abe-5d6c-88bf-5a7f7b8d0410", "parentControlId": 31157, "controlId": "AU-02", "title": "AU-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583737" }, { "id": 562779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d88c712-3faf-524d-a640-cf2728480fd0", "parentControlId": 31157, "controlId": "AU-2", "title": "AU-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583737" }, { "id": 562780, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23123316-7510-5115-ae1a-e768488e6996", "parentControlId": 31157, "controlId": "AU-2", "title": "AU-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583737" }, { "id": 562781, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e2118d8-c6be-5f50-83da-208607649cd7", "parentControlId": 31157, "controlId": "AU-2", "title": "AU-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583737" }, { "id": 562785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c0d1593-fa43-59cf-833d-1048bd05d0aa", "parentControlId": 31157, "controlId": "3.3.3", "title": "3.3.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583737" }, { "id": 562786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8eacd0b1-584c-5b9d-a29b-19c68f6995eb", "parentControlId": 31157, "controlId": "3.14.3", "title": "3.14.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583737" }, { "id": 562787, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a788176-f597-56f1-b1bf-23a2dffcf66a", "parentControlId": 31157, "controlId": "03.03.01.b", "title": "03.03.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583738" }, { "id": 562788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583738", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "381d41e9-2dbe-527d-9eec-d3b0834136b1", "parentControlId": 31157, "controlId": "03.03.05.a", "title": "03.03.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583738" }, { "id": 562799, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b6c2516-5ad1-5184-ade7-905897fd62e2", "parentControlId": 31157, "controlId": "DE.CM-01", "title": "DE.CM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583739" }, { "id": 562800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e005bcf6-eeb6-5da6-93c7-e6b159796606", "parentControlId": 31157, "controlId": "DE.AE", "title": "DE.AE", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583739" }, { "id": 562801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5345f8a0-d660-5f63-a03d-547dcf89d961", "parentControlId": 31157, "controlId": "DE.AE-06", "title": "DE.AE-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583739" }, { "id": 562835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f7069f3-8000-5308-bd67-830580b1da1e", "parentControlId": 31157, "controlId": "SITUATION-2a", "title": "SITUATION-2a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583753" }, { "id": 562836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4752fc9-befd-5349-b372-d046c9be0747", "parentControlId": 31157, "controlId": "SITUATION-2b", "title": "SITUATION-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583753" }, { "id": 562837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51628eb3-39c0-5efa-8b74-2017263c3a72", "parentControlId": 31157, "controlId": "SITUATION-2e", "title": "SITUATION-2e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583753" }, { "id": 562838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7d70c58-e78b-5821-8b1e-bf064a535e07", "parentControlId": 31157, "controlId": "SITUATION-2i", "title": "SITUATION-2i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583753" }, { "id": 562858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c89a52d-1988-55cf-b475-0729b51b9db2", "parentControlId": 31157, "controlId": "§117.15(d)(3)", "title": "§117.15(d)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583756" }, { "id": 562859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7304fb90-4d20-516d-8a49-766e48913c6e", "parentControlId": 31157, "controlId": "§117.15(d)(3)(i)", "title": "§117.15(d)(3)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583756" }, { "id": 562860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e22439d-4f80-5f65-909b-bf84c0c9a561", "parentControlId": 31157, "controlId": "§117.15(d)(3)(i)(A)", "title": "§117.15(d)(3)(i)(A)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583756" }, { "id": 562861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b226186-cbf2-5943-a486-318a76c33db1", "parentControlId": 31157, "controlId": "§117.15(d)(3)(i)(B)", "title": "§117.15(d)(3)(i)(B)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583756" }, { "id": 562862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebfb9d84-d738-59e8-a26e-45e4bd2bc73a", "parentControlId": 31157, "controlId": "§117.15(d)(3)(ii)", "title": "§117.15(d)(3)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583756" }, { "id": 562863, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1f855df-6894-5049-8422-f934fd5fc289", "parentControlId": 31157, "controlId": "§117.15(d)(3)(ii)(A)", "title": "§117.15(d)(3)(ii)(A)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583756" }, { "id": 562864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c9bcd60-791b-5fb1-8fb3-add80444df84", "parentControlId": 31157, "controlId": "§117.15(d)(3)(ii)(B)", "title": "§117.15(d)(3)(ii)(B)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583756" }, { "id": 562865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7cd6c21-972f-5880-99df-f82221e42637", "parentControlId": 31157, "controlId": "§117.15(d)(3)(ii)(C)", "title": "§117.15(d)(3)(ii)(C)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583757" }, { "id": 562866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583757", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93276d30-05b5-5800-9ad3-fef7d64be90f", "parentControlId": 31157, "controlId": "§117.15(d)(3)(ii)(D)", "title": "§117.15(d)(3)(ii)(D)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583757" }, { "id": 562867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583757", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7044915-4632-54cd-9053-489a2f3294e3", "parentControlId": 31157, "controlId": "§117.15(d)(3)(iii)", "title": "§117.15(d)(3)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583757" }, { "id": 562892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583761", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8adedbd6-4ffd-544b-9775-b5089ba252db", "parentControlId": 31157, "controlId": "C1.a", "title": "C1.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583761" } ], "id": 31157, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730983", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730983", "catalogueId": 1062, "uuid": "262ac731-a8f3-5e6b-b6bd-a256114fda45", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization review event logs on an ongoing basis and escalate incidents in accordance with established timelines and procedures?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Security Event Monitoring", "description": "

Control Description

Mechanisms exist to review event logs on an ongoing basis and escalate incidents in accordance with established timelines and procedures.

Evidence Request List (ERL)

E-MON-01\nE-MON-02\nE-MON-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.\n▪ Generating event logs and the review of those event logs is narrowly-focused to business-critical Technology Assets, Applications, Services and/or Data (TAASD).

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A log aggregator, or similar automated tool, provides an event log report generation capability to aid in detecting and assessing anomalous activities on business-critical TAASD.\n▪ IT and/or cybersecurity personnel configure alerts for critical or sensitive data that is stored, transmitted and processed on assets.\n▪ Logs of privileged functions (e.g., administrator or root actions) are reviewed for evidence of unauthorized activities.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to review event logs on an ongoing basis and escalate incidents in accordance with established timelines and procedures.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-01.8", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-01.8", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70409, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590209", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590209", "securityControlId": 31160, "ccis": [], "uuid": "177f3793-bc16-5efb-8675-d8531455fe0e", "testId": "MON-01.11_A01", "test": "security violations that automatically disable a system are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(05)_ODP", "defaultText": null }, { "id": 70410, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590209", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590209", "securityControlId": 31160, "ccis": [], "uuid": "d99c0286-0254-5b25-bc02-fa3713370929", "testId": "MON-01.11_A02", "test": "least-disruptive actions to terminate suspicious events are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(07)_ODP[02]", "defaultText": null }, { "id": 70411, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590209", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590209", "securityControlId": 31160, "ccis": [], "uuid": "a1c5c441-68cc-5412-9631-d62a728c1a78", "testId": "MON-01.11_A03", "test": "a configurable capability is implemented to automatically disable the system if security violations are detected.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(05)", "defaultText": null }, { "id": 70412, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59021", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59021", "securityControlId": 31160, "ccis": [], "uuid": "353c6573-3c28-55dc-bd49-3f146b7827c5", "testId": "MON-01.11_A04", "test": "least-disruptive actions are taken upon the detection of suspicious events.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(07)(b)", "defaultText": null }, { "id": 70413, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59021", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59021", "securityControlId": 31160, "ccis": [], "uuid": "912f9b2c-1778-5181-85a8-2967c4d7091f", "testId": "MON-01.11_A05", "test": "incident response personnel (identified by name and/or by role) to be notified of detected suspicious events is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(07)_ODP[01]", "defaultText": null }, { "id": 70414, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59021", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59021", "securityControlId": 31160, "ccis": [], "uuid": "31af4d15-34ee-503a-8791-2efe8580d91d", "testId": "MON-01.11_A06", "test": "incident response personnel are notified of detected suspicious events.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-04(07)(a)", "defaultText": null } ], "externalMappings": [ { "id": 562922, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8156bce-64ba-5371-ac38-6636126217fd", "parentControlId": 31160, "controlId": "SI-4(7)", "title": "SI-4(7)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583765" }, { "id": 562923, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9aafa961-0aef-57c0-a344-97564dc46a1d", "parentControlId": 31160, "controlId": "IR-04(05)", "title": "IR-04(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583765" }, { "id": 562924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afe389b8-ac7d-5940-8be3-0b70006d467a", "parentControlId": 31160, "controlId": "SI-04(07)", "title": "SI-04(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583765" }, { "id": 562927, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1cea9b8-90a4-5e40-96d0-a6286e47af26", "parentControlId": 31160, "controlId": "IR-04(05)", "title": "IR-04(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583765" }, { "id": 562928, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "501ffece-b9d9-5d4a-95a9-a097649490bb", "parentControlId": 31160, "controlId": "SI-04(07)", "title": "SI-04(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583765" } ], "id": 31160, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730984", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730984", "catalogueId": 1062, "uuid": "1cacfa9c-e4d6-57ba-91e8-ed5a122c07fb", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization automatically implement pre-determined corrective actions in response to detected events that have security incident implications?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Automated Response to Suspicious Events", "description": "

Control Description

Automated mechanisms exist to implement pre-determined corrective actions in response to detected events that have security incident implications.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to automatically implement pre-determined corrective actions in response to detected events that have security incident implications.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "MON-01.11", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-01.11", "references": "

Micro-Small Business (<10 staff)

∙ Review system logs periodically

Small Business (10-49 staff)

∙ Log monitoring policy\n∙ Regular review of key system logs

Medium Business (50-249 staff)

∙ Intrusion Detection / Prevention Systems (IDS / IPS)\n∙ Extended Detection and Response (XDR)

Large Business (250-999 staff)

∙ Intrusion Detection / Prevention Systems (IDS / IPS)\n∙ Extended Detection and Response (XDR)

Enterprise (>1,000 staff)

∙ Intrusion Detection / Prevention Systems (IDS / IPS)\n∙ Extended Detection and Response (XDR)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70415, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59021", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59021", "securityControlId": 31161, "ccis": [], "uuid": "0ed0f9ef-6d16-5c1f-a429-3c597d8bd234", "testId": "MON-01.12_A01", "test": "personnel or roles to be alerted when indications of inappropriate or unusual activity with cybersecurity / data privacy implications occur is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(12)_ODP[01]", "defaultText": null }, { "id": 70416, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59021", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59021", "securityControlId": 31161, "ccis": [], "uuid": "394c362d-2e9f-57e8-b27b-e48a9463fa91", "testId": "MON-01.12_A02", "test": "automated mechanisms used to alert personnel or roles are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(12)_ODP[02]", "defaultText": null }, { "id": 70417, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590211", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590211", "securityControlId": 31161, "ccis": [], "uuid": "8c6cfc7a-8528-5dca-b554-c761fd5d8287", "testId": "MON-01.12_A03", "test": "activities that trigger alerts to personnel or are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(12)_ODP[03]", "defaultText": null }, { "id": 70418, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590211", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590211", "securityControlId": 31161, "ccis": [], "uuid": "2ec71f72-c347-59ac-ac45-1b5d949ce463", "testId": "MON-01.12_A04", "test": "personnel or roles is/are alerted using automated mechanisms when activities that trigger alerts indicate inappropriate or unusual activities with cybersecurity / data privacy implications.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(12)", "defaultText": null }, { "id": 70419, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590211", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590211", "securityControlId": 31161, "ccis": [], "uuid": "6ea04521-d70e-5bd9-9f8a-546beeb9e3be", "testId": "MON-01.12_A05", "test": "findings are reported to organizational personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.03.05.b", "defaultText": null } ], "externalMappings": [ { "id": 562942, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45b90c57-0f18-585e-82f9-7d4d09eb7176", "parentControlId": 31161, "controlId": "SI-4(12)", "title": "SI-4(12)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583767" }, { "id": 562943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f4c422f-0758-5076-b670-586dda2872a3", "parentControlId": 31161, "controlId": "SI-04(12)", "title": "SI-04(12)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583767" }, { "id": 562945, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96738df4-415c-546a-8e5d-5b0d6d3ca893", "parentControlId": 31161, "controlId": "SI-04(12)", "title": "SI-04(12)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583767" }, { "id": 562946, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31ad4bbf-44b5-547a-a781-fbcda83a9f2c", "parentControlId": 31161, "controlId": "SI-04(12)", "title": "SI-04(12)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583768" }, { "id": 562947, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd06bfd3-a8f3-5044-bddf-5c3bf4b78fa6", "parentControlId": 31161, "controlId": "SI-04(12)", "title": "SI-04(12)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583768" }, { "id": 562948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8dead226-ea79-5283-888e-cac92488e225", "parentControlId": 31161, "controlId": "03.03.04.a", "title": "03.03.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583768" }, { "id": 562949, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aaf28fa9-ea51-547e-95e8-d6c9af5912dc", "parentControlId": 31161, "controlId": "03.03.05.b", "title": "03.03.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583768" }, { "id": 562951, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8954c5bf-89b0-5555-a344-e68bf3bde04a", "parentControlId": 31161, "controlId": "DE.AE", "title": "DE.AE", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583768" }, { "id": 562952, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10b3ba87-ff2f-5a84-b05c-b40c7e70334c", "parentControlId": 31161, "controlId": "DE.AE-06", "title": "DE.AE-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583768" } ], "id": 31161, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730984", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730984", "catalogueId": 1062, "uuid": "a244d9d6-31f9-59d7-b2cc-8984875ac2d6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization automatically alert incident response personnel to inappropriate or anomalous activities that have potential security incident implications?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Automated Alerts", "description": "

Control Description

Mechanisms exist to automatically alert incident response personnel to inappropriate or anomalous activities that have potential security incident implications.

Evidence Request List (ERL)

E-MON-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to automatically alert incident response personnel to inappropriate or anomalous activities that have potential security incident implications.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-01.12", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-01.12", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70420, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590211", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590211", "securityControlId": 31162, "ccis": [], "uuid": "fefe27e7-41a5-54c6-8bb3-74fdec00b295", "testId": "MON-01.13_A01", "test": "communications traffic for the system is analyzed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(13)(a)[01]", "defaultText": null }, { "id": 70421, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590211", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590211", "securityControlId": 31162, "ccis": [], "uuid": "c090437e-0740-5328-9cc9-cf2f8609f6eb", "testId": "MON-01.13_A02", "test": "event patterns for the system are analyzed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(13)(a)[02]", "defaultText": null }, { "id": 70422, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590211", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590211", "securityControlId": 31162, "ccis": [], "uuid": "033842b7-3f1a-5b36-b1fc-31e4bb4c1691", "testId": "MON-01.13_A03", "test": "profiles representing common traffic are developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(13)(b)[01]", "defaultText": null }, { "id": 70423, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590211", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590211", "securityControlId": 31162, "ccis": [], "uuid": "a25de4a1-db2d-503f-a1b8-09759599da9a", "testId": "MON-01.13_A04", "test": "profiles representing event patterns are developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(13)(b)[02]", "defaultText": null }, { "id": 70424, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590212", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590212", "securityControlId": 31162, "ccis": [], "uuid": "25eeeda0-dd10-5fbe-b2ff-22dafc73bae8", "testId": "MON-01.13_A05", "test": "traffic profiles are used in tuning system-monitoring devices.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(13)(c)[01]", "defaultText": null }, { "id": 70425, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590212", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590212", "securityControlId": 31162, "ccis": [], "uuid": "2a13a80f-44bb-536c-8faa-88d13193efa9", "testId": "MON-01.13_A06", "test": "event profiles are used in tuning system-monitoring devices.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(13)(c)[02]", "defaultText": null } ], "externalMappings": [ { "id": 562972, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58377", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1cb13a74-c59c-5297-a718-2320556fa2f5", "parentControlId": 31162, "controlId": "SI-4(13)", "title": "SI-4(13)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583771" }, { "id": 562973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1174417e-437f-5ca8-9dfd-d6ce5d3a79e8", "parentControlId": 31162, "controlId": "SI-04(13)", "title": "SI-04(13)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583771" }, { "id": 562974, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da300136-c91b-570c-be8a-e79ea5e92f38", "parentControlId": 31162, "controlId": "SI-04(13)", "title": "SI-04(13)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583771" }, { "id": 562976, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48443363-a4d6-530c-b541-13b39fa2d1b6", "parentControlId": 31162, "controlId": "SITUATION-3g", "title": "SITUATION-3g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583771" } ], "id": 31162, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730985", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730985", "catalogueId": 1062, "uuid": "f8ee5473-d202-5690-8015-94e91f9cea8d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization \"tune\" event monitoring technologies through analyzing communications traffic/event patterns and developing profiles representing common traffic patterns and/or events?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Alert Threshold Tuning", "description": "

Control Description

Mechanisms exist to \"tune\" event monitoring technologies through analyzing communications traffic/event patterns and developing profiles representing common traffic patterns and/or events.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to \"tune\" event monitoring technologies through analyzing communications traffic/event patterns and developing profiles representing common traffic patterns and/or events.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "MON-01.13", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-01.13", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70426, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590212", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590212", "securityControlId": 31163, "ccis": [], "uuid": "08bd26f5-496a-56e4-a450-84ccf44453bf", "testId": "MON-01.14_A01", "test": "additional monitoring of individuals who have been identified as posing an increased level of risk is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(19)_ODP[01]", "defaultText": null }, { "id": 70427, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590212", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590212", "securityControlId": 31163, "ccis": [], "uuid": "bffc025e-d9da-5f8c-8c6e-71617f0a94d8", "testId": "MON-01.14_A02", "test": "sources that identify individuals who pose an increased level of risk are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(19)_ODP[02]", "defaultText": null }, { "id": 70428, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590212", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590212", "securityControlId": 31163, "ccis": [], "uuid": "c829d8a5-cb96-5ef7-b53d-4580395e5437", "testId": "MON-01.14_A03", "test": "additional monitoring is implemented on individuals who have been identified by sources as posing an increased level of risk.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(19)", "defaultText": null } ], "externalMappings": [ { "id": 562979, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb609c53-15cc-557b-840c-e6d378819154", "parentControlId": 31163, "controlId": "SI-4(19)", "title": "SI-4(19)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583771" }, { "id": 562980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "021ca2c5-68b3-54e0-9cfd-d4eb9a809997", "parentControlId": 31163, "controlId": "SI-04(19)", "title": "SI-04(19)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583772" }, { "id": 562981, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583772", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39efca6c-bdb8-53fc-909e-cfe89a32254c", "parentControlId": 31163, "controlId": "SI-04(19)", "title": "SI-04(19)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583772" }, { "id": 562982, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583772", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7df2f1fa-60f7-5ae2-8f7f-9ed6677acae7", "parentControlId": 31163, "controlId": "SI-4(19)", "title": "SI-4(19)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583772" } ], "id": 31163, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730985", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730985", "catalogueId": 1062, "uuid": "2075d329-dbdf-56ba-a236-d8896a7b06f6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement enhanced activity monitoring for individuals who have been identified as posing an increased level of risk?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Individuals Posing Greater Risk", "description": "

Control Description

Mechanisms exist to implement enhanced activity monitoring for individuals who have been identified as posing an increased level of risk.

Evidence Request List (ERL)

E-MON-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to implement enhanced activity monitoring for individuals who have been identified as posing an increased level of risk.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "MON-01.14", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-01.14", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70429, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590213", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590213", "securityControlId": 31164, "ccis": [], "uuid": "2a427a22-f7d5-5985-b520-b893a56f9b9a", "testId": "MON-01.15_A01", "test": "additional monitoring of privileged users is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(20)_ODP", "defaultText": null }, { "id": 70430, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590213", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590213", "securityControlId": 31164, "ccis": [], "uuid": "1ff181b8-119d-5de8-9f49-c28a76e1f4a9", "testId": "MON-01.15_A02", "test": "additional monitoring of privileged users is implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(20)", "defaultText": null } ], "externalMappings": [ { "id": 562995, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8b89e2c-b74d-53d6-abca-6c6724413c5d", "parentControlId": 31164, "controlId": "SI-4(20)", "title": "SI-4(20)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583773" }, { "id": 562996, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c413198-4a6a-59c9-858c-e00ff4d98f75", "parentControlId": 31164, "controlId": "SI-04(20)", "title": "SI-04(20)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583773" }, { "id": 562997, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583774", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16106bfe-f939-5daa-90e9-acc09a644c73", "parentControlId": 31164, "controlId": "SI-04(20)", "title": "SI-04(20)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583774" }, { "id": 562999, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583774", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dea9014c-a4c0-5c31-b1af-9b2c1a8ba8b9", "parentControlId": 31164, "controlId": "SI-04(20)", "title": "SI-04(20)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583774" }, { "id": 563000, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583774", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08c65f2c-e760-50ff-bd56-67a1138df602", "parentControlId": 31164, "controlId": "SI-04(20)", "title": "SI-04(20)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583774" }, { "id": 563001, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583774", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94eb9416-c4b0-5a86-a270-3e3eada099b2", "parentControlId": 31164, "controlId": "03.01.07.b", "title": "03.01.07.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583774" } ], "id": 31164, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730985", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730985", "catalogueId": 1062, "uuid": "9a4ec11a-ad24-5678-ba43-96e8afc300f7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement enhanced activity monitoring for privileged users?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Privileged User Oversight", "description": "

Control Description

Mechanisms exist to implement enhanced activity monitoring for privileged users.

Evidence Request List (ERL)

E-MON-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to implement enhanced activity monitoring for privileged users.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "MON-01.15", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-01.15", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70431, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590213", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590213", "securityControlId": 31165, "ccis": [], "uuid": "f5a3b5be-b6de-58c6-8ddb-9e022088b7ea", "testId": "MON-01.16_A01", "test": "the organization formally identifies its needs for monitoring.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70432, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590213", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590213", "securityControlId": 31165, "ccis": [], "uuid": "2988566f-253c-57af-b883-b7c978e4e01b", "testId": "MON-01.16_A02", "test": "monitoring needs are prioritized by asset, based on (1) asset criticality and (2) the sensitivity of the data it stores, transmits and processes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 563015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583775", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9110aa89-7c95-5c27-93b4-7bbfd4347f6c", "parentControlId": 31165, "controlId": "3.3.3", "title": "3.3.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583775" }, { "id": 563019, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "291424e6-eb04-5ff2-9f08-8e6d1c1a3691", "parentControlId": 31165, "controlId": "SITUATION-1a", "title": "SITUATION-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583776" }, { "id": 563020, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34f08887-ee41-53e3-a333-be4a2fc0cd12", "parentControlId": 31165, "controlId": "SITUATION-1f", "title": "SITUATION-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583776" }, { "id": 563021, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3bf1163-77c3-522c-9858-fc194162f06a", "parentControlId": 31165, "controlId": "SITUATION-2f", "title": "SITUATION-2f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583776" }, { "id": 563022, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9763b664-f39f-5397-a970-8e9f8010ce9e", "parentControlId": 31165, "controlId": "SITUATION-2g", "title": "SITUATION-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583776" }, { "id": 563023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583777", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81ef39e9-8ac0-5dfd-9dc5-a17c3a89307d", "parentControlId": 31165, "controlId": "SITUATION-3g", "title": "SITUATION-3g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583777" }, { "id": 563024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583777", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92159441-9859-57e2-9a28-1cd23c62607a", "parentControlId": 31165, "controlId": "RESPONSE-1e", "title": "RESPONSE-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583777" } ], "id": 31165, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730986", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730986", "catalogueId": 1062, "uuid": "f32459ce-cd07-59af-822e-ae76903af84c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization assess the organization's needs for monitoring and prioritize the monitoring of Technology Assets, Applications and/or Services (TAAS), based on TAAS criticality and the sensitivity of the data it stores, transmits and processes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Analyze and Prioritize Monitoring Requirements", "description": "

Control Description

Mechanisms exist to assess the organization's needs for monitoring and prioritize the monitoring of Technology Assets, Applications and/or Services (TAAS), based on TAAS criticality and the sensitivity of the data it stores, transmits and processes.

Evidence Request List (ERL)

E-AST-30

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to assess the organization's needs for monitoring and prioritize the monitoring of Technology Assets, Applications and/or Services (TAAS), based on TAAS criticality and the sensitivity of the data it stores, transmits and processes.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-01.16", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-01.16", "references": "

Micro-Small Business (<10 staff)

∙ Review system logs periodically

Small Business (10-49 staff)

∙ Log monitoring policy\n∙ Regular review of key system logs

Medium Business (50-249 staff)

∙ SIEM (e.g., Wazuh)\n∙ Automated log collection and alerting

Large Business (250-999 staff)

∙ Enterprise SIEM (e.g., Splunk, IBM QRadar)\n∙ Continuous monitoring program\n∙ SOC monitoring

Enterprise (>1,000 staff)

∙ Enterprise SIEM/SOAR platform\n∙ 24/7 SOC monitoring\n∙ Threat hunting\n∙ Automated incident response", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70433, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590214", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590214", "securityControlId": 31166, "ccis": [], "uuid": "0c5bcb91-7bac-56ec-aee3-434669153bac", "testId": "MON-01.17_A01", "test": "the capability for authorized users to remotely view and hear content related to an established user session in real time is provided.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-14(03)[01]", "defaultText": null }, { "id": 70434, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590214", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590214", "securityControlId": 31166, "ccis": [], "uuid": "fe70a622-0350-57d5-8d4b-0f0cd8668e0b", "testId": "MON-01.17_A02", "test": "the capability for authorized users to remotely view and hear content related to an established user session in real time is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-14(03)[02]", "defaultText": null } ], "externalMappings": [ { "id": 563087, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b92f164d-3548-5483-94c7-0c31bf9720de", "parentControlId": 31166, "controlId": "AU-14(03)", "title": "AU-14(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583784" }, { "id": 563088, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b45eb69a-2436-576d-bdd6-619e0a579980", "parentControlId": 31166, "controlId": "AU-14(03)", "title": "AU-14(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583784" } ], "id": 31166, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730986", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730986", "catalogueId": 1062, "uuid": "1c7c6f46-30be-581c-af4a-5fff63fa90cb", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enable authorized personnel the ability to remotely view and hear content related to an established user session in real time, in accordance with organizational standards, as well as statutory, regulatory and contractual obligations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Real-Time Session Monitoring", "description": "

Control Description

Mechanisms exist to enable authorized personnel the ability to remotely view and hear content related to an established user session in real time, in accordance with organizational standards, as well as statutory, regulatory and contractual obligations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to enable authorized personnel the ability to remotely view and hear content related to an established user session in real time, in accordance with organizational standards, as well as statutory, regulatory and contractual obligations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-01.17", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-01.17", "references": "

Micro-Small Business (<10 staff)

∙ Review system logs periodically

Small Business (10-49 staff)

∙ Log monitoring policy\n∙ Regular review of key system logs

Medium Business (50-249 staff)

∙ SIEM (e.g., Wazuh)\n∙ Automated log collection and alerting

Large Business (250-999 staff)

∙ Enterprise SIEM (e.g., Splunk, IBM QRadar)\n∙ Continuous monitoring program\n∙ SOC monitoring

Enterprise (>1,000 staff)

∙ Enterprise SIEM/SOAR platform\n∙ 24/7 SOC monitoring\n∙ Threat hunting\n∙ Automated incident response", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70435, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590214", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590214", "securityControlId": 31167, "ccis": [], "uuid": "88645efd-2e46-58f6-8d80-27045f88e6af", "testId": "MON-02_A01", "test": "the frequency at which system audit records are reviewed and analyzed is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least weekly", "otherId": "171A_R3_A.03.03.05.ODP[01]", "defaultText": null }, { "id": 70436, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590214", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590214", "securityControlId": 31167, "ccis": [], "uuid": "7190d1cb-ff36-5630-8dc2-f001ffa6aa86", "testId": "MON-02_A02", "test": "system audit records are reviewed and analyzed per an organization-defined frequency for indications and the potential impact of inappropriate or unusual activity.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least weekly", "otherId": "SCF Created", "defaultText": null }, { "id": 70437, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590219", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590219", "securityControlId": 31167, "ccis": [], "uuid": "ef537091-edbc-5742-9ed0-394d35e13cf6", "testId": "MON-02_A03", "test": "audit records across different repositories are analyzed to gain organization-wide situational awareness.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.03.05.c[01]", "defaultText": null }, { "id": 70438, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590219", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590219", "securityControlId": 31167, "ccis": [], "uuid": "9472bad2-7eae-587d-b38b-da336b1c15ad", "testId": "MON-02_A04", "test": "automated mechanisms used for integrating audit record review, analysis and reporting processes are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-06(01)_ODP", "defaultText": null }, { "id": 70439, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590219", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59022", "securityControlId": 31167, "ccis": [], "uuid": "7eeba5fd-595d-57fb-9197-a15d6dcce585", "testId": "MON-02_A05", "test": "audit record review, analysis and reporting processes are integrated using organization-defined automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-06(01)", "defaultText": null }, { "id": 70440, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59022", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59022", "securityControlId": 31167, "ccis": [], "uuid": "723b01b7-7ad8-559d-b818-5a71f1af1387", "testId": "MON-02_A06", "test": "the frequency or situation requiring logging for each specified event type is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AU-06_ODP[01]\n53A_R5_AU-02_ODP[03]", "defaultText": null }, { "id": 70441, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59022", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59022", "securityControlId": 31167, "ccis": [], "uuid": "b274ff8b-42e9-5e77-aee5-f048a95e5117", "testId": "MON-02_A07", "test": "the event logging function is coordinated with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AU-02b.", "defaultText": null }, { "id": 70442, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59022", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59022", "securityControlId": 31167, "ccis": [], "uuid": "1dce7791-70ec-5a48-ac2f-5abc24ec8dae", "testId": "MON-02_A08", "test": "the event types selected for logging are reviewed / updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: annually and whenever there is a change in the threat environment", "otherId": "53A_R5_AU-02e.", "defaultText": null }, { "id": 70443, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590221", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590221", "securityControlId": 31167, "ccis": [], "uuid": "8ad31a53-7fc3-5961-ae63-9edb55f2ee20", "testId": "MON-02_A09", "test": "a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AU-02d.", "defaultText": null }, { "id": 70444, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590221", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590221", "securityControlId": 31167, "ccis": [], "uuid": "5cba6d22-acf7-5a5d-bb27-256372948b87", "testId": "MON-02_A10", "test": "system audit records are reviewed and analyzed per an organization-defined frequency for indications of organization-defined inappropriate or unusual activity and the potential impact of the inappropriate or unusual activity.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least weekly", "otherId": "53A_R5_AU-06a.", "defaultText": null }, { "id": 70445, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590221", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590221", "securityControlId": 31167, "ccis": [], "uuid": "b4588c0c-7242-5ba7-ab56-fa1d2b9d941e", "testId": "MON-02_A11", "test": "findings are reported to organization-defined personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AU-06b.", "defaultText": null }, { "id": 70446, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590222", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590222", "securityControlId": 31167, "ccis": [], "uuid": "bcef2c09-49ee-5548-a601-2b8c58046f6f", "testId": "MON-02_A12", "test": "the level of audit record review, analysis and reporting within the system is adjusted when there is a change in risk based on law enforcement information, intelligence information or other credible sources of information.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AU-06c.", "defaultText": null }, { "id": 70447, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590222", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590222", "securityControlId": 31167, "ccis": [], "uuid": "d0968373-cfe3-5339-8170-a56df6811f6e", "testId": "MON-02_A13", "test": "system audit records are reviewed and analyzed for indications and the potential impact of inappropriate or unusual activity.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least weekly", "otherId": "171A_R3_A.03.03.05.a", "defaultText": null } ], "externalMappings": [ { "id": 563146, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48c23eb2-cbef-56e5-8579-2443a211bbaa", "parentControlId": 31167, "controlId": "SR 2.8 RE 1", "title": "SR 2.8 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583799" }, { "id": 563147, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9cdbe2b0-f88e-5b00-a87d-e1f028cd6b90", "parentControlId": 31167, "controlId": "8.15", "title": "8.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583799" }, { "id": 563150, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e167b944-2eb6-5eb3-bc16-097351444be4", "parentControlId": 31167, "controlId": "AU-2", "title": "AU-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583799" }, { "id": 563151, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16676981-5bce-5a31-a8c1-eef1d2d3ab25", "parentControlId": 31167, "controlId": "AU-2(3)", "title": "AU-2(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5838" }, { "id": 563152, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ce68a46-612c-502a-a184-54a068886ddb", "parentControlId": 31167, "controlId": "AU-6", "title": "AU-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5838" }, { "id": 563153, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e68b77f6-c285-5808-ba06-498aa1768bb2", "parentControlId": 31167, "controlId": "IR-4(4)", "title": "IR-4(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5838" }, { "id": 563154, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9105c8ef-e5ed-5cc4-804b-7c9a59bee9f3", "parentControlId": 31167, "controlId": "SI-4", "title": "SI-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5838" }, { "id": 563155, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f14fa89-f3ee-5856-bcba-7e5b79e21609", "parentControlId": 31167, "controlId": "AU-02", "title": "AU-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5838" }, { "id": 563156, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0eb818f-5337-5806-a561-0a14b64bb3fb", "parentControlId": 31167, "controlId": "AU-06", "title": "AU-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5838" }, { "id": 563157, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8456cd52-f6e6-5b61-a6d9-b97acb7148a2", "parentControlId": 31167, "controlId": "IR-04(04)", "title": "IR-04(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5838" }, { "id": 563158, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ad89d79-4486-5cfd-9466-510475cb4711", "parentControlId": 31167, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5838" }, { "id": 563163, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42ddb226-6e63-5026-9142-48ff31187878", "parentControlId": 31167, "controlId": "AU-02", "title": "AU-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583801" }, { "id": 563164, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3803bb95-b7ad-522a-833e-e8539d0b85b1", "parentControlId": 31167, "controlId": "AU-06", "title": "AU-06", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583801" }, { "id": 563165, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73fd7eed-1428-555d-b27f-5aff53d50c36", "parentControlId": 31167, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583801" }, { "id": 563166, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af8a7d20-a59b-56f1-997d-74d182d367bd", "parentControlId": 31167, "controlId": "IR-04(04)", "title": "IR-04(04)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583801" }, { "id": 563167, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05e3f06b-164c-5239-a6ef-e99b090def00", "parentControlId": 31167, "controlId": "AU-02", "title": "AU-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583801" }, { "id": 563168, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7b8381c-2ba4-5ec0-aaa1-a5d1e105d77e", "parentControlId": 31167, "controlId": "AU-06", "title": "AU-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583802" }, { "id": 563169, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d54c4594-4a5d-5b8c-8d7c-42558e63501d", "parentControlId": 31167, "controlId": "IR-04(04)", "title": "IR-04(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583802" }, { "id": 563170, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d3167af-e08e-57da-87bf-52587c608a94", "parentControlId": 31167, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583802" }, { "id": 563171, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5955d8c3-0125-5de0-b9ad-e8ee6d9f105d", "parentControlId": 31167, "controlId": "AU-02", "title": "AU-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583802" }, { "id": 563172, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c426d2d0-839d-5a90-aa91-d4192e2bcb92", "parentControlId": 31167, "controlId": "AU-06", "title": "AU-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583802" }, { "id": 563173, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a51d331-69ba-5dae-a04a-0ed1614b1120", "parentControlId": 31167, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583802" }, { "id": 563174, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87a02f8b-c69f-572e-9d4e-23eda950be4d", "parentControlId": 31167, "controlId": "AU-02", "title": "AU-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583802" }, { "id": 563175, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4fc90d0-d122-5c3f-8c93-493b3d849d17", "parentControlId": 31167, "controlId": "AU-06", "title": "AU-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583803" }, { "id": 563176, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5aef779-c8e8-5fe2-882d-36c1cc1fad79", "parentControlId": 31167, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583803" }, { "id": 563177, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ba2e1c5-fb38-51a5-b7ad-2cec7b121487", "parentControlId": 31167, "controlId": "AU-02", "title": "AU-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583803" }, { "id": 563178, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "685415b8-413e-532d-85a0-e9cc7fe84ee0", "parentControlId": 31167, "controlId": "AU-06", "title": "AU-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583803" }, { "id": 563179, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fed2a05-e658-5927-8e12-98dc58a6cbaa", "parentControlId": 31167, "controlId": "IR-04(04)", "title": "IR-04(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583803" }, { "id": 563180, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53c442b4-7566-502a-940b-35d877af0465", "parentControlId": 31167, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583803" }, { "id": 563183, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1a3ef76-c4a5-5bac-9c80-2678881310b5", "parentControlId": 31167, "controlId": "AU-2", "title": "AU-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583803" }, { "id": 563184, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2b17374-bd47-5a42-9cb4-b5b7411cfb7d", "parentControlId": 31167, "controlId": "AU-6", "title": "AU-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583804" }, { "id": 563185, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e522030a-aa44-57af-b72c-fd08f742e0ed", "parentControlId": 31167, "controlId": "SI-4", "title": "SI-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583804" }, { "id": 563186, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f413190-937b-5bc8-b565-5ed5f3939d89", "parentControlId": 31167, "controlId": "AU-2", "title": "AU-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583804" }, { "id": 563187, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fcccb5c-4e5a-5ac6-8ce2-accd6c9a7cad", "parentControlId": 31167, "controlId": "AU-6", "title": "AU-6", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583804" }, { "id": 563188, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd5d0162-2b26-5a98-9ef8-0d1aa0c85e80", "parentControlId": 31167, "controlId": "SI-4", "title": "SI-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583804" }, { "id": 563189, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44567561-0e4f-5835-b91e-abd15151d5a0", "parentControlId": 31167, "controlId": "AU-2", "title": "AU-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583804" }, { "id": 563190, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34d2ce24-5f59-525d-a275-a7ab29be3024", "parentControlId": 31167, "controlId": "SI-4", "title": "SI-4", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583804" }, { "id": 563199, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583806", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36da29a8-7657-5f45-8fcb-39b933f2f85e", "parentControlId": 31167, "controlId": "3.3.1", "title": "3.3.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583806" }, { "id": 563200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583806", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54cfecd3-e46d-5bbd-b982-563391282b11", "parentControlId": 31167, "controlId": "3.3.3", "title": "3.3.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583806" }, { "id": 563201, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583806", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13ac8e48-0745-5d7f-89d5-bec51a070cfc", "parentControlId": 31167, "controlId": "3.3.5", "title": "3.3.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583806" }, { "id": 563202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583806", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d1413ec-68f5-534a-9b64-cb4916abef2c", "parentControlId": 31167, "controlId": "3.3.6", "title": "3.3.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583806" }, { "id": 563203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583806", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53057d6c-8b2a-5255-9ed8-7a05c4527fb7", "parentControlId": 31167, "controlId": "3.3.8", "title": "3.3.8", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583806" }, { "id": 563204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583806", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acdbeff9-a509-56ee-895c-6f9a3ba53987", "parentControlId": 31167, "controlId": "3.3.9", "title": "3.3.9", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583806" }, { "id": 563205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14a784c5-0dbf-56fc-9d84-640b3ceb274b", "parentControlId": 31167, "controlId": "03.03.05.a", "title": "03.03.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583807" }, { "id": 563206, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce6c5a2f-7d6d-551a-ba9c-53dd9a821608", "parentControlId": 31167, "controlId": "03.03.05.c", "title": "03.03.05.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583807" }, { "id": 563212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8eb9504d-2523-5a48-a55c-9ee5e1050a24", "parentControlId": 31167, "controlId": "DE.AE-03", "title": "DE.AE-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583807" }, { "id": 563213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0df1fb8-4992-5ffc-ace0-bb0788c72a96", "parentControlId": 31167, "controlId": "DE.AE-06", "title": "DE.AE-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583807" }, { "id": 563244, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583811", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb2f9251-1271-5074-bc76-10e55938ab0e", "parentControlId": 31167, "controlId": "SITUATION-1e", "title": "SITUATION-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583811" }, { "controlId": "B.1.11", "title": "B.1.11 — Supervision and Review — Access Control", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-2(4), AU-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "c25c3c04-27cb-5167-a801-a7fed46874e4", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.11", "title": "NEI 08-09 App D.1.11 — Supervision and Review — Access Control", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.11", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "42865cbd-6079-5791-925c-1f31d87421c0", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.11", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "2354950f-d835-5b92-bf43-962a2aa2a29b", "isPublic": true }, { "controlId": "B.2.2", "title": "B.2.2 — Auditable Events", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "acf1c5c1-1128-5d36-b8ce-c9d9c4115856", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.2", "title": "NEI 08-09 App D.2.2 — Auditable Events", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "7d302f49-7280-5e85-adde-6117605ed662", "isPublic": true }, { "controlId": "B.2.6", "title": "B.2.6 — Audit Review, Analysis, and Reporting", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "4ece0696-9238-5af3-bd6f-ce43c5caa209", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.6", "title": "NEI 08-09 App D.2.6 — Audit Review, Analysis, and Reporting", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "ff7a4610-6767-58e9-a2a6-21a2d3ac2f9e", "isPublic": true }, { "controlId": "CIP-007-6-R4", "title": "CIP-007-6-R4 — Security Event Monitoring", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "46a136f6-9adc-5e57-ab22-51edda46a5b3", "isPublic": true }, { "controlId": "CIP-007-6-4.1", "title": "CIP-007-6-4.1 — Log events at the BES Cyber System level (per BES Cyber System capability) or at the Cyber Asset level (per Cyber Ass...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0722eb18-7c0b-5531-9d21-2feed19d9888", "isPublic": true }, { "controlId": "CIP-007-6-4.1.1", "title": "CIP-007-6-4.1.1 — Detected successful login attempts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e3805fe0-673e-5e03-bce5-ce03a946deba", "isPublic": true }, { "controlId": "CIP-007-6-4.1.2", "title": "CIP-007-6-4.1.2 — Detected failed access attempts and failed login attempts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b41503a2-256b-56cb-bf6b-048a9312bbaa", "isPublic": true }, { "controlId": "CIP-007-6-4.1.3", "title": "CIP-007-6-4.1.3 — Detected malicious code.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b345b4f2-2f0a-57f3-bec9-016161e176c9", "isPublic": true }, { "controlId": "CIP-007-6-4.2", "title": "CIP-007-6-4.2 — Generate alerts for security events that the Responsible Entity determines necessitates an alert, that includes, as a...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "903605e8-5d72-5eba-875e-6f5e23040d6f", "isPublic": true }, { "controlId": "CIP-007-6-4.2.1", "title": "CIP-007-6-4.2.1 — Detected malicious code from Part 4.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "deeaa775-c9c1-562a-9796-087dbcb18d5a", "isPublic": true }, { "controlId": "CIP-007-6-4.2.2", "title": "CIP-007-6-4.2.2 — Detected failure of Part 4.1 event logging.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "aa86ea77-38b3-5e5f-a77a-57d6560be071", "isPublic": true }, { "controlId": "CIP-007-6-4.3", "title": "CIP-007-6-4.3 — Where technically feasible, retain applicable event logs identified in Part 4.1 for at least the last 90 consecutive...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d82a0e62-1ff2-50af-b217-425665e75eb2", "isPublic": true }, { "controlId": "CIP-007-6-4.4", "title": "CIP-007-6-4.4 — Review a summarization or sampling of logged events as determined by the Responsible Entity at intervals no greater t...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "085178bb-023b-5f38-9c80-f8acc170a34e", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "ff1eaaf0-7a7b-5349-b225-8ea2854ea344", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "31127945-7098-5ef6-a8c1-5c66f47e108b", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "b53d7885-cbae-5077-8904-379bcecd8796", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "1cd09acc-a660-543f-9e74-c3d688180892", "isPublic": true } ], "id": 31167, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730987", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730987", "catalogueId": 1062, "uuid": "5499d2fd-b5ec-5321-b0d2-51ca76b9f519", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize a Security Incident Event Manager (SIEM) or similar automated tool, to support the centralized collection of security-related event logs?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Centralized Collection of Security Event Logs", "description": "

Control Description

Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of security-related event logs.

Evidence Request List (ERL)

E-MON-01\nE-MON-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A log aggregator, or similar automated tool, provides an event log report generation capability to aid in detecting and assessing anomalous activities on business-critical TAASD.\n▪ IT and/or cybersecurity personnel configure alerts for critical or sensitive data that is stored, transmitted and processed on assets.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support the centralized collection of security-related event logs.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.11, B.2.2, B.2.6
NERC-CIP (2026) Requirements: CIP-007-6-R4", "controlId": "MON-02", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-02", "references": "

Micro-Small Business (<10 staff)

∙ Centralized log collector (e.g., Windows Event Forwarding, syslog server)\n∙ Managed Security Services Provider (MSSP)\n∙ Cloud logging (e.g., Microsoft Sentinel free tier, AWS CloudWatch)

Small Business (10-49 staff)

∙ Centralized log collector (e.g., Graylog free, Elastic Stack free)\n∙ Managed Security Services Provider (MSSP)\n∙ Cloud SIEM (e.g., Microsoft Sentinel, Sumo Logic)

Medium Business (50-249 staff)

∙ Centralized log collector\n∙ Security Incident Event Manager (SIEM) (e.g., Splunk, Microsoft Sentinel, IBM QRadar)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Enterprise SIEM with centralized log collection (e.g., Splunk, Microsoft Sentinel)\n∙ Log management platform (e.g., Splunk, Elastic Stack, Graylog)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Enterprise SIEM with scalable log ingestion (e.g., Splunk Enterprise, IBM QRadar)\n∙ Log management and analytics platform\n∙ Managed Detection and Response (MDR) or in-house SOC\n∙ Log data lake for long-term retention and threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70448, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590222", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590222", "securityControlId": 31168, "ccis": [], "uuid": "34dea5a2-f2fa-5dc9-b264-3fca1c8dcf0f", "testId": "MON-02.1_A01", "test": "authorized use of the system is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.14.7[a]", "defaultText": null }, { "id": 70449, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590222", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590222", "securityControlId": 31168, "ccis": [], "uuid": "1835aaa1-5998-5e08-b3b0-a1768c6cc208", "testId": "MON-02.1_A02", "test": "unauthorized use of the system is identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.14.7[b]", "defaultText": null }, { "id": 70450, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590223", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590223", "securityControlId": 31168, "ccis": [], "uuid": "9d65e5b1-f2a6-57a5-a7c9-e60aefcc372b", "testId": "MON-02.1_A03", "test": "incident information and individual incident responses are correlated to achieve an organization-wide perspective on incident awareness and response.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(04)", "defaultText": null }, { "id": 70451, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590223", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590223", "securityControlId": 31168, "ccis": [], "uuid": "90b33e5c-2900-5df3-8806-fc1f1679ceaa", "testId": "MON-02.1_A04", "test": "audit records across different repositories are correlated to gain organization-wide situational awareness.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-06(03)\n53A_R5_IR-04(04)\n53A_R5_SI-04(16)\n171A_R3_A.03.03.05.c[02]", "defaultText": null }, { "id": 70452, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590223", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590223", "securityControlId": 31168, "ccis": [], "uuid": "dbd1a28c-8594-57e8-8206-4c397f1236b5", "testId": "MON-02.1_A05", "test": "audit record review, analysis and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious or unusual activity are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.3.5[a]", "defaultText": null }, { "id": 70453, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590223", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590223", "securityControlId": 31168, "ccis": [], "uuid": "5cb3d475-f100-5cc0-8477-6bd07bc8275b", "testId": "MON-02.1_A06", "test": "defined audit record review, analysis and reporting processes are correlated.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.3.5[b]", "defaultText": null } ], "externalMappings": [ { "id": 563349, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c06ef67-c360-57ec-ae05-2065a207f756", "parentControlId": 31168, "controlId": "8.15", "title": "8.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583824" }, { "id": 563352, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0094e753-3121-59b7-b505-13923efe2e80", "parentControlId": 31168, "controlId": "AU-6(3)", "title": "AU-6(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583824" }, { "id": 563353, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8df5b9d8-cfdd-586e-a434-7df12ba7688f", "parentControlId": 31168, "controlId": "IR-4(4)", "title": "IR-4(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583824" }, { "id": 563354, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60166c9a-8c7d-5a39-b118-378d5edc0347", "parentControlId": 31168, "controlId": "SI-4(16)", "title": "SI-4(16)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583824" }, { "id": 563355, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583824", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17361781-1848-5aa3-9c8b-cea6249f86ea", "parentControlId": 31168, "controlId": "AU-06(03)", "title": "AU-06(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583824" }, { "id": 563356, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3706eb95-8a35-559d-9104-734bc091257b", "parentControlId": 31168, "controlId": "AU-06(09)", "title": "AU-06(09)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583825" }, { "id": 563357, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37ef619c-8dfd-51c0-94f1-6bb76b514304", "parentControlId": 31168, "controlId": "IR-04(04)", "title": "IR-04(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583825" }, { "id": 563358, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc33f967-640d-5e85-b54b-3010577b96f8", "parentControlId": 31168, "controlId": "SI-04(16)", "title": "SI-04(16)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583825" }, { "id": 563360, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79b57e9f-f089-56db-bd6e-6c5819456ae8", "parentControlId": 31168, "controlId": "AU-06(03)", "title": "AU-06(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583825" }, { "id": 563361, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8294522a-bce9-53c4-abc8-5cc80966b694", "parentControlId": 31168, "controlId": "IR-04(04)", "title": "IR-04(04)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583825" }, { "id": 563362, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c18c086-dcc2-5412-b355-db2e638de7ef", "parentControlId": 31168, "controlId": "AU-06(03)", "title": "AU-06(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583825" }, { "id": 563363, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f32353ac-9a63-5ae6-ba18-2d6b804a4500", "parentControlId": 31168, "controlId": "AU-06(09)", "title": "AU-06(09)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583825" }, { "id": 563364, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6b51a5e-cc80-5a5e-a948-85ec2cb86dec", "parentControlId": 31168, "controlId": "IR-04(04)", "title": "IR-04(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583825" }, { "id": 563365, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36f199cf-25d0-5e0e-80dd-93aed1d92f85", "parentControlId": 31168, "controlId": "SI-04(16)", "title": "SI-04(16)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583826" }, { "id": 563366, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca449e0f-981b-5ae0-bd73-b209323fae1b", "parentControlId": 31168, "controlId": "AU-06(03)", "title": "AU-06(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583826" }, { "id": 563367, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b7a8c8c-1125-5a84-b9b5-69a9809526b8", "parentControlId": 31168, "controlId": "AU-06(03)", "title": "AU-06(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583826" }, { "id": 563368, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c7cbe28-cb27-53b5-a3a4-df3f675b6a5f", "parentControlId": 31168, "controlId": "IR-04(04)", "title": "IR-04(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583826" }, { "id": 563373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3f00991-98bb-5d9f-bc57-6495947d1ca0", "parentControlId": 31168, "controlId": "AU-6(9)", "title": "AU-6(9)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583827" }, { "id": 563375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a16ba8d-ba71-57b8-a910-a70d48ce5936", "parentControlId": 31168, "controlId": "3.3.5", "title": "3.3.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583827" }, { "id": 563376, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8914a3d-d884-5785-9097-fd379be19a67", "parentControlId": 31168, "controlId": "3.14.7", "title": "3.14.7", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583827" }, { "id": 563377, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e39ca13-548e-5c51-ab50-de8945bc4c4d", "parentControlId": 31168, "controlId": "03.03.05.a", "title": "03.03.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583827" }, { "id": 563378, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cff34c30-3e9b-52bf-9f69-b6ea3552ac2d", "parentControlId": 31168, "controlId": "03.03.05.c", "title": "03.03.05.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583827" }, { "id": 563386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30bd2f78-fcc6-59f2-b167-63fde2da0098", "parentControlId": 31168, "controlId": "DE.AE-03", "title": "DE.AE-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583828" }, { "id": 563387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9eb4a85-6a76-59b8-b723-0fc03b53428f", "parentControlId": 31168, "controlId": "DE.AE-06", "title": "DE.AE-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583828" }, { "id": 563403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58383", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90df3ff0-c364-59c6-8589-84334b09b483", "parentControlId": 31168, "controlId": "SITUATION-1e", "title": "SITUATION-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58383" }, { "id": 563404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58383", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "471a33b2-bdb1-5b42-be3c-493d63e5f4d3", "parentControlId": 31168, "controlId": "SITUATION-3e", "title": "SITUATION-3e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58383" }, { "id": 563405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58383", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c64da99a-d938-5b02-b0cb-a769a077a2da", "parentControlId": 31168, "controlId": "RESPONSE-1d", "title": "RESPONSE-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58383" }, { "controlId": "B.2.3", "title": "B.2.3 — Content of Audit Records", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "f69b2b5a-159c-5158-9aef-952aa5eea977", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.3", "title": "NEI 08-09 App D.2.3 — Content of Audit Records", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "b1d3a621-96e9-5fbf-b4a0-bf571de5a30b", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.2.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "fa64dcc8-195a-53cd-a183-c265ae232457", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "e2f58fa9-5ae4-507f-87d8-73592a5321b8", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "e903fe7c-f9f9-5738-b092-cd8cb22a3ece", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "4c73fef3-972b-5bd0-b466-6e3460a9d343", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "646a70ef-5bcd-52bb-89ac-b867e5d2da7b", "isPublic": true } ], "id": 31168, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730987", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730987", "catalogueId": 1062, "uuid": "905f5a9b-bc6a-5f70-9047-928bfe013237", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to correlate both technical and non-technical information from across the enterprise by a Security Incident Event Manager (SIEM) or similar automated tool, to enhance organization-wide situational awareness?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Correlate Monitoring Information", "description": "

Control Description

Automated mechanisms exist to correlate both technical and non-technical information from across the enterprise by a Security Incident Event Manager (SIEM) or similar automated tool, to enhance organization-wide situational awareness.

Evidence Request List (ERL)

E-MON-05\nE-MON-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A log aggregator, or similar automated tool, provides an event log report generation capability to aid in detecting and assessing anomalous activities on business-critical TAASD.\n▪ IT and/or cybersecurity personnel configure alerts for critical or sensitive data that is stored, transmitted and processed on assets.\n▪ Logs of vulnerability scanning activities and associated administrator accounts are reviewed to ensure that those activities are limited to the timeframes of legitimate scans.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to automatically correlate both technical and non-technical information from across the enterprise by a Security Incident Event Manager (SIEM) or similar automated tool, to enhance organization-wide situational awareness.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.2.3", "controlId": "MON-02.1", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70454, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590223", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590223", "securityControlId": 31169, "ccis": [], "uuid": "22470988-5981-53a5-a69d-af0344975120", "testId": "MON-02.2_A01", "test": "the capability to centrally review and analyze audit records from multiple components within the system is provided.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-06(04)[01]", "defaultText": null }, { "id": 70455, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590224", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590224", "securityControlId": 31169, "ccis": [], "uuid": "f4fa6a20-7368-5349-9b38-2cb789a6a661", "testId": "MON-02.2_A02", "test": "the capability to centrally review and analyze audit records from multiple components within the system is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-06(04)[02]", "defaultText": null } ], "externalMappings": [ { "id": 563457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e5965bf-e853-561b-8990-124d3297eb58", "parentControlId": 31169, "controlId": "SR 2.8 RE 1", "title": "SR 2.8 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583837" }, { "id": 563458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1788be64-8ee5-5ca9-b7a1-2081f7d28677", "parentControlId": 31169, "controlId": "6.8", "title": "6.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583837" }, { "id": 563459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5ef7d4d-19d5-558d-a073-2a21bd46489b", "parentControlId": 31169, "controlId": "8.15", "title": "8.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583837" }, { "id": 563460, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a89f43d0-3154-54cc-961f-7dc56927cef3", "parentControlId": 31169, "controlId": "8.16", "title": "8.16", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583837" }, { "id": 563466, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56c13f61-c022-5cf4-9c99-ccda5f77e699", "parentControlId": 31169, "controlId": "AU-6(4)", "title": "AU-6(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583846" }, { "id": 563467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a82ce69-ab53-5a08-a855-805321794532", "parentControlId": 31169, "controlId": "AU-06(04)", "title": "AU-06(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583846" }, { "id": 563468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4cf1d248-1add-5361-bd03-c9c311a05e6b", "parentControlId": 31169, "controlId": "AU-06(04)", "title": "AU-06(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583846" }, { "id": 563469, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c91da62-d1d0-5051-bf58-ef4948fbeeda", "parentControlId": 31169, "controlId": "03.03.01.b", "title": "03.03.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583847" }, { "id": 563470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5f1b0fe-a874-517f-a9d9-ef0f6b2de0a1", "parentControlId": 31169, "controlId": "03.03.05.a", "title": "03.03.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583847" }, { "id": 563471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc1de627-60cf-5a70-bf13-b72394150bf1", "parentControlId": 31169, "controlId": "03.03.05.c", "title": "03.03.05.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583847" }, { "controlId": "B.2.12", "title": "B.2.12 — Audit Generation", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-12", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "53eb9224-a342-5ba6-beaf-2b1c01f64955", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.12", "title": "NEI 08-09 App D.2.12 — Audit Generation", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.12", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "4988b488-cf31-5dc4-8149-a27d8ae14821", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.2.12", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "651388c9-b188-5ac3-b9c9-65da9f6723f3", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "61bc15de-3264-5f6a-a70f-b76b6cd607b9", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "b348708a-3047-5763-a58d-3f5dc96a1f74", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "c3819507-acaf-5355-b267-4faed71b1bb1", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "dade25fc-40f6-5d0d-91fc-f127a3419f2a", "isPublic": true } ], "id": 31169, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730987", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730987", "catalogueId": 1062, "uuid": "d7401c60-7dd2-54a4-ad43-04deb7988bf0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to centrally collect, review and analyze audit records from multiple sources?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Central Review & Analysis", "description": "

Control Description

Automated mechanisms exist to centrally collect, review and analyze audit records from multiple sources.

Evidence Request List (ERL)

E-MON-01\nE-MON-02\nE-MON-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A log aggregator, or similar automated tool, provides an event log report generation capability to aid in detecting and assessing anomalous activities on business-critical TAASD.\n▪ IT and/or cybersecurity personnel configure alerts for critical or sensitive data that is stored, transmitted and processed on assets.\n▪ Logs of privileged functions (e.g., administrator or root actions) are reviewed for evidence of unauthorized activities.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to automatically centrally collect, review and analyze audit records from multiple sources.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.2.12", "controlId": "MON-02.2", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-02.2", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70456, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590224", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590224", "securityControlId": 31170, "ccis": [], "uuid": "6a67e8e1-2f0a-56b4-a0f0-3dcb78e4f053", "testId": "MON-02.3_A01", "test": "data/information collected from other sources to be analyzed is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-06(05)_ODP[02]", "defaultText": null }, { "id": 70457, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590224", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590224", "securityControlId": 31170, "ccis": [], "uuid": "d1156451-6dc6-5fe4-9c43-9e074eeba87b", "testId": "MON-02.3_A02", "test": "information from monitoring physical, cyber and supply chain activities are correlated to achieve integrated, organization-wide situational awareness.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(17)\n53A_R5_AU-06(05)_ODP[01]", "defaultText": null }, { "id": 70458, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590224", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590224", "securityControlId": 31170, "ccis": [], "uuid": "6391fab5-0eae-5fde-b890-3314f9cb8efc", "testId": "MON-02.3_A03", "test": "analysis of audit records is integrated with analysis of organization-specific criteria to further enhance the ability to identify inappropriate or unusual activity.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-06(05)", "defaultText": null } ], "externalMappings": [ { "id": 563549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583857", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6141da8b-8793-5634-bd7a-51be3f7fe30a", "parentControlId": 31170, "controlId": "AU-6(5)", "title": "AU-6(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583857" }, { "id": 563550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583857", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8db082a3-107b-555c-a070-673e0f1e5dff", "parentControlId": 31170, "controlId": "AU-06(05)", "title": "AU-06(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583857" }, { "id": 563551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583857", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91d11cda-4215-51bf-8119-47555241e992", "parentControlId": 31170, "controlId": "SI-04(17)", "title": "SI-04(17)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583857" }, { "id": 563552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583857", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41ab27ee-6c51-5b28-9885-d5c6208605d1", "parentControlId": 31170, "controlId": "AU-06(05)", "title": "AU-06(05)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583857" }, { "id": 563553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583857", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e809b6d-b8b4-5255-854b-18fc9430b259", "parentControlId": 31170, "controlId": "AU-06(05)", "title": "AU-06(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583857" }, { "id": 563554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583857", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd21ccfb-0a2d-5c56-8302-f0d1445b685d", "parentControlId": 31170, "controlId": "SI-04(17)", "title": "SI-04(17)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583857" }, { "id": 563555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583857", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3643c959-9b4b-5cc7-8ba7-c36ccd40e294", "parentControlId": 31170, "controlId": "AU-06(05)", "title": "AU-06(05)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583858" }, { "id": 563558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583858", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0a647b8-97a2-552a-9413-b90af26ca6d4", "parentControlId": 31170, "controlId": "SI-4(17)", "title": "SI-4(17)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583858" }, { "id": 563561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583858", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60e02e60-037a-53c2-b566-ef066448085e", "parentControlId": 31170, "controlId": "03.03.05.c", "title": "03.03.05.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583858" }, { "id": 563568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583859", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac08a95f-893a-5693-aac3-abb0ad530955", "parentControlId": 31170, "controlId": "RESPONSE-1d", "title": "RESPONSE-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583859" } ], "id": 31170, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730988", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730988", "catalogueId": 1062, "uuid": "0835a474-3f45-5ea8-b90a-3ec0990ac3fd", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to integrate the analysis of audit records with analysis of vulnerability scanners, network performance, system monitoring and other sources to further enhance the ability to identify inappropriate or unusual activity?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Integration of Scanning & Other Monitoring Information", "description": "

Control Description

Automated mechanisms exist to integrate the analysis of audit records with analysis of vulnerability scanners, network performance, system monitoring and other sources to further enhance the ability to identify inappropriate or unusual activity.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to automatically integrate the analysis of audit records with analysis of vulnerability scanners, network performance, system monitoring and other sources to further enhance the ability to identify inappropriate or unusual activity.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "MON-02.3", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-02.3", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70459, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590225", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590225", "securityControlId": 31171, "ccis": [], "uuid": "778964ed-7101-501f-aa08-761304e07e9f", "testId": "MON-02.4_A01", "test": "information from audit records is correlated with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual or malevolent activity.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-06(06)", "defaultText": null } ], "externalMappings": [ { "id": 563585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583861", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd4c901b-9d7f-576a-aea2-3e7e53e0569f", "parentControlId": 31171, "controlId": "AU-6(6)", "title": "AU-6(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583861" }, { "id": 563586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583861", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60f7224c-5c1d-52e6-b99b-523ea4d18781", "parentControlId": 31171, "controlId": "AU-06(06)", "title": "AU-06(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583861" }, { "id": 563587, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583861", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f2ec9f1-d78e-540d-8776-9a184efe631c", "parentControlId": 31171, "controlId": "AU-06(06)", "title": "AU-06(06)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583861" }, { "id": 563588, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583861", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "adab0bfd-8add-504d-a160-ec90d5999eb8", "parentControlId": 31171, "controlId": "AU-06(06)", "title": "AU-06(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583861" }, { "id": 563589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583861", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5db5da04-6472-5147-b65d-0ae60f3ac9f2", "parentControlId": 31171, "controlId": "AU-06(06)", "title": "AU-06(06)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583861" } ], "id": 31171, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730988", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730988", "catalogueId": 1062, "uuid": "64ea2a2d-8597-5942-a720-c7f3e99d30ef", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual or malevolent activity?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Correlation with Physical Monitoring", "description": "

Control Description

Automated mechanisms exist to correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual or malevolent activity.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to automatically correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual or malevolent activity.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "MON-02.4", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-02.4", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70460, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590225", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590225", "securityControlId": 31172, "ccis": [], "uuid": "f5627ad1-46a5-5f17-b856-295ea79148a0", "testId": "MON-02.5_A01", "test": "the permitted actions for each organization-defined criteria (e.g., system process, role or user) associated with the review, analysis and reporting of audit record information are specified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-06(07)\n53A_R5_AU-06(07)_ODP", "defaultText": null } ], "externalMappings": [ { "id": 563597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583862", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fea4efc-f1cc-5ade-b6ce-b594f33b1711", "parentControlId": 31172, "controlId": "AU-6(7)", "title": "AU-6(7)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583862" }, { "id": 563598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583862", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0704f14c-fe3d-5973-bf06-3eec6336fac4", "parentControlId": 31172, "controlId": "AU-06(07)", "title": "AU-06(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583863" }, { "id": 563599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583863", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72dde610-63cd-591a-a721-06615aa2c99c", "parentControlId": 31172, "controlId": "AU-06(07)", "title": "AU-06(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583863" } ], "id": 31172, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730989", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730989", "catalogueId": 1062, "uuid": "9d003899-8bd0-5b9c-9e18-b9b30d4fafac", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization specify the permitted actions for both users and Technology Assets, Applications and/or Services (TAAS) associated with the review, analysis and reporting of audit information?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Permitted Actions", "description": "

Control Description

Mechanisms exist to specify the permitted actions for both users and Technology Assets, Applications and/or Services (TAAS) associated with the review, analysis and reporting of audit information.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to specify the permitted actions for both users and Technology Assets, Applications and/or Services (TAAS) associated with the review, analysis and reporting of audit information.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-02.5", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-02.5", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70461, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590225", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590225", "securityControlId": 31173, "ccis": [], "uuid": "a81bf932-9d9b-5312-90f2-4f659d4e11ea", "testId": "MON-02.6_A01", "test": "system audit records are reviewed and analyzed per an organization-defined frequency for indications of organization-defined inappropriate or unusual activity and the potential impact of the inappropriate or unusual activity.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least weekly", "otherId": "53A_R5_AU-06a.", "defaultText": null }, { "id": 70462, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590226", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590226", "securityControlId": 31173, "ccis": [], "uuid": "c8566c68-11cc-5a00-8d33-31acd046325b", "testId": "MON-02.6_A02", "test": "findings are reported to organization-defined personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least weekly", "otherId": "53A_R5_AU-06b.", "defaultText": null }, { "id": 70463, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590226", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590226", "securityControlId": 31173, "ccis": [], "uuid": "292ffbf8-4f16-5a1c-8b78-37070f9885ec", "testId": "MON-02.6_A03", "test": "the level of audit record review, analysis and reporting within the system is adjusted when there is a change in risk based on law enforcement information, intelligence information or other credible sources of information.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-06c.", "defaultText": null }, { "id": 70464, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590226", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590226", "securityControlId": 31173, "ccis": [], "uuid": "50b522a7-cde2-5a05-9c21-1f57d9af7121", "testId": "MON-02.6_A04", "test": "the frequency at which system audit records are reviewed and analyzed is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least weekly", "otherId": "53A_R5_AU-06_ODP[01]", "defaultText": null }, { "id": 70465, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590226", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590226", "securityControlId": 31173, "ccis": [], "uuid": "4e67d867-7cf9-5b72-abb5-ef3f153cebf9", "testId": "MON-02.6_A05", "test": "inappropriate or unusual activity is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AU-06_ODP[02]", "defaultText": null }, { "id": 70466, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590226", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590226", "securityControlId": 31173, "ccis": [], "uuid": "65c3ee2f-8979-52ac-b37d-0d2c6354ad98", "testId": "MON-02.6_A06", "test": "personnel or roles to receive findings from reviews and analyses of system records is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AU-06_ODP[03]", "defaultText": null } ], "externalMappings": [ { "id": 563608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee1f17fd-4f28-573f-8878-09770eb04a56", "parentControlId": 31173, "controlId": "AU-6(10)", "title": "AU-6(10)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583864" }, { "id": 563609, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d18d0d27-ad02-512e-920f-36f85211bb37", "parentControlId": 31173, "controlId": "AU-06", "title": "AU-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583864" }, { "id": 563611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b7daa35-a581-55fd-8b41-ffc893ebd74b", "parentControlId": 31173, "controlId": "AU-06", "title": "AU-06", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583864" }, { "id": 563612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8643e03e-860d-5d0f-a98e-67de16467015", "parentControlId": 31173, "controlId": "AU-06", "title": "AU-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583864" }, { "id": 563613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ed774b9-a50d-5961-9a8c-b835649a76cb", "parentControlId": 31173, "controlId": "AU-06", "title": "AU-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583864" }, { "id": 563614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66ccd2e4-351f-540e-bc81-e67d36a82934", "parentControlId": 31173, "controlId": "AU-06", "title": "AU-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583864" }, { "id": 563615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86e08ba2-b3e7-574a-a83d-f2b70d93db9b", "parentControlId": 31173, "controlId": "AU-06", "title": "AU-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583864" }, { "id": 563617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583865", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "182e3d59-cd67-5871-9793-7ef0d00e37fd", "parentControlId": 31173, "controlId": "AU-6", "title": "AU-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583865" }, { "id": 563618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583865", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49a6b6ff-fb3b-512d-a7a7-1823f407512f", "parentControlId": 31173, "controlId": "AU-6", "title": "AU-6", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583865" } ], "id": 31173, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730989", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730989", "catalogueId": 1062, "uuid": "fc6f4fbf-d421-5c90-9e26-64955143e78e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization adjust the level of audit review, analysis and reporting based on evolving threat information from law enforcement, industry associations or other credible sources of threat intelligence?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Audit Level Adjustments", "description": "

Control Description

Mechanisms exist to adjust the level of audit review, analysis and reporting based on evolving threat information from law enforcement, industry associations or other credible sources of threat intelligence.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to adjust the level of audit review, analysis and reporting based on evolving threat information from law enforcement, industry associations or other credible sources of threat intelligence.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-02.6", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-02.6", "references": "

Micro-Small Business (<10 staff)

∙ Review system logs periodically

Small Business (10-49 staff)

∙ Log monitoring policy\n∙ Regular review of key system logs

Medium Business (50-249 staff)

∙ SIEM (e.g., Wazuh)\n∙ Automated log collection and alerting

Large Business (250-999 staff)

∙ Enterprise SIEM (e.g., Splunk, IBM QRadar)\n∙ Continuous monitoring program\n∙ SOC monitoring

Enterprise (>1,000 staff)

∙ Enterprise SIEM/SOAR platform\n∙ 24/7 SOC monitoring\n∙ Threat hunting\n∙ Automated incident response", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70467, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590227", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590227", "securityControlId": 31174, "ccis": [], "uuid": "9c5effc0-6bc8-5292-bfef-156847c5aa9a", "testId": "MON-02.7_A01", "test": "system components from which audit records are to be compiled into a system-wide (logical or physical) audit trail are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-12(01)_ODP[01]", "defaultText": null }, { "id": 70468, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590227", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590227", "securityControlId": 31174, "ccis": [], "uuid": "4e9a5f3e-eff0-5c01-8c6a-674cf2db3a46", "testId": "MON-02.7_A02", "test": "level of tolerance for the relationship between timestamps of individual records in the audit trail is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-12(01)_ODP[02]", "defaultText": null }, { "id": 70469, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590227", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590227", "securityControlId": 31174, "ccis": [], "uuid": "f2fe165b-b5d2-50be-847f-edeee15860e0", "testId": "MON-02.7_A03", "test": "audit records from organization-defined system components are compiled into a system-wide (logical or physical) audit trail that is time-correlated to within organization-defined level of tolerance.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-12(01)", "defaultText": null } ], "externalMappings": [ { "id": 563642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "adb7143d-8767-5253-a21f-e80360bce0a4", "parentControlId": 31174, "controlId": "AU-12(1)", "title": "AU-12(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583868" }, { "id": 563643, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9dd24b27-0870-5d2c-a6bd-343f5653e4d7", "parentControlId": 31174, "controlId": "AU-12(01)", "title": "AU-12(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583868" }, { "id": 563644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50aff35b-d862-5453-ac81-18cc629c136c", "parentControlId": 31174, "controlId": "AU-12(01)", "title": "AU-12(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583868" }, { "id": 563645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a304fcaf-51eb-5947-ab07-468b745b29e1", "parentControlId": 31174, "controlId": "AU-12(01)", "title": "AU-12(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583868" }, { "id": 563646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f8e39b1-6a36-5ad2-a685-0e6cd026ec4e", "parentControlId": 31174, "controlId": "AU-12(01)", "title": "AU-12(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583868" }, { "id": 563647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "095d1ea9-0e98-56ef-aea8-149653535916", "parentControlId": 31174, "controlId": "03.03.01.a", "title": "03.03.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583868" } ], "id": 31174, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730989", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730989", "catalogueId": 1062, "uuid": "2b123942-26f4-5dc2-b826-15e5ed2df728", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to compile audit records into an organization-wide audit trail that is time-correlated?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "System-Wide / Time-Correlated Audit Trail", "description": "

Control Description

Automated mechanisms exist to compile audit records into an organization-wide audit trail that is time-correlated.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ SBC enforce logging to link system access to individual users or service accounts using a non-repudiation capability to protect against an individual falsely denying having performed a particular action.\n▪ SBC enforce local security event logging and forward those logs to a centralized log repository to provide an alternate audit capability in the event of a failure in the primary audit capability.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to automatically compile audit records into an organization-wide audit trail that is time-correlated.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "MON-02.7", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-02.7", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70470, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590227", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590227", "securityControlId": 31175, "ccis": [], "uuid": "47d79ba3-66cc-5220-975b-6f235488325e", "testId": "MON-02.8_A01", "test": "individuals or roles authorized to change the logging on system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-12(03)_ODP[01]", "defaultText": null }, { "id": 70471, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590227", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590227", "securityControlId": 31175, "ccis": [], "uuid": "310719c6-9537-5ba3-b8a8-9d2893d8c3ad", "testId": "MON-02.8_A02", "test": "system components on which logging is to be performed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-12(03)_ODP[02]", "defaultText": null }, { "id": 70472, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590228", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590228", "securityControlId": 31175, "ccis": [], "uuid": "cace72ff-5121-5638-9854-4c62c44e140c", "testId": "MON-02.8_A03", "test": "selectable event criteria with which change logging is to be performed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-12(03)_ODP[03]", "defaultText": null }, { "id": 70473, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590228", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590228", "securityControlId": 31175, "ccis": [], "uuid": "88d3ca1e-46cd-5072-b8b8-4c29449fa2a3", "testId": "MON-02.8_A04", "test": "the capability for organization-defined individuals or roles to change the logging to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds is provided / implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-12(03)[01]\n53A_R5_AU-12(03)[02]\n53A_R5_AU-12(03)_ODP[04]", "defaultText": null } ], "externalMappings": [ { "id": 563683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583872", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7375bc1f-9dbc-5d72-897f-bcfd8dec410f", "parentControlId": 31175, "controlId": "AU-12(3)", "title": "AU-12(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583873" }, { "id": 563684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80ef9a36-b708-5760-b7ba-6e978d735c0a", "parentControlId": 31175, "controlId": "AU-12(03)", "title": "AU-12(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583873" }, { "id": 563685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "006cfb6d-30c2-5131-9dab-413016341c7c", "parentControlId": 31175, "controlId": "AU-12(03)", "title": "AU-12(03)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583873" }, { "id": 563686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f58e0cab-6826-5959-9796-e6f69994d6f8", "parentControlId": 31175, "controlId": "AU-12(03)", "title": "AU-12(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583873" }, { "id": 563687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ccaab0cb-a5bf-53e6-b963-c8fb5aed44f2", "parentControlId": 31175, "controlId": "AU-12(03)", "title": "AU-12(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583873" } ], "id": 31175, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73099", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73099", "catalogueId": 1062, "uuid": "9e4a5be6-1af1-561d-91aa-c61ccda3294d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide privileged users or roles the capability to change the auditing to be performed on specified system components, based on specific event criteria within specified time thresholds?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Changes by Authorized Individuals", "description": "

Control Description

Mechanisms exist to provide privileged users or roles the capability to change the auditing to be performed on specified system components, based on specific event criteria within specified time thresholds.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to provide privileged users or roles the capability to change the auditing to be performed on specified system components, based on specific event criteria within specified time thresholds.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-02.8", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-02.8", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70475, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590228", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590228", "securityControlId": 31177, "ccis": [], "uuid": "2360d5db-2c7c-512a-a01a-3f5380647623", "testId": "MON-03_A01", "test": "the content of audit records needed to support monitoring, analysis, investigation and reporting of unlawful or unauthorized system activity is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events.\n\nFor Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes", "otherId": "171A_3.3.1[b]\n171A_3.3.2[a]\n53A_R5_AU-02_ODP[01]\n53A_R5_AU-02_ODP[02]\n53A_R5_AU-02a.\n53A_R5_AU-02c.[01]", "defaultText": null }, { "id": 70476, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590229", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590229", "securityControlId": 31177, "ccis": [], "uuid": "61d7f894-4779-5377-ae3a-cd9f9dcae154", "testId": "MON-03_A02", "test": "audit records contain information that establishes what type of event occurred.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-03a.\n53A_R5_AU-02c.[02]", "defaultText": null }, { "id": 70477, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590229", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590229", "securityControlId": 31177, "ccis": [], "uuid": "c4cd8378-f745-535c-9aa2-f09374c4dfb3", "testId": "MON-03_A03", "test": "audit records contain information that establishes when the event occurred.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-03b.\n53A_R5_AU-02c.[02]\n171A_R3_A.03.03.02.a.02", "defaultText": null }, { "id": 70478, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590229", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590229", "securityControlId": 31177, "ccis": [], "uuid": "0ae0eb8b-fbc2-55ec-abeb-b07dc3671312", "testId": "MON-03_A04", "test": "audit records contain information that establishes where the event occurred.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-03c.\n53A_R5_AU-02c.[02]\n171A_R3_A.03.03.02.a.03", "defaultText": null }, { "id": 70479, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590229", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590229", "securityControlId": 31177, "ccis": [], "uuid": "d9bd1182-2e5e-59e6-b27d-72ab7564796c", "testId": "MON-03_A05", "test": "audit records contain information that establishes the source of the event.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-03d.\n53A_R5_AU-02c.[02]\n171A_R3_A.03.03.02.a.04", "defaultText": null }, { "id": 70480, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590229", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590229", "securityControlId": 31177, "ccis": [], "uuid": "66985108-a582-5ab4-9df0-9559c1df9abb", "testId": "MON-03_A06", "test": "audit records contain information that establishes the outcome of the event.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-03e.\n53A_R5_AU-02c.[02]\n171A_R3_A.03.03.02.a.05", "defaultText": null }, { "id": 70481, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590229", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590229", "securityControlId": 31177, "ccis": [], "uuid": "06e0db50-3ae4-5c7a-bd01-40210a1eeaea", "testId": "MON-03_A07", "test": "audit records contain information that establishes the identity of the individuals, subjects, objects, or entities associated with the event.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-03f.\n171A_R3_A.03.03.02.a.06", "defaultText": null }, { "id": 70482, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590229", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590229", "securityControlId": 31177, "ccis": [], "uuid": "27e4aa73-4192-55a3-9b95-501779b5db2a", "testId": "MON-03_A08", "test": "event logs needed (e.g., event types to be logged) to enable the monitoring, analysis, investigation and reporting of unlawful or unauthorized system activity are specified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.3.1[a]", "defaultText": null }, { "id": 70483, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59023", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59023", "securityControlId": 31177, "ccis": [], "uuid": "231d6d85-e871-5120-9328-a41a5fb33a02", "testId": "MON-03_A09", "test": "a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AU-02d.", "defaultText": null }, { "id": 70484, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59023", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59023", "securityControlId": 31177, "ccis": [], "uuid": "17e5caa8-a6a3-5d73-9539-14e81f878ebd", "testId": "MON-03_A10", "test": "audit records, once created, contain the defined content.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.3.1[d]\n171A_3.3.2[b]", "defaultText": null }, { "id": 70485, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59023", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59023", "securityControlId": 31177, "ccis": [], "uuid": "4ec7e971-dd4d-5eb3-b84a-01473a2ee830", "testId": "MON-03_A11", "test": "the frequency of event types selected for logging are reviewed / updated.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least weekly", "otherId": "53A_R5_AU-02_ODP[04]", "defaultText": null }, { "id": 70486, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59023", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59023", "securityControlId": 31177, "ccis": [], "uuid": "da1159e0-969b-50a0-a2f9-40fdbd131b82", "testId": "MON-03_A12", "test": "event types selected for logging within the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.03.01.ODP[01]", "defaultText": null }, { "id": 70487, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590237", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590237", "securityControlId": 31177, "ccis": [], "uuid": "ee255f40-c909-5133-9cbb-2e2b6374da82", "testId": "MON-03_A13", "test": "the following event types are specified for logging within the system: .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: SDP values:\nat a minimum and where applicable:\n(1) Authentication events:\n (a) Logons (Success/Failure)\n (b) Logoffs (Success)\n(2) Security Relevant File and Objects events:\n (a) Create (Success/Failure)\n (b) Access (Success/Failure)\n (c) Delete (Success/Failure)\n (d) Modify (Success/Failure)\n (e) Permission Modification (Success/Failure)\n (f) Ownership Modification (Success/Failure)\n(3) Export/Writes/downloads to devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure)\n(4) Import/Uploads from devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure)\n(5) User and Group Management events:\n (a) User add, delete, modify, disable, lock (Success/Failure)\n (b) Group/Role add, delete, modify (Success/Failure)\n6) Use of Privileged/Special Rights events:\n (a) Security or audit policy changes (Success/Failure)\n (b) Configuration changes (Success/Failure)\n(7) Admin or root-level access (Success/Failure)\n(8) Privilege/Role escalation (Success/Failure)\n(9) Audit and security relevant log data accesses (Success/Failure)\n(10) System reboot, restart, and shutdown (Success/Failure)\n(11) Print to a device (Success/Failure)\n(12) Print to a file (e.g., pdf format) (Success/Failure)\n(13) Application (e.g., Adobe, Firefox, MS Office Suite) initialization (Success/Failure)\n\nFor additional guidance, see: OMB21-31 ML 1", "otherId": "171A_R3_A.03.03.01.a", "defaultText": null }, { "id": 70488, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590237", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590237", "securityControlId": 31177, "ccis": [], "uuid": "a1e1c25e-9f45-5fd1-9651-4890d3a20b0d", "testId": "MON-03_A14", "test": "the event types selected for logging are updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months and after any significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.03.01.b[02]", "defaultText": null }, { "id": 70489, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590237", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590237", "securityControlId": 31177, "ccis": [], "uuid": "25ec4bdc-b53d-5842-89e1-f66879ad7dab", "testId": "MON-03_A15", "test": "additional information for audit records is provided, as needed.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.03.02.b", "defaultText": null } ], "externalMappings": [ { "id": 563711, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583876", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bef15690-ae70-599d-aaf7-53748c1a060e", "parentControlId": 31177, "controlId": "EVENT 1.5", "title": "EVENT 1.5", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583876" }, { "id": 563712, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583876", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f036c6f1-6236-5808-b2ce-9ef643d454dc", "parentControlId": 31177, "controlId": "CR 2.8", "title": "CR 2.8", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583876" }, { "id": 563713, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583876", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "edbd70ba-23cb-50cf-80fa-52c32d6f6a18", "parentControlId": 31177, "controlId": "8.15", "title": "8.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583876" }, { "id": 563718, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583877", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a906819-71ef-55b4-bf57-499e64de8235", "parentControlId": 31177, "controlId": "AU-3", "title": "AU-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583877" }, { "id": 563719, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583877", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1996f00-1a02-59af-99ac-de999a4b431a", "parentControlId": 31177, "controlId": "DM-2(1)", "title": "DM-2(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583877" }, { "id": 563720, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583877", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "edfc82db-dc2c-5a33-9ac2-0a59c5915dd5", "parentControlId": 31177, "controlId": "AU-03", "title": "AU-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583877" }, { "id": 563721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583877", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1639cfcb-1887-53c7-8a2d-6b64bd7c54f8", "parentControlId": 31177, "controlId": "AU-03", "title": "AU-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583877" }, { "id": 563723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583878", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aaa1ec30-661e-5f31-80ca-dccfb02ec107", "parentControlId": 31177, "controlId": "AU-03", "title": "AU-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583878" }, { "id": 563724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583878", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b00d53e-b5b7-5d94-ba72-49db73821562", "parentControlId": 31177, "controlId": "AU-03", "title": "AU-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583878" }, { "id": 563725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583878", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "954a947d-71d5-5c86-9a2e-01df30ec87a9", "parentControlId": 31177, "controlId": "AU-03", "title": "AU-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583878" }, { "id": 563726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583878", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4ba7b26-5306-5de2-8daf-f1f7c81ba1c6", "parentControlId": 31177, "controlId": "AU-03", "title": "AU-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583878" }, { "id": 563727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583878", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "664b5ab3-d704-539a-b581-0c6eaccd9a20", "parentControlId": 31177, "controlId": "AU-3", "title": "AU-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583878" }, { "id": 563728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583878", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0796856-9e0d-53b8-85a6-a5b787d1f949", "parentControlId": 31177, "controlId": "AU-3", "title": "AU-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583878" }, { "id": 563729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583878", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53f91dfd-f94d-5db6-b9ce-d931074b22a9", "parentControlId": 31177, "controlId": "AU-3", "title": "AU-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583878" }, { "id": 563733, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583879", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef56f735-a21d-5e3c-a2e2-880a54784b72", "parentControlId": 31177, "controlId": "3.3.2", "title": "3.3.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583879" }, { "id": 563734, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583879", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2106aec-2c36-54aa-a822-167b332768dc", "parentControlId": 31177, "controlId": "03.03.01.a", "title": "03.03.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583879" }, { "id": 563735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583879", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08c97098-3eea-5e85-80d9-95bca05b191d", "parentControlId": 31177, "controlId": "03.03.02.a", "title": "03.03.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583879" }, { "id": 563736, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583879", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "090e5354-a6b1-529f-a5c4-adaf80603934", "parentControlId": 31177, "controlId": "03.03.02.a.01", "title": "03.03.02.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583879" }, { "id": 563737, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583879", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "133e28ad-a9e7-5547-b733-c6ca70d83907", "parentControlId": 31177, "controlId": "03.03.02.a.02", "title": "03.03.02.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583879" }, { "id": 563738, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583879", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b551b8b-0e9f-55d7-b108-a0ec151ed0c7", "parentControlId": 31177, "controlId": "03.03.02.a.03", "title": "03.03.02.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583879" }, { "id": 563739, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583879", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d98f528-b392-509e-ae25-71e6dd5cb9da", "parentControlId": 31177, "controlId": "03.03.02.a.04", "title": "03.03.02.a.04", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583879" }, { "id": 563740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583879", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df1368b1-5f8f-595b-b6d0-0d4e9177e049", "parentControlId": 31177, "controlId": "03.03.02.a.05", "title": "03.03.02.a.05", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583879" }, { "id": 563741, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "901fed11-6ae2-51c0-900b-a7966def3646", "parentControlId": 31177, "controlId": "03.03.02.a.06", "title": "03.03.02.a.06", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58388" }, { "id": 563742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d0e53c3-3e89-50f0-89f5-c771c45be65a", "parentControlId": 31177, "controlId": "03.03.02.b", "title": "03.03.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58388" }, { "id": 563757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583882", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "459632d2-a102-52e7-9dc3-37c50525e146", "parentControlId": 31177, "controlId": "PR.PS-04", "title": "PR.PS-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583882" }, { "id": 563831, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12e1cc3c-b1a6-57cd-8b34-aca8767fcb04", "parentControlId": 31177, "controlId": "CIP-007-6 4.1", "title": "CIP-007-6 4.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583898" }, { "id": 563832, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66617514-d1ac-50b2-a1b0-e1261162541b", "parentControlId": 31177, "controlId": "CIP-007-6 4.1.1", "title": "CIP-007-6 4.1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583898" }, { "id": 563833, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583899", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1132fe25-aacb-5e23-abf7-37d4acb598be", "parentControlId": 31177, "controlId": "CIP-007-6 4.1.2", "title": "CIP-007-6 4.1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583899" }, { "id": 563834, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583899", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e4725a2-54dc-5dae-8d2a-f8bf59be60ed", "parentControlId": 31177, "controlId": "CIP-007-6 4.1.3", "title": "CIP-007-6 4.1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583899" }, { "id": 563867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03aa7c2e-fd0f-5b8d-9629-15f677ea2cf3", "parentControlId": 31177, "controlId": "C1.a", "title": "C1.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583904" }, { "controlId": "B.1.11", "title": "B.1.11 — Supervision and Review — Access Control", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-2(4), AU-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "458557a9-51ad-5e2f-bdfc-c36fda38b16f", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.11", "title": "NEI 08-09 App D.1.11 — Supervision and Review — Access Control", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.11", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "5b6d5789-efae-5549-a1ee-19ff010bffb8", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.11", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "a5f3b8cb-4331-5d14-a40f-444fc75fdca0", "isPublic": true }, { "controlId": "B.2.3", "title": "B.2.3 — Content of Audit Records", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "070b9721-7287-54e6-9318-5671b621c889", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.3", "title": "NEI 08-09 App D.2.3 — Content of Audit Records", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "72cefd81-aa6d-5d41-8471-cf7108308895", "isPublic": true }, { "controlId": "B.2.6", "title": "B.2.6 — Audit Review, Analysis, and Reporting", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "426430d8-3097-571c-a18f-928ff1289025", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.6", "title": "NEI 08-09 App D.2.6 — Audit Review, Analysis, and Reporting", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "170bed65-0866-51b5-8595-c03c1f4f0d71", "isPublic": true }, { "controlId": "CIP-007-6-R4", "title": "CIP-007-6-R4 — Security Event Monitoring", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "55951343-9787-5c71-8d0c-aa4fcd5363cf", "isPublic": true }, { "controlId": "CIP-007-6-4.1", "title": "CIP-007-6-4.1 — Log events at the BES Cyber System level (per BES Cyber System capability) or at the Cyber Asset level (per Cyber Ass...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b7124da3-620a-5630-afdb-9be6a87b16d1", "isPublic": true }, { "controlId": "CIP-007-6-4.1.1", "title": "CIP-007-6-4.1.1 — Detected successful login attempts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "02aa18f7-573a-5ac3-9c24-dc7fbd68bf92", "isPublic": true }, { "controlId": "CIP-007-6-4.1.2", "title": "CIP-007-6-4.1.2 — Detected failed access attempts and failed login attempts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4cf8ffea-6387-5a54-8089-177b8798c0ca", "isPublic": true }, { "controlId": "CIP-007-6-4.1.3", "title": "CIP-007-6-4.1.3 — Detected malicious code.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "63434237-4729-5f79-b95e-218306e3a367", "isPublic": true }, { "controlId": "CIP-007-6-4.2", "title": "CIP-007-6-4.2 — Generate alerts for security events that the Responsible Entity determines necessitates an alert, that includes, as a...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5bc0ed87-9762-5f84-a8ac-d4b3fbc6cf57", "isPublic": true }, { "controlId": "CIP-007-6-4.2.1", "title": "CIP-007-6-4.2.1 — Detected malicious code from Part 4.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3cbca97d-e09f-54af-81aa-9c2354a4acc7", "isPublic": true }, { "controlId": "CIP-007-6-4.2.2", "title": "CIP-007-6-4.2.2 — Detected failure of Part 4.1 event logging.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f5f9e0be-2c09-570b-bec6-31647797211f", "isPublic": true }, { "controlId": "CIP-007-6-4.3", "title": "CIP-007-6-4.3 — Where technically feasible, retain applicable event logs identified in Part 4.1 for at least the last 90 consecutive...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e62d0700-5b8a-5aac-8a9f-148d54ae48ce", "isPublic": true }, { "controlId": "CIP-007-6-4.4", "title": "CIP-007-6-4.4 — Review a summarization or sampling of logged events as determined by the Responsible Entity at intervals no greater t...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c7cd7169-d157-5bcb-83fc-d950820aa187", "isPublic": true }, { "controlId": "CIP-015-1-R3", "title": "CIP-015-1-R3 — INSM Anomalous Activity Evaluation and Response", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a974f967-a8d4-5384-ae17-d11ce2458565", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "9296e87c-2fed-5a30-9dd1-141c6f870b3b", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "c7498030-0745-54b7-9fb8-307e44ea930f", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "e3da52d1-ab4d-5ae3-b39a-a97de5268f35", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "69158e28-5df6-5ec8-844e-6eba36f976e9", "isPublic": true } ], "id": 31177, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73099", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73099", "catalogueId": 1062, "uuid": "ce93331c-7576-53b4-af8a-57a5449a30f5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization configure Technology Assets, Applications and/or Services (TAAS) to produce event logs that contain sufficient information to, at a minimum:\n (1) Establish what type of event occurred;\n (2) When (date and time) the event occurred;\n (3) Where the event occurred;\n (4) The source of the event;\n (5) The outcome (success or failure) of the event; and \n (6) The identity of any user/subject associated with the event?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Content of Event Logs", "description": "

Control Description

Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to produce event logs that contain sufficient information to, at a minimum:\n(1) Establish what type of event occurred;\n(2) When (date and time) the event occurred;\n(3) Where the event occurred;\n(4) The source of the event;\n(5) The outcome (success or failure) of the event; and \n(6) The identity of any user/subject associated with the event.

Evidence Request List (ERL)

E-AST-01\nE-CPL-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.\n▪ Generating event logs and the review of those event logs is narrowly-focused to business-critical Technology Assets, Applications, Services and/or Data (TAASD).

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ SBC enforce logging to link system access to individual users or service accounts using a non-repudiation capability to protect against an individual falsely denying having performed a particular action.\n▪ SBC enforce local security event logging and forward those logs to a centralized log repository to provide an alternate audit capability in the event of a failure in the primary audit capability.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to configure Technology Assets, Applications and/or Services (TAAS) to produce event logs that contain sufficient information to, at a minimum:\n(1) Establish what type of event occurred;\n(2) When (date and time) the event occurred;\n(3) Where the event occurred;\n(4) The source of the event;\n(5) The outcome (success or failure) of the event; and \n(6) The identity of any user/subject associated with the event.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.11, B.2.3, B.2.6
NERC-CIP (2026) Requirements: CIP-007-6-R4, CIP-015-1-R3", "controlId": "MON-03", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-03", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70490, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590238", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590238", "securityControlId": 31178, "ccis": [], "uuid": "099e4b27-890a-5156-8bcf-cd847a0f7f42", "testId": "MON-03.1_A01", "test": "additional information to be included in audit records is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-03(01)_ODP", "defaultText": null }, { "id": 70491, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590238", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590238", "securityControlId": 31178, "ccis": [], "uuid": "8657d610-091b-5fa5-89b9-1a01e84ccddc", "testId": "MON-03.1_A02", "test": "generated audit records contain the following organization-defined additional information.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: session, connection, transaction, or activity duration; \n\nFor client-server transactions, the number of bytes received and bytes sent; additional informational messages to diagnose or identify the event; characteristics that describe or identify the object or resource being acted upon; individual identities of group account users; full-text of privileged commands", "otherId": "53A_R5_AU-03(01)", "defaultText": null } ], "externalMappings": [ { "id": 563924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58391", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "245616fb-e329-505c-9967-5f3869f8c164", "parentControlId": 31178, "controlId": "AU-3(1)", "title": "AU-3(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583911" }, { "id": 563925, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "961a7f1c-1fe7-5314-a01e-b5d46ecfa6ed", "parentControlId": 31178, "controlId": "AU-6(1)", "title": "AU-6(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583911" }, { "id": 563926, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7de3223d-0822-5762-842c-8150f21ad9a1", "parentControlId": 31178, "controlId": "AU-03(01)", "title": "AU-03(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583911" }, { "id": 563927, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6676226b-0e68-5153-947d-08e8f4d461fe", "parentControlId": 31178, "controlId": "AU-06(01)", "title": "AU-06(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583911" }, { "id": 563928, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3260d3f9-bbd7-5886-9bc1-662d6cbb6211", "parentControlId": 31178, "controlId": "AU-03(01)", "title": "AU-03(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583911" }, { "id": 563929, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a17e2100-c58e-50ac-8e96-3418efa53815", "parentControlId": 31178, "controlId": "AU-06(01)", "title": "AU-06(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583911" }, { "id": 563930, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5c3c489-2c34-553a-a7d2-b54ecd467f35", "parentControlId": 31178, "controlId": "AU-03(01)", "title": "AU-03(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583911" }, { "id": 563931, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e535a775-459d-5c53-a571-1513f1caef35", "parentControlId": 31178, "controlId": "AU-06(01)", "title": "AU-06(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583911" }, { "id": 563932, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "375a0dd2-11e8-59b6-88d0-8a232cc82b1f", "parentControlId": 31178, "controlId": "AU-03(01)", "title": "AU-03(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583911" }, { "id": 563933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd141017-5401-52df-8217-c4b8d0e821d4", "parentControlId": 31178, "controlId": "AU-06(01)", "title": "AU-06(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583911" }, { "id": 563934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a542aab-9dba-57d2-afe5-66e092e05b4f", "parentControlId": 31178, "controlId": "AU-03(01)", "title": "AU-03(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583912" }, { "id": 563935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67310241-538e-5a40-8610-341a1ae4e195", "parentControlId": 31178, "controlId": "AU-06(01)", "title": "AU-06(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583912" }, { "id": 563936, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8ecb1d0-2e39-5058-90be-92e58733c19a", "parentControlId": 31178, "controlId": "3.3.8", "title": "3.3.8", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583912" }, { "controlId": "B.2.6", "title": "B.2.6 — Audit Review, Analysis, and Reporting", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "40340b32-0020-5d81-a989-595c95ddcf31", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.6", "title": "NEI 08-09 App D.2.6 — Audit Review, Analysis, and Reporting", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d946e4dd-b055-5069-a3c6-aa39168ee1f2", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.2.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "5b8958b3-2d29-5794-a584-154e09fef95b", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b40ce2e9-5829-5e05-bf81-04b270914e23", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "eb0d3d79-3829-570a-b3af-97b83f5a02a8", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "15ad9a62-c348-507b-a80b-5906cb2542ed", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "90e0c6c7-bb2b-50fb-a9e2-f6b4f0e7b41a", "isPublic": true } ], "id": 31178, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730991", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730991", "catalogueId": 1062, "uuid": "3e5f40cf-a87c-56ce-8aae-bb5876cb5549", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect sensitive/regulated data contained in log files?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Sensitive Event Log Information", "description": "

Control Description

Mechanisms exist to protect sensitive/regulated data contained in log files.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Logs of privileged functions (e.g., administrator or root actions) are reviewed for evidence of unauthorized activities.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to protect sensitive/regulated data contained in log files.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.2.6", "controlId": "MON-03.1", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70492, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590238", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590238", "securityControlId": 31179, "ccis": [], "uuid": "2c8337cb-09b8-5a68-8a1b-db9238d96c92", "testId": "MON-03.2_A01", "test": "the content of the audit records needed to support the ability to uniquely trace users to their actions is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events.\n\nFor Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes", "otherId": "171A_3.3.2[a]\n53A_R5_AU-02_ODP[01]\n53A_R5_AU-02_ODP[02]\n53A_R5_AU-02a.\n53A_R5_AU-02c.[01]", "defaultText": null }, { "id": 70493, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590239", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590239", "securityControlId": 31179, "ccis": [], "uuid": "33227ab9-e36e-5894-a3f2-8c4222d15dff", "testId": "MON-03.2_A02", "test": "audit records are created (generated).
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.3.1[c]", "defaultText": null }, { "id": 70494, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590239", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590239", "securityControlId": 31179, "ccis": [], "uuid": "29fd10b8-1bfc-59c3-9ae5-3aab6387fdc8", "testId": "MON-03.2_A03", "test": "audit records contain information that establishes the identity of any individuals, subjects or objects/entities associated with the event.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-03f.", "defaultText": null } ], "externalMappings": [ { "id": 563952, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583914", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c86a582-b82f-5974-8152-642417c34a7d", "parentControlId": 31179, "controlId": "03.03.01.a", "title": "03.03.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583914" } ], "id": 31179, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730991", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730991", "catalogueId": 1062, "uuid": "f815949a-d926-5c71-a473-13a91338c954", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization link system access to individual users or service accounts?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Audit Trails", "description": "

Control Description

Mechanisms exist to link system access to individual users or service accounts.

Evidence Request List (ERL)

E-MON-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.\n▪ Generating event logs and the review of those event logs is narrowly-focused to business-critical Technology Assets, Applications, Services and/or Data (TAASD).

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ SBC enforce logging to link system access to individual users or service accounts using a non-repudiation capability to protect against an individual falsely denying having performed a particular action.\n▪ SBC enforce local security event logging and forward those logs to a centralized log repository to provide an alternate audit capability in the event of a failure in the primary audit capability.\n▪ A log aggregator, or similar automated tool, provides an event log report generation capability to aid in detecting and assessing anomalous activities on business-critical TAASD.\n▪ IT and/or cybersecurity personnel configure alerts for critical or sensitive data that is stored, transmitted and processed on assets.\n▪ IT and/or cybersecurity personnel retain security event logs for a time period consistent with records retention requirements to provide support for after-the-fact investigations of security incidents and to meet statutory, regulatory and/or contractual retention requirements.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to link system access to individual users or service accounts.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-03.2", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-03.2", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70495, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590239", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590239", "securityControlId": 31180, "ccis": [], "uuid": "a84cbab1-af02-583c-9bfe-85ef36845d9c", "testId": "MON-03.3_A01", "test": "a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system or other system that is dedicated to that analysis is performed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-06(08)", "defaultText": null }, { "id": 70496, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590239", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590239", "securityControlId": 31180, "ccis": [], "uuid": "7aa62bd4-50bb-5743-85cf-b057ab0b5f3c", "testId": "MON-03.3_A02", "test": "the execution of privileged functions is logged.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.01.07.b", "defaultText": null } ], "externalMappings": [ { "id": 564031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583923", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "837a2c13-a0f8-5a3d-b7ea-e78b442145b4", "parentControlId": 31180, "controlId": "8.15", "title": "8.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583923" }, { "id": 564035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583924", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08d648d4-e217-5972-ae97-764baa28df41", "parentControlId": 31180, "controlId": "AU-6(8)", "title": "AU-6(8)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583924" }, { "id": 564036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583924", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf9a60ed-86bb-5eb4-a574-9368b0bc5ad7", "parentControlId": 31180, "controlId": "AU-06(08)", "title": "AU-06(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583924" }, { "id": 564037, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583924", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd6c03ca-f484-5c91-b891-9ab61290b922", "parentControlId": 31180, "controlId": "AU-06(08)", "title": "AU-06(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583924" }, { "id": 564039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583924", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3459a27d-56d5-560f-bff1-9fa89800f7e2", "parentControlId": 31180, "controlId": "03.01.07.b", "title": "03.01.07.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583924" } ], "id": 31180, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730991", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730991", "catalogueId": 1062, "uuid": "e6647fab-41b6-5b70-8aaf-90f481cbfe20", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization log and review the actions of users and/or services with elevated privileges?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Privileged Functions Logging", "description": "

Control Description

Mechanisms exist to log and review the actions of users and/or services with elevated privileges.

Evidence Request List (ERL)

MON-03.2

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.\n▪ Generating event logs and the review of those event logs is narrowly-focused to business-critical Technology Assets, Applications, Services and/or Data (TAASD).

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ SBC enforce logging to link system access to individual users or service accounts using a non-repudiation capability to protect against an individual falsely denying having performed a particular action.\n▪ SBC enforce local security event logging and forward those logs to a centralized log repository to provide an alternate audit capability in the event of a failure in the primary audit capability.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to log and review the actions of users and/or services with elevated privileges.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-03.3", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-03.3", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70499, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59024", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59024", "securityControlId": 31182, "ccis": [], "uuid": "0b1d9c37-7bc9-5972-9327-3d6a3736e3a8", "testId": "MON-03.5_A01", "test": "elements identified in the privacy risk assessment are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-03(03)_ODP", "defaultText": null }, { "id": 70500, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59024", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59024", "securityControlId": 31182, "ccis": [], "uuid": "9af5f7b7-8321-5417-a8b3-5308001d5ecc", "testId": "MON-03.5_A02", "test": "Personal Data (PD) contained in audit records is limited to organization-defined elements identified in the privacy risk assessment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-03(03)", "defaultText": null } ], "externalMappings": [ { "id": 564092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d6329ba-23d7-52bf-b05e-f25a4ab30c74", "parentControlId": 31182, "controlId": "AU-03(03)", "title": "AU-03(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58393" }, { "id": 564094, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583931", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd1a818c-a0d6-5e67-9b75-fb7f9f1a3e6f", "parentControlId": 31182, "controlId": "AU-03(03)", "title": "AU-03(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583931" } ], "id": 31182, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730992", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730992", "catalogueId": 1062, "uuid": "8ac51736-e11c-5c71-84a2-f792f100c749", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization limit Personal Data (PD) contained in audit records to the elements identified in the Data Privacy Risk Assessment (DPRA)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Limit Personal Data (PD) In Audit Records", "description": "

Control Description

Mechanisms exist to limit Personal Data (PD) contained in audit records to the elements identified in the Data Privacy Risk Assessment (DPRA).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to limit Personal Data (PD) contained in audit records to the elements identified in the Data Privacy Risk Assessment (DPRA).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-03.5", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-03.5", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70501, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59024", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59024", "securityControlId": 31183, "ccis": [], "uuid": "33a22803-646f-5ab4-b5ac-9e612b50ee3f", "testId": "MON-03.6_A01", "test": "cybersecurity / data privacy controls and related processes to be centrally managed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-09_ODP", "defaultText": null }, { "id": 70502, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590241", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590241", "securityControlId": 31183, "ccis": [], "uuid": "2875c313-80c4-518d-9b6e-0d1c48762ce8", "testId": "MON-03.6_A02", "test": "cybersecurity / data privacy controls and related processes are centrally managed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-09", "defaultText": null } ], "externalMappings": [ { "id": 564098, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583931", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8309846d-fa08-50ce-9423-b1ba8331a67a", "parentControlId": 31183, "controlId": "AU-3(2)", "title": "AU-3(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583931" }, { "id": 564099, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583931", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e82bdc2-8dfd-52d3-8f40-f1e82754550a", "parentControlId": 31183, "controlId": "PL-09", "title": "PL-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583931" }, { "id": 564101, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583932", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6d1f376-519f-5a8e-9e99-253d318ca6c2", "parentControlId": 31183, "controlId": "PL-09", "title": "PL-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583932" }, { "id": 564102, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583932", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "088f5804-8555-5a7b-b21b-4583d7685006", "parentControlId": 31183, "controlId": "PL-9", "title": "PL-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583932" } ], "id": 31183, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730993", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730993", "catalogueId": 1062, "uuid": "a9e615a9-86cc-5329-a6e6-003f8c23dc50", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization centrally manage and update the criteria to be captured in event logs generated by organization-defined system components?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Centralized Management of Event Log Content", "description": "

Control Description

Mechanisms exist to centrally manage and update the criteria to be captured in event logs generated by organization-defined system components.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A log aggregator, or similar automated tool, provides an event log report generation capability to aid in detecting and assessing anomalous activities on business-critical TAASD.\n▪ IT and/or cybersecurity personnel configure alerts for critical or sensitive data that is stored, transmitted and processed on assets.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to centrally manage and update the criteria to be captured in event logs generated by organization-defined system components.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-03.6", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-03.6", "references": "

Micro-Small Business (<10 staff)

∙ Review system logs periodically

Small Business (10-49 staff)

∙ Log monitoring policy\n∙ Regular review of key system logs

Medium Business (50-249 staff)

∙ SIEM (e.g., Wazuh)\n∙ Automated log collection and alerting

Large Business (250-999 staff)

∙ Enterprise SIEM (e.g., Splunk, IBM QRadar)\n∙ Continuous monitoring program\n∙ SOC monitoring

Enterprise (>1,000 staff)

∙ Enterprise SIEM/SOAR platform\n∙ 24/7 SOC monitoring\n∙ Threat hunting\n∙ Automated incident response", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70505, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590241", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590241", "securityControlId": 31185, "ccis": [], "uuid": "ea344992-fecd-5951-a9fb-e91a44435592", "testId": "MON-04_A01", "test": "event log retention requirements are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-04_ODP", "defaultText": null }, { "id": 70506, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590242", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590242", "securityControlId": 31185, "ccis": [], "uuid": "c176bfe5-daa5-543c-aecb-f3c539c75471", "testId": "MON-04_A02", "test": "event log storage capacity is allocated to accommodate organization-defined event log retention requirements.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-04", "defaultText": null } ], "externalMappings": [ { "id": 564134, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583944", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad01d593-1f18-5e66-b041-5447d8b35de2", "parentControlId": 31185, "controlId": "SR 2.9", "title": "SR 2.9", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583944" }, { "id": 564135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583944", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3b8a716-70bd-5877-843e-59c9d73e9efe", "parentControlId": 31185, "controlId": "CR 2.9(a)", "title": "CR 2.9(a)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583944" }, { "id": 564136, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583944", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "464d53fb-dbdb-5174-b314-ef9fc9235232", "parentControlId": 31185, "controlId": "CR 2.9(b)", "title": "CR 2.9(b)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583944" }, { "id": 564137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583944", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89fe1104-0f31-5bb1-87a5-e7c7e132e0ea", "parentControlId": 31185, "controlId": "AU-4", "title": "AU-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583944" }, { "id": 564138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583944", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f69e5e6-37c9-50c9-8003-4ee0ade82f8c", "parentControlId": 31185, "controlId": "AU-04", "title": "AU-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583944" }, { "id": 564139, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583944", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c75b3519-93cb-5f5a-b546-af927828d638", "parentControlId": 31185, "controlId": "AU-04", "title": "AU-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583944" }, { "id": 564140, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583944", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdf2ea28-59db-5b2d-b9b3-739e94faa4ab", "parentControlId": 31185, "controlId": "AU-04", "title": "AU-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583944" }, { "id": 564141, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a3f5ced-e7fd-5e95-bf25-5f2bc1042bbf", "parentControlId": 31185, "controlId": "AU-04", "title": "AU-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583945" }, { "id": 564142, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbf24390-a59f-5143-9a5b-4af2ae32c267", "parentControlId": 31185, "controlId": "AU-04", "title": "AU-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583945" }, { "id": 564143, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f63a50e-1c4c-5aad-b8f8-3eeae75c648d", "parentControlId": 31185, "controlId": "AU-04", "title": "AU-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583945" }, { "controlId": "B.2.4", "title": "B.2.4 — Audit Storage Capacity", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1287dc6f-c3b3-5160-88ea-57cd78978fa1", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.4", "title": "NEI 08-09 App D.2.4 — Audit Storage Capacity", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "9e66b84a-8dc9-59e2-8a2d-a3861ca50591", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.2.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "d80f08d0-3f70-596c-8b57-6b06762409ed", "isPublic": true }, { "controlId": "B.2.5", "title": "B.2.5 — Response to Audit Processing Failures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ac56f92b-2871-5339-be3e-848f6fea260e", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.5", "title": "NEI 08-09 App D.2.5 — Response to Audit Processing Failures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "fbb4687f-4d3e-5b9c-a191-d6b105ea59ef", "isPublic": true }, { "controlId": "CIP-007-6-R4", "title": "CIP-007-6-R4 — Security Event Monitoring", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6b43cb10-4e8a-5667-831a-95e504efd1a3", "isPublic": true }, { "controlId": "CIP-007-6-4.1", "title": "CIP-007-6-4.1 — Log events at the BES Cyber System level (per BES Cyber System capability) or at the Cyber Asset level (per Cyber Ass...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "105e5462-372a-5374-8dcd-da115a000ba3", "isPublic": true }, { "controlId": "CIP-007-6-4.1.1", "title": "CIP-007-6-4.1.1 — Detected successful login attempts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6f775bd3-6908-5132-89c8-c7955e453380", "isPublic": true }, { "controlId": "CIP-007-6-4.1.2", "title": "CIP-007-6-4.1.2 — Detected failed access attempts and failed login attempts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "02b727ba-9b7b-5b56-9c79-1fae0cabc518", "isPublic": true }, { "controlId": "CIP-007-6-4.1.3", "title": "CIP-007-6-4.1.3 — Detected malicious code.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "978a8a82-bbef-52d8-b46c-639cb2c532b3", "isPublic": true }, { "controlId": "CIP-007-6-4.2", "title": "CIP-007-6-4.2 — Generate alerts for security events that the Responsible Entity determines necessitates an alert, that includes, as a...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3f3c9b66-3471-5225-8c05-118f0d098115", "isPublic": true }, { "controlId": "CIP-007-6-4.2.1", "title": "CIP-007-6-4.2.1 — Detected malicious code from Part 4.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6c5b4269-b876-5ac6-9ad3-263481bd20cf", "isPublic": true }, { "controlId": "CIP-007-6-4.2.2", "title": "CIP-007-6-4.2.2 — Detected failure of Part 4.1 event logging.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d0fa39d9-1f02-5d5c-b5f8-c7408033e9a2", "isPublic": true }, { "controlId": "CIP-007-6-4.3", "title": "CIP-007-6-4.3 — Where technically feasible, retain applicable event logs identified in Part 4.1 for at least the last 90 consecutive...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "aef7f302-0147-5554-b9b4-b0259dc9a8ce", "isPublic": true }, { "controlId": "CIP-007-6-4.4", "title": "CIP-007-6-4.4 — Review a summarization or sampling of logged events as determined by the Responsible Entity at intervals no greater t...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7d8399c7-226b-5abc-8ee0-fb889b27a818", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "813a7fb2-55c6-5ca8-b911-18573743a388", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "23cca085-9821-5fef-adac-f62cd4f65723", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "ebbbc2fb-6d2b-5d4a-9d1c-f1dacecbecd9", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "5f175aea-606f-5832-9e56-d91effdd53b1", "isPublic": true } ], "id": 31185, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730993", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730993", "catalogueId": 1062, "uuid": "9856dd64-d4f2-57bb-a4f6-bfd3e2088389", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization allocate and proactively manage sufficient event log storage capacity to reduce the likelihood of such capacity being exceeded?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 8.0, "title": "Event Log Storage Capacity", "description": "

Control Description

Mechanisms exist to allocate and proactively manage sufficient event log storage capacity to reduce the likelihood of such capacity being exceeded.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to allocate and proactively manage sufficient event log storage capacity to reduce the likelihood of such capacity being exceeded.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.2.4, B.2.5
NERC-CIP (2026) Requirements: CIP-007-6-R4", "controlId": "MON-04", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-04", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program\n∙ ITIL 4 (https://axelos.com)

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program\n∙ ITIL 4 (https://axelos.com)

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program\n∙ ITIL 4 (https://axelos.com)

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program\n∙ ITIL 4 (https://axelos.com)

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program\n∙ ITIL 4 (https://axelos.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70507, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590242", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590242", "securityControlId": 31186, "ccis": [], "uuid": "081e2625-00be-5f1e-9824-04ea6ef9cb8c", "testId": "MON-05_A01", "test": "personnel or roles to be alerted in the event of an event logging process failure are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.3.4[a]\n53A_R5_AU-05_ODP[01]\n53A_R5_AU-05a.", "defaultText": null }, { "id": 70508, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590242", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590242", "securityControlId": 31186, "ccis": [], "uuid": "a8786a4c-1ba3-5601-a542-19eb095e6076", "testId": "MON-05_A02", "test": "types of event logging process failures for which alert will be generated are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.3.4[b]", "defaultText": null }, { "id": 70509, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590242", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590242", "securityControlId": 31186, "ccis": [], "uuid": "bd008f9a-2ad1-5f9f-9c81-1223f6a5392f", "testId": "MON-05_A03", "test": "organization-defined additional actions are taken.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: overwrite oldest record", "otherId": "53A_R5_AU-05_ODP[03]\n53A_R5_AU-05b.", "defaultText": null }, { "id": 70510, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590242", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590242", "securityControlId": 31186, "ccis": [], "uuid": "5462988e-923b-547a-8a23-76b5e918300a", "testId": "MON-05_A04", "test": "organizational personnel or roles are alerted in the event of an audit logging process failure within an organization-defined time period.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.3.4[c]", "defaultText": null }, { "id": 70511, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590243", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590243", "securityControlId": 31186, "ccis": [], "uuid": "1bbae8d4-8d27-54fc-aab6-467c81ee394c", "testId": "MON-05_A05", "test": "the time period for organizational personnel or roles receiving audit logging process failure alerts is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-05_ODP[02]\n171A_R3_A.03.03.04.ODP[01]", "defaultText": null }, { "id": 70512, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590243", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590243", "securityControlId": 31186, "ccis": [], "uuid": "a2e571ed-9dbc-5d03-b6e2-b01a0152d9b7", "testId": "MON-05_A06", "test": "additional actions to be taken in the event of an audit logging process failure are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.03.04.ODP[02]", "defaultText": null }, { "id": 70513, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590243", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590243", "securityControlId": 31186, "ccis": [], "uuid": "3df86c5c-3168-539d-b1c7-63a2330bd4bf", "testId": "MON-05_A07", "test": "organizational personnel or roles are alerted in the event of an audit logging process failure within .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: near real time or as soon as practicable upon discovery", "otherId": "171A_R3_A.03.03.04.a", "defaultText": null }, { "id": 70514, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590243", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590243", "securityControlId": 31186, "ccis": [], "uuid": "9450166b-c2fb-5109-9f41-a3def0c291ca", "testId": "MON-05_A08", "test": "the following additional actions are taken: .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: document the failure and resolution, troubleshoot, repair/restart the audit logging process, and report as incident if applicable", "otherId": "171A_R3_A.03.03.04.b", "defaultText": null } ], "externalMappings": [ { "id": 564165, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "231d1448-99a6-5cff-bbd8-be3b52f6ad94", "parentControlId": 31186, "controlId": "SR 2.10", "title": "SR 2.10", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583948" }, { "id": 564166, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "936f436d-3b2f-53a9-9058-76be629e58ba", "parentControlId": 31186, "controlId": "AU-5", "title": "AU-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583948" }, { "id": 564167, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56960a3d-5a49-5bf2-a32e-4961fd004107", "parentControlId": 31186, "controlId": "AU-05", "title": "AU-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583948" }, { "id": 564168, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "989c83c3-8828-5f05-bc71-fb42fdcf46f1", "parentControlId": 31186, "controlId": "AU-05", "title": "AU-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583948" }, { "id": 564169, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e08fdcae-cb46-585c-8c35-4ab49ee108b6", "parentControlId": 31186, "controlId": "AU-05", "title": "AU-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583948" }, { "id": 564170, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac562622-2d04-500e-9094-a5eee244a632", "parentControlId": 31186, "controlId": "AU-05", "title": "AU-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583949" }, { "id": 564171, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1415a7ea-36ae-5ba7-a162-b8bb856e6e5e", "parentControlId": 31186, "controlId": "AU-05", "title": "AU-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583949" }, { "id": 564172, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8bb5ca1-1983-5c93-a575-73ae72310553", "parentControlId": 31186, "controlId": "AU-05", "title": "AU-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583949" }, { "id": 564173, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10452e15-03f0-549e-a9ba-69428950ebe8", "parentControlId": 31186, "controlId": "3.3.4", "title": "3.3.4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583949" }, { "id": 564174, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15f4bf27-8622-5e52-a167-870d9c618dd2", "parentControlId": 31186, "controlId": "03.03.04.b", "title": "03.03.04.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583949" }, { "id": 564193, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583951", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d45be8a8-8865-59dc-9097-2ab3803a92d7", "parentControlId": 31186, "controlId": "CIP-007-6 4.2.2", "title": "CIP-007-6 4.2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583951" }, { "controlId": "B.2.4", "title": "B.2.4 — Audit Storage Capacity", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ebdc13e2-d74d-5a1c-93fd-7fbf8d3755a3", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.4", "title": "NEI 08-09 App D.2.4 — Audit Storage Capacity", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "485e8f6a-be1f-53da-8d37-16a8c98241e2", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.2.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "d5c9b7ca-7b86-520f-83fc-11c058c2fa08", "isPublic": true }, { "controlId": "B.2.5", "title": "B.2.5 — Response to Audit Processing Failures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ff407ee6-9620-5099-a697-2baba15406f9", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.5", "title": "NEI 08-09 App D.2.5 — Response to Audit Processing Failures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e52380a6-6ff0-5a46-9727-6ea3798b8b92", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7a346137-1c38-52b7-b249-243ddd9d25ae", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "9d722c8b-4d40-5838-a7b2-84f50c7a47d3", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "f2d48a4c-b4c7-52b6-9f64-52d7a3f777ee", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "f1a15185-d5a9-5d2a-af7a-26716d04301c", "isPublic": true } ], "id": 31186, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730994", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730994", "catalogueId": 1062, "uuid": "f28c996b-70e3-5e09-adc6-e9633bd1b093", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization alert appropriate personnel in the event of a log processing failure and take actions to remedy the disruption?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Response To Event Log Processing Failures", "description": "

Control Description

Mechanisms exist to alert appropriate personnel in the event of a log processing failure and take actions to remedy the disruption.

Evidence Request List (ERL)

E-MON-10

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to alert appropriate personnel in the event of a log processing failure and take actions to remedy the disruption.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.2.4, B.2.5", "controlId": "MON-05", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-05", "references": "

Micro-Small Business (<10 staff)

∙ Incident Response Plan (IRP)\n∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Incident Response Plan (IRP)\n∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Incident Response Plan (IRP)\n∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Incident Response Plan (IRP)\n∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Incident Response Plan (IRP)\n∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70515, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590244", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590244", "securityControlId": 31187, "ccis": [], "uuid": "3c6ed6ef-3510-59b7-9907-12fb11170ca4", "testId": "MON-05.1_A01", "test": "real-time period requiring alerts when event log failure events occur is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-05(02)_ODP[01]", "defaultText": null }, { "id": 70516, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590244", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590244", "securityControlId": 31187, "ccis": [], "uuid": "c8eb0ee0-dd48-50a7-bbc0-bd76bd8f1df1", "testId": "MON-05.1_A02", "test": "personnel, roles, and/or locations to be alerted in real time when event log failure events occur is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-05(02)_ODP[02]\n53A_R5_SI-04(12)_ODP[01]", "defaultText": null }, { "id": 70517, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590244", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590244", "securityControlId": 31187, "ccis": [], "uuid": "620d2ef3-ab35-562c-8e22-275340715f28", "testId": "MON-05.1_A03", "test": "event logging failure events requiring real-time alerts are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-05(02)_ODP[03]\n53A_R5_SI-04(12)_ODP[03]", "defaultText": null }, { "id": 70518, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590244", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590244", "securityControlId": 31187, "ccis": [], "uuid": "330561dc-5b21-56dd-997c-4036cb3dddfd", "testId": "MON-05.1_A04", "test": "an alert is provided within organization-defined real-time period to organization-defined personnel, roles, and/or locations when organization-defined event logging failure events requiring real-time alerts occur.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-05(02)\n53A_R5_SI-04(12)_ODP[02]\n53A_R5_SI-04(12)", "defaultText": null } ], "externalMappings": [ { "id": 564204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583953", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02a3b3cc-efda-5178-89ef-cf5aca16ea05", "parentControlId": 31187, "controlId": "AU-5(2)", "title": "AU-5(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583953" }, { "id": 564205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583953", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90fe6a9d-9a24-5e75-81f9-82befa691df6", "parentControlId": 31187, "controlId": "SI-4(12)", "title": "SI-4(12)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583953" }, { "id": 564206, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583953", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "757da9cd-e93d-5470-ad8f-b5fa0d5ebcf7", "parentControlId": 31187, "controlId": "AU-05(02)", "title": "AU-05(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583953" }, { "id": 564207, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583953", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "168150b4-645b-54e0-a2cf-18819bfc5600", "parentControlId": 31187, "controlId": "SI-04(12)", "title": "SI-04(12)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583953" }, { "id": 564209, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583953", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5640a409-837b-5de7-9c14-261a929d8595", "parentControlId": 31187, "controlId": "AU-05(02)", "title": "AU-05(02)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583954" }, { "id": 564210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583954", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "940e8e4b-5808-5ef3-887b-dcdf338dd32e", "parentControlId": 31187, "controlId": "SI-04(12)", "title": "SI-04(12)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583954" }, { "id": 564211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583954", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a55cd62-9cf5-5cc0-8c50-2608313b9624", "parentControlId": 31187, "controlId": "AU-05(02)", "title": "AU-05(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583954" }, { "id": 564212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583954", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93096bac-5a6e-5064-bc3c-c6cdc7c104c0", "parentControlId": 31187, "controlId": "SI-04(12)", "title": "SI-04(12)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583954" }, { "id": 564213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583954", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d19e89fa-d204-5d6f-8af0-3afdd9ccc629", "parentControlId": 31187, "controlId": "AU-05(02)", "title": "AU-05(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583954" } ], "id": 31187, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730994", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730994", "catalogueId": 1062, "uuid": "42fd439b-760c-5789-8f6a-9a745cf8a940", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide 24x7x365 near real-time alerting capability when an event log processing failure occurs?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Real-Time Alerts of Event Logging Failure", "description": "

Control Description

Mechanisms exist to provide 24x7x365 near real-time alerting capability when an event log processing failure occurs.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to provide 24x7x365 near real-time alerting capability when an event log processing failure occurs.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-05.1", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-05.1", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70519, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590244", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590244", "securityControlId": 31188, "ccis": [], "uuid": "8df06598-5cc9-57e5-bf6e-31a85d2cc866", "testId": "MON-05.2_A01", "test": "personnel, roles, and/or locations to be warned when allocated event log storage volume reaches a percentage of repository maximum event log storage capacity is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-05(01)_ODP[01]", "defaultText": null }, { "id": 70520, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590245", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590245", "securityControlId": 31188, "ccis": [], "uuid": "3e569317-bc0f-552d-9c0e-679e8a601e82", "testId": "MON-05.2_A02", "test": "time period for defined personnel, roles, and/or locations to be warned when allocated event log storage volume reaches a percentage of repository maximum event log storage capacity is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-05(01)_ODP[02]", "defaultText": null }, { "id": 70521, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590245", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590245", "securityControlId": 31188, "ccis": [], "uuid": "61e526ba-b029-5a41-9c4d-c9b70ecebfe7", "testId": "MON-05.2_A03", "test": "percentage of repository maximum event log storage capacity is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-05(01)_ODP[03]", "defaultText": null }, { "id": 70522, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590245", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590245", "securityControlId": 31188, "ccis": [], "uuid": "98fb8ab8-216e-5040-ba91-3828b1e549a9", "testId": "MON-05.2_A04", "test": "a warning is provided per an organization-defined time period when allocated event log storage volume reaches organization-defined percentage of repository maximum event log storage capacity.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-05(01)", "defaultText": null } ], "externalMappings": [ { "id": 564224, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583956", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9bea9c41-4f21-5fff-a03b-d751b474a74f", "parentControlId": 31188, "controlId": "SR 2.9 RE 1", "title": "SR 2.9 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583956" }, { "id": 564225, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583956", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99238894-35f1-5bf9-8b55-8c829a9fdbc2", "parentControlId": 31188, "controlId": "CR 2.9(1)", "title": "CR 2.9(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583956" }, { "id": 564226, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583956", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9671b0c5-950c-5a4a-af41-584b47debf07", "parentControlId": 31188, "controlId": "AU-5(1)", "title": "AU-5(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583956" }, { "id": 564227, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583956", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f6c7219-d8e9-5512-893b-ea937967f58e", "parentControlId": 31188, "controlId": "AU-05(01)", "title": "AU-05(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583956" }, { "id": 564228, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583956", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91676abe-00ee-536c-820b-af14f7456da9", "parentControlId": 31188, "controlId": "AU-05(01)", "title": "AU-05(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583956" }, { "id": 564229, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583956", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84c6bb90-5af6-57ec-82d0-efa910154dfd", "parentControlId": 31188, "controlId": "AU-05(01)", "title": "AU-05(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583956" }, { "id": 564230, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583956", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ce390fd-805f-58c0-9307-d09ea678b052", "parentControlId": 31188, "controlId": "AU-05(01)", "title": "AU-05(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583956" } ], "id": 31188, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730994", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730994", "catalogueId": 1062, "uuid": "e153701b-87ac-5378-bde8-d3f3c934e96b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to alert appropriate personnel when the allocated volume reaches an organization-defined percentage of maximum event log storage capacity?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Event Log Storage Capacity Alerting", "description": "

Control Description

Automated mechanisms exist to alert appropriate personnel when the allocated volume reaches an organization-defined percentage of maximum event log storage capacity.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to automatically alert appropriate personnel when the allocated volume reaches an organization-defined percentage of maximum event log storage capacity.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-05.2", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-05.2", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70523, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590245", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590245", "securityControlId": 31189, "ccis": [], "uuid": "9042f5aa-2ba1-581f-ae5e-f38c24ef2182", "testId": "MON-06_A01", "test": "system components that provide an audit record generation capability for the events types are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-12_ODP[01]", "defaultText": null }, { "id": 70524, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590246", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590246", "securityControlId": 31189, "ccis": [], "uuid": "e2f2c08f-c8c8-57c2-937e-8cbc151a4ae4", "testId": "MON-06_A02", "test": "audit records include organization-defined audit record content requirements.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-12c.", "defaultText": null }, { "id": 70525, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590246", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590246", "securityControlId": 31189, "ccis": [], "uuid": "0e095a46-ecfb-5fca-99e4-742c15e68c71", "testId": "MON-06_A03", "test": "personnel or roles allowed to select the event types that are to be logged by specific components of the system is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-12_ODP[02]", "defaultText": null }, { "id": 70526, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590246", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590246", "securityControlId": 31189, "ccis": [], "uuid": "c05b4d2a-1fd3-53e6-8fe7-b143324b92d4", "testId": "MON-06_A04", "test": "an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis and reporting requirements and after-the-fact investigations of incidents that does not alter the original content or time ordering of audit records.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.3.6[b]\n53A_R5_AU-07a.[02]\n53A_R5_AU-07b.[02]\n53A_R5_AU-07(01)[01]\n53A_R5_AU-07(01)[02]\n53A_R5_AU-12a.\n53A_R5_AU-12b.", "defaultText": null }, { "id": 70527, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590246", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590246", "securityControlId": 31189, "ccis": [], "uuid": "4ea3239c-4286-5174-8d4f-cb5270c604fe", "testId": "MON-06_A05", "test": "fields within audit records that can be processed, sorted or searched are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AU-07(01)_ODP", "defaultText": null }, { "id": 70528, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590246", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590246", "securityControlId": 31189, "ccis": [], "uuid": "e2eecc8d-8004-58be-9c66-688923fe6182", "testId": "MON-06_A06", "test": "findings are reported to organizational personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.03.05.b", "defaultText": null }, { "id": 70529, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590246", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590246", "securityControlId": 31189, "ccis": [], "uuid": "e2488cfc-3473-59dd-838b-507d637300d9", "testId": "MON-06_A07", "test": "an audit record reduction and report generation capability that supports audit record review is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.03.06.a[01]\n171A_3.3.6[a]\n53A_R5_AU-07a.[01]\n53A_R5_AU-07b.[01]", "defaultText": null }, { "id": 70530, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590246", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590246", "securityControlId": 31189, "ccis": [], "uuid": "10c45dbb-aab9-524f-90b5-4fe5dc1b1833", "testId": "MON-06_A08", "test": "an audit record reduction and report generation capability that supports audit record analysis is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.03.06.a[02]\n171A_3.3.6[a]\n53A_R5_AU-07a.[01]\n53A_R5_AU-07b.[01]", "defaultText": null }, { "id": 70531, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590247", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590247", "securityControlId": 31189, "ccis": [], "uuid": "581465b0-c2b4-56c4-a1e7-7ffed6aca431", "testId": "MON-06_A09", "test": "an audit record reduction and report generation capability that supports audit record reporting requirements is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.03.06.a[03]\n171A_3.3.6[a]\n53A_R5_AU-07a.[01]\n53A_R5_AU-07b.[01]", "defaultText": null }, { "id": 70532, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590247", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590247", "securityControlId": 31189, "ccis": [], "uuid": "aea3d23e-e12a-557c-9956-a8305741babb", "testId": "MON-06_A10", "test": "an audit record reduction and report generation capability that supports after-the-fact investigations of incidents is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.03.06.a[04]", "defaultText": null } ], "externalMappings": [ { "id": 564249, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21037dba-5c77-5cd5-a0a7-c4f99a7aaae1", "parentControlId": 31189, "controlId": "6.8", "title": "6.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583959" }, { "id": 564250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "516a702b-4fd6-5f22-a58a-01b6a5056499", "parentControlId": 31189, "controlId": "8.15", "title": "8.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583959" }, { "id": 564254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d953503a-a8a8-5413-9d59-aea94ca22dda", "parentControlId": 31189, "controlId": "AU-7", "title": "AU-7", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583959" }, { "id": 564255, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fbd9f49-6e23-5bc5-90ca-bb07fb45f2a9", "parentControlId": 31189, "controlId": "AU-7(1)", "title": "AU-7(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583959" }, { "id": 564256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "220d8ed2-d76a-5f66-aee7-0586068d67b5", "parentControlId": 31189, "controlId": "AU-12", "title": "AU-12", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583959" }, { "id": 564257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efe4064c-e35c-5e6e-b282-d24a197bc1a4", "parentControlId": 31189, "controlId": "AU-07", "title": "AU-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58396" }, { "id": 564258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cad95750-00f1-5a62-afa7-e37340240abd", "parentControlId": 31189, "controlId": "AU-07(01)", "title": "AU-07(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58396" }, { "id": 564259, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9ed29cb-0875-53b8-8ed6-ffd374c491ad", "parentControlId": 31189, "controlId": "AU-12", "title": "AU-12", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58396" }, { "id": 564260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba6908b9-86d4-5d99-b142-c92f42e9e5fa", "parentControlId": 31189, "controlId": "AU-12", "title": "AU-12", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58396" }, { "id": 564261, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed928454-2edf-5e86-89a8-537c30264bc5", "parentControlId": 31189, "controlId": "AU-07", "title": "AU-07", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58396" }, { "id": 564262, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f889fce-58a7-515c-9521-ed40e8cb4aea", "parentControlId": 31189, "controlId": "AU-07(01)", "title": "AU-07(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58396" }, { "id": 564263, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23844bc0-eb20-5757-822d-4c6d5894eda2", "parentControlId": 31189, "controlId": "AU-07", "title": "AU-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58396" }, { "id": 564264, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f9d22dc-de3a-5ad1-816c-2d825c4596c7", "parentControlId": 31189, "controlId": "AU-07(01)", "title": "AU-07(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58396" }, { "id": 564265, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2dc7223-3e42-5e82-8c20-557b764b0837", "parentControlId": 31189, "controlId": "AU-12", "title": "AU-12", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58396" }, { "id": 564266, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1633d98-8e28-59f2-a189-599797255578", "parentControlId": 31189, "controlId": "AU-12", "title": "AU-12", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583961" }, { "id": 564267, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0bac05a4-7bf1-5755-b45e-a8337a9291d4", "parentControlId": 31189, "controlId": "AU-07", "title": "AU-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583961" }, { "id": 564268, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47afd196-5bf1-5e83-8783-5d9a5acb89a5", "parentControlId": 31189, "controlId": "AU-07(01)", "title": "AU-07(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583961" }, { "id": 564269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f230ede4-2d96-5ff1-a447-049bac7d914d", "parentControlId": 31189, "controlId": "AU-12", "title": "AU-12", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583961" }, { "id": 564270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4db48c6c-83b7-5860-8d25-8bd95d069139", "parentControlId": 31189, "controlId": "AU-07", "title": "AU-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583961" }, { "id": 564271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4133a623-a5cd-52f8-8c00-99bdcb035430", "parentControlId": 31189, "controlId": "AU-07(01)", "title": "AU-07(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583961" }, { "id": 564272, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4948737f-b9f7-58e0-80c0-baf671a4b8d3", "parentControlId": 31189, "controlId": "AU-12", "title": "AU-12", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583961" }, { "id": 564273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f074dba-34d2-5e40-952d-1eb209a83df2", "parentControlId": 31189, "controlId": "AU-12", "title": "AU-12", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583961" }, { "id": 564274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583962", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f47251dd-f75f-5567-93bb-c4778eb5f01a", "parentControlId": 31189, "controlId": "AU-12", "title": "AU-12", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583962" }, { "id": 564275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583962", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5938d02c-1e29-5f31-a071-e672e2a07edd", "parentControlId": 31189, "controlId": "AU-12", "title": "AU-12", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583962" }, { "id": 564278, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583962", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66c1a08e-c159-5da6-b1ac-8705ccaa0c43", "parentControlId": 31189, "controlId": "3.3.6", "title": "3.3.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583962" }, { "id": 564279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583962", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64a73d79-60ec-5a55-92f0-b5df773f055c", "parentControlId": 31189, "controlId": "03.03.05.b", "title": "03.03.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583962" }, { "id": 564280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583962", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6799f816-bd2c-5ff0-8453-a476255b2dc7", "parentControlId": 31189, "controlId": "03.03.06.a", "title": "03.03.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583962" }, { "id": 564292, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583964", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd6dac04-03a8-5dfa-bdbe-c858bf1c99ce", "parentControlId": 31189, "controlId": "SITUATION-3a", "title": "SITUATION-3a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583964" }, { "id": 564293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583964", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cbd7f720-ebee-5042-b153-6565d98ae6e1", "parentControlId": 31189, "controlId": "SITUATION-3b", "title": "SITUATION-3b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583964" }, { "id": 564294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583964", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3d0e1e1-058e-5e39-be5a-0d48b3ae056c", "parentControlId": 31189, "controlId": "SITUATION-3c", "title": "SITUATION-3c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583964" }, { "id": 564295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583964", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71ba4923-0b37-5b66-847f-39cb29c18ada", "parentControlId": 31189, "controlId": "SITUATION-3d", "title": "SITUATION-3d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583964" }, { "id": 564296, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583964", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "815ac307-31f6-5b35-bbd1-4754c33a1eda", "parentControlId": 31189, "controlId": "SITUATION-3f", "title": "SITUATION-3f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583964" }, { "controlId": "B.2.7", "title": "B.2.7 — Audit Reduction and Report Generation", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "17cbb116-a942-59ea-91fd-51dda829e243", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.7", "title": "NEI 08-09 App D.2.7 — Audit Reduction and Report Generation", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e29557d7-af4e-562f-9914-2edfce8f2c63", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.2.7", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "68e6356c-9e68-557b-8e3b-4cdb55699ec7", "isPublic": true }, { "controlId": "B.2.12", "title": "B.2.12 — Audit Generation", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-12", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "d3e0aa4c-eb8f-54be-94e4-26dc736a73c4", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.12", "title": "NEI 08-09 App D.2.12 — Audit Generation", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.12", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "3adfd193-2e88-5932-a2b5-7b9f911811ca", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "8ec2fe08-2548-5704-8c56-cff1b81ec4e2", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "a2543bf0-5d36-5041-a660-30fa1712a2c4", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "aea4bc27-94c3-5683-a7d7-94f106598b89", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "3a8e7c75-16f2-5050-b55b-fed659e72c82", "isPublic": true } ], "id": 31189, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730995", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730995", "catalogueId": 1062, "uuid": "a10479a7-dff9-5312-8fa5-c9ebdcd8ac5b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide an event log report generation capability to aid in detecting and assessing anomalous activities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Monitoring Reporting", "description": "

Control Description

Mechanisms exist to provide an event log report generation capability to aid in detecting and assessing anomalous activities.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A log aggregator, or similar automated tool, provides an event log report generation capability to aid in detecting and assessing anomalous activities on business-critical TAASD.\n▪ IT and/or cybersecurity personnel configure alerts for critical or sensitive data that is stored, transmitted and processed on assets.\n▪ Logs of privileged functions (e.g., administrator or root actions) are reviewed for evidence of unauthorized activities.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to provide an event log report generation capability to aid in detecting and assessing anomalous activities.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.2.7, B.2.12", "controlId": "MON-06", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-06", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70533, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590247", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590247", "securityControlId": 31190, "ccis": [], "uuid": "4bf72a27-0aac-5513-a282-8dd524949c00", "testId": "MON-06.1_A01", "test": "the capability to audit the parameters of user query events for data sets containing Personal Data (PD) is provided.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-12(04)[01]", "defaultText": null }, { "id": 70534, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590247", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590247", "securityControlId": 31190, "ccis": [], "uuid": "8f22e807-cf0e-5d9e-81dd-77ef9e54ae77", "testId": "MON-06.1_A02", "test": "the capability to audit the parameters of user query events for data sets containing Personal Data (PD) is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-12(04)[02]", "defaultText": null } ], "externalMappings": [ { "id": 564333, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583969", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f246d4f0-3e21-5300-8129-acb1b9ffb5df", "parentControlId": 31190, "controlId": "AU-12(04)", "title": "AU-12(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583969" }, { "id": 564334, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583969", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9a81ea4-3f68-548c-935f-ef96832ff90f", "parentControlId": 31190, "controlId": "AU-12(04)", "title": "AU-12(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583969" } ], "id": 31190, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730995", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730995", "catalogueId": 1062, "uuid": "da98542b-4e54-5c3c-867e-a84d7c515adc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide and implement the capability for auditing the parameters of user query events for data sets containing Personal Data (PD)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Query Parameter Audits of Personal Data (PD)", "description": "

Control Description

Mechanisms exist to provide and implement the capability for auditing the parameters of user query events for data sets containing Personal Data (PD).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to provide and implement the capability for auditing the parameters of user query events for data sets containing Personal Data (PD).

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-06.1", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-06.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70535, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590248", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590248", "securityControlId": 31191, "ccis": [], "uuid": "23d15531-48e4-551a-b7b7-8adc02d18e8e", "testId": "MON-06.2_A01", "test": "trend analysis is employed to determine if control implementations used in the continuous monitoring process need to be modified based on empirical data.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-07(03)[01]", "defaultText": null }, { "id": 70536, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590248", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590248", "securityControlId": 31191, "ccis": [], "uuid": "6012b59c-0b7b-5df5-a993-77409775edfe", "testId": "MON-06.2_A02", "test": "trend analysis is employed to determine if the frequency of continuous monitoring activities used in the continuous monitoring process needs to be modified based on empirical data.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-07(03)[02]", "defaultText": null }, { "id": 70537, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590249", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590249", "securityControlId": 31191, "ccis": [], "uuid": "96463dc5-92a8-55dc-bd39-ce9b470939b2", "testId": "MON-06.2_A03", "test": "trend analysis is employed to determine if the types of activities used in the continuous monitoring process need to be modified based on empirical data.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-07(03)[03]", "defaultText": null } ], "externalMappings": [ { "id": 564338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583969", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "233d9cdf-ff38-5f05-a273-6a5d5786a47a", "parentControlId": 31191, "controlId": "CA-7(3)", "title": "CA-7(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583969" }, { "id": 564339, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "054c920e-9d1f-5b8b-b51c-a52b42928bcb", "parentControlId": 31191, "controlId": "CA-07(03)", "title": "CA-07(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58397" }, { "id": 564340, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1c205ef-cd48-5d97-8348-0ef498f29def", "parentControlId": 31191, "controlId": "CA-07(03)", "title": "CA-07(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58397" }, { "id": 564342, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44a323fe-3895-5887-a017-be30bb43a055", "parentControlId": 31191, "controlId": "CA-7(3)", "title": "CA-7(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58397" }, { "id": 564344, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69d432e4-8220-5b99-9d11-3a8ebf079463", "parentControlId": 31191, "controlId": "SITUATION-3a", "title": "SITUATION-3a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58397" }, { "id": 564345, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0fd7712a-023f-55f0-9fa6-15da1e133c72", "parentControlId": 31191, "controlId": "SITUATION-3c", "title": "SITUATION-3c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58397" }, { "id": 564346, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583971", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5329dcc-7bc2-5a9a-8f96-424910de23ce", "parentControlId": 31191, "controlId": "SITUATION-3d", "title": "SITUATION-3d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583971" } ], "id": 31191, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730995", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730995", "catalogueId": 1062, "uuid": "79b2af4c-e0d7-5051-950d-94c2d66b45d2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization employ trend analyses to determine if security control implementations, the frequency of continuous monitoring activities, and/or the types of activities used in the continuous monitoring process need to be modified based on empirical data?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Trend Analysis Reporting", "description": "

Control Description

Mechanisms exist to employ trend analyses to determine if security control implementations, the frequency of continuous monitoring activities, and/or the types of activities used in the continuous monitoring process need to be modified based on empirical data.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.\n▪ Generating event logs and the review of those event logs is narrowly-focused to business-critical Technology Assets, Applications, Services and/or Data (TAASD).

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to employ trend analyses to determine if security control implementations, the frequency of continuous monitoring activities, and/or the types of activities used in the continuous monitoring process need to be modified based on empirical data.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-06.2", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-06.2", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70538, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59025", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59025", "securityControlId": 31192, "ccis": [], "uuid": "93f069b4-acdd-5c02-9f35-6595524c4d40", "testId": "MON-07_A01", "test": "timestamps are recorded for audit records that meet organization-defined granularity of time measurement and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time or include the local time offset as part of the timestamp.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-08b.\n171A_3.3.7[b]", "defaultText": null }, { "id": 70539, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59025", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59025", "securityControlId": 31192, "ccis": [], "uuid": "232d5a3d-f84e-5df6-918d-bb343cc44d1d", "testId": "MON-07_A02", "test": "internal system clocks are used to generate time stamps for audit records.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.3.7[a]\n171A_R3_A.03.03.07.a", "defaultText": null }, { "id": 70540, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59025", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59025", "securityControlId": 31192, "ccis": [], "uuid": "27cf6aae-5496-5be6-a416-fe3a23ee8549", "testId": "MON-07_A03", "test": "granularity of time measurement for audit record time stamps is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.03.07.ODP[01]", "defaultText": null }, { "id": 70541, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59025", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59025", "securityControlId": 31192, "ccis": [], "uuid": "d6e18550-162f-5015-bdb0-4e79e49aa266", "testId": "MON-07_A04", "test": "time stamps are recorded for audit records that meet organization-defined granularity of time measurement.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70542, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59025", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59025", "securityControlId": 31192, "ccis": [], "uuid": "8e9fb5e3-90d4-5892-9141-51d6fabd0c7d", "testId": "MON-07_A05", "test": "time stamps are recorded for audit records that meet .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: a granularity of one (1) second or smaller", "otherId": "171A_R3_A.03.03.07.b[01]", "defaultText": null } ], "externalMappings": [ { "id": 564353, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583971", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1dd4ce30-cb6e-5ee0-937e-9af8872103be", "parentControlId": 31192, "controlId": "SR 2.11", "title": "SR 2.11", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583971" }, { "id": 564354, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583971", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27cfeeb9-95f2-5034-9b8d-00878b455358", "parentControlId": 31192, "controlId": "CR 2.11", "title": "CR 2.11", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583971" }, { "id": 564355, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583972", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "419cd2ec-8972-50ea-ba78-5cd7c64c4fe2", "parentControlId": 31192, "controlId": "AU-8", "title": "AU-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583972" }, { "id": 564356, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583972", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df275d6d-9614-50ef-81c6-1a2938a74d19", "parentControlId": 31192, "controlId": "AU-08", "title": "AU-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583972" }, { "id": 564358, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583972", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e36fc8f-e348-5ff4-a69f-2bbecb14335e", "parentControlId": 31192, "controlId": "AU-08", "title": "AU-08", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583972" }, { "id": 564359, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583972", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e838e761-1af7-5182-ae56-92b661742f80", "parentControlId": 31192, "controlId": "AU-08", "title": "AU-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583972" }, { "id": 564360, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583972", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d077e87-abb4-5df2-9d34-c5d802919fcb", "parentControlId": 31192, "controlId": "AU-08", "title": "AU-08", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583972" }, { "id": 564361, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583972", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e954eae0-108a-585f-9ddc-80f5d417ac6a", "parentControlId": 31192, "controlId": "AU-08", "title": "AU-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583972" }, { "id": 564362, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583972", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ccb11e4e-6938-503b-9111-9fc4544c5877", "parentControlId": 31192, "controlId": "AU-08", "title": "AU-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583972" }, { "id": 564363, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583972", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a58ae53-1291-57ce-b981-7389ecf41f86", "parentControlId": 31192, "controlId": "03.03.02.a.02", "title": "03.03.02.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583972" }, { "id": 564364, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d42ae2a9-149d-5030-aa4e-4bf75fe0bb64", "parentControlId": 31192, "controlId": "03.03.07.a", "title": "03.03.07.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583973" }, { "controlId": "B.2.8", "title": "B.2.8 — Time Stamps", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ce7d9649-f1e5-5b60-b3c9-e52c4744b1e1", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.8", "title": "NEI 08-09 App D.2.8 — Time Stamps", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "676d54d0-d1d0-51cc-850c-e577fff44ec0", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.2.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "c62f383a-2491-55eb-a355-0e16566628e6", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "0301b596-7a1b-5d45-9e56-498a1cca0f31", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "7bb25090-3a19-5ab6-980a-fdf60ecdcdb3", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "80f5edcb-e8e2-5a93-aa79-2ebf74c37385", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "834c934a-e742-5f90-afa2-b08b25775ea1", "isPublic": true } ], "id": 31192, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730996", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730996", "catalogueId": 1062, "uuid": "acfc3857-500e-5ece-bd7e-fb500721825a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization configure Technology Assets, Applications and/or Services (TAAS) to use an authoritative time source to generate time stamps for event logs?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Time Stamps", "description": "

Control Description

Mechanisms exist to configure Technology Assets, Applications and/or Services (TAAS) to use an authoritative time source to generate time stamps for event logs.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to configure Technology Assets, Applications and/or Services (TAAS) to use an authoritative time source to generate time stamps for event logs.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.2.8", "controlId": "MON-07", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-07", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70543, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590251", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590251", "securityControlId": 31193, "ccis": [], "uuid": "e7b2af7b-fecb-545e-91f8-170bc8c09e1e", "testId": "MON-07.1_A01", "test": "an authoritative source with which to compare and synchronize internal system clocks is specified.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.3.7[b]\n53A_R5_SC-45(01)_ODP[02]", "defaultText": null }, { "id": 70544, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590251", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590251", "securityControlId": 31193, "ccis": [], "uuid": "7b379c63-900a-5c85-b33f-49596a225e31", "testId": "MON-07.1_A02", "test": "internal system clocks used to generate time stamps for audit records are compared to and synchronized with the specified authoritative time source.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: at least hourly", "otherId": "171A_3.3.7[c]\n53A_R5_SC-45(01)(a)\n53A_R5_SC-45(01)_ODP[03]", "defaultText": null }, { "id": 70545, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590251", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590251", "securityControlId": 31193, "ccis": [], "uuid": "4f11b765-ca8d-57bb-82c1-40f9cb064ee7", "testId": "MON-07.1_A03", "test": "system clocks are synchronized within and between systems and system components.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-45", "defaultText": null }, { "id": 70546, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590251", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590251", "securityControlId": 31193, "ccis": [], "uuid": "33869657-8585-50d2-8d15-7a53edf13a89", "testId": "MON-07.1_A04", "test": "the frequency at which to compare the internal system clocks with the authoritative time source is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least hourly", "otherId": "53A_R5_SC-45(01)_ODP[01]", "defaultText": null }, { "id": 70547, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590252", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590252", "securityControlId": 31193, "ccis": [], "uuid": "0c27ad86-fed8-57d1-ae91-ded52a09bf3d", "testId": "MON-07.1_A05", "test": "the internal system clocks are synchronized with the authoritative time source when the time difference is greater than an organization-defined time period.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: any difference", "otherId": "53A_R5_SC-45(01)(b)", "defaultText": null }, { "id": 70548, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590252", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590252", "securityControlId": 31193, "ccis": [], "uuid": "be85f450-0491-5c29-bff7-ae6c203017f8", "testId": "MON-07.1_A06", "test": "time stamps are recorded for audit records that use Coordinated Universal Time (UTC), have a fixed local time offset from UTC, or include the local time offset as part of the time stamp.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.03.07.b[02]", "defaultText": null } ], "externalMappings": [ { "id": 564410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583978", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9aa51886-d307-5cd5-9eeb-c0263e667065", "parentControlId": 31193, "controlId": "CR 2.11(1)", "title": "CR 2.11(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583978" }, { "id": 564411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583978", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e08228e9-8ae3-5063-9ae7-834b8d0e6a28", "parentControlId": 31193, "controlId": "AU-8(1)", "title": "AU-8(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583978" }, { "id": 564412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583978", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e71fb7c-db54-5fa7-be61-218633db8c1d", "parentControlId": 31193, "controlId": "SC-45", "title": "SC-45", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583978" }, { "id": 564413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583978", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b1836d6-ef8c-5645-b28c-257d7c1b1766", "parentControlId": 31193, "controlId": "SC-45(01)", "title": "SC-45(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583978" }, { "id": 564414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583978", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58a23f90-6901-5127-a6dd-485383b072c1", "parentControlId": 31193, "controlId": "SC-45", "title": "SC-45", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583978" }, { "id": 564415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583978", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "883fbb12-dd79-518d-a61a-7d0e50aab834", "parentControlId": 31193, "controlId": "SC-45(01)", "title": "SC-45(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583978" }, { "id": 564416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583979", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "988ddda3-b374-5016-8783-eca7fdbd2107", "parentControlId": 31193, "controlId": "SC-45", "title": "SC-45", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583979" }, { "id": 564417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583979", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78939c40-04cc-5b9d-9481-717adb1482aa", "parentControlId": 31193, "controlId": "SC-45", "title": "SC-45", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583979" }, { "id": 564418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583979", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e228314f-2f9a-509b-bc80-0d550faee690", "parentControlId": 31193, "controlId": "SC-45", "title": "SC-45", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583979" }, { "id": 564419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583979", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d3d76ad-e6d6-5a45-ba4f-3ee28ca57b7d", "parentControlId": 31193, "controlId": "3.3.7", "title": "3.3.7", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583979" }, { "id": 564420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583979", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72103454-aa40-5d46-bf0a-4a28a6756d8c", "parentControlId": 31193, "controlId": "03.03.07.b", "title": "03.03.07.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583979" }, { "controlId": "B.2.8", "title": "B.2.8 — Time Stamps", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "7f2f6787-a021-59d8-9e90-e4faf295bb71", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.8", "title": "NEI 08-09 App D.2.8 — Time Stamps", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "a5f26f2a-572c-5212-bee3-1928564ceff4", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.2.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "6998ade1-3a93-5da2-8bf2-cc4d575413a7", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "a7e180bf-831a-5f3c-bfff-81aeada06ee9", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "12976a42-65ef-5b6b-a5e0-565d65cf74a6", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "b2052443-886e-5cfc-838b-d677d413c337", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "2d4da030-8205-5db4-a033-b2a58012b66e", "isPublic": true } ], "id": 31193, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730996", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730996", "catalogueId": 1062, "uuid": "f3b0b139-d0a5-57a8-ace3-7fa3312c6ec0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization synchronize internal system clocks with an authoritative time source?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Synchronization With Authoritative Time Source", "description": "

Control Description

Mechanisms exist to synchronize internal system clocks with an authoritative time source.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to synchronize internal system clocks with an authoritative time source.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.2.8", "controlId": "MON-07.1", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-07.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70549, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590252", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590252", "securityControlId": 31194, "ccis": [], "uuid": "fca41dfc-f9e1-5bf2-9a3c-d4772262aa15", "testId": "MON-08_A01", "test": "audit records are retained for a time period consistent with the records retention policy.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "171A_R3_A.03.03.03.b", "defaultText": null }, { "id": 70550, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590252", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590252", "securityControlId": 31194, "ccis": [], "uuid": "2fb8d227-905b-5489-abdf-44a49da39b48", "testId": "MON-08_A02", "test": "the original content of audit records is preserved.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.03.06.b[01]", "defaultText": null }, { "id": 70551, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590253", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590253", "securityControlId": 31194, "ccis": [], "uuid": "77e32a6f-f71a-52ab-9b2e-ce4e95456525", "testId": "MON-08_A03", "test": "the original time ordering of audit records is preserved.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.03.06.b[02]", "defaultText": null }, { "id": 70552, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590253", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590253", "securityControlId": 31194, "ccis": [], "uuid": "2c37c453-515e-5046-b54e-98301621ad72", "testId": "MON-08_A04", "test": "audit information is protected from unauthorized access, modification, and deletion.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.03.08.a[01]\n171A_3.3.8[d]\n171A_3.3.8[e]\n171A_3.3.8[f]\n53A_R5_AU-09a.", "defaultText": null }, { "id": 70553, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590253", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590253", "securityControlId": 31194, "ccis": [], "uuid": "c3038ae0-3aa0-57ce-8a27-2a907dbba580", "testId": "MON-08_A05", "test": "access to management of audit logging functionality is authorized to only a subset of privileged users or roles.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.03.08.b", "defaultText": null }, { "id": 70554, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590253", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590253", "securityControlId": 31194, "ccis": [], "uuid": "4f0fd2b5-5444-54f7-a46d-978a640ef486", "testId": "MON-08_A06", "test": "personnel or roles to be alerted upon detection of unauthorized access, modification or deletion of audit information is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AU-09_ODP", "defaultText": null }, { "id": 70555, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590253", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590253", "securityControlId": 31194, "ccis": [], "uuid": "a3d80578-9ea6-55a7-bb95-313eb47b7b35", "testId": "MON-08_A07", "test": "organization-defined personnel or roles are alerted upon detection of unauthorized access, modification or deletion of audit information.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AU-09b.", "defaultText": null } ], "externalMappings": [ { "id": 564476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b43198d8-3540-5053-86ed-fb1ac6797cd7", "parentControlId": 31194, "controlId": "EVENT 1.6", "title": "EVENT 1.6", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583994" }, { "id": 564477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce74b1fe-aefd-5ea9-9b51-5208dfb38dd0", "parentControlId": 31194, "controlId": "SR 3.9", "title": "SR 3.9", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583994" }, { "id": 564478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e60b9339-60ef-580f-b8dc-069568885f13", "parentControlId": 31194, "controlId": "SR 6.1 RE 1", "title": "SR 6.1 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583994" }, { "id": 564479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "823f631c-55fe-5d03-ab28-d1f37118d3cc", "parentControlId": 31194, "controlId": "CR 3.9", "title": "CR 3.9", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583994" }, { "id": 564480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8f70d14-99e6-5bb3-a41b-142dcde6b7c6", "parentControlId": 31194, "controlId": "CR 6.1", "title": "CR 6.1", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583994" }, { "id": 564481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cea27b2e-8f17-5fee-a22d-1d40ab9452b8", "parentControlId": 31194, "controlId": "CR 6.1(1)", "title": "CR 6.1(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583995" }, { "id": 564482, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14c692ce-1de0-5710-ae10-90447513c482", "parentControlId": 31194, "controlId": "8.15", "title": "8.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583995" }, { "id": 564486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82bf7921-fc4b-59d7-969b-01e17f96af5c", "parentControlId": 31194, "controlId": "AU-9", "title": "AU-9", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583995" }, { "id": 564487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d31a1c7-d862-508b-b204-57678df3fd65", "parentControlId": 31194, "controlId": "AU-09", "title": "AU-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583995" }, { "id": 564488, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5882b60-9060-5650-89a8-8d8191553cb2", "parentControlId": 31194, "controlId": "AU-09", "title": "AU-09", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583995" }, { "id": 564489, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afb50c05-5132-5615-91e0-4dd063730787", "parentControlId": 31194, "controlId": "AU-09", "title": "AU-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583995" }, { "id": 564490, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13e4f810-ba48-5d32-9b9d-144056510083", "parentControlId": 31194, "controlId": "AU-09", "title": "AU-09", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583996" }, { "id": 564491, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a529b9f7-1ab8-5378-9fc4-af4926f4bbd9", "parentControlId": 31194, "controlId": "AU-09", "title": "AU-09", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583996" }, { "id": 564492, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26ab40eb-7c3d-53a7-836e-ee2f37d04f00", "parentControlId": 31194, "controlId": "AU-09", "title": "AU-09", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583996" }, { "id": 564493, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0dd8ff7c-d5e8-5796-8433-6cf99a7c0acf", "parentControlId": 31194, "controlId": "3.3.8", "title": "3.3.8", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583996" }, { "id": 564494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70bc8e03-8055-5a58-a5d6-d5bef4a3288c", "parentControlId": 31194, "controlId": "03.03.03.b", "title": "03.03.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583996" }, { "id": 564495, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d696980-6e8d-5cd4-8e1c-c08710ee1a59", "parentControlId": 31194, "controlId": "03.03.06.b", "title": "03.03.06.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583996" }, { "id": 564496, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.583996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6363d19f-de67-5fab-9ce4-96e484a6002e", "parentControlId": 31194, "controlId": "03.03.08.a", "title": "03.03.08.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.583996" }, { "id": 564550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5418267e-2ae9-5059-a1f5-bf84bd2474d0", "parentControlId": 31194, "controlId": "C1.b", "title": "C1.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584003" }, { "controlId": "B.2.9", "title": "B.2.9 — Protection of Audit Information", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-9", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "97cf5ddf-cd79-5c03-86f1-b5e21e2dfecd", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.9", "title": "NEI 08-09 App D.2.9 — Protection of Audit Information", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.9", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "304a0ff7-0bdf-508c-beb7-3ee2b3f9fe85", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.2.9", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "f611cfbe-d08e-54d2-be2c-3af79a8ea5b1", "isPublic": true }, { "controlId": "CIP-015-1-R2", "title": "CIP-015-1-R2 — INSM Data Protection and Retention", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9e3dcb8e-ee13-56b2-a66a-7cb9e900bf12", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "fbe2dfae-4933-537a-985e-20b4ef00c26e", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "4864a8ed-4aa7-5d1a-82e4-8736a1c76d24", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "b936143b-1f1a-54a9-b6c6-f5125d8bbc20", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "b954605e-0f05-5fb7-bdb2-10a4e24bc795", "isPublic": true } ], "id": 31194, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730996", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730996", "catalogueId": 1062, "uuid": "3ee3d706-fc6c-54ab-832e-08396f3b353e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect event logs and audit tools from unauthorized access, modification and deletion?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Protection of Event Logs", "description": "

Control Description

Mechanisms exist to protect event logs and audit tools from unauthorized access, modification and deletion.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel retain security event logs for a time period consistent with records retention requirements to provide support for after-the-fact investigations of security incidents and to meet statutory, regulatory and/or contractual retention requirements.\n▪ IT and/or cybersecurity personnel restrict access to the management of event logs for privileged users to protect event logs and audit tools from unauthorized access, modification and deletion.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to protect event logs and audit tools from unauthorized access, modification and deletion.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.2.9
NERC-CIP (2026) Requirements: CIP-015-1-R2", "controlId": "MON-08", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-08", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70556, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590253", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590253", "securityControlId": 31195, "ccis": [], "uuid": "afc2cc49-8f15-5d95-bd98-cdbdbd38ec8f", "testId": "MON-08.1_A01", "test": "the frequency of event logs transferred to a different system, system component or media other than the system or system component conducting the logging is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-04(01)_ODP\n53A_R5_AU-09(02)_ODP", "defaultText": null }, { "id": 70557, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590254", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590254", "securityControlId": 31195, "ccis": [], "uuid": "11e93e42-d643-50eb-9aa1-61b0e431fab1", "testId": "MON-08.1_A02", "test": "event logs are transferred per an organization-defined frequency to a different system, system component or media other than the system or system component conducting the logging.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-04(01)", "defaultText": null }, { "id": 70558, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590254", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590254", "securityControlId": 31195, "ccis": [], "uuid": "68c7ca37-9b8d-5947-be57-af5427e31cac", "testId": "MON-08.1_A03", "test": "audit records are stored per an organization-defined frequency in a repository that is part of a physically different system or system component than the system or component being audited.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-09(02)", "defaultText": null } ], "externalMappings": [ { "id": 564583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "083b27e3-06d0-52d1-a702-77427e1e3d52", "parentControlId": 31195, "controlId": "AU-4(1)", "title": "AU-4(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584007" }, { "id": 564584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "065db2ef-42b4-513f-ac99-bc6bf37a7bd7", "parentControlId": 31195, "controlId": "AU-9(2)", "title": "AU-9(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584007" }, { "id": 564585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87887f57-d84a-5d52-a806-094ab56aa52b", "parentControlId": 31195, "controlId": "AU-04(01)", "title": "AU-04(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584007" }, { "id": 564586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b34bbbfd-bcc2-53b1-b77f-551f9ada9b53", "parentControlId": 31195, "controlId": "AU-09(02)", "title": "AU-09(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584007" }, { "id": 564587, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ff1b751-2e06-5a02-bda6-9d1495ce9ede", "parentControlId": 31195, "controlId": "AU-09(02)", "title": "AU-09(02)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584007" }, { "id": 564588, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c7b31ee-f593-5ce1-baf9-0b8e831472b1", "parentControlId": 31195, "controlId": "AU-04(01)", "title": "AU-04(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584007" }, { "id": 564589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11c255ad-5533-5665-a434-4efc83fdec63", "parentControlId": 31195, "controlId": "AU-09(02)", "title": "AU-09(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584007" }, { "id": 564590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d4d10f4-dda2-5c20-b55f-158a5574b3ac", "parentControlId": 31195, "controlId": "AU-04(01)", "title": "AU-04(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584007" }, { "id": 564591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584008", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f947f5dc-e229-5068-8981-f586524e1407", "parentControlId": 31195, "controlId": "AU-04(01)", "title": "AU-04(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584008" }, { "id": 564592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584008", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf7fba87-50f3-5bbb-877c-cb19ac624be3", "parentControlId": 31195, "controlId": "AU-04(01)", "title": "AU-04(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584008" }, { "id": 564593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584008", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a621d7b6-12c0-5ae6-8040-a36f1a899969", "parentControlId": 31195, "controlId": "AU-09(02)", "title": "AU-09(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584008" }, { "id": 564595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584008", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae4c073e-7254-56f6-8ea6-1092227d2f3e", "parentControlId": 31195, "controlId": "03.03.08.a", "title": "03.03.08.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584008" } ], "id": 31195, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730997", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730997", "catalogueId": 1062, "uuid": "40cf3648-77cc-52e2-92d8-715600f3ae7b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization back up event logs onto a physically different system or system component than the Security Incident Event Manager (SIEM) or similar automated tool?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Event Log Backup on Separate Physical Systems / Components", "description": "

Control Description

Mechanisms exist to back up event logs onto a physically different system or system component than the Security Incident Event Manager (SIEM) or similar automated tool.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to back up event logs onto a physically different system or system component than the Security Incident Event Manager (SIEM) or similar automated tool.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-08.1", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-08.1", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70559, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590254", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590254", "securityControlId": 31196, "ccis": [], "uuid": "eaaff641-cbf7-5743-996d-6a6ae734c524", "testId": "MON-08.2_A01", "test": "a subset of privileged users or roles authorized to access management of event logging functionality is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.3.9[a]\n53A_R5_AU-09(04)_ODP", "defaultText": null }, { "id": 70560, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590254", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590254", "securityControlId": 31196, "ccis": [], "uuid": "78de5a6b-ee82-58fd-91f1-adfdd87d1a89", "testId": "MON-08.2_A02", "test": "access to management of audit logging functionality is authorized to only a subset of privileged users or roles.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.3.9[b]\n171A_R3_A.03.03.08.b\n53A_R5_AU-09(04)", "defaultText": null } ], "externalMappings": [ { "id": 564620, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584012", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e54aaad-a055-51d4-8ca8-3278232ec894", "parentControlId": 31196, "controlId": "SR 6.1", "title": "SR 6.1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584012" }, { "id": 564621, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584012", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec720603-221e-5259-9dc3-50e049be261a", "parentControlId": 31196, "controlId": "CR 6.1", "title": "CR 6.1", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584012" }, { "id": 564622, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584012", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c8ffd1a-a203-5dec-a98c-5bf227c8dba6", "parentControlId": 31196, "controlId": "AU-9(4)", "title": "AU-9(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584012" }, { "id": 564623, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584012", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9dfd57b5-ead9-58d2-aa8c-1ee212262c2a", "parentControlId": 31196, "controlId": "AU-09(04)", "title": "AU-09(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584012" }, { "id": 564624, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584012", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b73db02b-21f7-57cf-86f3-54cdec7df70c", "parentControlId": 31196, "controlId": "AU-09(04)", "title": "AU-09(04)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584012" }, { "id": 564625, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584012", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25eb5909-0e9c-5173-8ace-3fd1e653b6e7", "parentControlId": 31196, "controlId": "AU-09(04)", "title": "AU-09(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584012" }, { "id": 564626, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584012", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "162118c3-353b-5238-be66-16ebf52a4272", "parentControlId": 31196, "controlId": "AU-09(04)", "title": "AU-09(04)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584012" }, { "id": 564627, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3f2e84e-fcb6-5799-9e36-0d35818fc125", "parentControlId": 31196, "controlId": "AU-09(04)", "title": "AU-09(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584013" }, { "id": 564628, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "854594b8-9028-5cca-82cb-29b902022e63", "parentControlId": 31196, "controlId": "3.3.9", "title": "3.3.9", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584013" }, { "id": 564629, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22aa8e6c-4f08-54fe-9a10-424f35adb6f1", "parentControlId": 31196, "controlId": "03.03.08.a", "title": "03.03.08.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584013" }, { "id": 564630, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75606943-c139-5687-a25f-0e6ceb649329", "parentControlId": 31196, "controlId": "03.03.08.b", "title": "03.03.08.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584013" } ], "id": 31196, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730997", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730997", "catalogueId": 1062, "uuid": "34c5bd91-8ae6-5da5-b684-30b921328ce6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict access to the management of event logs to privileged users with a specific business need?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Access by Subset of Privileged Users", "description": "

Control Description

Mechanisms exist to restrict access to the management of event logs to privileged users with a specific business need.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel restrict access to the management of event logs for privileged users to protect event logs and audit tools from unauthorized access, modification and deletion.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to restrict access to the management of event logs to privileged users with a specific business need.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-08.2", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-08.2", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70561, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590255", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590255", "securityControlId": 31197, "ccis": [], "uuid": "dc8144d0-18bb-5a6d-800a-a899c7726c1d", "testId": "MON-08.3_A01", "test": "cryptographic mechanisms to protect the integrity of audit information and audit tools are implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-09(03)", "defaultText": null } ], "externalMappings": [ { "id": 564660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584016", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bf6161b-ac99-5667-b8c0-8b9bbbac6834", "parentControlId": 31197, "controlId": "AU-9(3)", "title": "AU-9(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584016" }, { "id": 564661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584016", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0d6361a-79bf-5e3f-8b53-bd700c82c613", "parentControlId": 31197, "controlId": "AU-09(03)", "title": "AU-09(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584016" }, { "id": 564662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b863e8f6-f62a-5dad-8ba3-45a23c75c570", "parentControlId": 31197, "controlId": "AU-09(03)", "title": "AU-09(03)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584017" }, { "id": 564663, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8343dda1-0a37-54cd-9769-021356734179", "parentControlId": 31197, "controlId": "AU-09(03)", "title": "AU-09(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584017" }, { "id": 564664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04e8f307-57cd-59a4-89c9-03642aa022fd", "parentControlId": 31197, "controlId": "AU-09(03)", "title": "AU-09(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584017" }, { "id": 564666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72b132ce-d0a3-51ec-8df0-184e2a4aa059", "parentControlId": 31197, "controlId": "03.03.08.a", "title": "03.03.08.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584017" } ], "id": 31197, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730997", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730997", "catalogueId": 1062, "uuid": "88b5f795-d7d4-534e-a2ea-d140d2535766", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Are cryptographic mechanisms utilized to protect the integrity of event logs and audit tools?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Cryptographic Protection of Event Log Information", "description": "

Control Description

Cryptographic mechanisms exist to protect the integrity of event logs and audit tools.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational cryptographic capability exists to protect the integrity of event logs and audit tools.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-08.3", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-08.3", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70562, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590255", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590255", "securityControlId": 31198, "ccis": [], "uuid": "ccba0116-292b-5a9b-8d46-ab83ea09cf2e", "testId": "MON-08.4_A01", "test": "critical or sensitive system and organizational operations for which dual authorization is to be enforced are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.1.1e[a]\n53A_R5_CM-05(04)_ODP[01]\n53A_R5_AU-09(05)_ODP[01]\n53A_R5_AU-09(05)_ODP[02]", "defaultText": null }, { "id": 70563, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590255", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590255", "securityControlId": 31198, "ccis": [], "uuid": "58c0c368-b1e1-5458-87ba-ad61e3f87eb3", "testId": "MON-08.4_A02", "test": "dual authorization is employed to execute critical or sensitive system and organizational operations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "172A_3.1.1e[b]\n53A_R5_AU-09(05)\n53A_R5_CM-05(04)[01]\n53A_R5_CM-05(04)[02]", "defaultText": null } ], "externalMappings": [ { "id": 564669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bd5fd10-6491-5366-92e5-98d1d0eeadf7", "parentControlId": 31198, "controlId": "AU-9(5)", "title": "AU-9(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584018" }, { "id": 564670, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8953b025-a0fd-5309-be75-d74b35ad7211", "parentControlId": 31198, "controlId": "AU-09(05)", "title": "AU-09(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584018" }, { "id": 564671, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4101f7b7-f7b0-5e00-a3f9-29fb84ad3c55", "parentControlId": 31198, "controlId": "AU-09(05)", "title": "AU-09(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584018" } ], "id": 31198, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730997", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730997", "catalogueId": 1062, "uuid": "3648e56e-808a-512c-b650-7bd9abef5aa7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to enforce dual authorization for the movement or deletion of event logs?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Dual Authorization for Event Log Movement", "description": "

Control Description

Automated mechanisms exist to enforce dual authorization for the movement or deletion of event logs.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to automatically enforce dual authorization for the movement or deletion of event logs.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-08.4", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-08.4", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70564, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590255", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590255", "securityControlId": 31199, "ccis": [], "uuid": "189a46e7-a93c-52c0-a051-3c11b9b541ea", "testId": "MON-09_A01", "test": "actions to be covered by non-repudiation are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-10_ODP", "defaultText": null }, { "id": 70565, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590256", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590256", "securityControlId": 31199, "ccis": [], "uuid": "91e72e5e-06bb-5637-8a54-528debf5c61a", "testId": "MON-09_A02", "test": "irrefutable evidence is provided that an individual (or process acting on behalf of an individual) has performed organization-defined actions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-10", "defaultText": null } ], "externalMappings": [ { "id": 564675, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9abbc922-0220-5dff-8c2b-9c0bf0837104", "parentControlId": 31199, "controlId": "SR 2.12", "title": "SR 2.12", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584018" }, { "id": 564676, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1cf26627-5b22-55d7-9518-e67255eb35a9", "parentControlId": 31199, "controlId": "SR 2.12 RE 1", "title": "SR 2.12 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584018" }, { "id": 564677, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584019", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3eab0950-cda9-56d5-82c5-96e9d2616356", "parentControlId": 31199, "controlId": "CR 2.12", "title": "CR 2.12", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584019" }, { "id": 564678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584019", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3639cf9-bf52-5af6-a540-0794c29c543c", "parentControlId": 31199, "controlId": "CR 2.12(1)", "title": "CR 2.12(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584019" }, { "id": 564679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584019", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d7f161a-89c7-5946-b779-fa7f34c007aa", "parentControlId": 31199, "controlId": "AU-10", "title": "AU-10", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584019" }, { "id": 564680, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584019", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "901c73f0-5407-5970-b1ae-6c98c9957a7f", "parentControlId": 31199, "controlId": "AU-10", "title": "AU-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584019" }, { "id": 564681, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584019", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "761cf57c-ee4f-55b6-8d5b-eccb3450b057", "parentControlId": 31199, "controlId": "AU-10", "title": "AU-10", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584019" }, { "id": 564682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584019", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53229d0a-8b14-504b-959a-a082ea852bc7", "parentControlId": 31199, "controlId": "AU-10", "title": "AU-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584019" }, { "id": 564683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584019", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b325c1e-35c3-5994-9782-ed920c79004d", "parentControlId": 31199, "controlId": "AU-10", "title": "AU-10", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584019" }, { "id": 564684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584019", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61953c2e-c8d1-54f3-8ce5-ceb0b3fd4fc6", "parentControlId": 31199, "controlId": "AU-10", "title": "AU-10", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584019" }, { "controlId": "B.2.10", "title": "B.2.10 — Nonrepudiation", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-10", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "fab3fd6d-32c8-5f4b-8e60-63d14ad896a9", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.10", "title": "NEI 08-09 App D.2.10 — Nonrepudiation", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.10", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "36cfd769-392a-52bb-b675-31008a01515e", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.2.10", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "366a32fc-33a5-55a5-af83-04ca27d1eb53", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "cf2a4a51-433e-58aa-abdf-8389e0abf238", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "c8c8358a-4f67-5ed0-ba5e-20df77be193a", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "4c78561d-f30b-5060-b7a0-1c8f999ab26d", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "09072225-5a76-5e12-b82d-7dfc53b1b374", "isPublic": true } ], "id": 31199, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730998", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730998", "catalogueId": 1062, "uuid": "89c019b1-444f-54d9-8bd8-e86432b52828", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize a non-repudiation capability to protect against an individual falsely denying having performed a particular action?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Non-Repudiation", "description": "

Control Description

Mechanisms exist to utilize a non-repudiation capability to protect against an individual falsely denying having performed a particular action.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to utilize a non-repudiation capability to protect against an individual falsely denying having performed a particular action.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.2.10", "controlId": "MON-09", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-09", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70566, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590256", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590256", "securityControlId": 31200, "ccis": [], "uuid": "c7275d66-d163-5c13-ba40-3039dfe7baa1", "testId": "MON-09.1_A01", "test": "the strength of binding between the identity of the information producer and the information is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-10(01)_ODP", "defaultText": null }, { "id": 70567, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590256", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590256", "securityControlId": 31200, "ccis": [], "uuid": "90a78228-5658-55c8-9620-f5046a11dc5d", "testId": "MON-09.1_A02", "test": "the identity of the information producer is bound with the information to organization-defined strength of binding.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-10(01)(a)", "defaultText": null }, { "id": 70568, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590256", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590256", "securityControlId": 31200, "ccis": [], "uuid": "50608128-f3e0-5488-beb3-2d2d19f26eb3", "testId": "MON-09.1_A03", "test": "the means for authorized individuals to determine the identity of the producer of the information is provided.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-10(01)(b)", "defaultText": null }, { "id": 70569, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590256", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590256", "securityControlId": 31200, "ccis": [], "uuid": "a898c63c-1cfd-576c-8357-489aa6450105", "testId": "MON-09.1_A04", "test": "the frequency at which to validate the binding of the information producer identity to the information is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AU-10(02)_ODP[01]", "defaultText": null }, { "id": 70570, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590257", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590257", "securityControlId": 31200, "ccis": [], "uuid": "8e4f49b1-b9c4-5932-a5af-503381878a85", "testId": "MON-09.1_A05", "test": "the actions to be performed in the event of a validation error are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AU-10(02)_ODP[02]", "defaultText": null }, { "id": 70571, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590257", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590257", "securityControlId": 31200, "ccis": [], "uuid": "6abd01e0-37b7-5cb6-9efe-fd1ec6d96234", "testId": "MON-09.1_A06", "test": "the binding of the information producer identity to the information is validated at organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AU-10(02)(a)", "defaultText": null }, { "id": 70572, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590257", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590257", "securityControlId": 31200, "ccis": [], "uuid": "081e73fb-3e61-595a-8a4f-c80243dc1d9b", "testId": "MON-09.1_A07", "test": "organization-defined actions in the event of a validation error are performed.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AU-10(02)(b)", "defaultText": null } ], "externalMappings": [ { "id": 564701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584021", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0df80d40-4e45-5caa-a861-18c43d270b89", "parentControlId": 31200, "controlId": "AU-10(01)", "title": "AU-10(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584021" }, { "id": 564702, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6c84cfe-88aa-5219-882c-441c96ed3b27", "parentControlId": 31200, "controlId": "AU-10(02)", "title": "AU-10(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584022" }, { "id": 564703, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83c46f50-1119-53c2-bb7d-cbf626c8c208", "parentControlId": 31200, "controlId": "AU-10(01)", "title": "AU-10(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584022" }, { "id": 564704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e43c4c5d-ce9c-5f56-a9b1-9ebee3b6c814", "parentControlId": 31200, "controlId": "AU-10(02)", "title": "AU-10(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584022" }, { "id": 564706, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ee12ef6-d1f5-52ed-a327-aa9f8afa3908", "parentControlId": 31200, "controlId": "AU-10(1)", "title": "AU-10(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584022" }, { "id": 564707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9859871-3ab0-52e6-b803-d4a3731acca3", "parentControlId": 31200, "controlId": "AU-10(2)", "title": "AU-10(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584022" } ], "id": 31200, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730998", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730998", "catalogueId": 1062, "uuid": "959af484-2395-578c-9061-922c6b086f4a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization bind the identity of the information producer to the information generated?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Identity Binding", "description": "

Control Description

Mechanisms exist to bind the identity of the information producer to the information generated.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to bind the identity of the information producer to the information generated.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-09.1", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-09.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70573, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590257", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590257", "securityControlId": 31201, "ccis": [], "uuid": "f2bd9316-bac6-5e95-9a39-f2353171fd11", "testId": "MON-10_A01", "test": "a time period to retain audit records that is consistent with the records retention policy is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.3.1[e]\n53A_R5_AU-11_ODP", "defaultText": null }, { "id": 70574, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590257", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590257", "securityControlId": 31201, "ccis": [], "uuid": "6f016fc8-5b27-5543-917f-b2219ca3088e", "testId": "MON-10_A02", "test": "audit records are retained for a time period consistent with the records retention policy.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "171A_3.3.1[f]\n171A_R3_A.03.03.03.b\n53A_R5_AU-11", "defaultText": null } ], "externalMappings": [ { "id": 564722, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584024", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e73db88-40b2-5106-9d65-15e836b77bda", "parentControlId": 31201, "controlId": "EVENT 1.4", "title": "EVENT 1.4", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584024" }, { "id": 564723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584024", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a74d20c6-7a69-5b58-af04-a941bd243a00", "parentControlId": 31201, "controlId": "AU-11", "title": "AU-11", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584024" }, { "id": 564724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584024", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8cbe0a3a-291f-584f-906f-69140add4c9c", "parentControlId": 31201, "controlId": "AU-11", "title": "AU-11", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584024" }, { "id": 564726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584024", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0298596-67a8-5f9d-8901-c4616d2aa4f4", "parentControlId": 31201, "controlId": "AU-11", "title": "AU-11", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584024" }, { "id": 564727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aabc46f8-0418-5921-8d3b-57df4ff91d68", "parentControlId": 31201, "controlId": "AU-11", "title": "AU-11", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584025" }, { "id": 564728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "399988cf-21f0-5fe6-b345-bc2dfb36a2c7", "parentControlId": 31201, "controlId": "AU-11", "title": "AU-11", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584025" }, { "id": 564729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c42ba62-139e-5d71-a43e-cf632f78b161", "parentControlId": 31201, "controlId": "AU-11", "title": "AU-11", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584025" }, { "id": 564730, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c560a85-c731-5c11-bd87-2152e53c3e0b", "parentControlId": 31201, "controlId": "AU-11", "title": "AU-11", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584025" }, { "id": 564731, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0aae269-9f6b-5610-b4f0-4d38ae44faa8", "parentControlId": 31201, "controlId": "3.3.1", "title": "3.3.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584025" }, { "id": 564732, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23c1dd3a-0571-53ae-b1cb-ef9562d0b9d3", "parentControlId": 31201, "controlId": "03.03.03.b", "title": "03.03.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584025" }, { "id": 564757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "905f34da-e86b-5497-9a78-fe94ebcc43c5", "parentControlId": 31201, "controlId": "CIP-006-6 1.9", "title": "CIP-006-6 1.9", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584036" }, { "id": 564758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1c46c70-6bc7-5a88-bec4-24debcfffb3c", "parentControlId": 31201, "controlId": "CIP-006-6 2.3", "title": "CIP-006-6 2.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584036" }, { "id": 564759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28234ebe-69b4-5397-aa58-9e3435cae1cd", "parentControlId": 31201, "controlId": "CIP-007-6 4.3", "title": "CIP-007-6 4.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584036" }, { "id": 564778, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25c2080c-ad79-5149-bca0-6ab81bbd7e16", "parentControlId": 31201, "controlId": "C1.b", "title": "C1.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584039" }, { "controlId": "A.5", "title": "A.5 — DOCUMENT CONTROL AND RECORDS RETENTION AND HANDLING", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-11, MP-4, PM-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "48f11bb6-bd58-5aee-9561-d6816cbe5e91", "isPublic": true }, { "controlId": "NEI 08-09 Sec 5.0", "title": "NEI 08-09 Sec 5.0 — DOCUMENT CONTROL AND RECORDS RETENTION AND HANDLING", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "0725847a-afd5-51e1-893d-0e01c871d166", "isPublic": true }, { "controlId": "10 CFR 73.54(h), 73.55(q)", "title": "10 CFR 73.54(h), 73.55(q) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "212289d1-bac0-54c0-8cd8-4e34fc9b0bb3", "isPublic": true }, { "controlId": "B.2.11", "title": "B.2.11 — Audit Record Retention", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a3886736-8e53-540a-a073-8a9fc31a9921", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.11", "title": "NEI 08-09 App D.2.11 — Audit Record Retention", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.11", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d910b5b5-d363-56d4-8f0f-170c5d9b8d29", "isPublic": true }, { "controlId": "10 CFR 73.54(h)", "title": "10 CFR 73.54(h) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.2.11", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "4da27527-b061-55bb-978d-d2d012e124d7", "isPublic": true }, { "controlId": "CIP-015-1-R2", "title": "CIP-015-1-R2 — INSM Data Protection and Retention", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "767d0fa8-cb6c-5fef-8960-2e64df20049d", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b85eecdc-2192-5617-94db-faef0f700de0", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "29abac20-6452-5ecf-9acc-23f54b678ce0", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "03a0809c-2e5b-5c5e-b042-54e71abfcc4b", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "b21efa54-b86a-5515-8147-1936336c3269", "isPublic": true } ], "id": 31201, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730998", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730998", "catalogueId": 1062, "uuid": "9286d00f-0d70-5c4d-a260-d4e9fac02cf5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization retain event logs for a time period consistent with records retention requirements to provide support for after-the-fact investigations of security incidents and to meet statutory, regulatory and contractual retention requirements?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 10.0, "title": "Event Log Retention", "description": "

Control Description

Mechanisms exist to retain event logs for a time period consistent with records retention requirements to provide support for after-the-fact investigations of security incidents and to meet statutory, regulatory and contractual retention requirements.

Evidence Request List (ERL)

E-AST-11

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to retain event logs for a time period consistent with records retention requirements to provide support for after-the-fact investigations of security incidents and to meet statutory, regulatory and contractual retention requirements.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.5, B.2.11
NERC-CIP (2026) Requirements: CIP-015-1-R2", "controlId": "MON-10", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-10", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)\n∙ Log retention policy (minimum 90 days online, 1 year archived)\n∙ Cloud log storage (e.g., AWS S3, Azure Storage)

Small Business (10-49 staff)

∙ Managed Security Services Provider (MSSP)\n∙ Log retention policy (minimum 90 days online, 1 year archived)\n∙ Cloud SIEM with configurable retention

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM) with defined retention schedules\n∙ Managed Security Services Provider (MSSP)\n∙ Log archiving to cold storage (e.g., AWS S3 Glacier, Azure Archive)

Large Business (250-999 staff)

∙ SIEM with tiered log retention (hot/warm/cold storage)\n∙ Log retention policy aligned to regulatory requirements (e.g., HIPAA 6 yrs, PCI DSS 1 yr)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Enterprise log retention program aligned to all applicable regulations\n∙ SIEM with tiered retention (hot/warm/cold storage)\n∙ Immutable log archives (e.g., AWS S3 Object Lock, Azure Blob WORM)\n∙ Legal hold capability for investigation support", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70575, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590258", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590258", "securityControlId": 31202, "ccis": [], "uuid": "79c1a381-6321-5a8b-9e89-d18fafe4810e", "testId": "MON-11_A01", "test": "open-source information and/or information sites to be monitored for evidence of unauthorized disclosure of organizational information is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-13_ODP[01]", "defaultText": null }, { "id": 70576, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590258", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590258", "securityControlId": 31202, "ccis": [], "uuid": "e5e80bbc-0860-5560-99ed-f17eb3e58979", "testId": "MON-11_A02", "test": "the frequency with which open-source information and/or information sites are monitored for evidence of unauthorized disclosure of organizational information is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-13_ODP[02]\n53A_R5_AU-13a.", "defaultText": null }, { "id": 70577, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590258", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590258", "securityControlId": 31202, "ccis": [], "uuid": "4ae0212a-b193-5e58-af46-9a864daa27c5", "testId": "MON-11_A03", "test": "personnel or roles to be notified if an information disclosure is discovered is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-13_ODP[03]", "defaultText": null }, { "id": 70578, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590258", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590258", "securityControlId": 31202, "ccis": [], "uuid": "51eacda0-7255-5ed7-9319-389b4457e421", "testId": "MON-11_A04", "test": "additional actions to be taken if an information disclosure is discovered are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-13_ODP[04]", "defaultText": null }, { "id": 70579, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590259", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590259", "securityControlId": 31202, "ccis": [], "uuid": "05a7d971-d3df-58e3-9843-aea081e2c33b", "testId": "MON-11_A05", "test": "personnel or roles are notified if an information disclosure is discovered.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-13b.01", "defaultText": null }, { "id": 70580, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590259", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590259", "securityControlId": 31202, "ccis": [], "uuid": "39e198bd-0e3d-5c54-8fc8-c0ce7d089c14", "testId": "MON-11_A06", "test": "additional actions are taken if an information disclosure is discovered.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-13b.02", "defaultText": null } ], "externalMappings": [ { "id": 564793, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8656a76d-a3c4-58e4-be39-c38724bad2a3", "parentControlId": 31202, "controlId": "5.7", "title": "5.7", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584041" }, { "id": 564795, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "adb6c081-43e7-561f-85fc-777be3433c11", "parentControlId": 31202, "controlId": "AU-13", "title": "AU-13", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584041" }, { "id": 564796, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c77b87f-1c4e-5913-bbd4-1b8adb0d30b3", "parentControlId": 31202, "controlId": "AU-13", "title": "AU-13", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584041" }, { "id": 564797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec60627e-7e53-58da-9c37-94695dcc2f5a", "parentControlId": 31202, "controlId": "AU-13", "title": "AU-13", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584041" }, { "id": 564799, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a895b0dd-d469-5192-a7f9-19a3b2c40475", "parentControlId": 31202, "controlId": "AU-13", "title": "AU-13", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584042" }, { "id": 564800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b095894d-77be-526b-ab54-27f5547709c8", "parentControlId": 31202, "controlId": "AU-13", "title": "AU-13", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584042" }, { "id": 564803, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a68d9844-485c-5bc4-ae33-b1556c6cfc02", "parentControlId": 31202, "controlId": "03.01.22.b", "title": "03.01.22.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584042" }, { "controlId": "A.5", "title": "A.5 — DOCUMENT CONTROL AND RECORDS RETENTION AND HANDLING", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-11, MP-4, PM-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "87fc9a05-63f8-5c92-ac52-bd780174a8e5", "isPublic": true }, { "controlId": "NEI 08-09 Sec 5.0", "title": "NEI 08-09 Sec 5.0 — DOCUMENT CONTROL AND RECORDS RETENTION AND HANDLING", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "786a8e6c-f5bf-54fb-b2e9-fe59e3df365c", "isPublic": true }, { "controlId": "10 CFR 73.54(h), 73.55(q)", "title": "10 CFR 73.54(h), 73.55(q) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "43eeae52-dfe5-5f6a-839f-6ea92200e103", "isPublic": true }, { "controlId": "B.2.11", "title": "B.2.11 — Audit Record Retention", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "cf9ce734-f7ee-57aa-ae4b-b1763fec05aa", "isPublic": true }, { "controlId": "NEI 08-09 App D.2.11", "title": "NEI 08-09 App D.2.11 — Audit Record Retention", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.2.11", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "52c986fd-5e26-5f88-af8d-28eee7e05ba7", "isPublic": true }, { "controlId": "10 CFR 73.54(h)", "title": "10 CFR 73.54(h) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.2.11", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "68125226-b20f-5de3-abc2-caf7f605c7ed", "isPublic": true }, { "controlId": "CIP-015-1-R2", "title": "CIP-015-1-R2 — INSM Data Protection and Retention", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "37e6327c-5fc9-5e6d-a156-b2983c6bafac", "isPublic": true }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "6aa36acb-dae7-5798-aeaa-8eecf1982367", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "6205ce14-ce97-51a8-bca3-3866ae0e4990", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "fa8fe2a9-24db-5cf8-b46e-ce3d1e9a6b61", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "4013a457-5770-5441-9117-bdae9b9d78d4", "isPublic": true } ], "id": 31202, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730999", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730999", "catalogueId": 1062, "uuid": "ac8d87b5-8dda-517a-97e9-ccf9e27c5c40", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization monitor for evidence of unauthorized exfiltration or disclosure of non-public information?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Monitoring For Information Disclosure", "description": "

Control Description

Mechanisms exist to monitor for evidence of unauthorized exfiltration or disclosure of non-public information.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to monitor for evidence of unauthorized exfiltration or disclosure of non-public information.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.5, B.2.11
NERC-CIP (2026) Requirements: CIP-015-1-R2", "controlId": "MON-11", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-11", "references": "

Micro-Small Business (<10 staff)

∙ Content filtering\n∙ Keyword alerting (e.g., Google Alerts)\n∙ Review of social media outlets\n∙ HaveIBeenPwned monitoring (https://haveibeenpwned.com)

Small Business (10-49 staff)

∙ Content filtering\n∙ Keyword alerting (e.g., Google Alerts)\n∙ Review of social media outlets\n∙ HaveIBeenPwned monitoring (https://haveibeenpwned.com)\n∙ Dark web monitoring (e.g., SpyCloud, HaveIBeenPwned Pro)

Medium Business (50-249 staff)

∙ Content filtering\n∙ Keyword alerting (e.g., Google Alerts)\n∙ Dark web monitoring (e.g., SpyCloud, Recorded Future, Digital Shadows)\n∙ Data Loss Prevention (DLP) solution

Large Business (250-999 staff)

∙ Data Loss Prevention (DLP) solution (e.g., Microsoft Purview DLP, Forcepoint DLP)\n∙ Dark web monitoring platform (e.g., Recorded Future, Digital Shadows, SpyCloud)\n∙ Brand and digital footprint monitoring

Enterprise (>1,000 staff)

∙ Enterprise DLP solution (e.g., Symantec DLP, Forcepoint DLP, Microsoft Purview DLP)\n∙ Dedicated threat intelligence platform with dark web monitoring\n∙ Digital risk protection (DRP) service (e.g., ZeroFox, Recorded Future)\n∙ Automated exfiltration detection via SIEM/UEBA", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70581, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590259", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590259", "securityControlId": 31203, "ccis": [], "uuid": "554edbfb-af55-5bc2-b63d-5801c384bd9a", "testId": "MON-11.1_A01", "test": "anomalous or suspicious behavior is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.2e[a]", "defaultText": null }, { "id": 70582, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590259", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590259", "securityControlId": 31203, "ccis": [], "uuid": "ca85c2ac-3ab7-5a7e-815a-22e2386c2232", "testId": "MON-11.1_A02", "test": "organizational systems and system components are monitored on an ongoing basis for anomalous or suspicious behavior.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "172A_3.14.2e[b]", "defaultText": null }, { "id": 70583, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590259", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590259", "securityControlId": 31203, "ccis": [], "uuid": "83c0fc60-ffe7-5f79-af54-ce365b0b37de", "testId": "MON-11.1_A03", "test": "outbound communications traffic is analyzed at interfaces external to the system to detect covert exfiltration of information.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-04(18)[01]", "defaultText": null }, { "id": 70584, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590259", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590259", "securityControlId": 31203, "ccis": [], "uuid": "9594ad99-2eaa-55fd-8376-61f8376d5992", "testId": "MON-11.1_A04", "test": "interior points of the network are monitored to detect covert exfiltration of information.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-04(18)_ODP\n53A_R5_SI-04(18)[02]", "defaultText": null } ], "externalMappings": [ { "id": 564810, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "728bed65-b12c-5e3b-b276-a094ff61fed9", "parentControlId": 31203, "controlId": "SI-4(18)", "title": "SI-4(18)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584043" }, { "id": 564811, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3990370-9999-58c4-96b0-18b15e42a0c3", "parentControlId": 31203, "controlId": "SI-04(18)", "title": "SI-04(18)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584043" }, { "id": 564813, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b89a0a4-44d4-5f38-baa3-05ee492514e3", "parentControlId": 31203, "controlId": "SI-04(18)", "title": "SI-04(18)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584043" } ], "id": 31203, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.730999", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.730999", "catalogueId": 1062, "uuid": "19c53fa7-97f1-5846-9530-28def922c4b4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to analyze network traffic to detect covert data exfiltration?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Analyze Traffic for Covert Exfiltration", "description": "

Control Description

Automated mechanisms exist to analyze network traffic to detect covert data exfiltration.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to automatically analyze network traffic to detect covert data exfiltration.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "MON-11.1", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-11.1", "references": "

Micro-Small Business (<10 staff)

∙ Content filtering

Small Business (10-49 staff)

∙ Content filtering

Medium Business (50-249 staff)

∙ Content filtering

Large Business (250-999 staff)

∙ Content filtering

Enterprise (>1,000 staff)

∙ Content filtering", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70585, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59026", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59026", "securityControlId": 31204, "ccis": [], "uuid": "356ebc20-2c23-5413-aed1-b8f8318dc1ac", "testId": "MON-11.2_A01", "test": "authorization or approval processes for network services are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(22)_ODP[01]", "defaultText": null }, { "id": 70586, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59026", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59026", "securityControlId": 31204, "ccis": [], "uuid": "4e55023f-85a4-5186-8018-df12d0de2729", "testId": "MON-11.2_A03", "test": "personnel or roles to be alerted upon the detection of network services that have not been authorized or approved by authorization or approval processes is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(22)_ODP[02]\n53A_R5_SI-04(22)_ODP[03]", "defaultText": null }, { "id": 70587, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590262", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590262", "securityControlId": 31204, "ccis": [], "uuid": "f12091cb-c3be-5714-b243-da833ab4de2b", "testId": "MON-11.2_A04", "test": "network services that have not been authorized or approved by authorization or approval processes are detected.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(22)(a)", "defaultText": null }, { "id": 70588, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590262", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590262", "securityControlId": 31204, "ccis": [], "uuid": "b1abc8fb-f90e-5018-9b5d-3ba2bd4f6dd8", "testId": "MON-11.2_A05", "test": "organization-defined actions are initiated when network services that have not been authorized or approved by authorization or approval processes are detected.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(22)(b)", "defaultText": null }, { "id": 70589, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590262", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590262", "securityControlId": 31204, "ccis": [], "uuid": "229d3e54-9485-5d06-8c94-1711285e1579", "testId": "MON-11.2_A06", "test": "organizational systems and system components are monitored on an ongoing basis for anomalous or suspicious behavior.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.14.2e[b]", "defaultText": null } ], "externalMappings": [ { "id": 564825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "945af091-9c8a-568b-adea-5c1b1e7c47a6", "parentControlId": 31204, "controlId": "ORG 2.2(b)", "title": "ORG 2.2(b)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584045" }, { "id": 564827, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e7fba92-1b42-53f8-bb7c-1e77c2a026a1", "parentControlId": 31204, "controlId": "SI-4(22)", "title": "SI-4(22)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584045" }, { "id": 564828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea7b43e0-40c2-5a7d-824c-a93abc6c5e33", "parentControlId": 31204, "controlId": "SI-04(22)", "title": "SI-04(22)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584045" }, { "id": 564829, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81b15f60-664b-5ab2-b293-b6e75481e945", "parentControlId": 31204, "controlId": "SI-04(22)", "title": "SI-04(22)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584045" }, { "id": 564830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cbbfbb22-ca17-56b9-a9a7-fbf2e4c02169", "parentControlId": 31204, "controlId": "SI-04(22)", "title": "SI-04(22)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584045" }, { "id": 564831, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebc8fd97-daa2-5643-9601-44635eacf673", "parentControlId": 31204, "controlId": "SI-04(22)", "title": "SI-04(22)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584045" } ], "id": 31204, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731", "catalogueId": 1062, "uuid": "1687810d-73b5-5be4-a478-5c625e1fd480", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to detect unauthorized network services and alert incident response personnel?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Unauthorized Network Services", "description": "

Control Description

Automated mechanisms exist to detect unauthorized network services and alert incident response personnel.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to automatically detect unauthorized network services and alert incident response personnel.

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "MON-11.2", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-11.2", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)\n∙ Extended Detection and Response (XDR)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)\n∙ Extended Detection and Response (XDR)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)\n∙ Extended Detection and Response (XDR)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70590, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590263", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590263", "securityControlId": 31205, "ccis": [], "uuid": "5939e346-df33-54b2-8e38-d9713163b677", "testId": "MON-11.3_A01", "test": "anomalous or suspicious behavior is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.2e[a]", "defaultText": null }, { "id": 70591, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590263", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590263", "securityControlId": 31205, "ccis": [], "uuid": "e17f002b-03f5-5c67-8046-12715d5f2338", "testId": "MON-11.3_A02", "test": "Indicators of Compromise (IOC) are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.11.2e[a]\n172A_3.14.6e[a]", "defaultText": null }, { "id": 70592, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590263", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590263", "securityControlId": 31205, "ccis": [], "uuid": "0b9c7a91-215a-5f24-a09a-b9f4f9c513ca", "testId": "MON-11.3_A03", "test": "sources that provide Indicators of Compromise (IOC) are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(24)_ODP[01]\n53A_R5_SI-04(24)[01]", "defaultText": null }, { "id": 70593, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590263", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590263", "securityControlId": 31205, "ccis": [], "uuid": "a9a2f424-5d3c-5b37-8223-18ff9241f8e7", "testId": "MON-11.3_A04", "test": "Indicators of Compromise (IOC) provided by sources are discovered.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(24)[01]", "defaultText": null }, { "id": 70594, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590263", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590263", "securityControlId": 31205, "ccis": [], "uuid": "dbcab4c6-6bbe-5b97-883b-a462ad391185", "testId": "MON-11.3_A05", "test": "Indicators of Compromise (IOC) provided by sources are collected.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(24)[02]", "defaultText": null }, { "id": 70595, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590264", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590264", "securityControlId": 31205, "ccis": [], "uuid": "9fe5111d-0966-52e8-9c12-b2c6a19929e6", "testId": "MON-11.3_A06", "test": "unauthorized use of the system is identified through techniques and methods.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04b.", "defaultText": null }, { "id": 70596, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590264", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590264", "securityControlId": 31205, "ccis": [], "uuid": "e81e19b0-0ccd-5086-8358-fa1d8fc37ab3", "testId": "MON-11.3_A07", "test": "internal monitoring capabilities are invoked or monitoring devices are deployed strategically within the system to collect organization-determined essential information.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_SI-04c.01", "defaultText": null }, { "id": 70597, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590264", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590264", "securityControlId": 31205, "ccis": [], "uuid": "dcb0b2d1-f01e-58b7-97d5-ab62b83af8ae", "testId": "MON-11.3_A08", "test": "internal monitoring capabilities are invoked or monitoring devices are deployed at ad hoc locations within the system to track specific types of transactions of interest to the organization.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_SI-04c.02", "defaultText": null }, { "id": 70598, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590264", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590264", "securityControlId": 31205, "ccis": [], "uuid": "705c5aa5-ede9-5c78-ab68-8794f92467fc", "testId": "MON-11.3_A09", "test": "personnel or roles to whom Indicators of Compromise (IOC) are to be distributed is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-04(24)_ODP[02]", "defaultText": null }, { "id": 70599, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590264", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590264", "securityControlId": 31205, "ccis": [], "uuid": "49bf896b-fbee-5b47-901a-ed51feec98c1", "testId": "MON-11.3_A10", "test": "Indicators of Compromise (IOC) provided by sources are distributed to personnel or roles.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-04(24)[03]", "defaultText": null }, { "id": 70600, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590265", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590265", "securityControlId": 31205, "ccis": [], "uuid": "a2477a31-5cec-5592-bedf-cf74e6959ed6", "testId": "MON-11.3_A11", "test": "personnel or roles to whom Indicators of Compromise (IOC) are to be distributed is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-04(24)_ODP[02]", "defaultText": null }, { "id": 70601, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590265", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590265", "securityControlId": 31205, "ccis": [], "uuid": "8e610915-3cdb-5fdd-841f-3dabcba8742f", "testId": "MON-11.3_A12", "test": "Indicators of Compromise (IOC) provided by sources are distributed to personnel or roles.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-04(24)[03]", "defaultText": null }, { "id": 70602, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590265", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590265", "securityControlId": 31205, "ccis": [], "uuid": "64b88f7b-1069-5ad0-bdf2-d4ef8f3bf5af", "testId": "MON-11.3_A13", "test": "organizational systems to search for Indicators of Compromise (IOC) are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.11.2e_ODP[4]", "defaultText": null }, { "id": 70603, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590265", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590265", "securityControlId": 31205, "ccis": [], "uuid": "1933072a-e601-5010-a20a-df4493299ea0", "testId": "MON-11.3_A14", "test": "effective mitigations are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.6e[b]", "defaultText": null }, { "id": 70604, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590265", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590265", "securityControlId": 31205, "ccis": [], "uuid": "84fa9e62-ebc6-54bb-84c9-f74d181c83f4", "testId": "MON-11.3_A15", "test": "intrusion detection approaches are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.6e[c]", "defaultText": null }, { "id": 70605, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590265", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590265", "securityControlId": 31205, "ccis": [], "uuid": "3d575785-2c7e-594f-b098-20ee0988945a", "testId": "MON-11.3_A16", "test": "threat hunting activities are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.6e[d]", "defaultText": null }, { "id": 70606, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590266", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590266", "securityControlId": 31205, "ccis": [], "uuid": "5b61c557-fd5b-5be5-afd2-62f2e9f4b238", "testId": "MON-11.3_A17", "test": "advanced automation and analytics capabilities are used to predict and identify risks to organizations, systems and system components are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.11.3e[a]", "defaultText": null }, { "id": 70607, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590266", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590266", "securityControlId": 31205, "ccis": [], "uuid": "ca23c960-3905-5cad-8cdf-331c9445769c", "testId": "MON-11.3_A18", "test": "analysts are used to predict and identify risks to organizations, systems and system components are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.11.3e[b]", "defaultText": null }, { "id": 70608, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590266", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590266", "securityControlId": 31205, "ccis": [], "uuid": "5a691d7f-cedf-5c7c-bb71-a2e5f80101e0", "testId": "MON-11.3_A19", "test": "advanced automation and analytics capabilities are employed in support of analysts to predict and identify risks to organizations, systems and system components.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.11.3e[c]", "defaultText": null }, { "id": 70609, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590266", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590266", "securityControlId": 31205, "ccis": [], "uuid": "87d7a8e7-557e-50c9-9168-67f142e571ff", "testId": "MON-11.3_A20", "test": "threat indicator information and effective mitigations obtained from external organizations are used to guide and inform intrusion detection and threat hunting.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.14.6e[e]\n172A_3.14.6e_ODP[1]", "defaultText": null } ], "externalMappings": [ { "id": 564840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a2aee72-2df8-5f36-8cdb-bfa83f00579f", "parentControlId": 31205, "controlId": "5.7", "title": "5.7", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584047" }, { "id": 564842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78124c81-677f-5400-b386-3c7395b11228", "parentControlId": 31205, "controlId": "SI-4(24)", "title": "SI-4(24)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584047" }, { "id": 564843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e408b82-28b8-588c-85db-43f5e902a2c8", "parentControlId": 31205, "controlId": "SI-04(24)", "title": "SI-04(24)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584047" }, { "id": 564845, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06b0ffb1-d236-5fc2-901a-24d1b618ef2d", "parentControlId": 31205, "controlId": "SI-04(24)", "title": "SI-04(24)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584047" }, { "id": 564847, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77aa333c-d71e-5673-9954-dc9719078123", "parentControlId": 31205, "controlId": "3.14.7", "title": "3.14.7", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584048" }, { "id": 564848, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1dfbe74e-f274-5754-ae79-f5cc0fb8405d", "parentControlId": 31205, "controlId": "03.14.06.a.01", "title": "03.14.06.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584048" }, { "id": 564849, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4bb86139-39f9-5484-830c-50d665139ab5", "parentControlId": 31205, "controlId": "03.14.06.a.02", "title": "03.14.06.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584048" }, { "id": 564850, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56baca26-6ea9-5fd7-b95a-f827631008a2", "parentControlId": 31205, "controlId": "03.14.06.b", "title": "03.14.06.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584048" }, { "id": 564851, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d6a73f6-f78f-55e5-902d-6da2fd09d3a6", "parentControlId": 31205, "controlId": "03.14.06.c", "title": "03.14.06.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584048" }, { "id": 564853, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6983d877-58ae-5746-8719-ad3a4f1a3231", "parentControlId": 31205, "controlId": "DE.CM", "title": "DE.CM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584048" }, { "id": 564857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "501f4272-8f07-54b0-b776-dcac6aa02365", "parentControlId": 31205, "controlId": "SITUATION-2d", "title": "SITUATION-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584049" }, { "id": 564858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56486234-bd94-520f-8a4d-31f40d1c7c4e", "parentControlId": 31205, "controlId": "SITUATION-2h", "title": "SITUATION-2h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584049" }, { "id": 564859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45a1c632-abe0-5a8a-a50c-fb0a04de3adc", "parentControlId": 31205, "controlId": "SITUATION-2i", "title": "SITUATION-2i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584049" } ], "id": 31205, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731", "catalogueId": 1062, "uuid": "195e5e2c-5db4-5b44-81fb-5226b8a1eb34", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to identify and alert on Indicators of Compromise (IoC)?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Monitoring for Indicators of Compromise (IOC)", "description": "

Control Description

Automated mechanisms exist to identify and alert on Indicators of Compromise (IoC).

Evidence Request List (ERL)

E-IRO-02\nE-MON-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to automatically identify and alert on Indicators of Compromise (IoC).

Level 4 - Quantitatively Controlled: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "MON-11.3", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-11.3", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)\n∙ Extended Detection and Response (XDR)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)\n∙ Extended Detection and Response (XDR)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)\n∙ Extended Detection and Response (XDR)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70610, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590266", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590266", "securityControlId": 31206, "ccis": [], "uuid": "6156766d-cc07-50d6-828a-40abf8227f7a", "testId": "MON-12_A01", "test": "user session auditing practices are defined (e.g., record, view, hear or log).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-14_ODP[02]", "defaultText": null }, { "id": 70611, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590266", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590266", "securityControlId": 31206, "ccis": [], "uuid": "6a13c14c-36d0-5ada-afc8-b5f6e4274b69", "testId": "MON-12_A02", "test": "users or roles who can audit the content of a user session are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-14_ODP[01]", "defaultText": null }, { "id": 70612, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590267", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590267", "securityControlId": 31206, "ccis": [], "uuid": "b72ec935-13b8-5d23-be31-f15c3a045ce4", "testId": "MON-12_A03", "test": "circumstances under which the content of a user session can be audited are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-14_ODP[03]", "defaultText": null }, { "id": 70613, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590267", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590267", "securityControlId": 31206, "ccis": [], "uuid": "8647a5a4-d3fc-5d00-abff-3cc139c72e09", "testId": "MON-12_A04", "test": "designated users or roles are provided with the capability to audit the content of a user session under organization-defined circumstances.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-14a.[01]", "defaultText": null }, { "id": 70614, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590267", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590267", "securityControlId": 31206, "ccis": [], "uuid": "4a0804fd-62a3-586a-ab52-75169f41a508", "testId": "MON-12_A05", "test": "the capability for organization's the content of a user session under organization-defined circumstances is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AU-14a.[02]", "defaultText": null }, { "id": 70615, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590267", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590267", "securityControlId": 31206, "ccis": [], "uuid": "4d888a4b-4115-5f1c-b583-80733fd89704", "testId": "MON-12_A06", "test": "session auditing activities are developed in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards and guidelines.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AU-14b.[01]", "defaultText": null }, { "id": 70616, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590268", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590268", "securityControlId": 31206, "ccis": [], "uuid": "8b6b48d3-b538-50c6-bd44-2dec6fd443cb", "testId": "MON-12_A07", "test": "session auditing activities are integrated in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards and guidelines.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AU-14b.[02]", "defaultText": null }, { "id": 70617, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590268", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590268", "securityControlId": 31206, "ccis": [], "uuid": "8229e600-7dbd-54c4-8fb6-c09c624763b0", "testId": "MON-12_A08", "test": "session auditing activities are used in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards and guidelines.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AU-14b.[03]", "defaultText": null } ], "externalMappings": [ { "id": 564881, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5ca8926-0d81-57a5-9f36-80aa8a3801e3", "parentControlId": 31206, "controlId": "AU-14", "title": "AU-14", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584052" }, { "id": 564882, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf83506e-1a29-5c17-8256-578fb236e51f", "parentControlId": 31206, "controlId": "AU-14", "title": "AU-14", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584052" }, { "id": 564883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3dca17b7-221a-55e8-b180-acabc8c1524f", "parentControlId": 31206, "controlId": "AU-14", "title": "AU-14", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584052" }, { "id": 564884, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "061c59c0-3598-50d6-bdbf-1bbde36f11b0", "parentControlId": 31206, "controlId": "AU-14", "title": "AU-14", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584052" }, { "id": 564885, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b332ec44-9fab-5a81-a780-c3d83014f302", "parentControlId": 31206, "controlId": "AU-14", "title": "AU-14", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584052" }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d3470f39-c522-5f58-86f7-370bb73be2c6", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "bd5d8af9-4164-5cde-9159-686eb14f8744", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "8adbdf90-c5ff-52cd-9726-e34aeed665ff", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "9da7c2d1-b83f-5d94-a57e-5dc14c4de43c", "isPublic": true } ], "id": 31206, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731001", "catalogueId": 1062, "uuid": "0c2faf77-2ab6-5621-a32d-cf8ffd32b7af", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide session audit capabilities that can: \n (1) Capture and log all content related to a user session; and\n (2) Remotely view all content related to an established user session in real time?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Session Audit", "description": "

Control Description

Mechanisms exist to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to provide session audit capabilities that can: \n(1) Capture and log all content related to a user session; and\n(2) Remotely view all content related to an established user session in real time.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-12", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-12", "references": "

Micro-Small Business (<10 staff)

∙ ManageEngine PAM360 (https://manageengine.com)\n∙ Basic privileged session recording (e.g., built-in OS logging)

Small Business (10-49 staff)

∙ ManageEngine PAM360 (https://manageengine.com)\n∙ Privileged Access Workstation (PAW) or jump server logging

Medium Business (50-249 staff)

∙ ManageEngine PAM360 (https://manageengine.com)\n∙ Ekran User Activity Monitoring (UAM) (https://ekransystem.com)\n∙ Privileged Access Management (PAM) solution with session recording

Large Business (250-999 staff)

∙ ManageEngine PAM360 (https://manageengine.com)\n∙ Ekran User Activity Monitoring (UAM) (https://ekransystem.com)\n∙ CyberArk Privileged Session Manager or BeyondTrust Session Management

Enterprise (>1,000 staff)

∙ Enterprise PAM with session audit (e.g., CyberArk, BeyondTrust, Delinea)\n∙ ManageEngine PAM360 (https://manageengine.com)\n∙ Ekran User Activity Monitoring (UAM) (https://ekransystem.com)\n∙ AI-powered anomalous behavior detection in privileged sessions", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70618, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590268", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590268", "securityControlId": 31207, "ccis": [], "uuid": "a8ba2ffd-7f79-5cd9-b233-c552ca90d2fc", "testId": "MON-13_A01", "test": "an alternate event logging functionality in the event of a failure in primary event logging capability is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-05(05)_ODP", "defaultText": null }, { "id": 70619, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590268", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590268", "securityControlId": 31207, "ccis": [], "uuid": "8fa6731d-0704-58b8-9f31-328111d8ae80", "testId": "MON-13_A02", "test": "an alternate event logging capability is provided in the event of a failure in primary event logging capability that implements organization-defined alternate event logging functionality.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-05(05)", "defaultText": null } ], "externalMappings": [ { "id": 564890, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e44df8cd-5b30-5e29-8e37-6afee6636159", "parentControlId": 31207, "controlId": "AU-15", "title": "AU-15", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584053" }, { "id": 564891, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c30d63be-ad36-5b68-908f-b11eb6a3ddae", "parentControlId": 31207, "controlId": "AU-05(05)", "title": "AU-05(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584053" }, { "id": 564892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c53727a0-4ed2-54e8-b897-79b743db663c", "parentControlId": 31207, "controlId": "AU-05(05)", "title": "AU-05(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584054" }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "4e42000d-3d44-5d63-8766-1aa8890f5baa", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "53fa6e8c-fb0a-5590-b3da-42b6dac2e2e9", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "44f43013-706e-5449-8f6c-4abb86a562c5", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "22c580d1-6b12-5567-a22d-c400f2504f6c", "isPublic": true } ], "id": 31207, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731001", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731001", "catalogueId": 1062, "uuid": "efaa8d79-a9f7-536f-8290-aa0a07bdc32b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide an alternate event logging capability in the event of a failure in primary audit capability?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Alternate Event Logging Capability", "description": "

Control Description

Mechanisms exist to provide an alternate event logging capability in the event of a failure in primary audit capability.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to provide an alternate event logging capability in the event of a failure in primary audit capability.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-13", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-13", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70620, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590269", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590269", "securityControlId": 31208, "ccis": [], "uuid": "907ea0e7-ac0b-5c57-9400-153495a1264c", "testId": "MON-14_A01", "test": "methods for coordinating audit information among external organizations when audit information is transmitted across organizational boundaries are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-16_ODP[01]", "defaultText": null }, { "id": 70621, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590269", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590269", "securityControlId": 31208, "ccis": [], "uuid": "85527c99-aab6-5b59-a882-711ddbbcca85", "testId": "MON-14_A02", "test": "audit information to be coordinated among external organizations when audit information is transmitted across organizational boundaries is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-16_ODP[02]", "defaultText": null }, { "id": 70622, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590269", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590269", "securityControlId": 31208, "ccis": [], "uuid": "a360d700-6db9-524b-a420-8f04bfaa6bfd", "testId": "MON-14_A03", "test": "organization-defined methods for coordinating audit information among external organizations when audit information is transmitted across organizational boundaries are employed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-16", "defaultText": null } ], "externalMappings": [ { "id": 564894, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a2ec881-11bc-5734-9d17-ed0f2703feba", "parentControlId": 31208, "controlId": "AU-16", "title": "AU-16", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584054" }, { "id": 564895, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1612cafb-743b-5ed8-a925-1747af7ced1c", "parentControlId": 31208, "controlId": "AU-16(1)", "title": "AU-16(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584054" }, { "id": 564896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0a9bcf9-3e13-558b-8847-e2c845b92e4f", "parentControlId": 31208, "controlId": "AU-16", "title": "AU-16", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584054" }, { "id": 564897, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be1ea4a7-1261-543d-934a-e7ba7a9c50fc", "parentControlId": 31208, "controlId": "AU-16(01)", "title": "AU-16(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584054" }, { "id": 564898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f9eca46-32e1-53ca-8aa2-30370af2282c", "parentControlId": 31208, "controlId": "AU-16", "title": "AU-16", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584054" }, { "id": 564899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e9eccf5-c2c9-52b4-a942-e8b8941b3f4f", "parentControlId": 31208, "controlId": "AU-16(01)", "title": "AU-16(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584054" }, { "id": 564900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed9862da-78eb-5128-bbe8-a5fd8cd84c6d", "parentControlId": 31208, "controlId": "AU-16", "title": "AU-16", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584054" }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "96ecabca-0f41-5784-84ef-dff198a1c04b", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "2a9722d1-e5a2-5e49-aadc-bf54b01d872a", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "b8c2bee8-5895-59fd-a550-92d24de15555", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "e77c24a3-d325-54d8-b00c-f76d88567b5d", "isPublic": true } ], "id": 31208, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731001", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731001", "catalogueId": 1062, "uuid": "edf8dfe2-89c9-5086-9dea-1dd56b164877", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization coordinate sanitized event logs among external organizations to identify anomalous events when event logs are shared across organizational boundaries, without giving away sensitive or critical business data?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Cross-Organizational Monitoring", "description": "

Control Description

Mechanisms exist to coordinate sanitized event logs among external organizations to identify anomalous events when event logs are shared across organizational boundaries, without giving away sensitive or critical business data.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to coordinate sanitized event logs among external organizations to identify anomalous events when event logs are shared across organizational boundaries, without giving away sensitive or critical business data.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-14", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-14", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70623, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590269", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590269", "securityControlId": 31209, "ccis": [], "uuid": "298c590c-1362-525a-bfcc-0c8614d796bf", "testId": "MON-14.1_A01", "test": "organizations with which cross-organizational audit information is to be shared are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-16(02)_ODP[01]", "defaultText": null }, { "id": 70624, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59027", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59027", "securityControlId": 31209, "ccis": [], "uuid": "e4d1249e-eba6-5473-9afa-5520c77eef22", "testId": "MON-14.1_A02", "test": "cross-organizational sharing agreements to be used when providing cross-organizational audit information to organizations are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-16(02)_ODP[02]", "defaultText": null }, { "id": 70625, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59027", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59027", "securityControlId": 31209, "ccis": [], "uuid": "87b528dc-9f66-5395-bdf2-ccca6ca54a95", "testId": "MON-14.1_A03", "test": "cross-organizational audit information is provided to organization-defined organizations based on organization-defined cross-organizational sharing agreements.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-16(02)", "defaultText": null } ], "externalMappings": [ { "id": 564906, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bd449e8-3e76-5ab0-97fe-606d048379b7", "parentControlId": 31209, "controlId": "AU-16(2)", "title": "AU-16(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584055" }, { "id": 564907, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aef569c1-4c8d-5a28-886f-525b9627d215", "parentControlId": 31209, "controlId": "AU-16(02)", "title": "AU-16(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584055" }, { "id": 564908, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95852bf2-0173-5726-9dcf-0e8dbc6678fd", "parentControlId": 31209, "controlId": "AU-16(02)", "title": "AU-16(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584055" }, { "id": 564909, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a282d3bd-4446-5d86-9931-c3047eb80239", "parentControlId": 31209, "controlId": "AU-16(2)", "title": "AU-16(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584055" }, { "id": 564910, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5f98bbe-cc4d-5b02-8a47-af54c9e79e02", "parentControlId": 31209, "controlId": "AU-16(2)", "title": "AU-16(2)", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584056" } ], "id": 31209, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731001", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731001", "catalogueId": 1062, "uuid": "57bf757d-4464-53c6-a5a8-a0de7830a4f8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization share event logs with third-party organizations based on specific cross-organizational sharing agreements?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Sharing of Event Logs", "description": "

Control Description

Mechanisms exist to share event logs with third-party organizations based on specific cross-organizational sharing agreements.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to share event logs with third-party organizations based on specific cross-organizational sharing agreements.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-14.1", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-14.1", "references": "

Micro-Small Business (<10 staff)

∙ Vocabulary for Event Recording and Incident Sharing (VERIS) (https://verisframework.org)

Small Business (10-49 staff)

∙ Vocabulary for Event Recording and Incident Sharing (VERIS) (https://verisframework.org)

Medium Business (50-249 staff)

∙ Vocabulary for Event Recording and Incident Sharing (VERIS) (https://verisframework.org)

Large Business (250-999 staff)

∙ Vocabulary for Event Recording and Incident Sharing (VERIS) (https://verisframework.org)

Enterprise (>1,000 staff)

∙ Vocabulary for Event Recording and Incident Sharing (VERIS) (https://verisframework.org)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70626, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59027", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59027", "securityControlId": 31210, "ccis": [], "uuid": "63975d31-961f-598f-9290-763922942dcb", "testId": "MON-15_A01", "test": "a covert channel analysis is performed to identify those aspects of communications within the system that are potential avenues for covert channels (e.g., storage and/or timing).
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-31a.\n53A_R5_SC-31_ODP", "defaultText": null }, { "id": 70627, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59027", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59027", "securityControlId": 31210, "ccis": [], "uuid": "8d63425e-58d2-5293-8d79-4370e9f98a80", "testId": "MON-15_A02", "test": "the maximum bandwidth of those channels is estimated.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-31b.", "defaultText": null } ], "externalMappings": [ { "id": 564914, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7a257cc-4423-5a48-8a33-1d805737632a", "parentControlId": 31210, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584056" }, { "id": 564915, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a50ee754-2f67-52a0-abd4-b418c480bb3a", "parentControlId": 31210, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584056" }, { "id": 564916, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55863c4a-4763-54fd-a8b9-c8b6e43ab790", "parentControlId": 31210, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584057" }, { "id": 564917, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b886e70-36e0-5b1b-8efb-1911bc54380d", "parentControlId": 31210, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584057" }, { "id": 564918, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43302175-0bb7-5304-b6a5-d15a7b1bbea5", "parentControlId": 31210, "controlId": "T1071", "title": "T1071", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584057" }, { "id": 564919, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ae48c87-1550-5968-8597-bedffda1655a", "parentControlId": 31210, "controlId": "T1071.001", "title": "T1071.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584057" }, { "id": 564920, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ee7bc20-0eab-535d-ac6e-67c02be56996", "parentControlId": 31210, "controlId": "T1071.002", "title": "T1071.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584057" }, { "id": 564921, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dce8c034-e3e4-53f0-9393-01ac5b258465", "parentControlId": 31210, "controlId": "T1071.003", "title": "T1071.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584057" }, { "id": 564922, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a867beb1-6dfa-572c-9c04-d50c7632b953", "parentControlId": 31210, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584057" }, { "id": 564923, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f8d4921-c73f-5c9e-9233-79b56fad225d", "parentControlId": 31210, "controlId": "T1071.005", "title": "T1071.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584057" }, { "id": 564924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36163282-ae8b-5b14-9f7e-a8984163a893", "parentControlId": 31210, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584057" }, { "id": 564925, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "790e6988-4438-5c3e-9a1b-e4b4dc51b001", "parentControlId": 31210, "controlId": "SC-31", "title": "SC-31", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584058" }, { "id": 564926, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bb6dcfd-15ee-5a0a-b23c-597ec9458f6d", "parentControlId": 31210, "controlId": "SC-31", "title": "SC-31", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584058" }, { "id": 564927, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2fc0931-84f4-5234-a963-e6ca26d6a24a", "parentControlId": 31210, "controlId": "SC-31", "title": "SC-31", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584058" }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "6182f29d-c311-5625-8634-0025872e9cc0", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "afa300e5-4f57-542d-8ba7-bdd81e53ebc2", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "525cdf47-e3ec-57b5-ad6c-f0653583e271", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "843e8aa8-2ac3-55b9-94f7-f1bb762af3d5", "isPublic": true } ], "id": 31210, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731002", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731002", "catalogueId": 1062, "uuid": "4d45f5c0-5bcc-58bf-b360-44fc8421edc9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct covert channel analysis to identify aspects of communications that are potential avenues for covert channels?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Covert Channel Analysis", "description": "

Control Description

Mechanisms exist to conduct covert channel analysis to identify aspects of communications that are potential avenues for covert channels.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to conduct covert channel analysis to identify aspects of communications that are potential avenues for covert channels.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-15", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-15", "references": "

Micro-Small Business (<10 staff)

∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70628, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59027", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59027", "securityControlId": 31211, "ccis": [], "uuid": "2d770307-77e7-5cb3-bcfd-e439280820d4", "testId": "MON-16_A01", "test": "environments or resources which may contain or may be related to anomalous or suspected adversarial behavior are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(11)_ODP\n53A_R5_IR-04(13)_ODP", "defaultText": null }, { "id": 70629, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590271", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590271", "securityControlId": 31211, "ccis": [], "uuid": "9d098726-654d-50d9-b441-1b220a2394a5", "testId": "MON-16_A02", "test": "systems are monitored to detect unauthorized local connections.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04a.02[01]", "defaultText": null }, { "id": 70630, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590271", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590271", "securityControlId": 31211, "ccis": [], "uuid": "c006c4ac-8195-5ce5-9ef3-c0e7335b1190", "testId": "MON-16_A03", "test": "systems are monitored to detect unauthorized network connections.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04a.02[02]", "defaultText": null }, { "id": 70631, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590271", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590271", "securityControlId": 31211, "ccis": [], "uuid": "90be1c87-a88f-5e29-ba46-50778b0b6102", "testId": "MON-16_A04", "test": "systems are monitored to detect unauthorized remote connections.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04a.02[03]", "defaultText": null }, { "id": 70632, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590271", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590271", "securityControlId": 31211, "ccis": [], "uuid": "ac606f21-c741-568d-9a57-a2d609707de5", "testId": "MON-16_A05", "test": "outbound communications traffic at the external interfaces to the system is analyzed to discover anomalies.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(11)[01]", "defaultText": null }, { "id": 70633, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590271", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590271", "securityControlId": 31211, "ccis": [], "uuid": "e8264141-b97f-590d-82a3-dffa9c0d1dfd", "testId": "MON-16_A06", "test": "outbound communications traffic at interior points is analyzed to discover anomalies.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(11)[02]", "defaultText": null }, { "id": 70634, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590272", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590272", "securityControlId": 31211, "ccis": [], "uuid": "794b5be6-31a1-5959-850a-d44aad69ca4d", "testId": "MON-16_A07", "test": "anomalous or suspected adversarial behavior in or related to organization-defined environments or resources are analyzed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(13)\n53A_R5_SI-04d.[01]\n53A_R5_SI-04d.[02]", "defaultText": null }, { "id": 70635, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590272", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590272", "securityControlId": 31211, "ccis": [], "uuid": "a49a2bc2-1e4c-5d99-9e1b-2cbb0429b7a2", "testId": "MON-16_A08", "test": "unauthorized use of the system is identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.14.06.b", "defaultText": null }, { "id": 70636, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590272", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590272", "securityControlId": 31211, "ccis": [], "uuid": "7a514e2f-15db-58dc-852e-ba34d3bd7eb7", "testId": "MON-16_A09", "test": "anomalous or suspicious behavior is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.2e[a]\n53A_R5_AC-02(12)_ODP[01]", "defaultText": null }, { "id": 70637, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590283", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590283", "securityControlId": 31211, "ccis": [], "uuid": "48391684-21ff-5738-aa30-9c2e5a62c16f", "testId": "MON-16_A10", "test": "personnel or roles to report atypical usage is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at a minimum, the organization's cybersecurity team and/or similar role within the organization", "otherId": "53A_R5_AC-02(12)_ODP[02]", "defaultText": null }, { "id": 70638, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590283", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590283", "securityControlId": 31211, "ccis": [], "uuid": "07807323-5fd7-5bbd-a21c-81b20d7445e0", "testId": "MON-16_A11", "test": "atypical usage of system accounts is reported to organization-defined personnel or roles.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: at a minimum, the organization's cybersecurity team and/or similar role within the organization", "otherId": "53A_R5_AC-02(12)(b)\n53A_R5_SI-04g.", "defaultText": null }, { "id": 70639, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590283", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590284", "securityControlId": 31211, "ccis": [], "uuid": "4a88ed6a-b790-54f6-9f04-8a1d32449d6f", "testId": "MON-16_A12", "test": "organizational systems and system components are monitored on an ongoing basis for anomalous or suspicious behavior.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.14.2e[b]\n53A_R5_AC-02(12)(a)\n53A_R5_SI-04a.01", "defaultText": null } ], "externalMappings": [ { "id": 564944, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1837a70a-a9a1-5342-bd6d-f6aad26a17e2", "parentControlId": 31211, "controlId": "ORG 2.2(d)", "title": "ORG 2.2(d)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58406" }, { "id": 564946, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d67e91a8-9721-5a31-add3-dbd8b35d622c", "parentControlId": 31211, "controlId": "AC-2(12)", "title": "AC-2(12)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58406" }, { "id": 564947, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39f613ae-ed25-502f-a81a-d2c450613e0f", "parentControlId": 31211, "controlId": "SI-4(11)", "title": "SI-4(11)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58406" }, { "id": 564948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82c5933d-52f9-5fc7-8698-46fe7c69daac", "parentControlId": 31211, "controlId": "AC-02(12)", "title": "AC-02(12)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584061" }, { "id": 564949, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67acebcb-d280-5887-83bb-e21faa319ff3", "parentControlId": 31211, "controlId": "IR-04(13)", "title": "IR-04(13)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584061" }, { "id": 564950, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9897dfda-327f-55ef-9e08-277d736e9adf", "parentControlId": 31211, "controlId": "SI-04(11)", "title": "SI-04(11)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584061" }, { "id": 564952, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2346a1b9-21e4-5127-82ee-c8a6e0c12dc5", "parentControlId": 31211, "controlId": "AC-02(12)", "title": "AC-02(12)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584061" }, { "id": 564955, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed3e5e72-e212-5b60-bc63-17e75fd7df07", "parentControlId": 31211, "controlId": "AC-02(12)", "title": "AC-02(12)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584061" }, { "id": 564956, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1b3a79f-b3a9-586f-b5ce-9d1218c3398a", "parentControlId": 31211, "controlId": "IR-04(13)", "title": "IR-04(13)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584061" }, { "id": 564957, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22cd449b-eb68-54ea-b7b6-56fdfe90c4e4", "parentControlId": 31211, "controlId": "SI-04(11)", "title": "SI-04(11)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584061" }, { "id": 564958, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc97b736-3398-5886-b7ff-456af677fc1e", "parentControlId": 31211, "controlId": "AC-02(12)", "title": "AC-02(12)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584062" }, { "id": 564962, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4297cd6e-bbd5-578f-8006-be7a2e82492f", "parentControlId": 31211, "controlId": "3.14.7", "title": "3.14.7", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584062" }, { "id": 564963, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3e2787f-330a-5e15-aef6-acdf5f32d5b7", "parentControlId": 31211, "controlId": "03.01.01.e", "title": "03.01.01.e", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584062" }, { "id": 564964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2dd125e4-51f7-5df2-b6ac-65137229bbf9", "parentControlId": 31211, "controlId": "03.03.05.a", "title": "03.03.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584062" }, { "id": 564965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdbbf63e-ddf2-5e51-b934-0977a94f858a", "parentControlId": 31211, "controlId": "03.14.06.a.01", "title": "03.14.06.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584062" }, { "id": 564966, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28b93a9c-a8ac-5f4b-a061-29ec7eb9c08d", "parentControlId": 31211, "controlId": "03.14.06.a.02", "title": "03.14.06.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584063" }, { "id": 564967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bf6aaae-0f2e-5ce2-b0ef-5b875497be85", "parentControlId": 31211, "controlId": "03.14.06.b", "title": "03.14.06.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584063" }, { "id": 564968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88f42fbe-efdf-5576-8d72-bbed262873fe", "parentControlId": 31211, "controlId": "03.14.06.c", "title": "03.14.06.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584063" }, { "id": 564972, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc6f6662-59fc-5d5c-803a-b889e3167ed8", "parentControlId": 31211, "controlId": "DE.CM", "title": "DE.CM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584063" }, { "id": 564973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2566989a-f0a5-59bd-95a1-d935c8cd722b", "parentControlId": 31211, "controlId": "DE.CM-03", "title": "DE.CM-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584063" }, { "id": 564982, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8fa5b2a-c55d-5217-b333-ac911d3f1389", "parentControlId": 31211, "controlId": "ACCESS-2i", "title": "ACCESS-2i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584064" }, { "id": 564983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acd502de-722b-50ee-b387-3683ff302591", "parentControlId": 31211, "controlId": "SITUATION-2d", "title": "SITUATION-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584065" }, { "id": 564984, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6040059-59d4-5c7e-bc83-3bdad06f0603", "parentControlId": 31211, "controlId": "SITUATION-2h", "title": "SITUATION-2h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584065" }, { "id": 564985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d98b9950-2040-5219-82d2-e528efec090e", "parentControlId": 31211, "controlId": "SITUATION-2i", "title": "SITUATION-2i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584065" }, { "id": 565033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6216e080-2fed-5ad2-8e45-d2b99ec1145e", "parentControlId": 31211, "controlId": "C1.f", "title": "C1.f", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58407" }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "e9613f7a-d9b5-5a05-bccd-e867aab8a844", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "e10cccf4-9576-5476-ba34-6c577b62ac7d", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "ee0d1b3a-ee06-5833-a40a-b11e7f33d39f", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "21f8c3f1-a8d9-53d2-b5e5-a1352353351a", "isPublic": true } ], "id": 31211, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731002", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731002", "catalogueId": 1062, "uuid": "77f6c5fb-2a19-56c6-ab09-bc629e99a846", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 10.0, "title": "Anomalous Behavior", "description": "

Control Description

Mechanisms exist to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.

Evidence Request List (ERL)

E-IRO-02\nE-MON-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to utilize User & Entity Behavior Analytics (UEBA) and/or User Activity Monitoring (UAM) solutions to detect and respond to anomalous behavior that could indicate account compromise or other malicious activities.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-16", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-16", "references": "

Micro-Small Business (<10 staff)

∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70640, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590284", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590284", "securityControlId": 31212, "ccis": [], "uuid": "46784e17-7eb9-5ab6-9b8c-6dd8555de4bb", "testId": "MON-16.1_A01", "test": "a legal opinion regarding insider threat monitoring is obtained.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70641, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590284", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590284", "securityControlId": 31212, "ccis": [], "uuid": "09d21b6f-a8c1-5ecd-b635-8a101c857241", "testId": "MON-16.1_A02", "test": "monitoring activities for insider threats is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70642, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590284", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590284", "securityControlId": 31212, "ccis": [], "uuid": "4847dd11-a7c4-5ae5-af79-d9b149f4430d", "testId": "MON-16.1_A03", "test": "organization-defined mechanisms are employed to monitor internal personnel activity for potential security incidents.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 565059, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584073", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8017acd-cfbf-5906-8914-63aa03777c25", "parentControlId": 31212, "controlId": "DE.CM-03", "title": "DE.CM-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584073" } ], "id": 31212, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731002", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731002", "catalogueId": 1062, "uuid": "ba981100-4d00-53e0-bbb9-d3c5f27da580", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization monitor internal personnel activity for potential security incidents?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Insider Threats", "description": "

Control Description

Mechanisms exist to monitor internal personnel activity for potential security incidents.

Evidence Request List (ERL)

E-IRO-02\nE-MON-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to monitor internal personnel activity for potential security incidents.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-16.1", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-16.1", "references": "

Micro-Small Business (<10 staff)

∙ Insider Threat program\n∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Insider Threat program\n∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Insider Threat program\n∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Insider Threat program\n∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Insider Threat program\n∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70643, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590284", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590284", "securityControlId": 31213, "ccis": [], "uuid": "ba5fd1be-89bc-5cba-bee7-0512c052988b", "testId": "MON-16.2_A01", "test": "a legal opinion regarding third-party threat monitoring is obtained.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70644, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590284", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590284", "securityControlId": 31213, "ccis": [], "uuid": "9a88bb27-1e05-5a54-813d-8637450f4104", "testId": "MON-16.2_A02", "test": "monitoring activities for third-party threats is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70645, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590285", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590285", "securityControlId": 31213, "ccis": [], "uuid": "0c6d7c36-09fd-5779-ad29-d0997f1b8ad3", "testId": "MON-16.2_A03", "test": "organization-defined mechanisms are employed to monitor third-party activities for potential security incidents.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 565067, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2fd96de-1762-5747-9bc7-8145b63202d1", "parentControlId": 31213, "controlId": "DE.CM-06", "title": "DE.CM-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584083" } ], "id": 31213, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731003", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731003", "catalogueId": 1062, "uuid": "0917d8b9-3953-519a-8791-3dbe5a4d2951", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization monitor third-party personnel activity for potential security incidents?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Third-Party Threats", "description": "

Control Description

Mechanisms exist to monitor third-party personnel activity for potential security incidents.

Evidence Request List (ERL)

E-IRO-02\nE-MON-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.\n▪ Generating event logs and the review of those event logs is narrowly-focused to business-critical Technology Assets, Applications, Services and/or Data (TAASD).

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to monitor third-party personnel activity for potential security incidents.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-16.2", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-16.2", "references": "

Micro-Small Business (<10 staff)

∙ Insider Threat program\n∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)

Small Business (10-49 staff)

∙ Insider Threat program\n∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Security Incident Event Manager (SIEM)

Medium Business (50-249 staff)

∙ Insider Threat program\n∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)

Large Business (250-999 staff)

∙ Insider Threat program\n∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)

Enterprise (>1,000 staff)

∙ Insider Threat program\n∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70646, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590285", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590285", "securityControlId": 31214, "ccis": [], "uuid": "61521876-9ddd-56ed-a6a3-606fa403247b", "testId": "MON-16.3_A01", "test": "unauthorized activities are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70647, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590285", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590285", "securityControlId": 31214, "ccis": [], "uuid": "af4d1d19-5d11-55f7-b8d7-abc17380310a", "testId": "MON-16.3_A02", "test": "personnel or roles to be notified when unauthorized activities are detected is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70648, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590285", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590285", "securityControlId": 31214, "ccis": [], "uuid": "51d28c3c-e1fe-5110-92aa-39a85459e147", "testId": "MON-16.3_A03", "test": "methods to detect unauthorized activities are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70649, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590285", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590285", "securityControlId": 31214, "ccis": [], "uuid": "ec2437b9-4389-52e7-917f-371451b3f65d", "testId": "MON-16.3_A04", "test": "monitoring mechanisms are configured to detect unauthorized activities.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70650, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590285", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590285", "securityControlId": 31214, "ccis": [], "uuid": "c9147d04-0ebc-5c59-84d8-dfb3f8587594", "testId": "MON-16.3_A05", "test": "personnel or roles are notified when unauthorized activities are detected.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 565074, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c21f233-ce73-5363-b508-8c056accd8bc", "parentControlId": 31214, "controlId": "DE.CM-03", "title": "DE.CM-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584083" }, { "id": 565076, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e5e3cb2-7455-5576-8f11-df2e791a700b", "parentControlId": 31214, "controlId": "CIP-006-6 1.4", "title": "CIP-006-6 1.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584084" } ], "id": 31214, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731003", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731003", "catalogueId": 1062, "uuid": "66ad872e-a7de-59c6-b637-fcac3d111d01", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization monitor for unauthorized activities, accounts, connections, devices and software?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Unauthorized Activities", "description": "

Control Description

Mechanisms exist to monitor for unauthorized activities, accounts, connections, devices and software.

Evidence Request List (ERL)

E-IRO-02\nE-MON-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to monitor for unauthorized activities, accounts, connections, devices and software.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-16.3", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-16.3", "references": "

Micro-Small Business (<10 staff)

∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Managed Security Services Provider (MSSP)

Small Business (10-49 staff)

∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Security Incident Event Manager (SIEM)\n∙ Managed Security Services Provider (MSSP)

Medium Business (50-249 staff)

∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)

Large Business (250-999 staff)

∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)

Enterprise (>1,000 staff)

∙ Indicators of Compromise (IoC)\n∙ Indicators of Exposure (IoE)\n∙ Security Incident Event Manager (SIEM)\n∙ Extended Detection and Response (XDR)\n∙ Managed Security Services Provider (MSSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70651, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590286", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590286", "securityControlId": 31215, "ccis": [], "uuid": "42e600ef-e1cd-5415-b6aa-3ee692b20f2a", "testId": "MON-16.4_A01", "test": "an automated mechanism generates event logs for permissions changes to privileged accounts and/or groups.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 565084, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52681d43-e9c8-5371-ae22-0ecdc5a52cfb", "parentControlId": 31215, "controlId": "DE.CM-06", "title": "DE.CM-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584085" } ], "id": 31215, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731003", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731003", "catalogueId": 1062, "uuid": "9f9308cb-adea-52b6-8e7a-e34b2421086a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to generate event logs for permissions changes to privileged accounts and/or groups?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 7.0, "title": "Account Creation and Modification Logging", "description": "

Control Description

Automated mechanisms exist to generate event logs for permissions changes to privileged accounts and/or groups.

Evidence Request List (ERL)

E-AST-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.\n▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to automatically generate event logs for permissions changes to privileged accounts and/or groups.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-16.4", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-16.4", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70652, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590286", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590286", "securityControlId": 31216, "ccis": [], "uuid": "a3f15284-0b67-543e-a1cf-d83468e9f8a1", "testId": "MON-17_A01", "test": "analysis and triage capabilities for event log review processes are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 70653, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590286", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590286", "securityControlId": 31216, "ccis": [], "uuid": "0b641229-6dad-513c-9a45-e51b00762bef", "testId": "MON-17_A02", "test": "analysis and triage capabilities are integrated into event log review processes that support the organization's governance and incident response functions.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 565088, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01a53259-f113-56d3-9b66-43488c887f2c", "parentControlId": 31216, "controlId": "EVENT 1.1", "title": "EVENT 1.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584085" }, { "id": 565089, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a9f92ec-c5dc-5e66-900d-1e2235d0fbc4", "parentControlId": 31216, "controlId": "CIP-007-6 4.4", "title": "CIP-007-6 4.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584085" }, { "id": 565092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c91054f-9adb-5db4-b52b-f4c72afdda5d", "parentControlId": 31216, "controlId": "C1.d", "title": "C1.d", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584086" }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "90964cee-d8d8-5f2b-877a-65dc8e201d6c", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "10f2c970-4628-527d-aba2-52f7a318d976", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "fe9693d9-142f-5f50-824d-97ef81d3096f", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "d3ffd21d-71c3-54b9-a38b-69ecc122a693", "isPublic": true } ], "id": 31216, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731004", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731004", "catalogueId": 1062, "uuid": "e802a7d4-b03a-5409-95e5-dfd08f22471c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure event log reviews include analysis and triage practices that integrate with its established incident response processes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Event Log Analysis & Triage", "description": "

Control Description

Mechanisms exist to ensure event log reviews include analysis and triage practices that integrate with the organization's established incident response processes.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to ensure event log reviews include analysis and triage practices that integrate with the organization's established incident response processes.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-17", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-17", "references": "

Micro-Small Business (<10 staff)

∙ Review system logs periodically

Small Business (10-49 staff)

∙ Log monitoring policy\n∙ Regular review of key system logs

Medium Business (50-249 staff)

∙ SIEM (e.g., Wazuh)\n∙ Automated log collection and alerting

Large Business (250-999 staff)

∙ Enterprise SIEM (e.g., Splunk, IBM QRadar)\n∙ Continuous monitoring program\n∙ SOC monitoring

Enterprise (>1,000 staff)

∙ Enterprise SIEM/SOAR platform\n∙ 24/7 SOC monitoring\n∙ Threat hunting\n∙ Automated incident response", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70657, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590287", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590287", "securityControlId": 31219, "ccis": [], "uuid": "61012ac4-a759-5946-a68b-d1287a4ef293", "testId": "MON-19_A01", "test": "Technology Assets, Applications and/or Services (TAAS) that require hardware-enforced, write-once media (e.g., Write Once Read Many (WORM) technologies) are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "", "defaultText": null }, { "id": 70658, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590287", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590287", "securityControlId": 31219, "ccis": [], "uuid": "28987af7-46a9-5199-9b62-5c0de24b4815", "testId": "MON-19_A02", "test": "hardware-enforced, write-once media technologies are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "", "defaultText": null }, { "id": 70659, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590287", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590287", "securityControlId": 31219, "ccis": [], "uuid": "0aeccc06-5ea6-5cc4-b9f2-683ace2da5e4", "testId": "MON-19_A03", "test": "hardware-enforced, write-once media technologies are implemented, where required.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "", "defaultText": null } ], "externalMappings": [ { "id": 565114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "721fc3b8-0b99-56f4-b228-13cb407204bc", "parentControlId": 31219, "controlId": "SR 3.9 RE 1", "title": "SR 3.9 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584088" }, { "id": 565115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c97f1b93-042c-5a7c-99b4-12cb8e886f33", "parentControlId": 31219, "controlId": "CR 3.9(1)", "title": "CR 3.9(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584088" }, { "controlId": "NSS-17T-Sec6.5", "title": "NSS-17T-Sec6.5 — Continuous Monitoring, Audit Logging & Anomaly Detection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "211e9c6b-c315-5762-b021-1c423f219eb5", "isPublic": true }, { "controlId": "IEC-62645-7.3.5", "title": "IEC-62645-7.3.5 — Security Monitoring and Audit Trail Generation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "691b4b89-5e0c-51f6-8708-bbea78e7dffc", "isPublic": true }, { "controlId": "IEC-63096-12.4", "title": "IEC-63096-12.4 — Logging, Monitoring, and Clock Synchronization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "8ba555b4-eb36-5cf0-8edb-6e038a81f8ee", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.c", "title": "DOE-O-205.1D-4.c — Continuous Diagnostics, Monitoring & Operational Visibility", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MON Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "720c33b0-53c4-56c3-a608-cba8c7c41c98", "isPublic": true } ], "id": 31219, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731005", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731005", "catalogueId": 1062, "uuid": "f2862a7b-2d55-563d-af62-1d287f8865f6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization produce event logs on hardware-enforced, write-once media (e.g., Write Once Read Many (WORM) technologies)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Write Once Read Many (WORM) Event Log Generation", "description": "

Control Description

Mechanisms exist to produce event logs on hardware-enforced, write-once media (e.g., Write Once Read Many (WORM) technologies).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.\n▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.\n▪ An implemented and operational capability exists to produce event logs on hardware-enforced, write-once media (e.g., Write Once Read Many (WORM) technologies).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MON-19", "family": "Continuous Monitoring", "enhancements": "", "sortId": "MON-19", "references": "

Micro-Small Business (<10 staff)

∙ Review system logs periodically

Small Business (10-49 staff)

∙ Log monitoring policy\n∙ Regular review of key system logs

Medium Business (50-249 staff)

∙ SIEM (e.g., Wazuh)\n∙ Automated log collection and alerting

Large Business (250-999 staff)

∙ Enterprise SIEM (e.g., Splunk, IBM QRadar)\n∙ Continuous monitoring program\n∙ SOC monitoring

Enterprise (>1,000 staff)

∙ Enterprise SIEM/SOAR platform\n∙ 24/7 SOC monitoring\n∙ Threat hunting\n∙ Automated incident response", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70660, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590288", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590288", "securityControlId": 31220, "ccis": [], "uuid": "8b129f5b-d0a9-5646-aef4-d252175b2eb1", "testId": "CRY-01_A01", "test": "cryptographic uses are identified / defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_SC-08(02)_ODP\n53A_R5_SC-13_ODP[01]\n53A_R5_SC-13a.", "defaultText": null }, { "id": 70661, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590288", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590288", "securityControlId": 31220, "ccis": [], "uuid": "ec89c86c-27b8-52e5-bb8c-6435a310c525", "testId": "CRY-01_A02", "test": "cryptographic mechanisms intended to prevent unauthorized disclosure of sensitive / regulated data are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-13_ODP[02]\n171A_3.13.8[a]", "defaultText": null }, { "id": 70662, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590288", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590288", "securityControlId": 31220, "ccis": [], "uuid": "dfcdfca4-5604-5254-9028-00c69e4af7e5", "testId": "CRY-01_A03", "test": "organization-defined types of cryptography are implemented to protect the confidentiality of sensitive / regulated data.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-13b.", "defaultText": null }, { "id": 70663, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590288", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590288", "securityControlId": 31220, "ccis": [], "uuid": "4bf910d6-35c5-5da6-841e-42c91d5ecc53", "testId": "CRY-01_A04", "test": "as necessary for compliance requirements, FIPS-validated cryptography is employed to protect the confidentiality of sensitive / regulated data.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.13.11", "defaultText": null }, { "id": 70664, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590289", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590289", "securityControlId": 31220, "ccis": [], "uuid": "5da5551b-9d11-52c4-be88-c387e0519c6b", "testId": "CRY-01_A05", "test": "security critical or essential software is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.1e_ODP[1]", "defaultText": null }, { "id": 70665, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590289", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590289", "securityControlId": 31220, "ccis": [], "uuid": "52c6cf89-981c-530a-a937-4decfe14f6d1", "testId": "CRY-01_A06", "test": "root of trust mechanisms or cryptographic signatures are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.1e[a]", "defaultText": null }, { "id": 70666, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590289", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590289", "securityControlId": 31220, "ccis": [], "uuid": "83caf280-fa8c-51a4-b8f5-76038b998be9", "testId": "CRY-01_A07", "test": "the integrity of security critical or essential software is verified using root of trust mechanisms or cryptographic signatures.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.14.1e[b]", "defaultText": null }, { "id": 70667, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590289", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590289", "securityControlId": 31220, "ccis": [], "uuid": "8631fddd-24cf-5594-85c1-a3521164f6cd", "testId": "CRY-01_A08", "test": "cryptographic mechanisms are implemented to prevent the unauthorized disclosure of sensitive / regulated data during transmission.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 70668, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590289", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590289", "securityControlId": 31220, "ccis": [], "uuid": "dbd585d8-3983-5c99-8c18-8c15345e4302", "testId": "CRY-01_A09", "test": "cryptographic mechanisms are implemented to prevent the unauthorized disclosure of sensitive / regulated data while in storage.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 70669, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59029", "securityControlId": 31220, "ccis": [], "uuid": "841815da-5957-5654-a875-c6916e35533b", "testId": "CRY-01_A10", "test": "cryptographic mechanisms are implemented to detect unauthorized changes to software.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-07(06)[01]", "defaultText": null }, { "id": 70670, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59029", "securityControlId": 31220, "ccis": [], "uuid": "f226ece3-f854-5945-954c-5256f46e33e1", "testId": "CRY-01_A11", "test": "cryptographic mechanisms are implemented to detect unauthorized changes to firmware.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-07(06)[02]", "defaultText": null }, { "id": 70671, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59029", "securityControlId": 31220, "ccis": [], "uuid": "299b75df-db45-543c-bd71-a5ed5628615f", "testId": "CRY-01_A12", "test": "cryptographic mechanisms are implemented to detect unauthorized changes to information.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-07(06)[03]", "defaultText": null }, { "id": 70672, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59029", "securityControlId": 31220, "ccis": [], "uuid": "8c9d1621-dd6f-52a8-9bba-8fddf6611e92", "testId": "CRY-01_A13", "test": "cryptographic mechanisms are implemented to prevent the unauthorized disclosure of CUI during transmission.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.13.08[01]", "defaultText": null }, { "id": 70673, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59029", "securityControlId": 31220, "ccis": [], "uuid": "8f48e130-1b14-55a9-9361-c79f17309dad", "testId": "CRY-01_A14", "test": "cryptographic mechanisms are implemented to prevent the unauthorized disclosure of CUI while in storage.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.13.08[02]", "defaultText": null }, { "id": 70674, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590291", "securityControlId": 31220, "ccis": [], "uuid": "e652b4f6-41a0-5937-b3c7-592eefc0a8e6", "testId": "CRY-01_A15", "test": "the types of cryptography for protecting the confidentiality of CUI are defined.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.13.11.ODP[01]", "defaultText": null }, { "id": 70675, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590291", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590291", "securityControlId": 31220, "ccis": [], "uuid": "70516cae-0101-5c89-b059-fe882e6c3e5e", "testId": "CRY-01_A16", "test": "the following types of cryptography are implemented to protect the confidentiality of CUI: .
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171
SCF Defined Parameters: FIPS Validated Cryptography\n(https://csrc.nist.gov/Projects/Cryptographic-ModuleValidation-Program/Validated-Modules)", "otherId": "171A_R3_A.03.13.11", "defaultText": null }, { "id": 70676, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590291", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590291", "securityControlId": 31220, "ccis": [], "uuid": "9fc92dbb-ea40-5a3f-87f5-7a8f8202703b", "testId": "CRY-01_A17", "test": "cryptographic protections management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70677, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590291", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590291", "securityControlId": 31220, "ccis": [], "uuid": "76fad698-ce98-54d6-a77e-7854d17a02da", "testId": "CRY-01_A18", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support cryptographic protections management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70678, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590291", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590291", "securityControlId": 31220, "ccis": [], "uuid": "f4ad694f-4f63-57c8-9346-e68c063d33f2", "testId": "CRY-01_A19", "test": "responsibility and authority for the performance of cryptographic protections management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70679, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590291", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590291", "securityControlId": 31220, "ccis": [], "uuid": "1c9bab54-f5fb-5889-b857-845808ab893c", "testId": "CRY-01_A20", "test": "personnel performing cryptographic protections management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 565157, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584094", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a2bbe91-4902-55cd-8c84-740c5b5c9e2a", "parentControlId": 31220, "controlId": "DATA 1.5", "title": "DATA 1.5", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584094" }, { "id": 565158, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584094", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b6214f7-1544-5f35-8152-ced10ca780cc", "parentControlId": 31220, "controlId": "SR 4.1", "title": "SR 4.1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584094" }, { "id": 565159, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584094", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35bbb59c-86f8-5197-9def-ceac1ed68570", "parentControlId": 31220, "controlId": "SR 4.1 RE 1", "title": "SR 4.1 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584094" }, { "id": 565160, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584094", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "effb0023-9eb8-5aaf-b26c-8a1a8fda1f33", "parentControlId": 31220, "controlId": "SR 4.3", "title": "SR 4.3", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584094" }, { "id": 565161, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584094", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "038e46f5-afcd-5f1c-a17a-4bc3a52a72b3", "parentControlId": 31220, "controlId": "CR 4.3", "title": "CR 4.3", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584094" }, { "id": 565163, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584094", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0dd6a116-7ee6-5d04-adb5-05eb852d4813", "parentControlId": 31220, "controlId": "8.24", "title": "8.24", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584095" }, { "id": 565164, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584095", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "355c5400-7269-5bc0-aeec-7650730cf3dc", "parentControlId": 31220, "controlId": "8.26", "title": "8.26", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584095" }, { "id": 565169, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584095", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c5d26fe-7944-5b1e-a463-d26df5d7293c", "parentControlId": 31220, "controlId": "T1005", "title": "T1005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584095" }, { "id": 565170, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "480b7b45-29b6-5be1-8766-18476eec1686", "parentControlId": 31220, "controlId": "T1025", "title": "T1025", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584096" }, { "id": 565171, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48da7a2d-0814-53ea-b3c8-c5ebb8e5b3ee", "parentControlId": 31220, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584096" }, { "id": 565172, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc6b5af7-4b30-524f-ad35-3b4b77065990", "parentControlId": 31220, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584096" }, { "id": 565173, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "118d9cc1-7e3a-52c9-b703-a7cedfb70db9", "parentControlId": 31220, "controlId": "T1557.004", "title": "T1557.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584096" }, { "id": 565177, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a8618f4-e018-5dca-bb0b-382092c9363b", "parentControlId": 31220, "controlId": "SC-8(1)", "title": "SC-8(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584096" }, { "id": 565178, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea5b7dbd-3e02-5fc8-9a72-f3515b1cf354", "parentControlId": 31220, "controlId": "SC-8(2)", "title": "SC-8(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584096" }, { "id": 565179, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2266e81-6291-5948-b846-842478ada88c", "parentControlId": 31220, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584097" }, { "id": 565180, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "911154a8-8755-572b-8801-5d3078b3f1c5", "parentControlId": 31220, "controlId": "SC-13(1)", "title": "SC-13(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584097" }, { "id": 565181, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fdb2548-6df1-5c2e-a8b0-fdd0f22e43ef", "parentControlId": 31220, "controlId": "SI-7(6)", "title": "SI-7(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584097" }, { "id": 565182, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "064b74d6-318e-575d-8660-feda321fd111", "parentControlId": 31220, "controlId": "SC-08(01)", "title": "SC-08(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584097" }, { "id": 565183, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b321e00e-6c59-5f40-891c-2ea5444de5cd", "parentControlId": 31220, "controlId": "SC-08(02)", "title": "SC-08(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584097" }, { "id": 565184, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c3aa071-0163-524d-83ae-f3953846a9b2", "parentControlId": 31220, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584097" }, { "id": 565185, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26c4593e-0d2b-53aa-9684-1f6d2455fb8b", "parentControlId": 31220, "controlId": "SI-07(06)", "title": "SI-07(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584097" }, { "id": 565189, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6414b391-2b09-5695-8411-032f19aa6066", "parentControlId": 31220, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584098" }, { "id": 565190, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22e1c6a7-1abe-5f74-a544-85bc286fc546", "parentControlId": 31220, "controlId": "SC-08(01)", "title": "SC-08(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584098" }, { "id": 565192, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fc20cb6-fe08-566d-9c7f-4c79b25fe9de", "parentControlId": 31220, "controlId": "SC-08(01)", "title": "SC-08(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584098" }, { "id": 565193, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a662a574-14b3-5593-99fe-43398051cd51", "parentControlId": 31220, "controlId": "SC-08(02)", "title": "SC-08(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584098" }, { "id": 565194, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29e9cb08-43ec-5301-818c-33e09586f987", "parentControlId": 31220, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584098" }, { "id": 565195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c111e47f-1533-5256-b0aa-42756556f874", "parentControlId": 31220, "controlId": "SI-07(06)", "title": "SI-07(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584099" }, { "id": 565196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90324bfa-c662-5ac8-ab9f-9bd2ad2c9273", "parentControlId": 31220, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584099" }, { "id": 565197, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b01aa47-4ab1-58db-a7f6-ca7d303b7e5d", "parentControlId": 31220, "controlId": "SC-08(01)", "title": "SC-08(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584099" }, { "id": 565198, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd5b49e6-f33b-5a8e-a5b1-38cd8067531c", "parentControlId": 31220, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584099" }, { "id": 565199, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf585fae-60b7-56c6-a019-50dbaee09fe3", "parentControlId": 31220, "controlId": "SC-08(01)", "title": "SC-08(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584099" }, { "id": 565200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f63721a1-64f7-5646-8c4b-68ee3adad378", "parentControlId": 31220, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584099" }, { "id": 565203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e078de65-2a73-5d59-9b9c-746ee5586201", "parentControlId": 31220, "controlId": "3.13.11", "title": "3.13.11", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584099" }, { "id": 565204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89a93f5e-c8f2-59ae-aa60-b94b131e0a17", "parentControlId": 31220, "controlId": "03.13.08", "title": "03.13.08", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5841" }, { "id": 565205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffad832a-e599-50c4-a9ea-b2ba7c8cf88a", "parentControlId": 31220, "controlId": "03.13.11", "title": "03.13.11", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5841" }, { "id": 565213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bb70ff8-1abb-56e0-9e00-ed48fc85d2c5", "parentControlId": 31220, "controlId": "PR.DS-01", "title": "PR.DS-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584101" }, { "id": 565214, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b8503f4-0bc7-513e-be6f-4d6a2cc49aef", "parentControlId": 31220, "controlId": "PR.DS-02", "title": "PR.DS-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584101" }, { "id": 565215, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b4f417b-1ae1-5fac-95dc-69cc1405ecd1", "parentControlId": 31220, "controlId": "PR.DS-10", "title": "PR.DS-10", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584101" }, { "id": 565246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584105", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60cab329-cbf3-5713-874a-8df3fb75463e", "parentControlId": 31220, "controlId": "ARCHITECTURE-5d", "title": "ARCHITECTURE-5d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584105" }, { "id": 565282, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e87a22c-bdd6-5aed-ba83-d974cab2ef0a", "parentControlId": 31220, "controlId": "CIP-006-6 1.10", "title": "CIP-006-6 1.10", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584109" }, { "id": 565283, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38e69e9d-a53d-5d9a-83e2-a0162bad8914", "parentControlId": 31220, "controlId": "12-2.d", "title": "12-2.d", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584109" }, { "id": 565284, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84a740f2-a018-54aa-860f-264e1bf21a74", "parentControlId": 31220, "controlId": "12-2.e(1)", "title": "12-2.e(1)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584109" }, { "controlId": "B.3.10", "title": "B.3.10 — Use of Cryptography", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-13", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "0ca55484-4770-54e1-a16b-919b35e860e3", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.10", "title": "NEI 08-09 App D.3.10 — Use of Cryptography", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.10", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "96d4dc41-14cb-5613-974e-eb51342ba4f0", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.10", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "c4f079f0-8905-52c7-b6c5-8ac77cdf9df2", "isPublic": true }, { "controlId": "IEC-62645-7.3.4", "title": "IEC-62645-7.3.4 — Cryptographic Integrity and Authentication Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "9a48062c-590a-5dd5-bcfd-1a51d1bfb8d1", "isPublic": true }, { "controlId": "IEC-63096-10.1", "title": "IEC-63096-10.1 — Cryptographic Controls Policy and Key Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "189ff8a7-8163-5426-9c72-492fcf9798c5", "isPublic": true } ], "id": 31220, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731005", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731005", "catalogueId": 1062, "uuid": "e7b8d7e3-bf97-596f-8e0c-42130f3ae17c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Use of Cryptographic Controls", "description": "

Control Description

Mechanisms exist to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.

Evidence Request List (ERL)

E-CRY-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cryptographic Protections (CRY) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CRY domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Cryptography management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel provide an encryption solution (software or hardware) for the storage of sensitive/regulated data.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.\n▪ External compliance requirements for cryptography are identified and documented, based on applicable laws, regulations and contractual obligations.\n▪ IT and/or cybersecurity personnel perform an annual review of deployed cryptographic cipher suites and protocols to identify and replace weak and/or deprecated cryptographic cipher suites and protocols.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to implement cryptographic mechanisms that are applicability for statutory, regulatory and/or contractual compliance obligations.\n▪ Sensitive/regulated data is encrypted at rest using cryptographic protections that are commensurate with the sensitivity of the data.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of cryptographic protections controls using known public standards and trusted cryptographic technologies.

Level 4 - Quantitatively Controlled: Cryptographic Protections (CRY) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.10", "controlId": "CRY-01", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-01", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management (CM) program\n∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management (CM) program\n∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management (CM) program\n∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management (CM) program\n∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program\n∙ Configuration Management (CM) program\n∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70680, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590292", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590292", "securityControlId": 31221, "ccis": [], "uuid": "9906e62e-07b1-52d0-8fb9-47fe9de96a0a", "testId": "CRY-01.1_A01", "test": "either cryptographic mechanisms or alternative physical safeguards are implemented to prevent unauthorized disclosure of sensitive / regulated data during transmission.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.13.8[c]\n53A_R5_SC-08(04)", "defaultText": null }, { "id": 70681, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590292", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590292", "securityControlId": 31221, "ccis": [], "uuid": "5ea0be23-a7ad-5c0d-bb30-53c2ce41f133", "testId": "CRY-01.1_A02", "test": "alternative physical safeguards intended to prevent unauthorized disclosure of sensitive / regulated are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_SC-08(04)_ODP\n171A_3.13.8[b]", "defaultText": null } ], "externalMappings": [ { "id": 565485, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584141", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "930217c8-6098-5a9b-b433-d49638af15f1", "parentControlId": 31221, "controlId": "SC-8(1)", "title": "SC-8(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584141" }, { "id": 565486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584141", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "342a09f6-199b-55e9-aaaf-f344f68c2706", "parentControlId": 31221, "controlId": "SC-08(01)", "title": "SC-08(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584141" }, { "id": 565488, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584141", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e49b479b-9ae1-599e-abff-87f8f3abbd54", "parentControlId": 31221, "controlId": "SC-08(01)", "title": "SC-08(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584141" }, { "id": 565489, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584141", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7aa4685-dd8b-5077-8119-c4c20372965c", "parentControlId": 31221, "controlId": "SC-08(01)", "title": "SC-08(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584141" }, { "id": 565490, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584141", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b023456-b41a-5d98-9abb-1d0dece3cd70", "parentControlId": 31221, "controlId": "SC-08(01)", "title": "SC-08(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584141" }, { "id": 565491, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584142", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4f5ee97-33e8-5481-a753-235e164d0f6a", "parentControlId": 31221, "controlId": "SC-08(01)", "title": "SC-08(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584142" }, { "id": 565493, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584142", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4533328-022a-591e-bcb5-7365d98c90bb", "parentControlId": 31221, "controlId": "3.8.6", "title": "3.8.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584142" }, { "id": 565494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584142", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "346853d7-a915-50db-81bf-74ad591f27d0", "parentControlId": 31221, "controlId": "3.13.8", "title": "3.13.8", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584142" }, { "id": 565495, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584142", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95c3964e-5e5f-5ddc-91c4-02f6b6941b1b", "parentControlId": 31221, "controlId": "03.13.08", "title": "03.13.08", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584142" }, { "id": 565498, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584142", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f93d4749-ac22-5ea8-a4ab-9b4a9295cc9a", "parentControlId": 31221, "controlId": "PR.DS-01", "title": "PR.DS-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584142" } ], "id": 31221, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731005", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731005", "catalogueId": 1062, "uuid": "ef0d26c1-8250-5e17-ae04-142072c1b74c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Are cryptographic mechanisms utilized to prevent unauthorized disclosure of information as an alternative to physical safeguards?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Alternate Physical Protection", "description": "

Control Description

Cryptographic mechanisms exist to prevent unauthorized disclosure of information as an alternative to physical safeguards.

Evidence Request List (ERL)

E-GOV-18

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational cryptographic capability exists to prevent unauthorized disclosure of information as an alternative to physical safeguards.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CRY-01.1", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70682, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590292", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590292", "securityControlId": 31222, "ccis": [], "uuid": "dc1055ad-bf56-55e8-9019-6584d183d0bc", "testId": "CRY-01.2_A01", "test": "a legal opinion regarding exporting cryptographic technologies is obtained.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70683, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590292", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590292", "securityControlId": 31222, "ccis": [], "uuid": "534d35a7-0c4d-56bd-83af-794948243bf6", "testId": "CRY-01.2_A02", "test": "cryptographic uses are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-13_ODP[01]\n53A_R5_SC-13a.", "defaultText": null }, { "id": 70684, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590292", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590292", "securityControlId": 31222, "ccis": [], "uuid": "cfe90248-88bb-5b18-967c-12b6f1582d6c", "testId": "CRY-01.2_A03", "test": "types of cryptography for each specified cryptographic use are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-13_ODP[02]", "defaultText": null } ], "externalMappings": [ { "id": 565518, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584145", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8724c31-7d6d-5e0b-80c8-d5b02a98ae24", "parentControlId": 31222, "controlId": "5.31", "title": "5.31", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584145" }, { "id": 565521, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584145", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d81679c8-0962-5fa0-8c0e-e50f9b83d8ca", "parentControlId": 31222, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584145" }, { "id": 565522, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584145", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f47af88b-52c3-527d-a153-6c7c7a2e0d0f", "parentControlId": 31222, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584145" }, { "id": 565524, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584145", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55ca7348-84aa-5f5c-a25b-22e3e582ca88", "parentControlId": 31222, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584145" }, { "id": 565525, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584146", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78e984c5-3104-560b-94d1-54fc628e3096", "parentControlId": 31222, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584146" }, { "id": 565526, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584146", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ca43674-5045-55c3-9cc4-ce021ab2c4c7", "parentControlId": 31222, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584146" }, { "id": 565527, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584146", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbeeac4d-2bba-5b1c-b840-937ec5c1a44d", "parentControlId": 31222, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584146" }, { "id": 565528, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584146", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e9e4c20-8bdc-53aa-8c07-245e5eec37db", "parentControlId": 31222, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584146" } ], "id": 31222, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731006", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731006", "catalogueId": 1062, "uuid": "44afa1e9-cc22-5dfe-9d77-7b653f66d38d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization address the exporting of cryptographic technologies in compliance with relevant statutory and regulatory requirements?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 5.0, "title": "Export-Controlled Cryptography", "description": "

Control Description

Mechanisms exist to address the exporting of cryptographic technologies in compliance with relevant statutory and regulatory requirements.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to address the exporting of cryptographic technologies in compliance with relevant statutory and regulatory requirements.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CRY-01.2", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-01.2", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70685, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590293", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590293", "securityControlId": 31223, "ccis": [], "uuid": "36fce405-7ca0-50db-ae55-d69ba71c56a4", "testId": "CRY-01.3_A01", "test": "the confidentiality and integrity of information is maintained during preparation for transmission.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-08(02)[01]\n53A_R5_SC-08(02)_ODP", "defaultText": null }, { "id": 70686, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590293", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590293", "securityControlId": 31223, "ccis": [], "uuid": "fae2ee33-7224-5b48-b1bc-c1ef98f304db", "testId": "CRY-01.3_A02", "test": "the confidentiality and integrity of information is maintained during reception.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-08(02)[02]\n53A_R5_SC-08(02)_ODP", "defaultText": null } ], "externalMappings": [ { "id": 565545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584148", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ddceea29-c0e3-5176-a78e-0028394588ac", "parentControlId": 31223, "controlId": "SC-8(2)", "title": "SC-8(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584148" }, { "id": 565546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584148", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c012b7c-185b-51e1-865d-889150c58359", "parentControlId": 31223, "controlId": "SC-08(02)", "title": "SC-08(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584148" }, { "id": 565548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584148", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aeb7f87d-1312-5c6a-93e1-cccfbe021e32", "parentControlId": 31223, "controlId": "SC-08(02)", "title": "SC-08(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584148" } ], "id": 31223, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731006", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731006", "catalogueId": 1062, "uuid": "d2257727-248d-5f00-abc1-e553798f6c18", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Are cryptographic mechanisms utilized to ensure the confidentiality and integrity of information during preparation for transmission and during reception?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Pre/Post Transmission Handling", "description": "

Control Description

Cryptographic mechanisms exist to ensure the confidentiality and integrity of information during preparation for transmission and during reception.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational cryptographic capability exists to ensure the confidentiality and integrity of information during preparation for transmission and during reception.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CRY-01.3", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-01.3", "references": "

Micro-Small Business (<10 staff)

∙ Enable encryption for sensitive files (e.g., VeraCrypt, BitLocker)

Small Business (10-49 staff)

∙ Full disk encryption\n∙ TLS for data in transit

Medium Business (50-249 staff)

∙ Enterprise encryption standards policy\n∙ PKI management

Large Business (250-999 staff)

∙ Enterprise PKI\n∙ HSM for key management\n∙ Certificate lifecycle management

Enterprise (>1,000 staff)

∙ Enterprise HSM (e.g., Thales, AWS CloudHSM)\n∙ Enterprise PKI\n∙ Automated certificate management (e.g., Venafi)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70687, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590295", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590295", "securityControlId": 31224, "ccis": [], "uuid": "a2766124-b445-5ffa-91eb-c672c7aabbd9", "testId": "CRY-01.4_A01", "test": "technical and procedural means to confuse and mislead adversaries are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.13.3e_ODP[1]", "defaultText": null }, { "id": 70688, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590295", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590295", "securityControlId": 31224, "ccis": [], "uuid": "6ea8a2bc-da1e-5168-9dd6-80c49973069e", "testId": "CRY-01.4_A02", "test": "technical and procedural means are employed to confuse and mislead adversaries.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.13.3e[a]", "defaultText": null } ], "externalMappings": [ { "id": 565556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584149", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "524d2aae-fd98-527a-ad74-724938f9c4f0", "parentControlId": 31224, "controlId": "SC-8(4)", "title": "SC-8(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584149" }, { "id": 565557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584149", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "272e056c-9985-5aaf-8c53-75942641f100", "parentControlId": 31224, "controlId": "SC-08(04)", "title": "SC-08(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584149" }, { "id": 565558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584149", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "355c945b-8300-5c2c-918f-4fece430a7f2", "parentControlId": 31224, "controlId": "SC-08(04)", "title": "SC-08(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584149" } ], "id": 31224, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731006", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731006", "catalogueId": 1062, "uuid": "ebf88e93-1a96-5aa0-ab44-b18ba371eef6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Are cryptographic mechanisms utilized to conceal or randomize communication patterns?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Conceal / Randomize Communications", "description": "

Control Description

Cryptographic mechanisms exist to conceal or randomize communication patterns.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational cryptographic capability exists to conceal or randomize communication patterns.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CRY-01.4", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-01.4", "references": "

Micro-Small Business (<10 staff)

∙ Enable encryption for sensitive files (e.g., VeraCrypt, BitLocker)

Small Business (10-49 staff)

∙ Full disk encryption\n∙ TLS for data in transit

Medium Business (50-249 staff)

∙ Enterprise encryption standards policy\n∙ PKI management

Large Business (250-999 staff)

∙ Enterprise PKI\n∙ HSM for key management\n∙ Certificate lifecycle management

Enterprise (>1,000 staff)

∙ Enterprise HSM (e.g., Thales, AWS CloudHSM)\n∙ Enterprise PKI\n∙ Automated certificate management (e.g., Venafi)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70689, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590295", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590295", "securityControlId": 31225, "ccis": [], "uuid": "3d816318-a7ef-5f81-b3fa-d1d91771763c", "testId": "CRY-01.5_A01", "test": "cryptographic uses are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-13_ODP[01]\n53A_R5_SC-13a.", "defaultText": null }, { "id": 70690, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590296", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590296", "securityControlId": 31225, "ccis": [], "uuid": "90014035-12ba-574d-baab-052f06dbb8db", "testId": "CRY-01.5_A02", "test": "types of cryptography for each specified cryptographic use are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-13_ODP[02]", "defaultText": null }, { "id": 70691, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590296", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590296", "securityControlId": 31225, "ccis": [], "uuid": "9c2f6414-4994-5579-9d93-90c6124def17", "testId": "CRY-01.5_A03", "test": "an inventory of cryptographic cipher suites and protocols is maintained.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70692, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590296", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590296", "securityControlId": 31225, "ccis": [], "uuid": "6bb087bb-4c88-5a6e-92f5-8d2fb3ea8601", "testId": "CRY-01.5_A04", "test": "deployed cryptographic cipher suites and protocols are periodically reviewed to identify industry trends regarding the continued viability of utilized cryptographic cipher suites and protocols.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 70693, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590296", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590296", "securityControlId": 31225, "ccis": [], "uuid": "0a1ad193-fc16-5a43-99d2-d5d54d228cf7", "testId": "CRY-01.5_A05", "test": "proactive measures are taken to respond to industry trends regarding the continued viability of utilized cryptographic cipher suites and protocols.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 565560, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fe8bfd2-b789-5b80-962a-2690c20629b2", "parentControlId": 31225, "controlId": "03.13.11", "title": "03.13.11", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58415" } ], "id": 31225, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731007", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731007", "catalogueId": 1062, "uuid": "02e2131d-ba75-5e7e-8617-19fc41d1e2f8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify, document and review deployed cryptographic cipher suites and protocols to proactively respond to industry trends regarding the continued viability of utilized cryptographic cipher suites and protocols?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Cryptographic Cipher Suites and Protocols Inventory", "description": "

Control Description

Mechanisms exist to identify, document and review deployed cryptographic cipher suites and protocols to proactively respond to industry trends regarding the continued viability of utilized cryptographic cipher suites and protocols.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify, document and review deployed cryptographic cipher suites and protocols to proactively respond to industry trends regarding the continued viability of utilized cryptographic cipher suites and protocols.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CRY-01.5", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-01.5", "references": "

Micro-Small Business (<10 staff)

∙ Enable encryption for sensitive files (e.g., VeraCrypt, BitLocker)

Small Business (10-49 staff)

∙ Full disk encryption\n∙ TLS for data in transit

Medium Business (50-249 staff)

∙ Enterprise encryption standards policy\n∙ PKI management

Large Business (250-999 staff)

∙ Enterprise PKI\n∙ HSM for key management\n∙ Certificate lifecycle management

Enterprise (>1,000 staff)

∙ Enterprise HSM (e.g., Thales, AWS CloudHSM)\n∙ Enterprise PKI\n∙ Automated certificate management (e.g., Venafi)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70694, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590297", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590297", "securityControlId": 31226, "ccis": [], "uuid": "6a339084-fc88-5e21-90bf-94de12d5fa10", "testId": "CRY-02_A01", "test": "mechanisms for authentication to a cryptographic module are implemented that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards and guidelines for such authentication.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-07", "defaultText": null } ], "externalMappings": [ { "id": 565571, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584151", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fc41b1d-5453-5eac-b7bc-24d1c29d02b6", "parentControlId": 31226, "controlId": "IA-7", "title": "IA-7", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584151" }, { "id": 565572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584151", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbe3e679-62e9-5f80-afa9-4dc94d7c02c6", "parentControlId": 31226, "controlId": "IA-07", "title": "IA-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584151" }, { "id": 565574, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3da9860d-19c4-5a6b-95c2-af1ce89647e7", "parentControlId": 31226, "controlId": "IA-07", "title": "IA-07", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584152" }, { "id": 565575, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4cdd9245-953a-5861-b043-01a95cb7dab7", "parentControlId": 31226, "controlId": "IA-07", "title": "IA-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584152" }, { "id": 565576, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c81772f4-8ecb-5aa8-b649-e05052abe47a", "parentControlId": 31226, "controlId": "IA-07", "title": "IA-07", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584152" }, { "id": 565577, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcf51763-2474-5d18-982a-9cef75324ddb", "parentControlId": 31226, "controlId": "IA-07", "title": "IA-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584152" }, { "id": 565578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20ce862f-ca5a-58a0-8b6f-bc707898e9a3", "parentControlId": 31226, "controlId": "IA-07", "title": "IA-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584152" }, { "controlId": "IEC-62645-7.3.4", "title": "IEC-62645-7.3.4 — Cryptographic Integrity and Authentication Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "ab194106-2782-5ccd-b7dd-af4433738be3", "isPublic": true }, { "controlId": "IEC-63096-10.1", "title": "IEC-63096-10.1 — Cryptographic Controls Policy and Key Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "284d56b7-4707-5e46-8e47-f12490bf4cb3", "isPublic": true } ], "id": 31226, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731007", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731007", "catalogueId": 1062, "uuid": "8f9dbccf-93f1-5397-bb1c-0500315538c6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to enable systems to authenticate to a cryptographic module?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 8.0, "title": "Automated Authentication Through Cryptographic Modules", "description": "

Control Description

Automated mechanisms exist to enable systems to authenticate to a cryptographic module.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cryptographic Protections (CRY) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CRY domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Cryptography management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel provide an encryption solution (software or hardware) for the storage of sensitive/regulated data.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically enable systems to authenticate to a cryptographic module.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CRY-02", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-02", "references": "

Micro-Small Business (<10 staff)

∙ Enable encryption for sensitive files (e.g., VeraCrypt, BitLocker)

Small Business (10-49 staff)

∙ Full disk encryption\n∙ TLS for data in transit

Medium Business (50-249 staff)

∙ Enterprise encryption standards policy\n∙ PKI management

Large Business (250-999 staff)

∙ Enterprise PKI\n∙ HSM for key management\n∙ Certificate lifecycle management

Enterprise (>1,000 staff)

∙ Enterprise HSM (e.g., Thales, AWS CloudHSM)\n∙ Enterprise PKI\n∙ Automated certificate management (e.g., Venafi)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70695, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590297", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590297", "securityControlId": 31227, "ccis": [], "uuid": "66ac9b14-a71d-5f05-95d4-d4caf232c216", "testId": "CRY-03_A01", "test": "the types of cryptography for protecting the confidentiality of data are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70696, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590297", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590297", "securityControlId": 31227, "ccis": [], "uuid": "ebd12e5d-08e4-5359-b791-4067be9c1494", "testId": "CRY-03_A02", "test": "cryptographic mechanisms are implemented to prevent the unauthorized disclosure of data during transmission.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-08\n53A_R5_SC-08_ODP\n53A_R5_SC-08(01)\n53A_R5_SC-08(01)_ODP", "defaultText": null }, { "id": 70697, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590297", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590297", "securityControlId": 31227, "ccis": [], "uuid": "319d4ae4-e499-5184-9c2a-158727f9d462", "testId": "CRY-03_A03", "test": "organization-defined types of cryptography are implemented to protect the confidentiality of sensitive / regulated data.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70698, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590297", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590297", "securityControlId": 31227, "ccis": [], "uuid": "2f9c18a3-27f5-58c5-a693-824dd8d679e6", "testId": "CRY-03_A04", "test": "cryptographic mechanisms are implemented to prevent the unauthorized disclosure of CUI during transmission.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.13.08[01]", "defaultText": null }, { "id": 70699, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590298", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590298", "securityControlId": 31227, "ccis": [], "uuid": "53de87ea-ec84-5828-8546-922003043efa", "testId": "CRY-03_A05", "test": "the types of cryptography for protecting the confidentiality of CUI are defined.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.13.11.ODP[01]", "defaultText": null }, { "id": 70700, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590298", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590298", "securityControlId": 31227, "ccis": [], "uuid": "1d2462bf-9c8f-54de-9002-0a59587d62a5", "testId": "CRY-03_A06", "test": "the following types of cryptography are implemented to protect the confidentiality of CUI: .
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171
SCF Defined Parameters: FIPS Validated Cryptography\n(https://csrc.nist.gov/Projects/Cryptographic-ModuleValidation-Program/Validated-Modules)", "otherId": "171A_R3_A.03.13.11", "defaultText": null } ], "externalMappings": [ { "id": 565627, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ad675b5-75cd-53aa-a62a-ce1517f74a19", "parentControlId": 31227, "controlId": "SR 4.1 RE 2", "title": "SR 4.1 RE 2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584158" }, { "id": 565628, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef59b440-abf3-5502-9454-ba02f264c4a3", "parentControlId": 31227, "controlId": "CR 4.1(b)", "title": "CR 4.1(b)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584158" }, { "id": 565629, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd483697-7ca1-5074-b4c1-ca11a177bad7", "parentControlId": 31227, "controlId": "5.14", "title": "5.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584158" }, { "id": 565630, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ef28860-fb58-5317-8310-e2622b7b2e06", "parentControlId": 31227, "controlId": "8.24", "title": "8.24", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584158" }, { "id": 565631, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df40e646-348e-5f07-b012-007de272ead6", "parentControlId": 31227, "controlId": "8.26", "title": "8.26", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584158" }, { "id": 565640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584159", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6e97e90-7c65-57fc-93c9-6dbb62e15a90", "parentControlId": 31227, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584159" }, { "id": 565641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584159", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "224cef03-1188-52ce-982e-75c76e5dd485", "parentControlId": 31227, "controlId": "T1040", "title": "T1040", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584159" }, { "id": 565642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd733f7d-123d-5565-824e-44761ddb6914", "parentControlId": 31227, "controlId": "T1090", "title": "T1090", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58416" }, { "id": 565643, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67b49433-95ec-5743-a881-8d150ef2edd1", "parentControlId": 31227, "controlId": "T1090.004", "title": "T1090.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58416" }, { "id": 565644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "742f78ca-ec38-5f03-af45-d00c123c8026", "parentControlId": 31227, "controlId": "T1550.001", "title": "T1550.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58416" }, { "id": 565645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c44ad1dd-8c62-5dc2-b1fb-1ecc1a4fd8c1", "parentControlId": 31227, "controlId": "T1550.004", "title": "T1550.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58416" }, { "id": 565646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdd0ed00-e85c-5c29-9e9c-ea364fb7ea49", "parentControlId": 31227, "controlId": "T1552.007", "title": "T1552.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58416" }, { "id": 565647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc1e258e-00fe-5a3b-9f47-13560e58f54e", "parentControlId": 31227, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58416" }, { "id": 565648, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3528a30-0c49-5bea-98c0-758fc66a4f21", "parentControlId": 31227, "controlId": "T1557.001", "title": "T1557.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58416" }, { "id": 565649, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7db1527e-7aeb-53a6-8fb5-eefd74843de1", "parentControlId": 31227, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58416" }, { "id": 565650, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4f5e046-4d28-5d42-bbfb-58edd0d6d245", "parentControlId": 31227, "controlId": "T1557.003", "title": "T1557.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58416" }, { "id": 565651, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53bebb19-e6dc-5380-948f-83abfcc5632d", "parentControlId": 31227, "controlId": "T1557.004", "title": "T1557.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58416" }, { "id": 565652, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b17deaf-be37-5022-b108-78e22ba7ff55", "parentControlId": 31227, "controlId": "T1562", "title": "T1562", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584161" }, { "id": 565653, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4a3f3b6-a4e8-58de-931e-30453d01138a", "parentControlId": 31227, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584161" }, { "id": 565654, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c39c349-900a-5c29-8782-1b38687e45e4", "parentControlId": 31227, "controlId": "T1562.009", "title": "T1562.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584161" }, { "id": 565655, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72d55568-d627-5805-8499-b774db68393b", "parentControlId": 31227, "controlId": "T1562.010", "title": "T1562.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584161" }, { "id": 565656, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a38c2d79-3e57-5925-b475-40269017e483", "parentControlId": 31227, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584161" }, { "id": 565657, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92d60540-e2ab-5f1c-b0a2-e32bee0c99dc", "parentControlId": 31227, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584161" }, { "id": 565658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "095aed58-1007-5249-82c0-638a30e5c9cb", "parentControlId": 31227, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584161" }, { "id": 565659, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6a173f9-8017-53be-b5a4-0d87ee864d8b", "parentControlId": 31227, "controlId": "T1622", "title": "T1622", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584161" }, { "id": 565664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "caea57e9-fd02-5825-b147-32fa3335ce6f", "parentControlId": 31227, "controlId": "SC-8", "title": "SC-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584162" }, { "id": 565665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8684e893-fe58-5a38-ae47-cf5fcfc48c3e", "parentControlId": 31227, "controlId": "SC-8(1)", "title": "SC-8(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584162" }, { "id": 565666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04adb265-93dc-583f-8494-21f53994a873", "parentControlId": 31227, "controlId": "SC-08", "title": "SC-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584162" }, { "id": 565667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da9a824d-01d8-5046-9f35-4848f47ddf5b", "parentControlId": 31227, "controlId": "SC-08(01)", "title": "SC-08(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584162" }, { "id": 565670, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e4f21ed-230e-5f43-b384-2a8669156441", "parentControlId": 31227, "controlId": "SC-08", "title": "SC-08", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584163" }, { "id": 565671, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33395957-80ab-5979-97d6-786c1136a927", "parentControlId": 31227, "controlId": "SC-08(01)", "title": "SC-08(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584163" }, { "id": 565673, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "123d7436-8816-5469-b97a-55fdb5ad50f9", "parentControlId": 31227, "controlId": "SC-08", "title": "SC-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584163" }, { "id": 565674, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98366926-4194-5ee6-bb5f-9ccca853cd13", "parentControlId": 31227, "controlId": "SC-08(01)", "title": "SC-08(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584163" }, { "id": 565675, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3dc71208-230d-5893-838e-42832545f0ce", "parentControlId": 31227, "controlId": "SC-08", "title": "SC-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584163" }, { "id": 565676, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "951ad01d-9856-5630-aee0-359a88d0a4e5", "parentControlId": 31227, "controlId": "SC-08(01)", "title": "SC-08(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584163" }, { "id": 565677, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "470d0d36-03dd-56d1-9a55-7e96a89ed751", "parentControlId": 31227, "controlId": "SC-08", "title": "SC-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584164" }, { "id": 565678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71613966-165a-5411-876d-5f360f32f303", "parentControlId": 31227, "controlId": "SC-08(01)", "title": "SC-08(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584164" }, { "id": 565680, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7cbad4a2-cfd7-5a46-9211-49167db969bb", "parentControlId": 31227, "controlId": "SC-8", "title": "SC-8", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584164" }, { "id": 565681, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df48b4e4-21fd-571d-816d-9d7c7398c86d", "parentControlId": 31227, "controlId": "SC-8", "title": "SC-8", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584164" }, { "id": 565684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3929d43c-7cb1-585c-8dde-8871df308991", "parentControlId": 31227, "controlId": "3.13.8", "title": "3.13.8", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584164" }, { "id": 565685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b31ce057-c64a-5cf1-a498-c05d76e5431a", "parentControlId": 31227, "controlId": "03.13.08", "title": "03.13.08", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584164" }, { "id": 565692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad3a1ad6-fe76-51f4-8fa0-934961938844", "parentControlId": 31227, "controlId": "PR.DS-02", "title": "PR.DS-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584165" }, { "id": 565727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584177", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee66c779-87ff-5ddb-b9f7-0ab0006480f7", "parentControlId": 31227, "controlId": "ARCHITECTURE-5c", "title": "ARCHITECTURE-5c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584177" }, { "id": 565728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584177", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81b774c5-56bc-5fec-bf9e-f8212f604f97", "parentControlId": 31227, "controlId": "ARCHITECTURE-5d", "title": "ARCHITECTURE-5d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584177" }, { "id": 565784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9804f335-a639-5849-bdc7-7a9e11417221", "parentControlId": 31227, "controlId": "B3.b", "title": "B3.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584184" }, { "controlId": "B.3.6", "title": "B.3.6 — Transmission Integrity", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "aed69daf-6436-51f1-b7b1-c8e549ee346f", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.6", "title": "NEI 08-09 App D.3.6 — Transmission Integrity", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "c99e116f-b1f6-5b6b-ba58-48a2934aa77f", "isPublic": true }, { "controlId": "10 CFR 73.54(a)(2)", "title": "10 CFR 73.54(a)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "1b57941b-52a0-5cdc-a6c6-47cac5d43707", "isPublic": true }, { "controlId": "B.3.7", "title": "B.3.7 — Transmission Confidentiality", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "c842df8f-6f71-566c-afc2-8bfe8310f137", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.7", "title": "NEI 08-09 App D.3.7 — Transmission Confidentiality", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6b6a71ac-81fd-50a8-84f3-067c062087e4", "isPublic": true }, { "controlId": "CIP-005-7-R2", "title": "CIP-005-7-R2 — Interactive Remote Access Management", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "51b9490a-a59d-5e90-b582-19630f88f6f3", "isPublic": true }, { "controlId": "CIP-005-7-2.1", "title": "CIP-005-7-2.1 — For all Interactive Remote Access, utilize an Intermediate System such that the Cyber Asset initiating Interactive Re...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0fe61719-cd2c-530e-9136-36b8a0859f38", "isPublic": true }, { "controlId": "CIP-005-7-2.2", "title": "CIP-005-7-2.2 — For all Interactive Remote Access sessions, utilize encryption that terminates at an Intermediate System.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b9fb7665-a414-51e5-8741-d3cf099abeba", "isPublic": true }, { "controlId": "CIP-005-7-2.3", "title": "CIP-005-7-2.3 — Require multi-factor authentication for all Interactive Remote Access sessions.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "fd493fd7-99b9-5fe9-afba-870cf20eae39", "isPublic": true }, { "controlId": "CIP-005-7-2.4", "title": "CIP-005-7-2.4 — Have one or more methods for determining active vendor remote access sessions (including Interactive Remote Access an...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e4511ba4-9a40-5a78-8755-2d356d0b1a0f", "isPublic": true }, { "controlId": "CIP-005-7-2.5", "title": "CIP-005-7-2.5 — Have one or more method(s) to disable active vendor remote access (including Interactive Remote Access and system- to...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "08ad7cd9-4c1d-5342-9d59-317c67919281", "isPublic": true }, { "controlId": "CIP-012-1-R1", "title": "CIP-012-1-R1 — Real-time Assessment and Monitoring Data Protection Between Control Centers", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e20fcddb-53fa-55a3-8c53-c06c6def5946", "isPublic": true }, { "controlId": "CIP-012-1-1.1", "title": "CIP-012-1-1.1 — Identification of security protection used to mitigate the risks posed by unauthorized disclosure and unauthorized mo...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-012-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "51f9b67a-ef7f-5672-8737-eda105a7710c", "isPublic": true }, { "controlId": "CIP-012-1-1.2", "title": "CIP-012-1-1.2 — Identification of where the Responsible Entity applied security protection for transmitting Real-time Assessment and...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-012-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0e85756d-43ed-5d2e-9408-6feea02dedc3", "isPublic": true }, { "controlId": "CIP-012-1-1.3", "title": "CIP-012-1-1.3 — If the Control Centers are owned or operated by different Responsible Entities, identification of the responsibilitie...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-012-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3a898593-fa84-5831-9652-0fc1b2518558", "isPublic": true }, { "controlId": "CIP-012-2-1.1", "title": "CIP-012-2-1.1 — Risk Mitigation for Availability, Integrity, and Confidentiality of Real-Time Data (CIP-012-2)", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-012-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "db86e540-2ee2-556f-b692-4d06ce39b558", "isPublic": true }, { "controlId": "IEC-62645-7.3.4", "title": "IEC-62645-7.3.4 — Cryptographic Integrity and Authentication Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "1395e0fd-ca1f-5bd4-ad41-41116335950b", "isPublic": true }, { "controlId": "IEC-63096-10.1", "title": "IEC-63096-10.1 — Cryptographic Controls Policy and Key Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "5251ce30-b9d1-5557-82b4-ccfad6c5d7de", "isPublic": true } ], "id": 31227, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731007", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731007", "catalogueId": 1062, "uuid": "6ed8dd1e-acea-5f34-967e-0ca76905f5dd", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Are cryptographic mechanisms utilized to protect the confidentiality of data being transmitted?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Transmission Confidentiality", "description": "

Control Description

Cryptographic mechanisms exist to protect the confidentiality of data being transmitted.

Evidence Request List (ERL)

E-CRY-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cryptographic Protections (CRY) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CRY domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Cryptography management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel provide an encryption solution (software or hardware) for the storage of sensitive/regulated data.\n▪ Sensitive/regulated data is encrypted in transit according to standardized processes.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.\n▪ External compliance requirements for cryptography are identified and documented, based on applicable laws, regulations and contractual obligations.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to implement cryptographic mechanisms that are applicability for statutory, regulatory and/or contractual compliance obligations.\n▪ Sensitive/regulated data is encrypted at rest using cryptographic protections that are commensurate with the sensitivity of the data.\n▪ Sensitive/regulated data is encrypted during transmission using cryptographic protections that are commensurate with the sensitivity of the data.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational cryptographic capability exists to protect the confidentiality of data being transmitted.

Level 4 - Quantitatively Controlled: Cryptographic Protections (CRY) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.6, B.3.7
NERC-CIP (2026) Requirements: CIP-005-7-R2, CIP-012-1-R1", "controlId": "CRY-03", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-03", "references": "

Micro-Small Business (<10 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Transport Layer Security (TLS)\n∙ IPSec encryption\n∙ Encrypted Multiprotocol Label Switching (MPLS)

Small Business (10-49 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Transport Layer Security (TLS)\n∙ IPSec encryption\n∙ Encrypted Multiprotocol Label Switching (MPLS)

Medium Business (50-249 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Transport Layer Security (TLS)\n∙ IPSec encryption\n∙ Encrypted Multiprotocol Label Switching (MPLS)

Large Business (250-999 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Transport Layer Security (TLS)\n∙ IPSec encryption\n∙ Encrypted Multiprotocol Label Switching (MPLS)

Enterprise (>1,000 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Transport Layer Security (TLS)\n∙ IPSec encryption\n∙ Encrypted Multiprotocol Label Switching (MPLS)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70701, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590298", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590298", "securityControlId": 31228, "ccis": [], "uuid": "aab2ada3-5243-5057-9b5a-0c984ec00555", "testId": "CRY-04_A01", "test": "the integrity of transmitted information is/are protected.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-08\n53A_R5_SC-08_ODP", "defaultText": null }, { "id": 70702, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590298", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590298", "securityControlId": 31228, "ccis": [], "uuid": "4bd2908b-0f69-5913-ad7d-9dcab95f3fa4", "testId": "CRY-04_A02", "test": "cryptographic uses are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-13_ODP[01]", "defaultText": null }, { "id": 70703, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590298", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590298", "securityControlId": 31228, "ccis": [], "uuid": "41e5d49c-7e54-566e-b3ec-bfbde4d39f70", "testId": "CRY-04_A03", "test": "information requiring cryptographic protection is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-28(01)_ODP[01]", "defaultText": null }, { "id": 70704, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590299", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590299", "securityControlId": 31228, "ccis": [], "uuid": "7852d765-c53e-530e-acfc-c3918930c5e2", "testId": "CRY-04_A04", "test": "system components or media requiring cryptographic protection is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-28(01)_ODP[02]", "defaultText": null }, { "id": 70705, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590299", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590299", "securityControlId": 31228, "ccis": [], "uuid": "4902ee93-c017-51e1-b928-6d9ef16669b0", "testId": "CRY-04_A05", "test": "types of cryptography for each specified cryptographic use are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-13_ODP[02]", "defaultText": null }, { "id": 70706, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590299", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590299", "securityControlId": 31228, "ccis": [], "uuid": "2ffb16e3-ce21-5681-bd5a-7868fe4bbd17", "testId": "CRY-04_A06", "test": "the integrity of transmitted cybersecurity / data privacy attributes is verified.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-16(01)[01]\n53A_R5_SC-16(01)[02]", "defaultText": null }, { "id": 70707, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590299", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590299", "securityControlId": 31228, "ccis": [], "uuid": "f21f63a2-fd0b-5cdc-bcb0-38ad3d7488b6", "testId": "CRY-04_A07", "test": "cryptographic mechanisms are implemented to prevent unauthorized disclosure of information at rest on system components or media.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-28(01)[01]", "defaultText": null }, { "id": 70708, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590299", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590299", "securityControlId": 31228, "ccis": [], "uuid": "026b764e-f31c-5829-8ad1-1e7221b3a7ea", "testId": "CRY-04_A08", "test": "cryptographic mechanisms are implemented to prevent unauthorized modification of information at rest on system components or media.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-28(01)[02]", "defaultText": null } ], "externalMappings": [ { "id": 565824, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1ff239b-2c95-5160-a07c-427485ef263e", "parentControlId": 31228, "controlId": "DATA 1.7", "title": "DATA 1.7", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584189" }, { "id": 565825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0f8c7ff-8150-53e1-9073-f5cd4b914d19", "parentControlId": 31228, "controlId": "SR 3.1", "title": "SR 3.1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584189" }, { "id": 565826, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cd5cba2-95c3-540d-8d8b-1c2f4eae6dd4", "parentControlId": 31228, "controlId": "SR 3.1 RE 1", "title": "SR 3.1 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584189" }, { "id": 565827, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c943dc99-84c6-52c1-a2a2-84527aff5403", "parentControlId": 31228, "controlId": "CR 3.1", "title": "CR 3.1", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58419" }, { "id": 565828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45821606-7361-51eb-bd69-bce1f5ae0b71", "parentControlId": 31228, "controlId": "CR 3.1(1)", "title": "CR 3.1(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58419" }, { "id": 565829, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7809ef1-0a34-5553-a57f-9534d23778ae", "parentControlId": 31228, "controlId": "8.24", "title": "8.24", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58419" }, { "id": 565830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34dd7da4-d419-5fe6-a36f-cf7de383cbfe", "parentControlId": 31228, "controlId": "8.26", "title": "8.26", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58419" }, { "id": 565835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "085840d5-e238-5492-b7ec-d67123fbc8dd", "parentControlId": 31228, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58419" }, { "id": 565836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abb8325d-ad6c-53f3-8510-e20ae1d17dfe", "parentControlId": 31228, "controlId": "T1040", "title": "T1040", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584191" }, { "id": 565837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "185271b6-9c5a-537e-8a86-0b3960292a4b", "parentControlId": 31228, "controlId": "T1090", "title": "T1090", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584191" }, { "id": 565838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d78ad292-13ae-57b8-9a8d-0a6903be4e01", "parentControlId": 31228, "controlId": "T1090.004", "title": "T1090.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584191" }, { "id": 565839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53a9edf8-e365-5167-833d-b83ea457c3f2", "parentControlId": 31228, "controlId": "T1550.001", "title": "T1550.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584191" }, { "id": 565840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db842a31-7cb6-52c1-a388-76e48a185bcc", "parentControlId": 31228, "controlId": "T1550.004", "title": "T1550.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584191" }, { "id": 565841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5161696-c3b3-56a3-9ce2-6d0170bbca03", "parentControlId": 31228, "controlId": "T1552.007", "title": "T1552.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584191" }, { "id": 565842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62554ef7-9f2b-5c4d-91e5-426157bf1055", "parentControlId": 31228, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584191" }, { "id": 565843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "202a8a76-3f42-5013-9cf6-dd39054879fa", "parentControlId": 31228, "controlId": "T1557.001", "title": "T1557.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584191" }, { "id": 565844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1530a3d9-6176-522c-969b-b9c764eca5e0", "parentControlId": 31228, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584192" }, { "id": 565845, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e405fcf1-3e5d-5262-ac41-6bd2fc164b03", "parentControlId": 31228, "controlId": "T1557.003", "title": "T1557.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584192" }, { "id": 565846, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "182237c0-3926-59bd-9940-7a96e256a047", "parentControlId": 31228, "controlId": "T1557.004", "title": "T1557.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584192" }, { "id": 565847, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26d7322f-0d3b-5049-8cd3-ec3a350354ff", "parentControlId": 31228, "controlId": "T1562", "title": "T1562", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584192" }, { "id": 565848, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b222103-d0f9-5d46-bfe8-7734125200b1", "parentControlId": 31228, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584192" }, { "id": 565849, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad4e8310-e105-5d1e-aa7f-d62b4508555d", "parentControlId": 31228, "controlId": "T1562.009", "title": "T1562.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584192" }, { "id": 565850, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b546a4ba-338e-5ca1-9aa5-da0daa197760", "parentControlId": 31228, "controlId": "T1562.010", "title": "T1562.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584192" }, { "id": 565851, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7bbfe8de-9b3d-5e88-91e0-fbb8e1f1ccdd", "parentControlId": 31228, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584192" }, { "id": 565852, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfa09baf-f136-5005-b162-5ec72400c08f", "parentControlId": 31228, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584192" }, { "id": 565853, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b109e61-fc4d-5833-af85-38affce02f6c", "parentControlId": 31228, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584193" }, { "id": 565854, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b047c08d-5856-56c6-8c2e-fd70306031f8", "parentControlId": 31228, "controlId": "T1622", "title": "T1622", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584193" }, { "id": 565856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9636c616-350e-5906-9b0a-acedbe7b6ebc", "parentControlId": 31228, "controlId": "SC-8", "title": "SC-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584193" }, { "id": 565857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96a73ccf-023a-56cc-a175-7b1843a09d42", "parentControlId": 31228, "controlId": "SC-16(1)", "title": "SC-16(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584193" }, { "id": 565858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9554261-61e7-58c5-b8dd-7a7202ab5c99", "parentControlId": 31228, "controlId": "SC-28(1)", "title": "SC-28(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584193" }, { "id": 565859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ac4ebcf-4780-5844-96f8-590164ca53bb", "parentControlId": 31228, "controlId": "SC-08", "title": "SC-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584193" }, { "id": 565860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f67a8c3-40a1-53b8-96d4-06e63184c0ea", "parentControlId": 31228, "controlId": "SC-16(01)", "title": "SC-16(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584193" }, { "id": 565861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54d15a01-8dff-51f7-8705-f5ac3ec6939d", "parentControlId": 31228, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584193" }, { "id": 565865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06b5dbe3-8459-5199-a47e-010d0dda4d83", "parentControlId": 31228, "controlId": "SC-08", "title": "SC-08", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584194" }, { "id": 565866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85a1a427-7da2-50d8-9027-127a18610317", "parentControlId": 31228, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584194" }, { "id": 565867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91f3fc2f-8fe5-5865-b7da-eeb8ef30a001", "parentControlId": 31228, "controlId": "SC-08", "title": "SC-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584194" }, { "id": 565868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46bad80e-0a77-5ce2-b15f-f9882102c3f7", "parentControlId": 31228, "controlId": "SC-16(01)", "title": "SC-16(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584194" }, { "id": 565869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ee1364a-dfa9-5f9d-a844-17968a126f0d", "parentControlId": 31228, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584194" }, { "id": 565870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d677bdcf-d25a-54aa-9080-1475241b55b0", "parentControlId": 31228, "controlId": "SC-08", "title": "SC-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584194" }, { "id": 565871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74a23ccb-d201-54d1-801b-eea2cd13f0db", "parentControlId": 31228, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584195" }, { "id": 565872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bad8edd-cdb6-537a-993a-0eba2d2e4c26", "parentControlId": 31228, "controlId": "SC-08", "title": "SC-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584195" }, { "id": 565873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc61f802-5123-5cfb-9364-d65fac4a1ab6", "parentControlId": 31228, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584195" }, { "id": 565876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de34cbc0-b463-5d02-aeca-1ff446c3399f", "parentControlId": 31228, "controlId": "SC-8", "title": "SC-8", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584195" }, { "id": 565877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54708c40-12c7-539d-bf5b-8837bd5e0bcf", "parentControlId": 31228, "controlId": "SC-8", "title": "SC-8", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584195" }, { "id": 565880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a81b5842-cad8-537d-8d7e-0aa6a5492355", "parentControlId": 31228, "controlId": "NFO - SI-1", "title": "NFO - SI-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584196" }, { "id": 565882, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f9ada9b-7be3-5e30-b70a-8299da3c4180", "parentControlId": 31228, "controlId": "PR.DS-02", "title": "PR.DS-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584196" }, { "controlId": "B.3.20", "title": "B.3.20 — Confidentiality of Information at Rest", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-28", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "7251de00-87e8-5489-8e47-61f678f4d93a", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.20", "title": "NEI 08-09 App D.3.20 — Confidentiality of Information at Rest", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.20", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "15983594-cfa8-5d13-898b-2e4aa764231a", "isPublic": true }, { "controlId": "10 CFR 73.54(a)(2)", "title": "10 CFR 73.54(a)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.20", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "04cb028e-894b-562a-81e2-3d617178043e", "isPublic": true }, { "controlId": "IEC-62645-7.3.4", "title": "IEC-62645-7.3.4 — Cryptographic Integrity and Authentication Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "70c65c56-b19e-5c64-bd63-465f4b6daa9a", "isPublic": true }, { "controlId": "IEC-63096-10.1", "title": "IEC-63096-10.1 — Cryptographic Controls Policy and Key Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "6ce699cb-e478-5736-b181-96ef61267f0c", "isPublic": true } ], "id": 31228, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731008", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731008", "catalogueId": 1062, "uuid": "aa3cb8e8-1949-5dc9-94b3-8a52e983c7c8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Are cryptographic mechanisms utilized to protect the integrity of data being transmitted?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Transmission Integrity", "description": "

Control Description

Cryptographic mechanisms exist to protect the integrity of data being transmitted.

Evidence Request List (ERL)

E-CRY-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cryptographic Protections (CRY) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CRY domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Cryptography management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel provide an encryption solution (software or hardware) for the storage of sensitive/regulated data.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.\n▪ External compliance requirements for cryptography are identified and documented, based on applicable laws, regulations and contractual obligations.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to implement cryptographic mechanisms that are applicability for statutory, regulatory and/or contractual compliance obligations.\n▪ Sensitive/regulated data is encrypted at rest using cryptographic protections that are commensurate with the sensitivity of the data.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational cryptographic capability exists to protect the integrity of data being transmitted.

Level 4 - Quantitatively Controlled: Cryptographic Protections (CRY) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.20", "controlId": "CRY-04", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-04", "references": "

Micro-Small Business (<10 staff)

∙ Enable encryption for sensitive files (e.g., VeraCrypt, BitLocker)

Small Business (10-49 staff)

∙ Full disk encryption\n∙ TLS for data in transit

Medium Business (50-249 staff)

∙ Enterprise encryption standards policy\n∙ PKI management

Large Business (250-999 staff)

∙ Enterprise PKI\n∙ HSM for key management\n∙ Certificate lifecycle management

Enterprise (>1,000 staff)

∙ Enterprise HSM (e.g., Thales, AWS CloudHSM)\n∙ Enterprise PKI\n∙ Automated certificate management (e.g., Venafi)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70709, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590299", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590299", "securityControlId": 31229, "ccis": [], "uuid": "a6fb5f7a-1717-5a6b-b729-fddc0d9c9dfa", "testId": "CRY-05_A01", "test": "the confidentiality of sensitive / regulated data stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.8.6\n53A_R5_SC-13b.", "defaultText": null }, { "id": 70710, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5903", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5903", "securityControlId": 31229, "ccis": [], "uuid": "e155e2cd-e6da-5b62-a988-3f68832c2fd4", "testId": "CRY-05_A02", "test": "cryptographic mechanisms are implemented to prevent the unauthorized disclosure of sensitive / regulated data while in storage.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70711, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5903", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5903", "securityControlId": 31229, "ccis": [], "uuid": "d9b16f39-220a-5a2b-b97f-eb5f6526d338", "testId": "CRY-05_A03", "test": "cryptographic uses are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-13_ODP[01]\n53A_R5_SC-13a.", "defaultText": null }, { "id": 70712, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5903", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5903", "securityControlId": 31229, "ccis": [], "uuid": "d207af5c-d040-5e25-8996-321af65011a3", "testId": "CRY-05_A04", "test": "information requiring cryptographic protection is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-28(01)_ODP[01]", "defaultText": null }, { "id": 70713, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5903", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5903", "securityControlId": 31229, "ccis": [], "uuid": "036e4602-4a8a-5ed2-9407-3e7874b13bd4", "testId": "CRY-05_A05", "test": "system components or media requiring cryptographic protection is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-28(01)_ODP[02]", "defaultText": null }, { "id": 70714, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5903", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5903", "securityControlId": 31229, "ccis": [], "uuid": "8880e7e8-edae-58f0-8200-f105f166a2ff", "testId": "CRY-05_A06", "test": "the types of cryptography for protecting the confidentiality of sensitive / regulated data are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-13_ODP[02]", "defaultText": null }, { "id": 70715, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590301", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590301", "securityControlId": 31229, "ccis": [], "uuid": "2affcdfc-ac22-57bf-a390-6ecfa7f499fd", "testId": "CRY-05_A07", "test": "organization-defined types of cryptography are implemented to protect the confidentiality of sensitive / regulated data.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 70716, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590301", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590301", "securityControlId": 31229, "ccis": [], "uuid": "ffc6a526-ef5e-5e5b-892e-42033576ec3e", "testId": "CRY-05_A08", "test": "cryptographic mechanisms are implemented to prevent the unauthorized disclosure of CUI while in storage.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.13.08[02]", "defaultText": null }, { "id": 70717, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590301", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590301", "securityControlId": 31229, "ccis": [], "uuid": "3c263e57-cb45-5c6a-ae96-2dab295fd665", "testId": "CRY-05_A09", "test": "the types of cryptography for protecting the confidentiality of CUI are defined.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.13.11.ODP[01]", "defaultText": null }, { "id": 70718, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590301", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590301", "securityControlId": 31229, "ccis": [], "uuid": "30280ceb-4686-5882-9072-3fd359b5a228", "testId": "CRY-05_A10", "test": "the following types of cryptography are implemented to protect the confidentiality of CUI: .
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171
SCF Defined Parameters: FIPS Validated Cryptography\n(https://csrc.nist.gov/Projects/Cryptographic-ModuleValidation-Program/Validated-Modules)", "otherId": "171A_R3_A.03.13.11", "defaultText": null } ], "externalMappings": [ { "id": 565964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584205", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a9e5158-2adc-5107-a9b7-3e19bebe83b6", "parentControlId": 31229, "controlId": "CR 4.1(a)", "title": "CR 4.1(a)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584205" }, { "id": 565965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584205", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cfa92fd-bfbc-5422-95b4-ba51d2edee34", "parentControlId": 31229, "controlId": "8.24", "title": "8.24", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584205" }, { "id": 565968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584206", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcae929e-fc1c-5fb6-9b23-2647bbc981fb", "parentControlId": 31229, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584206" }, { "id": 565969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584206", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b9fb86b-36c6-5aff-b000-67ce6f80af17", "parentControlId": 31229, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584206" }, { "id": 565970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584206", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ee72cb2-c881-5118-9e0d-95c34e7e9579", "parentControlId": 31229, "controlId": "T1003.002", "title": "T1003.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584206" }, { "id": 565971, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584206", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55f918ed-7a99-5c79-9924-c103e5cb4b0f", "parentControlId": 31229, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584206" }, { "id": 565972, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584206", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c247ef7-6f0e-5387-aec7-39b67b92731f", "parentControlId": 31229, "controlId": "T1003.004", "title": "T1003.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584206" }, { "id": 565973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584206", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1eae455b-5ae6-58e7-b0d4-5c1f2ee3230f", "parentControlId": 31229, "controlId": "T1003.005", "title": "T1003.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584206" }, { "id": 565974, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584206", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39e305e9-48ad-59e5-965e-a316b7abd66a", "parentControlId": 31229, "controlId": "T1003.006", "title": "T1003.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584206" }, { "id": 565975, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b762adc-6b01-5367-949b-fa38f82b7091", "parentControlId": 31229, "controlId": "T1003.007", "title": "T1003.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584207" }, { "id": 565976, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40d66b49-0006-5942-acd6-e2e37a6a12e8", "parentControlId": 31229, "controlId": "T1003.008", "title": "T1003.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584207" }, { "id": 565977, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "754127a4-0021-5696-b39c-cfa7240e3a12", "parentControlId": 31229, "controlId": "T1005", "title": "T1005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584207" }, { "id": 565978, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4458ffa-a63a-5a97-847b-2c9cb764cc19", "parentControlId": 31229, "controlId": "T1025", "title": "T1025", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584207" }, { "id": 565979, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91cf6d88-9b9c-5b0e-b887-6d4b03690b34", "parentControlId": 31229, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584207" }, { "id": 565980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "191622b6-8d79-5bc3-9613-ac40860a9ad4", "parentControlId": 31229, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584207" }, { "id": 565981, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "147c9d45-1d62-5c9b-ab6a-c445517ec891", "parentControlId": 31229, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584207" }, { "id": 565982, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7e41277-03df-5fa7-8477-2d0575fdd116", "parentControlId": 31229, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584207" }, { "id": 565983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ebb6359-1cb3-5779-9fdb-bb9a010ade2d", "parentControlId": 31229, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584207" }, { "id": 565984, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "195c318a-446b-5d79-9562-0057cb734b6a", "parentControlId": 31229, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584208" }, { "id": 565985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfe00920-229d-55eb-92ab-668609e6921b", "parentControlId": 31229, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584208" }, { "id": 565986, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c0ecd6d-939e-5dfb-8a86-21ad71925590", "parentControlId": 31229, "controlId": "T1078.001", "title": "T1078.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584208" }, { "id": 565987, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c301de2-7a40-5684-8b15-9656f2826cb4", "parentControlId": 31229, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584208" }, { "id": 565988, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a6c74b3-786c-58bb-88df-38179fbc6560", "parentControlId": 31229, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584208" }, { "id": 565989, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a2712a1-46dc-5284-9258-9286b84942f2", "parentControlId": 31229, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584208" }, { "id": 565990, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9d68f04-c878-527d-8df0-2e34d807a9ae", "parentControlId": 31229, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584208" }, { "id": 565991, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb595831-dfe4-5bf1-bc71-c12b65faa39f", "parentControlId": 31229, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584208" }, { "id": 565992, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71bd9ebb-a68a-5781-b513-c22d23f4803c", "parentControlId": 31229, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584209" }, { "id": 565993, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98c70ddf-808c-57c1-991e-ce444ce0ed41", "parentControlId": 31229, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584209" }, { "id": 565994, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc64305c-f997-50a9-ba19-596c24f8ce0f", "parentControlId": 31229, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584209" }, { "id": 565995, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d7dd87b-dfec-5d38-8035-56306f606d52", "parentControlId": 31229, "controlId": "T1550.001", "title": "T1550.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584209" }, { "id": 565996, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2272a350-0463-53ae-91df-d898edae4ecb", "parentControlId": 31229, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584209" }, { "id": 565997, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc071f8d-c740-5917-a1da-d0eb6707999c", "parentControlId": 31229, "controlId": "T1552.001", "title": "T1552.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584209" }, { "id": 565998, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9350f58f-e107-5937-8127-c7b4533b807d", "parentControlId": 31229, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584209" }, { "id": 565999, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90937e0c-6ba4-5e5a-ba1d-521ac79e7d5a", "parentControlId": 31229, "controlId": "T1552.003", "title": "T1552.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584209" }, { "id": 566000, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a83414e-fc36-5933-af69-a0168b4cf7e6", "parentControlId": 31229, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584209" }, { "id": 566001, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee991f1d-a00c-5a9e-be6c-6239225b7a93", "parentControlId": 31229, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584209" }, { "id": 566002, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f45ef62-0d79-5f8d-8491-715c3537a9c4", "parentControlId": 31229, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58421" }, { "id": 566003, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07a832a5-998d-5da0-be04-ee28bb0c5cd4", "parentControlId": 31229, "controlId": "T1565.003", "title": "T1565.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58421" }, { "id": 566004, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e4b0216-8b79-59af-b7b1-2c1ca72fa7f6", "parentControlId": 31229, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58421" }, { "id": 566005, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8343d7df-51f3-58ff-9b11-75d42ebd2b04", "parentControlId": 31229, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58421" }, { "id": 566006, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d226df04-5326-5bf1-9768-5647134b3a54", "parentControlId": 31229, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58421" }, { "id": 566007, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a6754d1-b8d4-5370-813f-61e7cd60414d", "parentControlId": 31229, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58421" }, { "id": 566008, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36e058d9-0818-50e2-9d0e-280e6ed5bb34", "parentControlId": 31229, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58421" }, { "id": 566009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "643d1a00-22a8-5a9b-bc8f-0b2e472c44b7", "parentControlId": 31229, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58421" }, { "id": 566014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dadef95a-216f-5d2b-a8db-b4ea9035d95c", "parentControlId": 31229, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584211" }, { "id": 566015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "463f4fe5-2608-5e91-9c22-30849f55d6db", "parentControlId": 31229, "controlId": "SC-28", "title": "SC-28", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584211" }, { "id": 566016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2ff4094-75a4-5dc6-a7e8-5dd6c17863c1", "parentControlId": 31229, "controlId": "SC-28(1)", "title": "SC-28(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584211" }, { "id": 566017, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584212", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e89fe350-0cfd-52cf-9e0f-d6019896b706", "parentControlId": 31229, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584212" }, { "id": 566018, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584212", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "219bd814-19a7-50e9-ba57-aef111908398", "parentControlId": 31229, "controlId": "SC-28", "title": "SC-28", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584212" }, { "id": 566019, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584212", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba273637-532c-5f45-8ba3-f911376af363", "parentControlId": 31229, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584212" }, { "id": 566023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584212", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f250bee-516a-5a54-8102-ae84a81ec0aa", "parentControlId": 31229, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584212" }, { "id": 566024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584212", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8c6cd8a-2e91-551a-844d-4bbedb984fdf", "parentControlId": 31229, "controlId": "SC-28", "title": "SC-28", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584212" }, { "id": 566025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584212", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5304a8a3-eabb-518b-b3b3-88c5837ec139", "parentControlId": 31229, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584212" }, { "id": 566026, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584212", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b8a950c-bf52-576d-9d76-530bb9acd4b7", "parentControlId": 31229, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584212" }, { "id": 566027, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584213", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "116e41d1-59d1-5d85-942f-e6d0ec4a740e", "parentControlId": 31229, "controlId": "SC-28", "title": "SC-28", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584213" }, { "id": 566028, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584213", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6eff83e1-a42f-52ee-96a8-0a1af5b8e8b2", "parentControlId": 31229, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584213" }, { "id": 566029, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584213", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c64a6e4-22a6-544d-9322-521e13f6f158", "parentControlId": 31229, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584213" }, { "id": 566030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584213", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78ce4579-7b93-5e85-8687-0cb8714da892", "parentControlId": 31229, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584213" }, { "id": 566031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584213", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5bf703f-5b4f-5fdc-9c4a-30fa08ef568c", "parentControlId": 31229, "controlId": "SC-28", "title": "SC-28", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584213" }, { "id": 566032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584213", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3204cdf-d10b-50de-ad61-ea7959e914e6", "parentControlId": 31229, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584213" }, { "id": 566033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584213", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd6d98bb-8b5e-5365-ac8b-1623d03cbb42", "parentControlId": 31229, "controlId": "SC-13", "title": "SC-13", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584213" }, { "id": 566034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584213", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0bca41fa-fd8a-5312-995d-09ce7a2ebe40", "parentControlId": 31229, "controlId": "SC-28", "title": "SC-28", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584213" }, { "id": 566035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584213", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94f4b9e3-dc7a-5169-a822-b6e1f30c1d10", "parentControlId": 31229, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584213" }, { "id": 566037, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584214", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d85d51fa-5a3b-52a9-ab46-aca09f13e1ef", "parentControlId": 31229, "controlId": "SC-28", "title": "SC-28", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584214" }, { "id": 566038, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584214", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b49f01c3-0026-55b9-9aa0-b36bfe67f74d", "parentControlId": 31229, "controlId": "SC-28", "title": "SC-28", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584214" }, { "id": 566041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e450bcb1-eda2-54ec-b79e-a76ffb656db5", "parentControlId": 31229, "controlId": "3.8.6", "title": "3.8.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584222" }, { "id": 566042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6452788c-29dc-5830-9b59-821a2fb4f45a", "parentControlId": 31229, "controlId": "3.13.16", "title": "3.13.16", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584222" }, { "id": 566043, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fcb612c-d064-5293-b719-e660875a932d", "parentControlId": 31229, "controlId": "03.13.08", "title": "03.13.08", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584223" }, { "id": 566048, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73fccdf2-175c-5fdf-a976-3123fadf323f", "parentControlId": 31229, "controlId": "PR.DS-01", "title": "PR.DS-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584223" }, { "id": 566074, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d440b49f-05aa-5946-895a-ea10377a509c", "parentControlId": 31229, "controlId": "ARCHITECTURE-5a", "title": "ARCHITECTURE-5a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584226" }, { "id": 566075, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea5a8912-52b9-58ba-b3a9-38b7146a686b", "parentControlId": 31229, "controlId": "ARCHITECTURE-5b", "title": "ARCHITECTURE-5b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584226" }, { "id": 566076, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92f105ba-62eb-5ef0-bf53-60c578733b4a", "parentControlId": 31229, "controlId": "ARCHITECTURE-5d", "title": "ARCHITECTURE-5d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584226" }, { "id": 566118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584232", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1c44bf7-b814-587f-b559-174651e1cbcf", "parentControlId": 31229, "controlId": "B3.c", "title": "B3.c", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584232" }, { "controlId": "B.3.10", "title": "B.3.10 — Use of Cryptography", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-13", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "6907c4b0-01de-53b7-811d-dc113ee8816d", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.10", "title": "NEI 08-09 App D.3.10 — Use of Cryptography", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.10", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "1e196422-3809-5017-ba1b-ca157b9084c4", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.10", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "383eb7ff-d0ea-5a17-ad7a-b11087187c96", "isPublic": true }, { "controlId": "B.3.20", "title": "B.3.20 — Confidentiality of Information at Rest", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-28", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "2eae56bb-ee41-5483-9a68-7898cdbcdff3", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.20", "title": "NEI 08-09 App D.3.20 — Confidentiality of Information at Rest", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.20", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "ea4f56b7-90ec-5c6d-821d-74d0561825a3", "isPublic": true }, { "controlId": "10 CFR 73.54(a)(2)", "title": "10 CFR 73.54(a)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.20", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "3f9d8e56-bf0e-5cf4-b725-5ea6fe519354", "isPublic": true }, { "controlId": "B.4.9", "title": "B.4.9 — Cryptographic Module Authentication", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IA-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "eb1ac481-254a-5a0d-9dda-35a11b4cb47e", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.9", "title": "NEI 08-09 App D.4.9 — Cryptographic Module Authentication", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.9", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "9e43abfa-e64e-5cd9-8b0b-c4147916eb4d", "isPublic": true }, { "controlId": "IEC-62645-7.3.4", "title": "IEC-62645-7.3.4 — Cryptographic Integrity and Authentication Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "20090dd9-2753-556d-acba-c721ae35bdd9", "isPublic": true }, { "controlId": "IEC-63096-10.1", "title": "IEC-63096-10.1 — Cryptographic Controls Policy and Key Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "549d88c7-498e-5b3b-b7c6-5156383b920c", "isPublic": true } ], "id": 31229, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731008", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731008", "catalogueId": 1062, "uuid": "26548376-d4fb-5faa-9fcf-519dba4d9d2d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Are cryptographic mechanisms utilized to prevent unauthorized disclosure of data at rest?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Encrypting Data At Rest", "description": "

Control Description

Cryptographic mechanisms exist to prevent unauthorized disclosure of data at rest.

Evidence Request List (ERL)

E-CRY-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cryptographic Protections (CRY) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CRY domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Cryptography management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel provide an encryption solution (software or hardware) for the storage of sensitive/regulated data.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.\n▪ External compliance requirements for cryptography are identified and documented, based on applicable laws, regulations and contractual obligations.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to implement cryptographic mechanisms that are applicability for statutory, regulatory and/or contractual compliance obligations.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational cryptographic capability exists to prevent unauthorized disclosure of data at rest.

Level 4 - Quantitatively Controlled: Cryptographic Protections (CRY) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.10, B.3.20, B.4.9", "controlId": "CRY-05", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-05", "references": "

Micro-Small Business (<10 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Microsoft BitLocker (https://microsoft.com)

Small Business (10-49 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Microsoft BitLocker (https://microsoft.com)

Medium Business (50-249 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Microsoft BitLocker (https://microsoft.com)

Large Business (250-999 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Microsoft BitLocker (https://microsoft.com)

Enterprise (>1,000 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Microsoft BitLocker (https://microsoft.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70719, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590301", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590301", "securityControlId": 31230, "ccis": [], "uuid": "1556409a-3e5c-5aa0-b04b-99bb165b2cbe", "testId": "CRY-05.1_A01", "test": "storage media types are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70720, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590301", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590301", "securityControlId": 31230, "ccis": [], "uuid": "c05fe0cc-20ef-55f4-948f-05a21e0cec48", "testId": "CRY-05.1_A02", "test": "cryptographic mechanisms protect the confidentiality and integrity of the sensitive data residing on storage media.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 566138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e94fbb47-1005-56a0-a061-b41b30a118d0", "parentControlId": 31230, "controlId": "03.13.08", "title": "03.13.08", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584234" } ], "id": 31230, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731009", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731009", "catalogueId": 1062, "uuid": "aec79bf8-0e1f-5144-9b6e-934600a9acfe", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Are cryptographic mechanisms utilized to protect the confidentiality and integrity of sensitive/regulated data residing on storage media?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Storage Media", "description": "

Control Description

Cryptographic mechanisms exist to protect the confidentiality and integrity of sensitive/regulated data residing on storage media.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational cryptographic capability exists to protect the confidentiality and integrity of sensitive/regulated data residing on storage media.

Level 4 - Quantitatively Controlled: Cryptographic Protections (CRY) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CRY-05.1", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-05.1", "references": "

Micro-Small Business (<10 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Microsoft BitLocker (https://microsoft.com)

Small Business (10-49 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Microsoft BitLocker (https://microsoft.com)

Medium Business (50-249 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Microsoft BitLocker (https://microsoft.com)

Large Business (250-999 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Microsoft BitLocker (https://microsoft.com)

Enterprise (>1,000 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Microsoft BitLocker (https://microsoft.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70721, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590302", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590302", "securityControlId": 31231, "ccis": [], "uuid": "b6eed719-1b1e-5e22-92b3-1fbacadf7577", "testId": "CRY-05.2_A01", "test": "persistent organizational storage locations are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.5e[a]", "defaultText": null }, { "id": 70722, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590302", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590302", "securityControlId": 31231, "ccis": [], "uuid": "87d237d6-e91c-528c-9e52-355622e3bb59", "testId": "CRY-05.2_A02", "test": "recurring reviews of persistent organizational storage locations are conducted to identify sensitive / regulated data that is no longer needed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.5e[b]", "defaultText": null }, { "id": 70723, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590302", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590302", "securityControlId": 31231, "ccis": [], "uuid": "f92244f2-a08e-54e3-b91d-1bff59e14e91", "testId": "CRY-05.2_A03", "test": "the frequency with which to conduct reviews of persistent organizational storage locations is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "172A_3.14.5e_ODP[1]", "defaultText": null }, { "id": 70724, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590302", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590302", "securityControlId": 31231, "ccis": [], "uuid": "db220a91-a98e-5b34-99cd-91c4473b3cb3", "testId": "CRY-05.2_A04", "test": "information to be removed from online storage and stored offline in a secure location is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-28(02)_ODP", "defaultText": null }, { "id": 70725, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590302", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590302", "securityControlId": 31231, "ccis": [], "uuid": "5b1689b3-3eb1-5e84-94ca-de561688f019", "testId": "CRY-05.2_A05", "test": "information is removed from online storage.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-28(02)[01]", "defaultText": null }, { "id": 70726, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590303", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590303", "securityControlId": 31231, "ccis": [], "uuid": "16cefffe-ca74-54f1-a316-1a7b3fdb347a", "testId": "CRY-05.2_A06", "test": "information is stored offline in a secure location.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-28(02)[02]", "defaultText": null } ], "externalMappings": [ { "id": 566147, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bff5e112-c792-539d-bed1-b9ab5bd772f8", "parentControlId": 31231, "controlId": "SC-28(2)", "title": "SC-28(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584235" }, { "id": 566148, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2b90630-0456-5bc1-b61f-1cfcfcd68b68", "parentControlId": 31231, "controlId": "SC-28(02)", "title": "SC-28(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584235" }, { "id": 566150, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584236", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f18c29a2-e073-5d2c-b8c5-a981faf93f0d", "parentControlId": 31231, "controlId": "SC-28(02)", "title": "SC-28(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584236" } ], "id": 31231, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731009", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731009", "catalogueId": 1062, "uuid": "233f6dcd-349b-5131-9d92-8e682f37513c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization remove unused data from online storage and archive it off-line in a secure location until it can be disposed of according to data retention requirements?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Offline Storage", "description": "

Control Description

Mechanisms exist to remove unused data from online storage and archive it off-line in a secure location until it can be disposed of according to data retention requirements.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cryptographic Protections (CRY) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CRY domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Cryptography management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to remove unused data from online storage and archive it off-line in a secure location until it can be disposed of according to data retention requirements.

Level 4 - Quantitatively Controlled: Cryptographic Protections (CRY) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CRY-05.2", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-05.2", "references": "

Micro-Small Business (<10 staff)

∙ Enable encryption for sensitive files (e.g., VeraCrypt, BitLocker)

Small Business (10-49 staff)

∙ Full disk encryption\n∙ TLS for data in transit

Medium Business (50-249 staff)

∙ Enterprise encryption standards policy\n∙ PKI management

Large Business (250-999 staff)

∙ Enterprise PKI\n∙ HSM for key management\n∙ Certificate lifecycle management

Enterprise (>1,000 staff)

∙ Enterprise HSM (e.g., Thales, AWS CloudHSM)\n∙ Enterprise PKI\n∙ Automated certificate management (e.g., Venafi)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70729, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590303", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590303", "securityControlId": 31234, "ccis": [], "uuid": "ffba7642-5dd9-5cb6-8a70-c4676ad45ff8", "testId": "CRY-07_A01", "test": "configuration requirements are established for each type of wireless access.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-18a.[01]", "defaultText": null }, { "id": 70730, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590303", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590303", "securityControlId": 31234, "ccis": [], "uuid": "621a31d7-ade0-5daa-81cb-f93e3c45ff9f", "testId": "CRY-07_A02", "test": "connection requirements are established for each type of wireless access.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-18a.[02]", "defaultText": null }, { "id": 70731, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590304", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590304", "securityControlId": 31234, "ccis": [], "uuid": "593e1d91-42f0-5309-99ea-97b263de3988", "testId": "CRY-07_A03", "test": "implementation guidance is established for each type of wireless access.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-18a.[03]", "defaultText": null } ], "externalMappings": [ { "id": 566177, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a03aaa8c-33bd-51f4-9cec-654ab1aa0853", "parentControlId": 31234, "controlId": "SR 1.6", "title": "SR 1.6", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584239" }, { "id": 566178, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d47d179-63aa-58ec-8835-83e12fc3c267", "parentControlId": 31234, "controlId": "CR 1.6", "title": "CR 1.6", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584239" }, { "id": 566180, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fae56ac5-c938-5162-8c9a-4ebfbefea298", "parentControlId": 31234, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584239" }, { "id": 566181, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "826ebbca-1497-51d6-9dc0-6f725ce26838", "parentControlId": 31234, "controlId": "SC-40", "title": "SC-40", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584239" }, { "id": 566182, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff3245c0-bc60-5c29-894a-248fe8868046", "parentControlId": 31234, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584239" }, { "id": 566183, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb84b67b-5cf3-5cb9-a112-f15220cf468c", "parentControlId": 31234, "controlId": "SC-40", "title": "SC-40", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584239" }, { "id": 566186, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58424", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5675f71b-5d04-57ef-82e1-97a8a837bd72", "parentControlId": 31234, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58424" }, { "id": 566187, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58424", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0da90d11-07b2-5b21-bc48-b23bf134f786", "parentControlId": 31234, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58424" }, { "id": 566188, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58424", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05c3b24f-92e5-5277-a748-347d397d6a7d", "parentControlId": 31234, "controlId": "SC-40", "title": "SC-40", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58424" }, { "id": 566189, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58424", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b77a5363-e8da-5418-a8c4-a4143611fff7", "parentControlId": 31234, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58424" }, { "id": 566190, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58424", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "822e4c5a-53c4-5c6e-af30-53cd02df742e", "parentControlId": 31234, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58424" }, { "id": 566191, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58424", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad9a8f0a-3dbf-50b4-a43d-b6a231677c8a", "parentControlId": 31234, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58424" }, { "id": 566192, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584241", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e0a5323-bed8-5a41-9b75-0bfb5d8a975c", "parentControlId": 31234, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584241" }, { "id": 566193, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584241", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c341ca5d-5776-5a57-8856-9d1b9a932c0c", "parentControlId": 31234, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584241" }, { "id": 566197, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584241", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e23882d-b222-5626-96c6-a8b8b9284d72", "parentControlId": 31234, "controlId": "03.01.16.a", "title": "03.01.16.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584241" }, { "controlId": "IEC-62645-7.3.4", "title": "IEC-62645-7.3.4 — Cryptographic Integrity and Authentication Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "23b1c9de-25fb-5943-8254-3420ec716640", "isPublic": true }, { "controlId": "IEC-63096-10.1", "title": "IEC-63096-10.1 — Cryptographic Controls Policy and Key Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "b5a3d2b1-b565-5c2b-99eb-cdfdb6d64b3c", "isPublic": true } ], "id": 31234, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73101", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73101", "catalogueId": 1062, "uuid": "528baf93-bade-5cd1-9e35-9f6b691e70c8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect the confidentiality and integrity of wireless networking technologies by implementing authentication and strong encryption?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Wireless Access Authentication & Encryption", "description": "

Control Description

Mechanisms exist to protect the confidentiality and integrity of wireless networking technologies by implementing authentication and strong encryption.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Cryptographic Protections (CRY) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with CRY domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Cryptography management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel provide an encryption solution (software or hardware) for the storage of sensitive/regulated data.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.\n▪ External compliance requirements for cryptography are identified and documented, based on applicable laws, regulations and contractual obligations.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to implement cryptographic mechanisms that are applicability for statutory, regulatory and/or contractual compliance obligations.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to protect the confidentiality and integrity of wireless networking technologies by implementing authentication and strong encryption.

Level 4 - Quantitatively Controlled: Cryptographic Protections (CRY) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CRY-07", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-07", "references": "

Micro-Small Business (<10 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Wi-Fi Protected Access 3 (WPA3)

Small Business (10-49 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Wi-Fi Protected Access 3 (WPA3)

Medium Business (50-249 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Wi-Fi Protected Access 3 (WPA3)

Large Business (250-999 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Wi-Fi Protected Access 3 (WPA3)

Enterprise (>1,000 staff)

∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Wi-Fi Protected Access 3 (WPA3)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70732, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590304", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590304", "securityControlId": 31235, "ccis": [], "uuid": "f12c659a-c342-58df-905f-170b76e796c8", "testId": "CRY-08_A01", "test": "requirements for key generation, distribution, storage, access and destruction are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-12_ODP", "defaultText": null }, { "id": 70733, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590304", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590304", "securityControlId": 31235, "ccis": [], "uuid": "d6f7bd94-17a3-55fd-9663-5d4f9b0c2237", "testId": "CRY-08_A02", "test": "a certificate policy for issuing public key certificates is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-17_ODP", "defaultText": null }, { "id": 70734, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590304", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590304", "securityControlId": 31235, "ccis": [], "uuid": "eb1864ce-2b6c-51e7-b4d1-7fb1c4611140", "testId": "CRY-08_A03", "test": "public key certificates are issued under an organization-defined certificate policy or public key certificates are obtained from an approved service provider.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-17a.", "defaultText": null }, { "id": 70735, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590304", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590304", "securityControlId": 31235, "ccis": [], "uuid": "791d8ed9-9d41-5222-ad97-aeb20511cd0f", "testId": "CRY-08_A04", "test": "only approved trust anchors are included in trust stores or certificate stores managed by the organization.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_SC-17b.", "defaultText": null }, { "id": 70736, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590304", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590305", "securityControlId": 31235, "ccis": [], "uuid": "ce1d029d-001f-5316-87af-4464f09de555", "testId": "CRY-08_A05", "test": "cryptographic keys are established whenever cryptography is employed.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_SC-12[01]\n171A_3.13.10[a]", "defaultText": null }, { "id": 70737, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590308", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590308", "securityControlId": 31235, "ccis": [], "uuid": "537cb8d6-3793-598a-9428-0b2fe5438741", "testId": "CRY-08_A06", "test": "cryptographic keys are managed whenever cryptography is employed.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_SC-12[02]\n171A_3.13.10[b]", "defaultText": null } ], "externalMappings": [ { "id": 566279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ab3ab6a-0e8c-5d7b-995b-c5574530585f", "parentControlId": 31235, "controlId": "CR 1.8", "title": "CR 1.8", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584251" }, { "id": 566280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abdf0c3a-7f2a-5239-8c65-4df322e55d89", "parentControlId": 31235, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584251" }, { "id": 566281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "596b9707-f64f-5646-b4ca-c071ff45e3f2", "parentControlId": 31235, "controlId": "T1098.004", "title": "T1098.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584251" }, { "id": 566282, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e18da603-3f24-519b-aceb-3dff222f4c4e", "parentControlId": 31235, "controlId": "T1521.003", "title": "T1521.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584251" }, { "id": 566283, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b8009de-704c-53a8-b5f2-44e626d7d770", "parentControlId": 31235, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584251" }, { "id": 566284, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8102ee70-76e5-5fb6-9332-205a21d4f8c4", "parentControlId": 31235, "controlId": "T1552.001", "title": "T1552.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584251" }, { "id": 566285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfda8216-13a0-58b0-9507-6b0b977f2fab", "parentControlId": 31235, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584251" }, { "id": 566286, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a895b1ad-a211-5dc0-b212-c2694c07834e", "parentControlId": 31235, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584251" }, { "id": 566287, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36c7968e-6a49-5f0d-91b2-d8f06fdbefee", "parentControlId": 31235, "controlId": "T1563.001", "title": "T1563.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584251" }, { "id": 566288, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8567a59d-bc36-5573-94c5-3b687e41033f", "parentControlId": 31235, "controlId": "T1573", "title": "T1573", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584251" }, { "id": 566289, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f260458-9e76-5af0-81d4-72ae5e7cf19b", "parentControlId": 31235, "controlId": "T1573.001", "title": "T1573.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584252" }, { "id": 566290, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a5e2a35-c801-5815-8f65-9e3e0c8ceb13", "parentControlId": 31235, "controlId": "T1573.002", "title": "T1573.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584252" }, { "id": 566291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4df7ff89-3031-5ed3-8b81-a70a42b5ddd6", "parentControlId": 31235, "controlId": "T1606", "title": "T1606", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584252" }, { "id": 566292, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "870d32c7-232a-533e-96bc-55062b30aa40", "parentControlId": 31235, "controlId": "SC-12", "title": "SC-12", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584252" }, { "id": 566293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "331a96f8-2cbd-5a50-bd9b-40ce0459d501", "parentControlId": 31235, "controlId": "SC-12(4)", "title": "SC-12(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584252" }, { "id": 566294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "924fb377-e458-53d3-8fba-4ff6ae343d4f", "parentControlId": 31235, "controlId": "SC-12(5)", "title": "SC-12(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584252" }, { "id": 566295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93e8a9e9-1d22-5be8-9440-31f354fc120a", "parentControlId": 31235, "controlId": "SC-17", "title": "SC-17", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584252" }, { "id": 566296, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69b3d45b-9b8c-5dae-971a-157638436071", "parentControlId": 31235, "controlId": "SC-12", "title": "SC-12", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584253" }, { "id": 566297, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8f33d67-b542-529f-88f1-b94345b083ad", "parentControlId": 31235, "controlId": "SC-17", "title": "SC-17", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584253" }, { "id": 566298, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe0158da-6a96-5e76-8439-2c5cf764d1d9", "parentControlId": 31235, "controlId": "SC-12", "title": "SC-12", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584253" }, { "id": 566299, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46f047eb-abcb-5627-8283-e7b60c155dd6", "parentControlId": 31235, "controlId": "SC-17", "title": "SC-17", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584253" }, { "id": 566300, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26d10ed0-c542-514c-91d0-9b2c9b43731f", "parentControlId": 31235, "controlId": "SC-12", "title": "SC-12", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584253" }, { "id": 566301, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1ee16d6-5c08-5954-8e5d-5b1dc10f285d", "parentControlId": 31235, "controlId": "SC-17", "title": "SC-17", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584253" }, { "id": 566302, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22a9389e-154e-5a77-8f16-e7b4b6b00362", "parentControlId": 31235, "controlId": "SC-12", "title": "SC-12", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584253" }, { "id": 566303, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4fc3b5d-9666-58b1-9b77-bed4937cb637", "parentControlId": 31235, "controlId": "SC-12", "title": "SC-12", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584253" }, { "id": 566304, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c624b8da-d3e3-53c2-81fe-c64d0a7f15ff", "parentControlId": 31235, "controlId": "SC-17", "title": "SC-17", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584253" }, { "id": 566305, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5f39da6-b0cc-5c87-b8e6-d3ffbc619abe", "parentControlId": 31235, "controlId": "SC-12", "title": "SC-12", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584253" }, { "id": 566306, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8210291b-05f6-51b8-b500-750f52104ff7", "parentControlId": 31235, "controlId": "SC-17", "title": "SC-17", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584254" }, { "id": 566307, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13c4045f-ecab-5a84-b4fa-e070da5a71e3", "parentControlId": 31235, "controlId": "3.13.10", "title": "3.13.10", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584254" }, { "id": 566308, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3f700ea-f786-5bdb-ad6e-a4e5b5be0892", "parentControlId": 31235, "controlId": "03.13.10", "title": "03.13.10", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584254" }, { "controlId": "B.3.9", "title": "B.3.9 — Cryptographic Key Establishment and Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-12", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "dc42da65-54f1-5a34-a917-7f8257a20d39", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.9", "title": "NEI 08-09 App D.3.9 — Cryptographic Key Establishment and Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.9", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "61d875af-9de3-5446-9ae4-b5a8fcece6dc", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.9", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "f81bb797-48af-5ba7-80a8-ee5051b5a7f1", "isPublic": true }, { "controlId": "B.3.13", "title": "B.3.13 — Public Key Infrastructure Certificates", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-17", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a6f95b4a-232a-5ac1-97b1-9a18d52b745c", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.13", "title": "NEI 08-09 App D.3.13 — Public Key Infrastructure Certificates", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.13", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "614df105-dc72-5ccf-a59d-2cc231f5b056", "isPublic": true }, { "controlId": "IEC-62645-7.3.4", "title": "IEC-62645-7.3.4 — Cryptographic Integrity and Authentication Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "c05e8438-c282-555b-8929-11a92632889e", "isPublic": true }, { "controlId": "IEC-63096-10.1", "title": "IEC-63096-10.1 — Cryptographic Controls Policy and Key Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "fd54d83a-15d6-50f4-8a13-ab301f30fcdb", "isPublic": true } ], "id": 31235, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73101", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73101", "catalogueId": 1062, "uuid": "6f26d3ed-2fa3-576a-975d-489cd35fbd5a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization securely implement an internal Public Key Infrastructure (PKI) infrastructure or obtain PKI services from a reputable PKI service provider?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Public Key Infrastructure (PKI)", "description": "

Control Description

Mechanisms exist to securely implement an internal Public Key Infrastructure (PKI) infrastructure or obtain PKI services from a reputable PKI service provider.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.\n▪ External compliance requirements for cryptography are identified and documented, based on applicable laws, regulations and contractual obligations.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to implement cryptographic mechanisms that are applicability for statutory, regulatory and/or contractual compliance obligations.\n▪ The IT department implements Public Key Infrastructure (PKI) key management controls to protect the confidentiality, integrity and availability of keys.\n▪ The IT department implements and maintains an internal PKI infrastructure or obtains PKI services from a reputable PKI service provider.\n▪ The PKI infrastructure enables the secure distribution of symmetric and asymmetric cryptographic keys using industry recognized key management technology and processes.\n▪ The PKI infrastructure ensures the availability of information in the event of the loss of cryptographic keys by individual users.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to securely implement an internal Public Key Infrastructure (PKI) infrastructure or obtain PKI services from a reputable PKI service provider.

Level 4 - Quantitatively Controlled: Cryptographic Protections (CRY) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.9, B.3.13", "controlId": "CRY-08", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-08", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Cloud PKI (https://microsoft.com)\n∙ Digitcert (https://digicert.com)\n∙ Entrust (https://entrust.com)\n∙ Vault (https://vaultproject.io)

Small Business (10-49 staff)

∙ Microsoft Cloud PKI (https://microsoft.com)\n∙ Digitcert (https://digicert.com)\n∙ Entrust (https://entrust.com)\n∙ Vault (https://vaultproject.io)

Medium Business (50-249 staff)

∙ Microsoft Cloud PKI (https://microsoft.com)\n∙ Digitcert (https://digicert.com)\n∙ Entrust (https://entrust.com)\n∙ Vault (https://vaultproject.io)

Large Business (250-999 staff)

∙ Microsoft Cloud PKI (https://microsoft.com)\n∙ Digitcert (https://digicert.com)\n∙ Entrust (https://entrust.com)\n∙ Vault (https://vaultproject.io)

Enterprise (>1,000 staff)

∙ Microsoft Cloud PKI (https://microsoft.com)\n∙ Digitcert (https://digicert.com)\n∙ Entrust (https://entrust.com)\n∙ Vault (https://vaultproject.io)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70739, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590308", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590308", "securityControlId": 31237, "ccis": [], "uuid": "266df209-84cb-573e-bb67-b003d948ca7a", "testId": "CRY-09_A01", "test": "requirements for key generation, distribution, storage, access, and destruction are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-28(03)_ODP[02]\n171A_R3_A.03.13.10.ODP[01]", "defaultText": null }, { "id": 70740, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590308", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590308", "securityControlId": 31237, "ccis": [], "uuid": "87b57ab6-1978-5890-8cc1-67c0fc759400", "testId": "CRY-09_A02", "test": "protected storage for cryptographic keys is provided using organization-defined criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-28(03)\n53A_R5_SC-28(03)_ODP[01]", "defaultText": null }, { "id": 70741, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590308", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590308", "securityControlId": 31237, "ccis": [], "uuid": "26f04463-9dca-51ac-806a-2afa17dc2d39", "testId": "CRY-09_A03", "test": "cryptographic keys are established in the system in accordance with organization-defined key management requirements.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70742, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590309", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590309", "securityControlId": 31237, "ccis": [], "uuid": "d8fb1291-8eb9-519c-9ab9-b06a7f1698c0", "testId": "CRY-09_A04", "test": "cryptographic keys are managed in the system in accordance with organization-defined key management requirements.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70743, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590309", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590309", "securityControlId": 31237, "ccis": [], "uuid": "106999a9-b4f0-5a8a-b75e-d815cb740f87", "testId": "CRY-09_A05", "test": "cryptographic keys are established in the system in accordance with the following key management requirements: .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: Guidance: At a minimum, establish a policy and procedure in line with the latest Cryptographic key management guidance", "otherId": "171A_R3_A.03.13.10[01]", "defaultText": null }, { "id": 70744, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590309", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590309", "securityControlId": 31237, "ccis": [], "uuid": "54e59de3-6e04-5753-841a-203a6f769b43", "testId": "CRY-09_A06", "test": "cryptographic keys are managed in the system in accordance with the following key management requirements: .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: Guidance: At a minimum, establish a policy and procedure in line with the latest Cryptographic key management guidance", "otherId": "171A_R3_A.03.13.10[02]", "defaultText": null } ], "externalMappings": [ { "id": 566379, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58427", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7d6e045-5bf7-5d99-867d-6ecadb5c749b", "parentControlId": 31237, "controlId": "DATA 1.6", "title": "DATA 1.6", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58427" }, { "id": 566380, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58427", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd4d25e6-4fae-5742-9050-f3258a3eb37f", "parentControlId": 31237, "controlId": "CR 1.9(d)", "title": "CR 1.9(d)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58427" }, { "id": 566381, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "886d4fe9-7e49-5f7d-b5da-5ca4eee909e0", "parentControlId": 31237, "controlId": "CR 1.9(e)", "title": "CR 1.9(e)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584271" }, { "id": 566382, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fb765fb-9f21-5589-9a1d-77caa8b6db1e", "parentControlId": 31237, "controlId": "CR 1.9(f)", "title": "CR 1.9(f)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584271" }, { "id": 566383, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68e73714-f304-5b24-aa47-0e6e3ce071dc", "parentControlId": 31237, "controlId": "8.24", "title": "8.24", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584271" }, { "id": 566388, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8a5b64f-5e2d-544a-8712-394dfc05e13e", "parentControlId": 31237, "controlId": "SC-28(03)", "title": "SC-28(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584271" }, { "id": 566389, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cae8f26c-b4b0-5456-a054-c010adc8cb9b", "parentControlId": 31237, "controlId": "SC-28(03)", "title": "SC-28(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584271" }, { "id": 566390, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "411f1829-e0bf-5399-b511-81af0dda869b", "parentControlId": 31237, "controlId": "3.13.10", "title": "3.13.10", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584272" }, { "id": 566391, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19d687a8-c945-51c8-bd87-f4929405a0c7", "parentControlId": 31237, "controlId": "03.13.10", "title": "03.13.10", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584272" }, { "id": 566442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b569a6f-fa95-5951-84ec-4efc97fdc742", "parentControlId": 31237, "controlId": "ARCHITECTURE-5e", "title": "ARCHITECTURE-5e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584278" }, { "controlId": "B.3.9", "title": "B.3.9 — Cryptographic Key Establishment and Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-12", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "6442200d-e54d-5962-bca4-073b41cf99b1", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.9", "title": "NEI 08-09 App D.3.9 — Cryptographic Key Establishment and Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.9", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "f87ccc3e-84f4-509e-afbc-c8c7f592c593", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.9", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "6f9d0979-d06f-50b2-83ec-2cf2f8598846", "isPublic": true }, { "controlId": "IEC-62645-7.3.4", "title": "IEC-62645-7.3.4 — Cryptographic Integrity and Authentication Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "6ac99c5d-2ddc-5a68-975d-1dd86328ece9", "isPublic": true }, { "controlId": "IEC-63096-10.1", "title": "IEC-63096-10.1 — Cryptographic Controls Policy and Key Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "5d3f88ce-76da-5c9f-85ee-c27f4b7cc64f", "isPublic": true } ], "id": 31237, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731011", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731011", "catalogueId": 1062, "uuid": "a2672ef4-cf0a-5a29-ba71-cadf2248fd60", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Cryptographic Key Management", "description": "

Control Description

Mechanisms exist to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.

Evidence Request List (ERL)

E-CRY-01\nE-CRY-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.\n▪ External compliance requirements for cryptography are identified and documented, based on applicable laws, regulations and contractual obligations.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to implement cryptographic mechanisms that are applicability for statutory, regulatory and/or contractual compliance obligations.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate cryptographic key management controls to protect the confidentiality, integrity and availability of keys.

Level 4 - Quantitatively Controlled: Cryptographic Protections (CRY) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.9", "controlId": "CRY-09", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-09", "references": "

Micro-Small Business (<10 staff)

∙ Cryptographic governance program

Small Business (10-49 staff)

∙ Cryptographic governance program

Medium Business (50-249 staff)

∙ Cryptographic governance program

Large Business (250-999 staff)

∙ Cryptographic governance program

Enterprise (>1,000 staff)

∙ Cryptographic governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70745, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590309", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590309", "securityControlId": 31238, "ccis": [], "uuid": "98c0cfe5-7a64-599c-bfa2-89ac0f879df8", "testId": "CRY-09.1_A01", "test": "symmetric cryptographic keys are produced using organization-defined values key management technology and processes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-12(02)[01]", "defaultText": null }, { "id": 70746, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590309", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590309", "securityControlId": 31238, "ccis": [], "uuid": "e2e1e9fa-5e76-57c4-aee6-c0cb9f73e3ec", "testId": "CRY-09.1_A02", "test": "symmetric cryptographic keys are controlled using organization-defined values for key management technology and processes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-12(02)[02]\n53A_R5_SC-12(02)_ODP", "defaultText": null }, { "id": 70747, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590309", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59031", "securityControlId": 31238, "ccis": [], "uuid": "ee824bd8-982b-54fb-a416-a61a94d99d17", "testId": "CRY-09.1_A03", "test": "symmetric cryptographic keys are distributed using organization-defined values key management technology and processes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-12(02)[03]", "defaultText": null } ], "externalMappings": [ { "id": 566515, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "962cb82c-68a6-56ac-ba70-1fac2e2708b6", "parentControlId": 31238, "controlId": "CR 1.14", "title": "CR 1.14", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584286" }, { "id": 566516, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f675acf8-f6b4-5948-849d-37f050507542", "parentControlId": 31238, "controlId": "CR 1.14(a)", "title": "CR 1.14(a)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584287" }, { "id": 566517, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50d92d25-e4e1-5ce7-9b76-906fe7b37bdd", "parentControlId": 31238, "controlId": "CR 1.14(b)", "title": "CR 1.14(b)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584287" }, { "id": 566518, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aab804e6-637f-5bdd-adb7-8884248c89d0", "parentControlId": 31238, "controlId": "CR 1.14(c)", "title": "CR 1.14(c)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584287" }, { "id": 566519, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5be83195-fe00-5923-a7bf-29e7ea2e085c", "parentControlId": 31238, "controlId": "CR 1.14(d)", "title": "CR 1.14(d)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584287" }, { "id": 566520, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae96ee5b-fdd9-5c23-939b-72a59286a51d", "parentControlId": 31238, "controlId": "SC-12(2)", "title": "SC-12(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584287" }, { "id": 566521, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28fe5178-c564-59dc-ab9b-66c67b8ae0e1", "parentControlId": 31238, "controlId": "SC-12(02)", "title": "SC-12(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584287" }, { "id": 566522, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a40cf79c-aebe-5f6f-b4b5-7923f8055562", "parentControlId": 31238, "controlId": "SC-12(02)", "title": "SC-12(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584287" } ], "id": 31238, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731011", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731011", "catalogueId": 1062, "uuid": "5e984c0d-0448-5418-9442-eb1d57468a41", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the production and management of symmetric cryptographic keys using Federal Information Processing Standards (FIPS)-compliant key management technology and processes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Symmetric Keys", "description": "

Control Description

Mechanisms exist to facilitate the production and management of symmetric cryptographic keys using Federal Information Processing Standards (FIPS)-compliant key management technology and processes.

Evidence Request List (ERL)

E-CRY-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the production and management of symmetric cryptographic keys using Federal Information Processing Standards (FIPS)-compliant key management technology and processes.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CRY-09.1", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-09.1", "references": "

Micro-Small Business (<10 staff)

∙ Cryptographic governance program

Small Business (10-49 staff)

∙ Cryptographic governance program

Medium Business (50-249 staff)

∙ Cryptographic governance program

Large Business (250-999 staff)

∙ Cryptographic governance program

Enterprise (>1,000 staff)

∙ Cryptographic governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70748, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59031", "securityControlId": 31239, "ccis": [], "uuid": "b24e7074-0628-5dee-8095-8402341d853e", "testId": "CRY-09.2_A01", "test": "asymmetric cryptographic keys are produced using organization-defined criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-12(03)[01]", "defaultText": null }, { "id": 70749, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59031", "securityControlId": 31239, "ccis": [], "uuid": "4b5d2ed3-3b42-5858-9703-990816336d14", "testId": "CRY-09.2_A02", "test": "asymmetric cryptographic keys are controlled using organization-defined criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-12(03)[02]", "defaultText": null }, { "id": 70750, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59031", "securityControlId": 31239, "ccis": [], "uuid": "e9ceca09-12b5-5f8d-9b8f-403227fecffb", "testId": "CRY-09.2_A03", "test": "asymmetric cryptographic keys are distributed using organization-defined criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-12(03)[03]", "defaultText": null }, { "id": 70751, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59031", "securityControlId": 31239, "ccis": [], "uuid": "267cc473-22d5-59fd-b3e6-37e72fe71be4", "testId": "CRY-09.2_A04", "test": "one of the following organization-defined values is selected: \n(1) NSA-approved key management technology and processes. \n(2) prepositioned keying material. \n(3) DoD-approved or DoD-issued Medium Assurance PKI certificates. \n(4) DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user’s private key. or \n(5) certificates issued in accordance with organization-defined requirements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-12(03)_ODP", "defaultText": null } ], "externalMappings": [ { "id": 566530, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d043869-af89-5c39-88be-af7433439498", "parentControlId": 31239, "controlId": "SC-12(3)", "title": "SC-12(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584288" }, { "id": 566531, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed8e321b-632c-50fa-a123-0bd368972e5a", "parentControlId": 31239, "controlId": "SC-12(03)", "title": "SC-12(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584288" }, { "id": 566532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01b7a420-411e-5453-a279-c43e729b9dee", "parentControlId": 31239, "controlId": "SC-12(03)", "title": "SC-12(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584288" } ], "id": 31239, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731012", "catalogueId": 1062, "uuid": "3b3095cd-40ac-5579-90d1-272c0ccd3a30", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the production and management of asymmetric cryptographic keys using Federal Information Processing Standards (FIPS)-compliant key management technology and processes that protect the user’s private key?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Asymmetric Keys", "description": "

Control Description

Mechanisms exist to facilitate the production and management of asymmetric cryptographic keys using Federal Information Processing Standards (FIPS)-compliant key management technology and processes that protect the user’s private key.

Evidence Request List (ERL)

E-CRY-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the production and management of asymmetric cryptographic keys using Federal Information Processing Standards (FIPS)-compliant key management technology and processes that protect the user’s private key.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CRY-09.2", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-09.2", "references": "

Micro-Small Business (<10 staff)

∙ Cryptographic governance program

Small Business (10-49 staff)

∙ Cryptographic governance program

Medium Business (50-249 staff)

∙ Cryptographic governance program

Large Business (250-999 staff)

∙ Cryptographic governance program

Enterprise (>1,000 staff)

∙ Cryptographic governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70752, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590311", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590311", "securityControlId": 31240, "ccis": [], "uuid": "42fc02d7-a2a6-5134-839e-d67888745996", "testId": "CRY-09.3_A01", "test": "information availability is maintained in the event of the loss of cryptographic keys by users.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-12(01)", "defaultText": null } ], "externalMappings": [ { "id": 566546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58429", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f75f5ff4-ac75-5d02-84e8-a05c7aac1163", "parentControlId": 31240, "controlId": "8.24", "title": "8.24", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58429" }, { "id": 566549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58429", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac941f32-d74f-5b56-8be8-cb4276b52546", "parentControlId": 31240, "controlId": "SC-12(1)", "title": "SC-12(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58429" }, { "id": 566550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58429", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7d6b072-a3b9-5a11-a543-0708b3e79edf", "parentControlId": 31240, "controlId": "SC-12(01)", "title": "SC-12(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58429" }, { "id": 566551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d66da48-f09b-51cd-93f9-dff936e7b670", "parentControlId": 31240, "controlId": "SC-12(01)", "title": "SC-12(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584291" }, { "id": 566552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f9871b7-eb6a-51a7-9299-b0b6c682a790", "parentControlId": 31240, "controlId": "SC-12(01)", "title": "SC-12(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584291" }, { "id": 566553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0f5f6ac-c3ba-5c90-83bf-57f84803ea9e", "parentControlId": 31240, "controlId": "SC-12(01)", "title": "SC-12(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584291" }, { "id": 566554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f99c9d4a-555c-5a87-93e9-f6ae9599492e", "parentControlId": 31240, "controlId": "03.13.10", "title": "03.13.10", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584291" } ], "id": 31240, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731012", "catalogueId": 1062, "uuid": "5f778ec4-0d7a-555d-8ce5-27e327205318", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure the availability of information in the event of the loss of cryptographic keys by individual users?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Cryptographic Key Loss or Change", "description": "

Control Description

Mechanisms exist to ensure the availability of information in the event of the loss of cryptographic keys by individual users.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure the availability of information in the event of the loss of cryptographic keys by individual users.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CRY-09.3", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-09.3", "references": "

Micro-Small Business (<10 staff)

∙ Cryptographic governance program

Small Business (10-49 staff)

∙ Cryptographic governance program

Medium Business (50-249 staff)

∙ Cryptographic governance program

Large Business (250-999 staff)

∙ Cryptographic governance program

Enterprise (>1,000 staff)

∙ Cryptographic governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70753, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590311", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590311", "securityControlId": 31241, "ccis": [], "uuid": "79abd815-55ac-588a-99a1-ef02430d8f5c", "testId": "CRY-09.4_A01", "test": "a centrally-managed cryptographic key management solution facilitates the secure distribution of symmetric and asymmetric cryptographic keys.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 566581, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98006f24-a44f-538e-9636-560892264b4c", "parentControlId": 31241, "controlId": "8.24", "title": "8.24", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584294" }, { "id": 566584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39035053-04b9-5ddf-bb23-a659271527f5", "parentControlId": 31241, "controlId": "03.13.10", "title": "03.13.10", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584294" } ], "id": 31241, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731012", "catalogueId": 1062, "uuid": "7068eb36-abec-5d56-820a-13ec5ef3f179", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the secure distribution of symmetric and asymmetric cryptographic keys using industry recognized key management technology and processes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Control & Distribution of Cryptographic Keys", "description": "

Control Description

Mechanisms exist to facilitate the secure distribution of symmetric and asymmetric cryptographic keys using industry recognized key management technology and processes.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the secure distribution of symmetric and asymmetric cryptographic keys using industry recognized key management technology and processes.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CRY-09.4", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-09.4", "references": "

Micro-Small Business (<10 staff)

∙ Cryptographic governance program

Small Business (10-49 staff)

∙ Cryptographic governance program

Medium Business (50-249 staff)

∙ Cryptographic governance program

Large Business (250-999 staff)

∙ Cryptographic governance program

Enterprise (>1,000 staff)

∙ Cryptographic governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70756, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590312", "securityControlId": 31244, "ccis": [], "uuid": "b9c0da66-8e57-5dd1-87d3-3bd971d38142", "testId": "CRY-09.7_A01", "test": "exclusive control of cryptographic keys is maintained for encrypted material stored or transmitted through an external system.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(06)", "defaultText": null } ], "externalMappings": [ { "id": 566600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "000fc55e-d588-55d0-9dc5-84c0c96a119b", "parentControlId": 31244, "controlId": "SA-09(06)", "title": "SA-09(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584296" }, { "id": 566601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4195624-4355-568b-83a3-59e929e4f1d3", "parentControlId": 31244, "controlId": "SA-09(06)", "title": "SA-09(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584296" } ], "id": 31244, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731013", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731013", "catalogueId": 1062, "uuid": "ef3006aa-d153-524f-9bbb-0c5b5372755e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain control of cryptographic keys for encrypted material stored or transmitted through an external system?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "External System Cryptographic Key Control", "description": "

Control Description

Mechanisms exist to maintain control of cryptographic keys for encrypted material stored or transmitted through an external system.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain control of cryptographic keys for encrypted material stored or transmitted through an external system.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CRY-09.7", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-09.7", "references": "

Micro-Small Business (<10 staff)

∙ Cryptographic governance program

Small Business (10-49 staff)

∙ Cryptographic governance program

Medium Business (50-249 staff)

∙ Cryptographic governance program

Large Business (250-999 staff)

∙ Cryptographic governance program

Enterprise (>1,000 staff)

∙ Cryptographic governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70757, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590312", "securityControlId": 31245, "ccis": [], "uuid": "ff9efeaa-fd85-5e7d-93a6-289f8b64fcd6", "testId": "CRY-10_A01", "test": "cybersecurity / data privacy attributes associated with information exchanged are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-16_ODP[01]\n53A_R5_SC-16_ODP[02]", "defaultText": null }, { "id": 70758, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590312", "securityControlId": 31245, "ccis": [], "uuid": "34baf342-1055-5839-845e-e1dd6d0ad80a", "testId": "CRY-10_A02", "test": "cybersecurity / data privacy attributes are associated with information exchanged between systems.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-16[01]\n53A_R5_SC-16[03]", "defaultText": null }, { "id": 70759, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590312", "securityControlId": 31245, "ccis": [], "uuid": "d74f6bc7-6be0-53d4-b2a4-1fefdda52402", "testId": "CRY-10_A03", "test": "security /privacy attributes are associated with information exchanged between system components.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-16[02]\n53A_R5_SC-16[04]", "defaultText": null }, { "id": 70760, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590312", "securityControlId": 31245, "ccis": [], "uuid": "8084be9a-14c4-50a4-97b2-29aa09754958", "testId": "CRY-10_A04", "test": "the integrity of transmitted cybersecurity / data privacy attributes is verified.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-16(01)[01]\n53A_R5_SC-16(01)[02]", "defaultText": null } ], "externalMappings": [ { "id": 566605, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9192f1cc-f0c2-5109-85de-267afde55c71", "parentControlId": 31245, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584297" }, { "id": 566606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5739f1d7-8a16-5f4f-bdc9-ed2b7baef3e5", "parentControlId": 31245, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584297" }, { "id": 566607, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af0f057c-458d-52d8-b400-02df4d25bfcc", "parentControlId": 31245, "controlId": "T1573", "title": "T1573", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584297" }, { "id": 566608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fdb3acc-883f-5686-86d7-2a3720e94d7d", "parentControlId": 31245, "controlId": "T1573.001", "title": "T1573.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584297" }, { "id": 566609, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4247e861-b423-5086-9753-1430c2e71d6a", "parentControlId": 31245, "controlId": "T1573.002", "title": "T1573.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584297" }, { "id": 566610, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27f31fbb-8392-500f-91ec-3951ed3624a1", "parentControlId": 31245, "controlId": "SC-16", "title": "SC-16", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584297" }, { "id": 566611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35e88f65-9035-5feb-aee2-cae610e1d10a", "parentControlId": 31245, "controlId": "SC-16(1)", "title": "SC-16(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584298" }, { "id": 566612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c3575e2-ce6e-58fc-b39d-29e0c82a576d", "parentControlId": 31245, "controlId": "SC-16", "title": "SC-16", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584298" }, { "id": 566613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "599d936b-cfcd-587f-9c85-7bf63285bb1d", "parentControlId": 31245, "controlId": "SC-16(01)", "title": "SC-16(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584298" }, { "id": 566615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc1e9e39-6141-5aef-93e2-bc645b5a503d", "parentControlId": 31245, "controlId": "SC-16", "title": "SC-16", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584298" }, { "id": 566616, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1eca0a5-3291-5f18-a100-11d0e1787db2", "parentControlId": 31245, "controlId": "SC-16(01)", "title": "SC-16(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584298" }, { "controlId": "B.3.12", "title": "B.3.12 — Transmission of Security Parameters", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-16", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "7702c08d-5729-520a-97a2-a1f8261f9e75", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.12", "title": "NEI 08-09 App D.3.12 — Transmission of Security Parameters", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.12", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "58a3205c-d3f4-56c6-9c32-91999d3388a1", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.12", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "afa5ffcd-3d4f-566e-be49-9b9bc4c576fa", "isPublic": true }, { "controlId": "IEC-62645-7.3.4", "title": "IEC-62645-7.3.4 — Cryptographic Integrity and Authentication Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "d59f027d-abdc-5bb4-8975-d25751727536", "isPublic": true }, { "controlId": "IEC-63096-10.1", "title": "IEC-63096-10.1 — Cryptographic Controls Policy and Key Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "0f618e20-3511-56f1-99cb-b6df73fd7278", "isPublic": true } ], "id": 31245, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731014", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731014", "catalogueId": 1062, "uuid": "e7202b03-3f2b-5294-b010-66e3788b7b4d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization associate Technology Assets, Applications and/or Services (TAAS) security attributes with information exchanged between TAAS?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Transmission of Cybersecurity & Data Protection Attributes", "description": "

Control Description

Mechanisms exist to associate Technology Assets, Applications and/or Services (TAAS) security attributes with information exchanged between TAAS.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards.

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to associate Technology Assets, Applications and/or Services (TAAS) security attributes with information exchanged between TAAS.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.12", "controlId": "CRY-10", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-10", "references": "

Micro-Small Business (<10 staff)

∙ Cryptographic governance program

Small Business (10-49 staff)

∙ Cryptographic governance program

Medium Business (50-249 staff)

∙ Cryptographic governance program

Large Business (250-999 staff)

∙ Cryptographic governance program

Enterprise (>1,000 staff)

∙ Cryptographic governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70761, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590313", "securityControlId": 31246, "ccis": [], "uuid": "8c3f0d13-2571-5492-8cb8-434536844f45", "testId": "CRY-11_A01", "test": "certificate authorities to be allowed for verification of the establishment of protected sessions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-23(05)_ODP", "defaultText": null }, { "id": 70762, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590313", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590313", "securityControlId": 31246, "ccis": [], "uuid": "0d39e2b2-14b4-551c-98f3-d03052d12319", "testId": "CRY-11_A02", "test": "only the use of organization-defined certificated authorities for verification of the establishment of protected sessions is allowed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-23(05)", "defaultText": null } ], "externalMappings": [ { "id": 566622, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44f6cd84-b25b-5059-afd0-efe3add3ef2a", "parentControlId": 31246, "controlId": "SC-23(5)", "title": "SC-23(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584299" }, { "id": 566623, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10cae5be-a7c2-5d46-80b7-8535b49deeb5", "parentControlId": 31246, "controlId": "SC-23(05)", "title": "SC-23(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584299" }, { "id": 566624, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "116b331b-3494-5360-808d-b438ad88f2d7", "parentControlId": 31246, "controlId": "SC-23(05)", "title": "SC-23(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584299" }, { "controlId": "IEC-62645-7.3.4", "title": "IEC-62645-7.3.4 — Cryptographic Integrity and Authentication Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "b8d66d7e-bf50-5129-b8b6-1fd011950d53", "isPublic": true }, { "controlId": "IEC-63096-10.1", "title": "IEC-63096-10.1 — Cryptographic Controls Policy and Key Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (CRY Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "e8752822-21e6-59f2-96a4-bdcd1987c779", "isPublic": true } ], "id": 31246, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731014", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731014", "catalogueId": 1062, "uuid": "09d47651-7468-5154-b3fb-bc40ac647c6f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to enable the use of organization-defined Certificate Authorities (CAs) to facilitate the establishment of protected sessions?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 8.0, "title": "Certificate Authorities", "description": "

Control Description

Automated mechanisms exist to enable the use of organization-defined Certificate Authorities (CAs) to facilitate the establishment of protected sessions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Cryptographic Protections (CRY) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are well-documented and kept current by process owners.\n▪ A security engineering team, or similar function, is appropriately staffed and supported to implement and maintain CRY domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of cryptographic protections operations (e.g., PKI management tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically enable the use of organization-defined Certificate Authorities (CAs) to facilitate the establishment of protected sessions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "CRY-11", "family": "Cryptographic Protections", "enhancements": "", "sortId": "CRY-11", "references": "

Micro-Small Business (<10 staff)

∙ Cryptographic governance program

Small Business (10-49 staff)

∙ Cryptographic governance program

Medium Business (50-249 staff)

∙ Cryptographic governance program

Large Business (250-999 staff)

∙ Cryptographic governance program

Enterprise (>1,000 staff)

∙ Cryptographic governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70767, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590314", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590314", "securityControlId": 31249, "ccis": [], "uuid": "0919de0d-0776-52ef-9c21-563fe2bec48f", "testId": "DCH-01_A01", "test": "paper media containing sensitive / regulated data is physically controlled.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "171A_3.8.1[a]", "defaultText": null }, { "id": 70768, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590314", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590314", "securityControlId": 31249, "ccis": [], "uuid": "d079fa58-9a3d-561e-b91f-ac46339474d1", "testId": "DCH-01_A02", "test": "digital media containing sensitive / regulated data is physically controlled.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "171A_3.8.1[b]", "defaultText": null }, { "id": 70769, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590314", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590314", "securityControlId": 31249, "ccis": [], "uuid": "54eb4aef-4394-54e0-b0d5-003dfdad2dd0", "testId": "DCH-01_A03", "test": "paper media containing sensitive / regulated data is securely stored.
PPTDF Applicability: Data
Assessment Rigor: 2", "otherId": "171A_3.8.1[c]", "defaultText": null }, { "id": 70770, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590315", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590315", "securityControlId": 31249, "ccis": [], "uuid": "803d17a6-5843-5b0a-a9c4-8e9a87901fb1", "testId": "DCH-01_A04", "test": "digital media containing sensitive / regulated data is securely stored.
PPTDF Applicability: Data
Assessment Rigor: 2", "otherId": "171A_3.8.1[d]", "defaultText": null }, { "id": 70771, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590315", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590315", "securityControlId": 31249, "ccis": [], "uuid": "2fd55fef-ee7d-553b-acb3-21326dbc312e", "testId": "DCH-01_A05", "test": "data classification & handling management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70772, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590315", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590315", "securityControlId": 31249, "ccis": [], "uuid": "a0670649-0e91-5eb2-961c-909884d2703d", "testId": "DCH-01_A06", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support data classification & handling management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70773, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590315", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590315", "securityControlId": 31249, "ccis": [], "uuid": "38de767d-54b6-5b6d-9d50-4dce721c99c2", "testId": "DCH-01_A07", "test": "responsibility and authority for the performance of data classification & handling management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70774, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590315", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590315", "securityControlId": 31249, "ccis": [], "uuid": "cf1fbbda-f72b-5cd3-8446-53d5e428334d", "testId": "DCH-01_A08", "test": "personnel performing data classification & handling management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 566682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "190ca4b1-f3a1-503b-bed2-d9a48721b663", "parentControlId": 31249, "controlId": "DATA 1.2", "title": "DATA 1.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584306" }, { "id": 566683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9798344-f963-5f62-8603-881991429073", "parentControlId": 31249, "controlId": "5.9", "title": "5.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584306" }, { "id": 566684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e82ea6d-e789-513c-9874-984d11fbafb5", "parentControlId": 31249, "controlId": "5.1", "title": "5.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584306" }, { "id": 566685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de950677-2da4-56ac-a5c6-cdb2dc06e326", "parentControlId": 31249, "controlId": "5.12", "title": "5.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584306" }, { "id": 566686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dad3e358-cee8-5c5f-bbd0-f73a31d49b12", "parentControlId": 31249, "controlId": "5.33", "title": "5.33", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584306" }, { "id": 566687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afe2c880-dc3f-5853-9ad1-a2787e804863", "parentControlId": 31249, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584306" }, { "id": 566688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e44dbd99-bd2b-56a5-94c9-69e293a74b84", "parentControlId": 31249, "controlId": "8.12", "title": "8.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584306" }, { "id": 566717, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28d120bd-f480-58aa-b5a1-b52c5315ca53", "parentControlId": 31249, "controlId": "MP-1", "title": "MP-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584318" }, { "id": 566718, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7311a7b1-c03e-5b49-a48b-324f2348aba5", "parentControlId": 31249, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584318" }, { "id": 566720, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9d9f411-7f0f-5f61-8acd-9174eb1602cb", "parentControlId": 31249, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584318" }, { "id": 566723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53a9e162-2612-5164-9b32-5a11b0812d06", "parentControlId": 31249, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584318" }, { "id": 566724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6db7c72-6b0c-5fc0-9ece-6014a774f52b", "parentControlId": 31249, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584318" }, { "id": 566725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58f060b9-3e37-5d7d-a0a3-9bada048d24d", "parentControlId": 31249, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584319" }, { "id": 566726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0006af76-568d-5f8d-9f77-08fabcb9e758", "parentControlId": 31249, "controlId": "MP-01", "title": "MP-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584319" }, { "id": 566727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30153cbf-9a4b-5bba-a87e-b04070d7c7e6", "parentControlId": 31249, "controlId": "MP-1", "title": "MP-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584319" }, { "id": 566728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e402b39c-e9c4-58b9-8446-1ceb36ee0c0a", "parentControlId": 31249, "controlId": "MP-1", "title": "MP-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584319" }, { "id": 566731, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a0a9fcf-f23c-5eb1-9b30-e7ffb424d0f3", "parentControlId": 31249, "controlId": "3.8.1", "title": "3.8.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584319" }, { "id": 566732, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc94cead-777e-5cce-a13f-fbe7e0ea079b", "parentControlId": 31249, "controlId": "3.8.3", "title": "3.8.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584319" }, { "id": 566733, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b491cf75-4faf-510f-bf95-ad159cc2e1c9", "parentControlId": 31249, "controlId": "NFO - MP-1", "title": "NFO - MP-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584319" }, { "id": 566734, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91912699-cf9a-5642-85bd-2bf5406b6cfa", "parentControlId": 31249, "controlId": "03.01.01.d.01", "title": "03.01.01.d.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58432" }, { "id": 566735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0a50193-6530-5877-bcf6-94621e069e2d", "parentControlId": 31249, "controlId": "03.01.01.d.02", "title": "03.01.01.d.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58432" }, { "id": 566736, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7004bbd-242a-5d3b-8c5a-98f8b1e52207", "parentControlId": 31249, "controlId": "03.08.01", "title": "03.08.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58432" }, { "id": 566742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5bc6e2b-b38e-560b-930c-06400583c359", "parentControlId": 31249, "controlId": "ID.AM-08", "title": "ID.AM-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584321" }, { "id": 566743, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "861f2c48-0ba2-5aeb-bd92-279c9281c9e8", "parentControlId": 31249, "controlId": "PR.DS", "title": "PR.DS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584321" }, { "id": 566744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f127d953-7a3c-5921-b473-fe5e388d4cc9", "parentControlId": 31249, "controlId": "PR.DS-01", "title": "PR.DS-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584321" }, { "id": 566745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "072531ce-fa01-55c6-83bf-074df3041ab3", "parentControlId": 31249, "controlId": "PR.DS-02", "title": "PR.DS-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584321" }, { "id": 566746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cfef0301-113e-55c1-8935-f00e40bf08f4", "parentControlId": 31249, "controlId": "PR.DS-10", "title": "PR.DS-10", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584321" }, { "id": 566826, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50eb2ef0-719c-52c7-99c1-d2700c34f611", "parentControlId": 31249, "controlId": "CIP-003-8 1.1.8", "title": "CIP-003-8 1.1.8", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58433" }, { "id": 566827, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0dba0e19-f05b-5ac2-a4a4-b7e0218b6ccd", "parentControlId": 31249, "controlId": "CIP-011-3 1.2", "title": "CIP-011-3 1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58433" }, { "id": 566828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efb45516-4602-59b1-b29b-c0c19c300063", "parentControlId": 31249, "controlId": "9-2", "title": "9-2", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58433" }, { "id": 566905, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584339", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a515bab-8d03-5a01-9c18-0f86437101b6", "parentControlId": 31249, "controlId": "B3", "title": "B3", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584339" }, { "controlId": "C.1.1", "title": "C.1.1 — Media Protection Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MP-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "9d33bc5f-027f-51fa-9901-0e3812705f29", "isPublic": true }, { "controlId": "NEI 08-09 App E.1.1", "title": "NEI 08-09 App E.1.1 — Media Protection Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.1.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e968e4e7-9bed-5828-b00a-73fd8c9130aa", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.1.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "de412c29-9264-5b84-a367-0c054cf2d6d0", "isPublic": true }, { "controlId": "CIP-011-3-R1", "title": "CIP-011-3-R1 — Information Protection Program (BCSI)", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "486e438c-6f95-562b-bba0-23d87b8cb6a2", "isPublic": true }, { "controlId": "CIP-011-3-1.1", "title": "CIP-011-3-1.1 — Method(s) to identify BCSI.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-011-3-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ff55f7fc-6158-5eae-9d45-98b04f43b129", "isPublic": true }, { "controlId": "CIP-011-3-1.2", "title": "CIP-011-3-1.2 — Method(s) to protect and securely handle BCSI to mitigate risks of compromising confidentiality.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-011-3-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c5f64284-b947-5621-ae08-74fb03a04d50", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "65808c5f-6262-5da4-a159-762631b1f9fa", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "1784f394-cb06-5cd5-93fd-5721d4aba209", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "7a79f642-8b52-546f-b4c0-a4b741654b01", "isPublic": true } ], "id": 31249, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731015", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731015", "catalogueId": 1062, "uuid": "d465276e-53f7-5db5-a8f9-7eea0ec77cb8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of data protection controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Data Protection", "description": "

Control Description

Mechanisms exist to facilitate the implementation of data protection controls.

Evidence Request List (ERL)

E-CRY-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Data Classification & Handling (DCH) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with DCH domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ A basic data classification process exists to identify categories of sensitive/regulated data for compliance-related protection requirements.\n▪ Data protection controls are primarily administrative in nature (e.g., policies & standards) to classify, protect and dispose of systems and data, including storage media.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ TAASD are categorized according to data classification and business criticality.\n▪ Data classification and handling criteria govern requirements protect sensitive/regulated regardless of where it is stored, processed and/or transmitted.\n▪ The data retention process is manual and IT and/or cybersecurity personnel work with business stakeholders and process owners to manage the process.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of data protection controls.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.1.1
NERC-CIP (2026) Requirements: CIP-011-3-R1", "controlId": "DCH-01", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-01", "references": "

Micro-Small Business (<10 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)

Small Business (10-49 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)

Medium Business (50-249 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Data governance program

Large Business (250-999 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Data governance program\n∙ Chief Data Officer (CDO)

Enterprise (>1,000 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Data governance program\n∙ Chief Data Officer (CDO)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70775, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590315", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590315", "securityControlId": 31250, "ccis": [], "uuid": "62c3c916-0916-5687-b5db-df74c723c13a", "testId": "DCH-01.1_A01", "test": "organizational data ownership requirements are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70776, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590316", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590316", "securityControlId": 31250, "ccis": [], "uuid": "ef69c2de-80c7-50dd-b476-73914b58182a", "testId": "DCH-01.1_A02", "test": "data ownership is formally assigned to an individual through defined roles and responsibilities.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 567002, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87f9affc-3159-5fad-9d43-a961a26698f5", "parentControlId": 31250, "controlId": "SA-04(12)", "title": "SA-04(12)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58435" }, { "id": 567004, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f7715b3-cc5c-55a6-ac68-12a38fae4c6d", "parentControlId": 31250, "controlId": "SA-04(12)", "title": "SA-04(12)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58435" }, { "id": 567005, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9940b1ea-60bf-5161-8d96-f2db3165153e", "parentControlId": 31250, "controlId": "SA-04(12)", "title": "SA-04(12)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58435" }, { "id": 567006, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b659f54-38cc-5225-b2de-150598ca299c", "parentControlId": 31250, "controlId": "SA-04(12)", "title": "SA-04(12)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58435" }, { "id": 567007, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0a2fde8-06bc-5504-95b9-91f0900e742c", "parentControlId": 31250, "controlId": "SA-04(12)", "title": "SA-04(12)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58435" }, { "id": 567008, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584351", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07979490-a2a8-5fcc-ba4c-e9c968da1afd", "parentControlId": 31250, "controlId": "03.08.01", "title": "03.08.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584351" }, { "id": 567009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584351", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e0cb081-6fbc-57e0-bb5a-214759b2a87f", "parentControlId": 31250, "controlId": "03.08.05.a", "title": "03.08.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584351" }, { "id": 567010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584351", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0abe4306-b274-5ad8-a65e-1a10918e51d3", "parentControlId": 31250, "controlId": "ID.AM-08", "title": "ID.AM-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584351" }, { "id": 567011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584351", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de5dd893-5ca8-57f7-8f1e-9d95d1ba73ca", "parentControlId": 31250, "controlId": "PR.DS", "title": "PR.DS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584351" } ], "id": 31250, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731015", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731015", "catalogueId": 1062, "uuid": "747ddd71-fe45-590e-beee-0eed38daaf9d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure data stewardship is assigned, documented and communicated?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Data Stewardship", "description": "

Control Description

Mechanisms exist to ensure data stewardship is assigned, documented and communicated.

Evidence Request List (ERL)

E-DCH-02\nE-DCH-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Data Classification & Handling (DCH) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with DCH domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Data protection controls are primarily administrative in nature (e.g., policies & standards) to classify, protect and dispose of systems and data, including storage media.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to document where sensitive/regulated data is stored, transmitted and/or processed.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure data stewardship is assigned, documented and communicated.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-01.1", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Assigned roles & responsibilities

Small Business (10-49 staff)

∙ Assigned roles & responsibilities

Medium Business (50-249 staff)

∙ Assigned roles & responsibilities

Large Business (250-999 staff)

∙ Assigned roles & responsibilities

Enterprise (>1,000 staff)

∙ Assigned roles & responsibilities", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70777, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590316", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590316", "securityControlId": 31251, "ccis": [], "uuid": "b4a66a38-719f-5e36-91b7-825f8b9f4d22", "testId": "DCH-01.2_A01", "test": "sensitive / regulated data inventories exist.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70778, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590316", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590316", "securityControlId": 31251, "ccis": [], "uuid": "91941ff7-a0ed-52a8-a3c7-8d36bb3a0f2b", "testId": "DCH-01.2_A02", "test": "protection mechanisms are defined for each type of sensitive / regulated data.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70779, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590316", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590316", "securityControlId": 31251, "ccis": [], "uuid": "2342e974-1dd4-5626-8dfe-dafa19d47d81", "testId": "DCH-01.2_A03", "test": "organization-defined mechanisms protect sensitive / regulated data wherever it is stored.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 567052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584364", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d90bf3d-4302-5bac-9e32-641d78641d73", "parentControlId": 31251, "controlId": "DATA 1.2", "title": "DATA 1.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584364" }, { "id": 567062, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584365", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9be31642-aa9f-5996-b037-ed8891165ab1", "parentControlId": 31251, "controlId": "3.10.6", "title": "3.10.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584365" }, { "id": 567063, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584365", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bb846e6-cea2-5887-adb3-5f721c6f9ad2", "parentControlId": 31251, "controlId": "03.01.01.d.01", "title": "03.01.01.d.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584365" }, { "id": 567064, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584365", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aad64aab-0b8b-51d2-a82a-1805118d4821", "parentControlId": 31251, "controlId": "03.01.01.d.02", "title": "03.01.01.d.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584365" }, { "id": 567065, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584365", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d2ba381-9b04-5fae-a66d-24efbea14903", "parentControlId": 31251, "controlId": "03.01.02", "title": "03.01.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584365" }, { "id": 567066, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584365", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66546c9d-466d-5e2f-9c1d-79c7afd0fcc6", "parentControlId": 31251, "controlId": "03.01.20.a", "title": "03.01.20.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584365" }, { "id": 567067, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b9103d5-b0cb-5d15-a917-da408041acac", "parentControlId": 31251, "controlId": "03.01.20.b", "title": "03.01.20.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584366" }, { "id": 567068, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3567953-3644-54d7-ad19-a9e73b287bab", "parentControlId": 31251, "controlId": "03.01.20.c.01", "title": "03.01.20.c.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584366" }, { "id": 567069, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c02aa545-1146-5d10-b3f6-a6dc08bfd39f", "parentControlId": 31251, "controlId": "03.01.20.d", "title": "03.01.20.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584366" }, { "id": 567070, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3947bfc4-01cf-5792-ad4c-8be38211366f", "parentControlId": 31251, "controlId": "03.06.05.d", "title": "03.06.05.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584366" }, { "id": 567071, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6e84cfb-5d88-5a9d-8d7b-3038a51d8987", "parentControlId": 31251, "controlId": "03.08.01", "title": "03.08.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584366" }, { "id": 567072, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd9e46df-d99e-524e-b6dc-15da222e9c52", "parentControlId": 31251, "controlId": "03.08.02", "title": "03.08.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584366" }, { "id": 567073, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25a730c1-e90c-5f1d-b96a-dc6e2ca82763", "parentControlId": 31251, "controlId": "03.08.05.a", "title": "03.08.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584366" }, { "id": 567074, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5777f620-9721-5f02-81c8-ef76cfc51e68", "parentControlId": 31251, "controlId": "03.17.01.c", "title": "03.17.01.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584366" }, { "id": 567077, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b5b2e80-dc7f-51ca-9d16-13ab41d9f7e0", "parentControlId": 31251, "controlId": "PR.DS", "title": "PR.DS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584367" }, { "id": 567106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "695d1324-7d46-5e50-8b77-f4e53fc80fa7", "parentControlId": 31251, "controlId": "§117.15(a)", "title": "§117.15(a)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58437" }, { "id": 567107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c164140f-aa33-502b-bd8f-459cd16ce854", "parentControlId": 31251, "controlId": "§117.15(a)(1)", "title": "§117.15(a)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58437" }, { "id": 567108, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "301846d2-217b-59da-855b-71f0a095e53f", "parentControlId": 31251, "controlId": "§117.15(a)(2)", "title": "§117.15(a)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58437" }, { "id": 567109, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30f4e87a-0387-54d2-84e5-81d1d45ca607", "parentControlId": 31251, "controlId": "§117.15(a)(2)(i)", "title": "§117.15(a)(2)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58437" }, { "id": 567110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4dab4db4-4fd8-526f-9d48-e316ee4d31b7", "parentControlId": 31251, "controlId": "§117.15(a)(2)(ii)", "title": "§117.15(a)(2)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58437" }, { "id": 567111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b25aee4-c1e0-5181-b902-33c474cb7350", "parentControlId": 31251, "controlId": "§117.15(a)(3)", "title": "§117.15(a)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58437" }, { "id": 567112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "278e2242-427f-5d83-b682-df80bce367b0", "parentControlId": 31251, "controlId": "§117.15(a)(3)(i)", "title": "§117.15(a)(3)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584371" }, { "id": 567113, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "825f904d-b973-57cc-9b44-29f73cfeadea", "parentControlId": 31251, "controlId": "§117.15(a)(3)(ii)", "title": "§117.15(a)(3)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584371" }, { "id": 567114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe1a3c65-e2e9-59b6-82ce-93705668a251", "parentControlId": 31251, "controlId": "§117.15(a)(3)(iii)", "title": "§117.15(a)(3)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584371" }, { "id": 567115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cdf5ed9-66fe-5137-91a2-6127c5ec9b13", "parentControlId": 31251, "controlId": "§117.15(a)(3)(iii)(A)", "title": "§117.15(a)(3)(iii)(A)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584371" }, { "id": 567116, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66e79a82-fb69-5e6d-822a-cd5fb2fe4580", "parentControlId": 31251, "controlId": "§117.15(a)(3)(iii)(B)", "title": "§117.15(a)(3)(iii)(B)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584371" }, { "id": 567117, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b92b3158-a87e-5df9-8a19-4d62c12a24f2", "parentControlId": 31251, "controlId": "§117.15(a)(3)(iii)(C)", "title": "§117.15(a)(3)(iii)(C)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584371" }, { "id": 567118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efad32ed-baed-596a-8da0-49c7d73c99ae", "parentControlId": 31251, "controlId": "§117.15(a)(3)(iii)(D)", "title": "§117.15(a)(3)(iii)(D)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584371" }, { "id": 567119, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a2d9f27-e830-5b56-88bc-ab82a1ad6036", "parentControlId": 31251, "controlId": "§117.15(a)(3)(iii)(E)", "title": "§117.15(a)(3)(iii)(E)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584372" }, { "id": 567120, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43dfcd45-0f3d-5b55-9cc5-8f273862ca89", "parentControlId": 31251, "controlId": "§117.15(a)(3)(iii)(F)", "title": "§117.15(a)(3)(iii)(F)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584372" }, { "id": 567121, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44a812ef-2e0f-577a-ae79-25a708c50011", "parentControlId": 31251, "controlId": "§117.15(a)(3)(iv)", "title": "§117.15(a)(3)(iv)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584372" }, { "id": 567122, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "187afbb2-2703-5788-9b09-5e60cb365796", "parentControlId": 31251, "controlId": "§117.15(a)(3)(iv)(A)", "title": "§117.15(a)(3)(iv)(A)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584372" }, { "id": 567123, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b628361d-b42d-5686-a400-5fa6c40f8851", "parentControlId": 31251, "controlId": "§117.15(a)(3)(iv)(B)", "title": "§117.15(a)(3)(iv)(B)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584372" }, { "id": 567124, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4183d2d7-417f-5784-a7d7-2f3dd27107c8", "parentControlId": 31251, "controlId": "§117.15(b)", "title": "§117.15(b)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584372" }, { "id": 567125, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3de27ed3-c240-567d-a725-805cb7fa064c", "parentControlId": 31251, "controlId": "§117.15(c)", "title": "§117.15(c)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584372" }, { "id": 567126, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c0d2a6a-db37-5105-bd73-2f1120b42a45", "parentControlId": 31251, "controlId": "§117.15(c)(1)", "title": "§117.15(c)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584372" }, { "id": 567127, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5adefe45-49bb-528a-bc53-0f1c4999d7f2", "parentControlId": 31251, "controlId": "§117.15(c)(2)", "title": "§117.15(c)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584372" }, { "id": 567128, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31810220-49ac-53c6-a6db-7ff5e5a25961", "parentControlId": 31251, "controlId": "§117.15(c)(3)", "title": "§117.15(c)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584372" }, { "id": 567129, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584373", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2cc42bc5-3afd-5edf-9e5d-3efc2ce8109a", "parentControlId": 31251, "controlId": "§117.15(e)(2)", "title": "§117.15(e)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584373" }, { "id": 567130, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584373", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "559b71bc-465a-5a1d-8ada-0ee0b9938e67", "parentControlId": 31251, "controlId": "§117.15(e)(3)", "title": "§117.15(e)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584373" }, { "id": 567131, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584373", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69b9e64e-74f7-5e71-b218-1ebf070282b3", "parentControlId": 31251, "controlId": "§117.15(e)(3)(i)", "title": "§117.15(e)(3)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584373" }, { "id": 567132, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584373", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13dd96d3-bb7c-5551-9819-126a8764f2c1", "parentControlId": 31251, "controlId": "§117.15(e)(3)(ii)", "title": "§117.15(e)(3)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584373" }, { "id": 567133, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584373", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bef8659-1936-51b7-b919-5c74fbfc2356", "parentControlId": 31251, "controlId": "§117.15(e)(3)(iii)", "title": "§117.15(e)(3)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584373" }, { "id": 567134, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584373", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce3bd7de-c7e1-533a-9063-807f1d0df940", "parentControlId": 31251, "controlId": "§117.15(e)(3)(iv)", "title": "§117.15(e)(3)(iv)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584373" }, { "id": 567135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584373", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "000c481b-b789-5966-9640-568167190b9f", "parentControlId": 31251, "controlId": "§117.15(e)(6)", "title": "§117.15(e)(6)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584373" }, { "id": 567136, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584373", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71b0c8b4-5fb1-51cb-8ebc-008fbd4e5c28", "parentControlId": 31251, "controlId": "§117.15(f)", "title": "§117.15(f)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584373" }, { "id": 567137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584373", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c965c63-dc07-5fee-98f0-34696664e88e", "parentControlId": 31251, "controlId": "§117.15(f)(1)", "title": "§117.15(f)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584373" }, { "id": 567138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584374", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f774efc4-6a20-5ae0-aceb-4c8c6732d3ef", "parentControlId": 31251, "controlId": "§117.15(f)(2)", "title": "§117.15(f)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584374" }, { "id": 567139, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584374", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7719c36-3f90-520f-a8e0-70eca0a01c6d", "parentControlId": 31251, "controlId": "§117.15(f)(3)", "title": "§117.15(f)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584374" }, { "id": 567140, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584374", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1f3262c-4b34-512b-811c-ac23db6d32e0", "parentControlId": 31251, "controlId": "9-2", "title": "9-2", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584374" }, { "id": 567141, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584374", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "818a1a6f-9ae8-5e32-9377-c35c8ed1d5a1", "parentControlId": 31251, "controlId": "9-2.a", "title": "9-2.a", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584374" }, { "controlId": "B.3.20", "title": "B.3.20 — Confidentiality of Information at Rest", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-28", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "6d635f70-ba74-5fbc-a714-fcbe6336d63b", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.20", "title": "NEI 08-09 App D.3.20 — Confidentiality of Information at Rest", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.20", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "f6501b50-5055-5773-a2eb-9fab5a0a357c", "isPublic": true }, { "controlId": "10 CFR 73.54(a)(2)", "title": "10 CFR 73.54(a)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.20", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "4bde81f0-3f8e-5e78-91bf-8805f5292035", "isPublic": true }, { "controlId": "CIP-011-3-R1", "title": "CIP-011-3-R1 — Information Protection Program (BCSI)", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "242f2e8a-fec7-56bf-888f-f0ce96e1eeb5", "isPublic": true }, { "controlId": "CIP-011-3-1.1", "title": "CIP-011-3-1.1 — Method(s) to identify BCSI.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-011-3-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3f2a595b-e4c7-59b5-9641-863717b350a5", "isPublic": true }, { "controlId": "CIP-011-3-1.2", "title": "CIP-011-3-1.2 — Method(s) to protect and securely handle BCSI to mitigate risks of compromising confidentiality.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-011-3-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "bec71668-77df-533d-9af2-1707072a84f1", "isPublic": true }, { "controlId": "CIP-015-1-R2", "title": "CIP-015-1-R2 — INSM Data Protection and Retention", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "56c056d2-6543-58bd-ada3-1b5eda8107ee", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "0f9f9d18-53ba-5ff4-9897-33cb5b3c1df5", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "7dd99fff-5fa2-53c5-98a3-ca947934aa9b", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "ae08a58a-51ea-5696-a9a8-395704c4064c", "isPublic": true } ], "id": 31251, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731015", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731016", "catalogueId": 1062, "uuid": "302699e8-83f0-5a7a-b71a-4a714d459431", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect sensitive/regulated data wherever it is processed and/or stored?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Sensitive / Regulated Data Protection", "description": "

Control Description

Mechanisms exist to protect sensitive/regulated data wherever it is processed and/or stored.

Evidence Request List (ERL)

E-CRY-01\nE-DCH-02\nE-DCH-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ TAASD are categorized according to data classification and business criticality.\n▪ Data classification and handling criteria govern requirements protect sensitive/regulated regardless of where it is stored, processed and/or transmitted.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to document where sensitive/regulated data is stored, transmitted and/or processed.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to protect sensitive/regulated data wherever it is processed and/or stored.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.20
NERC-CIP (2026) Requirements: CIP-011-3-R1, CIP-015-1-R2", "controlId": "DCH-01.2", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-01.2", "references": "

Micro-Small Business (<10 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)

Small Business (10-49 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)

Medium Business (50-249 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Data governance program

Large Business (250-999 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70780, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590316", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590316", "securityControlId": 31252, "ccis": [], "uuid": "971401e6-155f-5565-9e3d-ac98cd54b72e", "testId": "DCH-01.3_A01", "test": "data stewards document the potential impact in the event of a data loss incident.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 567186, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584379", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b64c445-b876-52df-b697-20849a8cdaa1", "parentControlId": 31252, "controlId": "03.08.05.c", "title": "03.08.05.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584379" }, { "id": 567187, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584379", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84c88bb7-d164-5ca4-a6b9-26d1cade18af", "parentControlId": 31252, "controlId": "PR.DS", "title": "PR.DS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584379" } ], "id": 31252, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731016", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731016", "catalogueId": 1062, "uuid": "a8ecb3e1-54f0-534d-bc1d-f36f96556a05", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure media records for sensitive/regulated data contain sufficient information to determine the potential impact in the event of a data loss incident?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Sensitive / Regulated Media Records", "description": "

Control Description

Mechanisms exist to ensure media records for sensitive/regulated data contain sufficient information to determine the potential impact in the event of a data loss incident.

Evidence Request List (ERL)

E-AST-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure media records for sensitive/regulated data contain sufficient information to determine the potential impact in the event of a data loss incident.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-01.3", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-01.3", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Metadata tagging

Small Business (10-49 staff)

∙ Data classification program\n∙ Metadata tagging

Medium Business (50-249 staff)

∙ Data classification program\n∙ Metadata tagging

Large Business (250-999 staff)

∙ Data classification program\n∙ Metadata tagging

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Metadata tagging", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70781, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590317", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590317", "securityControlId": 31253, "ccis": [], "uuid": "833f9b84-196b-5df3-ac37-09ca92b6465f", "testId": "DCH-01.4_A01", "test": "specific individuals and/or roles for logical and /or physical access to sensitive / regulated data are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70782, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590317", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590317", "securityControlId": 31253, "ccis": [], "uuid": "7c1e5338-f156-59f0-87f2-f8e9affc138d", "testId": "DCH-01.4_A02", "test": "only authorized individuals are provided logical and /or physical access to sensitive / regulated data.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70783, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590317", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590317", "securityControlId": 31253, "ccis": [], "uuid": "efbbc065-b672-5776-b55b-4e3376d95efd", "testId": "DCH-01.4_A03", "test": "the system security plan is protected from unauthorized disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.15.02.c", "defaultText": null }, { "id": 70784, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590317", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590317", "securityControlId": 31253, "ccis": [], "uuid": "61a97332-cbac-55ff-9df4-9cab135b7178", "testId": "DCH-01.4_A04", "test": "the SCRM plan is protected from unauthorized disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_SR-02c.[01]\n171A_R3_A.03.17.01.c", "defaultText": null } ], "externalMappings": [ { "id": 567209, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b76bf69b-c994-564a-b761-6c80cf50cfa1", "parentControlId": 31253, "controlId": "03.01.02", "title": "03.01.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584382" }, { "id": 567210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d19bf98c-a6bc-5fa0-82e8-f5f87905fb4e", "parentControlId": 31253, "controlId": "03.01.03", "title": "03.01.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584382" }, { "id": 567211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0190654e-f2e2-5d01-a076-0854b3dff8e7", "parentControlId": 31253, "controlId": "03.01.04.b", "title": "03.01.04.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584382" }, { "id": 567212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40b3b336-dde3-5614-aad8-5bb5d40398f5", "parentControlId": 31253, "controlId": "03.08.01", "title": "03.08.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584382" }, { "id": 567213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6c80bcf-caa1-5e88-8954-4a9eda452c98", "parentControlId": 31253, "controlId": "03.08.02", "title": "03.08.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584382" }, { "id": 567214, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c7f6147-526a-52ea-b111-33fd1a04ca54", "parentControlId": 31253, "controlId": "03.10.01.a", "title": "03.10.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584382" }, { "id": 567215, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f55e92a1-d410-5a01-9296-342243a91c69", "parentControlId": 31253, "controlId": "03.15.02.c", "title": "03.15.02.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584382" }, { "id": 567216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584383", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e472de5-a19a-5829-a26d-cca33c967e7b", "parentControlId": 31253, "controlId": "03.17.01.c", "title": "03.17.01.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584383" }, { "id": 567221, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584383", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1e25ff1-8f1f-57ea-95c5-e88626f54a20", "parentControlId": 31253, "controlId": "PR.DS", "title": "PR.DS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584383" }, { "id": 567226, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584384", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ae6db9f-d399-59f6-8982-2576f2550fb7", "parentControlId": 31253, "controlId": "9-2.a", "title": "9-2.a", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584384" } ], "id": 31253, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731016", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731016", "catalogueId": 1062, "uuid": "41739aff-1c5c-592e-afbd-18a91c1d0e39", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization explicitly define authorizations for specific individuals and/or roles for logical and /or physical access to sensitive/regulated data?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Defining Access Authorizations for Sensitive / Regulated Data", "description": "

Control Description

Mechanisms exist to explicitly define authorizations for specific individuals and/or roles for logical and /or physical access to sensitive/regulated data.

Evidence Request List (ERL)

E-DCH-02\nE-DCH-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to explicitly define authorizations for specific individuals and/or roles for logical and /or physical access to sensitive/regulated data.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-01.4", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-01.4", "references": "

Micro-Small Business (<10 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)

Small Business (10-49 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)

Medium Business (50-249 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Data governance program

Large Business (250-999 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70785, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590318", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590318", "securityControlId": 31254, "ccis": [], "uuid": "5d7dd2f9-f5e8-5ac5-bd33-52b1d9fe94b4", "testId": "DCH-02_A01", "test": "a data classification scheme is defined that covers reasonable data types to address the organization's operational needs.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70786, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590318", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590318", "securityControlId": 31254, "ccis": [], "uuid": "02eca028-4391-577b-a0d2-6e38484c97c7", "testId": "DCH-02_A02", "test": "data and assets are categorized in accordance with the data classification scheme that addresses applicable statutory, regulatory and contractual requirements.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 567258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da1687a6-9207-509f-9b27-1911b03b7d42", "parentControlId": 31254, "controlId": "DATA 1.1", "title": "DATA 1.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584387" }, { "id": 567259, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79c614bb-83e0-5e0c-8a9d-521c8b716226", "parentControlId": 31254, "controlId": "DATA 1.2", "title": "DATA 1.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584388" }, { "id": 567260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce59f052-a14b-544a-8b74-af0a9778d65d", "parentControlId": 31254, "controlId": "5.9", "title": "5.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584388" }, { "id": 567261, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab53ae71-5e5d-5d83-8355-1a709dc53d7e", "parentControlId": 31254, "controlId": "5.12", "title": "5.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584388" }, { "id": 567270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584389", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e315760-20ed-586e-89f1-e850cff691e9", "parentControlId": 31254, "controlId": "03.04.11.a", "title": "03.04.11.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584389" }, { "id": 567271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584389", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d269d1d-92ca-55dd-80fb-1f225520e698", "parentControlId": 31254, "controlId": "03.08.01", "title": "03.08.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584389" }, { "id": 567272, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584389", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e85e18d-c161-566d-846f-4de44a901bfa", "parentControlId": 31254, "controlId": "03.08.04", "title": "03.08.04", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584389" }, { "id": 567274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584389", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aceb3b99-58a8-50f6-85a3-05c3f2a907d9", "parentControlId": 31254, "controlId": "ID.AM-05", "title": "ID.AM-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584389" }, { "id": 567275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584389", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0f9fd8f-12e0-5d4c-bea9-9b7bd79cfcd4", "parentControlId": 31254, "controlId": "PR.DS", "title": "PR.DS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584389" }, { "id": 567336, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bdff9ad-9f9a-56c8-95a1-731e0bb7d682", "parentControlId": 31254, "controlId": "B3.a", "title": "B3.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584396" }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "2a13bcd9-8e3d-5efb-955b-32de18d763f4", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "62439a2b-05de-5ba2-a505-863a075907bf", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "9c86f7a9-51fb-5993-ab13-90a6ed3e6d1a", "isPublic": true } ], "id": 31254, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731017", "catalogueId": 1062, "uuid": "302a7401-1c08-5d3e-97b3-1a38336da9c7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 10.0, "title": "Data & Asset Classification", "description": "

Control Description

Mechanisms exist to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.

Evidence Request List (ERL)

E-DCH-01\nE-DCH-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ TAASD are categorized according to data classification and business criticality.\n▪ Data classification and handling criteria govern requirements protect sensitive/regulated regardless of where it is stored, processed and/or transmitted.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to categorize data in accordance with organizational policies and standards.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to document where sensitive/regulated data is stored, transmitted and/or processed.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure data and assets are categorized in accordance with applicable statutory, regulatory and contractual requirements.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-02", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-02", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ IT Asset Management (ITAM) program

Small Business (10-49 staff)

∙ Data classification program\n∙ IT Asset Management (ITAM) program

Medium Business (50-249 staff)

∙ Data classification program\n∙ IT Asset Management (ITAM) program\n∙ Data governance program

Large Business (250-999 staff)

∙ Data classification program\n∙ IT Asset Management (ITAM) program\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Data classification program\n∙ IT Asset Management (ITAM) program\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70789, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59032", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59032", "securityControlId": 31256, "ccis": [], "uuid": "29a1c42f-4615-5cdb-8d59-9558414e7808", "testId": "DCH-03_A01", "test": "access to sensitive / regulated data on system media is restricted to authorized personnel or roles.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MP-02[01]\n171A_3.8.2", "defaultText": null }, { "id": 70790, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590321", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590321", "securityControlId": 31256, "ccis": [], "uuid": "e6cb3fba-f5c8-5b9e-b58c-db04b6196e6c", "testId": "DCH-03_A02", "test": "types of digital media to which access is restricted are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-02_ODP[01]", "defaultText": null }, { "id": 70791, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590321", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590321", "securityControlId": 31256, "ccis": [], "uuid": "9e39f643-f6ea-5a81-81ee-8eebb1e3791f", "testId": "DCH-03_A03", "test": "personnel or roles authorized to access digital media is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-02_ODP[02]", "defaultText": null }, { "id": 70792, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590321", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590321", "securityControlId": 31256, "ccis": [], "uuid": "812516fb-e025-5a97-9995-0a022b1db921", "testId": "DCH-03_A04", "test": "types of non-digital media to which access is restricted are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-02_ODP[03]", "defaultText": null }, { "id": 70793, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590321", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590321", "securityControlId": 31256, "ccis": [], "uuid": "a2d4cfc4-5f7a-5bba-8497-affc014c8c04", "testId": "DCH-03_A05", "test": "personnel or roles authorized to access non-digital media is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-02_ODP[04]", "defaultText": null }, { "id": 70794, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590321", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590321", "securityControlId": 31256, "ccis": [], "uuid": "9ab978f8-5743-5ee4-b928-ecf4b38b811d", "testId": "DCH-03_A06", "test": "access to types of non-digital media is restricted to personnel or roles.
PPTDF Applicability: Data
Assessment Rigor: 2
SCF Defined Parameters: all types of digital and/or non-digital media containing sensitive information", "otherId": "53A_R5_MP-02[02]\n171A_3.8.2", "defaultText": null }, { "id": 70795, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590322", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590322", "securityControlId": 31256, "ccis": [], "uuid": "213f045a-9170-52be-8cac-48c777fe7dd1", "testId": "DCH-03_A07", "test": "access to CUI on system media is restricted to authorized personnel or roles.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.08.02", "defaultText": null } ], "externalMappings": [ { "id": 567409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584413", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55105e53-7073-513d-9df6-0c9ea9b038e8", "parentControlId": 31256, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584413" }, { "id": 567411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584413", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aea618da-b353-574f-8076-9fc7e52a8e6b", "parentControlId": 31256, "controlId": "MP-2", "title": "MP-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584413" }, { "id": 567412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584413", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09478ad7-606f-58e0-ab88-523adf8f18a4", "parentControlId": 31256, "controlId": "MP-02", "title": "MP-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584413" }, { "id": 567414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584413", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50d6a0d1-8abe-5f73-981f-e6e4d7caf600", "parentControlId": 31256, "controlId": "MP-02", "title": "MP-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584413" }, { "id": 567416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "005fb4bd-4df5-5368-9a17-7f51674ea86a", "parentControlId": 31256, "controlId": "MP-02", "title": "MP-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584414" }, { "id": 567417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4edb8acb-10ed-5bc1-9824-4d07d39d2e1a", "parentControlId": 31256, "controlId": "MP-02", "title": "MP-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584414" }, { "id": 567418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79924b0b-3c94-5603-b44b-e4f1ee07038c", "parentControlId": 31256, "controlId": "MP-02", "title": "MP-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584414" }, { "id": 567419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd7724e0-5267-5892-83bc-83dbb52d44b3", "parentControlId": 31256, "controlId": "MP-02", "title": "MP-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584414" }, { "id": 567420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae79a418-9622-5557-af2c-5ca7b41e3713", "parentControlId": 31256, "controlId": "3.1.3", "title": "3.1.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584414" }, { "id": 567421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7cde74ad-8bc7-5b7e-b75f-011c339755fe", "parentControlId": 31256, "controlId": "3.8.2", "title": "3.8.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584414" }, { "id": 567422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74bb678f-c0e0-5dda-a93a-2d37d9539ed1", "parentControlId": 31256, "controlId": "03.01.03", "title": "03.01.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584415" }, { "id": 567423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "525dbaa5-102a-5855-9c2d-f8a316efd70a", "parentControlId": 31256, "controlId": "03.08.01", "title": "03.08.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584415" }, { "id": 567424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b4b2d88-c775-52e2-bb32-a3b8c9003b2f", "parentControlId": 31256, "controlId": "03.08.02", "title": "03.08.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584415" }, { "id": 567428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "939f1e94-f3c7-5ad9-ad28-d6d744c68b75", "parentControlId": 31256, "controlId": "PR.DS", "title": "PR.DS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584415" }, { "controlId": "B.1.13", "title": "B.1.13 — Automated Marking", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-16", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "96c91d63-c43d-56c9-ab8f-c54bd8447eff", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.13", "title": "NEI 08-09 App D.1.13 — Automated Marking", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.13", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "1fad3d7e-6deb-51c1-9637-3997e0865c72", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.13", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "976f6969-0f70-566a-99c7-2e85a004e02f", "isPublic": true }, { "controlId": "B.1.14", "title": "B.1.14 — Automated Labeling", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-16", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "3adf947e-a6ab-511a-86b2-e90c6a6b1f73", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.14", "title": "NEI 08-09 App D.1.14 — Automated Labeling", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.14", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "51e41ce3-d702-55f7-80f4-48edb28ac63f", "isPublic": true }, { "controlId": "C.1.2", "title": "C.1.2 — Media Access", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MP-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ab0372d2-0f8a-5fda-b84f-a170a52e4b2a", "isPublic": true }, { "controlId": "NEI 08-09 App E.1.2", "title": "NEI 08-09 App E.1.2 — Media Access", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.1.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "ebcfe5f4-dfbb-5d8f-bbb1-9460a94b222c", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7e43eb34-1538-569f-a219-e564b9603ef3", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "68da3365-f457-558f-9ede-55664f7617c7", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "bed3e39f-c76d-55d3-93d4-34b9e51883a1", "isPublic": true } ], "id": 31256, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731017", "catalogueId": 1062, "uuid": "61c65062-460e-5b91-9854-f68cd730b1ed", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization control and restrict access to digital and non-digital media to authorized individuals?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Media Access", "description": "

Control Description

Mechanisms exist to control and restrict access to digital and non-digital media to authorized individuals.

Evidence Request List (ERL)

E-IAM-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to control and restrict access to digital and non-digital media to authorized individuals.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.13, B.1.14, C.1.2", "controlId": "DCH-03", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-03", "references": "

Micro-Small Business (<10 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)

Small Business (10-49 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)

Medium Business (50-249 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Data governance program

Large Business (250-999 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70796, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590322", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590322", "securityControlId": 31257, "ccis": [], "uuid": "a46aeb3d-7d66-5d5a-a22b-aaeaf4633885", "testId": "DCH-03.1_A01", "test": "a documented data classification scheme exists that covers data protection controls associated with sharing information with third-parties.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70797, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590322", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590322", "securityControlId": 31257, "ccis": [], "uuid": "16e984a2-ea2a-5a5d-87ec-8122232fc05c", "testId": "DCH-03.1_A02", "test": "data stewards establish formalized business process-specific procedures to limit the disclosure of data to authorized parties.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70798, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590322", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590322", "securityControlId": 31257, "ccis": [], "uuid": "5e1aef80-4c0e-57c7-af37-a92348c7fc16", "testId": "DCH-03.1_A03", "test": "the system security plan is protected from unauthorized disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.15.02.c", "defaultText": null }, { "id": 70799, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590322", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590322", "securityControlId": 31257, "ccis": [], "uuid": "33732d96-76c4-587d-8b55-1e7ce1d43129", "testId": "DCH-03.1_A04", "test": "the SCRM plan is protected from unauthorized disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_SR-02c.[01]\n171A_R3_A.03.17.01.c", "defaultText": null } ], "externalMappings": [ { "id": 567482, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79b6587f-5b71-5ee5-9d22-36e14ddc746f", "parentControlId": 31257, "controlId": "03.01.22.a", "title": "03.01.22.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584421" }, { "id": 567483, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5d8e0a2-773c-502a-8ebf-bb96d74e35ae", "parentControlId": 31257, "controlId": "03.15.02.c", "title": "03.15.02.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584421" }, { "id": 567484, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fa4ce84-f7fd-50e7-9fb3-c4d6e7bafc45", "parentControlId": 31257, "controlId": "03.17.01.c", "title": "03.17.01.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584422" }, { "id": 567630, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b8104b7-f016-5c63-a8c5-b4556f003b31", "parentControlId": 31257, "controlId": "§117.15(h)", "title": "§117.15(h)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584438" }, { "id": 567631, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f956abac-70ae-52c9-a445-57b58259dc7c", "parentControlId": 31257, "controlId": "§117.15(h)(1)", "title": "§117.15(h)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584438" }, { "id": 567632, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "590c967b-a90e-52a7-94eb-39f65fc8a0eb", "parentControlId": 31257, "controlId": "§117.15(h)(2)", "title": "§117.15(h)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584438" }, { "id": 567633, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7119cdb7-9bf5-585f-84bf-af255f256f58", "parentControlId": 31257, "controlId": "§117.15(h)(2)(i)", "title": "§117.15(h)(2)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584439" }, { "id": 567634, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6d806cb-edc9-5d83-99df-6fff96f88d4a", "parentControlId": 31257, "controlId": "§117.15(h)(2)(i)(A)", "title": "§117.15(h)(2)(i)(A)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584439" }, { "id": 567635, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25bc145d-dfbf-5576-97e4-071b0935dd58", "parentControlId": 31257, "controlId": "§117.15(h)(2)(i)(B)", "title": "§117.15(h)(2)(i)(B)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584439" }, { "id": 567636, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a3a9cbf-e1cc-58b2-a109-69945ec3d694", "parentControlId": 31257, "controlId": "§117.19(b)(3)(i)", "title": "§117.19(b)(3)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584439" }, { "id": 567637, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df0e8fdf-a4ee-5fc7-850e-f81802a6d61d", "parentControlId": 31257, "controlId": "§117.19(b)(4)(i)", "title": "§117.19(b)(4)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584439" }, { "id": 567638, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3188692-2136-58c3-94e8-5961abf329d1", "parentControlId": 31257, "controlId": "§117.19(b)(5)(i)", "title": "§117.19(b)(5)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584439" }, { "id": 567639, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2af611d6-1450-57ee-911a-73697aab68cd", "parentControlId": 31257, "controlId": "8-3.a(2)", "title": "8-3.a(2)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584439" } ], "id": 31257, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731018", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731018", "catalogueId": 1062, "uuid": "f09c0360-9bb2-537d-bd58-26f222be315f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict the disclosure of sensitive/regulated data to authorized parties with a need to know?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Disclosure of Information", "description": "

Control Description

Mechanisms exist to restrict the disclosure of sensitive/regulated data to authorized parties with a need to know.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict the disclosure of sensitive/regulated data to authorized parties with a need to know.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-03.1", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Non-Disclosure Agreements (NDAs)

Small Business (10-49 staff)

∙ Non-Disclosure Agreements (NDAs)

Medium Business (50-249 staff)

∙ Non-Disclosure Agreements (NDAs)\n∙ Data Loss Prevention (DLP)

Large Business (250-999 staff)

∙ Non-Disclosure Agreements (NDAs)\n∙ Data Loss Prevention (DLP)

Enterprise (>1,000 staff)

∙ Non-Disclosure Agreements (NDAs)\n∙ Data Loss Prevention (DLP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70800, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590323", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590323", "securityControlId": 31258, "ccis": [], "uuid": "a12de01b-44b7-576c-83a7-431b12fcddfd", "testId": "DCH-03.2_A01", "test": "automated mechanisms apply data masking to sensitive information that is displayed or printed, where technically feasible.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 567670, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cfaed00a-830c-5bcf-95a8-f5a5b90f8500", "parentControlId": 31258, "controlId": "8.11", "title": "8.11", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584451" } ], "id": 31258, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731018", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731018", "catalogueId": 1062, "uuid": "3ceae8db-206c-5657-b40c-c012f07bfca0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization apply data masking to sensitive/regulated information that is displayed or printed?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Masking Displayed Data", "description": "

Control Description

Mechanisms exist to apply data masking to sensitive/regulated information that is displayed or printed.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to apply data masking to sensitive/regulated information that is displayed or printed.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-03.2", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-03.2", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ IT Asset Management (ITAM) program

Small Business (10-49 staff)

∙ Data classification program\n∙ IT Asset Management (ITAM) program

Medium Business (50-249 staff)

∙ Data classification program\n∙ IT Asset Management (ITAM) program\n∙ Data governance program

Large Business (250-999 staff)

∙ Data classification program\n∙ IT Asset Management (ITAM) program\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Data classification program\n∙ IT Asset Management (ITAM) program\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70801, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590323", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590323", "securityControlId": 31259, "ccis": [], "uuid": "10c45a45-cd2a-5c33-8702-23f2dcaefe4c", "testId": "DCH-03.3_A01", "test": "the external system or system component to which to release information is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-03(09)_ODP[01]", "defaultText": null }, { "id": 70802, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590323", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590323", "securityControlId": 31259, "ccis": [], "uuid": "c45f9c3c-7660-5020-a6d5-efd11452b0cb", "testId": "DCH-03.3_A02", "test": "controls to be provided by the external system or system component are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-03(09)_ODP[02]", "defaultText": null }, { "id": 70803, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590323", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590323", "securityControlId": 31259, "ccis": [], "uuid": "bc08136f-d4c9-5124-8754-87e8075a100d", "testId": "DCH-03.3_A03", "test": "controls used to validate appropriateness of information to be released are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-03(09)_ODP[03]", "defaultText": null }, { "id": 70804, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590323", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590323", "securityControlId": 31259, "ccis": [], "uuid": "46738792-984d-5da3-acc5-5c7163b2e0fe", "testId": "DCH-03.3_A04", "test": "information is released outside of the system only if the receiving system or system component provides organization-defined controls.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-03(09)(a)", "defaultText": null }, { "id": 70805, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590323", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590324", "securityControlId": 31259, "ccis": [], "uuid": "8b19218f-f837-5165-a8f3-7bca278d10a6", "testId": "DCH-03.3_A05", "test": "information is released outside of the system only if organization-defined controls are used to validate the appropriateness of the information designated for release.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-03(09)(b)", "defaultText": null } ], "externalMappings": [ { "id": 567683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b67588b-ac95-5eec-9916-e64676eb7108", "parentControlId": 31259, "controlId": "AC-3(9)", "title": "AC-3(9)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584452" }, { "id": 567684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74733522-0700-5af0-ab7d-3db5480ec74e", "parentControlId": 31259, "controlId": "AC-03(09)", "title": "AC-03(09)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584452" }, { "id": 567685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c89fbc4c-09e8-5c30-8410-4b2093efc3cc", "parentControlId": 31259, "controlId": "AC-03(09)", "title": "AC-03(09)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584453" }, { "id": 567686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "104f7f1d-9039-52d9-8d24-33e73868da47", "parentControlId": 31259, "controlId": "AC-3(9)", "title": "AC-3(9)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584453" } ], "id": 31259, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731019", "catalogueId": 1062, "uuid": "93033c89-8bd6-588d-9078-454fe1f78cee", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to validate cybersecurity and data protection attributes prior to releasing information to external Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 4.0, "title": "Controlled Release", "description": "

Control Description

Automated mechanisms exist to validate cybersecurity and data protection attributes prior to releasing information to external Technology Assets, Applications and/or Services (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically validate cybersecurity and data protection attributes prior to releasing information to external Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-03.3", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-03.3", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70806, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590324", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590324", "securityControlId": 31260, "ccis": [], "uuid": "d60727fc-6766-59c5-a2b3-de0cfb5a71a7", "testId": "DCH-04_A01", "test": "types of media exempt from marking when remaining in controlled areas are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-03_ODP[01]", "defaultText": null }, { "id": 70807, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590324", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590324", "securityControlId": 31260, "ccis": [], "uuid": "4ae77051-1e45-5d93-8ff4-2cad5cf448e4", "testId": "DCH-04_A02", "test": "media is marked with applicable sensitive / regulated data markings.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "171A_3.8.4[a]", "defaultText": null }, { "id": 70808, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590324", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590324", "securityControlId": 31260, "ccis": [], "uuid": "ff864641-a9bd-5205-ac36-0dbbc8c61a32", "testId": "DCH-04_A03", "test": "media is marked to indicate distribution limitations, handling caveats and applicable security markings (if any) of the information.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.8.4[b]\n53A_R5_MP-03a.", "defaultText": null }, { "id": 70809, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590324", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590324", "securityControlId": 31260, "ccis": [], "uuid": "abdfdb56-8482-5ebe-85a0-7b7356fe98b9", "testId": "DCH-04_A04", "test": "controlled areas where media is exempt from marking are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-03_ODP[02]", "defaultText": null }, { "id": 70810, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590324", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590324", "securityControlId": 31260, "ccis": [], "uuid": "7915bd3d-e0f5-5f1e-b71b-9cc2af2ebe2f", "testId": "DCH-04_A05", "test": "types of media exempted from marking remain within controlled areas.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-03b.", "defaultText": null }, { "id": 70811, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590325", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590325", "securityControlId": 31260, "ccis": [], "uuid": "91816930-4d49-55fc-8098-a0bab6643723", "testId": "DCH-04_A06", "test": "system media that contain sensitive / regulated data are marked to indicate distribution limitations.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 70812, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590328", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590328", "securityControlId": 31260, "ccis": [], "uuid": "a3f95e15-97e8-5bb0-bdc1-268edede8b55", "testId": "DCH-04_A07", "test": "system media that contain sensitive / regulated data are marked to indicate handling caveats.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 70813, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590328", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590328", "securityControlId": 31260, "ccis": [], "uuid": "9169e331-4209-57b6-96f0-0bad9cc42682", "testId": "DCH-04_A08", "test": "system media that contain sensitive / regulated data are marked to indicate applicable sensitive / regulated data markings.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 70814, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590329", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590329", "securityControlId": 31260, "ccis": [], "uuid": "eeccbd86-84f3-56b3-ae67-6a8495893a6c", "testId": "DCH-04_A09", "test": "system media that contain CUI are marked to indicate distribution limitations.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.08.04[01]", "defaultText": null }, { "id": 70815, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590329", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590329", "securityControlId": 31260, "ccis": [], "uuid": "838a6fb5-d071-58aa-a768-0921579be278", "testId": "DCH-04_A10", "test": "system media that contain CUI are marked to indicate handling caveats.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.08.04[02]", "defaultText": null }, { "id": 70816, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590329", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590329", "securityControlId": 31260, "ccis": [], "uuid": "23117642-618f-501b-8f9e-4046a3056bd7", "testId": "DCH-04_A11", "test": "system media that contain CUI are marked to indicate applicable CUI markings.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.08.04[03]", "defaultText": null } ], "externalMappings": [ { "id": 567700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac3da99d-4980-5deb-9a50-0661dc2e5343", "parentControlId": 31260, "controlId": "5.1", "title": "5.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584455" }, { "id": 567701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94418d6d-6f79-5a54-97bd-78ba38258960", "parentControlId": 31260, "controlId": "5.13", "title": "5.13", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584455" }, { "id": 567707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc0c778f-db63-5ead-b226-16657aa4afc4", "parentControlId": 31260, "controlId": "MP-3", "title": "MP-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584455" }, { "id": 567708, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d150b911-179e-509e-869d-3650c0caa25c", "parentControlId": 31260, "controlId": "MP-03", "title": "MP-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584455" }, { "id": 567710, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584456", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c9f76cd-fc80-5189-8c64-3ee854e0be64", "parentControlId": 31260, "controlId": "MP-03", "title": "MP-03", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584456" }, { "id": 567711, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584456", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14f8fedd-f58f-539e-89a1-ee30a0ce34d3", "parentControlId": 31260, "controlId": "MP-03", "title": "MP-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584456" }, { "id": 567712, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584456", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3457637-4b76-5864-921d-13984569e2fa", "parentControlId": 31260, "controlId": "MP-03", "title": "MP-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584456" }, { "id": 567713, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584456", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "881fef4b-ddf4-5e6a-abe8-48a3f42b4c2e", "parentControlId": 31260, "controlId": "MP-03", "title": "MP-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584456" }, { "id": 567714, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584456", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a818b90-df37-5675-882f-fe0de63854cd", "parentControlId": 31260, "controlId": "3.8.4", "title": "3.8.4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584456" }, { "id": 567715, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584456", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0699a224-2254-59ad-9edf-22d545b36988", "parentControlId": 31260, "controlId": "03.08.04", "title": "03.08.04", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584456" }, { "id": 567733, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d2e063c-959d-55d5-ba15-e80584d517d3", "parentControlId": 31260, "controlId": "§117.14(a)(1)", "title": "§117.14(a)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584459" }, { "id": 567734, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0baeb9ae-5725-5c11-8cdc-4352b845df33", "parentControlId": 31260, "controlId": "§117.14(a)(2)", "title": "§117.14(a)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584459" }, { "id": 567735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00161801-f326-5674-8842-c096357ae7cd", "parentControlId": 31260, "controlId": "§117.14(b)", "title": "§117.14(b)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584459" }, { "id": 567736, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21920376-3509-54ac-a2fa-ea879fe8f0e8", "parentControlId": 31260, "controlId": "§117.14(c)", "title": "§117.14(c)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584459" }, { "id": 567737, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36b828e6-049c-59f0-943a-c2c282d9e047", "parentControlId": 31260, "controlId": "§117.14(d)", "title": "§117.14(d)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584459" }, { "id": 567738, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ee3046e-045e-54ab-8b71-f6a98e108c22", "parentControlId": 31260, "controlId": "§117.14(e)", "title": "§117.14(e)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584459" }, { "id": 567739, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a32e7bc5-dfb0-5030-a102-603f4d21a062", "parentControlId": 31260, "controlId": "§117.14(f)", "title": "§117.14(f)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584459" }, { "id": 567740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d29f3e28-86d7-5b16-b282-a89d37bee9fe", "parentControlId": 31260, "controlId": "§117.14(f)(1)", "title": "§117.14(f)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584459" }, { "id": 567741, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26987806-01e4-5e6b-8d69-f982ccffa3a4", "parentControlId": 31260, "controlId": "§117.14(f)(2)", "title": "§117.14(f)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584459" }, { "id": 567742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a763c289-6e93-5b9c-94fb-12c182e14c89", "parentControlId": 31260, "controlId": "§117.14(g)", "title": "§117.14(g)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58446" }, { "id": 567743, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd3ad04d-f4ff-52d5-92fb-e426b586fae5", "parentControlId": 31260, "controlId": "§117.14(g)(1)", "title": "§117.14(g)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58446" }, { "id": 567744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d486f5b6-db8c-5018-9213-ebda8be844cf", "parentControlId": 31260, "controlId": "§117.14(g)(2)", "title": "§117.14(g)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58446" }, { "id": 567745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff6c9591-0452-55e8-b8ac-75c341f089f5", "parentControlId": 31260, "controlId": "§117.14(h)", "title": "§117.14(h)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58446" }, { "id": 567746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f7d5b49-6b0d-52b3-98b1-352f0db91133", "parentControlId": 31260, "controlId": "§117.14(i)", "title": "§117.14(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58446" }, { "id": 567747, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea76dd44-4e2b-543b-aecd-6ffac99ed1c3", "parentControlId": 31260, "controlId": "§117.14(i)(1)", "title": "§117.14(i)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58446" }, { "id": 567748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9699335e-700e-56a8-8b58-7e021815be5f", "parentControlId": 31260, "controlId": "§117.14(i)(1)(i)", "title": "§117.14(i)(1)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58446" }, { "id": 567749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ff864ad-6b2d-58b1-8d80-a379a8fbc570", "parentControlId": 31260, "controlId": "§117.14(i)(1)(ii)", "title": "§117.14(i)(1)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58446" }, { "id": 567750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9369eb0d-873c-5416-8a46-a7b564b6b1a5", "parentControlId": 31260, "controlId": "§117.14(i)(2)", "title": "§117.14(i)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58446" }, { "id": 567751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584461", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1564ccb-2e3d-57f0-bd28-d9ba6fa5e4af", "parentControlId": 31260, "controlId": "§117.14(i)(3)", "title": "§117.14(i)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584461" }, { "id": 567752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584461", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac9a6193-dbd9-5896-87c6-0272e84ce42a", "parentControlId": 31260, "controlId": "§117.14(i)(4)", "title": "§117.14(i)(4)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584461" }, { "id": 567753, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584461", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eba630f9-1ada-5ce2-9b52-9be54862f575", "parentControlId": 31260, "controlId": "§117.14(j)", "title": "§117.14(j)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584461" }, { "id": 567754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584461", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0424764a-f077-5b22-aab1-c064bdaf6221", "parentControlId": 31260, "controlId": "§117.14(j)(1)", "title": "§117.14(j)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584461" }, { "id": 567755, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584461", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b3afc01-0720-5f83-b0f7-6e549b254187", "parentControlId": 31260, "controlId": "§117.14(j)(1)(i)", "title": "§117.14(j)(1)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584461" }, { "id": 567756, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584461", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ccb4bb0b-1289-5d28-94de-94886ec2cfdc", "parentControlId": 31260, "controlId": "§117.14(j)(1)(ii)", "title": "§117.14(j)(1)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584461" }, { "id": 567757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584461", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0b34357-6ae3-549c-aa1f-1d55ef0197c4", "parentControlId": 31260, "controlId": "§117.14(j)(1)(iii)", "title": "§117.14(j)(1)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584461" }, { "id": 567758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584461", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf1e9a0a-9d27-5f49-8855-f9cc13d80e3c", "parentControlId": 31260, "controlId": "§117.14(j)(2)", "title": "§117.14(j)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584461" }, { "id": 567759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584461", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33019492-b532-54df-a169-2bb01f821d96", "parentControlId": 31260, "controlId": "§117.14(j)(3)", "title": "§117.14(j)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584461" }, { "id": 567760, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a863d145-c3ad-538e-9702-eacf7d213fc8", "parentControlId": 31260, "controlId": "§117.14(k)", "title": "§117.14(k)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584462" }, { "id": 567761, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2e0bb28-76ae-5997-9b8b-9a72ecb9e13e", "parentControlId": 31260, "controlId": "§117.14(k)(1)", "title": "§117.14(k)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584462" }, { "id": 567762, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67bc25e3-8479-5ab1-b9cc-dbcb9b54ccda", "parentControlId": 31260, "controlId": "§117.14(k)(2)", "title": "§117.14(k)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584462" }, { "id": 567763, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f6b4f67-40a4-5962-be49-093078d6c5ff", "parentControlId": 31260, "controlId": "§117.14(k)(3)", "title": "§117.14(k)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584462" }, { "id": 567764, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d40ba2d7-0eaa-5233-8444-68ae9f976bf0", "parentControlId": 31260, "controlId": "§117.14(k)(3)(i)", "title": "§117.14(k)(3)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584462" }, { "id": 567765, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "787861f1-2094-5a24-a5b4-835b9f7030f8", "parentControlId": 31260, "controlId": "§117.14(k)(3)(ii)", "title": "§117.14(k)(3)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584462" }, { "id": 567766, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "caeb1a45-a751-522a-b2c2-80e43e8484e1", "parentControlId": 31260, "controlId": "§117.14(k)(3)(iii)", "title": "§117.14(k)(3)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584462" }, { "id": 567767, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71c7d676-40fd-5791-a4ca-58f0f4f077eb", "parentControlId": 31260, "controlId": "§117.14(l)", "title": "§117.14(l)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584462" }, { "id": 567768, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bc1f458-47d9-5f72-b15f-85257f859a21", "parentControlId": 31260, "controlId": "§117.14(m)", "title": "§117.14(m)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584463" }, { "id": 567769, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6027559-9e7b-5f82-a194-de6fdeb57dc8", "parentControlId": 31260, "controlId": "§117.14(m)(1)", "title": "§117.14(m)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584463" }, { "id": 567770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18af1dd1-4b5c-59b1-8f63-7eac75ce814f", "parentControlId": 31260, "controlId": "§117.14(m)(2)", "title": "§117.14(m)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584463" }, { "id": 567771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f8b6d4c-87bb-5e70-bede-369c4c6cde9d", "parentControlId": 31260, "controlId": "§117.14(m)(2)(i)", "title": "§117.14(m)(2)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584463" }, { "id": 567772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d995947-c5c8-5cc5-9e49-57ba79ecf5aa", "parentControlId": 31260, "controlId": "§117.14(m)(2)(ii)", "title": "§117.14(m)(2)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584463" }, { "id": 567773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87eaab0b-8d4a-5d08-a2cf-fa1ca12943f5", "parentControlId": 31260, "controlId": "§117.14(m)(2)(iii)", "title": "§117.14(m)(2)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584463" }, { "id": 567774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3df5a3a-7ffe-51a2-9072-6cdd0f9be4ed", "parentControlId": 31260, "controlId": "§117.14(m)(3)", "title": "§117.14(m)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584463" }, { "id": 567775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "584d83d3-f71d-5d5b-bf1e-8f89dcb89081", "parentControlId": 31260, "controlId": "§117.14(n)", "title": "§117.14(n)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584463" }, { "id": 567776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f68baad-2d70-5480-8863-2f6d9fd5675f", "parentControlId": 31260, "controlId": "§117.14(n)(1)", "title": "§117.14(n)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584464" }, { "id": 567777, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9477ce7a-ce78-595d-b595-6f7ac47d58fd", "parentControlId": 31260, "controlId": "§117.14(n)(2)", "title": "§117.14(n)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584464" }, { "id": 567778, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f0f2e2d-31ef-5a73-8f4f-28bc9e5e23eb", "parentControlId": 31260, "controlId": "§117.14(n)(3)", "title": "§117.14(n)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584464" }, { "id": 567779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c134a30f-57eb-57ec-b1f0-34da176d4781", "parentControlId": 31260, "controlId": "§117.14(o)", "title": "§117.14(o)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584464" }, { "id": 567780, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b6ae846-bae4-5017-9822-e9e63b584d5d", "parentControlId": 31260, "controlId": "§117.14(p)", "title": "§117.14(p)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584464" }, { "id": 567781, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f34aaf0b-39c4-51ed-a430-c98c97543de8", "parentControlId": 31260, "controlId": "§117.14(q)", "title": "§117.14(q)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584464" }, { "id": 567782, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2de8ae84-7d32-54cd-a730-791cbef6d3e4", "parentControlId": 31260, "controlId": "2-6", "title": "2-6", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584464" }, { "id": 567783, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "557c9069-2272-592a-b72d-f87b3d642511", "parentControlId": 31260, "controlId": "2-7", "title": "2-7", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584464" }, { "id": 567784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a667bf4-eb01-5a48-a7c1-943bb81450e5", "parentControlId": 31260, "controlId": "2-7.a(1)", "title": "2-7.a(1)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584464" }, { "id": 567785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584465", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2d68d7a-1371-5904-b3db-b2a8b518a74b", "parentControlId": 31260, "controlId": "2-7.a(2)", "title": "2-7.a(2)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584465" }, { "id": 567786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584465", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a33a6e6-8ca5-5d71-b6aa-36e3fa643d9a", "parentControlId": 31260, "controlId": "2-7.a(3)", "title": "2-7.a(3)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584465" }, { "id": 567787, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584465", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c7e3883-bee8-5b30-b34a-f66eec6281c6", "parentControlId": 31260, "controlId": "2-7.b", "title": "2-7.b", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584465" }, { "id": 567788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584465", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d482223c-57d2-5d68-b704-a0a8234a110a", "parentControlId": 31260, "controlId": "2-7.b(1)(a)", "title": "2-7.b(1)(a)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584465" }, { "id": 567789, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584465", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08c63986-ccd3-577e-aae8-aedac2af250c", "parentControlId": 31260, "controlId": "2-7.b(1)(b)", "title": "2-7.b(1)(b)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584465" }, { "id": 567790, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584465", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "336b3662-84cb-5606-b3f2-375cca5884a9", "parentControlId": 31260, "controlId": "2-7.b(2)(a)", "title": "2-7.b(2)(a)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584465" }, { "id": 567791, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584465", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98b21bd7-1c61-51a2-8e7b-e563e9e3cccb", "parentControlId": 31260, "controlId": "2-7.b(2)(b)", "title": "2-7.b(2)(b)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584465" }, { "id": 567792, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584465", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "720ec1e8-428c-5aa8-b9db-aa76eceaf794", "parentControlId": 31260, "controlId": "2-7.c(1)", "title": "2-7.c(1)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584465" }, { "id": 567793, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584466", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "201f2597-8cb7-599c-b69f-e3411247bba5", "parentControlId": 31260, "controlId": "2-7.c(2)", "title": "2-7.c(2)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584466" }, { "id": 567794, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584466", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9792c596-6d09-5a68-8c8c-e9e041294ed0", "parentControlId": 31260, "controlId": "2-7.c(2)(a)", "title": "2-7.c(2)(a)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584466" }, { "id": 567795, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584466", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8287d56-d83d-5d9a-9620-3eeba412dc0d", "parentControlId": 31260, "controlId": "2-7.c(2)(b)", "title": "2-7.c(2)(b)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584466" }, { "id": 567796, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584466", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67e709d7-2ef2-5245-8696-365a24d36164", "parentControlId": 31260, "controlId": "2-7.c(2)(c)", "title": "2-7.c(2)(c)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584466" }, { "id": 567797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584466", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4119a3e8-daab-5a84-b21e-9e42f3ca96c1", "parentControlId": 31260, "controlId": "9-2.c", "title": "9-2.c", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584466" }, { "controlId": "B.1.14", "title": "B.1.14 — Automated Labeling", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-16", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a410cbe2-d0ef-57df-9396-8f1634c5cd58", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.14", "title": "NEI 08-09 App D.1.14 — Automated Labeling", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.14", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "15433a1d-273c-5f23-900e-05c760b55870", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.14", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "fdd70719-f767-5626-adc0-7fe880049c7c", "isPublic": true }, { "controlId": "C.1.3", "title": "C.1.3 — Media Labeling/Marking", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MP-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "3397abfa-8574-59a9-b582-54bd276791d7", "isPublic": true }, { "controlId": "NEI 08-09 App E.1.3", "title": "NEI 08-09 App E.1.3 — Media Labeling/Marking", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.1.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "32435d8e-d3c0-5656-b59d-7dc55ce822e2", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d9d33fc0-7b0e-54df-a5cf-9b8aa1003c3d", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "27eafbae-79c8-5ee8-991c-53a599092df0", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "c2e21947-ad09-5f2d-b00a-d4535208cd5a", "isPublic": true } ], "id": 31260, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731019", "catalogueId": 1062, "uuid": "0e0d8404-4c2b-5584-8175-2b970d698815", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization mark media in accordance with data protection requirements so that personnel are alerted to distribution limitations, handling caveats and applicable security requirements?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Media Marking", "description": "

Control Description

Mechanisms exist to mark media in accordance with data protection requirements so that personnel are alerted to distribution limitations, handling caveats and applicable security requirements.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to mark media in accordance with data protection requirements so that personnel are alerted to distribution limitations, handling caveats and applicable security requirements.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.14, C.1.3", "controlId": "DCH-04", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-04", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Metadata tagging\n∙ IT Asset Management (ITAM) program

Small Business (10-49 staff)

∙ Data classification program\n∙ Metadata tagging\n∙ IT Asset Management (ITAM) program

Medium Business (50-249 staff)

∙ Data classification program\n∙ Metadata tagging\n∙ IT Asset Management (ITAM) program\n∙ Data governance program

Large Business (250-999 staff)

∙ Data classification program\n∙ Metadata tagging\n∙ IT Asset Management (ITAM) program\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Metadata tagging\n∙ IT Asset Management (ITAM) program\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70817, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590329", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590329", "securityControlId": 31261, "ccis": [], "uuid": "455e93c8-1789-5311-8a34-fa1499eba526", "testId": "DCH-04.1_A01", "test": "automated mechanisms mark media and system output to indicate the distribution limitations, handling requirements and applicable security markings (if any) of the information to enable the use of Data Loss Prevention (DLP) and similar automated data protection technologies.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 567841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "670f32d5-7ee4-5fcd-b89f-486616f449f9", "parentControlId": 31261, "controlId": "MP-03", "title": "MP-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584473" }, { "id": 567843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "edd8606b-c666-5a0b-b16a-22bba6c20acd", "parentControlId": 31261, "controlId": "MP-03", "title": "MP-03", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584473" }, { "id": 567844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "130f0dff-f2c9-5e04-b628-fb5c09a84536", "parentControlId": 31261, "controlId": "MP-03", "title": "MP-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584473" }, { "id": 567845, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb0247dd-f4c3-5009-a1d0-0af380ed424f", "parentControlId": 31261, "controlId": "MP-03", "title": "MP-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584473" }, { "id": 567846, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17ffd785-03e8-5cad-aa4f-01bc2f912bd5", "parentControlId": 31261, "controlId": "MP-03", "title": "MP-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584473" } ], "id": 31261, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731019", "catalogueId": 1062, "uuid": "dbc89b82-da4e-5013-97f0-d98c40047815", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to mark physical media and digital files to indicate the distribution limitations, handling requirements and applicable security markings (if any) of the information to aid Data Loss Prevention (DLP) technologies?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 2.0, "title": "Automated Marking", "description": "

Control Description

Automated mechanisms exist to mark physical media and digital files to indicate the distribution limitations, handling requirements and applicable security markings (if any) of the information to aid Data Loss Prevention (DLP) technologies.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically mark physical media and digital files to indicate the distribution limitations, handling requirements and applicable security markings (if any) of the information to aid Data Loss Prevention (DLP) technologies.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-04.1", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Metadata tagging\n∙ IT Asset Management (ITAM) program

Small Business (10-49 staff)

∙ Data classification program\n∙ Metadata tagging\n∙ IT Asset Management (ITAM) program

Medium Business (50-249 staff)

∙ Data classification program\n∙ Metadata tagging\n∙ IT Asset Management (ITAM) program\n∙ Data governance program

Large Business (250-999 staff)

∙ Data classification program\n∙ Metadata tagging\n∙ IT Asset Management (ITAM) program\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Metadata tagging\n∙ IT Asset Management (ITAM) program\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70818, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59033", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59033", "securityControlId": 31262, "ccis": [], "uuid": "d65aabcf-11c6-51fa-99a5-c4ddb9feace3", "testId": "DCH-05_A01", "test": "types of security / privacy attributes associated with cybersecurity attribute values for information in storage, in process, and/or in transmission are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16_ODP[01] \n53A_R5_AC-16_ODP[02]\n53A_R5_AC-16_ODP[03]\n53A_R5_AC-16_ODP[04]\n53A_R5_AC-16_ODP[05]\n53A_R5_AC-16_ODP[06]\n53A_R5_AC-16_ODP[07]\n53A_R5_AC-16_ODP[08]\n53A_R5_AC-16_ODP[09]\n53A_R5_AC-16c.[01]\n53A_R5_AC-16c.[02]\n53A_R5_AC-16d.", "defaultText": null }, { "id": 70819, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59033", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59033", "securityControlId": 31262, "ccis": [], "uuid": "3826eec9-2260-53f1-8db3-8be87fc09eb8", "testId": "DCH-05_A02", "test": "the means to associate organization-defined types of security / privacy attributes with organization-defined security attribute values for information in storage, in process, and/or in transmission are provided.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16a.[01]\n53A_R5_AC-16a.[02]", "defaultText": null }, { "id": 70820, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59033", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59033", "securityControlId": 31262, "ccis": [], "uuid": "f0a4680c-2be0-5eb4-9269-2b6a67d8b124", "testId": "DCH-05_A03", "test": "the frequency at which to review cybersecurity / data privacy attributes for applicability is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least annually", "otherId": "53A_R5_AC-16_ODP[10]\n53A_R5_AC-16_ODP[11]", "defaultText": null }, { "id": 70821, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59033", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59033", "securityControlId": 31262, "ccis": [], "uuid": "f61a40e0-eca5-5a79-aa57-8b695010187f", "testId": "DCH-05_A04", "test": "attributes are reviewed according to an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least annually", "otherId": "53A_R5_AC-16f.[01]\n53A_R5_AC-16f.[02]", "defaultText": null }, { "id": 70822, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590331", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590331", "securityControlId": 31262, "ccis": [], "uuid": "2bd76f53-7927-5a29-8610-fafd27bc9a49", "testId": "DCH-05_A05", "test": "attribute associations are made.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_AC-16b.[01]", "defaultText": null }, { "id": 70823, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590331", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590331", "securityControlId": 31262, "ccis": [], "uuid": "8d9f27d4-404e-580b-b7d2-fea613e12130", "testId": "DCH-05_A06", "test": "changes to attributes are audited.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_AC-16e.", "defaultText": null }, { "id": 70824, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590331", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590331", "securityControlId": 31262, "ccis": [], "uuid": "b86d4b77-723f-5ef3-b692-2cb6c4515fe6", "testId": "DCH-05_A07", "test": "attribute associations are retained with the information.
PPTDF Applicability: Data
Assessment Rigor: 2", "otherId": "53A_R5_AC-16b.[02]", "defaultText": null } ], "externalMappings": [ { "id": 567859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584474", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4d32711-58b8-567f-96ca-dc716ae4de75", "parentControlId": 31262, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584475" }, { "id": 567860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e0e4197-f500-562f-a962-ef7143a490bd", "parentControlId": 31262, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584475" }, { "id": 567861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a246472-026e-5390-a6a1-54b08f6885e8", "parentControlId": 31262, "controlId": "T1005", "title": "T1005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584475" }, { "id": 567862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "295a8550-2eec-502a-be02-8846235099cf", "parentControlId": 31262, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584475" }, { "id": 567863, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19f25b50-f3ea-5107-8f9c-0d9f307d18a0", "parentControlId": 31262, "controlId": "T1025", "title": "T1025", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584475" }, { "id": 567864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "984af144-9a77-54d4-94c2-23a797f1318c", "parentControlId": 31262, "controlId": "T1040", "title": "T1040", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584475" }, { "id": 567865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff9ebb18-b1b5-5481-a3a6-1e66eb76facb", "parentControlId": 31262, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584475" }, { "id": 567866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a72c282d-83cd-5cff-ad52-9895b65803e7", "parentControlId": 31262, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584475" }, { "id": 567867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584476", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbf75890-1506-580d-b696-f81dd99d0c1c", "parentControlId": 31262, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584476" }, { "id": 567868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584476", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67f26e0e-42fb-5067-bdf6-f76f3487c201", "parentControlId": 31262, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584476" }, { "id": 567869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584476", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7514fc2b-a58b-5495-b13a-d7f4d3e1b09b", "parentControlId": 31262, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584476" }, { "id": 567870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584476", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b9df63f-0d2a-54d1-949a-b4588dbebc91", "parentControlId": 31262, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584476" }, { "id": 567871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584476", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15f6c148-9537-57b0-8549-8703633fc086", "parentControlId": 31262, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584476" }, { "id": 567872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584476", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3ba0626-5c71-535b-bf12-a2c4136b8768", "parentControlId": 31262, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584476" }, { "id": 567873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584476", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de0af0cf-d48a-5c37-bd97-f9b5fea960be", "parentControlId": 31262, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584476" }, { "id": 567874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584476", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbacad4c-5032-5bfa-9df1-85086ab2727c", "parentControlId": 31262, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584476" }, { "id": 567875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584476", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce53b22e-0966-578e-92f9-415e2c0013e5", "parentControlId": 31262, "controlId": "T1114", "title": "T1114", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584476" }, { "id": 567876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584477", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27925fa4-66c5-5769-9201-8dac9576c785", "parentControlId": 31262, "controlId": "T1114.001", "title": "T1114.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584477" }, { "id": 567877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584477", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "240029f8-3de4-5f53-870b-15acee0c1aa1", "parentControlId": 31262, "controlId": "T1114.002", "title": "T1114.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584477" }, { "id": 567878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584477", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4615921-b858-5199-a0bf-16afc518f086", "parentControlId": 31262, "controlId": "T1114.003", "title": "T1114.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584477" }, { "id": 567879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584477", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41311f17-c4da-5308-81bc-1777ca424d7a", "parentControlId": 31262, "controlId": "T1119", "title": "T1119", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584477" }, { "id": 567880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584477", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8536df92-70a9-526d-b8ae-3e46c44cbf52", "parentControlId": 31262, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584477" }, { "id": 567881, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584477", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76c6363f-c949-516f-a0dd-c7177f05d6b9", "parentControlId": 31262, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584477" }, { "id": 567882, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584477", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0867cbad-a5bd-5279-b7df-1e4272b80064", "parentControlId": 31262, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584477" }, { "id": 567883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584477", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce579505-c079-5e7c-b661-ec3e6aa13dc8", "parentControlId": 31262, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584477" }, { "id": 567884, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584477", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b52f0929-4230-56ff-8a5a-f11a73ff572c", "parentControlId": 31262, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584477" }, { "id": 567885, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584478", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcf80661-0d3c-5f1f-b6a5-c82b1eb0d619", "parentControlId": 31262, "controlId": "T1222", "title": "T1222", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584478" }, { "id": 567886, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584478", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8fa4ca7-24c4-549e-9eed-87eeee0566d2", "parentControlId": 31262, "controlId": "T1222.001", "title": "T1222.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584478" }, { "id": 567887, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584478", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c84722ab-2f4b-5941-bb64-cf9c0c5336d0", "parentControlId": 31262, "controlId": "T1222.002", "title": "T1222.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584478" }, { "id": 567888, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584478", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc34ebc9-0aa7-5e57-8bd4-d53ad197b621", "parentControlId": 31262, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584478" }, { "id": 567889, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584478", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4abdd57b-9c57-54b6-b6be-48c7450ec321", "parentControlId": 31262, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584478" }, { "id": 567890, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584478", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54053800-2836-5830-8413-b47a8d5d4ced", "parentControlId": 31262, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584478" }, { "id": 567891, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584478", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c026c8c0-6a6d-532b-84d0-ff2e09de6ef7", "parentControlId": 31262, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584478" }, { "id": 567892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584478", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd465d10-a3b1-5917-8a03-cb25f0c5b81f", "parentControlId": 31262, "controlId": "T1547.007", "title": "T1547.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584478" }, { "id": 567893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584479", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0069f55e-5c45-544c-871d-bde7b7cdbafe", "parentControlId": 31262, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584479" }, { "id": 567894, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584479", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f914680-22b8-5f7c-9b37-376cc5f79f31", "parentControlId": 31262, "controlId": "T1548.003", "title": "T1548.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584479" }, { "id": 567895, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584479", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c49ffa57-06dd-5478-9382-a97b8d74fa0b", "parentControlId": 31262, "controlId": "T1548.006", "title": "T1548.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584479" }, { "id": 567896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584479", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53543198-f4fa-5cc7-8f6a-8fc148008d00", "parentControlId": 31262, "controlId": "T1550.001", "title": "T1550.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584479" }, { "id": 567897, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584479", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f86fa1cd-ffcb-57f6-8a75-ecb3299b980a", "parentControlId": 31262, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584479" }, { "id": 567898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584479", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7725f57-91ed-5054-a6b6-4a3d7cdd04b8", "parentControlId": 31262, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584479" }, { "id": 567899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584479", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70de1ad2-a9d6-5448-9a5f-bddaaeb13cbb", "parentControlId": 31262, "controlId": "T1552.005", "title": "T1552.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584479" }, { "id": 567900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584479", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad8cf6cf-e5aa-5aa3-9818-39182ff4ec1a", "parentControlId": 31262, "controlId": "T1556.009", "title": "T1556.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584479" }, { "id": 567901, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584479", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f5a5a1b-21c7-5bcd-88af-dc27a5e515c8", "parentControlId": 31262, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584479" }, { "id": 567902, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584479", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a2238a4-0629-5cf2-8b2f-d9781ca8fb3e", "parentControlId": 31262, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584479" }, { "id": 567903, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f617b338-8a6c-5de2-8d1c-8a85d6b1eb90", "parentControlId": 31262, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58448" }, { "id": 567904, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3aa80634-ff50-5191-a2dd-667856598b06", "parentControlId": 31262, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58448" }, { "id": 567905, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f28ce9d-d8f0-5366-884e-f59cab03331d", "parentControlId": 31262, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58448" }, { "id": 567906, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "129ed66e-ded3-54b2-8f4d-d6bca95fd2ba", "parentControlId": 31262, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58448" }, { "id": 567907, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0266e429-4596-5425-8f81-44e340b9066f", "parentControlId": 31262, "controlId": "T1564.004", "title": "T1564.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58448" }, { "id": 567908, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e99f2c5-a2db-512c-94f4-9124b27e81f6", "parentControlId": 31262, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58448" }, { "id": 567909, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45612970-cf48-58a8-8169-ad6be57730b8", "parentControlId": 31262, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58448" }, { "id": 567910, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a6d78af-51a9-5cff-8f60-db0d8d2a83d0", "parentControlId": 31262, "controlId": "T1565.002", "title": "T1565.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58448" }, { "id": 567911, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "641e8c5d-7b17-59f4-8c39-21853f05ab50", "parentControlId": 31262, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58448" }, { "id": 567912, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87fe61e7-5906-5a8e-b9f7-b2a9760d3cf0", "parentControlId": 31262, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584481" }, { "id": 567913, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584481", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc85ad03-3bc9-500d-b82a-0f28681faf12", "parentControlId": 31262, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584481" }, { "id": 567914, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584481", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e7fec65-e205-5948-b1cf-9c405a8812de", "parentControlId": 31262, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584481" }, { "id": 567915, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584481", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f9559ac-d150-5743-baa0-770ec2dd270f", "parentControlId": 31262, "controlId": "T1647", "title": "T1647", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584481" }, { "id": 567917, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584481", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "816e42f0-00d3-5356-be0d-71585981103d", "parentControlId": 31262, "controlId": "AC-16", "title": "AC-16", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584481" }, { "id": 567918, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584481", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f6d72fc-1e07-5f62-bfb8-923dca04ee03", "parentControlId": 31262, "controlId": "AC-16", "title": "AC-16", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584481" }, { "id": 567919, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584481", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7800b22d-3bf4-5563-9332-40075028b5cc", "parentControlId": 31262, "controlId": "AC-16", "title": "AC-16", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584481" }, { "controlId": "B.1.13", "title": "B.1.13 — Automated Marking", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-16", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a5bae8ba-d6c2-523f-87dc-6b78260837c6", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.13", "title": "NEI 08-09 App D.1.13 — Automated Marking", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.13", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "dcfd43ce-aeb3-5bdf-9093-e6cd814f4a95", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.13", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "e6b3a8db-301a-559d-bbb0-3caef11812c0", "isPublic": true }, { "controlId": "B.1.14", "title": "B.1.14 — Automated Labeling", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-16", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "5f93a8bf-209e-508e-976c-8dd2ab44ddf1", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.14", "title": "NEI 08-09 App D.1.14 — Automated Labeling", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.14", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "845d6983-3a5c-5490-9835-a58f693d36ae", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "8fdac81f-556c-562a-ac2f-1f513b84544a", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "c699f484-7095-5b15-88e3-1e6007eeb11f", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "6bc26e49-e53e-5e51-b3de-09996c2728e4", "isPublic": true } ], "id": 31262, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73102", "catalogueId": 1062, "uuid": "b40ab8b9-c8cd-58cd-aeb0-3b46a89f5ef7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Cybersecurity & Data Protection Attributes", "description": "

Control Description

Mechanisms exist to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to bind cybersecurity and data protection attributes to information as it is stored, transmitted and processed.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.13, B.1.14", "controlId": "DCH-05", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-05", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Metadata tagging

Small Business (10-49 staff)

∙ Data classification program\n∙ Metadata tagging

Medium Business (50-249 staff)

∙ Data classification program\n∙ Metadata tagging\n∙ Data governance program

Large Business (250-999 staff)

∙ Data classification program\n∙ Metadata tagging\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Metadata tagging\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70825, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590331", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590331", "securityControlId": 31263, "ccis": [], "uuid": "f7ee43b2-cffe-5a31-a630-a09c781909c9", "testId": "DCH-05.1_A01", "test": "subjects or objects with which cybersecurity / data privacy attributes are to be dynamically associated as information is created and combined are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(01)_ODP[01]\n53A_R5_AC-16(01)_ODP[02]\n53A_R5_AC-16(01)_ODP[03]\n53A_R5_AC-16(01)_ODP[04]", "defaultText": null }, { "id": 70826, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590331", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590331", "securityControlId": 31263, "ccis": [], "uuid": "c8567e10-3c51-5d50-a642-949fac0df2b4", "testId": "DCH-05.1_A02", "test": "cybersecurity / data privacy policies requiring dynamic association of cybersecurity / data privacy attributes with subjects and objects are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(01)_ODP[05]\n53A_R5_AC-16(01)_ODP[06]", "defaultText": null }, { "id": 70827, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590332", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590332", "securityControlId": 31263, "ccis": [], "uuid": "4cef3f0a-0db7-5b2d-b219-149bccea75f1", "testId": "DCH-05.1_A03", "test": "cybersecurity / data privacy attributes are dynamically associated with organization-defined subjects or objects as information is created or combined.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(01)[01]\n53A_R5_AC-16(01)[02]\n53A_R5_AC-16(01)[03]\n53A_R5_AC-16(01)[04]", "defaultText": null } ], "externalMappings": [ { "id": 567923, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1919be2-114d-5325-bbed-57cfea5a5506", "parentControlId": 31263, "controlId": "AC-16(01)", "title": "AC-16(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584482" }, { "id": 567924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f74aaec-8b29-5a4a-9670-e2397a20abd4", "parentControlId": 31263, "controlId": "AC-16(01)", "title": "AC-16(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584482" } ], "id": 31263, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73102", "catalogueId": 1062, "uuid": "de7545c5-40ea-51ad-85ae-c9ba4474bb2d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization dynamically associate cybersecurity and data protection attributes with individuals and objects as information is created, combined, or transformed, in accordance with organization-defined cybersecurity and data protection policies?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Dynamic Attribute Association", "description": "

Control Description

Mechanisms exist to dynamically associate cybersecurity and data protection attributes with individuals and objects as information is created, combined, or transformed, in accordance with organization-defined cybersecurity and data protection policies.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to dynamically associate cybersecurity and data protection attributes with individuals and objects as information is created, combined, or transformed, in accordance with organization-defined cybersecurity and data protection policies.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-05.1", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-05.1", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70828, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590332", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590332", "securityControlId": 31264, "ccis": [], "uuid": "9beae30b-99f9-529d-b86b-eb701a91c2f8", "testId": "DCH-05.2_A01", "test": "authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated cybersecurity / data privacy attributes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(02)[01]\n53A_R5_AC-16(02)[02]", "defaultText": null } ], "externalMappings": [ { "id": 567926, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7981e114-38b0-5a5c-b4cd-4bf3864bd15a", "parentControlId": 31264, "controlId": "AC-16(02)", "title": "AC-16(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584482" }, { "id": 567927, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7e77d71-5003-5563-9d55-a35a33ffefe9", "parentControlId": 31264, "controlId": "AC-16(02)", "title": "AC-16(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584482" } ], "id": 31264, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73102", "catalogueId": 1062, "uuid": "655ddcd0-2289-516e-8c13-407e7a0756d1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated cybersecurity and data protection attributes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Attribute Value Changes By Authorized Individuals", "description": "

Control Description

Mechanisms exist to provide authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated cybersecurity and data protection attributes.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated cybersecurity and data protection attributes.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-05.2", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-05.2", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70829, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590332", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590332", "securityControlId": 31265, "ccis": [], "uuid": "76c9dd70-8df9-5045-9a82-8b26475c256c", "testId": "DCH-05.3_A01", "test": "cybersecurity / data privacy attributes that require association and integrity maintenance are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(03)_ODP[01]\n53A_R5_AC-16(03)_ODP[02]", "defaultText": null }, { "id": 70830, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590332", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590332", "securityControlId": 31265, "ccis": [], "uuid": "af4d84b5-6a51-5c82-9e28-11b4b6f07690", "testId": "DCH-05.3_A02", "test": "subjects requiring the association and integrity of cybersecurity / data privacy attributes to such subjects to be maintained are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_AC-16(03)_ODP[03]\n53A_R5_AC-16(03)_ODP[05]", "defaultText": null }, { "id": 70831, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590332", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590332", "securityControlId": 31265, "ccis": [], "uuid": "d6a6f5a7-8645-519b-b2b6-f0396742cce9", "testId": "DCH-05.3_A03", "test": "objects requiring the association and integrity of cybersecurity / data privacy attributes to such objects to be maintained are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_AC-16(03)_ODP[04]\n53A_R5_AC-16(03)_ODP[06]", "defaultText": null }, { "id": 70832, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590332", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590332", "securityControlId": 31265, "ccis": [], "uuid": "bf200485-87f2-500f-9c05-b38889ffed19", "testId": "DCH-05.3_A04", "test": "the association and integrity of organization-defined cybersecurity / data privacy attributes to organization-defined subjects is maintained.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_AC-16(03)[01]\n53A_R5_AC-16(03)[03]", "defaultText": null }, { "id": 70833, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590333", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590333", "securityControlId": 31265, "ccis": [], "uuid": "5278f3c0-89a5-5039-a440-bd7aaf715c8a", "testId": "DCH-05.3_A05", "test": "the association and integrity of organization-defined cybersecurity / data privacy attributes to organization-defined objects is maintained.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_AC-16(03)[02]\n53A_R5_AC-16(03)[04]", "defaultText": null } ], "externalMappings": [ { "id": 567928, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "355abace-a938-5ab9-ac62-51d58b8ed64b", "parentControlId": 31265, "controlId": "AC-16(03)", "title": "AC-16(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584482" }, { "id": 567929, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584483", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32782a2a-b186-5b0f-979d-56908e45a838", "parentControlId": 31265, "controlId": "AC-16(03)", "title": "AC-16(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584483" } ], "id": 31265, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73102", "catalogueId": 1062, "uuid": "0c2abff2-3c8d-5582-b03c-7d0d71774c31", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain the association and integrity of cybersecurity and data protection attributes to individuals and objects?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Maintenance of Attribute Associations By System", "description": "

Control Description

Mechanisms exist to maintain the association and integrity of cybersecurity and data protection attributes to individuals and objects.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain the association and integrity of cybersecurity and data protection attributes to individuals and objects.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-05.3", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-05.3", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70834, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590333", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590333", "securityControlId": 31266, "ccis": [], "uuid": "42e23094-7fda-5942-914e-e6210737b843", "testId": "DCH-05.4_A01", "test": "cybersecurity / data privacy attributes associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(04)_ODP[01]\n53A_R5_AC-16(04)_ODP[03]", "defaultText": null }, { "id": 70835, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590333", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590333", "securityControlId": 31266, "ccis": [], "uuid": "285c5881-228e-558f-8022-59251c4dd3d9", "testId": "DCH-05.4_A02", "test": "cybersecurity / data privacy attributes associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(04)_ODP[02]\n53A_R5_AC-16(04)_ODP[04]", "defaultText": null }, { "id": 70836, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590333", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590333", "securityControlId": 31266, "ccis": [], "uuid": "8b73c9dd-f0d5-51dd-91bb-22f98efa8e66", "testId": "DCH-05.4_A03", "test": "subjects requiring the association of cybersecurity / data privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_AC-16(04)_ODP[05]\n53A_R5_AC-16(04)_ODP[07]", "defaultText": null }, { "id": 70837, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590341", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590341", "securityControlId": 31266, "ccis": [], "uuid": "f4c872be-5b02-5fa6-9122-eac6bc61186f", "testId": "DCH-05.4_A04", "test": "objects requiring the association of cybersecurity / data privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_AC-16(04)_ODP[06]\n53A_R5_AC-16(04)_ODP[08]", "defaultText": null }, { "id": 70838, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590341", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590341", "securityControlId": 31266, "ccis": [], "uuid": "b8918cb7-506a-571a-8ada-904e47c2319f", "testId": "DCH-05.4_A05", "test": "authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate organization-defined cybersecurity / data privacy attributes with organization-defined subjects.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(04)[01]\n53A_R5_AC-16(04)[03]", "defaultText": null }, { "id": 70839, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590341", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590341", "securityControlId": 31266, "ccis": [], "uuid": "ac50661f-3771-5aa6-82c7-ef805c4de659", "testId": "DCH-05.4_A06", "test": "authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate organization-defined cybersecurity / data privacy attributes with organization-defined objects.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(04)[02]\n53A_R5_AC-16(04)[04]", "defaultText": null } ], "externalMappings": [ { "id": 567930, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584483", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4818bbc-4f29-5ef6-b368-bf37526fcde6", "parentControlId": 31266, "controlId": "AC-16(04)", "title": "AC-16(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584483" }, { "id": 567931, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584483", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b83001b9-ae5d-53d6-8f4f-a0e2bc473c53", "parentControlId": 31266, "controlId": "AC-16(04)", "title": "AC-16(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584483" } ], "id": 31266, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731021", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731021", "catalogueId": 1062, "uuid": "d7ce8662-b187-5188-b5b4-4a57fdc20631", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide the capability to associate cybersecurity and data protection attributes with individuals and objects by authorized individuals (or processes acting on behalf of individuals)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Association of Attributes By Authorized Individuals", "description": "

Control Description

Mechanisms exist to provide the capability to associate cybersecurity and data protection attributes with individuals and objects by authorized individuals (or processes acting on behalf of individuals).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide the capability to associate cybersecurity and data protection attributes with individuals and objects by authorized individuals (or processes acting on behalf of individuals).

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-05.4", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-05.4", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70840, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590342", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590342", "securityControlId": 31267, "ccis": [], "uuid": "c62613b2-5e00-598c-9476-52840dd76bf2", "testId": "DCH-05.5_A01", "test": "special dissemination, handling or distribution instructions to be used for each object that the system transmits to output devices are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(05)_ODP[01]", "defaultText": null }, { "id": 70841, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590342", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590342", "securityControlId": 31267, "ccis": [], "uuid": "7c03c8a8-8541-525f-a289-fb70c4318c7d", "testId": "DCH-05.5_A02", "test": "human-readable, standard naming conventions for the cybersecurity / data privacy attributes to be displayed in human-readable form on each object that the system transmits to output devices are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(05)_ODP[02]", "defaultText": null }, { "id": 70842, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590342", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590342", "securityControlId": 31267, "ccis": [], "uuid": "f7d05216-c39a-5ddf-a0d2-23425a9862a8", "testId": "DCH-05.5_A03", "test": "cybersecurity / data privacy attributes are displayed in human-readable form on each object that the system transmits to output devices to identify organization-defined instructions using organization-defined naming conventions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(05)[01]\n53A_R5_AC-16(05)[02]", "defaultText": null } ], "externalMappings": [ { "id": 567932, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584483", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a462a52-bded-5e44-8815-1dfdad6d3a65", "parentControlId": 31267, "controlId": "AC-16(05)", "title": "AC-16(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584483" }, { "id": 567933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584483", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05154f78-715e-55ac-9a88-1da860d4c616", "parentControlId": 31267, "controlId": "AC-16(05)", "title": "AC-16(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584483" } ], "id": 31267, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731021", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731021", "catalogueId": 1062, "uuid": "968963a2-9e01-56ac-b11c-a6cc170831ae", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization display cybersecurity and data protection attributes in human-readable form on each object that the system transmits to output devices to identify special dissemination, handling or distribution instructions using human-readable, standard naming conventions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Attribute Displays for Output Devices", "description": "

Control Description

Mechanisms exist to display cybersecurity and data protection attributes in human-readable form on each object that the system transmits to output devices to identify special dissemination, handling or distribution instructions using human-readable, standard naming conventions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to display cybersecurity and data protection attributes in human-readable form on each object that the system transmits to output devices to identify special dissemination, handling or distribution instructions using human-readable, standard naming conventions.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-05.5", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-05.5", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70843, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590342", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590342", "securityControlId": 31268, "ccis": [], "uuid": "780c2321-7fb2-51ce-89dd-bc667901c9b0", "testId": "DCH-05.6_A01", "test": "cybersecurity / data privacy attributes associated with subjects are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(06)_ODP[01]\n53A_R5_AC-16(06)_ODP[03]", "defaultText": null }, { "id": 70844, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590342", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590343", "securityControlId": 31268, "ccis": [], "uuid": "83a5db46-7f71-54f8-852b-ba7bfaada27d", "testId": "DCH-05.6_A02", "test": "cybersecurity / data privacy attributes associated with objects are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(06)_ODP[02]\n53A_R5_AC-16(06)_ODP[04]", "defaultText": null }, { "id": 70845, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590343", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590343", "securityControlId": 31268, "ccis": [], "uuid": "46e0ab55-cf10-520a-b7ea-4b9d6951283b", "testId": "DCH-05.6_A03", "test": "subjects to be associated with cybersecurity / data privacy attributes are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(06)_ODP[05]\n53A_R5_AC-16(06)_ODP[07]", "defaultText": null }, { "id": 70846, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590343", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590343", "securityControlId": 31268, "ccis": [], "uuid": "f2b438ee-deb1-5acd-abe4-cd238ad511fc", "testId": "DCH-05.6_A04", "test": "objects to be associated with cybersecurity / data privacy attributes are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(06)_ODP[06]\n53A_R5_AC-16(06)_ODP[08]", "defaultText": null }, { "id": 70847, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590343", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590343", "securityControlId": 31268, "ccis": [], "uuid": "a2f38b97-70d0-534d-960c-78455cf8049d", "testId": "DCH-05.6_A05", "test": "cybersecurity / data privacy policies that require personnel to associate and maintain the association of cybersecurity / data privacy attributes with subjects and objects.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(06)_ODP[09]\n53A_R5_AC-16(06)_ODP[10]", "defaultText": null }, { "id": 70848, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590343", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590343", "securityControlId": 31268, "ccis": [], "uuid": "f2831454-e695-58a3-806f-32ad9ba8c913", "testId": "DCH-05.6_A06", "test": "personnel are required to associate and maintain the association of organization-defined cybersecurity / data privacy attributes with organization-defined subjects in accordance with organization-defined policies.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(06)[01]\n53A_R5_AC-16(06)[03]", "defaultText": null }, { "id": 70849, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590343", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590343", "securityControlId": 31268, "ccis": [], "uuid": "455d83d5-3173-5c4e-a059-2bd8e2335982", "testId": "DCH-05.6_A07", "test": "personnel are required to associate and maintain the association of organization-defined cybersecurity / data privacy attributes with organization-defined objects in accordance with organization-defined policies.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(06)[02]\n53A_R5_AC-16(06)[04]", "defaultText": null } ], "externalMappings": [ { "id": 567934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "265fa0db-9083-59ed-bd1f-cfb3da43ef8f", "parentControlId": 31268, "controlId": "AC-16(06)", "title": "AC-16(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584484" }, { "id": 567935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbb06f3c-f1c2-5d6c-b093-d99fea725056", "parentControlId": 31268, "controlId": "AC-16(06)", "title": "AC-16(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584484" } ], "id": 31268, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731021", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731021", "catalogueId": 1062, "uuid": "e3e5e774-96e1-595d-8821-c7b171096151", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require personnel to associate and maintain the association of cybersecurity and data protection attributes with individuals and objects in accordance with cybersecurity and data protection policies?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Data Subject Attribute Associations", "description": "

Control Description

Mechanisms exist to require personnel to associate and maintain the association of cybersecurity and data protection attributes with individuals and objects in accordance with cybersecurity and data protection policies.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require personnel to associate and maintain the association of cybersecurity and data protection attributes with individuals and objects in accordance with cybersecurity and data protection policies.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-05.6", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-05.6", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70850, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590344", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590344", "securityControlId": 31269, "ccis": [], "uuid": "2a822d26-be96-5ff4-bb9d-b32e35f11d10", "testId": "DCH-05.7_A01", "test": "a consistent interpretation of cybersecurity / data privacy attributes transmitted between distributed system components is provided.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(07)[01]\n53A_R5_AC-16(07)[02]", "defaultText": null } ], "externalMappings": [ { "id": 567936, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67a693e3-cc6e-57b8-9511-f1b3faa7dc50", "parentControlId": 31269, "controlId": "AC-16(07)", "title": "AC-16(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584484" }, { "id": 567937, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4c8f847-e9e9-59ca-9e16-80c68632c46b", "parentControlId": 31269, "controlId": "AC-16(07)", "title": "AC-16(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584484" } ], "id": 31269, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731022", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731022", "catalogueId": 1062, "uuid": "51d5f160-5731-585a-b343-9924456717ac", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide a consistent, organizationally agreed upon interpretation of cybersecurity and data protection attributes employed in access enforcement and flow enforcement decisions between distributed system components?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Consistent Attribute Interpretation", "description": "

Control Description

Mechanisms exist to provide a consistent, organizationally agreed upon interpretation of cybersecurity and data protection attributes employed in access enforcement and flow enforcement decisions between distributed system components.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide a consistent, organizationally agreed upon interpretation of cybersecurity and data protection attributes employed in access enforcement and flow enforcement decisions between distributed system components.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-05.7", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-05.7", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70851, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590344", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590344", "securityControlId": 31270, "ccis": [], "uuid": "2d1ff127-ecb7-5301-a830-2d0c13fa7af8", "testId": "DCH-05.8_A01", "test": "techniques and technologies to be implemented in associating cybersecurity / data privacy attributes to information are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(08)_ODP[01]\n53A_R5_AC-16(08)_ODP[02]", "defaultText": null }, { "id": 70852, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590344", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590344", "securityControlId": 31270, "ccis": [], "uuid": "6e0d01b4-c803-53fe-b772-e42e3993dcd4", "testId": "DCH-05.8_A02", "test": "organization-defined techniques and technologies are implemented in associating cybersecurity / data privacy attributes to information.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(08)[01]\n53A_R5_AC-16(08)[02]", "defaultText": null } ], "externalMappings": [ { "id": 567938, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80950b05-c8cb-5538-a248-cea8c1b997d8", "parentControlId": 31270, "controlId": "AC-16(08)", "title": "AC-16(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584484" }, { "id": 567939, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7aee1564-7ce8-56fd-b1e1-62dac91e4d8e", "parentControlId": 31270, "controlId": "AC-16(08)", "title": "AC-16(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584484" } ], "id": 31270, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731022", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731022", "catalogueId": 1062, "uuid": "3de27703-4b05-50b5-94ce-1c2780ebcfd1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization associate cybersecurity and data protection attributes to information?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Identity Association Techniques & Technologies", "description": "

Control Description

Mechanisms exist to associate cybersecurity and data protection attributes to information.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to associate cybersecurity and data protection attributes to information.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-05.8", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-05.8", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70853, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590344", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590344", "securityControlId": 31271, "ccis": [], "uuid": "49ac44c1-2d3d-5f7d-ba8a-26688f8b46b5", "testId": "DCH-05.9_A01", "test": "techniques or procedures used to validate regarding mechanisms for cybersecurity / data privacy attributes are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(09)_ODP[01]\n53A_R5_AC-16(09)_ODP[02]", "defaultText": null }, { "id": 70854, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590345", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590345", "securityControlId": 31271, "ccis": [], "uuid": "b25e9761-4cd2-5def-a00c-b728c96c0a45", "testId": "DCH-05.9_A02", "test": "cybersecurity / data privacy attributes associated with information are changed only via regarding mechanisms validated using organization-defined techniques or procedures.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(09)[01]\n53A_R5_AC-16(09)[02]", "defaultText": null } ], "externalMappings": [ { "id": 567940, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584485", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5b2448c-a9d9-571e-92f1-510d45d386cc", "parentControlId": 31271, "controlId": "AC-16(09)", "title": "AC-16(09)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584485" }, { "id": 567941, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584485", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "000c31fa-8f44-5be2-b4b9-66b32b58ab50", "parentControlId": 31271, "controlId": "AC-16(09)", "title": "AC-16(09)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584485" } ], "id": 31271, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731023", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731023", "catalogueId": 1062, "uuid": "2c97202e-7df4-5f81-a8af-eba0e5c11039", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization reclassify data as required, due to changing business/technical requirements?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Attribute Reassignment", "description": "

Control Description

Mechanisms exist to reclassify data as required, due to changing business/technical requirements.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to reclassify data as required, due to changing business/technical requirements.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-05.9", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-05.9", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70855, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590345", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590345", "securityControlId": 31272, "ccis": [], "uuid": "fe344fed-186b-52f0-adfb-d8b7fd41c430", "testId": "DCH-05.10_A01", "test": "authorized individuals are provided with the capability to define or change the type and value of cybersecurity / data privacy attributes available for association with subjects and objects.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-16(10)[01]\n53A_R5_AC-16(10)[02]", "defaultText": null } ], "externalMappings": [ { "id": 567943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584485", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ddf48f74-3554-5a41-8f91-26fae485359c", "parentControlId": 31272, "controlId": "AC-16(10)", "title": "AC-16(10)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584485" }, { "id": 567944, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584485", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "884a7be6-d52f-5d14-b1c3-ab53e098deed", "parentControlId": 31272, "controlId": "AC-16(10)", "title": "AC-16(10)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584486" } ], "id": 31272, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731023", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731023", "catalogueId": 1062, "uuid": "c892cf90-f4d0-5638-91c5-dcca40297a07", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide authorized individuals the capability to define or change the type and value of cybersecurity and data protection attributes available for association with subjects and objects?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Attribute Configuration By Authorized Individuals", "description": "

Control Description

Mechanisms exist to provide authorized individuals the capability to define or change the type and value of cybersecurity and data protection attributes available for association with subjects and objects.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide authorized individuals the capability to define or change the type and value of cybersecurity and data protection attributes available for association with subjects and objects.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-05.10", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-05.10", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70858, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590346", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590346", "securityControlId": 31274, "ccis": [], "uuid": "eed976bb-336e-54be-865f-0a359595b12e", "testId": "DCH-06_A01", "test": "types of digital media to be securely stored are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-04_ODP[03]", "defaultText": null }, { "id": 70859, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590346", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590346", "securityControlId": 31274, "ccis": [], "uuid": "e95f71fc-7a77-5b55-8a5d-7b8b5aad101d", "testId": "DCH-06_A02", "test": "types of non-digital media to be securely stored are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-04_ODP[04]", "defaultText": null }, { "id": 70860, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590346", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590346", "securityControlId": 31274, "ccis": [], "uuid": "bd7da1d8-798b-55a8-92a2-2dc4a554884b", "testId": "DCH-06_A03", "test": "controlled areas within which to securely store digital media are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-04_ODP[05]", "defaultText": null }, { "id": 70861, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590346", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590346", "securityControlId": 31274, "ccis": [], "uuid": "3cb9dfa6-4e37-5279-bcfa-d1e73d3b0531", "testId": "DCH-06_A04", "test": "controlled areas within which to securely store non-digital media are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-04_ODP[06]", "defaultText": null }, { "id": 70862, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590346", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590346", "securityControlId": 31274, "ccis": [], "uuid": "8bf5a9c8-ebd3-5b12-af27-7e3a6af357f9", "testId": "DCH-06_A05", "test": "types of digital media are securely stored within controlled areas.
PPTDF Applicability: Facility
Assessment Rigor: 1
SCF Defined Parameters: all types of digital and non-digital media with sensitive information", "otherId": "53A_R5_MP-04a.[03]", "defaultText": null }, { "id": 70863, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590347", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590347", "securityControlId": 31274, "ccis": [], "uuid": "54484a42-287d-500a-acfa-8b7ce0dee071", "testId": "DCH-06_A06", "test": "types of non-digital media are securely stored within controlled areas.
PPTDF Applicability: Facility
Assessment Rigor: 1
SCF Defined Parameters: all types of digital and non-digital media with sensitive information", "otherId": "53A_R5_MP-04a.[04]", "defaultText": null }, { "id": 70864, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590347", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590347", "securityControlId": 31274, "ccis": [], "uuid": "752b2e3a-0881-5af5-a9cb-cf92ec871968", "testId": "DCH-06_A07", "test": "system media types are protected until the media are destroyed or sanitized using approved equipment, techniques and procedures.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-04b.", "defaultText": null }, { "id": 70865, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590347", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590347", "securityControlId": 31274, "ccis": [], "uuid": "1ed5942d-6780-5114-9b5e-6657dc962281", "testId": "DCH-06_A08", "test": "system media that contain sensitive / regulated data are physically controlled.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 70866, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590347", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590347", "securityControlId": 31274, "ccis": [], "uuid": "7b0c39dc-7df8-54a5-8449-abb7f6f86596", "testId": "DCH-06_A09", "test": "system media that contain sensitive / regulated data are securely stored.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 70867, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590347", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590347", "securityControlId": 31274, "ccis": [], "uuid": "849c0199-e647-5356-a312-b86decb4b2a8", "testId": "DCH-06_A10", "test": "system media that contain CUI are physically controlled.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.08.01[01]", "defaultText": null }, { "id": 70868, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590348", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590348", "securityControlId": 31274, "ccis": [], "uuid": "7bee11a2-4637-5182-8a01-da904b357bb2", "testId": "DCH-06_A11", "test": "system media that contain CUI are securely stored.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.08.01[02]", "defaultText": null } ], "externalMappings": [ { "id": 567949, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584486", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72e3295d-aa5a-5d57-a05d-fad3913f8a77", "parentControlId": 31274, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584486" }, { "id": 567953, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584487", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "211f5df4-7cbe-5024-aa76-d04274ce0efd", "parentControlId": 31274, "controlId": "MP-4", "title": "MP-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584487" }, { "id": 567954, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584487", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c5036f3-b0ee-5ae4-b24b-b1a7e3797db7", "parentControlId": 31274, "controlId": "MP-04", "title": "MP-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584487" }, { "id": 567955, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584487", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c03c7b29-df6b-55f7-b614-33fad1b7e375", "parentControlId": 31274, "controlId": "MP-04", "title": "MP-04", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584487" }, { "id": 567956, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584487", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "961b8da0-46f7-507c-91f0-08d545e1b56f", "parentControlId": 31274, "controlId": "MP-04", "title": "MP-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584487" }, { "id": 567957, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584487", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6943e165-3421-58eb-89c9-a0b0364a4ffc", "parentControlId": 31274, "controlId": "MP-04", "title": "MP-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584487" }, { "id": 567958, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584487", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca55f42b-5453-59fe-bf67-3b6c1fa6f782", "parentControlId": 31274, "controlId": "MP-04", "title": "MP-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584487" }, { "id": 567959, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584487", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43ded73e-f301-5268-86e9-44135da97bbf", "parentControlId": 31274, "controlId": "MP-4", "title": "MP-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584487" }, { "id": 567960, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584487", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6369c57a-39c3-5ff3-ad69-df65e53599f8", "parentControlId": 31274, "controlId": "MP-4", "title": "MP-4", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584487" }, { "id": 567963, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff106858-0d91-5dd7-8734-d453e9b734dc", "parentControlId": 31274, "controlId": "3.8.1", "title": "3.8.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584488" }, { "id": 567964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99ce204a-8c9d-526f-b8be-5240dc622c3e", "parentControlId": 31274, "controlId": "03.08.01", "title": "03.08.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584488" }, { "id": 567967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584496", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82416f72-fdd7-57f0-b785-0255bdfb42bd", "parentControlId": 31274, "controlId": "ID.AM-07", "title": "ID.AM-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584496" }, { "controlId": "A.5", "title": "A.5 — DOCUMENT CONTROL AND RECORDS RETENTION AND HANDLING", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-11, MP-4, PM-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "f4ea1ae8-da01-5ac4-8337-df363364c553", "isPublic": true }, { "controlId": "NEI 08-09 Sec 5.0", "title": "NEI 08-09 Sec 5.0 — DOCUMENT CONTROL AND RECORDS RETENTION AND HANDLING", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "54e89d2d-18e2-5498-b099-ccd651c1fbe8", "isPublic": true }, { "controlId": "10 CFR 73.54(h), 73.55(q)", "title": "10 CFR 73.54(h), 73.55(q) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "699106d4-6476-5a4f-b065-52a9c068a645", "isPublic": true }, { "controlId": "C.1.4", "title": "C.1.4 — Media Storage", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MP-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "93e9e21c-4d2d-596a-b354-45f6dd593e73", "isPublic": true }, { "controlId": "NEI 08-09 App E.1.4", "title": "NEI 08-09 App E.1.4 — Media Storage", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.1.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "a3771899-da3c-5b59-8761-9491b1c2d7c6", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.1.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "7b9b6250-c04b-5d45-b006-b6bd73dc358c", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "db970e3c-955b-5915-a928-2b8ed632f891", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "6a91da16-1241-51e9-b874-260aea6abfc3", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "c962f23a-014f-5a99-9a09-903da713d772", "isPublic": true } ], "id": 31274, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731023", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731023", "catalogueId": 1062, "uuid": "214b0465-450e-5ce8-883e-1c2588990ded", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization: \n (1) Physically control and securely store digital and non-digital media within controlled areas using organization-defined security measures; and\n (2) Protect system media until the media are destroyed or sanitized using approved equipment, techniques and procedures?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Media Storage", "description": "

Control Description

Mechanisms exist to: \n(1) Physically control and securely store digital and non-digital media within controlled areas using organization-defined security measures; and\n(2) Protect system media until the media are destroyed or sanitized using approved equipment, techniques and procedures.

Evidence Request List (ERL)

E-DCH-02\nE-DCH-13

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Data Classification & Handling (DCH) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with DCH domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Data protection controls are primarily administrative in nature (e.g., policies & standards) to classify, protect and dispose of systems and data, including storage media.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to: \n(1) Physically control and securely store digital and non-digital media within controlled areas using organization-defined security measures; and\n(2) Protect system media until the media are destroyed or sanitized using approved equipment, techniques and procedures.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.5, C.1.4", "controlId": "DCH-06", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-06", "references": "

Micro-Small Business (<10 staff)

∙ Physical Access Control (PAC)

Small Business (10-49 staff)

∙ Physical Access Control (PAC)

Medium Business (50-249 staff)

∙ Physical Access Control (PAC)

Large Business (250-999 staff)

∙ Physical Access Control (PAC)\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Physical Access Control (PAC)\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70869, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590348", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590348", "securityControlId": 31275, "ccis": [], "uuid": "a14d0ead-a366-52bd-9dc2-369df4ef5ad2", "testId": "DCH-06.1_A01", "test": "types of digital media to be physically controlled are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-04_ODP[01]", "defaultText": null }, { "id": 70870, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590348", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590348", "securityControlId": 31275, "ccis": [], "uuid": "b0075dd3-f9bc-55f3-a2c0-da121d1b7d4d", "testId": "DCH-06.1_A02", "test": "types of non-digital media to be physically controlled are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-04_ODP[02]", "defaultText": null }, { "id": 70871, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590348", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590348", "securityControlId": 31275, "ccis": [], "uuid": "a457faf8-9a50-5441-8fcf-b57f5e5c8d8a", "testId": "DCH-06.1_A03", "test": "types of digital media are physically controlled.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: all types of digital and non-digital media with sensitive information", "otherId": "53A_R5_MP-04a.[01]", "defaultText": null }, { "id": 70872, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590348", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590348", "securityControlId": 31275, "ccis": [], "uuid": "f1e8246f-34ab-575f-9d30-76cb14470f78", "testId": "DCH-06.1_A04", "test": "types of non-digital media are physically controlled.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: all types of digital and non-digital media with sensitive information", "otherId": "53A_R5_MP-04a.[02]", "defaultText": null }, { "id": 70873, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590349", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590349", "securityControlId": 31275, "ccis": [], "uuid": "5ad1c789-07d8-5dc9-a70a-693f48bcfc1d", "testId": "DCH-06.1_A05", "test": "system media types are protected until the media are destroyed or sanitized using approved equipment, techniques and procedures.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-04b.", "defaultText": null } ], "externalMappings": [ { "id": 568010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f066032-fe72-5de9-af0a-7245f3731770", "parentControlId": 31275, "controlId": "03.08.01", "title": "03.08.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584502" } ], "id": 31275, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731024", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731024", "catalogueId": 1062, "uuid": "886110be-8dd1-5f53-9583-b1684fc5c21a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization physically secure all media that contains sensitive information?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Physically Secure All Media", "description": "

Control Description

Mechanisms exist to physically secure all media that contains sensitive information.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to physically secure all media that contains sensitive information.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-06.1", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-06.1", "references": "

Micro-Small Business (<10 staff)

∙ Physical Access Control (PAC)

Small Business (10-49 staff)

∙ Physical Access Control (PAC)

Medium Business (50-249 staff)

∙ Physical Access Control (PAC)

Large Business (250-999 staff)

∙ Physical Access Control (PAC)

Enterprise (>1,000 staff)

∙ Physical Access Control (PAC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70874, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590349", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590349", "securityControlId": 31276, "ccis": [], "uuid": "af25e2d9-90cb-5987-a79c-6a88dc698d57", "testId": "DCH-06.2_A01", "test": "an inventory is maintained for all sensitive / regulated data.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70875, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590349", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590349", "securityControlId": 31276, "ccis": [], "uuid": "c51b9c7b-fa29-5429-aa12-0fe9bd3a3054", "testId": "DCH-06.2_A02", "test": "recurring inventories keep sensitive / regulated data inventories current and accurate.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 568041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584505", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b8d4d3f-1575-5f59-8539-6151932961ee", "parentControlId": 31276, "controlId": "03.04.11.a", "title": "03.04.11.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584505" }, { "id": 568042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584506", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6eeec00-d0f3-571d-b6d7-31d2eb0c45f1", "parentControlId": 31276, "controlId": "03.04.11.b", "title": "03.04.11.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584506" }, { "id": 568045, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584506", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a34aa32-e6a4-5712-b7a1-be87440ee48b", "parentControlId": 31276, "controlId": "ID.AM-07", "title": "ID.AM-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584506" }, { "id": 568058, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584507", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b4d6f0d-9d2e-5fec-b872-ecaa4c6d9cbb", "parentControlId": 31276, "controlId": "B3.a", "title": "B3.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584507" } ], "id": 31276, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731024", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731024", "catalogueId": 1062, "uuid": "967cca8d-858f-5221-9c55-a6ac453904b7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain inventory logs of all sensitive media and conduct sensitive media inventories at least annually?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Sensitive Data Inventories", "description": "

Control Description

Mechanisms exist to maintain inventory logs of all sensitive media and conduct sensitive media inventories at least annually.

Evidence Request List (ERL)

E-AST-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to document where sensitive/regulated data is stored, transmitted and/or processed.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain inventory logs of all sensitive media and conduct sensitive media inventories at least annually.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-06.2", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-06.2", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Sensitive data inventories

Small Business (10-49 staff)

∙ Data classification program\n∙ Sensitive data inventories

Medium Business (50-249 staff)

∙ Data classification program\n∙ Sensitive data inventories

Large Business (250-999 staff)

∙ Data classification program\n∙ Sensitive data inventories\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Sensitive data inventories\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70876, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590349", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590349", "securityControlId": 31277, "ccis": [], "uuid": "4845551d-25fb-5a78-a735-dde8a25a061f", "testId": "DCH-06.3_A01", "test": "periodic scans of unstructured data sources are used to identify sensitive / regulated data, or data requiring special protection measures, per statutory, regulatory or contractual obligations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70877, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590349", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590349", "securityControlId": 31277, "ccis": [], "uuid": "0b3061c6-fd1f-58b1-b6b9-b9c39fdf0021", "testId": "DCH-06.3_A02", "test": "actions are taken to respond to the discovery of unauthorized sensitive / regulated data repositories are per the organization's Incident Response Plan (IRP), or similar documented procedures.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 568070, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584509", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a0f43b4-d02f-5001-9414-ada7fca8ff0d", "parentControlId": 31277, "controlId": "ID.AM-07", "title": "ID.AM-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584509" } ], "id": 31277, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731025", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731025", "catalogueId": 1062, "uuid": "36a97f97-0f81-59fb-94bb-03f1d713bd53", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization periodically scan unstructured data sources for sensitive/regulated data or data requiring special protection measures by statutory, regulatory or contractual obligations?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 7.0, "title": "Periodic Scans for Sensitive / Regulated Data", "description": "

Control Description

Mechanisms exist to periodically scan unstructured data sources for sensitive/regulated data or data requiring special protection measures by statutory, regulatory or contractual obligations.

Evidence Request List (ERL)

E-DCH-10

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to periodically scan unstructured data sources for sensitive/regulated data or data requiring special protection measures by statutory, regulatory or contractual obligations.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-06.3", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-06.3", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70878, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59035", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59035", "securityControlId": 31278, "ccis": [], "uuid": "2703eca2-ce8a-5b44-95c3-d105745fe3d8", "testId": "DCH-06.4_A01", "test": "the organization only uses current and supported technologies that are capable of implementing secure configurations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70879, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59035", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59035", "securityControlId": 31278, "ccis": [], "uuid": "bc2471ba-9d3e-5ffd-8b9b-ab7e03ebea4b", "testId": "DCH-06.4_A02", "test": "secure baseline configurations ensure sensitive / regulated data is rendered human unreadable anywhere that data is stored.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 568074, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584509", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0e7afe0-4d19-5007-8af9-b86ae4db023b", "parentControlId": 31278, "controlId": "03.08.01", "title": "03.08.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584509" } ], "id": 31278, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731025", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731025", "catalogueId": 1062, "uuid": "e3515aeb-c331-5f1c-95bb-3b947d566131", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure sensitive/regulated data is rendered human unreadable anywhere sensitive/regulated data is stored?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Making Sensitive Data Unreadable In Storage", "description": "

Control Description

Mechanisms exist to ensure sensitive/regulated data is rendered human unreadable anywhere sensitive/regulated data is stored.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure sensitive/regulated data is rendered human unreadable anywhere sensitive/regulated data is stored.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-06.4", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-06.4", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Sensitive data inventories\n∙ Cryptographic governance program

Small Business (10-49 staff)

∙ Data classification program\n∙ Sensitive data inventories\n∙ Cryptographic governance program

Medium Business (50-249 staff)

∙ Data classification program\n∙ Sensitive data inventories\n∙ Cryptographic governance program

Large Business (250-999 staff)

∙ Data classification program\n∙ Sensitive data inventories\n∙ Cryptographic governance program\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Sensitive data inventories\n∙ Cryptographic governance program\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70882, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590351", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590351", "securityControlId": 31280, "ccis": [], "uuid": "e9989e01-b61b-5660-a1dd-6a6c628ea9dc", "testId": "DCH-07_A01", "test": "access to media containing sensitive / regulated data is controlled.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "171A_3.8.5[a]", "defaultText": null }, { "id": 70883, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590351", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590351", "securityControlId": 31280, "ccis": [], "uuid": "8786a1bd-23d0-5150-a517-f5a7b3b1874d", "testId": "DCH-07_A02", "test": "accountability for media containing sensitive / regulated data is maintained during transport outside of controlled areas.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "171A_3.8.5[b]", "defaultText": null }, { "id": 70884, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590351", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590351", "securityControlId": 31280, "ccis": [], "uuid": "c38a0ccd-71cc-5a5b-8581-4177944928f1", "testId": "DCH-07_A03", "test": "types of system media to protect and control during transport outside of controlled areas are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-05_ODP[01]", "defaultText": null }, { "id": 70885, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590351", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590351", "securityControlId": 31280, "ccis": [], "uuid": "ad84a9f6-e89b-5c8a-b821-787d077d2615", "testId": "DCH-07_A04", "test": "personnel authorized to conduct media transport activities is/are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-05d.[01]", "defaultText": null }, { "id": 70886, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590351", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590351", "securityControlId": 31280, "ccis": [], "uuid": "c12aeaaf-8896-5555-890b-92b5fbdef04d", "testId": "DCH-07_A05", "test": "activities associated with the transport of system media are restricted to identified authorized personnel.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-05d.[02]", "defaultText": null }, { "id": 70887, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590353", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590353", "securityControlId": 31280, "ccis": [], "uuid": "391f49c7-39d5-53b5-a208-7e715ec15a5e", "testId": "DCH-07_A06", "test": "controls used to protect system media outside of controlled areas are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-05_ODP[02]", "defaultText": null }, { "id": 70888, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590353", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590353", "securityControlId": 31280, "ccis": [], "uuid": "91fd5d2f-61e2-50cb-ac2b-4e5d0c9ca3b1", "testId": "DCH-07_A07", "test": "controls used to control system media outside of controlled areas are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-05_ODP[03]", "defaultText": null }, { "id": 70889, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590353", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590353", "securityControlId": 31280, "ccis": [], "uuid": "2ae72266-b323-5458-b1dd-ff3ea3e31cef", "testId": "DCH-07_A08", "test": "system media that contain sensitive / regulated data are protected during transport outside of controlled areas.
PPTDF Applicability: Data
Assessment Rigor: 3
SCF Defined Parameters: prior to leaving secure/controlled environment: for digital media, encryption in compliance with applicable requirements.", "otherId": "53A_R5_MP-05a.[01]", "defaultText": null }, { "id": 70890, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590353", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590353", "securityControlId": 31280, "ccis": [], "uuid": "bedd489d-fda9-5d73-9e66-4e6e68a78cb8", "testId": "DCH-07_A09", "test": "system media that contain sensitive / regulated data are controlled during transport outside of controlled areas.
PPTDF Applicability: Data
Assessment Rigor: 3
SCF Defined Parameters: prior to leaving secure/controlled environment: for digital media, encryption in compliance with applicable requirements.", "otherId": "53A_R5_MP-05a.[02]", "defaultText": null }, { "id": 70891, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590353", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590353", "securityControlId": 31280, "ccis": [], "uuid": "e7f7908e-78ff-5d8a-909c-360140a88699", "testId": "DCH-07_A10", "test": "accountability for system media that contain sensitive / regulated data is maintained during transport outside of controlled areas.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_MP-05b.", "defaultText": null }, { "id": 70892, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590353", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590353", "securityControlId": 31280, "ccis": [], "uuid": "047c4db3-df89-5a26-b57f-e5a261c602eb", "testId": "DCH-07_A11", "test": "activities associated with the transport of system media that contain sensitive / regulated data are documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-05c.", "defaultText": null }, { "id": 70893, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590354", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590354", "securityControlId": 31280, "ccis": [], "uuid": "96c70fa4-59fb-5eaf-8faf-08070689e0f9", "testId": "DCH-07_A12", "test": "system media that contain CUI are protected during transport outside of controlled areas.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.08.05.a[01]", "defaultText": null }, { "id": 70894, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590354", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590354", "securityControlId": 31280, "ccis": [], "uuid": "741f3b4a-8015-537d-b99a-5b2ff584e16f", "testId": "DCH-07_A13", "test": "system media that contain CUI are controlled during transport outside of controlled areas.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.08.05.a[02]", "defaultText": null }, { "id": 70895, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590354", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590354", "securityControlId": 31280, "ccis": [], "uuid": "9ae7222c-1669-5dc6-9286-0188d8c1e02b", "testId": "DCH-07_A14", "test": "accountability for system media that contain CUI is maintained during transport outside of controlled areas.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.08.05.b", "defaultText": null }, { "id": 70896, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590354", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590354", "securityControlId": 31280, "ccis": [], "uuid": "e6f0c48c-e2c0-56e4-8d12-aac380dafd2b", "testId": "DCH-07_A15", "test": "activities associated with the transport of system media that contain CUI are documented.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.08.05.c", "defaultText": null } ], "externalMappings": [ { "id": 568113, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584514", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "949a40a7-c9fb-51bd-8eba-93644851e71f", "parentControlId": 31280, "controlId": "5.14", "title": "5.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584514" }, { "id": 568114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584514", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3635e761-a948-5211-952e-fb85c305fd23", "parentControlId": 31280, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584514" }, { "id": 568123, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ae29933-5885-5ea7-bba9-fe92029b95b6", "parentControlId": 31280, "controlId": "MP-5", "title": "MP-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584515" }, { "id": 568124, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a099aef5-3e8c-5afe-81c3-618808f6f875", "parentControlId": 31280, "controlId": "MP-05", "title": "MP-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584515" }, { "id": 568125, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45ece5ca-8e0a-5909-9f7e-7d144afb26a5", "parentControlId": 31280, "controlId": "MP-05", "title": "MP-05", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584515" }, { "id": 568127, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0afebcb2-cf7f-5d09-8bc4-d0d2909522ce", "parentControlId": 31280, "controlId": "MP-05", "title": "MP-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584515" }, { "id": 568128, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2e3d458-21ee-5f4b-8f3a-86a32cfa6a52", "parentControlId": 31280, "controlId": "MP-05", "title": "MP-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584515" }, { "id": 568129, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4572658-16a4-5144-a915-46709322fd3b", "parentControlId": 31280, "controlId": "MP-05", "title": "MP-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584515" }, { "id": 568130, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75535234-338f-52ac-9107-80292419290b", "parentControlId": 31280, "controlId": "MP-5", "title": "MP-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584516" }, { "id": 568133, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4024479f-c3ae-52c1-ba0f-b3708bb004bc", "parentControlId": 31280, "controlId": "3.8.5", "title": "3.8.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584516" }, { "id": 568134, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3adbde9-9ac3-5c7b-a325-837b371376d8", "parentControlId": 31280, "controlId": "03.08.05.a", "title": "03.08.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584516" }, { "id": 568135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "adfd9c7b-6ac7-5c2d-a6b9-4de85e372bd7", "parentControlId": 31280, "controlId": "03.08.05.b", "title": "03.08.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584516" }, { "id": 568177, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf9b5290-f6a0-5054-aeb2-db58e10f56e2", "parentControlId": 31280, "controlId": "9-3.c", "title": "9-3.c", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584521" }, { "id": 568178, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a1bd147-45ff-5d2a-81d8-fd453e673210", "parentControlId": 31280, "controlId": "11-5", "title": "11-5", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584521" }, { "id": 568179, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "445641c5-021e-5b07-a991-9ba41d973697", "parentControlId": 31280, "controlId": "11-5.a", "title": "11-5.a", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584521" }, { "id": 568180, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbe1523b-9678-5536-8e13-f8303c2fc2ca", "parentControlId": 31280, "controlId": "11-5.b", "title": "11-5.b", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584521" }, { "controlId": "C.1.5", "title": "C.1.5 — Media Transport", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MP-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "9b1cf20a-ccbe-53c0-98bb-e92374c3b651", "isPublic": true }, { "controlId": "NEI 08-09 App E.1.5", "title": "NEI 08-09 App E.1.5 — Media Transport", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.1.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "93c88d19-06ab-5b46-be7e-9ad98b29aac7", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.1.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "c719fb73-6465-50d2-8ba9-333fe73c12b2", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b288fa3f-8755-560f-8b24-1b07f11e010e", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "62b92fe0-e571-5612-91f2-3bc13b5c87c0", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "468343ee-dffb-57e5-8b31-46559d524795", "isPublic": true } ], "id": 31280, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731026", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731026", "catalogueId": 1062, "uuid": "ef3d1fb5-3a55-5f2b-aa49-aca09dbfb74d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect and control digital and non-digital media during transport outside of controlled areas using appropriate security measures?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Media Transportation", "description": "

Control Description

Mechanisms exist to protect and control digital and non-digital media during transport outside of controlled areas using appropriate security measures.

Evidence Request List (ERL)

E-DCH-14

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ Data classification and handling criteria govern user behavior for media handling.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to protect and control digital and non-digital media during transport outside of controlled areas using appropriate security measures.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.1.5", "controlId": "DCH-07", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-07", "references": "

Micro-Small Business (<10 staff)

∙ Assigned couriers

Small Business (10-49 staff)

∙ Assigned couriers

Medium Business (50-249 staff)

∙ Assigned couriers

Large Business (250-999 staff)

∙ Assigned couriers

Enterprise (>1,000 staff)

∙ Assigned couriers", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70897, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590354", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590354", "securityControlId": 31281, "ccis": [], "uuid": "ca633cc6-75c0-5a5f-9f3a-ed65d168eb36", "testId": "DCH-07.1_A01", "test": "a custodian to transport system media outside of controlled areas is identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-05(03)[01]", "defaultText": null }, { "id": 70898, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590355", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590355", "securityControlId": 31281, "ccis": [], "uuid": "0a989b34-ce9c-559f-aa65-dfcae599aff9", "testId": "DCH-07.1_A02", "test": "the identified custodian is employed during the transport of system media outside of controlled areas.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_MP-05(03)[02]", "defaultText": null } ], "externalMappings": [ { "id": 568202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584524", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6f88c81-fc54-5b31-9e7d-b05fe46307ef", "parentControlId": 31281, "controlId": "5.1", "title": "5.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584524" }, { "id": 568203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584524", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c78ff26-7215-5cd4-881f-d916c1c5f28d", "parentControlId": 31281, "controlId": "5.14", "title": "5.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584524" }, { "id": 568212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584525", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db1b0a53-fb00-5540-a2a8-7a073ffd59c9", "parentControlId": 31281, "controlId": "MP-5(3)", "title": "MP-5(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584525" }, { "id": 568213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584525", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3674fdd0-8e00-50c0-8cfb-7be3180ce5c9", "parentControlId": 31281, "controlId": "MP-05(03)", "title": "MP-05(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584525" }, { "id": 568215, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584525", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03b8128d-f722-5405-997d-f64ae3c0e2e1", "parentControlId": 31281, "controlId": "MP-05(03)", "title": "MP-05(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584525" }, { "id": 568216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584525", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "595161cf-16b7-5c58-a462-0184931183fc", "parentControlId": 31281, "controlId": "03.08.05.a", "title": "03.08.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584525" }, { "id": 568217, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584525", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "853dcbf7-32fb-502b-900d-ef47bf8a3392", "parentControlId": 31281, "controlId": "03.08.05.b", "title": "03.08.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584525" }, { "id": 568232, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584527", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b148fc5-6ac3-5194-adbf-ca18d8cdd6df", "parentControlId": 31281, "controlId": "§117.15(f)(4)", "title": "§117.15(f)(4)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584527" }, { "id": 568233, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584527", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "061b589f-c404-5c59-99fc-0d43d11b915c", "parentControlId": 31281, "controlId": "§117.15(f)(4)(i)", "title": "§117.15(f)(4)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584527" }, { "id": 568234, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584527", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b57a3d52-f6f1-5295-9bd8-01ab1c0621aa", "parentControlId": 31281, "controlId": "§117.15(f)(4)(ii)", "title": "§117.15(f)(4)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584527" }, { "id": 568235, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584527", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "830beae8-d74d-5d8c-8fed-94a38dbe8150", "parentControlId": 31281, "controlId": "§117.15(f)(4)(iii)", "title": "§117.15(f)(4)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584527" }, { "id": 568236, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584527", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62b0c204-25ba-508f-9b0c-5bab72c4d0f9", "parentControlId": 31281, "controlId": "§117.15(f)(4)(iv)", "title": "§117.15(f)(4)(iv)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584527" } ], "id": 31281, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731026", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731026", "catalogueId": 1062, "uuid": "d38d2503-ced0-5150-8b5c-776a63d4928c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify custodians throughout the transport of digital or non-digital media?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Custodians", "description": "

Control Description

Mechanisms exist to identify custodians throughout the transport of digital or non-digital media.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Data Classification & Handling (DCH) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with DCH domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ Data classification and handling criteria govern user behavior for media handling.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify custodians throughout the transport of digital or non-digital media.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-07.1", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-07.1", "references": "

Micro-Small Business (<10 staff)

∙ Chain of custody

Small Business (10-49 staff)

∙ Chain of custody

Medium Business (50-249 staff)

∙ Chain of custody

Large Business (250-999 staff)

∙ Chain of custody

Enterprise (>1,000 staff)

∙ Chain of custody", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70899, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590355", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590355", "securityControlId": 31282, "ccis": [], "uuid": "fe70dbe7-994b-5091-bb53-83e5df1d0c18", "testId": "DCH-07.2_A01", "test": "information requiring cryptographic protection is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-28(01)_ODP[01]", "defaultText": null }, { "id": 70900, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590355", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590355", "securityControlId": 31282, "ccis": [], "uuid": "2a6e5a0e-0371-5189-b5e3-6cf94b2dbe29", "testId": "DCH-07.2_A02", "test": "system components or media requiring cryptographic protection is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-28(01)_ODP[02]", "defaultText": null }, { "id": 70901, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590355", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590355", "securityControlId": 31282, "ccis": [], "uuid": "3490f14b-b89f-5b68-9bdd-69121ed918b9", "testId": "DCH-07.2_A03", "test": "cryptographic mechanisms are implemented to prevent unauthorized disclosure and/or modification of information at rest on organization-defined system components or media.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-28(01)[01]\n53A_R5_SC-28(01)[02]", "defaultText": null } ], "externalMappings": [ { "id": 568247, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "920016ad-4d5a-546f-a24b-9e149ab1e05f", "parentControlId": 31282, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584529" }, { "id": 568249, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06a98afc-1976-53fa-a757-f6abbdc481af", "parentControlId": 31282, "controlId": "MP-5(4)", "title": "MP-5(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584529" }, { "id": 568250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5255787a-0428-5573-951d-ded2accaccfc", "parentControlId": 31282, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584529" }, { "id": 568252, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d4673e2-cb6c-5051-9619-58ae029f659d", "parentControlId": 31282, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584529" }, { "id": 568253, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ea5f2cc-2089-5825-8d83-c2c33870b761", "parentControlId": 31282, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584529" }, { "id": 568254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd96e43e-d7ed-52a4-802c-3db8e8761d32", "parentControlId": 31282, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58453" }, { "id": 568255, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f1a85d5-4a79-502f-8d60-40a8e7143870", "parentControlId": 31282, "controlId": "SC-28(01)", "title": "SC-28(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58453" }, { "id": 568257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e650a306-5881-508b-918e-a38ad05b3ec3", "parentControlId": 31282, "controlId": "03.08.05.a", "title": "03.08.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58453" } ], "id": 31282, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731026", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731026", "catalogueId": 1062, "uuid": "750cb1ff-00ed-502b-b16d-540662ee3471", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Are cryptographic mechanisms utilized to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Encrypting Data In Storage Media", "description": "

Control Description

Cryptographic mechanisms exist to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational cryptographic capability exists to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-07.2", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-07.2", "references": "

Micro-Small Business (<10 staff)

∙ Cryptographic governance program\n∙ Secure Baseline Configurations (SBC)\n∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Microsoft BitLocker (https://microsoft.com)

Small Business (10-49 staff)

∙ Cryptographic governance program\n∙ Secure Baseline Configurations (SBC)\n∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Microsoft BitLocker (https://microsoft.com)

Medium Business (50-249 staff)

∙ Cryptographic governance program\n∙ Secure Baseline Configurations (SBC)\n∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Microsoft BitLocker (https://microsoft.com)

Large Business (250-999 staff)

∙ Cryptographic governance program\n∙ Secure Baseline Configurations (SBC)\n∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Microsoft BitLocker (https://microsoft.com)

Enterprise (>1,000 staff)

∙ Cryptographic governance program\n∙ Secure Baseline Configurations (SBC)\n∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov)\n∙ Microsoft BitLocker (https://microsoft.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70902, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590356", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590356", "securityControlId": 31283, "ccis": [], "uuid": "440f68db-b319-5618-af1c-3c177238920e", "testId": "DCH-08_A01", "test": "system media to be sanitized prior to disposal is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-06_ODP[01]", "defaultText": null }, { "id": 70903, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590356", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590356", "securityControlId": 31283, "ccis": [], "uuid": "714c50c1-9a6a-5fc0-9fdb-da3d86e59ef5", "testId": "DCH-08_A02", "test": "system media to be sanitized prior to release from organizational control is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-06_ODP[02]", "defaultText": null }, { "id": 70904, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590356", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590356", "securityControlId": 31283, "ccis": [], "uuid": "1ac3eeb6-7d7a-5579-9a4a-4b0ddba61adf", "testId": "DCH-08_A03", "test": "system media to be sanitized prior to release for reuse is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-06_ODP[03]", "defaultText": null }, { "id": 70905, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590356", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590356", "securityControlId": 31283, "ccis": [], "uuid": "f28651cb-8f6c-5225-956f-a31617e85b63", "testId": "DCH-08_A04", "test": "sanitization techniques and procedures to be used for sanitization prior to disposal are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-06_ODP[04]", "defaultText": null }, { "id": 70906, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590356", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590356", "securityControlId": 31283, "ccis": [], "uuid": "766a74fe-5d27-59cb-8ca9-835a7a12cc22", "testId": "DCH-08_A05", "test": "sanitization techniques and procedures to be used for sanitization prior to release from organizational control are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-06_ODP[05]", "defaultText": null }, { "id": 70907, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590356", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590356", "securityControlId": 31283, "ccis": [], "uuid": "864364c1-8dea-554c-836a-ccf5e2eea1d6", "testId": "DCH-08_A06", "test": "sanitization techniques and procedures to be used for sanitization prior to release for reuse are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-06_ODP[06]", "defaultText": null }, { "id": 70908, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590357", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590357", "securityControlId": 31283, "ccis": [], "uuid": "9e37d415-2262-5ac8-b2c2-cf7c3c0ba964", "testId": "DCH-08_A07", "test": "system media is sanitized using sanitization techniques and procedures prior to disposal.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: techniques and procedures IAW NIST SP 800-088 Section 4: Reuse and Disposal of Storage Media and Hardware", "otherId": "53A_R5_MP-06a.[01]", "defaultText": null }, { "id": 70909, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590357", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590357", "securityControlId": 31283, "ccis": [], "uuid": "0070ff42-582d-532d-ac65-4aa79689ebed", "testId": "DCH-08_A08", "test": "system media is sanitized using sanitization techniques and procedures prior to release from organizational control.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: techniques and procedures IAW NIST SP 800-088 Section 4: Reuse and Disposal of Storage Media and Hardware", "otherId": "53A_R5_MP-06a.[02]", "defaultText": null }, { "id": 70910, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590357", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590357", "securityControlId": 31283, "ccis": [], "uuid": "ea6cf84d-799e-5cd7-92bc-21d226096b73", "testId": "DCH-08_A09", "test": "system media is sanitized using sanitization techniques and procedures prior to release for reuse.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: techniques and procedures IAW NIST SP 800-088 Section 4: Reuse and Disposal of Storage Media and Hardware", "otherId": "53A_R5_MP-06a.[03]", "defaultText": null }, { "id": 70911, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590357", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590357", "securityControlId": 31283, "ccis": [], "uuid": "289e1d6a-e899-524e-9384-eb19680439e7", "testId": "DCH-08_A10", "test": "sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_MP-06b.", "defaultText": null } ], "externalMappings": [ { "id": 568292, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8dee09d0-471e-5387-9fea-76a28a1569bb", "parentControlId": 31283, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584542" }, { "id": 568293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4af2b689-8455-5bfb-8d54-6129ed605bb8", "parentControlId": 31283, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584542" }, { "id": 568297, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ff415a5-96bf-587d-bd6c-cb2a7ee4a47d", "parentControlId": 31283, "controlId": "MP-6", "title": "MP-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584542" }, { "id": 568298, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7c199df-8f1f-597c-baf9-bcdb5bf6bf4a", "parentControlId": 31283, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584543" }, { "id": 568300, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584543", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a4ab644-c719-5197-bc58-2902fc38c556", "parentControlId": 31283, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584543" }, { "id": 568301, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584543", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcad5fc7-a2a3-5824-8d59-4dc4965a67ce", "parentControlId": 31283, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584543" }, { "id": 568302, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584543", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b889a48-4336-5277-8904-f30f6c647322", "parentControlId": 31283, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584543" }, { "id": 568303, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584543", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08276131-8f6c-55ab-a32d-b69a8f999298", "parentControlId": 31283, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584543" }, { "id": 568304, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584543", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3b4a6b3-aeef-5b74-9bb3-27b1d815f1ee", "parentControlId": 31283, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584543" }, { "id": 568305, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584543", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a9fde0e-5da5-5294-b8f6-b747b33181f4", "parentControlId": 31283, "controlId": "MP-6", "title": "MP-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584543" }, { "id": 568306, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584543", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d3b1e12-621a-5bad-a0aa-095418f94289", "parentControlId": 31283, "controlId": "MP-6", "title": "MP-6", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584543" }, { "id": 568307, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584543", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b21d78e9-0991-5d00-9b4d-5eaf6c6f7a94", "parentControlId": 31283, "controlId": "MP-6", "title": "MP-6", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584544" }, { "id": 568310, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584544", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0913494d-24a7-5c1d-925d-99f45cdae72c", "parentControlId": 31283, "controlId": "3.8.3", "title": "3.8.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584544" }, { "id": 568311, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584544", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "939a6ddf-b9ab-569e-aec4-293767226a24", "parentControlId": 31283, "controlId": "03.08.03", "title": "03.08.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584544" }, { "id": 568336, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2574342-e5d8-56eb-bfbd-5bb38dcb44f1", "parentControlId": 31283, "controlId": "§117.15(h)(8)(iii)", "title": "§117.15(h)(8)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584547" }, { "id": 568337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64a84a65-9032-54e2-ab70-89b6d2abf972", "parentControlId": 31283, "controlId": "§117.15(i)", "title": "§117.15(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584547" }, { "id": 568338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ec9699d-1191-511a-907d-561630521c22", "parentControlId": 31283, "controlId": "§117.15(i)(1)", "title": "§117.15(i)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584547" }, { "id": 568339, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b33166ff-0bcf-57a3-a308-cb7b536a47a7", "parentControlId": 31283, "controlId": "§117.15(i)(2)", "title": "§117.15(i)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584547" }, { "controlId": "C.1.1", "title": "C.1.1 — Media Protection Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MP-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a3a4dd0d-db00-512f-a19d-dc99e30fcd72", "isPublic": true }, { "controlId": "NEI 08-09 App E.1.1", "title": "NEI 08-09 App E.1.1 — Media Protection Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.1.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "0254b093-3886-54fb-b1a1-c3d829587608", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.1.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "0b6e7087-be53-5cd6-bf4b-57eaaf7d569c", "isPublic": true }, { "controlId": "C.1.6", "title": "C.1.6 — Media Sanitation and Disposal", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MP-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "30e06068-cb5c-5494-938b-1c1acabce781", "isPublic": true }, { "controlId": "NEI 08-09 App E.1.6", "title": "NEI 08-09 App E.1.6 — Media Sanitation and Disposal", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.1.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "88b8c8a2-c488-543b-88ec-9ae89572fd09", "isPublic": true }, { "controlId": "CIP-011-3-R1", "title": "CIP-011-3-R1 — Information Protection Program (BCSI)", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "02078172-37d6-58f2-9ba1-8692ee734988", "isPublic": true }, { "controlId": "CIP-011-3-1.1", "title": "CIP-011-3-1.1 — Method(s) to identify BCSI.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-011-3-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "324dccf6-cb6c-58d9-b294-b0f208490c96", "isPublic": true }, { "controlId": "CIP-011-3-1.2", "title": "CIP-011-3-1.2 — Method(s) to protect and securely handle BCSI to mitigate risks of compromising confidentiality.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-011-3-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1200fb6a-6e38-574c-a48c-3ebdda094bcb", "isPublic": true }, { "controlId": "CIP-011-3-R2", "title": "CIP-011-3-R2 — BES Cyber Asset Reuse and Disposal", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "42475894-f383-553e-aa61-a66533d22491", "isPublic": true }, { "controlId": "CIP-011-3-2.1", "title": "CIP-011-3-2.1 — Prior to the release for reuse of applicable Cyber Assets that contain BCSI (except for reuse within other systems id...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-011-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "dae2f051-cabb-5326-9233-b61579199fdc", "isPublic": true }, { "controlId": "CIP-011-3-2.2", "title": "CIP-011-3-2.2 — Prior to the disposal of applicable Cyber Assets that contain BCSI, the Responsible Entity shall take action to preve...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-011-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8d83141b-5e21-515d-be0b-c7302a902c6c", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d2234cd4-69db-5eec-a407-26254b744ae7", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "8ed532bb-e7c8-5ac5-a363-d2f5e43a614e", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "d54951db-babe-5b10-ab76-d8a9bbbb873f", "isPublic": true } ], "id": 31283, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731026", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731026", "catalogueId": 1062, "uuid": "c825fba6-2ae9-51ec-8835-a0b02bbd1c93", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization securely dispose of media when it is no longer required, using formal procedures?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Physical Media Disposal", "description": "

Control Description

Mechanisms exist to securely dispose of media when it is no longer required, using formal procedures.

Evidence Request List (ERL)

E-AST-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ The data retention process is manual and IT and/or cybersecurity personnel work with business stakeholders and process owners to manage the process.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to dispose of, destroy, erase, and/or anonymize sensitive/regulated data.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to securely dispose of media when it is no longer required, using formal procedures.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.1.1, C.1.6
NERC-CIP (2026) Requirements: CIP-011-3-R1, CIP-011-3-R2", "controlId": "DCH-08", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-08", "references": "

Micro-Small Business (<10 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Small Business (10-49 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Medium Business (50-249 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Large Business (250-999 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Enterprise (>1,000 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70912, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590357", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590357", "securityControlId": 31284, "ccis": [], "uuid": "8e88b040-0b70-5334-8fe9-aa3b2b0b9346", "testId": "DCH-09_A01", "test": "system media to be sanitized prior to disposal, release and/or reuse is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-06_ODP[01]\n53A_R5_MP-06_ODP[02]\n53A_R5_MP-06_ODP[03]", "defaultText": null }, { "id": 70913, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590358", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590358", "securityControlId": 31284, "ccis": [], "uuid": "0ebc29a8-9d60-5cf8-8353-f07c2d2e2f54", "testId": "DCH-09_A02", "test": "sanitization techniques and procedures to be used for sanitization prior to disposal, release and/or reuse are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-06_ODP[04]\n53A_R5_MP-06_ODP[05]\n53A_R5_MP-06_ODP[06]", "defaultText": null }, { "id": 70914, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590358", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590358", "securityControlId": 31284, "ccis": [], "uuid": "c0046435-d9c1-5a69-bae3-13f338ecc8f8", "testId": "DCH-09_A03", "test": "system media is sanitized using sanitization techniques and procedures prior to disposal, release and/or reuse.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: techniques and procedures IAW NIST SP 800-088 Section 4: Reuse and Disposal of Storage Media and Hardware", "otherId": "53A_R5_MP-06a.[01]\n53A_R5_MP-06a.[02]\n53A_R5_MP-06a.[03]\n171A_3.7.3", "defaultText": null }, { "id": 70915, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590358", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590358", "securityControlId": 31284, "ccis": [], "uuid": "73aec02f-a057-55e4-a96f-93be5b9358f2", "testId": "DCH-09_A04", "test": "sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_MP-06b.", "defaultText": null }, { "id": 70916, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590358", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590358", "securityControlId": 31284, "ccis": [], "uuid": "205b3150-a337-58b6-ba33-c80691497245", "testId": "DCH-09_A05", "test": "circumstances requiring sanitization of portable storage devices are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-06(03)_ODP", "defaultText": null }, { "id": 70917, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590358", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590358", "securityControlId": 31284, "ccis": [], "uuid": "eec53146-e014-5c6a-839d-6a8255edb006", "testId": "DCH-09_A06", "test": "non-destructive sanitization techniques are applied to portable storage devices prior to connecting such devices to the system under circumstances.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-06(03)", "defaultText": null }, { "id": 70918, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590358", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590358", "securityControlId": 31284, "ccis": [], "uuid": "4f45eff8-a800-5de5-858c-78dcdb051757", "testId": "DCH-09_A07", "test": "equipment containing sensitive / regulated data is sanitized prior to disposal, reuse, or release out of organizational control.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.8.3[a]\n171A_3.8.3[b]", "defaultText": null }, { "id": 70919, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590358", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590358", "securityControlId": 31284, "ccis": [], "uuid": "cd1cac5b-ccb5-5497-9206-fdb2d42c64b9", "testId": "DCH-09_A08", "test": "system media that contain CUI are sanitized prior to disposal, release out of organizational control, or release for reuse.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.08.03", "defaultText": null }, { "id": 70920, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590359", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590359", "securityControlId": 31284, "ccis": [], "uuid": "4071f46c-d12a-5cb3-af45-17bc36610782", "testId": "DCH-09_A09", "test": "system media containing sensitive/regulated data is sanitized or destroyed before disposal.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "CMMC L1 Assessment Guide", "defaultText": null }, { "id": 70921, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590359", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590359", "securityControlId": 31284, "ccis": [], "uuid": "542e3b75-0cc7-590f-aea5-1a1237c7715f", "testId": "DCH-09_A10", "test": "system media containing sensitive/regulated data is sanitized before it is released for reuse.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "CMMC L1 Assessment Guide", "defaultText": null } ], "externalMappings": [ { "id": 568419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e4cfa16-8e5e-55f1-a3b5-cab958807518", "parentControlId": 31284, "controlId": "CR 4.2", "title": "CR 4.2", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584557" }, { "id": 568420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f6d1bfa-2695-5421-850f-086e832fc128", "parentControlId": 31284, "controlId": "CR 4.2(1)", "title": "CR 4.2(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584557" }, { "id": 568421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58d378a2-b8da-598c-9fbc-34e0b8378027", "parentControlId": 31284, "controlId": "CR 4.2(2)", "title": "CR 4.2(2)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584557" }, { "id": 568422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e81626ef-055b-55eb-b831-6604c3a31003", "parentControlId": 31284, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584557" }, { "id": 568426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "218c4c31-0e26-5c7f-82cf-fa0c853f0309", "parentControlId": 31284, "controlId": "MP-6", "title": "MP-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584557" }, { "id": 568427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ecac9599-6c94-55e1-a3c0-e867df30094d", "parentControlId": 31284, "controlId": "MP-6(3)", "title": "MP-6(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584557" }, { "id": 568428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2dc626e4-6e16-5f2c-b530-2a091f5bdb32", "parentControlId": 31284, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584558" }, { "id": 568429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdba8000-b33e-575a-ab1e-e1301983635f", "parentControlId": 31284, "controlId": "MP-06(03)", "title": "MP-06(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584558" }, { "id": 568432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13bf1e23-344c-516c-857b-f83ea51b965b", "parentControlId": 31284, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584558" }, { "id": 568433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43514cd1-8629-571b-853b-194cd92bad40", "parentControlId": 31284, "controlId": "MP-06(03)", "title": "MP-06(03)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584558" }, { "id": 568435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef0d1874-39d4-5d5d-8a0b-c42d4488cd9e", "parentControlId": 31284, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584558" }, { "id": 568436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1181dc23-6d7e-5888-9c1f-0d9ce6aaf47b", "parentControlId": 31284, "controlId": "MP-06(03)", "title": "MP-06(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584558" }, { "id": 568437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "201adad6-779d-51db-8015-e1328a206cae", "parentControlId": 31284, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584559" }, { "id": 568438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b213136b-1855-58f3-beba-98ead72469c4", "parentControlId": 31284, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584559" }, { "id": 568439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2379c9b1-36cd-53b5-8eca-ad4961e7e9f0", "parentControlId": 31284, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584559" }, { "id": 568440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2593c099-511a-5fa7-925e-2ad6079e7d1a", "parentControlId": 31284, "controlId": "MP-06(03)", "title": "MP-06(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584559" }, { "id": 568441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66a980ea-6504-5f71-b2ee-a25d62ecc448", "parentControlId": 31284, "controlId": "MP-6", "title": "MP-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584559" }, { "id": 568442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2450e9e7-33df-54eb-b0ce-7a40b2491986", "parentControlId": 31284, "controlId": "MP-6", "title": "MP-6", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584559" }, { "id": 568443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92407f5b-3088-5715-a9fd-443182035d45", "parentControlId": 31284, "controlId": "MP-6", "title": "MP-6", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584559" }, { "id": 568446, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58456", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92cec9ec-09aa-513d-9bde-a5be983f9992", "parentControlId": 31284, "controlId": "3.7.3", "title": "3.7.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58456" }, { "id": 568447, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58456", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f819d6a4-16fd-5f69-bad6-aaedf901d80a", "parentControlId": 31284, "controlId": "3.8.3", "title": "3.8.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58456" }, { "id": 568448, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58456", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b90904bc-a196-50e1-b48e-e13188f981d6", "parentControlId": 31284, "controlId": "03.07.04.c", "title": "03.07.04.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58456" }, { "id": 568449, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58456", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c61f144e-917a-5275-8d99-9bf6e1657139", "parentControlId": 31284, "controlId": "03.08.03", "title": "03.08.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58456" }, { "id": 568458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7dae0ee7-030d-50ac-b7a9-bfe849555a8d", "parentControlId": 31284, "controlId": "ASSET-2h", "title": "ASSET-2h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584561" }, { "id": 568486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584564", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aac578ce-a216-5b0c-8e80-3c65a903422e", "parentControlId": 31284, "controlId": "CIP-011-3 2.1", "title": "CIP-011-3 2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584564" }, { "id": 568496, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584565", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "360f69d0-a6fd-5364-b1b9-71bd09f7df00", "parentControlId": 31284, "controlId": "B3.e", "title": "B3.e", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584565" }, { "controlId": "C.1.2", "title": "C.1.2 — Media Access", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MP-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ca57c23e-b670-5f5f-a83c-c341ced832bf", "isPublic": true }, { "controlId": "NEI 08-09 App E.1.2", "title": "NEI 08-09 App E.1.2 — Media Access", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.1.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "2c00846c-6cd8-5056-a54c-a83a2a0e4470", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.1.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "9f30f100-0bcb-5fe4-be83-b696c5dc1d97", "isPublic": true }, { "controlId": "C.1.6", "title": "C.1.6 — Media Sanitation and Disposal", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MP-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "30a9124c-223d-57d1-aa11-73a7f99f9848", "isPublic": true }, { "controlId": "NEI 08-09 App E.1.6", "title": "NEI 08-09 App E.1.6 — Media Sanitation and Disposal", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.1.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "bc2a8db5-9a56-53c5-9c40-cfb6d48380a6", "isPublic": true }, { "controlId": "CIP-011-3-R2", "title": "CIP-011-3-R2 — BES Cyber Asset Reuse and Disposal", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "19e61fd6-1560-570d-991b-c3250393f084", "isPublic": true }, { "controlId": "CIP-011-3-2.1", "title": "CIP-011-3-2.1 — Prior to the release for reuse of applicable Cyber Assets that contain BCSI (except for reuse within other systems id...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-011-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "cfb48c6a-5b8a-578f-9ed3-c3edebe79546", "isPublic": true }, { "controlId": "CIP-011-3-2.2", "title": "CIP-011-3-2.2 — Prior to the disposal of applicable Cyber Assets that contain BCSI, the Responsible Entity shall take action to preve...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-011-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1054fb35-ec3c-5e6d-8e5b-9f954bd2fa25", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "52ad7c8f-53f5-524f-bd18-3bbfcab34b3d", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "00058797-d239-52e2-8bc3-3b756912bebc", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "9e0477eb-e703-5e54-b452-a9489f08df24", "isPublic": true } ], "id": 31284, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731027", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731027", "catalogueId": 1062, "uuid": "a45ac7e8-b96d-58cb-91a0-71a7ba6bbfb9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization sanitize system media with the strength and integrity commensurate with the classification or sensitivity of the information prior to disposal, release out of organizational control or release for reuse?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "System Media Sanitization", "description": "

Control Description

Mechanisms exist to sanitize system media with the strength and integrity commensurate with the classification or sensitivity of the information prior to disposal, release out of organizational control or release for reuse.

Evidence Request List (ERL)

E-AST-03\nE-DCH-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ The data retention process is manual and IT and/or cybersecurity personnel work with business stakeholders and process owners to manage the process.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to dispose of, destroy, erase, and/or anonymize sensitive/regulated data.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to sanitize system media with the strength and integrity commensurate with the classification or sensitivity of the information prior to disposal, release out of organizational control or release for reuse.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.1.2, C.1.6
NERC-CIP (2026) Requirements: CIP-011-3-R2", "controlId": "DCH-09", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-09", "references": "

Micro-Small Business (<10 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Small Business (10-49 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Medium Business (50-249 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Large Business (250-999 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Enterprise (>1,000 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70922, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590359", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590359", "securityControlId": 31285, "ccis": [], "uuid": "da62947e-60e7-57a2-874d-9c176a4e6706", "testId": "DCH-09.1_A01", "test": "media sanitization and disposal actions are reviewed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-06(01)[01]", "defaultText": null }, { "id": 70923, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590359", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590359", "securityControlId": 31285, "ccis": [], "uuid": "e9b828dc-f51d-5e3c-a2a8-5d755b15317a", "testId": "DCH-09.1_A02", "test": "media sanitization and disposal actions are approved.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MP-06(01)[02]", "defaultText": null }, { "id": 70924, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590359", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590359", "securityControlId": 31285, "ccis": [], "uuid": "3ff51836-9c17-5ac0-b2c7-8dafb456a922", "testId": "DCH-09.1_A03", "test": "media sanitization and disposal actions are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-06(01)[04]", "defaultText": null }, { "id": 70925, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590359", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590359", "securityControlId": 31285, "ccis": [], "uuid": "3cfe3d02-820a-5bb9-a356-548f9d5216e4", "testId": "DCH-09.1_A04", "test": "media sanitization and disposal actions are tracked.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_MP-06(01)[03]", "defaultText": null }, { "id": 70926, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59036", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59036", "securityControlId": 31285, "ccis": [], "uuid": "615f91fa-c427-5741-afd2-6e4c3f7fa3ed", "testId": "DCH-09.1_A05", "test": "media sanitization and disposal actions are verified.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_MP-06(01)[05]", "defaultText": null } ], "externalMappings": [ { "id": 568557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfba28de-62a2-5487-8b7b-af2b66b1e9d1", "parentControlId": 31285, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584572" }, { "id": 568559, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "734abda3-5f46-5b9d-89d7-945ddd4d0e93", "parentControlId": 31285, "controlId": "MP-6(1)", "title": "MP-6(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584572" }, { "id": 568560, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "591cf164-99f9-58bd-9daf-3ff7e887b060", "parentControlId": 31285, "controlId": "MP-06(01)", "title": "MP-06(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584572" }, { "id": 568561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8516fa29-d2a9-5fbc-b812-6803e7a90b44", "parentControlId": 31285, "controlId": "MP-06(01)", "title": "MP-06(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584572" }, { "id": 568562, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1178f354-c355-5c4e-be5c-c668fe6d5e67", "parentControlId": 31285, "controlId": "MP-06(01)", "title": "MP-06(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584573" }, { "id": 568563, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be184ac0-564f-5e6d-b7e8-a2ff2684b258", "parentControlId": 31285, "controlId": "MP-06(01)", "title": "MP-06(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584573" } ], "id": 31285, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731027", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731027", "catalogueId": 1062, "uuid": "e438ad4a-10bc-53a6-833b-a42c59ff7950", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization supervise, track, document and verify system media sanitization and disposal actions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "System Media Sanitization Documentation", "description": "

Control Description

Mechanisms exist to supervise, track, document and verify system media sanitization and disposal actions.

Evidence Request List (ERL)

E-AST-03\nE-DCH-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ The data retention process is manual and IT and/or cybersecurity personnel work with business stakeholders and process owners to manage the process.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to supervise, track, document and verify system media sanitization and disposal actions.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-09.1", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-09.1", "references": "

Micro-Small Business (<10 staff)

∙ Certificate of destruction

Small Business (10-49 staff)

∙ Certificate of destruction

Medium Business (50-249 staff)

∙ Certificate of destruction

Large Business (250-999 staff)

∙ Certificate of destruction

Enterprise (>1,000 staff)

∙ Certificate of destruction", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70927, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59036", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59036", "securityControlId": 31286, "ccis": [], "uuid": "fd76cee8-8f47-5193-a69e-20687776c832", "testId": "DCH-09.2_A01", "test": "the frequency with which to test sanitization equipment / procedures is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_MP-06(02)_ODP[01]\n53A_R5_MP-06(02)_ODP[02]", "defaultText": null }, { "id": 70928, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59036", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59036", "securityControlId": 31286, "ccis": [], "uuid": "cb0be8bc-9470-513d-9c35-45b30cf863bf", "testId": "DCH-09.2_A02", "test": "sanitization equipment / procedures are tested frequently to ensure that the intended sanitization is achieved.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MP-06(02)[01]\n53A_R5_MP-06(02)[02]", "defaultText": null } ], "externalMappings": [ { "id": 568601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "694ed298-4a79-51a3-87dd-4f60027abfa2", "parentControlId": 31286, "controlId": "MP-6(2)", "title": "MP-6(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584577" }, { "id": 568602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2c983d6-4e17-5125-b095-a3b1a6e81a30", "parentControlId": 31286, "controlId": "MP-06(02)", "title": "MP-06(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584577" }, { "id": 568603, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4264667-82b5-5bfc-a1f2-76f53234ca3f", "parentControlId": 31286, "controlId": "MP-06(02)", "title": "MP-06(02)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584577" }, { "id": 568604, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b36d130c-e0d3-571a-80bb-5863f7de03cf", "parentControlId": 31286, "controlId": "MP-06(02)", "title": "MP-06(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584577" }, { "id": 568605, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd828d2f-e1a9-5a0b-bb0f-51e583a0ba45", "parentControlId": 31286, "controlId": "MP-06(02)", "title": "MP-06(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584577" } ], "id": 31286, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731028", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731028", "catalogueId": 1062, "uuid": "ddf00172-9f9a-5478-82fc-1f154f365145", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization test sanitization equipment and procedures to verify that the intended result is achieved?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Equipment Testing", "description": "

Control Description

Mechanisms exist to test sanitization equipment and procedures to verify that the intended result is achieved.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to test sanitization equipment and procedures to verify that the intended result is achieved.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-09.2", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-09.2", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70929, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59036", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59036", "securityControlId": 31287, "ccis": [], "uuid": "8a5b0b50-9e12-5d8e-8def-d98ba3f6d009", "testId": "DCH-09.3_A01", "test": "system media to be sanitized prior to disposal is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-06_ODP[01]", "defaultText": null }, { "id": 70930, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590361", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590361", "securityControlId": 31287, "ccis": [], "uuid": "6d62afa5-c473-5d0a-a6ac-0e390599b578", "testId": "DCH-09.3_A02", "test": "types of Personal Data (PD) to be sanitized prior to disposal are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70931, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590361", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590361", "securityControlId": 31287, "ccis": [], "uuid": "eb76cac8-f1d8-5771-942a-cfa5b6f40dfc", "testId": "DCH-09.3_A03", "test": "sanitization techniques and procedures to be used for sanitization of Personal Data (PD) are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70932, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590361", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590361", "securityControlId": 31287, "ccis": [], "uuid": "b45fcbb8-f739-549d-9a2a-23908e0adf8d", "testId": "DCH-09.3_A04", "test": "sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed for the sanitization of Personal Data.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 568618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584588", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26ed9a7a-bb14-5b21-b823-5bb4ffd1c385", "parentControlId": 31287, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584588" }, { "id": 568620, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584588", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8dba3566-3e51-51d2-9ac4-817f9544d8ac", "parentControlId": 31287, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584588" }, { "id": 568621, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bec6a8d-3bba-5242-8956-195ed5f6dfb3", "parentControlId": 31287, "controlId": "MP-06(03)", "title": "MP-06(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584589" }, { "id": 568624, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7352d836-12e1-569f-9a35-62503ffd43d9", "parentControlId": 31287, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584589" }, { "id": 568625, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ea72a45-c366-56aa-9995-7d7de389c1de", "parentControlId": 31287, "controlId": "MP-06(03)", "title": "MP-06(03)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584589" }, { "id": 568626, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93b55b01-0790-5425-86be-ec40fd2346b1", "parentControlId": 31287, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584589" }, { "id": 568627, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e4b42f0-c8b7-5d25-95ee-99462cedbdee", "parentControlId": 31287, "controlId": "MP-06(03)", "title": "MP-06(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584589" }, { "id": 568628, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "badb3043-c6c6-5129-9cb6-df6c5808c028", "parentControlId": 31287, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584589" }, { "id": 568629, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09ae4832-a4c7-507b-b222-1c66a4fba741", "parentControlId": 31287, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584589" }, { "id": 568630, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2af94397-9a39-50a1-81c2-4c1bb7f6ed91", "parentControlId": 31287, "controlId": "MP-06", "title": "MP-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58459" }, { "id": 568631, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76809a6e-a4f0-5bda-8017-76450f1b7e3b", "parentControlId": 31287, "controlId": "MP-06(03)", "title": "MP-06(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58459" }, { "id": 568632, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d454038-b6b9-5ae8-a005-f9586629b438", "parentControlId": 31287, "controlId": "MP-6", "title": "MP-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58459" }, { "id": 568633, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9669bfea-b1af-5165-b33f-cad52f81bb38", "parentControlId": 31287, "controlId": "MP-6", "title": "MP-6", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58459" }, { "id": 568634, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6a990f6-ba44-55e6-b3aa-e993b5c67d38", "parentControlId": 31287, "controlId": "MP-6", "title": "MP-6", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58459" } ], "id": 31287, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731028", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731028", "catalogueId": 1062, "uuid": "841ab948-947a-50ef-87c3-3a9e0905a28b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the sanitization of Personal Data (PD)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Sanitization of Personal Data (PD)", "description": "

Control Description

Mechanisms exist to facilitate the sanitization of Personal Data (PD).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ The data retention process is manual and IT and/or cybersecurity personnel work with business stakeholders and process owners to manage the process.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the sanitization of Personal Data (PD).

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-09.3", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-09.3", "references": "

Micro-Small Business (<10 staff)

∙ De-identifying sensitive Personal Data (sPD)

Small Business (10-49 staff)

∙ De-identifying sensitive Personal Data (sPD)

Medium Business (50-249 staff)

∙ De-identifying sensitive Personal Data (sPD)

Large Business (250-999 staff)

∙ De-identifying sensitive Personal Data (sPD)

Enterprise (>1,000 staff)

∙ De-identifying sensitive Personal Data (sPD)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70933, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590361", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590361", "securityControlId": 31288, "ccis": [], "uuid": "a77d404b-74c9-561e-830d-bbb311f53213", "testId": "DCH-09.4_A01", "test": "circumstances requiring sanitization of portable storage devices are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-06(03)_ODP", "defaultText": null }, { "id": 70934, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590362", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590362", "securityControlId": 31288, "ccis": [], "uuid": "23b37fb7-2c89-5921-b48e-354027a02ce2", "testId": "DCH-09.4_A02", "test": "non-destructive sanitization techniques are applied to portable storage devices prior to connecting such devices to the system under circumstances.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-06(03)", "defaultText": null } ], "externalMappings": [ { "id": 568668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584594", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "732a8b93-d9da-502d-b507-6dff6a1bd5fc", "parentControlId": 31288, "controlId": "MP-6(3)", "title": "MP-6(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584594" }, { "id": 568669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584594", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2cc46e39-f18d-5803-98f3-4d5e55fff752", "parentControlId": 31288, "controlId": "MP-06(03)", "title": "MP-06(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584594" }, { "id": 568671, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584595", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42dbb62c-59fa-5b74-b1a1-12a1e6884865", "parentControlId": 31288, "controlId": "MP-06(03)", "title": "MP-06(03)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584595" }, { "id": 568672, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584595", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f2a8eb4-7933-51f8-9613-60092ae19e21", "parentControlId": 31288, "controlId": "MP-06(03)", "title": "MP-06(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584595" }, { "id": 568673, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584595", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2993add9-3a83-56dc-bff7-8fbf46c1bce7", "parentControlId": 31288, "controlId": "MP-06(03)", "title": "MP-06(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584595" } ], "id": 31288, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731028", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731028", "catalogueId": 1062, "uuid": "c5a82e48-cf63-510b-8ddf-f0526236e5d7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization apply nondestructive sanitization techniques to portable storage devices prior to first use?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "First Time Use Sanitization", "description": "

Control Description

Mechanisms exist to apply nondestructive sanitization techniques to portable storage devices prior to first use.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to apply nondestructive sanitization techniques to portable storage devices prior to first use.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-09.4", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-09.4", "references": "

Micro-Small Business (<10 staff)

∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Small Business (10-49 staff)

∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Medium Business (50-249 staff)

∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Large Business (250-999 staff)

∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Enterprise (>1,000 staff)

∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70935, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590362", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590362", "securityControlId": 31289, "ccis": [], "uuid": "dfa457c7-15b4-589a-a509-cd4091b38514", "testId": "DCH-09.5_A01", "test": "system media to be sanitized using dual authorization is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-06(07)_ODP", "defaultText": null }, { "id": 70936, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590362", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590362", "securityControlId": 31289, "ccis": [], "uuid": "22505cbc-8141-5c9f-8b29-ff2d584ce427", "testId": "DCH-09.5_A02", "test": "dual authorization for sanitization of system media is enforced.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-06(07)", "defaultText": null } ], "externalMappings": [ { "id": 568680, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1933a9ae-ab2b-5022-983c-d4fce3f8ec1c", "parentControlId": 31289, "controlId": "MP-6(7)", "title": "MP-6(7)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584596" }, { "id": 568681, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc39a508-f27f-588e-9d8d-c01264684fe1", "parentControlId": 31289, "controlId": "MP-06(07)", "title": "MP-06(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584596" }, { "id": 568682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9bd37a9-5914-5372-b069-77e4e6acd3df", "parentControlId": 31289, "controlId": "MP-06(07)", "title": "MP-06(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584596" } ], "id": 31289, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731029", "catalogueId": 1062, "uuid": "c0c59fa1-930a-5bc7-90bf-5d18318f31ca", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce dual authorization for the destruction, disposal or sanitization of digital media that contains sensitive/regulated data?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Dual Authorization for Sensitive Data Destruction", "description": "

Control Description

Mechanisms exist to enforce dual authorization for the destruction, disposal or sanitization of digital media that contains sensitive/regulated data.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enforce dual authorization for the destruction, disposal or sanitization of digital media that contains sensitive/regulated data.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-09.5", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-09.5", "references": "

Micro-Small Business (<10 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Small Business (10-49 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Medium Business (50-249 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Large Business (250-999 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Enterprise (>1,000 staff)

∙ Logical Access Control (LAC)\n∙ Physical Access Control (PAC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70937, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590364", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590364", "securityControlId": 31290, "ccis": [], "uuid": "e3bc1d18-c009-59ee-b720-fedcbc891ecc", "testId": "DCH-10_A01", "test": "the use of removable media on system components is controlled.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.8.7\n53A_R5_MP-07_ODP[02]", "defaultText": null }, { "id": 70938, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590364", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590364", "securityControlId": 31290, "ccis": [], "uuid": "361ba7e8-7aee-5a0f-be67-03923841b012", "testId": "DCH-10_A02", "test": "organization-defined types of system media are restricted or prohibited.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70939, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590364", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590364", "securityControlId": 31290, "ccis": [], "uuid": "9d8333f6-70d2-569a-af3c-a2c7dbb9dcbf", "testId": "DCH-10_A03", "test": "types of system media with usage restrictions or that are prohibited from use are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_MP-07_ODP[01]\n171A_R3_A.03.08.07.ODP[01]", "defaultText": null }, { "id": 70940, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590365", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590365", "securityControlId": 31290, "ccis": [], "uuid": "8b17a2f6-3d76-5fe0-a649-7bb22ed16dc6", "testId": "DCH-10_A04", "test": "systems or system components on which the use of specific types of system media to be restricted or prohibited are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-07_ODP[03]", "defaultText": null }, { "id": 70941, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590365", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590365", "securityControlId": 31290, "ccis": [], "uuid": "be36b9ba-1014-5ccf-9f94-ab91b12be219", "testId": "DCH-10_A05", "test": "controls to restrict or prohibit the use of specific types of system media on systems or system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-07_ODP[04]\n53A_R5_MP-07_ODP[02]", "defaultText": null }, { "id": 70942, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590365", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590365", "securityControlId": 31290, "ccis": [], "uuid": "af99d4b4-c02c-5e3a-881e-2037255195e4", "testId": "DCH-10_A06", "test": "the use of types of system media is organization-defined criteria on systems or system components using controls.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_MP-07a.", "defaultText": null }, { "id": 70943, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590365", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590365", "securityControlId": 31290, "ccis": [], "uuid": "3880019a-ba7f-5de1-a02b-3858ab5c5d41", "testId": "DCH-10_A07", "test": "the use of portable storage devices in organizational systems is prohibited when such devices have no identifiable owner.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_MP-07b.", "defaultText": null }, { "id": 70944, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590366", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590366", "securityControlId": 31290, "ccis": [], "uuid": "5e1b5e48-fda3-524c-b330-620e9243a9ea", "testId": "DCH-10_A08", "test": "the use of the following types of system media is restricted or prohibited: .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: any removable media not managed by or on behalf of the organization", "otherId": "171A_R3_A.03.08.07.a", "defaultText": null } ], "externalMappings": [ { "id": 568686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5bee12f2-bc11-5764-87d8-a3c22504be0c", "parentControlId": 31290, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584596" }, { "id": 568689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "887fcc0c-02e1-5fc3-9568-72c102a6b026", "parentControlId": 31290, "controlId": "T1025", "title": "T1025", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584597" }, { "id": 568690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a655d8c1-46b9-5c98-8625-2f9cc7ee5a0d", "parentControlId": 31290, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584597" }, { "id": 568691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "187a8337-af43-5a1a-b509-81818c53671f", "parentControlId": 31290, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584597" }, { "id": 568692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6334170a-2f4f-5c2b-ac7d-9352c48ed12f", "parentControlId": 31290, "controlId": "T1091", "title": "T1091", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584597" }, { "id": 568693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81988a99-cb8a-5ede-a533-5705f4f9a647", "parentControlId": 31290, "controlId": "T1092", "title": "T1092", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584597" }, { "id": 568694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "624da3ea-ca57-5635-a523-296d3fca1e0c", "parentControlId": 31290, "controlId": "T1200", "title": "T1200", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584597" }, { "id": 568695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb3a2bf6-36b0-5df4-9b9c-af6bc4ea0e96", "parentControlId": 31290, "controlId": "MP-7", "title": "MP-7", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584597" }, { "id": 568696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d5d4619-7433-5874-a99c-f0edfccbc26b", "parentControlId": 31290, "controlId": "SC-8(2)", "title": "SC-8(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584598" }, { "id": 568697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d77b0c6-4498-507e-8121-a46717f2e805", "parentControlId": 31290, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584598" }, { "id": 568698, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14efe54f-696c-5963-8da9-6e93e803f984", "parentControlId": 31290, "controlId": "SC-08(02)", "title": "SC-08(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584598" }, { "id": 568701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8f11ec8-8bce-50f9-a924-a7ce4606a5d3", "parentControlId": 31290, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584598" }, { "id": 568702, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02e1c1f5-5340-5ea8-9a02-2f3baf7338dc", "parentControlId": 31290, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584598" }, { "id": 568703, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f672a172-c472-5f04-95d8-89227ea4acd1", "parentControlId": 31290, "controlId": "SC-08(02)", "title": "SC-08(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584598" }, { "id": 568704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7de8cfad-4828-5524-bd05-6b032add8996", "parentControlId": 31290, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584598" }, { "id": 568705, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "204e45d5-35e5-57b9-8988-28d384beb6a3", "parentControlId": 31290, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584598" }, { "id": 568706, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584599", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d5b7f6d-df57-532a-9811-7b09f2001e49", "parentControlId": 31290, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584599" }, { "id": 568707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584599", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fd4e5a5-4e2e-5a43-a7bb-79b1c89b1104", "parentControlId": 31290, "controlId": "3.8.7", "title": "3.8.7", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584599" }, { "id": 568708, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584599", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9a8a434-8323-50aa-8982-09ba742c0b2f", "parentControlId": 31290, "controlId": "03.08.07.a", "title": "03.08.07.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584599" }, { "controlId": "C.1.3", "title": "C.1.3 — Media Labeling/Marking", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MP-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "d65f602d-3c3d-5f5a-b293-4061a9008176", "isPublic": true }, { "controlId": "NEI 08-09 App E.1.3", "title": "NEI 08-09 App E.1.3 — Media Labeling/Marking", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.1.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "4d16704d-46db-502d-8434-657a367d0e4d", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.1.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "3e7ab86a-fce7-56f6-9314-1bb71dc18bf1", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "94ad1c6f-f353-5643-ad40-2b488e2fcbe9", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "7d3e6287-7d91-5f77-ab8e-b05e409c28ce", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "cf45f633-68f1-5637-b112-2eecee7baeae", "isPublic": true } ], "id": 31290, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731029", "catalogueId": 1062, "uuid": "c637e926-b106-59ce-838f-c28ee5ade29f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict the use of types of digital media on systems or system components?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Media Use", "description": "

Control Description

Mechanisms exist to restrict the use of types of digital media on systems or system components.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict the use of types of digital media on systems or system components.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.1.3", "controlId": "DCH-10", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-10", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70945, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590366", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590366", "securityControlId": 31291, "ccis": [], "uuid": "f313447e-ba0b-5f5a-a160-5afd5f91655f", "testId": "DCH-10.1_A01", "test": "the use of sensitive / regulated data is restricted to approved business practices.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 70946, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590366", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590366", "securityControlId": 31291, "ccis": [], "uuid": "427baca9-4860-5004-9d7e-18e378a3fedc", "testId": "DCH-10.1_A02", "test": "the distribution of sensitive / regulated data is restricted to authorized personnel.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 568740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "917e0514-90bf-59c6-84fd-e859168bf6f0", "parentControlId": 31291, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584602" } ], "id": 31291, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731029", "catalogueId": 1062, "uuid": "147a2e82-ac8d-5f76-ac80-1b380bcda3ff", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict the use and distribution of sensitive/regulated data?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Limitations on Use", "description": "

Control Description

Mechanisms exist to restrict the use and distribution of sensitive/regulated data.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Data Classification & Handling (DCH) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with DCH domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Data protection controls are primarily administrative in nature (e.g., policies & standards) to classify, protect and dispose of systems and data, including storage media.\n▪ Limited media handling guidance exists for users.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict the use and distribution of sensitive/regulated data.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "DCH-10.1", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-10.1", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70947, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590367", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590367", "securityControlId": 31292, "ccis": [], "uuid": "ca90f7c7-f219-5e80-8989-e3fc7eaefff7", "testId": "DCH-10.2_A01", "test": "the use of portable storage devices is prohibited when such devices have no identifiable owner.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.8.8", "defaultText": null }, { "id": 70948, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590367", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590367", "securityControlId": 31292, "ccis": [], "uuid": "36626047-ba6d-50fb-9eb5-2c17bec89569", "testId": "DCH-10.2_A02", "test": "the use of removable system media without an identifiable owner is prohibited.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.08.07.b", "defaultText": null } ], "externalMappings": [ { "id": 568747, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584603", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c2f9cbf-ee2f-594d-8c11-b38ea627afb4", "parentControlId": 31292, "controlId": "MP-7(1)", "title": "MP-7(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584603" }, { "id": 568748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd3cc0e1-8fb4-57ae-9661-3a83782c8203", "parentControlId": 31292, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584604" }, { "id": 568750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5fbb72e-79fa-51a9-8a78-cc08bcca1660", "parentControlId": 31292, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584604" }, { "id": 568751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff83134d-e98b-5a8c-bda2-e17a79ead34b", "parentControlId": 31292, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584604" }, { "id": 568752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08bae0a8-7c06-57bf-bd30-9134ccbb8ac5", "parentControlId": 31292, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584604" }, { "id": 568753, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6823479-66fa-5d18-8abd-5d34f403b622", "parentControlId": 31292, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584604" }, { "id": 568754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7501582-5423-5e59-9c62-60cb7fb12dfd", "parentControlId": 31292, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584604" }, { "id": 568755, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b2a4616-557c-54a3-8b34-9141dc99b833", "parentControlId": 31292, "controlId": "3.8.8", "title": "3.8.8", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584604" }, { "id": 568756, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e78e99d-2179-5990-9427-a4e0645d3a27", "parentControlId": 31292, "controlId": "03.08.07.b", "title": "03.08.07.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584604" } ], "id": 31292, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73103", "catalogueId": 1062, "uuid": "4f05883f-3fc9-52b5-861b-3a05f0c7eb6d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Prohibit Use Without Owner", "description": "

Control Description

Mechanisms exist to prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-10.2", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-10.2", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70949, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590367", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590367", "securityControlId": 31293, "ccis": [], "uuid": "846a0e16-11cc-5862-9071-c2b5582bd104", "testId": "DCH-11_A01", "test": "a system media downgrading process is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-08_ODP[01]", "defaultText": null }, { "id": 70950, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590367", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590367", "securityControlId": 31293, "ccis": [], "uuid": "c7c730e6-e475-5843-8dba-5332d6cedfd8", "testId": "DCH-11_A02", "test": "system media requiring downgrading is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-08_ODP[02]", "defaultText": null }, { "id": 70951, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590367", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590367", "securityControlId": 31293, "ccis": [], "uuid": "1b39d145-7371-5bc5-a3c7-dd5b86f8aa9f", "testId": "DCH-11_A03", "test": "a system media downgrading process is established.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-08a.[01]", "defaultText": null }, { "id": 70952, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590368", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590368", "securityControlId": 31293, "ccis": [], "uuid": "d8c82bbf-d904-5592-b5fd-2383f98c9f16", "testId": "DCH-11_A04", "test": "the system media downgrading process includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-08a.[02]", "defaultText": null }, { "id": 70953, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590368", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590368", "securityControlId": 31293, "ccis": [], "uuid": "a6db77c2-9cf8-5787-8338-ec0ca90ec9e1", "testId": "DCH-11_A05", "test": "there is verification that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MP-08b.[01]", "defaultText": null }, { "id": 70954, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590368", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590368", "securityControlId": 31293, "ccis": [], "uuid": "6b0bdcf2-881b-5bfc-b6ab-136b71c64a09", "testId": "DCH-11_A06", "test": "there is verification that the system media downgrading process is commensurate with the access authorizations of the potential recipients of the downgraded information.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-08b.[02]", "defaultText": null }, { "id": 70955, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590368", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590368", "securityControlId": 31293, "ccis": [], "uuid": "6b1213f8-81b2-5363-ba1d-27eeb65a4f6c", "testId": "DCH-11_A07", "test": "system media requiring downgrading is identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-08c.", "defaultText": null }, { "id": 70956, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590368", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590368", "securityControlId": 31293, "ccis": [], "uuid": "6cd2383c-d2b7-5c46-9610-503df35eeb15", "testId": "DCH-11_A08", "test": "the identified system media is downgraded using the system media downgrading process.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-08d.", "defaultText": null }, { "id": 70957, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590368", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590368", "securityControlId": 31293, "ccis": [], "uuid": "904f40c1-465f-5423-ac46-99bd3121de26", "testId": "DCH-11_A09", "test": "system media containing sensitive and/or regulated information is identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-08(03)[01]", "defaultText": null }, { "id": 70958, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590368", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590368", "securityControlId": 31293, "ccis": [], "uuid": "5f2db67e-7a44-5d35-a41f-a8a18863a1cb", "testId": "DCH-11_A10", "test": "system media containing sensitive and/or regulated information is downgraded prior to public release.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_MP-08(03)[02]", "defaultText": null } ], "externalMappings": [ { "id": 568773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "252c6193-103b-5c1b-8561-ad9a591aef2b", "parentControlId": 31293, "controlId": "MP-8", "title": "MP-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584606" }, { "id": 568774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60616752-91ed-59c5-8a30-1ce10f48c0c1", "parentControlId": 31293, "controlId": "MP-08", "title": "MP-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584606" }, { "id": 568775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584607", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f403b272-5cd5-5455-b969-cff8577b4ef1", "parentControlId": 31293, "controlId": "MP-08(03)", "title": "MP-08(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584607" }, { "id": 568776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584607", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a2ae658-dd1f-5d1b-aabe-091709691ca7", "parentControlId": 31293, "controlId": "MP-08", "title": "MP-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584607" }, { "id": 568777, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584607", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08eda978-902a-5ae8-9846-b2c70823f18f", "parentControlId": 31293, "controlId": "MP-08(03)", "title": "MP-08(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584607" }, { "controlId": "C.1.4", "title": "C.1.4 — Media Storage", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MP-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "01916c7f-ced4-59aa-9eeb-f4cf79274d7a", "isPublic": true }, { "controlId": "NEI 08-09 App E.1.4", "title": "NEI 08-09 App E.1.4 — Media Storage", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.1.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "2e2ad01a-ba6e-500a-b72e-e998d3298a5d", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.1.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "f28d3ad2-bfd9-5d1d-bd1a-4a6064d1d825", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "74f59320-13a6-5fc4-ba0b-2c71a3606140", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "6a7bcd45-5e16-5197-a10b-f1dd28c2c502", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "367f637f-9143-5c22-9a58-10fc0fa777e1", "isPublic": true } ], "id": 31293, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73103", "catalogueId": 1062, "uuid": "1a262573-5d20-53d5-a104-a7b71fa835c1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization reclassify data, including associated Technology Assets, Applications and/or Services (TAAS), commensurate with the security category and/or classification level of the information?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Data Reclassification", "description": "

Control Description

Mechanisms exist to reclassify data, including associated Technology Assets, Applications and/or Services (TAAS), commensurate with the security category and/or classification level of the information.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to reclassify data, including associated Technology Assets, Applications and/or Services (TAAS), commensurate with the security category and/or classification level of the information.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.1.4", "controlId": "DCH-11", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-11", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program

Small Business (10-49 staff)

∙ Data classification program

Medium Business (50-249 staff)

∙ Data classification program

Large Business (250-999 staff)

∙ Data classification program\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70959, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590369", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590369", "securityControlId": 31294, "ccis": [], "uuid": "2b6ae092-7259-51ec-9c51-1408a5f0124e", "testId": "DCH-12_A01", "test": "removable media restrictions are in accordance with data handling and acceptable usage requirements.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 568785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58b73a15-7f46-5a10-9380-3f10f3e1a4a1", "parentControlId": 31294, "controlId": "COMP 1.2", "title": "COMP 1.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584608" }, { "id": 568786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38cd642c-33bf-55b3-ab42-28b6264fbf17", "parentControlId": 31294, "controlId": "COMP 2.1", "title": "COMP 2.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584608" }, { "id": 568788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69dce0f3-0d83-5553-bf5b-3800dfab03f9", "parentControlId": 31294, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584608" }, { "id": 568792, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d916923-2ba2-522c-bb86-178da131d4f2", "parentControlId": 31294, "controlId": "03.08.07.a", "title": "03.08.07.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584609" }, { "id": 568794, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6ca8a35-bb83-5838-b004-c3f77b3f81d3", "parentControlId": 31294, "controlId": "ARCHITECTURE-3g", "title": "ARCHITECTURE-3g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584609" }, { "controlId": "C.1.5", "title": "C.1.5 — Media Transport", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MP-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "40c775f9-d539-5286-bb37-203eed80194d", "isPublic": true }, { "controlId": "NEI 08-09 App E.1.5", "title": "NEI 08-09 App E.1.5 — Media Transport", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.1.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "7e318ea0-8c54-505e-9e7d-47dcbb84dc5f", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.1.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "08e94a4c-f99f-50fa-b58e-fb527a3acfbb", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "bdd53c3e-17db-5add-a634-7f3ddbd838ac", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "06845a00-4ef3-5d5b-a1e3-b332799e6567", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "1d6bc863-81ad-5c02-a6d0-8d36c3c53838", "isPublic": true } ], "id": 31294, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73103", "catalogueId": 1062, "uuid": "5209d050-b5ff-5813-89e4-98156ff5e6c5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict removable media in accordance with data handling and acceptable usage parameters?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Removable Media Security", "description": "

Control Description

Mechanisms exist to restrict removable media in accordance with data handling and acceptable usage parameters.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict removable media in accordance with data handling and acceptable usage parameters.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.1.5", "controlId": "DCH-12", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-12", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Data classification program\n∙ IT Asset Management (ITAM) program

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Data classification program\n∙ IT Asset Management (ITAM) program

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Data classification program\n∙ IT Asset Management (ITAM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Data classification program\n∙ IT Asset Management (ITAM) program\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Data classification program\n∙ IT Asset Management (ITAM) program\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70960, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590369", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590369", "securityControlId": 31295, "ccis": [], "uuid": "bf4d14b1-3bd0-5f09-9ef0-8ba5d9e6cb6a", "testId": "DCH-13_A01", "test": "connections to external systems are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.20[a]", "defaultText": null }, { "id": 70961, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590369", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590369", "securityControlId": 31295, "ccis": [], "uuid": "8395f4bb-3b86-50ef-84a6-419ba4d43c50", "testId": "DCH-13_A02", "test": "the use of external systems is identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.20[b]", "defaultText": null }, { "id": 70962, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590378", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590378", "securityControlId": 31295, "ccis": [], "uuid": "aa5f053f-be1e-5e39-9113-bec35d50fee9", "testId": "DCH-13_A03", "test": "connections to external systems are verified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.20[c]", "defaultText": null }, { "id": 70963, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590378", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590378", "securityControlId": 31295, "ccis": [], "uuid": "678553d1-0a79-5e20-b4ae-dced809a8fbf", "testId": "DCH-13_A04", "test": "the use of external systems is verified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.20[d]", "defaultText": null }, { "id": 70964, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590378", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590378", "securityControlId": 31295, "ccis": [], "uuid": "fefee993-7ccc-566d-ae7e-6f709974e8db", "testId": "DCH-13_A05", "test": "connections to external systems are controlled/limited.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.20[e]", "defaultText": null }, { "id": 70965, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590379", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590379", "securityControlId": 31295, "ccis": [], "uuid": "6ddcfa1a-16ff-5bde-991d-9671cc07eea1", "testId": "DCH-13_A06", "test": "the use of external systems is controlled/limited.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.20[f]", "defaultText": null }, { "id": 70966, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590379", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590379", "securityControlId": 31295, "ccis": [], "uuid": "5b9ce1df-e452-5fdb-8201-cf10a9650e20", "testId": "DCH-13_A07", "test": "terms and conditions consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-20_ODP[01]\n53A_R5_AC-20_ODP[02]", "defaultText": null }, { "id": 70967, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590379", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590379", "securityControlId": 31295, "ccis": [], "uuid": "c91fbcb4-9c30-520f-a11e-9302f724e48c", "testId": "DCH-13_A08", "test": "controls asserted to be implemented on external systems consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-20_ODP[03]", "defaultText": null }, { "id": 70968, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590379", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590379", "securityControlId": 31295, "ccis": [], "uuid": "aa27f63f-43b8-5ce0-8bd2-1ab159c4e90c", "testId": "DCH-13_A09", "test": "types of external systems prohibited from use are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-20_ODP[04]", "defaultText": null }, { "id": 70969, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59038", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59038", "securityControlId": 31295, "ccis": [], "uuid": "52d90437-a8c6-50d5-bc62-619b82810421", "testId": "DCH-13_A10", "test": "organization-defined criteria are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from external systems (if applicable).
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-20a.01", "defaultText": null }, { "id": 70970, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59038", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59038", "securityControlId": 31295, "ccis": [], "uuid": "a966bb1c-949d-5910-9b51-51a7bd0c5f44", "testId": "DCH-13_A11", "test": "organization-defined criteria consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store or transmit organization-controlled information using external systems (if applicable).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-20a.02", "defaultText": null }, { "id": 70971, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59038", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59038", "securityControlId": 31295, "ccis": [], "uuid": "023a1ee5-47be-5993-8ad4-7c4049110ed2", "testId": "DCH-13_A12", "test": "the use of organization-defined prohibited types of external systems is prohibited (if applicable).
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-20b.", "defaultText": null }, { "id": 70972, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59038", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59038", "securityControlId": 31295, "ccis": [], "uuid": "dc76d002-206a-5b93-9da0-22c4c825de06", "testId": "DCH-13_A13", "test": "security requirements to be satisfied on external systems prior to allowing the use of or access to those systems by authorized individuals are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.20.ODP[01]", "defaultText": null }, { "id": 70973, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59038", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59038", "securityControlId": 31295, "ccis": [], "uuid": "8680da86-adf9-50e6-bf39-47b8e1333f9f", "testId": "DCH-13_A14", "test": "the use of external systems is prohibited unless the systems are specifically authorized.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.20.a", "defaultText": null }, { "id": 70974, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590381", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590381", "securityControlId": 31295, "ccis": [], "uuid": "53287203-efe8-5e14-9973-dd478353bad0", "testId": "DCH-13_A15", "test": "the following security requirements to be satisfied on external systems prior to allowing the use of or access to those systems by authorized individuals are established: .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: Guidance: Organizations establish specific terms and conditions for the use of external systems in accordance with organizational security policies and procedures. At a minimum, terms and conditions address the specific types of applications that can be accessed on organizational systems from external systems and the highest security category of information that can be processed, stored, or transmitted on external systems. If the terms and conditions with the owners of the external systems cannot be established, organizations may impose restrictions on organizational personnel using those external systems. If applicable, use NIST SP 800-47 as a guide for establishing information exchanges between organizations.", "otherId": "171A_R3_A.03.01.20.b", "defaultText": null }, { "id": 70975, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590381", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590381", "securityControlId": 31295, "ccis": [], "uuid": "d6de7ca4-6fc3-5cfc-996c-9e227ae03c81", "testId": "DCH-13_A16", "test": "authorized individuals are permitted to use external systems to access the organizational system or to process, store, or transmit CUI only after verifying that the security requirements on the external systems as specified in the organization’s system security plans have been satisfied.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.01.20.c.01", "defaultText": null }, { "id": 70976, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590381", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590381", "securityControlId": 31295, "ccis": [], "uuid": "fa3d4919-bc7e-59ed-8920-aaa2cdd51801", "testId": "DCH-13_A17", "test": "authorized individuals are permitted to use external systems to access the organizational system or to process, store, or transmit CUI only after retaining approved system connection or processing agreements with the organizational entity hosting the external systems.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.01.20.c.02", "defaultText": null } ], "externalMappings": [ { "id": 568821, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e92c46c-8ed5-5c5c-99e6-e1b1669f8c3f", "parentControlId": 31295, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584612" }, { "id": 568822, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66a8f41d-a1fc-508f-af2d-d57389ca2742", "parentControlId": 31295, "controlId": "T1021", "title": "T1021", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584612" }, { "id": 568823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87dbc9aa-c07c-57e8-8ef6-c62d8d91169b", "parentControlId": 31295, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584612" }, { "id": 568824, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f88962af-8085-551a-a845-86af761bf0d5", "parentControlId": 31295, "controlId": "T1021.004", "title": "T1021.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584612" }, { "id": 568825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b6385e4-e804-518d-977d-dd8146e93552", "parentControlId": 31295, "controlId": "T1021.007", "title": "T1021.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584612" }, { "id": 568826, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d8013ea-07f5-5c5a-b21e-0d16941da6b2", "parentControlId": 31295, "controlId": "T1021.008", "title": "T1021.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584612" }, { "id": 568827, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebecf3c7-8c33-56f7-ac55-7bce89ff2172", "parentControlId": 31295, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584613" }, { "id": 568828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5386eca-ecd6-58c5-9eeb-fd09e08c2df2", "parentControlId": 31295, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584613" }, { "id": 568829, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5fb5014a-b9b1-5421-8592-253f7b498c57", "parentControlId": 31295, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584613" }, { "id": 568830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a06709b6-0a08-54eb-ba40-7c56cbd09c89", "parentControlId": 31295, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584613" }, { "id": 568831, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f19b8957-12da-5de1-9bd7-dcb6ee7b6fac", "parentControlId": 31295, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584613" }, { "id": 568832, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1364b027-d4d8-5bad-a37d-9c145facfb47", "parentControlId": 31295, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584613" }, { "id": 568833, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c435e81-7afe-5e2c-b373-a57236cf5bc4", "parentControlId": 31295, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584613" }, { "id": 568834, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8aa0e7b-f571-5fcc-bbb1-03937fbc6ed2", "parentControlId": 31295, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584613" }, { "id": 568835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3d07902-8469-5672-8689-fabaa3f609ff", "parentControlId": 31295, "controlId": "T1078.002", "title": "T1078.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584613" }, { "id": 568836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41f383df-67d7-575b-b2e8-000936f479bf", "parentControlId": 31295, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584614" }, { "id": 568837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4857500-7874-5c86-8064-aa3e909a68aa", "parentControlId": 31295, "controlId": "T1098.001", "title": "T1098.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584614" }, { "id": 568838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "599dd0c7-73cb-5877-9218-d47c750f52da", "parentControlId": 31295, "controlId": "T1098.002", "title": "T1098.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584614" }, { "id": 568839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11064e47-4525-5725-8136-7fae5fbe2885", "parentControlId": 31295, "controlId": "T1098.003", "title": "T1098.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584614" }, { "id": 568840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c72badc-974d-5a46-a8e5-dbd55214ae26", "parentControlId": 31295, "controlId": "T1098.004", "title": "T1098.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584614" }, { "id": 568841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc88eb88-c1e8-50d7-b72c-da59cd39c84b", "parentControlId": 31295, "controlId": "T1098.005", "title": "T1098.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584614" }, { "id": 568842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6163538-5cd7-5cb7-a003-fcb9085d01e0", "parentControlId": 31295, "controlId": "T1110", "title": "T1110", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584614" }, { "id": 568843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50f6f3a6-311a-53cb-b0cf-be44c3388dd7", "parentControlId": 31295, "controlId": "T1110.001", "title": "T1110.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584614" }, { "id": 568844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc5096e5-2e80-5040-b077-ac378dfb57d3", "parentControlId": 31295, "controlId": "T1110.002", "title": "T1110.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584615" }, { "id": 568845, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6abf469c-c526-5785-be04-ec2857840c03", "parentControlId": 31295, "controlId": "T1110.003", "title": "T1110.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584615" }, { "id": 568846, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95defdcc-d20a-58d9-8550-4d543384d8d1", "parentControlId": 31295, "controlId": "T1110.004", "title": "T1110.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584615" }, { "id": 568847, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b50e509-f1a4-5a38-80ba-2e98ccb73131", "parentControlId": 31295, "controlId": "T1111", "title": "T1111", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584615" }, { "id": 568848, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf593e93-10cc-552f-af09-c5315a8a1ed6", "parentControlId": 31295, "controlId": "T1114", "title": "T1114", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584615" }, { "id": 568849, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10bac13b-49e6-58bc-9036-db49840c0f0b", "parentControlId": 31295, "controlId": "T1114.001", "title": "T1114.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584615" }, { "id": 568850, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3596a171-e5a3-54f4-a394-6082c9770005", "parentControlId": 31295, "controlId": "T1114.002", "title": "T1114.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584615" }, { "id": 568851, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7629c8c0-01bc-525b-9f25-bbb7ee3b9a24", "parentControlId": 31295, "controlId": "T1114.003", "title": "T1114.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584615" }, { "id": 568852, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0e4385d-8e8d-5ddc-9555-a45944d2a068", "parentControlId": 31295, "controlId": "T1119", "title": "T1119", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584615" }, { "id": 568853, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d82985bf-739e-5dc2-9d72-13413f995f27", "parentControlId": 31295, "controlId": "T1133", "title": "T1133", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584615" }, { "id": 568854, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cdd0f51a-2947-523a-b5a9-7f6107bc988e", "parentControlId": 31295, "controlId": "T1134.005", "title": "T1134.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584616" }, { "id": 568855, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ea02a9a-2b81-52bc-b103-1dab7fa7c425", "parentControlId": 31295, "controlId": "T1136", "title": "T1136", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584616" }, { "id": 568856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "beef3190-4af9-5642-992e-f84867db411b", "parentControlId": 31295, "controlId": "T1136.001", "title": "T1136.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584616" }, { "id": 568857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5bda5a99-bd49-57ab-bf2a-325645003de1", "parentControlId": 31295, "controlId": "T1136.002", "title": "T1136.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584616" }, { "id": 568858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1d31d90-3086-5867-9bcb-4293269bad2f", "parentControlId": 31295, "controlId": "T1136.003", "title": "T1136.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584616" }, { "id": 568859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1c4d195-91a2-52f8-8622-c1003ad8e1fd", "parentControlId": 31295, "controlId": "T1200", "title": "T1200", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584616" }, { "id": 568860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec094ea7-da96-5b7b-911c-8f4330b375a7", "parentControlId": 31295, "controlId": "T1505.005", "title": "T1505.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584616" }, { "id": 568861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f06bcb87-5945-5545-98dd-f89ffcf5d8ec", "parentControlId": 31295, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584616" }, { "id": 568862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16aba6ef-46d2-50b2-93c4-7fc216c3598a", "parentControlId": 31295, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584616" }, { "id": 568863, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bb3a13d-5c67-54ec-8772-cd00a413a16a", "parentControlId": 31295, "controlId": "T1539", "title": "T1539", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584617" }, { "id": 568864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f29a9fd-0a6b-5e79-9dc2-fc63d9e617a6", "parentControlId": 31295, "controlId": "T1550.001", "title": "T1550.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584617" }, { "id": 568865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50cc72b3-1084-5e2a-b3ba-b486309201c0", "parentControlId": 31295, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584617" }, { "id": 568866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac709493-46e0-5504-aebd-fa7953698d65", "parentControlId": 31295, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584617" }, { "id": 568867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "130f9069-84b4-5e18-a006-23845d55b7d8", "parentControlId": 31295, "controlId": "T1552.005", "title": "T1552.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584617" }, { "id": 568868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bca23015-8182-5cf3-a421-8ee6f21cb8b5", "parentControlId": 31295, "controlId": "T1555", "title": "T1555", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584617" }, { "id": 568869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da99b523-cf4a-5475-9284-06ac1bc8ac3f", "parentControlId": 31295, "controlId": "T1556", "title": "T1556", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584617" }, { "id": 568870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f2e1474-c59d-5742-9f2a-cf89b397028c", "parentControlId": 31295, "controlId": "T1556.001", "title": "T1556.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584617" }, { "id": 568871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bb7aa8d-5915-56d6-9ef4-bc4ab2479193", "parentControlId": 31295, "controlId": "T1556.003", "title": "T1556.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584618" }, { "id": 568872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d9cca34-ec7e-5fc6-a528-b005d2ea9eb9", "parentControlId": 31295, "controlId": "T1556.004", "title": "T1556.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584618" }, { "id": 568873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59a6d153-6f01-527e-853f-dedc32bf9732", "parentControlId": 31295, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584618" }, { "id": 568874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27c612c4-7199-5984-8bde-9fc034bf9e8f", "parentControlId": 31295, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584618" }, { "id": 568875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a1207a2-ec36-5bab-a0bf-ac521d1f51a7", "parentControlId": 31295, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584618" }, { "id": 568876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5fac8027-d55a-51d0-a064-4178bb6d903d", "parentControlId": 31295, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584618" }, { "id": 568877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ca3f6a0-33e5-56e6-b7b0-457492d5806e", "parentControlId": 31295, "controlId": "T1565.002", "title": "T1565.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584618" }, { "id": 568878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af1a3027-a932-584e-adf7-5e8c82e6d781", "parentControlId": 31295, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584618" }, { "id": 568879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46cee79a-5a15-59de-894a-5f57d4c7a00a", "parentControlId": 31295, "controlId": "T1567.001", "title": "T1567.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584618" }, { "id": 568880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2059aa0-646e-5179-a51e-1c66a9fa676c", "parentControlId": 31295, "controlId": "T1567.002", "title": "T1567.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584618" }, { "id": 568881, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ca2aab6-2df9-59eb-8ab3-ebfadc19aa74", "parentControlId": 31295, "controlId": "T1578.005", "title": "T1578.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584619" }, { "id": 568882, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91788ca1-98d0-57ba-8bdd-5772bbfe0d71", "parentControlId": 31295, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584619" }, { "id": 568883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd2027ec-d09a-554c-a1d8-822d52cdfca3", "parentControlId": 31295, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584619" }, { "id": 568884, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7021027d-4516-5f1b-ab8a-180f5422bf35", "parentControlId": 31295, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584619" }, { "id": 568885, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7dc9d7ac-a4cb-5018-a8a3-69b0a5292381", "parentControlId": 31295, "controlId": "AC-20", "title": "AC-20", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584619" }, { "id": 568886, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ce1fa16-b259-5e74-b395-405da7f6ea6e", "parentControlId": 31295, "controlId": "AC-20", "title": "AC-20", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584619" }, { "id": 568887, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1abe8d3-30a9-5e6f-80d0-f10f87b9765a", "parentControlId": 31295, "controlId": "AC-20", "title": "AC-20", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584619" }, { "id": 568888, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f529f9f3-d990-5ee1-bec8-3b9773d795a4", "parentControlId": 31295, "controlId": "AC-20", "title": "AC-20", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584619" }, { "id": 568889, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef1fa2c7-9011-5240-b8a5-a1af8a47a657", "parentControlId": 31295, "controlId": "AC-20", "title": "AC-20", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584619" }, { "id": 568890, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a184e17-ca9c-50f7-9ebf-00c5aea2214d", "parentControlId": 31295, "controlId": "AC-20", "title": "AC-20", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58462" }, { "id": 568891, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f88a527-a581-5793-8da6-f09653780f00", "parentControlId": 31295, "controlId": "AC-20", "title": "AC-20", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58462" }, { "id": 568892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d42e8340-9aa7-5eb1-a181-9f1780fa19a2", "parentControlId": 31295, "controlId": "AC-20", "title": "AC-20", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58462" }, { "id": 568893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce058f4e-7ce2-51e6-8917-cadad8945219", "parentControlId": 31295, "controlId": "AC-20", "title": "AC-20", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58462" }, { "id": 568894, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10eafc2a-dff8-5ba1-8eed-e6107d361b4e", "parentControlId": 31295, "controlId": "AC-20", "title": "AC-20", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58462" }, { "id": 568898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c59449ee-d83c-5087-afbf-f01c1435658b", "parentControlId": 31295, "controlId": "3.1.20", "title": "3.1.20", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584621" }, { "id": 568899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0b7ed2e-3f3f-5494-98c5-9680c0f4cd86", "parentControlId": 31295, "controlId": "03.01.20.a", "title": "03.01.20.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584621" }, { "id": 568900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a7aadbf-4c21-51a1-a2c6-6f1888b46156", "parentControlId": 31295, "controlId": "03.01.20.b", "title": "03.01.20.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584621" }, { "id": 568901, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13afa21d-129a-5456-8d1c-02256e98842a", "parentControlId": 31295, "controlId": "03.01.20.c.01", "title": "03.01.20.c.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584621" }, { "id": 568902, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77394c74-e061-5c03-be1c-f0563e11160b", "parentControlId": 31295, "controlId": "03.01.20.c.02", "title": "03.01.20.c.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584621" }, { "id": 568903, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ef26402-4eb2-5150-89ed-a145b778ef89", "parentControlId": 31295, "controlId": "03.01.20.d", "title": "03.01.20.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584621" }, { "controlId": "B.1.19", "title": "B.1.19 — Access Control for Portable and Mobile Devices", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-19, MP-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ca593dda-ff97-5d72-a7b2-e071d79aa096", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.19", "title": "NEI 08-09 App D.1.19 — Access Control for Portable and Mobile Devices", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.19", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "abc3b8dc-2ad5-56f4-ac24-54e8a6776e11", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.19", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "d3761bb5-3e74-5376-b307-25d0ebabbf9b", "isPublic": true }, { "controlId": "B.1.21", "title": "B.1.21 — Third Party Products and Controls", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SA-9, AC-20", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "d18c6330-e04a-557c-bd08-c51611a3fe0c", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.21", "title": "NEI 08-09 App D.1.21 — Third Party Products and Controls", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.21", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "82983816-a268-552e-b20a-c4e55dc20276", "isPublic": true }, { "controlId": "B.1.22", "title": "B.1.22 — Use of External Systems", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-20", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ee98cb78-7bb0-5807-8f8e-f859f2b334ea", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.22", "title": "NEI 08-09 App D.1.22 — Use of External Systems", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.22", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "caed2631-dcb9-5bde-8a4d-362c04c768af", "isPublic": true }, { "controlId": "CIP-004-7-R6", "title": "CIP-004-7-R6 — Access Authorization for Transient Cyber Assets and Removable Media", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c2ca2a85-f510-5d4c-8718-88540399f8f2", "isPublic": true }, { "controlId": "CIP-004-7-6.1", "title": "CIP-004-7-6.1 — Prior to provisioning, authorize (unless already authorized according to Part 4.1.) based on need, as determined by t...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "aed7ba67-92b4-525b-b7ea-cd4cab101a13", "isPublic": true }, { "controlId": "CIP-004-7-6.1.1", "title": "CIP-004-7-6.1.1 — Provisioned electronic access to electronic BCSI", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2b514a72-1e3a-52ae-bd8b-cc0aaa5481ea", "isPublic": true }, { "controlId": "CIP-004-7-6.1.2", "title": "CIP-004-7-6.1.2 — Provisioned physical access to physical BCSI.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a168c174-f7e1-5af7-a24c-76f5c444c6db", "isPublic": true }, { "controlId": "CIP-004-7-6.2", "title": "CIP-004-7-6.2 — Verify at least once every 15 calendar months that all individuals with provisioned access to BCSI: 6.2.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "cc500214-581e-5616-8f5a-b70605793498", "isPublic": true }, { "controlId": "CIP-004-7-6.2.1", "title": "CIP-004-7-6.2.1 — have an authorization record", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f6ff9282-718f-536f-a5ce-0bd1ff887219", "isPublic": true }, { "controlId": "CIP-004-7-6.2.2", "title": "CIP-004-7-6.2.2 — still need the provisioned access to perform their current work functions, as determined by the Responsible Entity.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "59b5de55-dd3b-54c3-ad7a-2d1060e4ed1c", "isPublic": true }, { "controlId": "CIP-004-7-6.3", "title": "CIP-004-7-6.3 — For termination actions, remove the individual’s ability to use provisioned access to BCSI (unless already revoked ac...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "536c8786-f8c4-57f2-91ef-e58c2979d157", "isPublic": true }, { "controlId": "CIP-010-4-R4", "title": "CIP-010-4-R4 — Transient Cyber Asset and Removable Media Security", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "717acce6-7088-5105-957e-a5aa100d07b6", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "38b035d4-1484-5ab5-beeb-b45cb23175ba", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "71dc8457-e1f3-5d37-9367-9bc4eeb3ceb6", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "d7df4931-b9b6-5dd6-b7e3-1e8d5e6b8dbf", "isPublic": true } ], "id": 31295, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731031", "catalogueId": 1062, "uuid": "53adfec0-0312-5559-9c18-b0bb8a2f6c8b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization govern how external parties, including Technology Assets, Applications and/or Services (TAAS), are used to securely store, process and transmit data?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Use of External Technology Assets, Applications and/or Services (TAAS)", "description": "

Control Description

Mechanisms exist to govern how external parties, including Technology Assets, Applications and/or Services (TAAS), are used to securely store, process and transmit data.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to document where sensitive/regulated data is stored, transmitted and/or processed.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to govern how external parties, including Technology Assets, Applications and/or Services (TAAS), are used to securely store, process and transmit data.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.19, B.1.21, B.1.22
NERC-CIP (2026) Requirements: CIP-004-7-R6, CIP-010-4-R4", "controlId": "DCH-13", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-13", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70977, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590382", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590382", "securityControlId": 31296, "ccis": [], "uuid": "ed2ac1ba-e46e-5acd-a7a8-34d9cf5ad195", "testId": "DCH-13.1_A01", "test": "authorized individuals are permitted to use an external system to access the system or to process, store or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization's cybersecurity / data privacy policies and cybersecurity / data privacy plans (if applicable).
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "53A_R5_AC-20(01)(a)", "defaultText": null }, { "id": 70978, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590382", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590382", "securityControlId": 31296, "ccis": [], "uuid": "ad84fda4-e784-5f9f-842a-760a3cf8749f", "testId": "DCH-13.1_A02", "test": "authorized individuals are permitted to use an external system to access the system or to process, store or transmit organization-controlled information only after retention of approved system connection or processing agreements with the organizational entity hosting the external system (if applicable).
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_AC-20(01)(b)", "defaultText": null } ], "externalMappings": [ { "id": 568956, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584635", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72b9a6bb-13b5-52b7-b09f-6018e41dc7ee", "parentControlId": 31296, "controlId": "AC-20(1)", "title": "AC-20(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584635" }, { "id": 568957, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cc751f7-cfc0-5a23-b329-699c93920aaf", "parentControlId": 31296, "controlId": "AC-20(01)", "title": "AC-20(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584636" }, { "id": 568958, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a9c7f04-9bdd-517b-80c6-a00810dd0964", "parentControlId": 31296, "controlId": "AC-20(01)", "title": "AC-20(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584636" }, { "id": 568959, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1391fa90-768c-57c6-8bc2-1de6471b3957", "parentControlId": 31296, "controlId": "AC-20(01)", "title": "AC-20(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584636" }, { "id": 568960, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a238548-ca59-5a34-9577-c3a207975324", "parentControlId": 31296, "controlId": "AC-20(01)", "title": "AC-20(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584636" }, { "id": 568961, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58731119-26ed-580c-ba1a-50685801926f", "parentControlId": 31296, "controlId": "AC-20(01)", "title": "AC-20(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584636" }, { "id": 568962, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec535e61-ec8c-5e78-bdab-035e69fdf678", "parentControlId": 31296, "controlId": "AC-20(1)", "title": "AC-20(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584636" }, { "id": 568965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2b3927a-e305-5fdf-b768-afd11db49e2d", "parentControlId": 31296, "controlId": "3.1.20", "title": "3.1.20", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584636" }, { "id": 568966, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584637", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1544251-f460-5677-9d03-cc17b6d6d5be", "parentControlId": 31296, "controlId": "03.01.20.a", "title": "03.01.20.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584637" }, { "id": 568967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584637", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f694ab21-0463-542c-bbd0-e948a73c2878", "parentControlId": 31296, "controlId": "03.01.20.b", "title": "03.01.20.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584637" }, { "id": 568968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584637", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a5e0ed2-42d6-54ec-acbc-b793b89705fe", "parentControlId": 31296, "controlId": "03.01.20.c.01", "title": "03.01.20.c.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584637" }, { "id": 568969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584637", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0916c6bd-f466-5495-886f-75f834b117ca", "parentControlId": 31296, "controlId": "03.01.20.c.02", "title": "03.01.20.c.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584637" }, { "id": 568970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584637", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c2b46af-bf93-5532-a137-517de2d4d408", "parentControlId": 31296, "controlId": "03.01.20.d", "title": "03.01.20.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584637" } ], "id": 31296, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731031", "catalogueId": 1062, "uuid": "67965cdc-0669-5083-b6a6-78997069903c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prohibit external parties, including Technology Assets, Applications and/or Services (TAAS), from storing, processing and transmitting data unless authorized individuals first: \n(1) Verifying the implementation of required security, compliance and/or resilience controls; or\n(2) Retaining a processing agreement with the entity hosting the external TAAS?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Limits of Authorized Use", "description": "

Control Description

Mechanisms exist to prohibit external parties, including Technology Assets, Applications and/or Services (TAAS), from storing, processing and transmitting data unless authorized individuals first: \n(1) Verifying the implementation of required security, compliance and/or resilience controls; or\n(2) Retaining a processing agreement with the entity hosting the external TAAS.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prohibit external parties, including Technology Assets, Applications and/or Services (TAAS), from storing, processing and transmitting data unless authorized individuals first: \n(1) Verifying the implementation of required security, compliance and/or resilience controls; or\n(2) Retaining a processing agreement with the entity hosting the external TAAS.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-13.1", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-13.1", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70979, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590382", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590382", "securityControlId": 31297, "ccis": [], "uuid": "dbb21af1-191f-51e0-a88c-b975984b52b4", "testId": "DCH-13.2_A01", "test": "the use of portable storage devices containing sensitive / regulated data on external systems is identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.21[a]", "defaultText": null }, { "id": 70980, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590382", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590382", "securityControlId": 31297, "ccis": [], "uuid": "8acde05b-f859-549a-8d8e-aa6270f579d6", "testId": "DCH-13.2_A02", "test": "limits on the use of portable storage devices containing sensitive / regulated data on external systems are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.21[b]", "defaultText": null }, { "id": 70981, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590383", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590383", "securityControlId": 31297, "ccis": [], "uuid": "88ec0eb7-bcdf-512a-8b3a-903f0550796f", "testId": "DCH-13.2_A03", "test": "the use of portable storage devices containing sensitive / regulated data on external systems is limited as defined.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.21[c]", "defaultText": null }, { "id": 70982, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590383", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590383", "securityControlId": 31297, "ccis": [], "uuid": "9333157e-1427-52b9-a12d-a4473472cb9e", "testId": "DCH-13.2_A04", "test": "restrictions on the use of organization-controlled portable storage devices by authorized individuals on external systems are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-20(02)_ODP", "defaultText": null }, { "id": 70983, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590383", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590383", "securityControlId": 31297, "ccis": [], "uuid": "3d7db21c-7cd5-577f-a10b-c2deff0ca716", "testId": "DCH-13.2_A05", "test": "the use of organization-controlled portable storage devices by authorized individuals on external systems is restricted.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-20(02)\n171A_R3_A.03.01.20.d", "defaultText": null } ], "externalMappings": [ { "id": 568999, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b10aa427-8aac-54ea-b72d-65f5fbfe4a6e", "parentControlId": 31297, "controlId": "COMP 1.2", "title": "COMP 1.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58464" }, { "id": 569000, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07d0f37a-fc84-594e-9dda-7735747a1298", "parentControlId": 31297, "controlId": "AC-20(2)", "title": "AC-20(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58464" }, { "id": 569001, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584641", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "512876c5-cde7-5b9d-aeb5-f58efba3627b", "parentControlId": 31297, "controlId": "AC-20(5)", "title": "AC-20(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584641" }, { "id": 569002, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584641", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be2bdeb9-2289-56a7-9ffb-9d5ad0b6877d", "parentControlId": 31297, "controlId": "AC-20(02)", "title": "AC-20(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584641" }, { "id": 569003, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584641", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09e58157-7dfb-570c-a835-b568de8cf289", "parentControlId": 31297, "controlId": "AC-20(05)", "title": "AC-20(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584641" }, { "id": 569004, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584641", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57f8f339-d264-59e0-a2ce-cee19d11dfd7", "parentControlId": 31297, "controlId": "AC-20(02)", "title": "AC-20(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584641" }, { "id": 569006, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584641", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef175b3a-bcb7-544a-b7ac-58a2629bdd9a", "parentControlId": 31297, "controlId": "AC-20(02)", "title": "AC-20(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584641" }, { "id": 569007, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584641", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1185ad8d-2500-51e7-a05f-8dda3f1b86d5", "parentControlId": 31297, "controlId": "AC-20(05)", "title": "AC-20(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584641" }, { "id": 569008, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584641", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c9ee3f7-16b9-5491-bb6b-f0ec7ac0b394", "parentControlId": 31297, "controlId": "AC-20(02)", "title": "AC-20(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584641" }, { "id": 569009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584641", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05a91533-9a61-54df-ab6c-a34f74f8db81", "parentControlId": 31297, "controlId": "AC-20(02)", "title": "AC-20(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584641" }, { "id": 569010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584641", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c7d0fe6-7057-5415-bbea-9e5296320559", "parentControlId": 31297, "controlId": "3.1.21", "title": "3.1.21", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584641" }, { "id": 569011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584642", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f0ed1e0-ce7e-5cb3-b248-03ab3f5585ca", "parentControlId": 31297, "controlId": "03.01.20.a", "title": "03.01.20.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584642" }, { "id": 569012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584642", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fafd72d-0d6d-51ab-80e7-987493de9779", "parentControlId": 31297, "controlId": "03.01.20.d", "title": "03.01.20.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584642" } ], "id": 31297, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731031", "catalogueId": 1062, "uuid": "8d488e58-2b8e-5fa7-85d9-1ad8c3f781c8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict or prohibit the use of portable storage devices by users on external systems?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Portable Storage Devices", "description": "

Control Description

Mechanisms exist to restrict or prohibit the use of portable storage devices by users on external systems.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict or prohibit the use of portable storage devices by users on external systems.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-13.2", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-13.2", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70984, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590383", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590383", "securityControlId": 31298, "ccis": [], "uuid": "de9d7d3c-03ae-50db-9764-433f4461cb17", "testId": "DCH-13.3_A01", "test": "the frequency at which to review / update the procedures is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-17_ODP[02]", "defaultText": null }, { "id": 70985, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590383", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590383", "securityControlId": 31298, "ccis": [], "uuid": "5370179e-d9fe-5e6e-ac03-9cf8b0ddc3e9", "testId": "DCH-13.3_A02", "test": "organizational controls ensure that requirements for the protection of sensitive and/or regulated information that is processed, stored or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations and standards.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-17a.[01]", "defaultText": null }, { "id": 70986, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590384", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590384", "securityControlId": 31298, "ccis": [], "uuid": "777e6247-301e-51ac-bc4c-659d231b63a2", "testId": "DCH-13.3_A03", "test": "procedures are established to ensure that requirements for the protection of sensitive and/or regulated information that is processed, stored or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations and standards.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-17a.[02]", "defaultText": null }, { "id": 70987, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590386", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590386", "securityControlId": 31298, "ccis": [], "uuid": "2a124ca7-fd1a-5d21-bdb0-3fd7520151e4", "testId": "DCH-13.3_A04", "test": "procedures are reviewed / updated frequently
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-17b.[02]", "defaultText": null } ], "externalMappings": [ { "id": 569040, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584645", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d820aa06-2322-5d62-b51a-122c41a9d15c", "parentControlId": 31298, "controlId": "PM-17", "title": "PM-17", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584645" }, { "id": 569042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584645", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c55cfa0a-c6dd-5124-b0e7-5865f2777081", "parentControlId": 31298, "controlId": "PM-17", "title": "PM-17", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584645" }, { "id": 569043, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584646", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8e2a923-af00-5e87-8a6d-5d0cefb7c45d", "parentControlId": 31298, "controlId": "PM-17", "title": "PM-17", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584646" }, { "id": 569044, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584646", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b94f7566-2d2b-5daa-9eef-5b1c9ce40d5b", "parentControlId": 31298, "controlId": "PM-17", "title": "PM-17", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584646" }, { "id": 569045, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584646", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46dd8ace-3f8e-5275-84bc-dee7d8cd5a7a", "parentControlId": 31298, "controlId": "PM-17", "title": "PM-17", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584646" }, { "id": 569046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584646", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34f6b9f9-ee46-5a80-bfa7-c88a62927ba1", "parentControlId": 31298, "controlId": "PM-17", "title": "PM-17", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584646" }, { "id": 569048, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584646", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d72573f3-b432-5eb8-a8e8-98b25f79b472", "parentControlId": 31298, "controlId": "03.01.20.b", "title": "03.01.20.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584646" }, { "id": 569049, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584646", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11367dff-1671-5e48-8297-ed4fd10afb54", "parentControlId": 31298, "controlId": "03.01.20.c.01", "title": "03.01.20.c.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584646" } ], "id": 31298, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731032", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731032", "catalogueId": 1062, "uuid": "68e3dd2e-a1d3-5e59-9bb8-f0ccaded750f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure that the requirements for the protection of sensitive/regulated data processed, stored or transmitted on external Technology Assets, Applications and/or Services (TAAS), are implemented in accordance with applicable statutory, regulatory and contractual obligations?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 10.0, "title": "Protecting Sensitive / Regulated Data on External Technology Assets, Applications and/or Services (TAAS)", "description": "

Control Description

Mechanisms exist to ensure that the requirements for the protection of sensitive/regulated data processed, stored or transmitted on external Technology Assets, Applications and/or Services (TAAS), are implemented in accordance with applicable statutory, regulatory and contractual obligations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Data Classification & Handling (DCH) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with DCH domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Data protection controls are primarily administrative in nature (e.g., policies & standards) to classify, protect and dispose of systems and data, including storage media.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure that the requirements for the protection of sensitive/regulated data processed, stored or transmitted on external Technology Assets, Applications and/or Services (TAAS), are implemented in accordance with applicable statutory, regulatory and contractual obligations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-13.3", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-13.3", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70988, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590386", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590386", "securityControlId": 31299, "ccis": [], "uuid": "1fedef2a-7165-5960-a760-e76cd6f60364", "testId": "DCH-13.4_A01", "test": "restrictions on the use of non-organizationally owned systems or system components to process, store or transmit organizational information are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-20(03)_ODP", "defaultText": null }, { "id": 70989, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590387", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590387", "securityControlId": 31299, "ccis": [], "uuid": "8b89b13c-bac8-52c1-8d4f-845631d760ba", "testId": "DCH-13.4_A02", "test": "the use of non-organizationally owned systems or system components to process, store or transmit organizational information is restricted using organization-defined restrictions.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-20(03)", "defaultText": null }, { "id": 70990, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590387", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590387", "securityControlId": 31299, "ccis": [], "uuid": "27bae28d-792d-58f2-9c91-c14a8f9fd698", "testId": "DCH-13.4_A03", "test": "information resources that are owned, provisioned or issued by the organization are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.1.2e[a]", "defaultText": null }, { "id": 70991, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590387", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590387", "securityControlId": 31299, "ccis": [], "uuid": "6458e566-53c1-5a7b-a791-24fdf8a73a31", "testId": "DCH-13.4_A04", "test": "access to systems and system components is restricted to only those information resources that are owned, provisioned or issued by the organization.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.1.2e[b]", "defaultText": null } ], "externalMappings": [ { "id": 569055, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584647", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02b5c467-6d36-58de-961a-80aca6852926", "parentControlId": 31299, "controlId": "AC-20(3)", "title": "AC-20(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584647" }, { "id": 569056, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584647", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc8eb2e7-12e0-51f1-a2f7-27f09fe70288", "parentControlId": 31299, "controlId": "AC-20(03)", "title": "AC-20(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584647" }, { "id": 569057, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584647", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7904f2fd-2f7a-560c-a5a4-58879e1329d5", "parentControlId": 31299, "controlId": "AC-20(03)", "title": "AC-20(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584647" }, { "id": 569058, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584647", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7278c45-6e01-5486-85f2-ae8cb18090d8", "parentControlId": 31299, "controlId": "AC-20(3)", "title": "AC-20(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584647" }, { "id": 569061, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584648", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6274560-307c-5f67-8d88-a3a6b4f2f29a", "parentControlId": 31299, "controlId": "03.01.20.a", "title": "03.01.20.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584648" }, { "id": 569062, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584648", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b37fdba1-f0c8-55e4-ab2d-10da4d607bdf", "parentControlId": 31299, "controlId": "03.01.20.c.01", "title": "03.01.20.c.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584648" }, { "id": 569063, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584648", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd791ffd-9ed4-5391-a71b-90796c6c14b1", "parentControlId": 31299, "controlId": "03.01.20.d", "title": "03.01.20.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584648" } ], "id": 31299, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731032", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731032", "catalogueId": 1062, "uuid": "a13b6069-d9ae-55e6-b6d2-0bbbba323ead", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict the use of non-organizationally owned Technology Assets, Applications and/or Services (TAAS) to process, store or transmit organizational information?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Non-Organizationally Owned Technology Assets, Applications and/or Services (TAAS)", "description": "

Control Description

Mechanisms exist to restrict the use of non-organizationally owned Technology Assets, Applications and/or Services (TAAS) to process, store or transmit organizational information.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict the use of non-organizationally owned Technology Assets, Applications and/or Services (TAAS) to process, store or transmit organizational information.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-13.4", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-13.4", "references": "

Micro-Small Business (<10 staff)

∙ Rules of Behavior (RoB) / Acceptable Use

Small Business (10-49 staff)

∙ Rules of Behavior (RoB) / Acceptable Use

Medium Business (50-249 staff)

∙ Rules of Behavior (RoB) / Acceptable Use\n∙ Network Access Control (NAC)

Large Business (250-999 staff)

∙ Rules of Behavior (RoB) / Acceptable Use\n∙ Network Access Control (NAC)

Enterprise (>1,000 staff)

∙ Rules of Behavior (RoB) / Acceptable Use\n∙ Network Access Control (NAC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70992, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590387", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590387", "securityControlId": 31300, "ccis": [], "uuid": "d19b7ac5-3e9d-5309-819d-3acc4ffe6b67", "testId": "DCH-14_A01", "test": "information-sharing circumstances where user discretion is required to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-21_ODP[01]", "defaultText": null }, { "id": 70993, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590387", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590388", "securityControlId": 31300, "ccis": [], "uuid": "b2b10a69-c73f-55e9-8780-9152b0e8d7f4", "testId": "DCH-14_A02", "test": "authorized users are enabled to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for organization-defined information-sharing circumstances.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-21a.", "defaultText": null }, { "id": 70994, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590388", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590388", "securityControlId": 31300, "ccis": [], "uuid": "e94a83ea-2760-56f3-a42c-26b4b481ecc0", "testId": "DCH-14_A03", "test": "automated mechanisms or manual processes that assist users in making information-sharing and collaboration decisions are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-21_ODP[02]\n53A_R5_AC-21b.", "defaultText": null } ], "externalMappings": [ { "id": 569079, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58465", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "494a776e-f67b-59ee-83df-2069e7f7d51f", "parentControlId": 31300, "controlId": "5.14", "title": "5.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58465" }, { "id": 569083, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58465", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "100bac81-ec65-5f94-91d6-e67f43f7f3a4", "parentControlId": 31300, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58465" }, { "id": 569084, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58465", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "216f7a02-2789-5b53-b8c2-781dd373dbf1", "parentControlId": 31300, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58465" }, { "id": 569085, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584651", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebedbba5-f604-5e1b-8f7b-f275c582a215", "parentControlId": 31300, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584651" }, { "id": 569086, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584651", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00c6101d-c01d-53dc-b2fe-bac58757e252", "parentControlId": 31300, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584651" }, { "id": 569087, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584651", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57fa3ea1-5db7-52ee-aff8-a121640802c9", "parentControlId": 31300, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584651" }, { "id": 569088, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584651", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b448c5f-7ee5-5d73-aa66-fb2007b09443", "parentControlId": 31300, "controlId": "AC-21", "title": "AC-21", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584651" }, { "id": 569089, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584651", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4f9ff59-7f50-58ae-bd99-47c0971c671b", "parentControlId": 31300, "controlId": "AC-21", "title": "AC-21", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584651" }, { "id": 569091, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584651", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8628932-8c08-5742-8878-dab8a41ab9dc", "parentControlId": 31300, "controlId": "AC-21", "title": "AC-21", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584651" }, { "id": 569092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584651", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d40417d9-5f3a-53b8-b0c1-1902b5bf0d76", "parentControlId": 31300, "controlId": "AC-21", "title": "AC-21", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584651" }, { "id": 569093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584652", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27b9abbc-e667-56f2-9be4-16cfb375194d", "parentControlId": 31300, "controlId": "AC-21", "title": "AC-21", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584652" }, { "id": 569096, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584652", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0a0cd5a-5ef7-551c-891a-d2ab1af8b413", "parentControlId": 31300, "controlId": "03.01.20.b", "title": "03.01.20.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584652" }, { "controlId": "C.1.6", "title": "C.1.6 — Media Sanitation and Disposal", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MP-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "73a9e5de-c042-5e5b-adf2-fa40dbb96784", "isPublic": true }, { "controlId": "NEI 08-09 App E.1.6", "title": "NEI 08-09 App E.1.6 — Media Sanitation and Disposal", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.1.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "62ab4ebf-0565-51f6-9ee1-9c95d3aefe85", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.1.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "39c05fa2-a36c-55ce-8e1e-e347d83b53df", "isPublic": true }, { "controlId": "CIP-011-3-R2", "title": "CIP-011-3-R2 — BES Cyber Asset Reuse and Disposal", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e9556b46-30e7-5075-8e6c-258d4db3910f", "isPublic": true }, { "controlId": "CIP-011-3-2.1", "title": "CIP-011-3-2.1 — Prior to the release for reuse of applicable Cyber Assets that contain BCSI (except for reuse within other systems id...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-011-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "54804a1c-493a-507d-99c5-84f23c6e2a64", "isPublic": true }, { "controlId": "CIP-011-3-2.2", "title": "CIP-011-3-2.2 — Prior to the disposal of applicable Cyber Assets that contain BCSI, the Responsible Entity shall take action to preve...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-011-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3d095608-fef1-5b42-afe1-3f5274670e8f", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7906831d-88ad-5d87-91bc-a98a9d5676cc", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "dfc61887-30ea-5730-8912-7873d443a8aa", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "abb40273-42b7-5e17-924f-874dbfcfb17d", "isPublic": true } ], "id": 31300, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731032", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731032", "catalogueId": 1062, "uuid": "30dffbc4-d539-5cf5-af04-c261d03d6521", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize a process to assist users in making information sharing decisions to ensure data is appropriately protected?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Information Sharing", "description": "

Control Description

Mechanisms exist to utilize a process to assist users in making information sharing decisions to ensure data is appropriately protected.

Evidence Request List (ERL)

E-DCH-09\nE-SAT-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize a process to assist users in making information sharing decisions to ensure data is appropriately protected.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.1.6
NERC-CIP (2026) Requirements: CIP-011-3-R2", "controlId": "DCH-14", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-14", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program

Small Business (10-49 staff)

∙ Data classification program

Medium Business (50-249 staff)

∙ Data classification program

Large Business (250-999 staff)

∙ Data classification program\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70995, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590388", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590388", "securityControlId": 31301, "ccis": [], "uuid": "8b304041-9384-56d9-8271-5b4576d02c80", "testId": "DCH-14.1_A01", "test": "information-sharing restrictions to be enforced by information search and retrieval services are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-21(02)_ODP", "defaultText": null }, { "id": 70996, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590388", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590388", "securityControlId": 31301, "ccis": [], "uuid": "48b12024-cb17-5bd8-b550-cf5d1934de5b", "testId": "DCH-14.1_A02", "test": "information search and retrieval services that enforce organization-defined information-sharing restrictions are implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-21(02)", "defaultText": null } ], "externalMappings": [ { "id": 569155, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584659", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c237f7d4-cec3-5fb4-a618-1f3a2d97400c", "parentControlId": 31301, "controlId": "AC-21(2)", "title": "AC-21(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584659" }, { "id": 569156, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584659", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1014430b-e0f9-5b1b-8685-476935bd1d81", "parentControlId": 31301, "controlId": "AC-21(02)", "title": "AC-21(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584659" }, { "id": 569157, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584659", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d760847c-6e3b-5bcb-8bd8-7d12f35e28ec", "parentControlId": 31301, "controlId": "AC-21(02)", "title": "AC-21(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584659" }, { "controlId": "C.1.6", "title": "C.1.6 — Media Sanitation and Disposal", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MP-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a21242b1-bb91-5469-93b3-1bcbd8670706", "isPublic": true }, { "controlId": "NEI 08-09 App E.1.6", "title": "NEI 08-09 App E.1.6 — Media Sanitation and Disposal", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.1.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "17e3a033-730b-54ef-b42c-17f579b8ef27", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.1.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "1c459176-a9c2-54e0-bf43-2fcde14909a8", "isPublic": true }, { "controlId": "CIP-011-3-R2", "title": "CIP-011-3-R2 — BES Cyber Asset Reuse and Disposal", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1afbd50d-1e3a-5bd6-9949-62f164cd4bf1", "isPublic": true }, { "controlId": "CIP-011-3-2.1", "title": "CIP-011-3-2.1 — Prior to the release for reuse of applicable Cyber Assets that contain BCSI (except for reuse within other systems id...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-011-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "11b15d8a-b844-575e-b346-fb5cf1c62ffc", "isPublic": true }, { "controlId": "CIP-011-3-2.2", "title": "CIP-011-3-2.2 — Prior to the disposal of applicable Cyber Assets that contain BCSI, the Responsible Entity shall take action to preve...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-011-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "316471f6-c741-5c73-927f-9d7c8d03a509", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "06ce1dee-4de5-5e8b-a2ea-fe3ec83e518b", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "9fd17e95-2418-52e6-a0a9-59a1f5b2ee04", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "499d9f14-61e7-5db8-b0f4-d6fc549f6d08", "isPublic": true } ], "id": 31301, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731033", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731033", "catalogueId": 1062, "uuid": "43413556-27ed-5983-8c1f-937ded3f2b03", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure Technology Assets, Applications and/or Services (TAAS) implement data search and retrieval functions that properly enforce data protection / sharing restrictions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Information Search & Retrieval", "description": "

Control Description

Mechanisms exist to ensure Technology Assets, Applications and/or Services (TAAS) implement data search and retrieval functions that properly enforce data protection / sharing restrictions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure Technology Assets, Applications and/or Services (TAAS) implement data search and retrieval functions that properly enforce data protection / sharing restrictions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.1.6
NERC-CIP (2026) Requirements: CIP-011-3-R2", "controlId": "DCH-14.1", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-14.1", "references": "

Micro-Small Business (<10 staff)

∙ Data Loss Prevention (DLP)

Small Business (10-49 staff)

∙ Data Loss Prevention (DLP)

Medium Business (50-249 staff)

∙ Data Loss Prevention (DLP)

Large Business (250-999 staff)

∙ Data Loss Prevention (DLP)

Enterprise (>1,000 staff)

∙ Data Loss Prevention (DLP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70997, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590389", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590389", "securityControlId": 31302, "ccis": [], "uuid": "248eb876-9c7b-54b7-b589-cfb61b52c9da", "testId": "DCH-14.2_A01", "test": "individuals or systems transferring data between interconnecting systems have the requisite authorizations (e.g., write permissions or privileges) prior to accepting such data.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CA-03(06)", "defaultText": null } ], "externalMappings": [ { "id": 569163, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58466", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a84ded07-35e2-5e8d-9ab8-3d05a71ca868", "parentControlId": 31302, "controlId": "CA-03(06)", "title": "CA-03(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58466" }, { "id": 569164, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58466", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be0345e8-e9a8-541a-bde1-db2fd53bdbfd", "parentControlId": 31302, "controlId": "CA-03(06)", "title": "CA-03(06)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58466" }, { "id": 569165, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58466", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "512f5c8f-cfd2-54dc-8657-a0cf08fa9741", "parentControlId": 31302, "controlId": "CA-03(06)", "title": "CA-03(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58466" }, { "id": 569166, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58466", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "761e0b37-e471-541b-9c1e-1fd675a4034b", "parentControlId": 31302, "controlId": "CA-03(06)", "title": "CA-03(06)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58466" }, { "id": 569167, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58466", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b6b3ffa-a455-596d-ab32-344c2611835c", "parentControlId": 31302, "controlId": "03.01.20.b", "title": "03.01.20.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58466" }, { "id": 569168, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58466", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "199195fc-c822-575c-be08-2e0f342811a5", "parentControlId": 31302, "controlId": "03.01.20.c.02", "title": "03.01.20.c.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58466" }, { "id": 569169, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58466", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9be04520-aba9-5ee1-81e1-0f07718386d4", "parentControlId": 31302, "controlId": "03.12.05.a", "title": "03.12.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58466" } ], "id": 31302, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731033", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731033", "catalogueId": 1062, "uuid": "69a572bc-eda1-5589-8f49-8cd58df09e74", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization verify that individuals or Technology Assets, Applications and/or Services (TAAS) transferring data between interconnecting TAAS have the requisite authorizations (e.g., write permissions or privileges) prior to transferring said data?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Transfer Authorizations", "description": "

Control Description

Mechanisms exist to verify that individuals or Technology Assets, Applications and/or Services (TAAS) transferring data between interconnecting TAAS have the requisite authorizations (e.g., write permissions or privileges) prior to transferring said data.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to verify that individuals or Technology Assets, Applications and/or Services (TAAS) transferring data between interconnecting TAAS have the requisite authorizations (e.g., write permissions or privileges) prior to transferring said data.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-14.2", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-14.2", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70998, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590389", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590389", "securityControlId": 31303, "ccis": [], "uuid": "51c88199-8a8b-5402-b232-0ce019c40466", "testId": "DCH-14.3_A01", "test": "a data-specific Access Control List (ACL) or Data Information Sharing Agreement (DISA) is documented to determine the personnel with whom sensitive / regulated data is shared.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 569195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584663", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97531228-ba1b-5b2f-affb-9296bbc07727", "parentControlId": 31303, "controlId": "03.01.03", "title": "03.01.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584663" }, { "id": 569196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584663", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16b2db26-d92a-5dc1-ad6a-2e3abfcae2a8", "parentControlId": 31303, "controlId": "03.01.20.c.02", "title": "03.01.20.c.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584663" }, { "id": 569197, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584663", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70a9a4c9-69cd-558b-bab0-8bd8f1f0ff32", "parentControlId": 31303, "controlId": "03.12.05.a", "title": "03.12.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584664" }, { "id": 569199, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584664", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a92c5b0c-0d22-534f-a0e4-67d166d84d7e", "parentControlId": 31303, "controlId": "B3.a", "title": "B3.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584664" } ], "id": 31303, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731033", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731033", "catalogueId": 1062, "uuid": "a31915a7-979a-5bf8-9199-3b018680022a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization leverage data-specific Access Control Lists (ACL) or Interconnection Security Agreements (ISAs) to generate a logical map of the parties with whom sensitive/regulated data is shared?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Data Access Mapping", "description": "

Control Description

Mechanisms exist to leverage data-specific Access Control Lists (ACL) or Interconnection Security Agreements (ISAs) to generate a logical map of the parties with whom sensitive/regulated data is shared.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Data Classification & Handling (DCH) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with DCH domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited media handling guidance exists for users.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to document where sensitive/regulated data is stored, transmitted and/or processed.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to leverage data-specific Access Control Lists (ACL) or Interconnection Security Agreements (ISAs) to generate a logical map of the parties with whom sensitive/regulated data is shared.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-14.3", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-14.3", "references": "

Micro-Small Business (<10 staff)

∙ Access Control Lists (ACL)\n∙ Interconnection Security Agreements (ISAs)

Small Business (10-49 staff)

∙ Access Control Lists (ACL)\n∙ Interconnection Security Agreements (ISAs)

Medium Business (50-249 staff)

∙ Access Control Lists (ACL)\n∙ Interconnection Security Agreements (ISAs)

Large Business (250-999 staff)

∙ Access Control Lists (ACL)\n∙ Interconnection Security Agreements (ISAs)

Enterprise (>1,000 staff)

∙ Access Control Lists (ACL)\n∙ Interconnection Security Agreements (ISAs)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 70999, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590389", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590389", "securityControlId": 31304, "ccis": [], "uuid": "c19fa462-bf94-59e5-8815-8880d972ac93", "testId": "DCH-15_A01", "test": "individuals authorized to post or process information on publicly accessible systems are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.22[a]\n53A_R5_AC-22a.", "defaultText": null }, { "id": 71000, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59039", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59039", "securityControlId": 31304, "ccis": [], "uuid": "e9570b3e-b7d9-547a-b473-b105f9709dc5", "testId": "DCH-15_A02", "test": "procedures to ensure sensitive / regulated data is not posted or processed on publicly accessible systems are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.22[b]", "defaultText": null }, { "id": 71001, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59039", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59039", "securityControlId": 31304, "ccis": [], "uuid": "7b2e4aa2-85a9-5b24-9893-8215201ecf4c", "testId": "DCH-15_A03", "test": "the proposed content of information is reviewed prior to posting onto the publicly accessible system to ensure that non-public information is not included.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.22[c]\n53A_R5_AC-22c.", "defaultText": null }, { "id": 71002, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59039", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59039", "securityControlId": 31304, "ccis": [], "uuid": "f8dd56de-5cc2-58a7-8801-a16b828e11f9", "testId": "DCH-15_A04", "test": "the content on publicly accessible systems is reviewed for sensitive / regulated data.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71003, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59039", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59039", "securityControlId": 31304, "ccis": [], "uuid": "7b9bb158-3f63-50a6-a95a-0bd5a27ad739", "testId": "DCH-15_A05", "test": "mechanisms are in place to remove and address improper posting of sensitive / regulated data.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.22[e]", "defaultText": null }, { "id": 71004, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59039", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59039", "securityControlId": 31304, "ccis": [], "uuid": "1ed5c438-9d44-5626-a768-d482b83eeff7", "testId": "DCH-15_A06", "test": "the frequency at which to review the content on the publicly accessible system for non-public information is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least quarterly", "otherId": "53A_R5_AC-22_ODP", "defaultText": null }, { "id": 71005, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59039", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59039", "securityControlId": 31304, "ccis": [], "uuid": "e8962af2-2c48-5d31-b21f-dff2eb701626", "testId": "DCH-15_A07", "test": "authorized individuals are trained to ensure that publicly accessible information does not contain non-public information.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_AC-22b.", "defaultText": null }, { "id": 71006, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59039", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59039", "securityControlId": 31304, "ccis": [], "uuid": "9250b4b8-0e2d-5573-b0ee-0e24a83fcebb", "testId": "DCH-15_A08", "test": "authorized individuals are trained to ensure that publicly accessible information does not contain CUI.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.01.22.a", "defaultText": null }, { "id": 71007, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59039", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59039", "securityControlId": 31304, "ccis": [], "uuid": "bdfbe61a-7014-53f4-bbc8-d9e76a33243f", "testId": "DCH-15_A09", "test": "CUI is removed from publicly accessible systems, if discovered.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.01.22.b[02]", "defaultText": null }, { "id": 71008, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590391", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590391", "securityControlId": 31304, "ccis": [], "uuid": "6a744e59-fe2e-502f-ae01-c92a5098c68d", "testId": "DCH-15_A10", "test": "content on publicly accessible systems is reviewed to ensure that it does not include CUI.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_3.1.22[d]", "defaultText": null }, { "id": 71009, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590391", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590391", "securityControlId": 31304, "ccis": [], "uuid": "6ac26009-029a-5aa1-9d5a-0cf74d703a94", "testId": "DCH-15_A11", "test": "the content on publicly accessible systems is reviewed for CUI.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.01.22.b[01]", "defaultText": null }, { "id": 71010, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590391", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590391", "securityControlId": 31304, "ccis": [], "uuid": "6557af4a-75d8-5872-8ac6-38d1d42887c6", "testId": "DCH-15_A12", "test": "a review process is in place prior to posting of any content to publicly accessible systems.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "CMMC L1 Assessment Guide", "defaultText": null }, { "id": 71011, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590391", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590391", "securityControlId": 31304, "ccis": [], "uuid": "447170ca-b30b-5568-a11c-0c28e2a2904c", "testId": "DCH-15_A13", "test": "content on publicly accessible systems is reviewed to ensure that it does not include sensitive/regulated data.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "CMMC L1 Assessment Guide", "defaultText": null } ], "externalMappings": [ { "id": 569208, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584665", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a6b09ad-720b-5efb-a321-9a3bc6dbaa50", "parentControlId": 31304, "controlId": "AC-22", "title": "AC-22", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584665" }, { "id": 569209, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584665", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c94ef329-fbf6-554f-a9f3-a09b51aa24cc", "parentControlId": 31304, "controlId": "AC-22", "title": "AC-22", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584665" }, { "id": 569210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584665", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78375a8f-3b73-583c-94a2-5578b3638fc2", "parentControlId": 31304, "controlId": "AC-22", "title": "AC-22", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584665" }, { "id": 569211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584665", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9867360-d414-502c-8c49-2653ac62285d", "parentControlId": 31304, "controlId": "AC-22", "title": "AC-22", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584665" }, { "id": 569212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584667", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3df3050d-34c3-5e76-afd2-09898533dc95", "parentControlId": 31304, "controlId": "AC-22", "title": "AC-22", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584667" }, { "id": 569213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584667", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac993310-47e8-5ce8-8bd1-21d95a1a72f6", "parentControlId": 31304, "controlId": "AC-22", "title": "AC-22", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584667" }, { "id": 569214, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584667", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa9446c5-f2d4-55f4-a54a-6b54753c1944", "parentControlId": 31304, "controlId": "AC-22", "title": "AC-22", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584667" }, { "id": 569215, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584667", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4974eb6f-9083-58c1-bc5a-7d2da57f7a64", "parentControlId": 31304, "controlId": "AC-22", "title": "AC-22", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584667" }, { "id": 569216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584667", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e66f31c3-ad73-56d0-829c-360ce3bd25fb", "parentControlId": 31304, "controlId": "AC-22", "title": "AC-22", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584667" }, { "id": 569219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584668", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3f2dc14-fba5-585e-adff-ce644942916f", "parentControlId": 31304, "controlId": "3.1.22", "title": "3.1.22", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584668" }, { "id": 569220, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584668", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d53f83ce-a8c3-5ebd-a126-9f28d39140fe", "parentControlId": 31304, "controlId": "03.01.22.a", "title": "03.01.22.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584668" }, { "id": 569221, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584668", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "336e1f05-bb44-5809-a86a-86ccd7450e1b", "parentControlId": 31304, "controlId": "03.01.22.b", "title": "03.01.22.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584668" }, { "controlId": "B.1.23", "title": "B.1.23 — Publicly Accessible Content", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-22", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "449feb97-15c2-550b-90c5-4743814264c1", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.23", "title": "NEI 08-09 App D.1.23 — Publicly Accessible Content", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.23", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "5df8d3e4-c03d-5321-9d2b-fd27959bd58e", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.23", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "a8986568-2bc1-533a-9ae6-efdda5fd3dc4", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "45237e17-92c6-5adc-acf0-0682c7344659", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "7c963ff9-adc5-5b55-945f-b884acf9ad2a", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "460fa89b-18be-5940-9616-f438d7f440d6", "isPublic": true } ], "id": 31304, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731034", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731034", "catalogueId": 1062, "uuid": "fb01357a-a2d5-53b1-a1de-aa140097b295", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization control publicly-accessible content?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Publicly Accessible Content", "description": "

Control Description

Mechanisms exist to control publicly-accessible content.

Evidence Request List (ERL)

E-DCH-12

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Data Classification & Handling (DCH) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with DCH domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Data protection controls are primarily administrative in nature (e.g., policies & standards) to classify, protect and dispose of systems and data, including storage media.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to control publicly-accessible content.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.23", "controlId": "DCH-15", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-15", "references": "

Micro-Small Business (<10 staff)

∙ Data classification policy (public/internal/confidential)

Small Business (10-49 staff)

∙ Data classification policy\n∙ Data handling procedures

Medium Business (50-249 staff)

∙ Data classification program\n∙ DLP tools\n∙ Data handling standards

Large Business (250-999 staff)

∙ Enterprise DLP solution (e.g., Microsoft Purview, Symantec DLP)\n∙ Data classification tool

Enterprise (>1,000 staff)

∙ Enterprise data governance platform (e.g., Collibra)\n∙ DLP with automated classification\n∙ Data lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71012, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590391", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590391", "securityControlId": 31305, "ccis": [], "uuid": "cdbc52f8-a09f-58cc-a549-229e2cbdf303", "testId": "DCH-16_A01", "test": "data mining prevention and detection techniques are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-23_ODP[01]", "defaultText": null }, { "id": 71013, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590391", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590391", "securityControlId": 31305, "ccis": [], "uuid": "6bea88a3-e545-530c-a2e7-5075d8feb999", "testId": "DCH-16_A02", "test": "data storage objects to be protected against unauthorized data mining are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-23_ODP[02]", "defaultText": null }, { "id": 71014, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590392", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590392", "securityControlId": 31305, "ccis": [], "uuid": "5ca37720-b9b1-51d8-9cb9-b1ad4c931884", "testId": "DCH-16_A03", "test": "mechanisms are employed for organization-defined data storage objects to detect and protect against unauthorized data mining.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-23", "defaultText": null } ], "externalMappings": [ { "id": 569261, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb5a3c95-a693-5b5a-b05f-2dcb5833eac3", "parentControlId": 31305, "controlId": "T1005", "title": "T1005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584673" }, { "id": 569262, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e528cc92-6f13-525c-bce1-1492ab7aab83", "parentControlId": 31305, "controlId": "T1025", "title": "T1025", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584673" }, { "id": 569263, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82383b73-050b-5d00-b213-f668efb311ef", "parentControlId": 31305, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584673" }, { "id": 569264, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90204805-f131-52e9-8a70-df0b44212c4b", "parentControlId": 31305, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584673" }, { "id": 569265, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e1f2af3-d1cb-5fe8-b931-e8d0da6b2c0d", "parentControlId": 31305, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584673" }, { "id": 569266, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584682", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ec32948-27c5-5217-8fb4-3d8625ac2135", "parentControlId": 31305, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584682" }, { "id": 569267, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1349aef3-e9b8-5a94-aa65-3a833c8fbdbf", "parentControlId": 31305, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584683" }, { "id": 569268, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "393097dc-5bdb-5071-820d-159943fdabfc", "parentControlId": 31305, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584683" }, { "id": 569269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "654cd1f9-4d22-55a2-895b-1514441e3b30", "parentControlId": 31305, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584683" }, { "id": 569270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2fbcb44-e9c0-5f8d-a1a2-601bc59c44e0", "parentControlId": 31305, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584683" }, { "id": 569271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3addaf05-58bf-5ef2-9bb5-c98344744725", "parentControlId": 31305, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584683" }, { "id": 569272, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3194f61c-acfd-52da-85b2-e736302bb9a9", "parentControlId": 31305, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584683" }, { "id": 569273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "093484e2-ea4b-52e5-9a90-73f5e901e0f1", "parentControlId": 31305, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584683" }, { "id": 569274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbf94f64-489c-5205-8f10-697a43faa25e", "parentControlId": 31305, "controlId": "T1552.007", "title": "T1552.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584684" }, { "id": 569275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ee406e6-3d2d-57be-a86a-847ec07a5bec", "parentControlId": 31305, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584684" }, { "id": 569276, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4824c3f9-d69a-5666-af86-a850a5af8bef", "parentControlId": 31305, "controlId": "T1589", "title": "T1589", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584684" }, { "id": 569277, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40113249-461b-580c-8f3a-a9e2a83a6d1e", "parentControlId": 31305, "controlId": "T1589.002", "title": "T1589.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584684" }, { "id": 569278, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1eba03c8-8ee7-57c8-b98f-ae3505a61452", "parentControlId": 31305, "controlId": "T1589.003", "title": "T1589.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584684" }, { "id": 569279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e79a96b-7184-539d-9913-e62e25913f4c", "parentControlId": 31305, "controlId": "T1590", "title": "T1590", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584684" }, { "id": 569280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2554deb-1584-5841-9bd7-6218159dc9a1", "parentControlId": 31305, "controlId": "T1591", "title": "T1591", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584684" }, { "id": 569281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39952157-fc8a-5844-98c5-28480771a591", "parentControlId": 31305, "controlId": "T1591.001", "title": "T1591.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584684" }, { "id": 569282, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28f3ef91-1b05-5c9b-941b-adea3362d38c", "parentControlId": 31305, "controlId": "T1591.002", "title": "T1591.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584684" }, { "id": 569283, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6857837f-b8bc-5c59-a72a-9b8e8f41fb55", "parentControlId": 31305, "controlId": "T1591.003", "title": "T1591.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584685" }, { "id": 569284, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "600cd940-81ed-5bcd-84bc-f36c508f4f47", "parentControlId": 31305, "controlId": "T1591.004", "title": "T1591.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584685" }, { "id": 569285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "338390c8-e93f-53cb-a135-b8524d0917aa", "parentControlId": 31305, "controlId": "T1593.001", "title": "T1593.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584685" }, { "id": 569286, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d12cdf02-49c5-58cc-8934-2fdcb380c87e", "parentControlId": 31305, "controlId": "T1593.002", "title": "T1593.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584685" }, { "id": 569287, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37cf8bbd-0100-5663-9634-8a33042358be", "parentControlId": 31305, "controlId": "T1594", "title": "T1594", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584685" }, { "id": 569288, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7954a544-9261-5715-9664-1058cfff829d", "parentControlId": 31305, "controlId": "T1595", "title": "T1595", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584685" }, { "id": 569289, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9054385a-1ef9-579c-8842-a3e60c97c3d1", "parentControlId": 31305, "controlId": "T1595.001", "title": "T1595.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584685" }, { "id": 569290, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3058696a-7596-515b-9df4-baa95bb5defc", "parentControlId": 31305, "controlId": "T1595.002", "title": "T1595.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584685" }, { "id": 569291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "866bb445-f7c4-532f-95e4-b274f39a2569", "parentControlId": 31305, "controlId": "T1596", "title": "T1596", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584686" }, { "id": 569292, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9369080-bc90-57ce-9304-1d829316012e", "parentControlId": 31305, "controlId": "T1596.005", "title": "T1596.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584686" }, { "id": 569293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d49e2f6-41b8-5750-a835-c2bd874c2e57", "parentControlId": 31305, "controlId": "T1597", "title": "T1597", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584686" }, { "id": 569294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "520be3f7-cf04-5f14-b473-ac898ff34ca5", "parentControlId": 31305, "controlId": "AC-23", "title": "AC-23", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584686" }, { "id": 569295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9bd53824-214a-5364-9279-8d181469a1ff", "parentControlId": 31305, "controlId": "AC-23", "title": "AC-23", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584686" }, { "id": 569297, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "188fb77b-d84b-5cdc-8fc0-8ce7afa1229a", "parentControlId": 31305, "controlId": "AC-23", "title": "AC-23", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584686" }, { "id": 569299, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dae61e09-3f67-5b08-8ca0-3c1a3ea6ca8c", "parentControlId": 31305, "controlId": "AC-23", "title": "AC-23", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584686" }, { "id": 569300, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cbcc68b5-0b3b-5fc4-b557-3c57067856aa", "parentControlId": 31305, "controlId": "AC-23", "title": "AC-23", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584687" }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "f7a62f05-8cfc-5034-a878-a23dce7a21da", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "f26623e8-5783-5fe5-9dac-0d4ec0bf328c", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "432a8af6-a5c1-50e7-a793-8e283358f11e", "isPublic": true } ], "id": 31305, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731034", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731034", "catalogueId": 1062, "uuid": "7d66c2a2-e126-51e1-ba26-45cee35e48ba", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect data storage objects against unauthorized data mining and data harvesting techniques?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Data Mining Protection", "description": "

Control Description

Mechanisms exist to protect data storage objects against unauthorized data mining and data harvesting techniques.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Data Classification & Handling (DCH) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with DCH domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Data protection controls are primarily administrative in nature (e.g., policies & standards) to classify, protect and dispose of systems and data, including storage media.\n▪ Media is securely stored until it is destroyed or sanitized using approved equipment, techniques and procedures.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to protect data storage objects against unauthorized data mining and data harvesting techniques.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-16", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-16", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense-in-depth (DiD) architecture

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense-in-depth (DiD) architecture

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense-in-depth (DiD) architecture

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense-in-depth (DiD) architecture

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Defense-in-depth (DiD) architecture", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71015, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590392", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590392", "securityControlId": 31306, "ccis": [], "uuid": "693aaae8-e5ef-5f8f-90ae-12581a031e97", "testId": "DCH-17_A01", "test": "ad-hoc exchanges of large digital files with internal or external parties are secured according to organization-defined protection criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 569322, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e50b832-3298-55e0-bcff-48a34309f7ab", "parentControlId": 31306, "controlId": "5.14", "title": "5.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584689" }, { "id": 569326, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58469", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "020be62e-9ded-5371-91fe-68b7a5f00cbf", "parentControlId": 31306, "controlId": "3.1.20", "title": "3.1.20", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58469" }, { "id": 569327, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58469", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b85c99e-5fd0-59b1-be84-a762cf5e9413", "parentControlId": 31306, "controlId": "03.01.20.a", "title": "03.01.20.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58469" }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "c36492e9-7fbd-54fd-959d-7c15ff89a17a", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "afb91dbd-b460-5ec5-bf9a-e417ec9e5a46", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "75a65385-9e80-5cad-b61b-9701444790c2", "isPublic": true } ], "id": 31306, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731034", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731034", "catalogueId": 1062, "uuid": "fd5dc23d-519e-5bfe-905c-320fa8e28db9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization secure ad-hoc exchanges of large digital files with internal or external parties?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Ad-Hoc Transfers", "description": "

Control Description

Mechanisms exist to secure ad-hoc exchanges of large digital files with internal or external parties.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Data Classification & Handling (DCH) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with DCH domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Restrictions for ad-hoc data transfers are primarily administrative in nature (e.g., policies & standards).

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to document where sensitive/regulated data is stored, transmitted and/or processed.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to secure ad-hoc exchanges of large digital files with internal or external parties.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "DCH-17", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-17", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Secure Baseline Configurations (SBC)\n∙ Content / DNS filtering

Small Business (10-49 staff)

∙ Data classification program\n∙ Secure Baseline Configurations (SBC)\n∙ Content / DNS filtering

Medium Business (50-249 staff)

∙ Data classification program\n∙ Secure Baseline Configurations (SBC)\n∙ Content / DNS filtering

Large Business (250-999 staff)

∙ Data classification program\n∙ Secure Baseline Configurations (SBC)\n∙ Content / DNS filtering∙ Data governance program

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Secure Baseline Configurations (SBC)\n∙ Content / DNS filtering∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71016, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590392", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590392", "securityControlId": 31307, "ccis": [], "uuid": "9e706594-6d8b-58ce-9be4-fef9489f1e03", "testId": "DCH-18_A01", "test": "the frequency with which to conduct reviews of persistent organizational storage locations is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "172A_3.14.5e_ODP[1]", "defaultText": null }, { "id": 71017, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590392", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590392", "securityControlId": 31307, "ccis": [], "uuid": "8b5bccfe-66a5-530e-8311-e353407f7855", "testId": "DCH-18_A02", "test": "persistent organizational storage locations are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.5e[a]", "defaultText": null }, { "id": 71018, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590392", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590392", "securityControlId": 31307, "ccis": [], "uuid": "77e889fa-0acf-59b9-b319-cdc118438d6e", "testId": "DCH-18_A03", "test": "reviews of persistent organizational storage locations are conducted per an organization-defined frequency to identify sensitive / regulated data that is no longer needed.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "172A_3.14.5e[b]", "defaultText": null }, { "id": 71019, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590393", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590393", "securityControlId": 31307, "ccis": [], "uuid": "a84c4c5b-3a76-5c0a-8ef9-4a01ee081f3c", "testId": "DCH-18_A04", "test": "sensitive / regulated data that is no longer needed is removed.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "172A_3.14.5e[c]", "defaultText": null }, { "id": 71020, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590393", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590393", "securityControlId": 31307, "ccis": [], "uuid": "be9a9410-0822-5dab-a62f-435c810ff74b", "testId": "DCH-18_A05", "test": "sensitive / regulated data within the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_SI-12[01]", "defaultText": null }, { "id": 71021, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590393", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590393", "securityControlId": 31307, "ccis": [], "uuid": "50e39a17-c0b5-5934-8e51-6aae1dbe57a9", "testId": "DCH-18_A06", "test": "sensitive / regulated data within the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_SI-12[02]", "defaultText": null }, { "id": 71022, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590393", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590393", "securityControlId": 31307, "ccis": [], "uuid": "ecc37928-a156-5bed-85bc-d532aa72852a", "testId": "DCH-18_A07", "test": "sensitive / regulated data output from the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_SI-12[03]", "defaultText": null }, { "id": 71023, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590393", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590393", "securityControlId": 31307, "ccis": [], "uuid": "af40321c-5fc4-5c18-8b80-5d2fa3b12ba0", "testId": "DCH-18_A08", "test": "sensitive / regulated data output from the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_SI-12[04]", "defaultText": null }, { "id": 71024, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590393", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590393", "securityControlId": 31307, "ccis": [], "uuid": "7285d566-b6f9-5118-b87b-410bea523684", "testId": "DCH-18_A09", "test": "CUI within the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.14.08[01]", "defaultText": null }, { "id": 71025, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590394", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590394", "securityControlId": 31307, "ccis": [], "uuid": "8320dd1a-8583-56a0-933b-c968c11649a6", "testId": "DCH-18_A10", "test": "CUI within the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.14.08[02]", "defaultText": null }, { "id": 71026, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590394", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590394", "securityControlId": 31307, "ccis": [], "uuid": "798d8358-13b3-5346-95e5-178bb16003d7", "testId": "DCH-18_A11", "test": "CUI output from the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.14.08[03]", "defaultText": null }, { "id": 71027, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590394", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590394", "securityControlId": 31307, "ccis": [], "uuid": "b0337dd2-73ac-5e43-9b1a-d799c47263a7", "testId": "DCH-18_A12", "test": "CUI output from the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.14.08[04]", "defaultText": null } ], "externalMappings": [ { "id": 569372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584695", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37bfa540-da84-548b-87a6-f71d83baec68", "parentControlId": 31307, "controlId": "DATA 1.4", "title": "DATA 1.4", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584696" }, { "id": 569373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584696", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4daf945-1126-5977-b735-8aa3e249d9f7", "parentControlId": 31307, "controlId": "5.33", "title": "5.33", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584696" }, { "id": 569374, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584696", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b78342a-9ae9-5441-9b0c-7dffa446389d", "parentControlId": 31307, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584696" }, { "id": 569378, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584697", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34807af8-5519-563e-8f46-6544ff49e8e3", "parentControlId": 31307, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584697" }, { "id": 569379, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584697", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "040ef8c9-a66a-5bfe-a215-927bfdf1b1a8", "parentControlId": 31307, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584697" }, { "id": 569380, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99a3a88d-80e4-5ffa-bfa0-0a23fb6ec95d", "parentControlId": 31307, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584698" }, { "id": 569381, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b2c469b-5640-5ab5-a40d-8602088b12c4", "parentControlId": 31307, "controlId": "T1040", "title": "T1040", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584698" }, { "id": 569382, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5b80ddc-d8fc-5c14-adf7-b7b38a2e89eb", "parentControlId": 31307, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584698" }, { "id": 569383, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a92808b-8ab7-58b4-821b-ba17ad089fa6", "parentControlId": 31307, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584698" }, { "id": 569384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "518a160b-e5bf-5961-a3a0-b5f7910bb93e", "parentControlId": 31307, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584698" }, { "id": 569385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d61541fa-3ef1-5724-a8bd-88946198a9db", "parentControlId": 31307, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584698" }, { "id": 569386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eec479c1-2eee-596a-8efe-67293931893e", "parentControlId": 31307, "controlId": "T1114", "title": "T1114", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584698" }, { "id": 569387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14f23fdb-7f55-5a6d-82fe-f2a61e29e74e", "parentControlId": 31307, "controlId": "T1114.001", "title": "T1114.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584698" }, { "id": 569388, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25e67e6e-db55-51f0-b31b-a66546e6b590", "parentControlId": 31307, "controlId": "T1114.002", "title": "T1114.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584698" }, { "id": 569389, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "377a04d7-4e81-5298-949c-e0ac644e8cc7", "parentControlId": 31307, "controlId": "T1114.003", "title": "T1114.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584699" }, { "id": 569390, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc1c0ef0-8069-50e2-8e6c-2a59bdc6e9c1", "parentControlId": 31307, "controlId": "T1119", "title": "T1119", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584699" }, { "id": 569391, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ff930c9-c758-56f9-82f1-08b2c32635ed", "parentControlId": 31307, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584699" }, { "id": 569392, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2014e78-f1c5-5c67-9738-8c9aed5ea230", "parentControlId": 31307, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584699" }, { "id": 569393, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b027bfa8-01ed-5413-afd4-2defad4ffa1f", "parentControlId": 31307, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584699" }, { "id": 569394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5dda69f-165d-531a-b660-ba73d74077e1", "parentControlId": 31307, "controlId": "T1548.004", "title": "T1548.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584699" }, { "id": 569395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9f34acf-b86c-5424-bea2-1a4726cea13a", "parentControlId": 31307, "controlId": "T1550.001", "title": "T1550.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584699" }, { "id": 569396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b90a2d4f-d3e1-52bb-9b1a-ea5fc7aeaf7a", "parentControlId": 31307, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584699" }, { "id": 569397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bda704f-013e-5bde-91cf-753835d69f34", "parentControlId": 31307, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5847" }, { "id": 569398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85c2116d-ec87-557b-93ec-f2e7936d3529", "parentControlId": 31307, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5847" }, { "id": 569399, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f8a3607-27a0-55da-a42f-0adc5a9b0929", "parentControlId": 31307, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5847" }, { "id": 569400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b245f1c4-2adc-5801-a94e-438f8df55acc", "parentControlId": 31307, "controlId": "T1557.004", "title": "T1557.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5847" }, { "id": 569401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6468311-4e0c-52c5-b2bb-d4186edb4d0a", "parentControlId": 31307, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5847" }, { "id": 569402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4607c629-2596-5001-8f31-6ec16db9bbf3", "parentControlId": 31307, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5847" }, { "id": 569403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b8b36ce-5251-52e9-a631-3659ed5e25f1", "parentControlId": 31307, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5847" }, { "id": 569404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "915ea312-6c8d-5a46-9e32-321c23f111c9", "parentControlId": 31307, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5847" }, { "id": 569405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0519a3d-1f11-5719-b9a7-c0c08756f4f5", "parentControlId": 31307, "controlId": "T1558.005", "title": "T1558.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5847" }, { "id": 569406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcbf920a-1942-5551-9cf0-193d802a4d52", "parentControlId": 31307, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584701" }, { "id": 569407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584701", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afb83a03-20b9-5229-95b0-ba47b9e84750", "parentControlId": 31307, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584701" }, { "id": 569408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584701", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee731d48-dc4c-5799-bbe4-cb38f02397aa", "parentControlId": 31307, "controlId": "T1565.002", "title": "T1565.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584701" }, { "id": 569409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584701", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cee9fb37-3dc0-5ef5-8fca-c295c8fdefee", "parentControlId": 31307, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584701" }, { "id": 569410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584701", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "714c3bef-8d65-5c2c-a517-475f137cad3c", "parentControlId": 31307, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584701" }, { "id": 569411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584701", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f634e7ca-1fdc-5731-871c-0d97da00aeae", "parentControlId": 31307, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584701" }, { "id": 569419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cbee4419-6bd7-5266-bb36-f3b25f8f8569", "parentControlId": 31307, "controlId": "MP-7", "title": "MP-7", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584703" }, { "id": 569420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eee03aed-fa0c-540e-8a24-1f2783645d0e", "parentControlId": 31307, "controlId": "SI-12", "title": "SI-12", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584703" }, { "id": 569421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d692767-e84e-5889-b3aa-99e7173d7ab4", "parentControlId": 31307, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584703" }, { "id": 569422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b089716d-dbf9-5b04-abc8-48ecc5987e34", "parentControlId": 31307, "controlId": "SI-12", "title": "SI-12", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584704" }, { "id": 569425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bc32792-edfd-52da-bc5a-46893ec8d12a", "parentControlId": 31307, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584704" }, { "id": 569426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d5519be-f4d2-5c68-8575-f2187b7405a6", "parentControlId": 31307, "controlId": "SI-12", "title": "SI-12", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584704" }, { "id": 569428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29df7921-1478-5b22-9b81-c9807ea6c00d", "parentControlId": 31307, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584704" }, { "id": 569429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95b8e838-61f7-53f1-a9c8-ad16406d1934", "parentControlId": 31307, "controlId": "SI-12", "title": "SI-12", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584704" }, { "id": 569430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "961fdcbb-19d7-5bda-88ec-a3d4ba74d00e", "parentControlId": 31307, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584704" }, { "id": 569431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584705", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95d8978c-3d7d-530b-962b-5b4d80bb6fde", "parentControlId": 31307, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584705" }, { "id": 569432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584705", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "394e3eee-09f5-5c7f-aa3f-bda0053411d8", "parentControlId": 31307, "controlId": "SI-12", "title": "SI-12", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584705" }, { "id": 569433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584705", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8dc3ac2c-4cc9-5219-9a60-d54e8380f0f7", "parentControlId": 31307, "controlId": "MP-07", "title": "MP-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584705" }, { "id": 569434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584705", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3cf8a4a-95e3-5a1f-b771-437440b82965", "parentControlId": 31307, "controlId": "SI-12", "title": "SI-12", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584705" }, { "id": 569435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584705", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a1de16d-34a5-5e7e-b121-68d2b9f9b1df", "parentControlId": 31307, "controlId": "SI-12", "title": "SI-12", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584705" }, { "id": 569436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584705", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76fa01a0-0463-5523-ae93-b0b152138869", "parentControlId": 31307, "controlId": "SI-12", "title": "SI-12", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584705" }, { "id": 569438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584705", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb31225c-93b1-5776-9577-301940fdaa3d", "parentControlId": 31307, "controlId": "03.01.20.c.02", "title": "03.01.20.c.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584705" }, { "id": 569439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584705", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3cf193ad-99e1-59dc-bff0-198d96d7298e", "parentControlId": 31307, "controlId": "03.14.08", "title": "03.14.08", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584705" }, { "id": 569499, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584715", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "289a1512-1af9-5d34-8c80-5f8d681f15c0", "parentControlId": 31307, "controlId": "CIP-006-6 1.9", "title": "CIP-006-6 1.9", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584715" }, { "controlId": "C.3.10", "title": "C.3.10 — Information Output Handling and Retention", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-12", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "68d8a7cf-471a-5fb3-ba2f-5d388553a80e", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.10", "title": "NEI 08-09 App E.3.10 — Information Output Handling and Retention", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.10", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "664cbe10-2bfb-5a87-a2e9-5317409f90ce", "isPublic": true }, { "controlId": "10 CFR 73.54(h)", "title": "10 CFR 73.54(h) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.3.10", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "4818f68d-d193-5017-93f4-81c6a9da8c08", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "fd7a2a6d-d86f-5f92-8ef0-729edabc1936", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "48534a7d-19bc-5df2-845c-198972eb193b", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "b9bca3cd-6f52-5a2d-b951-b0a8d70f327f", "isPublic": true } ], "id": 31307, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731035", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731035", "catalogueId": 1062, "uuid": "7e9de79f-bf33-52f8-bc73-142f66398bea", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization retain media and data in accordance with applicable statutory, regulatory and contractual obligations?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 8.0, "title": "Media & Data Retention", "description": "

Control Description

Mechanisms exist to retain media and data in accordance with applicable statutory, regulatory and contractual obligations.

Evidence Request List (ERL)

E-AST-11

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Data Classification & Handling (DCH) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with DCH domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Data protection controls are primarily administrative in nature (e.g., policies & standards) to classify, protect and dispose of systems and data, including storage media.\n▪ A manual data retention process exists.\n▪ Media is securely stored until it is destroyed or sanitized using approved equipment, techniques and procedures.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ The data retention process is manual and IT and/or cybersecurity personnel work with business stakeholders and process owners to manage the process.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to dispose of, destroy, erase, and/or anonymize sensitive/regulated data.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to retain media and data in accordance with applicable statutory, regulatory and contractual obligations.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.3.10", "controlId": "DCH-18", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-18", "references": "

Micro-Small Business (<10 staff)

∙ Data retention program\n∙ Data classification program

Small Business (10-49 staff)

∙ Data retention program\n∙ Data classification program

Medium Business (50-249 staff)

∙ Data retention program\n∙ Data classification program

Large Business (250-999 staff)

∙ Data retention program\n∙ Data classification program\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Data retention program\n∙ Data classification program\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71028, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590394", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590394", "securityControlId": 31308, "ccis": [], "uuid": "4ced18dc-5f5b-5636-ae84-7aea9851502f", "testId": "DCH-18.1_A01", "test": "elements of Personal Data (PD) being processed in the information life cycle are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-12(01)_ODP", "defaultText": null }, { "id": 71029, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590394", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590394", "securityControlId": 31308, "ccis": [], "uuid": "7b620ad1-2aaa-50ea-84c3-71c08f866cb8", "testId": "DCH-18.1_A02", "test": "Personal Data (PD) being processed in the information life cycle is limited to organization-defined elements of Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-12(01)", "defaultText": null } ], "externalMappings": [ { "id": 569568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584723", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ef930c7-d97a-5ee7-91bd-77e378f1a1aa", "parentControlId": 31308, "controlId": "SI-12(01)", "title": "SI-12(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584723" }, { "id": 569570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584723", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a34bd6f5-8d8e-5b9a-91ce-c156c0adf1d5", "parentControlId": 31308, "controlId": "SI-12(01)", "title": "SI-12(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584723" } ], "id": 31308, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731035", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731035", "catalogueId": 1062, "uuid": "0bec4833-6e49-58d2-8a3d-1bbc5a1d3537", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization minimize sensitive/regulated data that is collected, received, processed, stored and/or transmitted throughout the information lifecycle to only those elements necessary to support necessary business processes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Minimize Sensitive / Regulated Data", "description": "

Control Description

Mechanisms exist to minimize sensitive/regulated data that is collected, received, processed, stored and/or transmitted throughout the information lifecycle to only those elements necessary to support necessary business processes.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Data Classification & Handling (DCH) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with DCH domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Data protection controls are primarily administrative in nature (e.g., policies & standards) to classify, protect and dispose of systems and data, including storage media.\n▪ Requirements exist for limiting the use of sensitive/regulated data in testing, training and research.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to minimize sensitive/regulated data that is collected, received, processed, stored and/or transmitted throughout the information lifecycle to only those elements necessary to support necessary business processes.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "DCH-18.1", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-18.1", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Product / project management\n∙ Data Protection Impact Assessment (DPIA)

Small Business (10-49 staff)

∙ Data classification program\n∙ Product / project management\n∙ Data Protection Impact Assessment (DPIA)

Medium Business (50-249 staff)

∙ Data classification program\n∙ Product / project management\n∙ Data Protection Impact Assessment (DPIA)

Large Business (250-999 staff)

∙ Data classification program\n∙ Product / project management\n∙ Data Protection Impact Assessment (DPIA)\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Product / project management\n∙ Data Protection Impact Assessment (DPIA)\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71030, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590395", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590395", "securityControlId": 31309, "ccis": [], "uuid": "08ef8a18-3bcc-5daf-8832-5fdfaa7f05b8", "testId": "DCH-18.2_A01", "test": "the developer of the system or system component is required to minimize the use of Personal Data (PD) in development and test environments.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-15(12)", "defaultText": null }, { "id": 71031, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590395", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590395", "securityControlId": 31309, "ccis": [], "uuid": "e332a99d-0df1-5914-ac85-755e2fb45c1f", "testId": "DCH-18.2_A02", "test": "techniques used to minimize the use of Personal Data (PD) for research, testing and training are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-12(02)_ODP[01]\n53A_R5_SI-12(02)_ODP[02]\n53A_R5_SI-12(02)_ODP[03]", "defaultText": null }, { "id": 71032, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590395", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590395", "securityControlId": 31309, "ccis": [], "uuid": "dff5edbe-cfc8-5a9d-8dbf-49aa06813ed9", "testId": "DCH-18.2_A03", "test": "organization-defined techniques are used to minimize the use of Personal Data (PD) for research, testing and training.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-12(02)[01]\n53A_R5_SI-12(02)[02]\n53A_R5_SI-12(02)[03]", "defaultText": null }, { "id": 71033, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590395", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590395", "securityControlId": 31309, "ccis": [], "uuid": "b9a6f038-7215-5ab8-a22b-5633c60147a8", "testId": "DCH-18.2_A04", "test": "processes that implement the privacy principle of minimization are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08(33)_ODP", "defaultText": null }, { "id": 71034, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590395", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590395", "securityControlId": 31309, "ccis": [], "uuid": "a561a906-ae12-5ad1-ac15-ea24d5776e96", "testId": "DCH-18.2_A05", "test": "the privacy principle of minimization is implemented using organization-defined processes.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08(33)", "defaultText": null } ], "externalMappings": [ { "id": 569584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9746fe0-7ece-5d3e-a8ec-5a3d43b2b130", "parentControlId": 31309, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584725" }, { "id": 569585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e3d514f-25b0-5b0d-82b4-834ac8b27dbb", "parentControlId": 31309, "controlId": "SA-08(33)", "title": "SA-08(33)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584725" }, { "id": 569586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5e6ac54-2e88-5984-bb51-0aea00c8bd19", "parentControlId": 31309, "controlId": "SA-15(12)", "title": "SA-15(12)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584725" }, { "id": 569587, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "937deec0-6bde-566a-86b5-dc0a2d882308", "parentControlId": 31309, "controlId": "SI-12(02)", "title": "SI-12(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584725" }, { "id": 569591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82b91721-abc7-5423-b3b2-202826380aa0", "parentControlId": 31309, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584734" }, { "id": 569592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d7f66b9-d241-527c-923c-a367d897651c", "parentControlId": 31309, "controlId": "SA-08(33)", "title": "SA-08(33)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584734" }, { "id": 569593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c6cc21a-8af1-58bd-b8cc-e6ad5d467b54", "parentControlId": 31309, "controlId": "SA-15(12)", "title": "SA-15(12)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584734" }, { "id": 569594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a74a32c-6500-542c-9947-b09e03b485a2", "parentControlId": 31309, "controlId": "SI-12(02)", "title": "SI-12(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584734" }, { "id": 569595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8e636bf-864d-5f4a-9254-42ffffe7da98", "parentControlId": 31309, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584734" }, { "id": 569596, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0462c3a3-b09f-53cb-a85c-4e0c0bf83d47", "parentControlId": 31309, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584734" }, { "id": 569597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13cd11df-469f-5011-ac6a-36ddfd7a75a7", "parentControlId": 31309, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584734" }, { "id": 569598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7963ba7c-3043-5e0d-905a-5ac33277bb99", "parentControlId": 31309, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584734" } ], "id": 31309, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731036", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731036", "catalogueId": 1062, "uuid": "f7ea8c7b-3ca8-5ece-8d7f-9ee68d3c5b2f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization minimize the use of Personal Data (PD) for research, testing, or training, in accordance with the Data Protection Impact Assessment (DPIA)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Limit Sensitive / Regulated Data In Testing, Training & Research", "description": "

Control Description

Mechanisms exist to minimize the use of sensitive/regulated data for research, testing, or training, in accordance with authorized, legitimate business practices.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Data Classification & Handling (DCH) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with DCH domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Limited media handling guidance exists for users.\n▪ Requirements exist for limiting the use of sensitive/regulated data in testing, training and research.\n▪ Requirements exist for minimizing data collection to what is necessary for business purposes.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ Business stakeholders and process owners adhere to applicable compliance requirements to limit the use of sensitive/regulated data in testing, training and research.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to minimize the use of sensitive/regulated data for research, testing, or training, in accordance with authorized, legitimate business practices.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-18.2", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-18.2", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71036, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590396", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590396", "securityControlId": 31311, "ccis": [], "uuid": "0dd25305-ff52-51df-b830-9d0b7cabd090", "testId": "DCH-19_A01", "test": "locations where information processing and data storage is/are to be restricted are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(05)_ODP[01]\n53A_R5_SA-09(05)_ODP[02]", "defaultText": null }, { "id": 71037, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590397", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590397", "securityControlId": 31311, "ccis": [], "uuid": "2d6f72c4-0973-51a3-8805-1f01790687ca", "testId": "DCH-19_A02", "test": "requirements or conditions for restricting the location of information processing, information storage or information services are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(05)_ODP[03]", "defaultText": null }, { "id": 71038, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590397", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590397", "securityControlId": 31311, "ccis": [], "uuid": "e645a417-428c-5803-9be2-44358249bf47", "testId": "DCH-19_A03", "test": "based on requirements, information processing, information storage or information services is/are restricted to locations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(05)", "defaultText": null }, { "id": 71039, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590398", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590398", "securityControlId": 31311, "ccis": [], "uuid": "17fd2a44-1223-57c0-8afa-872eab951fec", "testId": "DCH-19_A04", "test": "the geographic location of information processing and data storage is restricted to facilities located within the legal jurisdictional boundary of the United States.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_SA-09(08)", "defaultText": null } ], "externalMappings": [ { "id": 569635, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f84802bc-c553-5368-9134-72162115edfe", "parentControlId": 31311, "controlId": "SA-9(5)", "title": "SA-9(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584739" }, { "id": 569636, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "edc22f3c-e6dc-576d-80dd-806c3f635689", "parentControlId": 31311, "controlId": "SA-09(05)", "title": "SA-09(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584739" }, { "id": 569637, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fc23453-afc5-5f86-bd2f-7700d49ca4c4", "parentControlId": 31311, "controlId": "SA-09(08)", "title": "SA-09(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584739" }, { "id": 569640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c0b8439-5e73-5f16-84f4-bf24931e8062", "parentControlId": 31311, "controlId": "SA-09(05)", "title": "SA-09(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584739" }, { "id": 569641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58474", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea3ef9d2-e84a-5951-964e-495c20e912f8", "parentControlId": 31311, "controlId": "SA-09(08)", "title": "SA-09(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58474" }, { "id": 569642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58474", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e561f85-0ad9-5fb7-b06f-d4521913d315", "parentControlId": 31311, "controlId": "SA-9(5)", "title": "SA-9(5)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58474" }, { "id": 569644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58474", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89754723-64c8-5bcb-bb93-7d57769666e6", "parentControlId": 31311, "controlId": "03.04.11.a", "title": "03.04.11.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58474" }, { "id": 569645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58474", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7b27875-fdde-5184-a991-2b8762a9c904", "parentControlId": 31311, "controlId": "03.04.11.b", "title": "03.04.11.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58474" }, { "id": 569646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58474", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32af772b-954f-58b3-b5ea-31ed8f81825b", "parentControlId": 31311, "controlId": "ID.AM-03", "title": "ID.AM-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58474" }, { "id": 569663, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea11612a-0e7d-53eb-ba6f-3b44febbf8e5", "parentControlId": 31311, "controlId": "B3.a", "title": "B3.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584742" }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "940df2b5-22ba-50c1-8de3-1aa4b878abdd", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "c57cc43d-40f0-5a1d-9ac0-2acfdbdf4501", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "15e9814f-97d6-5c2e-bafc-b2431c548c17", "isPublic": true } ], "id": 31311, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731036", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731036", "catalogueId": 1062, "uuid": "9620bad5-ee91-50f9-ac1c-18f09d106c9d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization inventory, document and maintain data flows for data that is resident (permanently or temporarily) within a service's geographically distributed applications (physical and virtual), infrastructure, systems components and/or shared with other third-parties?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Geographic Location of Data", "description": "

Control Description

Mechanisms exist to inventory, document and maintain data flows for data that is resident (permanently or temporarily) within a service's geographically distributed applications (physical and virtual), infrastructure, systems components and/or shared with other third-parties.

Evidence Request List (ERL)

E-AST-23

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to document where sensitive/regulated data is stored, transmitted and/or processed.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to inventory, document and maintain data flows for data that is resident (permanently or temporarily) within a service's geographically distributed applications (physical and virtual), infrastructure, systems components and/or shared with other third-parties.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "DCH-19", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-19", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program\n∙ Data classification program\n∙ Sensitive data inventories\n∙ System Security & Privacy Plan (SSPP)\n∙ Product / project management

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program\n∙ Data classification program\n∙ Sensitive data inventories\n∙ System Security & Privacy Plan (SSPP)\n∙ Product / project management

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program\n∙ Data classification program\n∙ Sensitive data inventories\n∙ System Security & Privacy Plan (SSPP)\n∙ Product / project management

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program\n∙ Data classification program\n∙ Sensitive data inventories\n∙ System Security & Privacy Plan (SSPP)\n∙ Product / project management\n∙ Data governance program

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program\n∙ Data classification program\n∙ Sensitive data inventories\n∙ System Security & Privacy Plan (SSPP)\n∙ Product / project management\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71041, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590398", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590398", "securityControlId": 31313, "ccis": [], "uuid": "47b40593-c63d-5017-b895-21af2d24df9d", "testId": "DCH-21_A01", "test": "techniques used to dispose of, destroy and/or erase information following the retention period are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-12(03)_ODP[01]\n53A_R5_SI-12(03)_ODP[02]\n53A_R5_SI-12(03)_ODP[03]", "defaultText": null }, { "id": 71042, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590398", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590398", "securityControlId": 31313, "ccis": [], "uuid": "40525ba8-c749-5c3c-8ca5-a702ac33bb0e", "testId": "DCH-21_A02", "test": "organization-defined techniques are used to dispose of, destroy and/or erase following the retention period.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-12(03)[01]\n53A_R5_SI-12(03)[02]\n53A_R5_SI-12(03)[03]", "defaultText": null } ], "externalMappings": [ { "id": 569686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584745", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fabd06d-1729-5439-a083-c36da67c8fef", "parentControlId": 31313, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584745" }, { "id": 569689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584745", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4cfb1cd8-7a06-56e2-8f52-a1002a440bae", "parentControlId": 31313, "controlId": "DM-2", "title": "DM-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584745" }, { "id": 569690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584745", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a0e57ad-4855-515b-88ce-f59dbd1bb274", "parentControlId": 31313, "controlId": "SI-12(03)", "title": "SI-12(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584745" }, { "id": 569692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584746", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f839ca4d-a3ab-5690-a17a-881aa2755e40", "parentControlId": 31313, "controlId": "SI-12(03)", "title": "SI-12(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584746" }, { "id": 569693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584746", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad19f69b-26c1-59ca-a937-252b28ff93af", "parentControlId": 31313, "controlId": "03.08.03", "title": "03.08.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584746" }, { "id": 569707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584747", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e587f84d-78d1-55f9-9e11-c7a4ed86e229", "parentControlId": 31313, "controlId": "§117.15(g)", "title": "§117.15(g)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584747" }, { "id": 569708, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584747", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8088e4ee-d368-58e9-8915-dca85e043ad8", "parentControlId": 31313, "controlId": "§117.15(g)(1)", "title": "§117.15(g)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584747" }, { "id": 569709, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584747", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "925895aa-d6b9-5f66-825e-e8ead46c5a60", "parentControlId": 31313, "controlId": "§117.15(g)(2)", "title": "§117.15(g)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584747" }, { "id": 569710, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584747", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4466bab3-50f0-5a46-af6e-c66b08d8bef6", "parentControlId": 31313, "controlId": "6-1.a", "title": "6-1.a", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584747" }, { "id": 569711, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acf3666e-9ad4-517e-b043-0bb2595c641f", "parentControlId": 31313, "controlId": "6-1.b", "title": "6-1.b", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584748" }, { "id": 569712, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9dfe5d2c-1c58-52ef-b398-0cedf3bb39d1", "parentControlId": 31313, "controlId": "6-1.c", "title": "6-1.c", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584748" }, { "id": 569713, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "503ed2d2-dfcb-522a-9080-9f918cb56e36", "parentControlId": 31313, "controlId": "6-3.b", "title": "6-3.b", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584748" }, { "controlId": "A.5", "title": "A.5 — DOCUMENT CONTROL AND RECORDS RETENTION AND HANDLING", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AU-11, MP-4, PM-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "231c2f8a-0327-543b-adb8-dd13dbcf1291", "isPublic": true }, { "controlId": "NEI 08-09 Sec 5.0", "title": "NEI 08-09 Sec 5.0 — DOCUMENT CONTROL AND RECORDS RETENTION AND HANDLING", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6b9f91b6-24de-56af-bcc2-70f73f14ea23", "isPublic": true }, { "controlId": "10 CFR 73.54(h), 73.55(q)", "title": "10 CFR 73.54(h), 73.55(q) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "1dc025ad-8b0c-5526-b4b4-78a20cbe6d86", "isPublic": true }, { "controlId": "C.3.10", "title": "C.3.10 — Information Output Handling and Retention", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-12", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "b581985b-f7ab-54ed-8162-c2cebae71a40", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.10", "title": "NEI 08-09 App E.3.10 — Information Output Handling and Retention", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.10", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "03dcdae5-21c5-5261-9ffc-b8b1d0cb837b", "isPublic": true }, { "controlId": "10 CFR 73.54(h)", "title": "10 CFR 73.54(h) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.3.10", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "57ae31ff-5da9-5d8a-8598-6b029cbbec28", "isPublic": true }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "14a1d170-8724-5a44-890a-74e4ff0f2253", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "15b13463-7d5f-5e60-b08c-8ae4443f1b93", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "51eb5827-81f4-5d7d-a4a4-3efcc35fc832", "isPublic": true } ], "id": 31313, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731042", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731042", "catalogueId": 1062, "uuid": "1414889b-ea42-52db-93c6-fa8635e7577e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization securely dispose of, destroy or erase information?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Information Disposal", "description": "

Control Description

Mechanisms exist to securely dispose of, destroy or erase information.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to dispose of, destroy, erase, and/or anonymize sensitive/regulated data.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to securely dispose of, destroy or erase information.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.5, C.3.10", "controlId": "DCH-21", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-21", "references": "

Micro-Small Business (<10 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Small Business (10-49 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Medium Business (50-249 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Large Business (250-999 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers

Enterprise (>1,000 staff)

∙ Shred-it (https://shredit.com)\n∙ IronMountain (https://ironmountain.com)\n∙ BitRaser (https://bitraser.com)\n∙ DBAN (https://dban.org)\n∙ DoD-strength data erasers", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71043, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590399", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590399", "securityControlId": 31314, "ccis": [], "uuid": "6696d5fc-a504-56b7-bbb3-5e0eca42a5fa", "testId": "DCH-22_A01", "test": "organization-wide policies for Personal Data (PD) quality management are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-22[01]", "defaultText": null }, { "id": 71044, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590399", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590399", "securityControlId": 31314, "ccis": [], "uuid": "12164f09-968a-5aa3-b641-062e5768980b", "testId": "DCH-22_A02", "test": "organization-wide procedures for Personal Data (PD) quality management are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-22[02]", "defaultText": null }, { "id": 71045, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590399", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590399", "securityControlId": 31314, "ccis": [], "uuid": "9acc6f9e-4f68-5eb6-b4b9-17f49deedb50", "testId": "DCH-22_A03", "test": "the policies address reviewing the accuracy of Personal Data (PD) across the information life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22a.[01]", "defaultText": null }, { "id": 71046, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590399", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590399", "securityControlId": 31314, "ccis": [], "uuid": "3cf521b4-b6eb-58e4-a24d-3961efed1a91", "testId": "DCH-22_A04", "test": "the policies address reviewing the relevance of Personal Data (PD) across the information life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22a.[02]", "defaultText": null }, { "id": 71047, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590399", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590399", "securityControlId": 31314, "ccis": [], "uuid": "5d1a66fa-a7aa-5e69-a654-d059e45249eb", "testId": "DCH-22_A05", "test": "the policies address reviewing the timeliness of Personal Data (PD) across the information life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22a.[03]", "defaultText": null }, { "id": 71048, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590399", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590399", "securityControlId": 31314, "ccis": [], "uuid": "b973dbde-40d0-50e8-9c4d-f69f9d4835de", "testId": "DCH-22_A06", "test": "the policies address reviewing the completeness of Personal Data (PD) across the information life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22a.[04]", "defaultText": null }, { "id": 71049, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590399", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590399", "securityControlId": 31314, "ccis": [], "uuid": "219b11b0-8e19-53ae-b058-77834ed18631", "testId": "DCH-22_A07", "test": "the procedures address reviewing the accuracy of Personal Data (PD) across the information life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22a.[05]", "defaultText": null }, { "id": 71050, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5904", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5904", "securityControlId": 31314, "ccis": [], "uuid": "6400b222-f4a3-5d8d-8f03-1ccd3e94e7d4", "testId": "DCH-22_A08", "test": "the procedures address reviewing the relevance of Personal Data (PD) across the information life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22a.[06]", "defaultText": null }, { "id": 71051, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5904", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5904", "securityControlId": 31314, "ccis": [], "uuid": "bd6252e9-9aaf-5c72-bdf9-337c2648a720", "testId": "DCH-22_A09", "test": "the procedures address reviewing the timeliness of Personal Data (PD) across the information life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22a.[07]", "defaultText": null }, { "id": 71052, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5904", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5904", "securityControlId": 31314, "ccis": [], "uuid": "2312ac4d-0fb7-5e35-b3f9-4178d23f14a2", "testId": "DCH-22_A10", "test": "the procedures address reviewing the completeness of Personal Data (PD) across the information life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22a.[08]", "defaultText": null }, { "id": 71053, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5904", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5904", "securityControlId": 31314, "ccis": [], "uuid": "70d01222-5480-5e12-b7df-cbd3b0e87993", "testId": "DCH-22_A11", "test": "the policies address correcting or deleting inaccurate or outdated Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22b.[01]", "defaultText": null }, { "id": 71054, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5904", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5904", "securityControlId": 31314, "ccis": [], "uuid": "d3d25322-3740-53df-a856-4cdffd514e36", "testId": "DCH-22_A12", "test": "the procedures address correcting or deleting inaccurate or outdated Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22b.[02]", "defaultText": null }, { "id": 71055, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5904", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5904", "securityControlId": 31314, "ccis": [], "uuid": "3077efcb-91be-5c84-ab6a-f3906725a03c", "testId": "DCH-22_A13", "test": "the policies address disseminating notice of corrected or deleted Personal Data (PD) to individuals or other appropriate entities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22c.[01]", "defaultText": null }, { "id": 71056, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5904", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5904", "securityControlId": 31314, "ccis": [], "uuid": "6f84415c-3669-50a4-ae96-ea12cfe47b9b", "testId": "DCH-22_A14", "test": "the procedures address disseminating notice of corrected or deleted Personal Data (PD) to individuals or other appropriate entities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22c.[02]", "defaultText": null }, { "id": 71057, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5904", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5904", "securityControlId": 31314, "ccis": [], "uuid": "7b49a9b2-8a2a-57f4-8392-64ec9b300201", "testId": "DCH-22_A15", "test": "the policies address appeals of adverse decisions on correction or deletion requests.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22d.[01]", "defaultText": null }, { "id": 71058, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590401", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590401", "securityControlId": 31314, "ccis": [], "uuid": "4e7d2431-7137-5798-990d-b98856f9f26a", "testId": "DCH-22_A16", "test": "the procedures address appeals of adverse decisions on correction or deletion requests.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22d.[02]", "defaultText": null }, { "id": 71059, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590401", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590401", "securityControlId": 31314, "ccis": [], "uuid": "33b9b552-145f-527a-85b1-c782b4e3ccdd", "testId": "DCH-22_A17", "test": "the frequency at which to check the accuracy of Personal Data (PD) across the information life cycle is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-18_ODP[01]", "defaultText": null }, { "id": 71060, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590401", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590401", "securityControlId": 31314, "ccis": [], "uuid": "184552fd-40b0-5587-bb6e-7aee20c92036", "testId": "DCH-22_A18", "test": "the frequency at which to check the relevance of Personal Data (PD) across the information life cycle is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-18_ODP[02]", "defaultText": null }, { "id": 71061, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590401", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590401", "securityControlId": 31314, "ccis": [], "uuid": "a86c2cd0-9d5b-54c7-ad55-4e1130fca714", "testId": "DCH-22_A19", "test": "the frequency at which to check the timeliness of Personal Data (PD) across the information life cycle is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-18_ODP[03]", "defaultText": null }, { "id": 71062, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590401", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590401", "securityControlId": 31314, "ccis": [], "uuid": "2a25da63-ac1b-5961-aa10-5a2b999d5f79", "testId": "DCH-22_A20", "test": "the frequency at which to check the completeness of Personal Data (PD) across the information life cycle is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-18_ODP[04]", "defaultText": null }, { "id": 71063, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590402", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590402", "securityControlId": 31314, "ccis": [], "uuid": "6b15e9e9-0277-59fc-9499-2e8ff5d776c7", "testId": "DCH-22_A21", "test": "the accuracy of Personal Data (PD) across the information life cycle is checked frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-18a.[01]", "defaultText": null }, { "id": 71064, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590402", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590402", "securityControlId": 31314, "ccis": [], "uuid": "8c15b01c-140f-545a-9bbb-03e15c0b3fae", "testId": "DCH-22_A22", "test": "the relevance of Personal Data (PD) across the information life cycle is checked frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-18a.[02]", "defaultText": null }, { "id": 71065, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590402", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590402", "securityControlId": 31314, "ccis": [], "uuid": "31fac1cf-1ddb-5636-82bf-8ad6afef4f60", "testId": "DCH-22_A23", "test": "the timeliness of Personal Data (PD) across the information life cycle is checked frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-18a.[03]", "defaultText": null }, { "id": 71066, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590402", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590402", "securityControlId": 31314, "ccis": [], "uuid": "2a4ecabe-cbc1-5ef3-947f-fb1b3041f81d", "testId": "DCH-22_A24", "test": "the completeness of Personal Data (PD) across the information life cycle is checked frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-18a.[04]", "defaultText": null }, { "id": 71067, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590402", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590402", "securityControlId": 31314, "ccis": [], "uuid": "61c82df5-141b-5c57-a07c-a26035c88b44", "testId": "DCH-22_A25", "test": "inaccurate or outdated Personal Data (PD) is corrected or deleted.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-18b.", "defaultText": null }, { "id": 71068, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590402", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590402", "securityControlId": 31314, "ccis": [], "uuid": "e6326877-2eb5-5104-90bb-abdc36ea3f30", "testId": "DCH-22_A26", "test": "automated mechanisms used to correct or delete Personal Data (PD) that is inaccurate, outdated, incorrectly determined regarding impact or incorrectly de-identified are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-18(01)_ODP", "defaultText": null }, { "id": 71069, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590402", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590402", "securityControlId": 31314, "ccis": [], "uuid": "ef28f51f-90e4-509d-9abb-e4bd42e12e0b", "testId": "DCH-22_A27", "test": "automated mechanisms are used to correct or delete Personal Data (PD) that is inaccurate, outdated, incorrectly determined regarding impact or incorrectly de-identified.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-18(01)", "defaultText": null } ], "externalMappings": [ { "id": 569748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b9e7eff-97e2-5a8f-b3f1-df21edb9a238", "parentControlId": 31314, "controlId": "DI-1", "title": "DI-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584753" }, { "id": 569749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9cc0dc1-7548-5d53-b47c-604bac851111", "parentControlId": 31314, "controlId": "PM-22", "title": "PM-22", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584753" }, { "id": 569750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f0536ac-8a46-51e2-aad6-fbd63623068d", "parentControlId": 31314, "controlId": "SI-18", "title": "SI-18", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584753" }, { "id": 569751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584754", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66b38f7b-f5ba-5792-9eb2-4b1fb5296212", "parentControlId": 31314, "controlId": "SI-18(01)", "title": "SI-18(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584754" }, { "id": 569754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584754", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8ae58ca-346c-55ff-9264-4015693a1379", "parentControlId": 31314, "controlId": "PM-22", "title": "PM-22", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584754" }, { "id": 569755, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584754", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2904aaec-3814-595a-83f9-43eb42c18b39", "parentControlId": 31314, "controlId": "SI-18", "title": "SI-18", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584754" }, { "id": 569756, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584754", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c16e45cf-51d8-561f-ad99-9c61041b4318", "parentControlId": 31314, "controlId": "SI-18(01)", "title": "SI-18(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584754" }, { "id": 569757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584754", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66f760fe-857c-5d7e-a782-7aed671c98aa", "parentControlId": 31314, "controlId": "PM-22", "title": "PM-22", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584754" }, { "id": 569758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584754", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d990168a-81b3-5ddd-a034-ad8653b55a43", "parentControlId": 31314, "controlId": "PM-22", "title": "PM-22", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584754" }, { "id": 569759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584754", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a578700-fb48-5906-ac1b-72e79d3c2f77", "parentControlId": 31314, "controlId": "PM-22", "title": "PM-22", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584754" }, { "id": 569760, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584754", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "894cb962-acb6-50b6-a745-8898840cf207", "parentControlId": 31314, "controlId": "PM-22", "title": "PM-22", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584754" }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "70ace293-50da-55be-9595-d798d11cabb5", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "3ff9a0e9-b023-5a87-a7ec-65e0271416da", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "2a82ef94-bf87-57ec-a0ac-9c51e756700d", "isPublic": true } ], "id": 31314, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731043", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731043", "catalogueId": 1062, "uuid": "5d02d4d8-eca3-5dc7-8d33-e432795ed6a5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization check for Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) data to ensure the accuracy, relevance, timeliness, impact, completeness and de-identification of information throughout the information lifecycle.

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Data Quality Operations", "description": "

Control Description

Mechanisms exist to check for Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) data to ensure the accuracy, relevance, timeliness, impact, completeness and de-identification of information throughout the information lifecycle.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to check for Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) data to ensure the accuracy, relevance, timeliness, impact, completeness and de-identification of information throughout the information lifecycle.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "DCH-22", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-22", "references": "

Micro-Small Business (<10 staff)

∙ Product / project management

Small Business (10-49 staff)

∙ Product / project management

Medium Business (50-249 staff)

∙ Product / project management

Large Business (250-999 staff)

∙ Product / project management\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Product / project management\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71070, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590403", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590403", "securityControlId": 31315, "ccis": [], "uuid": "054f25e0-3b4c-5784-a32c-8d3f6acead6a", "testId": "DCH-22.1_A01", "test": "Personal Data (PD) is corrected, or deleted, upon request by individuals or their designated representatives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-18(04)\n53A_R5_SI-18b.", "defaultText": null }, { "id": 71071, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590403", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590403", "securityControlId": 31315, "ccis": [], "uuid": "8e240703-c571-57bc-a018-fce76cb23afe", "testId": "DCH-22.1_A02", "test": "recipients and individuals are notified when their Personal Data (PD) has been corrected or deleted.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-18(05)", "defaultText": null }, { "id": 71072, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590403", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590403", "securityControlId": 31315, "ccis": [], "uuid": "8bfd0f76-6db3-540d-869f-24c04205245d", "testId": "DCH-22.1_A03", "test": "recipients of Personal Data (PD) to be notified when their PD has been corrected or deleted are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-18(05)_ODP", "defaultText": null }, { "id": 71073, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590403", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590403", "securityControlId": 31315, "ccis": [], "uuid": "f8882ab1-fbff-5600-8233-5cc722e44543", "testId": "DCH-22.1_A04", "test": "automated mechanisms used to correct or delete Personal Data (PD) that is inaccurate, outdated, incorrectly determined regarding impact or incorrectly de-identified are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-18(01)_ODP", "defaultText": null }, { "id": 71074, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590403", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590403", "securityControlId": 31315, "ccis": [], "uuid": "af6bd03f-746c-5429-b3ca-ef8d71530512", "testId": "DCH-22.1_A05", "test": "automated mechanisms are used to correct or delete Personal Data (PD) that is inaccurate, outdated, incorrectly determined regarding impact or incorrectly de-identified.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-18(01)", "defaultText": null } ], "externalMappings": [ { "id": 569783, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584757", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cfb5ded7-98a0-56bd-a39c-809ad6145323", "parentControlId": 31315, "controlId": "IP-3", "title": "IP-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584757" }, { "id": 569784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584757", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf2e7c47-4ce2-56aa-8133-ab15e0ffb5ac", "parentControlId": 31315, "controlId": "SI-18(04)", "title": "SI-18(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584757" }, { "id": 569785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584758", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a51a9c0c-323f-5a1b-93ff-ef36a2c3460f", "parentControlId": 31315, "controlId": "SI-18(05)", "title": "SI-18(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584758" }, { "id": 569788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584758", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79db36eb-1d6a-5b08-afaf-66ab47693d0c", "parentControlId": 31315, "controlId": "SI-18(04)", "title": "SI-18(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584758" }, { "id": 569789, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584758", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57a9b519-9b14-53b7-9984-daab6e166b25", "parentControlId": 31315, "controlId": "SI-18(05)", "title": "SI-18(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584758" } ], "id": 31315, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731043", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731043", "catalogueId": 1062, "uuid": "e6f70051-c58e-5d21-8544-f25c9422b2f9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize technical controls to correct Personal Data (PD) that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Updating & Correcting Personal Data (PD)", "description": "

Control Description

Mechanisms exist to utilize technical controls to correct Personal Data (PD) that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize technical controls to correct Personal Data (PD) that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-22.1", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-22.1", "references": "

Micro-Small Business (<10 staff)

∙ Product / project management

Small Business (10-49 staff)

∙ Product / project management

Medium Business (50-249 staff)

∙ Product / project management

Large Business (250-999 staff)

∙ Product / project management\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Product / project management\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71075, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590404", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590404", "securityControlId": 31316, "ccis": [], "uuid": "68ba2fb0-2113-5192-9576-2a60ea26c0bd", "testId": "DCH-22.2_A01", "test": "data tags are employed to automate the correction or deletion of Personal Data (PD) across the information life cycle within organizational systems.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-18(02)", "defaultText": null }, { "id": 71076, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590404", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590404", "securityControlId": 31316, "ccis": [], "uuid": "670bb4cc-86a6-5cee-a47a-0611ceb75b83", "testId": "DCH-22.2_A02", "test": "the authorized processing of Personal Data (PD) is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-02(01)_ODP[01]", "defaultText": null }, { "id": 71077, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590404", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590404", "securityControlId": 31316, "ccis": [], "uuid": "49fa1518-45d0-5340-bacc-48f1c3809c20", "testId": "DCH-22.2_A03", "test": "elements of Personal Data (PD) to be tagged are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-02(01)_ODP[02]\n53A_R5_PT-03(01)_ODP[02]", "defaultText": null }, { "id": 71078, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590404", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590404", "securityControlId": 31316, "ccis": [], "uuid": "deab9fec-9aa0-5917-80b0-a74108e96eea", "testId": "DCH-22.2_A04", "test": "data tags containing authorized processing are attached to elements of Personal Data (PD).
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_PT-02(01)", "defaultText": null }, { "id": 71079, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590404", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590404", "securityControlId": 31316, "ccis": [], "uuid": "b0af9bf6-f97b-5e8d-8dd0-f71c5618256a", "testId": "DCH-22.2_A05", "test": "processing purposes to be contained in data tags are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-03(01)_ODP[01]", "defaultText": null }, { "id": 71080, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590404", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590404", "securityControlId": 31316, "ccis": [], "uuid": "58cc99e5-6ee9-553c-9a82-8566dc078282", "testId": "DCH-22.2_A06", "test": "data tags containing processing purposes are attached to elements of Personal Data (PD).
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_PT-03(01)", "defaultText": null } ], "externalMappings": [ { "id": 569866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6e07f46-227b-59ff-81a2-1ce46a5fe92d", "parentControlId": 31316, "controlId": "PT-02(01)", "title": "PT-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584767" }, { "id": 569867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da771a87-2346-5675-8a05-167fb20efb04", "parentControlId": 31316, "controlId": "PT-03(01)", "title": "PT-03(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584767" }, { "id": 569868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7bfceb3-c3bb-56ac-9c3c-fce0175578b8", "parentControlId": 31316, "controlId": "SI-18(02)", "title": "SI-18(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584767" }, { "id": 569870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c8c19a8-182b-549e-b51f-c61ae4137e30", "parentControlId": 31316, "controlId": "PT-02(01)", "title": "PT-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584767" }, { "id": 569871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "891baf1a-98d7-59ff-a889-5384f40ed852", "parentControlId": 31316, "controlId": "PT-03(01)", "title": "PT-03(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584767" }, { "id": 569872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33a9a408-c6a2-5434-88cc-95ccd9ce4095", "parentControlId": 31316, "controlId": "SI-18(02)", "title": "SI-18(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584767" } ], "id": 31316, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731043", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731043", "catalogueId": 1062, "uuid": "9dfeb2e4-850b-5d4a-852f-c3a02f855e55", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize data tags to automate tracking of sensitive/regulated data across the information lifecycle?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Data Tags", "description": "

Control Description

Mechanisms exist to utilize data tags to automate tracking of sensitive/regulated data across the information lifecycle.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize data tags to automate tracking of sensitive/regulated data across the information lifecycle.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "DCH-22.2", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-22.2", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Metadata tagging

Small Business (10-49 staff)

∙ Data classification program\n∙ Metadata tagging

Medium Business (50-249 staff)

∙ Data classification program\n∙ Metadata tagging

Large Business (250-999 staff)

∙ Data classification program\n∙ Metadata tagging

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Metadata tagging", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71081, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590405", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590405", "securityControlId": 31317, "ccis": [], "uuid": "4fce64a8-1127-5590-a51e-55067074a256", "testId": "DCH-22.3_A01", "test": "Personal Data (PD) is collected directly from the individual.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-18(03)", "defaultText": null } ], "externalMappings": [ { "id": 569880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30ea4738-efab-51e9-a9b4-876c315c8700", "parentControlId": 31317, "controlId": "SI-18(03)", "title": "SI-18(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584768" }, { "id": 569881, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68aab4d2-fc52-5dc2-b915-792ee065354e", "parentControlId": 31317, "controlId": "SI-19(01)", "title": "SI-19(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584768" }, { "id": 569883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d925d62-630e-5a7f-a5c1-119ee6ee53c3", "parentControlId": 31317, "controlId": "SI-18(03)", "title": "SI-18(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584769" }, { "id": 569884, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "272a5b06-176a-51f0-9179-d45cd9c76f76", "parentControlId": 31317, "controlId": "SI-19(01)", "title": "SI-19(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584769" } ], "id": 31317, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731044", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731044", "catalogueId": 1062, "uuid": "ffd7c42a-39b9-5c97-9021-be3d495e00f4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization collect Personal Data (PD) directly from the individual?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Primary Source Personal Data (PD) Collection", "description": "

Control Description

Mechanisms exist to collect Personal Data (PD) directly from the individual.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to collect Personal Data (PD) directly from the individual.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-22.3", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-22.3", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71082, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590405", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590405", "securityControlId": 31318, "ccis": [], "uuid": "1aad0650-83e2-52e8-8587-81cb855b70bc", "testId": "DCH-23_A01", "test": "elements of Personal Data (PD) to be removed from datasets are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-19_ODP[01]", "defaultText": null }, { "id": 71083, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590405", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590405", "securityControlId": 31318, "ccis": [], "uuid": "d243b69f-3c9d-54cf-b6c5-d4b743e3da6b", "testId": "DCH-23_A02", "test": "the frequency at which to evaluate the effectiveness of de-identification is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-19_ODP[02]", "defaultText": null }, { "id": 71084, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590405", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590405", "securityControlId": 31318, "ccis": [], "uuid": "a023a148-f236-5e10-b5ea-a34074e09511", "testId": "DCH-23_A03", "test": "elements are removed from datasets.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-19a.", "defaultText": null }, { "id": 71085, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590405", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590405", "securityControlId": 31318, "ccis": [], "uuid": "3fa0b9cf-a39f-5c46-98e8-6c141002be81", "testId": "DCH-23_A04", "test": "the effectiveness of de-identification is evaluated frequency.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-19b.", "defaultText": null } ], "externalMappings": [ { "id": 569893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58477", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8dd4b39-329e-5d61-bac5-c784da4818f4", "parentControlId": 31318, "controlId": "8.33", "title": "8.33", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58477" }, { "id": 569899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58477", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f172d18-0eec-5411-8666-8e1b4c9d1793", "parentControlId": 31318, "controlId": "DM-1(1)", "title": "DM-1(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58477" }, { "id": 569900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70353389-9b5d-5c46-8d90-226531ef7f52", "parentControlId": 31318, "controlId": "DM-3(1)", "title": "DM-3(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584771" }, { "id": 569901, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02155a2e-5805-518b-b66f-609da21ae77f", "parentControlId": 31318, "controlId": "SI-19", "title": "SI-19", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584771" }, { "id": 569903, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4abd6b5-2b1a-533c-b5b3-347e94278fbd", "parentControlId": 31318, "controlId": "SI-19", "title": "SI-19", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584771" }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "bb644464-1f14-580c-95b1-bfeaf78c72df", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "6cb5bfc7-0861-50b4-98cc-39beb67bc321", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "3e774c53-c259-50ba-b1ac-8e4ad2ab84e4", "isPublic": true } ], "id": 31318, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731044", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731044", "catalogueId": 1062, "uuid": "fb4b1f88-1d98-5200-b423-f0dd43fa1794", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization anonymize data by removing Personal Data (PD) from datasets?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "De-Identification (Anonymization)", "description": "

Control Description

Mechanisms exist to anonymize data by removing Personal Data (PD) from datasets.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to anonymize data by removing Personal Data (PD) from datasets.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-23", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-23", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71086, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590406", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590406", "securityControlId": 31319, "ccis": [], "uuid": "be280640-1b63-54fc-9e45-125e579ff6e1", "testId": "DCH-23.1_A01", "test": "the dataset is de-identified upon collection by not collecting Personal Data (PD).
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-19(01)", "defaultText": null } ], "externalMappings": [ { "id": 569933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584782", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ecd57b5-49bb-50f1-9f19-812fbe70af7f", "parentControlId": 31319, "controlId": "SI-19(01)", "title": "SI-19(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584782" }, { "id": 569935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584783", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0947ed3-b8b4-56dd-aebd-8b40514f9a78", "parentControlId": 31319, "controlId": "SI-19(01)", "title": "SI-19(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584783" } ], "id": 31319, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731045", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731045", "catalogueId": 1062, "uuid": "db0514f2-bb40-5c66-8e14-ff5c59edbfbe", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization de-identify the dataset upon collection by not collecting Personal Data (PD)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "De-Identify Dataset Upon Collection", "description": "

Control Description

Mechanisms exist to de-identify the dataset upon collection by not collecting Personal Data (PD).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to de-identify the dataset upon collection by not collecting Personal Data (PD).

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-23.1", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-23.1", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71087, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590407", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590408", "securityControlId": 31320, "ccis": [], "uuid": "d133c7de-7129-5aa3-a93d-6848fccb0434", "testId": "DCH-23.2_A01", "test": "the archiving of Personal Data (PD) elements is prohibited if those elements in a dataset will not be needed after the dataset is archived.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-19(02)", "defaultText": null } ], "externalMappings": [ { "id": 569940, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584783", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "308741bd-5c3f-5fe4-88fa-f4c3970861d2", "parentControlId": 31320, "controlId": "SI-19(02)", "title": "SI-19(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584783" }, { "id": 569941, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584783", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a852c03f-3ac6-523a-ae01-a16e13c81206", "parentControlId": 31320, "controlId": "SI-19(02)", "title": "SI-19(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584783" } ], "id": 31320, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731045", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731045", "catalogueId": 1062, "uuid": "1c5c1ff8-af63-5fda-9657-ed1c79a6c126", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization refrain from archiving Personal Data (PD) elements if those elements in a dataset will not be needed after the dataset is archived?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Archiving", "description": "

Control Description

Mechanisms exist to refrain from archiving Personal Data (PD) elements if those elements in a dataset will not be needed after the dataset is archived.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to refrain from archiving Personal Data (PD) elements if those elements in a dataset will not be needed after the dataset is archived.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-23.2", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-23.2", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71088, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590408", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590408", "securityControlId": 31321, "ccis": [], "uuid": "325b28a0-1b21-5aab-9f84-b527a10976f9", "testId": "DCH-23.3_A01", "test": "Personal Data (PD) elements are removed from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-19(03)", "defaultText": null } ], "externalMappings": [ { "id": 569942, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8edb2104-47d1-5d5e-b13a-7d16efb9fb36", "parentControlId": 31321, "controlId": "SI-19(03)", "title": "SI-19(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584784" }, { "id": 569943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d25511e-3ee2-5aed-b802-3d98d67cc4b1", "parentControlId": 31321, "controlId": "SI-19(03)", "title": "SI-19(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584784" } ], "id": 31321, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731045", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731045", "catalogueId": 1062, "uuid": "b3b66548-ef0b-5482-aa0c-137061905c97", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization remove Personal Data (PD) elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Release", "description": "

Control Description

Mechanisms exist to remove Personal Data (PD) elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to remove Personal Data (PD) elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-23.3", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-23.3", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71089, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590413", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590413", "securityControlId": 31322, "ccis": [], "uuid": "f6302908-1a53-564e-be1e-8065e4c0b270", "testId": "DCH-23.4_A01", "test": "direct identifiers in a dataset are removed, masked, encrypted, hashed or replaced.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-19(04)", "defaultText": null } ], "externalMappings": [ { "id": 569944, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71e49b4b-6f08-5010-9768-a8bd5fb7a33e", "parentControlId": 31322, "controlId": "8.11", "title": "8.11", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584784" }, { "id": 569946, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f025660-d144-590b-931e-c19184987bd1", "parentControlId": 31322, "controlId": "SI-19(04)", "title": "SI-19(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584784" }, { "id": 569948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "734682f5-92ec-5685-9d1a-3ca947306241", "parentControlId": 31322, "controlId": "SI-19(04)", "title": "SI-19(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584784" } ], "id": 31322, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731046", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731046", "catalogueId": 1062, "uuid": "200529ec-efa0-58a3-be60-d3ae9d9358be", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization remove, mask, encrypt, hash or replace direct identifiers in a dataset?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Removal, Masking, Encryption, Hashing or Replacement of Direct Identifiers", "description": "

Control Description

Mechanisms exist to remove, mask, encrypt, hash or replace direct identifiers in a dataset.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to remove, mask, encrypt, hash or replace direct identifiers in a dataset.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-23.4", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-23.4", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71090, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590414", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590414", "securityControlId": 31323, "ccis": [], "uuid": "7e9ccec5-6777-5cd2-b576-1b885c166436", "testId": "DCH-23.5_A01", "test": "numerical data is manipulated so that no individual or organization is identifiable in the results of the analysis.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-19(05)[01]", "defaultText": null }, { "id": 71091, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590414", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590414", "securityControlId": 31323, "ccis": [], "uuid": "729bc7ba-e41b-5bea-b9fe-4b0fb0bba77d", "testId": "DCH-23.5_A02", "test": "contingency tables are manipulated so that no individual or organization is identifiable in the results of the analysis.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-19(05)[02]", "defaultText": null }, { "id": 71092, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590414", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590414", "securityControlId": 31323, "ccis": [], "uuid": "5002a94c-ca70-502c-8901-a3ed3e7e06d0", "testId": "DCH-23.5_A03", "test": "statistical findings are manipulated so that no individual or organization is identifiable in the results of the analysis.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-19(05)[03]", "defaultText": null } ], "externalMappings": [ { "id": 569955, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584785", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc9e3615-d94b-59a9-881d-ced519f1d609", "parentControlId": 31323, "controlId": "SI-19(05)", "title": "SI-19(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584785" }, { "id": 569956, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584785", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4a8d201-d7ed-5fa3-a178-f874e3723c8d", "parentControlId": 31323, "controlId": "SI-19(05)", "title": "SI-19(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584785" } ], "id": 31323, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731046", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731046", "catalogueId": 1062, "uuid": "d9741222-96c2-5142-a29e-0e2b8bcc3282", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization manipulate numerical data, contingency tables and statistical findings so that no person or organization is identifiable in the results of the analysis?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Statistical Disclosure Control", "description": "

Control Description

Mechanisms exist to manipulate numerical data, contingency tables and statistical findings so that no person or organization is identifiable in the results of the analysis.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to manipulate numerical data, contingency tables and statistical findings so that no person or organization is identifiable in the results of the analysis.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-23.5", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-23.5", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71093, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590414", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590414", "securityControlId": 31324, "ccis": [], "uuid": "4b385ac5-b618-581a-b623-677728cde505", "testId": "DCH-23.6_A01", "test": "the disclosure of Personal Data (PD) is prevented by adding non-deterministic noise to the results of mathematical operations before the results are reported.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-19(06)", "defaultText": null } ], "externalMappings": [ { "id": 569957, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584785", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d62baf6-eb3c-55ca-903c-effae000a7a1", "parentControlId": 31324, "controlId": "SI-19(06)", "title": "SI-19(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584786" }, { "id": 569958, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584786", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ecb38b29-51e9-5d6b-bc7f-0c29295d2384", "parentControlId": 31324, "controlId": "SI-19(06)", "title": "SI-19(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584786" } ], "id": 31324, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731046", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731046", "catalogueId": 1062, "uuid": "7f806931-37ad-5d2d-9268-16e0ed858185", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prevent disclosure of Personal Data (PD) by adding non-deterministic noise to the results of mathematical operations before the results are reported?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Differential Data Privacy", "description": "

Control Description

Mechanisms exist to prevent disclosure of Personal Data (PD) by adding non-deterministic noise to the results of mathematical operations before the results are reported.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prevent disclosure of Personal Data (PD) by adding non-deterministic noise to the results of mathematical operations before the results are reported.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-23.6", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-23.6", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71094, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590415", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590415", "securityControlId": 31325, "ccis": [], "uuid": "e1481e68-1aa2-5526-8639-a052235245e1", "testId": "DCH-23.7_A01", "test": "de-identification is performed using validated algorithms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-19(07)[01]", "defaultText": null }, { "id": 71095, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590415", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590415", "securityControlId": 31325, "ccis": [], "uuid": "15bc09eb-403a-57bf-ba9b-cb972a94df97", "testId": "DCH-23.7_A02", "test": "de-identification is performed using software that is validated to implement the algorithms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-19(07)[02]", "defaultText": null } ], "externalMappings": [ { "id": 569960, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584786", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7234a676-b6f7-5d7f-8faa-f53ea5aec3c7", "parentControlId": 31325, "controlId": "SI-19(07)", "title": "SI-19(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584786" }, { "id": 569961, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584786", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d768242-d30c-586b-b337-12eadaa51b01", "parentControlId": 31325, "controlId": "SI-19(07)", "title": "SI-19(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584786" } ], "id": 31325, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731047", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731047", "catalogueId": 1062, "uuid": "07007ad8-59b8-5bfe-b535-94f89f1a4841", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization perform de-identification of sensitive/regulated data, using validated algorithms and software to implement the algorithms?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Automated De-Identification of Sensitive Data", "description": "

Control Description

Mechanisms exist to perform de-identification of sensitive/regulated data, using validated algorithms and software to implement the algorithms.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to perform de-identification of sensitive/regulated data, using validated algorithms and software to implement the algorithms.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-23.7", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-23.7", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71096, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590415", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590415", "securityControlId": 31326, "ccis": [], "uuid": "ff5169e1-ee2e-5ebf-9c55-47ac86746c08", "testId": "DCH-23.8_A01", "test": "a motivated intruder test is performed on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-19(08)", "defaultText": null } ], "externalMappings": [ { "id": 569962, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584786", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "390bec5a-a926-59c9-94c4-603f5d4803c5", "parentControlId": 31326, "controlId": "SI-19(08)", "title": "SI-19(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584786" }, { "id": 569963, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584786", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b517c8d7-6bba-55ad-bf30-ee8362c815cf", "parentControlId": 31326, "controlId": "SI-19(08)", "title": "SI-19(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584786" } ], "id": 31326, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731047", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731047", "catalogueId": 1062, "uuid": "48d63e0a-1d54-5b69-b6f1-5699989249f8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Motivated Intruder", "description": "

Control Description

Mechanisms exist to perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "DCH-23.8", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-23.8", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Product / project management\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Product / project management\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71098, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590416", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590416", "securityControlId": 31328, "ccis": [], "uuid": "10b24f2d-fcc4-5467-8d13-03bd2eed29ae", "testId": "DCH-24_A01", "test": "information for which the location is to be identified and documented is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-12_ODP", "defaultText": null }, { "id": 71099, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590416", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590416", "securityControlId": 31328, "ccis": [], "uuid": "4830971a-9b3a-50b8-9d1f-262eff17e7e4", "testId": "DCH-24_A02", "test": "the location of sensitive / regulated data is identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-12a.[01]", "defaultText": null }, { "id": 71100, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590416", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590416", "securityControlId": 31328, "ccis": [], "uuid": "a1d9b65f-255f-5bde-943e-090f98766ba3", "testId": "DCH-24_A03", "test": "the specific system components on which organization-defined information is processed are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-12a.[02]", "defaultText": null }, { "id": 71101, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590416", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590416", "securityControlId": 31328, "ccis": [], "uuid": "08ba02b4-151b-52aa-81de-50062fbccb03", "testId": "DCH-24_A04", "test": "the specific system components on which organization-defined information is stored are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-12a.[03]", "defaultText": null }, { "id": 71102, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590416", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590416", "securityControlId": 31328, "ccis": [], "uuid": "c2b02b73-def8-53ee-807e-403bb79c740f", "testId": "DCH-24_A05", "test": "changes to the location (e.g., system or system components) where organization-defined information is processed are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-12c.[01]", "defaultText": null }, { "id": 71103, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590416", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590416", "securityControlId": 31328, "ccis": [], "uuid": "6664e719-2f35-5c94-8486-853395746f06", "testId": "DCH-24_A06", "test": "changes to the location (e.g., system or system components) where organization-defined information is stored are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-12c.[02]", "defaultText": null }, { "id": 71104, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590416", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590416", "securityControlId": 31328, "ccis": [], "uuid": "e7051d02-fceb-5ece-b4a5-4bea82e9ac1a", "testId": "DCH-24_A07", "test": "the users who have access to the system and system components where organization-defined information is processed are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-12b.[01]", "defaultText": null }, { "id": 71105, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590416", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590416", "securityControlId": 31328, "ccis": [], "uuid": "93ab443c-7dbf-5ac5-ba36-50b4ac4a9903", "testId": "DCH-24_A08", "test": "the users who have access to the system and system components where organization-defined information is stored are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-12b.[02]", "defaultText": null }, { "id": 71106, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590417", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590417", "securityControlId": 31328, "ccis": [], "uuid": "73e611b3-f9a6-5e2f-a4c5-b0be6458d996", "testId": "DCH-24_A09", "test": "the location of CUI is identified and documented.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.04.11.a[01]", "defaultText": null } ], "externalMappings": [ { "id": 569967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584787", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77392eec-822f-507e-864a-ba41c57a24f5", "parentControlId": 31328, "controlId": "T1005", "title": "T1005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584787" }, { "id": 569968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584787", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abd4ab57-bda6-509d-b2b5-991fc5e3aecc", "parentControlId": 31328, "controlId": "T1025", "title": "T1025", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584788" }, { "id": 569969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584788", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d6b62ee-e951-5d37-9a76-a825020379fe", "parentControlId": 31328, "controlId": "CM-12", "title": "CM-12", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584788" }, { "id": 569970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584788", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9731655-d9d4-5146-80d0-d413eee6973f", "parentControlId": 31328, "controlId": "CM-12", "title": "CM-12", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584788" }, { "id": 569971, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584788", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5df592f4-0de6-5b95-8fdc-a2c935361322", "parentControlId": 31328, "controlId": "CM-12", "title": "CM-12", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584788" }, { "id": 569972, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584788", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29a0e298-fa1d-5bea-b124-b02a1a8905f9", "parentControlId": 31328, "controlId": "CM-12", "title": "CM-12", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584788" }, { "id": 569973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584788", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65bb225b-257d-5595-bab5-3f2abb333230", "parentControlId": 31328, "controlId": "CM-12", "title": "CM-12", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584788" }, { "id": 569974, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584788", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52730d92-bd0b-51f2-a4d6-af31621231cf", "parentControlId": 31328, "controlId": "CM-12", "title": "CM-12", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584788" }, { "controlId": "NSS-42G-Sec6", "title": "NSS-42G-Sec6 — Protection of Sensitive Nuclear Information (SNI / SGI) & Media Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "27edb67d-9414-55e2-9b70-eaa621322592", "isPublic": true }, { "controlId": "IEC-63096-8.2", "title": "IEC-63096-8.2 — Information Classification, Media Handling, and Sanitization", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "46861ad3-7c6f-5ebc-ba63-4abe19db73e5", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SNI", "title": "ONR-SyAP-FSyP7-SNI — Protection of Sensitive Nuclear Information (SNI)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (DCH Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "bcaebdf6-7e52-5c38-9377-cb425e47e811", "isPublic": true } ], "id": 31328, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731048", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731048", "catalogueId": 1062, "uuid": "8be82ed5-5334-555c-82fa-73caf2e74036", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify and document the location of information and the specific system components on which the information resides?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Information Location", "description": "

Control Description

Mechanisms exist to identify and document the location of information and the specific system components on which the information resides.

Evidence Request List (ERL)

E-AST-23

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to document where sensitive/regulated data is stored, transmitted and/or processed.

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify and document the location of information and the specific system components on which the information resides.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "DCH-24", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-24", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program\n∙ Data classification program\n∙ Sensitive data inventories\n∙ Data Flow Diagram (DFD)\n∙ System Security & Privacy Plan (SSPP)\n∙ Product / project management

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program\n∙ Data classification program\n∙ Sensitive data inventories\n∙ Data Flow Diagram (DFD)\n∙ System Security & Privacy Plan (SSPP)\n∙ Product / project management

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program\n∙ Data classification program\n∙ Sensitive data inventories\n∙ Data Flow Diagram (DFD)\n∙ System Security & Privacy Plan (SSPP)\n∙ Product / project management

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program\n∙ Data classification program\n∙ Sensitive data inventories\n∙ Data Flow Diagram (DFD)\n∙ System Security & Privacy Plan (SSPP)\n∙ Product / project management\n∙ Data governance program

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program\n∙ Data classification program\n∙ Sensitive data inventories\n∙ Data Flow Diagram (DFD)\n∙ System Security & Privacy Plan (SSPP)\n∙ Product / project management\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71107, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590417", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590417", "securityControlId": 31329, "ccis": [], "uuid": "3cd305dd-261b-5752-ab44-8dcfae8c3629", "testId": "DCH-24.1_A01", "test": "information to be protected is defined by information type.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-12(01)_ODP[01]", "defaultText": null }, { "id": 71108, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590417", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590417", "securityControlId": 31329, "ccis": [], "uuid": "752d5c5c-3606-56e8-8a75-2a65677715ca", "testId": "DCH-24.1_A02", "test": "system components where the information is located are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-12(01)_ODP[02]", "defaultText": null }, { "id": 71109, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590417", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590417", "securityControlId": 31329, "ccis": [], "uuid": "359a526d-5862-5fb1-8e61-cb50aab71a23", "testId": "DCH-24.1_A03", "test": "automated tools are used to identify information by information type on system components to ensure that controls are in place to protect organizational information and individual privacy.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-12(01)", "defaultText": null } ], "externalMappings": [ { "id": 570011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584792", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fbbd3f7-9967-5341-99c4-de4a0fab50a8", "parentControlId": 31329, "controlId": "CM-12(01)", "title": "CM-12(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584792" }, { "id": 570012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584792", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12926fcc-6a20-5db3-8e4d-7fa14f5a18d2", "parentControlId": 31329, "controlId": "CM-12(01)", "title": "CM-12(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584792" }, { "id": 570013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584793", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "117ca561-e9ec-539f-a817-48e04e844ebc", "parentControlId": 31329, "controlId": "CM-12(01)", "title": "CM-12(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584793" }, { "id": 570014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584793", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42edd36c-957a-5602-8f6d-c10aee561245", "parentControlId": 31329, "controlId": "CM-12(01)", "title": "CM-12(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584793" }, { "id": 570015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584793", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07dc0f39-f8ef-5fd1-acf9-e51e04995740", "parentControlId": 31329, "controlId": "CM-12(01)", "title": "CM-12(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584793" }, { "id": 570016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584793", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6591ef9-6374-52c2-9194-6d58f23fe1b0", "parentControlId": 31329, "controlId": "CM-12(1)", "title": "CM-12(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584793" } ], "id": 31329, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731048", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731048", "catalogueId": 1062, "uuid": "049b4204-a83f-5a96-90c7-f6c9e3820cc2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify by data classification type to ensure adequate security, compliance and resilience controls are in place to protect organizational information and individual data protection?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 6.0, "title": "Automated Tools to Support Information Location", "description": "

Control Description

Automated mechanisms exist to identify by data classification type to ensure adequate security, compliance and resilience controls are in place to protect organizational information and individual data protection.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Data Classification & Handling (DCH) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with DCH domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.\n▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically identify by data classification type to ensure adequate security, compliance and resilience controls are in place to protect organizational information and individual data protection.

Level 4 - Quantitatively Controlled: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "DCH-24.1", "family": "Data Classification & Handling", "enhancements": "", "sortId": "DCH-24.1", "references": "

Micro-Small Business (<10 staff)

∙ Data Rights Management (DRM) solution

Small Business (10-49 staff)

∙ Data Rights Management (DRM) solution

Medium Business (50-249 staff)

∙ Data Rights Management (DRM) solution

Large Business (250-999 staff)

∙ Data Rights Management (DRM) solution

Enterprise (>1,000 staff)

∙ Data Rights Management (DRM) solution", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71121, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59042", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59042", "securityControlId": 31334, "ccis": [], "uuid": "2f54f2a0-199d-5f90-80b3-13e77747fedb", "testId": "EMB-01_A01", "test": "embedded technology controls are implemented to protect the confidentiality of Operational Technology (OT) and/or Internet of Things (IoT) technologies.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71122, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59042", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59042", "securityControlId": 31334, "ccis": [], "uuid": "f743c551-ef32-53f9-ac21-693e336db859", "testId": "EMB-01_A02", "test": "embedded technology controls are implemented to protect the integrity of Operational Technology (OT) and/or Internet of Things (IoT) technologies.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71123, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59042", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59042", "securityControlId": 31334, "ccis": [], "uuid": "c19d298d-d3f4-557c-9bac-37114fbd14b7", "testId": "EMB-01_A03", "test": "embedded technology controls are implemented to protect the availability of Operational Technology (OT) and/or Internet of Things (IoT) technologies.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71124, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59042", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59042", "securityControlId": 31334, "ccis": [], "uuid": "dd67ba9b-5fa0-5306-ae95-ab5db78da467", "testId": "EMB-01_A04", "test": "embedded technology controls are implemented to protect the safety of Operational Technology (OT) and/or Internet of Things (IoT) technologies.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71125, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59042", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59042", "securityControlId": 31334, "ccis": [], "uuid": "c0c8ff4f-1841-5cdc-8c61-7128f711b32b", "testId": "EMB-01_A05", "test": "embedded technology management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71126, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59042", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59042", "securityControlId": 31334, "ccis": [], "uuid": "ba7a823c-7b21-53d6-9cfb-7cde721e101c", "testId": "EMB-01_A06", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support embedded technology management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71127, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590421", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590421", "securityControlId": 31334, "ccis": [], "uuid": "05f7f9a3-80f4-5454-8054-5fa34aafac6b", "testId": "EMB-01_A07", "test": "responsibility and authority for the performance of embedded technology management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71128, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590421", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590421", "securityControlId": 31334, "ccis": [], "uuid": "e9786cc6-7af9-5e41-9bd8-82fcb4b42838", "testId": "EMB-01_A08", "test": "personnel performing embedded technology management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 570183, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04f60427-c0ce-508a-a7fc-7f87ab5c8f81", "parentControlId": 31334, "controlId": "ARCHITECTURE-2j", "title": "ARCHITECTURE-2j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584812" }, { "controlId": "NSS-17T-Sec6.2", "title": "NSS-17T-Sec6.2 — Instrumentation & Control (I&C) Safety-Security Interface", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7777c042-5d61-5478-a47b-afc9d1d5baf5", "isPublic": true }, { "controlId": "IEC-62645-7", "title": "IEC-62645-7 — System & I&C Platform Level Cybersecurity Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "90e0b69d-d0f9-5d6b-ab8e-0a0dc6fce511", "isPublic": true }, { "controlId": "IEC-63096-14.2", "title": "IEC-63096-14.2 — Security in I&C Development and Plant Integration", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "606dfc08-f27f-5b56-8179-cbc9c11bc6ca", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5", "title": "IEEE-7-4.3.2-5.5 — System Integrity, Fail-Safe State, & Control of Access in Digital Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "ee5d1449-69b1-5145-b559-abc3a86af343", "isPublic": true }, { "controlId": "10-CFR-73.100(e)", "title": "10-CFR-73.100(e) — Passive Safety & Embedded Digital I&C Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "ad1a03cf-be4c-5866-ae15-df1b6dca0d81", "isPublic": true } ], "id": 31334, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73105", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73105", "catalogueId": 1062, "uuid": "d73ba8fc-728c-5096-9d26-b3b1126d31be", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of embedded technology controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Embedded Technology Security Program", "description": "

Control Description

Mechanisms exist to facilitate the implementation of embedded technology controls.

Evidence Request List (ERL)

E-AST-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Embedded Technology (EMB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with EMB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Embedded technology management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Embedded technologies (e.g., Operational Technology (OT) and Internet of Things (IoT) are managed in the same manner as any other technology asset.

Level 2 - Planned & Tracked: Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Embedded technologies (e.g., IoT and OT) are governed according to the same processes used for generic Technology Assets, Applications and/or Services (TAAS), where no formal, dedicated embedded technology governance process exists.\n▪ Business stakeholders and process owners are expected to take the initiative to work with IT and/or cybersecurity personnel to ensure applicable statutory, regulatory and/or contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data.\n▪ Secure Baseline Configurations (SBCs) protect embedded technologies commensurate with the criticality of the device and/or sensitivity of the data, in accordance with applicable laws, regulations and frameworks.

Level 3 - Well Defined: Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.\n▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of embedded technology controls.

Level 4 - Quantitatively Controlled: Embedded Technology (EMB) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "EMB-01", "family": "Embedded Technology", "enhancements": "", "sortId": "EMB-01", "references": "

Micro-Small Business (<10 staff)

∙ IT Asset Management (ITAM) program

Small Business (10-49 staff)

∙ IT Asset Management (ITAM) program

Medium Business (50-249 staff)

∙ IT Asset Management (ITAM) program

Large Business (250-999 staff)

∙ IT Asset Management (ITAM) program

Enterprise (>1,000 staff)

∙ IT Asset Management (ITAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71130, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590421", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590421", "securityControlId": 31336, "ccis": [], "uuid": "c55e93e9-273d-586c-981d-6ca001174e62", "testId": "EMB-03_A01", "test": "cybersecurity / data privacy risks associated with Operational Technology (OT) are proactively managed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "controlId": "A.3.1.3", "title": "A.3.1.3 — Identification of Critical Digital Assets", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-8, RA-2, PL-2, SA-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "fb1282df-233a-5fae-9fb2-71c8a05768aa", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.3 / NEI 13-10", "title": "NEI 08-09 Sec 3.1.3 / NEI 13-10 — Identification of Critical Digital Assets", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "69119b47-adbd-5b2d-9168-0fda20b1c0fc", "isPublic": true }, { "controlId": "10 CFR 73.54(a)(1), (b)(1)", "title": "10 CFR 73.54(a)(1), (b)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "b29063f3-ee99-5726-a622-35641d30ff84", "isPublic": true }, { "controlId": "A.3.1.5", "title": "A.3.1.5 — Defense-in-Depth Protective Strategies", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, PL-8, PM-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "2afb1e39-4fbd-5b02-be77-18203e4fe1ca", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.5 / Sec 3.2", "title": "NEI 08-09 Sec 3.1.5 / Sec 3.2 — Defense-in-Depth Protective Strategies", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6cc9f2a6-4f74-5681-9219-134c3cca84a1", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(2)", "title": "10 CFR 73.54(c)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "2508e238-9581-51c1-ad4f-764cb3fd9137", "isPublic": true }, { "controlId": "B.1.20", "title": "B.1.20 — Proprietary Protocol Visibility", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-4, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "2639993c-33a6-570a-8e37-34843521f1a4", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.20", "title": "NEI 08-09 App D.1.20 — Proprietary Protocol Visibility", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.20", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e5ab4557-feb0-52fb-9699-1c7c140158fc", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.20", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "e77c9306-27d6-558a-956f-0880c5d41c1d", "isPublic": true }, { "controlId": "B.3.22", "title": "B.3.22 — Fail in Known State", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-24", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "72b179e1-1bc8-5956-961f-40500f02f2b7", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.22", "title": "NEI 08-09 App D.3.22 — Fail in Known State", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.22", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "c9d769e3-19ee-5532-b3f6-9d687d5a2510", "isPublic": true }, { "controlId": "B.4.4", "title": "B.4.4 — Non-Authenticated Human Machine Interaction Security", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-14, IA-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "10a64dd3-e5be-572d-be2f-326b88179f13", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.4", "title": "NEI 08-09 App D.4.4 — Non-Authenticated Human Machine Interaction Security", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "82f56601-b7b4-5507-9628-8ab8b52f3250", "isPublic": true }, { "controlId": "C.3.11", "title": "C.3.11 — Anticipated Failure Response", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-13, CP-10", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "9d438aa6-967b-5d68-b966-178d82f3d422", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.11", "title": "NEI 08-09 App E.3.11 — Anticipated Failure Response", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.11", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "8d3a7fad-c96e-5295-a1b8-a8559a834f13", "isPublic": true }, { "controlId": "C.6", "title": "C.6 — Defensive Strategy", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, PL-8, CA-9", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "db36bcd9-319a-54f3-b5f4-33a374fe2bbf", "isPublic": true }, { "controlId": "NEI 08-09 App E.6", "title": "NEI 08-09 App E.6 — Defensive Strategy", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "79f9057d-15c8-512e-aede-8961fd117566", "isPublic": true }, { "controlId": "C.7", "title": "C.7 — Defense-in-Depth", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, AC-4, SC-7(21)", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "112ca5ce-b33f-570b-9f6a-e3e4de834e9f", "isPublic": true }, { "controlId": "NEI 08-09 App E.7 / RG 1.152 Rev 4", "title": "NEI 08-09 App E.7 / RG 1.152 Rev 4 — Defense-in-Depth", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "935f1954-a5a3-54f7-8e51-48adfedf0e95", "isPublic": true }, { "controlId": "CIP-002-5.1a-R1", "title": "CIP-002-5.1a-R1 — BES Cyber System Categorization Process", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "db31d907-b181-51b9-9ebe-8951fec6a5ba", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.1", "title": "CIP-002-5.1a-1.1 — Identify each of the high impact BES Cyber Systems according to Attachment 1, Section 1, if any, at each asset", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e578d049-952b-54d6-9443-5da53a079189", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.2", "title": "CIP-002-5.1a-1.2 — Identify each of the medium impact BES Cyber Systems according to Attachment 1, Section 2, if any, at each asset", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0c647204-0106-5307-b7d5-d681e76637e0", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.3", "title": "CIP-002-5.1a-1.3 — Identify each asset that contains a low impact BES Cyber System according to Attachment 1, Section 3, if any (a discr...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c62cb52d-3c55-564c-9719-caea00f440ca", "isPublic": true }, { "controlId": "CIP-003-8-R2", "title": "CIP-003-8-R2 — Cyber Security Plan Implementation for Low Impact BES Cyber Systems", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "17a3eda4-607a-59d1-aa0a-4f3234264ba4", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec1", "title": "CIP-003-9-Attachment1-Sec1 — Low Impact Cyber Security Awareness", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "300ae613-3c87-55fe-bfde-99b0e535083e", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec2", "title": "CIP-003-9-Attachment1-Sec2 — Low Impact Physical Security Controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "92cc2756-4a42-57fc-9de8-ad29b7211196", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec3", "title": "CIP-003-9-Attachment1-Sec3 — Low Impact Electronic Access Controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "52d53d48-db2d-57e7-a87b-0954722b48b5", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec4", "title": "CIP-003-9-Attachment1-Sec4 — Low Impact Cyber Security Incident Response", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0fc5425b-8c26-5c9b-9f2f-e8595a7921ec", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec5", "title": "CIP-003-9-Attachment1-Sec5 — Low Impact Transient Cyber Asset and Removable Media Malicious Code Risk Mitigation", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9630eb58-01ee-5763-9a03-3d7f2165c578", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec6", "title": "CIP-003-9-Attachment1-Sec6 — Low Impact Vendor Electronic Remote Access Security Controls (CIP-003-9)", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "be38b474-190a-5985-bf19-05bc0e85d8a5", "isPublic": true }, { "controlId": "CIP-005-7-R1", "title": "CIP-005-7-R1 — Electronic Security Perimeter Implementation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8a0e43f6-2cd1-57b8-ac4c-82ba4c5c98dc", "isPublic": true }, { "controlId": "CIP-005-7-1.1", "title": "CIP-005-7-1.1 — All applicable Cyber Assets connected to a network via a routable protocol shall reside within a defined ESP.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "384bce49-1ec0-5cd1-a4fa-ed0aceae02f2", "isPublic": true }, { "controlId": "CIP-005-7-1.2", "title": "CIP-005-7-1.2 — All External Routable Connectivity must be through an identified Electronic Access Point (EAP).", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2b608107-ff0d-5734-819b-53fd313d6248", "isPublic": true }, { "controlId": "CIP-005-7-1.3", "title": "CIP-005-7-1.3 — Require inbound and outbound access permissions, including the reason for granting access, and deny all other access...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8cba2952-57cd-53a9-8750-c390813a4459", "isPublic": true }, { "controlId": "CIP-005-7-1.4", "title": "CIP-005-7-1.4 — Where technically feasible, perform authentication when establishing Dial-up Connectivity with applicable Cyber Assets.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2d04f004-bd49-5163-b61e-98b98da1d00b", "isPublic": true }, { "controlId": "CIP-005-7-1.5", "title": "CIP-005-7-1.5 — Have one or more methods for detecting known or suspected malicious communications for both inbound and outbound comm...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d40c1cbe-bb85-5832-a661-ceaf0d70fc29", "isPublic": true }, { "controlId": "CIP-012-1-R1", "title": "CIP-012-1-R1 — Real-time Assessment and Monitoring Data Protection Between Control Centers", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c3c8404b-f19f-54bc-a0de-d93f67de5ed3", "isPublic": true }, { "controlId": "CIP-012-1-1.1", "title": "CIP-012-1-1.1 — Identification of security protection used to mitigate the risks posed by unauthorized disclosure and unauthorized mo...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-012-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "61970101-eb50-578a-972f-05e22b7fba29", "isPublic": true }, { "controlId": "CIP-012-1-1.2", "title": "CIP-012-1-1.2 — Identification of where the Responsible Entity applied security protection for transmitting Real-time Assessment and...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-012-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "fa7ecaa3-6100-58f0-bae8-8d9898c5056e", "isPublic": true }, { "controlId": "CIP-012-1-1.3", "title": "CIP-012-1-1.3 — If the Control Centers are owned or operated by different Responsible Entities, identification of the responsibilitie...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-012-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "cd88c6f8-e071-5a3d-8b36-00972eaebef9", "isPublic": true }, { "controlId": "CIP-012-2-1.1", "title": "CIP-012-2-1.1 — Risk Mitigation for Availability, Integrity, and Confidentiality of Real-Time Data (CIP-012-2)", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-012-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "cdcd0a49-ccf0-5316-8fe4-f571e6e3e57d", "isPublic": true }, { "controlId": "NSS-17T-Sec6.2", "title": "NSS-17T-Sec6.2 — Instrumentation & Control (I&C) Safety-Security Interface", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "be2d245b-ae14-5368-b7fe-3b6a0b7ace57", "isPublic": true }, { "controlId": "IEC-62645-7", "title": "IEC-62645-7 — System & I&C Platform Level Cybersecurity Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "a9d28ead-a88e-5745-8a23-2458d98ef53f", "isPublic": true }, { "controlId": "IEC-63096-14.2", "title": "IEC-63096-14.2 — Security in I&C Development and Plant Integration", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "f6e83a1b-049a-50b5-befa-8f7ecc3cbe2a", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5", "title": "IEEE-7-4.3.2-5.5 — System Integrity, Fail-Safe State, & Control of Access in Digital Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "c633e691-e002-599f-9c47-012849668888", "isPublic": true }, { "controlId": "10-CFR-73.100(e)", "title": "10-CFR-73.100(e) — Passive Safety & Embedded Digital I&C Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "bb3473a1-04e3-59da-b425-0f860c811251", "isPublic": true } ], "id": 31336, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731051", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731051", "catalogueId": 1062, "uuid": "16221c13-0b7e-5ae0-9d94-7632613276c1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization proactively manage the security, compliance and resilience risks associated with Operational Technology (OT)?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Operational Technology (OT)", "description": "

Control Description

Mechanisms exist to proactively manage the security, compliance and resilience risks associated with Operational Technology (OT).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Embedded Technology (EMB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with EMB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Embedded technology management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Embedded technologies (e.g., Operational Technology (OT) and Internet of Things (IoT) are managed in the same manner as any other technology asset.

Level 2 - Planned & Tracked: Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Embedded technologies (e.g., IoT and OT) are governed according to the same processes used for generic Technology Assets, Applications and/or Services (TAAS), where no formal, dedicated embedded technology governance process exists.\n▪ Business stakeholders and process owners are expected to take the initiative to work with IT and/or cybersecurity personnel to ensure applicable statutory, regulatory and/or contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data.\n▪ Secure Baseline Configurations (SBCs) protect embedded technologies commensurate with the criticality of the device and/or sensitivity of the data, in accordance with applicable laws, regulations and frameworks.\n▪ Special baselines for embedded technologies configurations are created for higher-risk environments.\n▪ Unauthorized configuration changes to embedded technologies are responded to in accordance with an Incident Response Plan (IRP) to determine if the unauthorized configuration is malicious in nature.

Level 3 - Well Defined: Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.\n▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to proactively manage the security, compliance and resilience risks associated with Operational Technology (OT).

Level 4 - Quantitatively Controlled: Embedded Technology (EMB) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.3, A.3.1.5, B.1.20, B.3.22, B.4.4, C.3.11, C.6, C.7
NERC-CIP (2026) Requirements: CIP-002-5.1a-R1, CIP-003-8-R2, CIP-005-7-R1, CIP-012-1-R1", "controlId": "EMB-03", "family": "Embedded Technology", "enhancements": "", "sortId": "EMB-03", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program\n∙ Data classification program\n∙ Sensitive data inventories\n∙ Data Flow Diagram (DFD)\n∙ System Security & Privacy Plan (SSPP)\n∙ Product / project management

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program\n∙ Data classification program\n∙ Sensitive data inventories\n∙ Data Flow Diagram (DFD)\n∙ System Security & Privacy Plan (SSPP)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program\n∙ Data classification program\n∙ Sensitive data inventories\n∙ Data Flow Diagram (DFD)\n∙ System Security & Privacy Plan (SSPP)\n∙ Product / project management

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program\n∙ Data classification program\n∙ Sensitive data inventories\n∙ Data Flow Diagram (DFD)\n∙ System Security & Privacy Plan (SSPP)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program\n∙ Data classification program\n∙ Sensitive data inventories\n∙ Data Flow Diagram (DFD)\n∙ System Security & Privacy Plan (SSPP)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71131, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590421", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590421", "securityControlId": 31337, "ccis": [], "uuid": "f1ed196a-ddcc-5531-88b3-e3f22871fcd0", "testId": "EMB-04_A01", "test": "embedded devices are protected against unauthorized use of the physical factory diagnostic and test interface(s).
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "controlId": "C.7", "title": "C.7 — Defense-in-Depth", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, AC-4, SC-7(21)", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "697acd78-05af-5d1c-8a6b-8530de46445d", "isPublic": true }, { "controlId": "NEI 08-09 App E.7 / RG 1.152 Rev 4", "title": "NEI 08-09 App E.7 / RG 1.152 Rev 4 — Defense-in-Depth", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "186247c5-3922-579e-aea7-34ee5ea38c25", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(2)", "title": "10 CFR 73.54(c)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.7", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "e2e3bab9-9a10-582d-87d3-e6d5273437ab", "isPublic": true }, { "controlId": "NSS-17T-Sec6.2", "title": "NSS-17T-Sec6.2 — Instrumentation & Control (I&C) Safety-Security Interface", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "78fe5191-08a5-5ad7-b777-6f417e7c4c90", "isPublic": true }, { "controlId": "IEC-62645-7", "title": "IEC-62645-7 — System & I&C Platform Level Cybersecurity Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "ae9cb7cd-7c0d-535c-9b73-e4157eeeb9f6", "isPublic": true }, { "controlId": "IEC-63096-14.2", "title": "IEC-63096-14.2 — Security in I&C Development and Plant Integration", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "2e1c039c-4e2c-59bd-acb0-4ec2209bd723", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5", "title": "IEEE-7-4.3.2-5.5 — System Integrity, Fail-Safe State, & Control of Access in Digital Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "35a43ee6-2ca8-5da7-805a-18bd915ea769", "isPublic": true }, { "controlId": "10-CFR-73.100(e)", "title": "10-CFR-73.100(e) — Passive Safety & Embedded Digital I&C Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "0038822f-bb51-5e6e-a115-291d4d1f5ab6", "isPublic": true } ], "id": 31337, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731051", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731051", "catalogueId": 1062, "uuid": "97b05df3-5450-5ff4-99d8-4a45dda75068", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect embedded devices against unauthorized use of the physical factory diagnostic and test interface(s)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Interface Security", "description": "

Control Description

Mechanisms exist to protect embedded devices against unauthorized use of the physical factory diagnostic and test interface(s).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Embedded technologies (e.g., IoT and OT) are governed according to the same processes used for generic Technology Assets, Applications and/or Services (TAAS), where no formal, dedicated embedded technology governance process exists.\n▪ Business stakeholders and process owners are expected to take the initiative to work with IT and/or cybersecurity personnel to ensure applicable statutory, regulatory and/or contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data.\n▪ Secure Baseline Configurations (SBCs) protect embedded technologies commensurate with the criticality of the device and/or sensitivity of the data, in accordance with applicable laws, regulations and frameworks.\n▪ Special baselines for embedded technologies configurations are created for higher-risk environments.

Level 3 - Well Defined: Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.\n▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to protect embedded devices against unauthorized use of the physical factory diagnostic and test interface(s).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.7", "controlId": "EMB-04", "family": "Embedded Technology", "enhancements": "", "sortId": "EMB-04", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71132, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590422", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590422", "securityControlId": 31338, "ccis": [], "uuid": "bac4bd87-25d2-5eba-a809-0b0977a8b636", "testId": "EMB-05_A01", "test": "embedded devices generate log entries when configuration changes or attempts to access interfaces are detected.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 570231, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584818", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7a80246-1379-567a-8e49-3c4c89329e06", "parentControlId": 31338, "controlId": "EDR 3.11(1)", "title": "EDR 3.11(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584818" }, { "controlId": "NSS-17T-Sec6.2", "title": "NSS-17T-Sec6.2 — Instrumentation & Control (I&C) Safety-Security Interface", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "e78c784d-7fbc-5828-85ef-3341a5386cba", "isPublic": true }, { "controlId": "IEC-62645-7", "title": "IEC-62645-7 — System & I&C Platform Level Cybersecurity Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "ff251965-596b-5f1f-8b3d-3061757ba085", "isPublic": true }, { "controlId": "IEC-63096-14.2", "title": "IEC-63096-14.2 — Security in I&C Development and Plant Integration", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "611fafa5-07df-5258-9208-29031ca23cff", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5", "title": "IEEE-7-4.3.2-5.5 — System Integrity, Fail-Safe State, & Control of Access in Digital Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "f52cb146-0560-5c6c-a63e-9c001c080361", "isPublic": true }, { "controlId": "10-CFR-73.100(e)", "title": "10-CFR-73.100(e) — Passive Safety & Embedded Digital I&C Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "8abf5b65-12de-5151-871b-c14823726756", "isPublic": true } ], "id": 31338, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731052", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731052", "catalogueId": 1062, "uuid": "d30cf6e4-fbb6-5363-bace-71ee304d028a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization generate log entries on embedded devices when configuration changes or attempts to access interfaces are detected?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Embedded Technology Configuration Monitoring", "description": "

Control Description

Mechanisms exist to generate log entries on embedded devices when configuration changes or attempts to access interfaces are detected.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Embedded technologies (e.g., IoT and OT) are governed according to the same processes used for generic Technology Assets, Applications and/or Services (TAAS), where no formal, dedicated embedded technology governance process exists.\n▪ Business stakeholders and process owners are expected to take the initiative to work with IT and/or cybersecurity personnel to ensure applicable statutory, regulatory and/or contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data.\n▪ Secure Baseline Configurations (SBCs) protect embedded technologies commensurate with the criticality of the device and/or sensitivity of the data, in accordance with applicable laws, regulations and frameworks.\n▪ Unauthorized configuration changes to embedded technologies are responded to in accordance with an Incident Response Plan (IRP) to determine if the unauthorized configuration is malicious in nature.

Level 3 - Well Defined: Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.\n▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to generate log entries on embedded devices when configuration changes or attempts to access interfaces are detected.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "EMB-05", "family": "Embedded Technology", "enhancements": "", "sortId": "EMB-05", "references": "

Micro-Small Business (<10 staff)

∙ Inventory embedded devices and document security settings

Small Business (10-49 staff)

∙ Embedded device inventory\n∙ Default credential change policy

Medium Business (50-249 staff)

∙ Embedded/IoT device security program\n∙ Network segmentation for IoT

Large Business (250-999 staff)

∙ IoT/OT security program\n∙ Network segmentation\n∙ IoT security platform (e.g., Claroty, Armis)

Enterprise (>1,000 staff)

∙ Enterprise IoT/OT security platform (e.g., Claroty, Armis, Dragos)\n∙ Zero-trust IoT architecture", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71133, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590422", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590422", "securityControlId": 31339, "ccis": [], "uuid": "3c857da7-6ab5-5552-844c-f9e10043dac7", "testId": "EMB-06_A01", "test": "embedded devices are protected by preventing the unauthorized installation and execution of software.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 570239, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f562d07-9992-5e63-a57d-feb177a46572", "parentControlId": 31339, "controlId": "EDR 3.2", "title": "EDR 3.2", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584819" }, { "controlId": "NSS-17T-Sec6.2", "title": "NSS-17T-Sec6.2 — Instrumentation & Control (I&C) Safety-Security Interface", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "ffc40c46-a0f9-5b40-b637-6042fa8cb53d", "isPublic": true }, { "controlId": "IEC-62645-7", "title": "IEC-62645-7 — System & I&C Platform Level Cybersecurity Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "081b3ebb-3b30-5b8d-9782-a3035408b2e2", "isPublic": true }, { "controlId": "IEC-63096-14.2", "title": "IEC-63096-14.2 — Security in I&C Development and Plant Integration", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "cf072c34-f568-502c-8baf-20788b5a46c0", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5", "title": "IEEE-7-4.3.2-5.5 — System Integrity, Fail-Safe State, & Control of Access in Digital Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "3c119e0b-a0c2-5aaa-aa0c-be2b950c2a3c", "isPublic": true }, { "controlId": "10-CFR-73.100(e)", "title": "10-CFR-73.100(e) — Passive Safety & Embedded Digital I&C Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "70a6c710-073d-535e-9cf4-ff5af5472ead", "isPublic": true } ], "id": 31339, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731052", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731052", "catalogueId": 1062, "uuid": "7ad29c56-6ec2-5730-9b84-1b6cdd738eb9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect embedded devices by preventing the unauthorized installation and execution of software?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Prevent Alterations", "description": "

Control Description

Mechanisms exist to protect embedded devices by preventing the unauthorized installation and execution of software.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Embedded technologies (e.g., IoT and OT) are governed according to the same processes used for generic Technology Assets, Applications and/or Services (TAAS), where no formal, dedicated embedded technology governance process exists.\n▪ Business stakeholders and process owners are expected to take the initiative to work with IT and/or cybersecurity personnel to ensure applicable statutory, regulatory and/or contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data.\n▪ Secure Baseline Configurations (SBCs) protect embedded technologies commensurate with the criticality of the device and/or sensitivity of the data, in accordance with applicable laws, regulations and frameworks.\n▪ Unauthorized configuration changes to embedded technologies are responded to in accordance with an Incident Response Plan (IRP) to determine if the unauthorized configuration is malicious in nature.

Level 3 - Well Defined: Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.\n▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to protect embedded devices by preventing the unauthorized installation and execution of software.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "EMB-06", "family": "Embedded Technology", "enhancements": "", "sortId": "EMB-06", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71143, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590431", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590431", "securityControlId": 31348, "ccis": [], "uuid": "fb28a2b7-1cdb-5b40-b3e0-28cc59adf452", "testId": "EMB-15_A01", "test": "the safety aspects of embedded technologies are evaluated via a fault tree analysis or similar method, to determine possible consequences of misuse, misconfiguration and/or failure.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 570310, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584836", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4592703-9b5e-51f9-b29b-95d74e5852db", "parentControlId": 31348, "controlId": "DATA 1.3", "title": "DATA 1.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584836" }, { "controlId": "NSS-17T-Sec6.2", "title": "NSS-17T-Sec6.2 — Instrumentation & Control (I&C) Safety-Security Interface", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "f0b98290-9bab-5be0-8e63-a420d5ffbd6f", "isPublic": true }, { "controlId": "IEC-62645-7", "title": "IEC-62645-7 — System & I&C Platform Level Cybersecurity Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "a07a7cc1-aabd-5404-b7d4-fd9246003150", "isPublic": true }, { "controlId": "IEC-63096-14.2", "title": "IEC-63096-14.2 — Security in I&C Development and Plant Integration", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "5cf61201-6fe4-5d9a-8236-5f278a821fc6", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5", "title": "IEEE-7-4.3.2-5.5 — System Integrity, Fail-Safe State, & Control of Access in Digital Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "182a1aa4-69e0-58f4-868b-64815c9eedc4", "isPublic": true }, { "controlId": "10-CFR-73.100(e)", "title": "10-CFR-73.100(e) — Passive Safety & Embedded Digital I&C Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "0fc8821a-f621-5586-b0c0-bc5808acec94", "isPublic": true } ], "id": 31348, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731055", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731055", "catalogueId": 1062, "uuid": "46b21144-0d14-5003-8ad8-5019c681c9d0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization evaluate the safety aspects of embedded technologies via a fault tree analysis, or similar method, to determine possible consequences of misuse, misconfiguration and/or failure?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Safety Assessment", "description": "

Control Description

Mechanisms exist to evaluate the safety aspects of embedded technologies via a fault tree analysis, or similar method, to determine possible consequences of misuse, misconfiguration and/or failure.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.\n▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to evaluate the safety aspects of embedded technologies via a fault tree analysis, or similar method, to determine possible consequences of misuse, misconfiguration and/or failure.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "EMB-15", "family": "Embedded Technology", "enhancements": "", "sortId": "EMB-15", "references": "

Micro-Small Business (<10 staff)

∙ IoT / OT safety assessment\n∙ Data Protection Impact Assessment (DPIA)

Small Business (10-49 staff)

∙ IoT / OT safety assessment\n∙ Data Protection Impact Assessment (DPIA)

Medium Business (50-249 staff)

∙ IoT / OT safety assessment\n∙ Data Protection Impact Assessment (DPIA)

Large Business (250-999 staff)

∙ IoT / OT safety assessment\n∙ Data Protection Impact Assessment (DPIA)

Enterprise (>1,000 staff)

∙ IoT / OT safety assessment\n∙ Data Protection Impact Assessment (DPIA)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71144, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590431", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590431", "securityControlId": 31349, "ccis": [], "uuid": "26af7602-33c7-5bfe-a501-094b4f826b0e", "testId": "EMB-16_A01", "test": "certificate-based authentication is enforced for embedded technologies (e.g., IoT, OT, etc.) and their supporting services.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 570316, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22c1be85-a748-5c98-b263-fd176bf64f32", "parentControlId": 31349, "controlId": "EDR 3.10(1)", "title": "EDR 3.10(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584837" }, { "id": 570317, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cce5657a-951b-58a1-8a20-a25d46a5b7a6", "parentControlId": 31349, "controlId": "HDR 2.4(1)", "title": "HDR 2.4(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584837" }, { "controlId": "NSS-17T-Sec6.2", "title": "NSS-17T-Sec6.2 — Instrumentation & Control (I&C) Safety-Security Interface", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "73670b52-fa96-5eac-8df3-3a168bb591b3", "isPublic": true }, { "controlId": "IEC-62645-7", "title": "IEC-62645-7 — System & I&C Platform Level Cybersecurity Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "0b41c954-b6c0-553d-a100-d76c75b6b046", "isPublic": true }, { "controlId": "IEC-63096-14.2", "title": "IEC-63096-14.2 — Security in I&C Development and Plant Integration", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "12c7eada-793b-59c5-802e-d539e8bf2310", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5", "title": "IEEE-7-4.3.2-5.5 — System Integrity, Fail-Safe State, & Control of Access in Digital Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "9a807425-615b-5a36-8563-dca9b7a7d437", "isPublic": true }, { "controlId": "10-CFR-73.100(e)", "title": "10-CFR-73.100(e) — Passive Safety & Embedded Digital I&C Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (EMB Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "5f30d94b-ed4a-5d12-acd6-5dfc89b2a227", "isPublic": true } ], "id": 31349, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731055", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731055", "catalogueId": 1062, "uuid": "fb05fdca-16e3-5f9d-b683-fcdd138b4742", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce certificate-based authentication for embedded technologies (e.g., IoT, OT, etc.) and their supporting services?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Certificate-Based Authentication", "description": "

Control Description

Mechanisms exist to enforce certificate-based authentication for embedded technologies (e.g., IoT, OT, etc.) and their supporting services.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.\n▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enforce certificate-based authentication for embedded technologies (e.g., IoT, OT, etc.) and their supporting services.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "EMB-16", "family": "Embedded Technology", "enhancements": "", "sortId": "EMB-16", "references": "

Micro-Small Business (<10 staff)

∙ Inventory embedded devices and document security settings

Small Business (10-49 staff)

∙ Embedded device inventory\n∙ Default credential change policy

Medium Business (50-249 staff)

∙ Embedded/IoT device security program\n∙ Network segmentation for IoT

Large Business (250-999 staff)

∙ IoT/OT security program\n∙ Network segmentation\n∙ IoT security platform (e.g., Claroty, Armis)

Enterprise (>1,000 staff)

∙ Enterprise IoT/OT security platform (e.g., Claroty, Armis, Dragos)\n∙ Zero-trust IoT architecture", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71148, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590432", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590432", "securityControlId": 31353, "ccis": [], "uuid": "f2202fc9-214f-5069-894c-ee92f0f46d8a", "testId": "END-01_A01", "test": "security configuration settings for information technology products employed in the system are established and included in the baseline configuration.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.4.2[a]", "defaultText": null }, { "id": 71149, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590432", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590432", "securityControlId": 31353, "ccis": [], "uuid": "339779e6-1875-5112-acd1-b4a940363b30", "testId": "END-01_A02", "test": "a current baseline configuration for systems, applications and services is developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.1[a]\n53A_R5_CM-02a.[01]", "defaultText": null }, { "id": 71150, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590433", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590433", "securityControlId": 31353, "ccis": [], "uuid": "b5884d74-8753-5884-8f7c-36d7152e4e75", "testId": "END-01_A03", "test": "the baseline configuration includes hardware, software, firmware and documentation.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.4.1[b]", "defaultText": null }, { "id": 71151, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590433", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590433", "securityControlId": 31353, "ccis": [], "uuid": "e3f905a1-66f0-5f22-8cb1-29227ab149a1", "testId": "END-01_A04", "test": "the baseline configuration is maintained (reviewed / updated) throughout the system development life cycle under configuration control.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.4.1[c]\n53A_R5_CM-02a.[02]", "defaultText": null }, { "id": 71152, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590433", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590433", "securityControlId": 31353, "ccis": [], "uuid": "56b2ac1f-33d8-5851-97e1-66af04db21cc", "testId": "END-01_A05", "test": "security configuration settings for information technology products employed in the system are enforced.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.4.2[b]\n53A_R5_CM-06b.", "defaultText": null }, { "id": 71153, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590433", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590433", "securityControlId": 31353, "ccis": [], "uuid": "0320b24d-8711-5875-b5a6-b0c6c18954df", "testId": "END-01_A06", "test": "configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using organization-defined common secure configurations.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CM-06a.", "defaultText": null }, { "id": 71154, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590433", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590433", "securityControlId": 31353, "ccis": [], "uuid": "30abd74d-177f-53f4-82f7-191f07190a5a", "testId": "END-01_A07", "test": "a control baseline for the system is selected.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PL-10", "defaultText": null }, { "id": 71155, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590433", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590433", "securityControlId": 31353, "ccis": [], "uuid": "ace624a7-a745-592c-94ea-2dc4ed04f2f0", "testId": "END-01_A08", "test": "thresholds to which attack surfaces are to be reduced are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-15(05)_ODP", "defaultText": null }, { "id": 71156, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590434", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590434", "securityControlId": 31353, "ccis": [], "uuid": "c6d67804-7b64-5c96-b31d-5df5b0669f47", "testId": "END-01_A09", "test": "the developer of the system, system component or system service is required to reduce attack surfaces to organization-defined thresholds.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-15(05)", "defaultText": null }, { "id": 71157, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590434", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590434", "securityControlId": 31353, "ccis": [], "uuid": "7a83ad39-ed63-5777-9bcd-fe21d87e28a2", "testId": "END-01_A10", "test": "approved authorizations are enforced for controlling the flow of CUI within the system.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.01.03[01]", "defaultText": null }, { "id": 71158, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590434", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590434", "securityControlId": 31353, "ccis": [], "uuid": "12ae2504-32e9-5420-8306-c1afd5e1914c", "testId": "END-01_A11", "test": "endpoint security management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71159, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590434", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590434", "securityControlId": 31353, "ccis": [], "uuid": "1fb55f43-9794-5169-8587-2f4fea9ea755", "testId": "END-01_A12", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support endpoint security management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71160, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590434", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590434", "securityControlId": 31353, "ccis": [], "uuid": "f9d0701f-e04d-548e-9a22-710d8b454822", "testId": "END-01_A13", "test": "responsibility and authority for the performance of endpoint security management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71161, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590434", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590434", "securityControlId": 31353, "ccis": [], "uuid": "85ed606a-35e9-5625-866e-c358aed71e82", "testId": "END-01_A14", "test": "personnel performing endpoint security management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 570341, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c55a907-2d58-5597-b9ff-f63b1a69f86b", "parentControlId": 31353, "controlId": "7.7", "title": "7.7", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58484" }, { "id": 570342, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36ef409c-9c5a-5417-8f69-c4eebe81ee57", "parentControlId": 31353, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58484" }, { "id": 570343, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98a47d04-afca-57d2-8ced-460d949365f6", "parentControlId": 31353, "controlId": "8.5", "title": "8.5", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58484" }, { "id": 570351, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4737f67d-7e1e-5c7c-93f6-207b143bfecd", "parentControlId": 31353, "controlId": "MP-2", "title": "MP-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584841" }, { "id": 570352, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d328449-0b2b-523a-a2c4-8620d1d88412", "parentControlId": 31353, "controlId": "MP-02", "title": "MP-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584841" }, { "id": 570354, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58d75b92-1ffa-55f4-97de-8e1a24856c92", "parentControlId": 31353, "controlId": "MP-02", "title": "MP-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584841" }, { "id": 570356, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21194182-b11c-5bdd-9e23-6f9d8b8284c7", "parentControlId": 31353, "controlId": "MP-02", "title": "MP-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584841" }, { "id": 570357, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "142a0ea5-3144-50b2-9e3d-d7047a2e8c8e", "parentControlId": 31353, "controlId": "MP-02", "title": "MP-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584841" }, { "id": 570358, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d844d7a-0db0-5ae6-b7bb-1d43ab53e7e1", "parentControlId": 31353, "controlId": "MP-02", "title": "MP-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584842" }, { "id": 570359, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ab17e86-9b17-52f8-ba58-6c4d4fc2aa18", "parentControlId": 31353, "controlId": "MP-02", "title": "MP-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584842" }, { "id": 570360, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96627947-4c7f-5f5b-8415-80508c5ff4d0", "parentControlId": 31353, "controlId": "3.14.2", "title": "3.14.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584842" }, { "id": 570361, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de31a36a-a4a0-5cb0-ac90-c82837263859", "parentControlId": 31353, "controlId": "03.14.02.a", "title": "03.14.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584842" }, { "id": 570369, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69226ecc-1fad-5363-9d20-3412715ea611", "parentControlId": 31353, "controlId": "DE.CM-09", "title": "DE.CM-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584843" }, { "id": 570381, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98116ba1-0587-540d-9f79-544d5db4c090", "parentControlId": 31353, "controlId": "ARCHITECTURE-3b", "title": "ARCHITECTURE-3b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584844" }, { "id": 570396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19efd475-1624-5335-afb6-41a8a2854c48", "parentControlId": 31353, "controlId": "CIP-011-3 1.2", "title": "CIP-011-3 1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584846" }, { "id": 570424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89514c87-91f3-5d8d-a434-55cc6c54a6bc", "parentControlId": 31353, "controlId": "B3.d", "title": "B3.d", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584849" }, { "controlId": "C.1.2", "title": "C.1.2 — Media Access", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MP-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a785a4cf-b226-5f55-9510-7979e7e735a4", "isPublic": true }, { "controlId": "NEI 08-09 App E.1.2", "title": "NEI 08-09 App E.1.2 — Media Access", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.1.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "4dc32437-2444-5e67-8e8f-73cc189bda62", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.1.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "5843490f-5368-5bcf-8721-ac0648795178", "isPublic": true } ], "id": 31353, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731057", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731057", "catalogueId": 1062, "uuid": "e8b660ff-ba20-5825-8956-901e1b626186", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of Endpoint Device Management (EDM) controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Endpoint Device Management (EDM)", "description": "

Control Description

Mechanisms exist to facilitate the implementation of Endpoint Device Management (EDM) controls.

Evidence Request List (ERL)

E-AST-01\nE-END-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Anti-malware technologies are centralized, deployed on all technology assets that can run anti-malware software.\n▪ Anti-spam/phishing technologies are centralized and built into existing email capabilities.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of Endpoint Device Management (EDM) controls.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.1.2", "controlId": "END-01", "family": "Endpoint Security", "enhancements": "", "sortId": "END-01", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program\n∙ Configuration Management (CM) program\n∙ Change control program

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program\n∙ Configuration Management (CM) program\n∙ Change control program

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program\n∙ Configuration Management (CM) program\n∙ Change control program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program\n∙ Configuration Management (CM) program\n∙ Change control program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program\n∙ Configuration Management (CM) program\n∙ Change control program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71163, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590435", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590435", "securityControlId": 31355, "ccis": [], "uuid": "caaf1ded-d1c2-5f90-9c5e-67bc72fd74d3", "testId": "END-02_A01", "test": "the confidentiality and integrity of sensitive / regulated data at rest is protected.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.13.16\n53A_R5_SC-28_ODP[01]\n53A_R5_SC-28", "defaultText": null }, { "id": 71164, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590435", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590435", "securityControlId": 31355, "ccis": [], "uuid": "849e45eb-8a0b-54e6-ad72-beb41f44f2e5", "testId": "END-02_A02", "test": "information at rest requiring protection is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-28_ODP[01]\n53A_R5_SC-28_ODP[02]", "defaultText": null } ], "externalMappings": [ { "id": 570480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584856", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f69c87a-1faf-587b-b4a0-cd96c47c5e24", "parentControlId": 31355, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584856" }, { "id": 570481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584856", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8422a4c6-ccf2-54e2-bc30-5ad7d703d037", "parentControlId": 31355, "controlId": "8.5", "title": "8.5", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584856" }, { "id": 570487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584857", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e46ccd9-bbfa-598c-b111-46c0c8246bc9", "parentControlId": 31355, "controlId": "SC-28", "title": "SC-28", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584857" }, { "id": 570488, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584857", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b62572f7-9722-569a-a27a-16747d728e1e", "parentControlId": 31355, "controlId": "SC-28", "title": "SC-28", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584857" }, { "id": 570490, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584857", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a07a3ab3-fa5e-5d2b-8aa1-4da0e674a2d3", "parentControlId": 31355, "controlId": "SC-28", "title": "SC-28", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584857" }, { "id": 570492, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584857", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0422f177-aa91-5bc5-81af-c2da3cf648b1", "parentControlId": 31355, "controlId": "SC-28", "title": "SC-28", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584857" }, { "id": 570493, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584857", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58f9da16-44c8-5dc2-8804-d4dbad360a69", "parentControlId": 31355, "controlId": "SC-28", "title": "SC-28", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584857" }, { "id": 570494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584858", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "001be976-7989-568b-8591-8d2225e34ca1", "parentControlId": 31355, "controlId": "SC-28", "title": "SC-28", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584858" }, { "id": 570495, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584858", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89b03e54-ffe5-5c1c-b8ea-fa8d3171120c", "parentControlId": 31355, "controlId": "SC-28", "title": "SC-28", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584858" }, { "id": 570496, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584858", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0009792a-76e3-5dd4-88d0-32731894e788", "parentControlId": 31355, "controlId": "SC-28", "title": "SC-28", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584858" }, { "id": 570499, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584858", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9d5ec35-c686-5c18-91d1-3b358cc5f160", "parentControlId": 31355, "controlId": "3.13.16", "title": "3.13.16", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584858" }, { "id": 570510, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584859", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92d92b38-e12f-57d4-8166-ece13540efc6", "parentControlId": 31355, "controlId": "ARCHITECTURE-3f", "title": "ARCHITECTURE-3f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584859" }, { "id": 570511, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584859", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ced5613-2f3d-54cb-b450-e0d4e8d8a2aa", "parentControlId": 31355, "controlId": "ARCHITECTURE-3h", "title": "ARCHITECTURE-3h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584859" }, { "controlId": "B.3.20", "title": "B.3.20 — Confidentiality of Information at Rest", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-28", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "230e26fb-d174-5a10-b26f-d9b556b7aa4c", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.20", "title": "NEI 08-09 App D.3.20 — Confidentiality of Information at Rest", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.20", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "66bb9c5b-651a-552c-bc55-0228ece1795c", "isPublic": true }, { "controlId": "10 CFR 73.54(a)(2)", "title": "10 CFR 73.54(a)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.20", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "9a9fa863-9600-5a18-84d4-2d846f0cd862", "isPublic": true }, { "controlId": "B.5.4", "title": "B.5.4 — Hardware Configuration", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-6, CM-7, MP-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ae5ab353-1dba-594b-ae47-c6526853342c", "isPublic": true }, { "controlId": "NEI 08-09 App D.5.4", "title": "NEI 08-09 App D.5.4 — Hardware Configuration", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.5.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "fbee3b3b-d37a-5662-b6cf-95c518b9bf65", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.5.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "679128e9-641d-5a15-80b7-e5cdc62fa981", "isPublic": true }, { "controlId": "CIP-004-7-R6", "title": "CIP-004-7-R6 — Access Authorization for Transient Cyber Assets and Removable Media", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1606edc3-c749-5536-8a5c-51b5360c2318", "isPublic": true }, { "controlId": "CIP-004-7-6.1", "title": "CIP-004-7-6.1 — Prior to provisioning, authorize (unless already authorized according to Part 4.1.) based on need, as determined by t...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c4c7fa30-e2e9-59d9-a693-428cb7f5feaa", "isPublic": true }, { "controlId": "CIP-004-7-6.1.1", "title": "CIP-004-7-6.1.1 — Provisioned electronic access to electronic BCSI", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6101170c-7959-583d-b642-514d93c65456", "isPublic": true }, { "controlId": "CIP-004-7-6.1.2", "title": "CIP-004-7-6.1.2 — Provisioned physical access to physical BCSI.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "946679b3-2464-50ab-93b2-8c493e35c4a7", "isPublic": true }, { "controlId": "CIP-004-7-6.2", "title": "CIP-004-7-6.2 — Verify at least once every 15 calendar months that all individuals with provisioned access to BCSI: 6.2.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "feaf3173-9c7e-567f-8cdb-bcd9338f3bd0", "isPublic": true }, { "controlId": "CIP-004-7-6.2.1", "title": "CIP-004-7-6.2.1 — have an authorization record", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7d2170f4-a12f-577b-bb4d-356bb094b770", "isPublic": true }, { "controlId": "CIP-004-7-6.2.2", "title": "CIP-004-7-6.2.2 — still need the provisioned access to perform their current work functions, as determined by the Responsible Entity.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a6c9a884-c988-5438-8499-4db0e694282a", "isPublic": true }, { "controlId": "CIP-004-7-6.3", "title": "CIP-004-7-6.3 — For termination actions, remove the individual’s ability to use provisioned access to BCSI (unless already revoked ac...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0885162b-37b5-52ac-a79b-889b76999d88", "isPublic": true } ], "id": 31355, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731057", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731057", "catalogueId": 1062, "uuid": "5e0eae08-ae6c-5645-bb30-3bc89d86daf4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect the confidentiality, integrity, availability and safety of endpoint devices?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Endpoint Protection Measures", "description": "

Control Description

Mechanisms exist to protect the confidentiality, integrity, availability and safety of endpoint devices.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Endpoint devices containing sensitive/regulated data use a cryptographic mechanism to prevent the unauthorized disclosure of information at rest (e.g., full drive encryption).

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to protect the confidentiality, integrity, availability and safety of endpoint devices.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.20, B.5.4
NERC-CIP (2026) Requirements: CIP-004-7-R6", "controlId": "END-02", "family": "Endpoint Security", "enhancements": "", "sortId": "END-02", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program\n∙ Configuration Management (CM) program\n∙ Change control program

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program\n∙ Configuration Management (CM) program\n∙ Change control program

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program\n∙ Configuration Management (CM) program\n∙ Change control program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program\n∙ Configuration Management (CM) program\n∙ Change control program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ IT Asset Management (ITAM) program\n∙ Configuration Management (CM) program\n∙ Change control program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71165, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590436", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590436", "securityControlId": 31356, "ccis": [], "uuid": "a103b0c6-4906-507e-b960-40a7313d9a96", "testId": "END-03_A01", "test": "policies governing the installation of software by users are established.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CM-11_ODP[01]\n53A_R5_CM-11a.", "defaultText": null }, { "id": 71166, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590436", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590436", "securityControlId": 31356, "ccis": [], "uuid": "b5109433-1f33-52a4-8533-6fb0be614608", "testId": "END-03_A02", "test": "user installation of software is allowed only with explicit privileged status.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-11(02)", "defaultText": null }, { "id": 71167, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590436", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590436", "securityControlId": 31356, "ccis": [], "uuid": "5208bb0d-1be6-5899-86c1-e1342aedb559", "testId": "END-03_A03", "test": "methods used to enforce software installation policies are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-11_ODP[02]", "defaultText": null }, { "id": 71168, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590436", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590436", "securityControlId": 31356, "ccis": [], "uuid": "d9ccca74-7e4f-5dc5-a0aa-072567f0fbeb", "testId": "END-03_A04", "test": "the frequency with which to monitor compliance is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-11_ODP[03]", "defaultText": null }, { "id": 71169, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590437", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590437", "securityControlId": 31356, "ccis": [], "uuid": "a14b3204-f928-5671-b465-2fe35c93e758", "testId": "END-03_A05", "test": "software installation policies are enforced through methods.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CM-11b.", "defaultText": null }, { "id": 71170, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590437", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590437", "securityControlId": 31356, "ccis": [], "uuid": "73beb622-3fc3-5313-aded-af12640e1bf2", "testId": "END-03_A06", "test": "compliance with policies is monitored frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: continuously", "otherId": "53A_R5_CM-11c.", "defaultText": null } ], "externalMappings": [ { "id": 570566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584874", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a63840d0-81f1-5c7a-bb11-d85dbacfd593", "parentControlId": 31356, "controlId": "8.19", "title": "8.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584874" }, { "id": 570570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584874", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b7cb712-d874-5754-a5c9-a65bae49a3f8", "parentControlId": 31356, "controlId": "CM-11", "title": "CM-11", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584874" }, { "id": 570571, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584874", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69f3750b-defc-5fe2-a8bd-b300e43f6ba9", "parentControlId": 31356, "controlId": "CM-11(2)", "title": "CM-11(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584874" }, { "id": 570572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584874", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23b48c8e-6f01-57d6-99bf-fd842e30df26", "parentControlId": 31356, "controlId": "CM-11", "title": "CM-11", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584874" }, { "id": 570573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584874", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdf518ee-54fa-5125-bcba-c6f8d247aa5a", "parentControlId": 31356, "controlId": "CM-11(02)", "title": "CM-11(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584874" }, { "id": 570576, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584875", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93d0920b-c35b-58fd-bf1c-ebad931907d7", "parentControlId": 31356, "controlId": "CM-11", "title": "CM-11", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584875" }, { "id": 570577, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584875", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cff2bcea-87ea-56ef-b878-ad425126a4bb", "parentControlId": 31356, "controlId": "CM-11", "title": "CM-11", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584875" }, { "id": 570578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584875", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b41a6cc7-3c67-5071-95ee-39027fd8fcbc", "parentControlId": 31356, "controlId": "CM-11(02)", "title": "CM-11(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584875" }, { "id": 570579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584875", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1080ff1-e234-5a30-9b3b-f345097ab591", "parentControlId": 31356, "controlId": "CM-11", "title": "CM-11", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584875" }, { "id": 570580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584875", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b6bc0a6-facf-55ea-9e8b-08eb1007cb6e", "parentControlId": 31356, "controlId": "CM-11", "title": "CM-11", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584875" }, { "id": 570583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584876", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f198e706-877b-5ceb-b347-29e3748d7372", "parentControlId": 31356, "controlId": "3.4.9", "title": "3.4.9", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584876" }, { "id": 570584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584876", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd6f3ee8-cacf-5a0e-84c6-b23350b4074d", "parentControlId": 31356, "controlId": "PR.PS-05", "title": "PR.PS-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584876" }, { "controlId": "B.5.5", "title": "B.5.5 — Installing Operating Systems, Applications, and Third-Party Software Updates", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-11, SI-7, CM-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "e831ea3c-2018-562a-8e11-a78096d8580c", "isPublic": true }, { "controlId": "NEI 08-09 App D.5.5", "title": "NEI 08-09 App D.5.5 — Installing Operating Systems, Applications, and Third-Party Software Updates", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.5.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "edf48069-eb90-5d94-8bad-661550f3f3be", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.5.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "13ef52d4-f999-5f11-9618-db6413697c12", "isPublic": true } ], "id": 31356, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731058", "catalogueId": 1062, "uuid": "056796a1-69f4-57ed-8498-851b4858d49a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to prohibit software installations without explicitly assigned privileged status?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Prohibit Installation Without Privileged Status", "description": "

Control Description

Automated mechanisms exist to prohibit software installations without explicitly assigned privileged status.

Evidence Request List (ERL)

E-IAM-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically prohibit software installations without explicitly assigned privileged status.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.5.5", "controlId": "END-03", "family": "Endpoint Security", "enhancements": "", "sortId": "END-03", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71171, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590437", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590437", "securityControlId": 31357, "ccis": [], "uuid": "a09417df-50d8-53f9-8192-0a022eca8478", "testId": "END-03.1_A01", "test": "compliance with software installation policies is monitored using organization-defined automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-11(03)[02]", "defaultText": null }, { "id": 71172, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590438", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590438", "securityControlId": 31357, "ccis": [], "uuid": "fcc95e45-4221-5967-bfac-acb688a23dd8", "testId": "END-03.1_A02", "test": "automated mechanisms used to detect the presence of unauthorized hardware, software and/or firmware within the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-08(03)_ODP[01]\n53A_R5_CM-08(03)_ODP[02]\n53A_R5_CM-08(03)_ODP[03]", "defaultText": null }, { "id": 71173, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590438", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590438", "securityControlId": 31357, "ccis": [], "uuid": "dfd8378b-49b5-5983-ac3c-42ef7f748a59", "testId": "END-03.1_A03", "test": "the presence of unauthorized hardware, software and/or firmware within the system is detected using automated mechanisms frequency.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: continuously", "otherId": "53A_R5_CM-08(03)(a)[01]\n53A_R5_CM-08(03)(a)[02]\n53A_R5_CM-08(03)(a)[03]", "defaultText": null }, { "id": 71174, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590438", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590438", "securityControlId": 31357, "ccis": [], "uuid": "e0f728bf-5f6b-563f-94e2-6fb4789c2e1a", "testId": "END-03.1_A04", "test": "the frequency at which automated mechanisms are used to detect the presence of unauthorized hardware, software and/or firmware within the system is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: automated mechanisms with a maximum five-minute delay in detection", "otherId": "53A_R5_CM-08(03)_ODP[04]", "defaultText": null }, { "id": 71175, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590438", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590438", "securityControlId": 31357, "ccis": [], "uuid": "949be19c-bb93-511e-b659-d9069b79d33c", "testId": "END-03.1_A05", "test": "automated mechanisms disable network access by unauthorized components, isolate unauthorized components and/or notify organization-defined personnel or roles.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CM-08(03)_ODP[05]", "defaultText": null }, { "id": 71176, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590438", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590438", "securityControlId": 31357, "ccis": [], "uuid": "d67603c2-75d9-5fa6-bfb1-8f3842c9df64", "testId": "END-03.1_A06", "test": "personnel or roles to be notified when unauthorized components are detected is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-08(03)_ODP[06]", "defaultText": null }, { "id": 71177, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590439", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590439", "securityControlId": 31357, "ccis": [], "uuid": "3838a73b-7e0d-5f3d-9b4a-35a40676cafa", "testId": "END-03.1_A07", "test": "organization-defined actions are taken when unauthorized hardware, software and/or firmware is detected.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_CM-08(03)(b)[01]\n53A_R5_CM-08(03)(b)[02]\n53A_R5_CM-08(03)(b)[03]", "defaultText": null } ], "externalMappings": [ { "id": 570611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584879", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca658734-eec2-53d7-917f-42b677ead6df", "parentControlId": 31357, "controlId": "CM-11(1)", "title": "CM-11(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584879" }, { "id": 570612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584879", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4057a3e6-6e3a-5c43-997b-f60be366e1a6", "parentControlId": 31357, "controlId": "CM-08(03)", "title": "CM-08(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584879" }, { "id": 570613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584879", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a812de85-7994-5063-8840-c8e075656dc8", "parentControlId": 31357, "controlId": "CM-11(03)", "title": "CM-11(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584879" }, { "id": 570616, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27c4bbed-4ebd-5a63-8ce8-76a498319c4e", "parentControlId": 31357, "controlId": "CM-08(03)", "title": "CM-08(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58488" }, { "id": 570617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62f47fb7-82e4-5d31-9823-a38c2faf0e0d", "parentControlId": 31357, "controlId": "CM-08(03)", "title": "CM-08(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58488" }, { "id": 570618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af62b223-09be-5ee0-949b-49a79cc74053", "parentControlId": 31357, "controlId": "CM-11(03)", "title": "CM-11(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58488" }, { "id": 570619, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bbe308e-3b17-5d12-b1f5-c1666876ae16", "parentControlId": 31357, "controlId": "CM-08(03)", "title": "CM-08(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58488" }, { "id": 570620, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db5231e2-5328-5e19-88a0-319b8610af2c", "parentControlId": 31357, "controlId": "CM-08(03)", "title": "CM-08(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58488" } ], "id": 31357, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731058", "catalogueId": 1062, "uuid": "86e56e5b-9401-5568-a658-53f979a6328c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization generate an alert when new software is detected?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Software Installation Alerts", "description": "

Control Description

Mechanisms exist to generate an alert when new software is detected.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to generate an alert when new software is detected.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-03.1", "family": "Endpoint Security", "enhancements": "", "sortId": "END-03.1", "references": "

Micro-Small Business (<10 staff)

∙ ManageEngine Endpoint Central (https://manageengine.com)

Small Business (10-49 staff)

∙ ManageEngine Endpoint Central (https://manageengine.com)

Medium Business (50-249 staff)

∙ ManageEngine Endpoint Central (https://manageengine.com)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Large Business (250-999 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Enterprise (>1,000 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71178, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590439", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590439", "securityControlId": 31358, "ccis": [], "uuid": "2c748045-bfb3-5de9-aae2-62ceb66d229b", "testId": "END-03.2_A01", "test": "physical access restrictions associated with changes to the system are defined and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.4.5[a]\n171A_3.4.5[b]\n53A_R5_CM-05[01]", "defaultText": null }, { "id": 71179, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590439", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590439", "securityControlId": 31358, "ccis": [], "uuid": "ee6df6ae-fb3d-50ee-8a8c-f673d1935f9e", "testId": "END-03.2_A02", "test": "physical access restrictions associated with changes to the system are approved.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.4.5[c]\n53A_R5_CM-05[02]", "defaultText": null }, { "id": 71180, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590439", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590439", "securityControlId": 31358, "ccis": [], "uuid": "2e3aafcd-09a6-5004-9a55-fe03622854d4", "testId": "END-03.2_A03", "test": "physical access restrictions associated with changes to the system are enforced.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.4.5[d]\n53A_R5_CM-05[03]", "defaultText": null }, { "id": 71181, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590439", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590439", "securityControlId": 31358, "ccis": [], "uuid": "eff3e356-c5b5-5219-8092-ef8cecb3195e", "testId": "END-03.2_A04", "test": "logical access restrictions associated with changes to the system are defined and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.4.5[e]\n171A_3.4.5[f]\n53A_R5_CM-05[04]", "defaultText": null }, { "id": 71182, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590439", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590439", "securityControlId": 31358, "ccis": [], "uuid": "9d25c4b2-1932-56e2-9022-4f46d08ccea9", "testId": "END-03.2_A05", "test": "logical access restrictions associated with changes to the system are approved.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.4.5[g]\n53A_R5_CM-05[05]", "defaultText": null }, { "id": 71183, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590439", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590439", "securityControlId": 31358, "ccis": [], "uuid": "472e797e-c3e1-5b26-b643-a779043754b6", "testId": "END-03.2_A06", "test": "logical access restrictions associated with changes to the system are enforced.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.4.5[h]\n53A_R5_CM-05[06]", "defaultText": null } ], "externalMappings": [ { "id": 570638, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584882", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d034a78-76b5-5f03-9fca-0b2071d5692c", "parentControlId": 31358, "controlId": "8.19", "title": "8.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584882" }, { "id": 570641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584882", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c473830c-12fa-5c3a-ab0e-5841c7069d05", "parentControlId": 31358, "controlId": "CM-5", "title": "CM-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584882" }, { "id": 570642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584883", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c204ce7-179a-5668-af7e-bb9c0278d43b", "parentControlId": 31358, "controlId": "CM-05", "title": "CM-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584883" }, { "id": 570644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584883", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44b50126-3f1f-5265-bac4-356d4915efa5", "parentControlId": 31358, "controlId": "CM-05", "title": "CM-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584883" }, { "id": 570645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584883", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f66f73a-0edc-5ff3-bddc-627a1b53cb27", "parentControlId": 31358, "controlId": "CM-05", "title": "CM-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584883" }, { "id": 570646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584883", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64d3f6ab-e5b3-5c01-95bf-56fdfd9e251f", "parentControlId": 31358, "controlId": "CM-05", "title": "CM-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584883" }, { "id": 570647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584883", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c25683b-f083-5d85-9afc-6986f113c9b3", "parentControlId": 31358, "controlId": "CM-05", "title": "CM-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584883" }, { "id": 570648, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584883", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86014376-1cc3-5267-b7ca-6d9a1b18fa25", "parentControlId": 31358, "controlId": "CM-05", "title": "CM-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584883" }, { "id": 570649, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584883", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47881a0f-ed01-5aa8-acc6-bd566772975e", "parentControlId": 31358, "controlId": "CM-5", "title": "CM-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584883" }, { "id": 570650, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584883", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "304e0f35-ea01-5580-8ccd-49b06efc43b1", "parentControlId": 31358, "controlId": "CM-5", "title": "CM-5", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584883" } ], "id": 31358, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731058", "catalogueId": 1062, "uuid": "b81542ba-a337-5f43-a044-b38d99ffd599", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define, document, approve and enforce access restrictions associated with changes to Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Governing Access Restriction for Change", "description": "

Control Description

Mechanisms exist to define, document, approve and enforce access restrictions associated with changes to Technology Assets, Applications and/or Services (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to define, document, approve and enforce access restrictions associated with changes to Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-03.2", "family": "Endpoint Security", "enhancements": "", "sortId": "END-03.2", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71184, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59044", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59044", "securityControlId": 31359, "ccis": [], "uuid": "9adc08a4-9d41-5245-afcf-cc676a0ff373", "testId": "END-04_A01", "test": "the frequency for malicious code scans is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least weekly", "otherId": "171A_3.14.5[a]\n53A_R5_SI-03_ODP[01]\n53A_R5_SI-03_ODP[02]", "defaultText": null }, { "id": 71185, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59044", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59044", "securityControlId": 31359, "ccis": [], "uuid": "1bcda7ac-f426-525c-a6b0-780a2c88d7e4", "testId": "END-04_A02", "test": "malicious code scans are performed with the defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least weekly", "otherId": "171A_3.14.5[b]", "defaultText": null }, { "id": 71186, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59044", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59044", "securityControlId": 31359, "ccis": [], "uuid": "4b308968-c53f-5bb3-b456-7a351b688685", "testId": "END-04_A03", "test": "malicious code protection mechanisms are configured to perform real-time scans of files from external sources as the files are downloaded, opened or executed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.14.5[c]", "defaultText": null }, { "id": 71187, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590441", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590441", "securityControlId": 31359, "ccis": [], "uuid": "6938729d-0dda-585e-9237-9cd8a70d58c6", "testId": "END-04_A04", "test": "designated locations for malicious code protection are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.14.2[a]", "defaultText": null }, { "id": 71188, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590441", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590441", "securityControlId": 31359, "ccis": [], "uuid": "b0df7c8e-8fe4-5a35-bf09-0a01afef6ba1", "testId": "END-04_A05", "test": "protection from malicious code at designated locations is provided.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.14.2[b]", "defaultText": null }, { "id": 71189, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590441", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590441", "securityControlId": 31359, "ccis": [], "uuid": "bb83b7e1-b2be-586d-a853-7819a6edebde", "testId": "END-04_A06", "test": "action to be taken in response to malicious code detection are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-03_ODP[04]\n53A_R5_SI-03_ODP[05]", "defaultText": null }, { "id": 71190, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590442", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590442", "securityControlId": 31359, "ccis": [], "uuid": "460c7158-0291-5c4a-a3e3-26c246ed0e19", "testId": "END-04_A07", "test": "personnel or roles to be alerted when malicious code is detected is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-03_ODP[06]", "defaultText": null }, { "id": 71191, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590442", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590442", "securityControlId": 31359, "ccis": [], "uuid": "fd58a5ac-ab34-56a3-aa89-8fab2add6f55", "testId": "END-04_A08", "test": "malicious code protection mechanisms are implemented at system entry and exit points to detect malicious code.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_SI-03_ODP[01]\n53A_R5_SI-03a.[01]\n171A_R3_A.03.14.02.a[01]", "defaultText": null }, { "id": 71192, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590442", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590442", "securityControlId": 31359, "ccis": [], "uuid": "e4d3a17e-1a46-5e62-a9d8-0c30c1253c0c", "testId": "END-04_A09", "test": "malicious code protection mechanisms are implemented at system entry and exit points to eradicate malicious code.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_SI-03_ODP[04]\n53A_R5_SI-03a.[02]\n171A_R3_A.03.14.02.a[02]", "defaultText": null }, { "id": 71193, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590442", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590442", "securityControlId": 31359, "ccis": [], "uuid": "80fcab09-11ae-56a8-8c8f-42fc779233f3", "testId": "END-04_A10", "test": "malicious code protection mechanisms are updated automatically as new releases are available in accordance with organizational configuration management policy and procedures.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-03b.", "defaultText": null }, { "id": 71194, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590442", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590442", "securityControlId": 31359, "ccis": [], "uuid": "d964ac50-1bf8-5e73-8398-6790a4034afc", "testId": "END-04_A11", "test": "malicious code protection mechanisms are configured to perform periodic scans of the system frequency.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: at least weekly", "otherId": "53A_R5_SI-03c.01[01]", "defaultText": null }, { "id": 71195, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590443", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590443", "securityControlId": 31359, "ccis": [], "uuid": "d580fcf7-7de3-526b-a468-278f467002dd", "testId": "END-04_A12", "test": "malicious code protection mechanisms are configured to perform real-time scans of files from external sources as the files are downloaded, opened or executed in accordance with organizational policy.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-03c.01[02]", "defaultText": null }, { "id": 71196, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590443", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590443", "securityControlId": 31359, "ccis": [], "uuid": "c7a4a4c3-89d7-5a62-9f9b-ffd16139bc40", "testId": "END-04_A13", "test": "malicious code protection mechanisms are configured to respond to malicious code detection.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-03c.02[01]\n53A_R5_SI-03_ODP[04]", "defaultText": null }, { "id": 71197, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590443", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590443", "securityControlId": 31359, "ccis": [], "uuid": "83ab023d-e7a3-51dd-9148-8c7d8c0ad2f6", "testId": "END-04_A14", "test": "malicious code protection mechanisms are configured to send alerts to personnel or roles in response to malicious code detection.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-03c.02[02]", "defaultText": null }, { "id": 71198, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590443", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590443", "securityControlId": 31359, "ccis": [], "uuid": "4d953661-e8c7-5422-a8df-6b2559d79869", "testId": "END-04_A15", "test": "the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system are addressed.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-03d.", "defaultText": null }, { "id": 71199, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590443", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590443", "securityControlId": 31359, "ccis": [], "uuid": "2a764d6f-c4d2-580f-bb93-2e921534bca6", "testId": "END-04_A16", "test": "malicious code protection mechanisms are implemented at system entry and exit points to eradicate malicious code.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-03a.[02]", "defaultText": null }, { "id": 71200, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590443", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590443", "securityControlId": 31359, "ccis": [], "uuid": "03a5ae07-b17e-5f79-9370-e8cabad98a0b", "testId": "END-04_A17", "test": "malicious code protection mechanisms are configured to block malicious code, quarantine malicious code, or take other actions in response to malicious code detection.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.14.02.c.02", "defaultText": null }, { "id": 71201, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590444", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590444", "securityControlId": 31359, "ccis": [], "uuid": "0f401214-10d7-51e4-9fc0-9db276f3d656", "testId": "END-04_A18", "test": "the frequency at which malicious code protection mechanisms perform scans is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least weekly", "otherId": "171A_R3_A.03.14.02.ODP[01]", "defaultText": null } ], "externalMappings": [ { "id": 570690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584888", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "030b7bc1-ee49-5a86-a0b7-a6d441afdd28", "parentControlId": 31359, "controlId": "COMP 2.2", "title": "COMP 2.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584888" }, { "id": 570691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584888", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cc36f63-0c51-5ab9-9240-2fdc4cd8081e", "parentControlId": 31359, "controlId": "SR 3.2", "title": "SR 3.2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584888" }, { "id": 570692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584888", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4245600f-9d0b-5570-ac51-c87f0e1b9762", "parentControlId": 31359, "controlId": "SR 3.2 RE 1", "title": "SR 3.2 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584888" }, { "id": 570693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584888", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d366cc6-afe5-5994-9e23-c193c244a28c", "parentControlId": 31359, "controlId": "SAR 3.2", "title": "SAR 3.2", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584888" }, { "id": 570694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8904372-e45c-521b-b1a7-971983b83fb5", "parentControlId": 31359, "controlId": "HDR 3.2", "title": "HDR 3.2", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584889" }, { "id": 570695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e145f8e-a043-5d47-8c04-5501e9100795", "parentControlId": 31359, "controlId": "NDR 3.2", "title": "NDR 3.2", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584889" }, { "id": 570696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9cb30e8-6208-5e47-821e-a9d753d925df", "parentControlId": 31359, "controlId": "8.7", "title": "8.7", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584889" }, { "id": 570699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c157b4b-c4ca-56e4-9f09-ab1c6a07268c", "parentControlId": 31359, "controlId": "T1001", "title": "T1001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584889" }, { "id": 570700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27c52207-078b-5e89-b80b-278726cb85a8", "parentControlId": 31359, "controlId": "T1001.001", "title": "T1001.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584889" }, { "id": 570701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "964dea0d-e732-55f0-98a5-c40809fd3fdf", "parentControlId": 31359, "controlId": "T1001.002", "title": "T1001.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584889" }, { "id": 570702, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa56a59a-a903-501d-b630-4ba6a718ce1a", "parentControlId": 31359, "controlId": "T1001.003", "title": "T1001.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584889" }, { "id": 570703, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9254298d-5c4a-52e5-8e00-7e30b60b2d77", "parentControlId": 31359, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584889" }, { "id": 570704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a03d33a9-27d4-5bd3-acb6-31093c1026e9", "parentControlId": 31359, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58489" }, { "id": 570705, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d30b7c3d-6c02-516d-97ca-0bcffe38c17a", "parentControlId": 31359, "controlId": "T1003.002", "title": "T1003.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58489" }, { "id": 570706, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f72663e-5131-5af2-8b85-f42c27563417", "parentControlId": 31359, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58489" }, { "id": 570707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90ef3ed4-72cb-53e3-842e-dca535084fd9", "parentControlId": 31359, "controlId": "T1003.004", "title": "T1003.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58489" }, { "id": 570708, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae52877b-5ef0-516b-bcbc-d6e48ec8d9f8", "parentControlId": 31359, "controlId": "T1003.005", "title": "T1003.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58489" }, { "id": 570709, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0737b04-f1a0-55a7-99a4-f91a3f5b72a9", "parentControlId": 31359, "controlId": "T1003.006", "title": "T1003.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58489" }, { "id": 570710, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee5735f1-9116-5eff-a631-d37c7e1cddc7", "parentControlId": 31359, "controlId": "T1003.007", "title": "T1003.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58489" }, { "id": 570711, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95c10391-a107-5eb0-833e-818a56bee6e7", "parentControlId": 31359, "controlId": "T1003.008", "title": "T1003.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58489" }, { "id": 570712, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18646c91-770f-513b-8fba-34c60ec91e3c", "parentControlId": 31359, "controlId": "T1005", "title": "T1005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58489" }, { "id": 570713, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cfc4606-a9ff-56ad-8722-088101c29379", "parentControlId": 31359, "controlId": "T1008", "title": "T1008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584891" }, { "id": 570714, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5205be05-14e6-5bdb-8afa-642f31a2127f", "parentControlId": 31359, "controlId": "T1011.001", "title": "T1011.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584891" }, { "id": 570715, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3ed871b-61da-5ad7-b5de-c04786eba847", "parentControlId": 31359, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584891" }, { "id": 570716, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16cdf9f1-7356-53c7-8182-4995b6ba9d7e", "parentControlId": 31359, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584891" }, { "id": 570717, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca379ab4-aca3-5abd-8af8-aa1577a59697", "parentControlId": 31359, "controlId": "T1025", "title": "T1025", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584891" }, { "id": 570718, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8479b64-ffd0-5e01-895b-b5aa5913ba8c", "parentControlId": 31359, "controlId": "T1027", "title": "T1027", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584891" }, { "id": 570719, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81189bef-2a41-5bf9-854b-80f6a4d96d86", "parentControlId": 31359, "controlId": "T1027.002", "title": "T1027.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584891" }, { "id": 570720, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd9766b5-5cc8-52be-b42c-82251147a123", "parentControlId": 31359, "controlId": "T1027.007", "title": "T1027.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584891" }, { "id": 570721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b58a91da-30f1-5caa-8ead-b5456112c4e1", "parentControlId": 31359, "controlId": "T1027.008", "title": "T1027.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584892" }, { "id": 570722, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ca4b4ae-576d-5101-b3d9-553929417d9b", "parentControlId": 31359, "controlId": "T1027.009", "title": "T1027.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584892" }, { "id": 570723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf40e04f-e882-566d-ae9e-497e04e8c617", "parentControlId": 31359, "controlId": "T1027.010", "title": "T1027.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584892" }, { "id": 570724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a5d6fe6-70fa-5d4e-ba90-87dc8dc6c998", "parentControlId": 31359, "controlId": "T1027.012", "title": "T1027.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584892" }, { "id": 570725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "185c5519-9f10-5924-8cb9-554d1fe39232", "parentControlId": 31359, "controlId": "T1027.013", "title": "T1027.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584892" }, { "id": 570726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2621986f-2990-5b3b-80fc-86159a5f932e", "parentControlId": 31359, "controlId": "T1027.014", "title": "T1027.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584892" }, { "id": 570727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "576451f0-814a-5fb1-bb6d-f145a98abcf6", "parentControlId": 31359, "controlId": "T1029", "title": "T1029", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584892" }, { "id": 570728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49e7a5ce-1da5-5467-8a74-99b478912fe5", "parentControlId": 31359, "controlId": "T1030", "title": "T1030", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584892" }, { "id": 570729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "695ae23e-03ad-5131-b915-3fed529b2a1f", "parentControlId": 31359, "controlId": "T1036", "title": "T1036", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584892" }, { "id": 570730, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "922f0be1-5f20-562d-9a63-2ec2aba2975b", "parentControlId": 31359, "controlId": "T1036.003", "title": "T1036.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584893" }, { "id": 570731, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c36b3bb-b753-569d-98e6-e2bb14c004b6", "parentControlId": 31359, "controlId": "T1036.005", "title": "T1036.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584893" }, { "id": 570732, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0cbfe2d3-b65b-54a9-b4ee-f7888f962864", "parentControlId": 31359, "controlId": "T1036.008", "title": "T1036.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584893" }, { "id": 570733, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58d4ed2b-10c1-5a5b-bd9d-350db1a8b684", "parentControlId": 31359, "controlId": "T1037", "title": "T1037", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584893" }, { "id": 570734, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3dbd1ad1-e892-5aba-84e5-a29e4bdb478c", "parentControlId": 31359, "controlId": "T1037.002", "title": "T1037.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584893" }, { "id": 570735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d7efa4f-88bf-560a-8829-688572f19f28", "parentControlId": 31359, "controlId": "T1037.003", "title": "T1037.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584893" }, { "id": 570736, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "213993bd-a325-5fb3-869f-ae8b12feaf63", "parentControlId": 31359, "controlId": "T1037.004", "title": "T1037.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584893" }, { "id": 570737, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9668f901-332d-57e7-a413-70e274bf8c53", "parentControlId": 31359, "controlId": "T1037.005", "title": "T1037.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584893" }, { "id": 570738, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0e9c6ca-151b-50e9-8276-9c357319c7fe", "parentControlId": 31359, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584893" }, { "id": 570739, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3994fb5b-7141-537d-8209-baafd5d8fc84", "parentControlId": 31359, "controlId": "T1046", "title": "T1046", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584893" }, { "id": 570740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584894", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ca0bf90-1cb4-50d7-bd16-e88c68662966", "parentControlId": 31359, "controlId": "T1047", "title": "T1047", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584894" }, { "id": 570741, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584894", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70237ad7-7f4d-5c7d-973c-43355713a549", "parentControlId": 31359, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584894" }, { "id": 570742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584894", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6eabd31b-f392-54e4-8a6a-b8ccfdc006ae", "parentControlId": 31359, "controlId": "T1048.001", "title": "T1048.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584894" }, { "id": 570743, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584894", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e1ec326-5236-5e3b-a356-e285f7c8d9d0", "parentControlId": 31359, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584894" }, { "id": 570744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584894", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32c12db6-c8c0-538e-a913-e38b04a191e9", "parentControlId": 31359, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584894" }, { "id": 570745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584894", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cbb2ea13-78bf-55ea-9fd5-5c4cce48cdad", "parentControlId": 31359, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584894" }, { "id": 570746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584894", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fb19057-09ba-5185-9423-c21f7b642ad8", "parentControlId": 31359, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584894" }, { "id": 570747, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584894", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b459cd7-bab6-5755-b6ce-893dd839094d", "parentControlId": 31359, "controlId": "T1055", "title": "T1055", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584894" }, { "id": 570748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ea41a6c-4f9b-573e-86d9-479d22cab193", "parentControlId": 31359, "controlId": "T1055.001", "title": "T1055.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584895" }, { "id": 570749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2153747-3ace-5120-a718-eaf6fddc2088", "parentControlId": 31359, "controlId": "T1055.002", "title": "T1055.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584895" }, { "id": 570750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29e75824-8e66-5919-a0c8-aef486a7b1dd", "parentControlId": 31359, "controlId": "T1055.003", "title": "T1055.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584895" }, { "id": 570751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "510c5eb6-3181-5add-95af-b86583728dd1", "parentControlId": 31359, "controlId": "T1055.004", "title": "T1055.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584895" }, { "id": 570752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f07d51b6-220d-54f5-8b17-17b05ec9b76c", "parentControlId": 31359, "controlId": "T1055.005", "title": "T1055.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584895" }, { "id": 570753, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83391865-ea03-5813-a3fb-61eb01ad8778", "parentControlId": 31359, "controlId": "T1055.008", "title": "T1055.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584895" }, { "id": 570754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdc7ab37-5cdd-5ddc-9bb8-de1109f05f39", "parentControlId": 31359, "controlId": "T1055.009", "title": "T1055.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584895" }, { "id": 570755, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "503c7938-b306-5a7a-80cb-c174f0a0add6", "parentControlId": 31359, "controlId": "T1055.011", "title": "T1055.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584895" }, { "id": 570756, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a86239d6-24eb-5cce-bd37-fd9218de4a44", "parentControlId": 31359, "controlId": "T1055.012", "title": "T1055.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584895" }, { "id": 570757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584896", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41aa5e9e-29c5-5900-980b-c95c8287779c", "parentControlId": 31359, "controlId": "T1055.013", "title": "T1055.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584896" }, { "id": 570758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584896", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ddfafff-228d-5b26-819f-4d68956cdfe0", "parentControlId": 31359, "controlId": "T1055.014", "title": "T1055.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584896" }, { "id": 570759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584896", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ceea608-641a-58f5-a6b9-fe19f2107e2e", "parentControlId": 31359, "controlId": "T1055.015", "title": "T1055.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584896" }, { "id": 570760, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584896", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fa97cf6-7345-5f03-8d39-d84070f5690f", "parentControlId": 31359, "controlId": "T1056.002", "title": "T1056.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584896" }, { "id": 570761, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584896", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d477db8-7e1e-57d2-ad07-df49d5c8126a", "parentControlId": 31359, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584896" }, { "id": 570762, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584896", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61ca4a57-d224-5d9c-8a1c-6affb9864603", "parentControlId": 31359, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584896" }, { "id": 570763, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584896", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ccf5fa6-6f91-54bc-8748-7f6c0f3dc8b0", "parentControlId": 31359, "controlId": "T1059.002", "title": "T1059.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584896" }, { "id": 570764, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584896", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "929b92d6-55cd-53ab-9268-27257a293b53", "parentControlId": 31359, "controlId": "T1059.003", "title": "T1059.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584896" }, { "id": 570765, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584896", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa8f1c7d-f2e7-5be2-b22d-2d443f8ac23b", "parentControlId": 31359, "controlId": "T1059.004", "title": "T1059.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584896" }, { "id": 570766, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f9a5c60-7630-57ef-a9fb-22bce62e84bb", "parentControlId": 31359, "controlId": "T1059.005", "title": "T1059.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584897" }, { "id": 570767, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0dd3ab0f-e383-57a9-9783-380e3fb3ed19", "parentControlId": 31359, "controlId": "T1059.006", "title": "T1059.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584897" }, { "id": 570768, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d2b167b-f4a2-5ef9-b776-6083a394ccc5", "parentControlId": 31359, "controlId": "T1059.007", "title": "T1059.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584897" }, { "id": 570769, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a51088a-9a71-52fb-a2f8-367a2e7d3433", "parentControlId": 31359, "controlId": "T1059.008", "title": "T1059.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584897" }, { "id": 570770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21f4e43d-072b-546e-a79b-66688c005daa", "parentControlId": 31359, "controlId": "T1059.010", "title": "T1059.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584897" }, { "id": 570771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fa73c39-2f91-52ef-ac3b-55efa70b6219", "parentControlId": 31359, "controlId": "T1059.011", "title": "T1059.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584897" }, { "id": 570772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "746815ed-1d6e-557d-9984-84b7404f3bca", "parentControlId": 31359, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584897" }, { "id": 570773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42b90964-a2c9-5a46-a997-c94a69f22c0a", "parentControlId": 31359, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584897" }, { "id": 570774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f778545e-4d1f-5f2c-a2c9-bd94d140f2a1", "parentControlId": 31359, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584897" }, { "id": 570775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90eb1c3a-964b-585a-9d1e-e00eece64250", "parentControlId": 31359, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584898" }, { "id": 570776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0c7bad8-5b10-53e3-aa1b-e3efc2afed94", "parentControlId": 31359, "controlId": "T1070.003", "title": "T1070.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584898" }, { "id": 570777, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c9bc840-e191-5d5b-b449-a063f009cc97", "parentControlId": 31359, "controlId": "T1070.007", "title": "T1070.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584898" }, { "id": 570778, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "beeff454-39ab-59b1-9d1d-a9ef4728e16a", "parentControlId": 31359, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584898" }, { "id": 570779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4476b6e-19f6-555c-bdda-d780bd00d1a0", "parentControlId": 31359, "controlId": "T1070.009", "title": "T1070.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584898" }, { "id": 570780, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4285a1c-c679-5c74-a2df-02d3948ef00c", "parentControlId": 31359, "controlId": "T1070.010", "title": "T1070.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584898" }, { "id": 570781, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4961c27-6f4d-5be9-a522-ce7488b4c6dd", "parentControlId": 31359, "controlId": "T1071", "title": "T1071", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584898" }, { "id": 570782, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7be1224a-a4e7-5695-9209-8f5d069c0f8c", "parentControlId": 31359, "controlId": "T1071.001", "title": "T1071.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584898" }, { "id": 570783, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5dc82186-3cf0-567d-a239-998f81aded17", "parentControlId": 31359, "controlId": "T1071.002", "title": "T1071.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584898" }, { "id": 570784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8179e4f5-62da-5ca4-860f-4d5136a524e7", "parentControlId": 31359, "controlId": "T1071.003", "title": "T1071.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584899" }, { "id": 570785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584899", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24bce5b7-546f-5d9a-9a36-60978595b7aa", "parentControlId": 31359, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584899" }, { "id": 570786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584899", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af9337c5-4092-52b5-918e-1f5af05d5542", "parentControlId": 31359, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584899" }, { "id": 570787, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584899", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48c2496b-9ae5-575f-b979-0f8a9ccc0024", "parentControlId": 31359, "controlId": "T1080", "title": "T1080", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584899" }, { "id": 570788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584899", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef04e46f-1364-5e56-bf4e-f18764e1cb15", "parentControlId": 31359, "controlId": "T1090", "title": "T1090", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584899" }, { "id": 570789, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584899", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "906d7740-cbcd-5ffe-8af0-77f8110d2f84", "parentControlId": 31359, "controlId": "T1090.001", "title": "T1090.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584899" }, { "id": 570790, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584899", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c83520b5-2d90-5e1d-a75b-09f6dd01c1c8", "parentControlId": 31359, "controlId": "T1090.002", "title": "T1090.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584899" }, { "id": 570791, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584899", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e335bdba-b545-5db8-ab6c-8e4fcc74a745", "parentControlId": 31359, "controlId": "T1091", "title": "T1091", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584899" }, { "id": 570792, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584899", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a5fd753-c66f-50b5-a4d2-02614b597df5", "parentControlId": 31359, "controlId": "T1092", "title": "T1092", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584899" }, { "id": 570793, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96845be4-5d54-5417-9e14-422b1fae4f1d", "parentControlId": 31359, "controlId": "T1095", "title": "T1095", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5849" }, { "id": 570794, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93681f2a-8574-595c-b3b8-7e71cb86944d", "parentControlId": 31359, "controlId": "T1098.004", "title": "T1098.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5849" }, { "id": 570795, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f8447a0-9e92-53e7-aa50-ae00ef338d7f", "parentControlId": 31359, "controlId": "T1102", "title": "T1102", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5849" }, { "id": 570796, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7495287f-c806-5ac6-a7be-d0402930e837", "parentControlId": 31359, "controlId": "T1102.001", "title": "T1102.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5849" }, { "id": 570797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5449b79d-cfb6-5365-955a-55f3795a69e3", "parentControlId": 31359, "controlId": "T1102.002", "title": "T1102.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5849" }, { "id": 570798, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4aed5e1e-96fe-586f-a052-95d5936e5922", "parentControlId": 31359, "controlId": "T1102.003", "title": "T1102.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5849" }, { "id": 570799, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c69e180-f5c1-52f7-bc3f-96af79e264b7", "parentControlId": 31359, "controlId": "T1104", "title": "T1104", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5849" }, { "id": 570800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8031d1f6-5056-5788-9dfb-ad3817a93ec2", "parentControlId": 31359, "controlId": "T1105", "title": "T1105", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5849" }, { "id": 570801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c71c26af-5de9-5348-992b-6153003cd426", "parentControlId": 31359, "controlId": "T1106", "title": "T1106", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5849" }, { "id": 570802, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87d6a485-c64c-5855-876d-d1be0c76aeea", "parentControlId": 31359, "controlId": "T1111", "title": "T1111", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584901" }, { "id": 570803, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cfd0b58-93f0-5fed-bb54-cdfe180425dc", "parentControlId": 31359, "controlId": "T1129", "title": "T1129", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584901" }, { "id": 570804, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71be3415-4839-5e4c-914f-28237ab3692b", "parentControlId": 31359, "controlId": "T1132", "title": "T1132", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584901" }, { "id": 570805, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e33df8c2-feec-5f3b-a996-20c8572a0c2d", "parentControlId": 31359, "controlId": "T1132.001", "title": "T1132.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584901" }, { "id": 570806, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "433e51b1-58e6-5d61-888c-43df0d462997", "parentControlId": 31359, "controlId": "T1132.002", "title": "T1132.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584901" }, { "id": 570807, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "179ff8d5-3ee2-568c-b204-37729b58ffd7", "parentControlId": 31359, "controlId": "T1137", "title": "T1137", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584901" }, { "id": 570808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b514c1df-7de8-5885-9375-f16e02638e7a", "parentControlId": 31359, "controlId": "T1137.001", "title": "T1137.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584901" }, { "id": 570809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bba6b61f-d81e-55a0-8fe2-3f2db5372d1c", "parentControlId": 31359, "controlId": "T1176", "title": "T1176", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584901" }, { "id": 570810, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b95d3570-7b51-5996-a9f3-cf5fd8ec1bd4", "parentControlId": 31359, "controlId": "T1185", "title": "T1185", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584901" }, { "id": 570811, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16a43d29-f647-5dfa-ad2e-8b40725665a7", "parentControlId": 31359, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584901" }, { "id": 570812, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584902", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "968c3e31-85da-5fe5-ab59-cd8f29f8cb75", "parentControlId": 31359, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584902" }, { "id": 570813, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584902", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7612bc97-ff8c-5dd3-a36b-cf208369fbaa", "parentControlId": 31359, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584902" }, { "id": 570814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584902", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbee954f-9e96-52f9-90a8-b0d233f6721a", "parentControlId": 31359, "controlId": "T1201", "title": "T1201", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584902" }, { "id": 570815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584902", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b4c5129-8869-56ba-93d8-5d5a42f92bef", "parentControlId": 31359, "controlId": "T1203", "title": "T1203", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584902" }, { "id": 570816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584903", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01e2ad13-103e-5a8d-abfe-f1c760155009", "parentControlId": 31359, "controlId": "T1204", "title": "T1204", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584903" }, { "id": 570817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584903", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83272e84-a171-5bce-9013-98ffc1228481", "parentControlId": 31359, "controlId": "T1204.001", "title": "T1204.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584903" }, { "id": 570818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584903", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29003f11-0995-5bb6-b1a4-2c986604a308", "parentControlId": 31359, "controlId": "T1204.002", "title": "T1204.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584903" }, { "id": 570819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584903", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5312a6a5-baac-5989-8f02-6602411e3834", "parentControlId": 31359, "controlId": "T1204.003", "title": "T1204.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584903" }, { "id": 570820, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584903", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10fc9c12-50dd-52f1-b852-3afa83d18fc5", "parentControlId": 31359, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584903" }, { "id": 570821, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584903", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96bb0f4f-52a3-588b-9cb5-73d09adc88d2", "parentControlId": 31359, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584903" }, { "id": 570822, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584903", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0267013a-fa99-5bd7-be83-7dd38880166e", "parentControlId": 31359, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584903" }, { "id": 570823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584903", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ceb5bca-aa88-5018-b9d3-aa2f516d2cfd", "parentControlId": 31359, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584903" }, { "id": 570824, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584903", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "916123bc-78a1-5d1d-8b79-0b21e8b298dc", "parentControlId": 31359, "controlId": "T1218.001", "title": "T1218.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584903" }, { "id": 570825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7888261b-8097-5dd6-92a7-a4331d646ff8", "parentControlId": 31359, "controlId": "T1218.002", "title": "T1218.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584904" }, { "id": 570826, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75d7ade5-55c1-5794-bd38-27c7cba86c43", "parentControlId": 31359, "controlId": "T1218.003", "title": "T1218.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584904" }, { "id": 570827, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49d36fb6-3e42-5bbf-9b0e-0a66aa7c0a55", "parentControlId": 31359, "controlId": "T1218.004", "title": "T1218.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584904" }, { "id": 570828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4091436b-9d84-513a-900a-d1a8b67a8f5f", "parentControlId": 31359, "controlId": "T1218.005", "title": "T1218.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584904" }, { "id": 570829, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4c9849b-e729-53f8-8277-58b58a88e9c6", "parentControlId": 31359, "controlId": "T1218.008", "title": "T1218.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584904" }, { "id": 570830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db47fe75-6a20-5a5c-86b1-4f25abbbaded", "parentControlId": 31359, "controlId": "T1218.009", "title": "T1218.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584904" }, { "id": 570831, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3c191c7-00b0-52f0-befe-a65cb0b677ea", "parentControlId": 31359, "controlId": "T1218.012", "title": "T1218.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584904" }, { "id": 570832, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ad3540f-6f8b-5c3e-950b-c210549140a9", "parentControlId": 31359, "controlId": "T1218.013", "title": "T1218.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584904" }, { "id": 570833, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b0558b4-096b-5211-b48a-aaf61c557bd7", "parentControlId": 31359, "controlId": "T1218.014", "title": "T1218.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584904" }, { "id": 570834, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "861e1bec-bb14-59a8-adca-a30565c85653", "parentControlId": 31359, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584905" }, { "id": 570835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d685a17-54cc-5a31-8aea-573d5a66fe8f", "parentControlId": 31359, "controlId": "T1219", "title": "T1219", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584905" }, { "id": 570836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "523dc5da-364d-542e-8fef-46deac2ade75", "parentControlId": 31359, "controlId": "T1221", "title": "T1221", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584905" }, { "id": 570837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5f9df4e-7c77-5fa5-abb3-678c681b0902", "parentControlId": 31359, "controlId": "T1485", "title": "T1485", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584905" }, { "id": 570838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66033797-071e-54a9-b71e-83da2d2f166f", "parentControlId": 31359, "controlId": "T1486", "title": "T1486", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584905" }, { "id": 570839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca5cb3e6-1ad7-5f8d-9c7e-94266a8a0f5c", "parentControlId": 31359, "controlId": "T1490", "title": "T1490", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584905" }, { "id": 570840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584905", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53dae04b-80c3-5d3b-92f7-37b3ccd67118", "parentControlId": 31359, "controlId": "T1491", "title": "T1491", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584905" }, { "id": 570841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d2c1d9c-78d3-56a3-8387-b33c3fc5debf", "parentControlId": 31359, "controlId": "T1491.001", "title": "T1491.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584906" }, { "id": 570842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a326ad45-5792-5384-80b6-5bf9a4709169", "parentControlId": 31359, "controlId": "T1491.002", "title": "T1491.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584906" }, { "id": 570843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77e31f6a-9c8b-547f-8df4-84bc1c43c8e0", "parentControlId": 31359, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584906" }, { "id": 570844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85c69794-7967-5a29-9ff0-d5427990dcb0", "parentControlId": 31359, "controlId": "T1525", "title": "T1525", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584906" }, { "id": 570845, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37aa6b7c-8761-5a91-a8de-a84e0f31a204", "parentControlId": 31359, "controlId": "T1539", "title": "T1539", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584906" }, { "id": 570846, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb412a93-1a7d-5678-b0c0-fede17404bae", "parentControlId": 31359, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584906" }, { "id": 570847, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35f4cbdb-7aa7-50b3-baa3-a2531da77b01", "parentControlId": 31359, "controlId": "T1543.002", "title": "T1543.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584906" }, { "id": 570848, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80221204-c05a-5a78-9221-f340ff3dd617", "parentControlId": 31359, "controlId": "T1546.002", "title": "T1546.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584906" }, { "id": 570849, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d1941c3-f678-5c3a-ad6a-135690047462", "parentControlId": 31359, "controlId": "T1546.003", "title": "T1546.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584906" }, { "id": 570850, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9498307-75eb-583e-9e4a-918e5ca9185d", "parentControlId": 31359, "controlId": "T1546.004", "title": "T1546.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584906" }, { "id": 570851, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5723644-4616-5c17-aa79-1922b18303ff", "parentControlId": 31359, "controlId": "T1546.006", "title": "T1546.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584907" }, { "id": 570852, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8e43367-c215-5935-88f3-79b13aab5e24", "parentControlId": 31359, "controlId": "T1546.013", "title": "T1546.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584907" }, { "id": 570853, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4254da7-08d6-5926-b324-d340ed6a520a", "parentControlId": 31359, "controlId": "T1546.014", "title": "T1546.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584907" }, { "id": 570854, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c6505fe-b3e9-5070-af4c-08c825fd6950", "parentControlId": 31359, "controlId": "T1546.016", "title": "T1546.016", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584907" }, { "id": 570855, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1388086-bbfb-5118-8c31-a8e0daee864d", "parentControlId": 31359, "controlId": "T1547.002", "title": "T1547.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584907" }, { "id": 570856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2360355e-714c-51ca-9bf0-3e0c2fd6e2f4", "parentControlId": 31359, "controlId": "T1547.005", "title": "T1547.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584907" }, { "id": 570857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "242e1cdc-6d2c-5bb5-8108-70a847029e22", "parentControlId": 31359, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584907" }, { "id": 570858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6fcf8d4-7fc5-5700-9594-6869d0f76902", "parentControlId": 31359, "controlId": "T1547.007", "title": "T1547.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584907" }, { "id": 570859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f010598b-9664-5c9c-9d1d-2f148da62392", "parentControlId": 31359, "controlId": "T1547.008", "title": "T1547.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584907" }, { "id": 570860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a03e3d7b-fd22-556f-82cc-1c54da5ef8ae", "parentControlId": 31359, "controlId": "T1547.009", "title": "T1547.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584908" }, { "id": 570861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f748b9f-ca9f-5cd6-9748-685123eb3ab5", "parentControlId": 31359, "controlId": "T1547.013", "title": "T1547.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584908" }, { "id": 570862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a545b64f-857c-5ad2-8ab5-d3ad14c613a4", "parentControlId": 31359, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584908" }, { "id": 570863, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3c8e475-cbe9-57a7-b4b7-d4145ad39d8d", "parentControlId": 31359, "controlId": "T1548.004", "title": "T1548.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584908" }, { "id": 570864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f99da96c-44af-5d95-83e8-d07d1eb2d741", "parentControlId": 31359, "controlId": "T1548.006", "title": "T1548.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584908" }, { "id": 570865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0cafc652-c7d5-559f-96a3-8307ed4bad85", "parentControlId": 31359, "controlId": "T1553.003", "title": "T1553.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584908" }, { "id": 570866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4bb9fcce-1975-586e-a70b-596ffe75c95e", "parentControlId": 31359, "controlId": "T1554", "title": "T1554", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584908" }, { "id": 570867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97c2539a-7adf-59ba-a06c-f0b6efb746c8", "parentControlId": 31359, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584908" }, { "id": 570868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cfff35a-625a-5fe8-8d1b-778888c26c57", "parentControlId": 31359, "controlId": "T1557.001", "title": "T1557.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584909" }, { "id": 570869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50cc9026-aacc-5d51-9679-dd6cf46a508d", "parentControlId": 31359, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584909" }, { "id": 570870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50616f96-bafd-554c-90fb-be6cbdd1af69", "parentControlId": 31359, "controlId": "T1557.003", "title": "T1557.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584909" }, { "id": 570871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5190d305-d5d1-514e-a55c-9b07018acfb7", "parentControlId": 31359, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584909" }, { "id": 570872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e468e796-4a79-51e1-b24c-9e2dddbe1fe7", "parentControlId": 31359, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584909" }, { "id": 570873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad7be18a-aa34-5990-8bc8-a724c853c8c3", "parentControlId": 31359, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584909" }, { "id": 570874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "222eeaca-3f41-5842-8e76-57ea8f7995ea", "parentControlId": 31359, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584909" }, { "id": 570875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29dc4a4b-a12f-54f2-8da8-b21bf9631e3d", "parentControlId": 31359, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584909" }, { "id": 570876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ecc9e08-cda9-5ed3-92e0-f642408c9a50", "parentControlId": 31359, "controlId": "T1559.001", "title": "T1559.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584909" }, { "id": 570877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96f8d8f4-ae4e-5fca-9e81-935eaca56e1f", "parentControlId": 31359, "controlId": "T1559.002", "title": "T1559.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584909" }, { "id": 570878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfa28fe7-6269-5ca8-8fdc-7f802162ea2a", "parentControlId": 31359, "controlId": "T1560", "title": "T1560", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58491" }, { "id": 570879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5d5ac9d-bf5e-5f1d-91e8-a7d0c1ae9c45", "parentControlId": 31359, "controlId": "T1560.001", "title": "T1560.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58491" }, { "id": 570880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4999a2aa-70a3-50a5-8c1e-2f810b69fdbd", "parentControlId": 31359, "controlId": "T1561", "title": "T1561", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58491" }, { "id": 570881, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c09a5ff4-5ece-57a4-ad57-4aa9bf5d2095", "parentControlId": 31359, "controlId": "T1561.001", "title": "T1561.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58491" }, { "id": 570882, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b01ac70-e1f5-5a48-8b3f-c95357ce1881", "parentControlId": 31359, "controlId": "T1561.002", "title": "T1561.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58491" }, { "id": 570883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65607767-b39a-5901-8ba9-a2cf920e1274", "parentControlId": 31359, "controlId": "T1562", "title": "T1562", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58491" }, { "id": 570884, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b31f984-8fac-55f1-88ba-76c4127ed28e", "parentControlId": 31359, "controlId": "T1562.001", "title": "T1562.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58491" }, { "id": 570885, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35d30b61-26b1-5f30-b592-3d3d39a5a61a", "parentControlId": 31359, "controlId": "T1562.002", "title": "T1562.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58491" }, { "id": 570886, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc8a451f-754d-5240-af11-b6b73cda218a", "parentControlId": 31359, "controlId": "T1562.004", "title": "T1562.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58491" }, { "id": 570887, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13d69b50-491e-5d8a-a27c-e1ae8817e6bc", "parentControlId": 31359, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584911" }, { "id": 570888, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9cc5ab80-6c08-5f1e-97ea-d2a04a05d7e0", "parentControlId": 31359, "controlId": "T1562.011", "title": "T1562.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584911" }, { "id": 570889, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f07fa95d-65f5-59a7-baea-dba8949044d0", "parentControlId": 31359, "controlId": "T1564.004", "title": "T1564.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584911" }, { "id": 570890, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b1ba8a7-ad7e-5370-be87-c10df04fd9b0", "parentControlId": 31359, "controlId": "T1564.008", "title": "T1564.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584911" }, { "id": 570891, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a75c5a27-db53-5068-ae0b-2b2983798cce", "parentControlId": 31359, "controlId": "T1564.009", "title": "T1564.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584911" }, { "id": 570892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc0353da-085e-5a01-9024-fb67b12d953a", "parentControlId": 31359, "controlId": "T1564.012", "title": "T1564.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584911" }, { "id": 570893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a870b6bf-1a98-581d-80de-5a2be2ebc2aa", "parentControlId": 31359, "controlId": "T1566", "title": "T1566", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584911" }, { "id": 570894, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ced6efb-389b-56b3-9a8d-2ecb3161f674", "parentControlId": 31359, "controlId": "T1566.001", "title": "T1566.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584911" }, { "id": 570895, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bcabb93-b938-51dd-a4ed-86564e454afc", "parentControlId": 31359, "controlId": "T1566.002", "title": "T1566.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584911" }, { "id": 570896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01904483-6194-5c3e-85be-cca4a4ee8e92", "parentControlId": 31359, "controlId": "T1566.003", "title": "T1566.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584912" }, { "id": 570897, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eeaddae2-bd43-521b-a67b-e7e26d89938d", "parentControlId": 31359, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584912" }, { "id": 570898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7308f24f-b732-541f-a23e-d964da359f3e", "parentControlId": 31359, "controlId": "T1568", "title": "T1568", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584912" }, { "id": 570899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c1783d3-5a99-546a-874c-c164e22bb959", "parentControlId": 31359, "controlId": "T1568.002", "title": "T1568.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584912" }, { "id": 570900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "614250e0-fda1-5fd6-8246-e523e1cca87d", "parentControlId": 31359, "controlId": "T1569", "title": "T1569", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584912" }, { "id": 570901, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cf01d92-93bb-5b63-a8ca-8106888cc5e9", "parentControlId": 31359, "controlId": "T1569.002", "title": "T1569.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584912" }, { "id": 570902, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91abc662-d9ba-5494-9088-70500e7b1b1f", "parentControlId": 31359, "controlId": "T1570", "title": "T1570", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584912" }, { "id": 570903, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1e5d1e6-4055-5288-ac43-b686d3e1f465", "parentControlId": 31359, "controlId": "T1571", "title": "T1571", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584912" }, { "id": 570904, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e521f6b-06f3-5f9d-be6a-97517b6e1ea6", "parentControlId": 31359, "controlId": "T1572", "title": "T1572", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584912" }, { "id": 570905, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e802a40-7eca-5930-98b1-ea2462f006ca", "parentControlId": 31359, "controlId": "T1573", "title": "T1573", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584913" }, { "id": 570906, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e451021b-a63e-521f-a3e8-51015df7c47e", "parentControlId": 31359, "controlId": "T1573.001", "title": "T1573.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584913" }, { "id": 570907, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "136bba85-0f95-52bd-b8b7-5aeeb2482637", "parentControlId": 31359, "controlId": "T1573.002", "title": "T1573.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584913" }, { "id": 570908, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "622e4c52-bb20-514e-b9a1-489d3d411016", "parentControlId": 31359, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584913" }, { "id": 570909, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d31fc56-5aa7-532c-bd9e-0a8d1df564f1", "parentControlId": 31359, "controlId": "T1574.001", "title": "T1574.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584913" }, { "id": 570910, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c71de1f-b353-5056-9a5e-e093cb3c61bf", "parentControlId": 31359, "controlId": "T1574.004", "title": "T1574.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584913" }, { "id": 570911, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fbb480d-103c-55c4-8860-95ff75145fc7", "parentControlId": 31359, "controlId": "T1574.007", "title": "T1574.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584913" }, { "id": 570912, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6afde3b9-8a87-5ea0-9dbf-085c26a23ef0", "parentControlId": 31359, "controlId": "T1574.008", "title": "T1574.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584913" }, { "id": 570913, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3f4d093-346c-5c0a-8a86-b18835444da0", "parentControlId": 31359, "controlId": "T1574.009", "title": "T1574.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584913" }, { "id": 570914, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584914", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fc5ed56-9f34-57e0-9b76-2f2895b1f871", "parentControlId": 31359, "controlId": "T1574.013", "title": "T1574.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584914" }, { "id": 570915, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584914", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d986480a-7f97-5d71-a806-7312a1c87ff4", "parentControlId": 31359, "controlId": "T1574.014", "title": "T1574.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584914" }, { "id": 570916, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584914", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "685b82e7-d077-51bc-a8bf-70ab1959f179", "parentControlId": 31359, "controlId": "T1598", "title": "T1598", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584914" }, { "id": 570917, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584914", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ece1dce9-a54c-59cd-8e8e-17474ef3b376", "parentControlId": 31359, "controlId": "T1598.001", "title": "T1598.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584914" }, { "id": 570918, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584914", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c8a7835-19cd-5590-acbd-e35a0bb6b44d", "parentControlId": 31359, "controlId": "T1598.002", "title": "T1598.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584914" }, { "id": 570919, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584914", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2e8563c-e3e1-5d3a-a57b-325a9f681240", "parentControlId": 31359, "controlId": "T1598.003", "title": "T1598.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584914" }, { "id": 570920, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584915", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a22ae230-e935-58d9-8738-a99cbea5686b", "parentControlId": 31359, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584915" }, { "id": 570921, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584915", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84e9f96f-1662-5045-aee2-b02961b7e2ba", "parentControlId": 31359, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584915" }, { "id": 570922, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584915", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b68b08a-8971-5e11-8918-1f9352abc65d", "parentControlId": 31359, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584915" }, { "id": 570923, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584915", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4199bc68-55ca-55e3-a428-3732d682318b", "parentControlId": 31359, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584915" }, { "id": 570924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584915", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fe6a2eb-d2d4-575b-a020-0df1d9cc8c8e", "parentControlId": 31359, "controlId": "T1622", "title": "T1622", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584915" }, { "id": 570928, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584915", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c318e494-be04-5a64-aa8c-cf9951b3ec17", "parentControlId": 31359, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584915" }, { "id": 570929, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c2f9f81-b215-5c41-92ae-afa284d8adee", "parentControlId": 31359, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584916" }, { "id": 570931, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14d920d7-b373-5492-a82e-af9f50234e78", "parentControlId": 31359, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584916" }, { "id": 570932, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fab81b3-4971-584d-8738-b286d88b70a4", "parentControlId": 31359, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584916" }, { "id": 570933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5796150-fcb3-5a4b-9b4f-79b65a97f31c", "parentControlId": 31359, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584916" }, { "id": 570934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d547f38-4a16-51d9-8609-259553eda570", "parentControlId": 31359, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584916" }, { "id": 570935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "860e4a4e-e5c1-5d7d-b554-d0181333d2b7", "parentControlId": 31359, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584916" }, { "id": 570936, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2600a81-f65f-5d50-ad06-1651c178deb7", "parentControlId": 31359, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584916" }, { "id": 570937, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15cade06-2f86-564d-afdd-ca3a69d89260", "parentControlId": 31359, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584916" }, { "id": 570938, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a6b943e-fb95-566e-9abf-c08671197f5f", "parentControlId": 31359, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584917" }, { "id": 570941, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02598c56-bb42-5fcd-8371-2cc5d980121a", "parentControlId": 31359, "controlId": "3.14.2", "title": "3.14.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584917" }, { "id": 570942, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdb08350-4591-5f0b-8f66-ee7f9b40698e", "parentControlId": 31359, "controlId": "03.14.02.c", "title": "03.14.02.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584917" }, { "id": 570943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "328af1fc-19a8-5ef6-af18-acd160808c70", "parentControlId": 31359, "controlId": "03.14.02.c.01", "title": "03.14.02.c.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584917" }, { "id": 570944, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce948b03-ff50-5417-a297-2064ff3873f1", "parentControlId": 31359, "controlId": "03.14.02.c.02", "title": "03.14.02.c.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584917" }, { "id": 570954, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584918", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ba11cc8-d359-57aa-80ad-c83d46b5f8f4", "parentControlId": 31359, "controlId": "DE.CM-09", "title": "DE.CM-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584918" }, { "id": 571032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584927", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fd47d71-d9cc-5171-a245-5808e76f5b74", "parentControlId": 31359, "controlId": "CIP-007-6 3.1", "title": "CIP-007-6 3.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584927" }, { "id": 571033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584927", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c460cd9f-3e8c-5443-892e-c5f1b07e5937", "parentControlId": 31359, "controlId": "CIP-007-6 3.2", "title": "CIP-007-6 3.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584927" }, { "id": 571034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584927", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b62df315-8965-5dc3-bda9-5004d8d1ff17", "parentControlId": 31359, "controlId": "CIP-007-6 3.3", "title": "CIP-007-6 3.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584927" }, { "id": 571035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584927", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b40ce6f2-8756-5ab0-b85e-6b6715da0570", "parentControlId": 31359, "controlId": "CIP-007-6 4.2.1", "title": "CIP-007-6 4.2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584927" }, { "controlId": "B.5.2", "title": "B.5.2 — Host Intrusion Detection System", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "2bc838f9-e88c-562d-acd5-d0cb1f7c93e7", "isPublic": true }, { "controlId": "NEI 08-09 App D.5.2", "title": "NEI 08-09 App D.5.2 — Host Intrusion Detection System", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.5.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6fe77138-b415-5091-b1ee-f01abc891d81", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.5.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "0c2be838-762a-565a-81e6-5e6025fa472f", "isPublic": true }, { "controlId": "C.3.3", "title": "C.3.3 — Malicious Code Protection", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a58a94c2-5d6a-5581-944f-4538e130c069", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.3", "title": "NEI 08-09 App E.3.3 — Malicious Code Protection", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "b15acb37-d83e-5aa5-88f6-77ea877b8e07", "isPublic": true }, { "controlId": "CIP-007-6-R3", "title": "CIP-007-6-R3 — Malicious Code Prevention", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "da40c08c-92e7-5894-b302-4927349de383", "isPublic": true }, { "controlId": "CIP-007-6-3.1", "title": "CIP-007-6-3.1 — Deploy method(s) to deter, detect, or prevent malicious code.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9c35a2d4-305a-5054-84a9-6ae6bb5389fd", "isPublic": true }, { "controlId": "CIP-007-6-3.2", "title": "CIP-007-6-3.2 — Mitigate the threat of detected malicious code.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "763a0638-e8b5-562c-bff7-7cb0693eede0", "isPublic": true }, { "controlId": "CIP-007-6-3.3", "title": "CIP-007-6-3.3 — For those methods identified in Part 3.1 that use signatures or patterns, have a process for the update of the signat...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9343ad16-99cb-53d1-84f4-2cece3e596f2", "isPublic": true }, { "controlId": "CIP-010-4-R4", "title": "CIP-010-4-R4 — Transient Cyber Asset and Removable Media Security", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "dea7f8f9-f037-58af-b66f-3c94bb8750e1", "isPublic": true } ], "id": 31359, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731059", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731059", "catalogueId": 1062, "uuid": "a453af09-b172-5f5c-9bc7-2ca405d0c611", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize antimalware technologies to detect and eradicate malicious code?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Malicious Code Protection (Anti-Malware)", "description": "

Control Description

Mechanisms exist to utilize antimalware technologies to detect and eradicate malicious code.

Evidence Request List (ERL)

E-END-01\nE-MON-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Anti-malware technologies are decentralized but are deployed on all technology assets that can run anti-malware software.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Anti-malware technologies are centralized, deployed on all technology assets that can run anti-malware software.\n▪ Anti-malware technologies are configured to generate event logs that can be centrally-reviewed (e.g., forwarded to a SIEM).\n▪ Anti-malware detection tools are configured to provide real-time protection (e.g., always on).\n▪ Anti-malware detection tools are configured to automatically update.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize antimalware technologies to detect and eradicate malicious code.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.5.2, C.3.3
NERC-CIP (2026) Requirements: CIP-007-6-R3, CIP-010-4-R4", "controlId": "END-04", "family": "Endpoint Security", "enhancements": "", "sortId": "END-04", "references": "

Micro-Small Business (<10 staff)

∙ Antimalware software

Small Business (10-49 staff)

∙ Antimalware software

Medium Business (50-249 staff)

∙ Antimalware software

Large Business (250-999 staff)

∙ Antimalware software

Enterprise (>1,000 staff)

∙ Antimalware software", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71202, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590444", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590444", "securityControlId": 31360, "ccis": [], "uuid": "627ef413-05a8-59f4-8feb-77dafaa0f2db", "testId": "END-04.1_A01", "test": "malicious code protection mechanisms are updated as new releases are available.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.14.4", "defaultText": null }, { "id": 71203, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590444", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590444", "securityControlId": 31360, "ccis": [], "uuid": "4bf091ef-77c9-53f1-8fe6-206186838861", "testId": "END-04.1_A02", "test": "malicious code protection mechanisms are updated as new releases are available in accordance with configuration management policy and procedures.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.14.02.b", "defaultText": null }, { "id": 71204, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590444", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590444", "securityControlId": 31360, "ccis": [], "uuid": "b617150f-5ebe-54ee-8608-5a5b5b978e1f", "testId": "END-04.1_A03", "test": "malicious code protection mechanisms are updated when new releases are available.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "CMMC L1 Assessment Guide", "defaultText": null } ], "externalMappings": [ { "id": 571115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c02a59d-3a14-5ee6-9acf-6221832410d6", "parentControlId": 31360, "controlId": "COMP 2.3", "title": "COMP 2.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584945" }, { "id": 571116, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fbac7ec-8870-502b-923d-b513567a73a5", "parentControlId": 31360, "controlId": "8.7", "title": "8.7", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584945" }, { "id": 571120, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5925b715-a342-5a1a-adfe-f2eef48ab466", "parentControlId": 31360, "controlId": "SI-3(2)", "title": "SI-3(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584945" }, { "id": 571121, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d78772b5-1b0e-5169-ab0e-a3ac101ec4eb", "parentControlId": 31360, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584946" }, { "id": 571122, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584946", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92282ca1-13af-5555-9b65-10d6821f924e", "parentControlId": 31360, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584946" }, { "id": 571125, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584946", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1ee745e-b1f9-5ad7-b08c-b5caa6588c5a", "parentControlId": 31360, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584946" }, { "id": 571126, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584946", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6b161c4-d192-5883-8eae-26e44f606b96", "parentControlId": 31360, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584946" }, { "id": 571127, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584946", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce154e67-f383-5d1a-a58d-82c81ccc0d34", "parentControlId": 31360, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584946" }, { "id": 571128, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584946", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32a5fbba-e1c2-5ddd-a0d8-f7ea8444208e", "parentControlId": 31360, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584946" }, { "id": 571129, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584946", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ccbd522-9669-5db0-ba84-e0945bfa9920", "parentControlId": 31360, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584946" }, { "id": 571130, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584946", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83768822-a066-5055-acd3-00f40e56557f", "parentControlId": 31360, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584946" }, { "id": 571131, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e99528ab-ce0c-53f9-8a91-991f267b7fb2", "parentControlId": 31360, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584947" }, { "id": 571132, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23b67f19-c468-5a09-91ac-5ee3a28d7efa", "parentControlId": 31360, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584947" }, { "id": 571133, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38ba6513-e2f8-5003-aa13-8fa76a2e62c1", "parentControlId": 31360, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584947" }, { "id": 571134, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6b69131-4f43-5847-a315-2f200188a7cc", "parentControlId": 31360, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584947" }, { "id": 571135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5aa4e59c-b550-5028-8bd3-68ec7d5211e5", "parentControlId": 31360, "controlId": "SI-2", "title": "SI-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584947" }, { "id": 571136, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e792fdf-1b66-5eaa-8f40-6b444cfaeeff", "parentControlId": 31360, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584947" }, { "id": 571137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e68b94c-2a7a-54d8-bdf8-ad0e93ffa7ed", "parentControlId": 31360, "controlId": "SI-2", "title": "SI-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584947" }, { "id": 571138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8eebaf1b-149f-59c0-a6ad-6bddae303a53", "parentControlId": 31360, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584947" }, { "id": 571139, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d51cd995-f3b1-5fdf-b955-6cddf88bdfda", "parentControlId": 31360, "controlId": "SI-2", "title": "SI-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584947" }, { "id": 571140, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b34a6acd-4d55-5e56-9268-5e3035aa6212", "parentControlId": 31360, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584948" }, { "id": 571145, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c05b774-8f3e-59d0-8bf3-9d16631cd7ce", "parentControlId": 31360, "controlId": "3.14.4", "title": "3.14.4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584948" }, { "id": 571146, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bc22b72-8e99-52aa-a1f9-a01bec76e922", "parentControlId": 31360, "controlId": "03.14.02.b", "title": "03.14.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584948" }, { "controlId": "C.3.3", "title": "C.3.3 — Malicious Code Protection", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "f30e1fb8-9c4f-5968-94e3-51ef6fc8b71a", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.3", "title": "NEI 08-09 App E.3.3 — Malicious Code Protection", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "73f21ab6-64af-5618-ad84-53b51ba1dcbb", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.3.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "d072f8f3-27cb-532f-8da3-ae2babfd6d94", "isPublic": true }, { "controlId": "CIP-007-6-R3", "title": "CIP-007-6-R3 — Malicious Code Prevention", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "adcdecf9-f92d-5cf2-ad58-aef089deeff1", "isPublic": true }, { "controlId": "CIP-007-6-3.1", "title": "CIP-007-6-3.1 — Deploy method(s) to deter, detect, or prevent malicious code.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c23d0ea1-a5b1-5c13-9621-4e3ca1cb6cf1", "isPublic": true }, { "controlId": "CIP-007-6-3.2", "title": "CIP-007-6-3.2 — Mitigate the threat of detected malicious code.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e6da2012-3e12-5372-875a-909f5dfce40a", "isPublic": true }, { "controlId": "CIP-007-6-3.3", "title": "CIP-007-6-3.3 — For those methods identified in Part 3.1 that use signatures or patterns, have a process for the update of the signat...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d0c39cff-489e-56f6-a4cf-c648ccee85a1", "isPublic": true } ], "id": 31360, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731059", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731059", "catalogueId": 1062, "uuid": "9e342df0-3d9d-549a-a125-9fd4c0d95c5e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization automatically update antimalware technologies, including signature definitions?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Automatic Antimalware Signature Updates", "description": "

Control Description

Automated mechanisms exist to update antimalware technologies, including signature definitions.

Evidence Request List (ERL)

E-END-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Anti-malware detection tools are configured to automatically update.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically update antimalware technologies, including signature definitions.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.3.3
NERC-CIP (2026) Requirements: CIP-007-6-R3", "controlId": "END-04.1", "family": "Endpoint Security", "enhancements": "", "sortId": "END-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71206, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590445", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590445", "securityControlId": 31362, "ccis": [], "uuid": "a2622ee4-c5f6-5460-aa7f-07a33541381c", "testId": "END-04.3_A01", "test": "antimalware controls and related processes to be centrally managed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created\n53A_R5_PL-09_ODP", "defaultText": null }, { "id": 71207, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590445", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590445", "securityControlId": 31362, "ccis": [], "uuid": "91e561fd-d5bd-55c7-bdc9-fce931de1afe", "testId": "END-04.3_A02", "test": "antimalware controls and related processes are centrally managed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created\n53A_R5_PL-09", "defaultText": null } ], "externalMappings": [ { "id": 571199, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584954", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae87e642-a293-5a84-9b7e-58aed542622a", "parentControlId": 31362, "controlId": "SR 3.2 RE 2", "title": "SR 3.2 RE 2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584954" }, { "id": 571200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584954", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "912c8f27-d5da-5687-a47f-2a148bc5f292", "parentControlId": 31362, "controlId": "HDR 3.2(1)", "title": "HDR 3.2(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584954" }, { "id": 571201, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584954", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afc80f4e-b11b-5fc1-b160-8d7c95b9b352", "parentControlId": 31362, "controlId": "SI-3(1)", "title": "SI-3(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584954" }, { "id": 571202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584954", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ada3af5-8e4d-5b19-8d3c-78d9dc4f8c6d", "parentControlId": 31362, "controlId": "PL-09", "title": "PL-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584954" }, { "id": 571204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584955", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee78ec61-a65c-5d0e-a67b-d22f612fa683", "parentControlId": 31362, "controlId": "PL-09", "title": "PL-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584955" }, { "id": 571205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584955", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9a9d99c-123e-5fd8-8850-a9ba6d66dd2a", "parentControlId": 31362, "controlId": "PL-9", "title": "PL-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584955" }, { "id": 571208, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584955", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "260fc898-794f-51df-8218-292cced8c5f1", "parentControlId": 31362, "controlId": "03.14.02.a", "title": "03.14.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584955" } ], "id": 31362, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73106", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73106", "catalogueId": 1062, "uuid": "f2ff0783-7f1e-5586-ac3c-f12ea8aa48e6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization centrally-manage antimalware technologies?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 8.0, "title": "Centralized Management of Antimalware Technologies", "description": "

Control Description

Mechanisms exist to centrally-manage antimalware technologies.

Evidence Request List (ERL)

E-END-03\nE-MON-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to centrally-manage antimalware technologies.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-04.3", "family": "Endpoint Security", "enhancements": "", "sortId": "END-04.3", "references": "

Micro-Small Business (<10 staff)

∙ Antimalware software

Small Business (10-49 staff)

∙ Antimalware software

Medium Business (50-249 staff)

∙ Antimalware software

Large Business (250-999 staff)

∙ Antimalware software

Enterprise (>1,000 staff)

∙ Antimalware software", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71208, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590445", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590445", "securityControlId": 31363, "ccis": [], "uuid": "aab01f55-c481-5efc-882a-92e8c9b41d1f", "testId": "END-04.4_A01", "test": "malicious code protection mechanisms are implemented at system entry and exit points to detect malicious code.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-03a.[01]", "defaultText": null }, { "id": 71209, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590446", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590446", "securityControlId": 31363, "ccis": [], "uuid": "e4452c53-c774-5395-be53-741f390b8155", "testId": "END-04.4_A02", "test": "malicious code protection mechanisms are updated automatically as new releases are available in accordance with organizational configuration management policy and procedures.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-03b.", "defaultText": null }, { "id": 71210, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590446", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590446", "securityControlId": 31363, "ccis": [], "uuid": "36d06340-1f29-5651-9401-0f2785997aa9", "testId": "END-04.4_A03", "test": "malicious code protection mechanisms are configured to perform periodic scans of the system frequency.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: at least weekly", "otherId": "53A_R5_SI-03c.01[01]", "defaultText": null }, { "id": 71211, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590446", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590446", "securityControlId": 31363, "ccis": [], "uuid": "7b7b9103-e60c-595e-9880-4aa217b6a91e", "testId": "END-04.4_A04", "test": "malicious code protection mechanisms are configured to perform real-time scans of files from external sources as the files are downloaded, opened or executed in accordance with organizational policy.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-03c.01[02]", "defaultText": null } ], "externalMappings": [ { "id": 571234, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584958", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d38de649-0ce0-56ec-b9cf-993eeadeb084", "parentControlId": 31363, "controlId": "SI-3(7)", "title": "SI-3(7)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584958" }, { "id": 571235, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584958", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7229cab2-64f8-568a-a487-63fdf5cebdaf", "parentControlId": 31363, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584958" }, { "id": 571237, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584958", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c442c6ed-4c63-55e4-bd27-35227e9a7e0e", "parentControlId": 31363, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584958" }, { "id": 571238, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584958", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "608bdb4c-1186-5514-87f1-819a7876c31a", "parentControlId": 31363, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584959" }, { "id": 571239, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db95d5e4-5b01-5ffe-b9b9-39a108e2dad5", "parentControlId": 31363, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584959" }, { "id": 571240, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "726db674-c14c-50f9-b5fc-707db2c1c254", "parentControlId": 31363, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584959" }, { "id": 571241, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7dcf231-5341-5135-8c70-6a9a591aa969", "parentControlId": 31363, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584959" }, { "id": 571242, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20b40253-8cf0-58a8-8c32-c1ae01606635", "parentControlId": 31363, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584959" }, { "id": 571243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76fcba56-294e-5dd6-ba93-414ad9ed7a57", "parentControlId": 31363, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584959" }, { "id": 571244, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98bb8d8a-006d-59c3-a71f-8d775f8b7cf4", "parentControlId": 31363, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584959" }, { "id": 571255, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58496", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7167da7-10e6-5d3e-a8ce-b07eeadfe85f", "parentControlId": 31363, "controlId": "CIP-007-6 3.3", "title": "CIP-007-6 3.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58496" } ], "id": 31363, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73106", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73106", "catalogueId": 1062, "uuid": "1c3b1782-35cf-58e7-9973-03930e86951d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize heuristic / nonsignature-based antimalware detection capabilities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Heuristic / Nonsignature-Based Detection", "description": "

Control Description

Mechanisms exist to utilize heuristic / nonsignature-based antimalware detection capabilities.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize heuristic / nonsignature-based antimalware detection capabilities.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-04.4", "family": "Endpoint Security", "enhancements": "", "sortId": "END-04.4", "references": "

Micro-Small Business (<10 staff)

∙ Antimalware software

Small Business (10-49 staff)

∙ Antimalware software

Medium Business (50-249 staff)

∙ Antimalware software

Large Business (250-999 staff)

∙ Antimalware software

Enterprise (>1,000 staff)

∙ Antimalware software", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71212, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590449", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590449", "securityControlId": 31364, "ccis": [], "uuid": "97240636-0e2a-5de4-8e3f-bebd70a4870a", "testId": "END-04.5_A01", "test": "the frequency at which to test malicious code protection mechanisms is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-03(06)_ODP", "defaultText": null }, { "id": 71213, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59045", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59045", "securityControlId": 31364, "ccis": [], "uuid": "406a43b3-1bac-5e24-8dfb-c9bba8da1fe2", "testId": "END-04.5_A02", "test": "malicious code protection mechanisms are tested frequently by introducing known benign code into the system.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-03(06)(a)", "defaultText": null }, { "id": 71214, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59045", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59045", "securityControlId": 31364, "ccis": [], "uuid": "234cea6c-dc99-5925-aeda-ff0eb61ceda3", "testId": "END-04.5_A03", "test": "the detection of (benign test) code occurs.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-03(06)(b)[01]", "defaultText": null }, { "id": 71215, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59045", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59045", "securityControlId": 31364, "ccis": [], "uuid": "1bd50de5-ad90-5780-b57c-72e303c9f1d3", "testId": "END-04.5_A04", "test": "the associated incident reporting occurs.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-03(06)(b)[02]", "defaultText": null } ], "externalMappings": [ { "id": 571269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584962", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12e00f5e-9fa3-5f62-97c7-2e4d28eedf6e", "parentControlId": 31364, "controlId": "COMP 2.3", "title": "COMP 2.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584962" }, { "id": 571270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584962", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5da45ee9-e2a1-5582-b42d-fb9a79d79eb6", "parentControlId": 31364, "controlId": "SI-3(6)", "title": "SI-3(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584962" }, { "id": 571271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584962", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdd05d3b-2739-5a57-b885-c544f57b1dbb", "parentControlId": 31364, "controlId": "SI-03(06)", "title": "SI-03(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584962" }, { "id": 571272, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584962", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "599d5d82-b40c-5cdd-a3e8-7f1f12b6226b", "parentControlId": 31364, "controlId": "SI-03(06)", "title": "SI-03(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584962" } ], "id": 31364, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731061", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731061", "catalogueId": 1062, "uuid": "61a4cd6d-6583-5366-bce5-89f2a2e09e46", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization test antimalware technologies by introducing a known benign, non-spreading test case into the system and subsequently verifying that both detection of the test case and associated incident reporting occurs?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Malware Protection Mechanism Testing", "description": "

Control Description

Mechanisms exist to test antimalware technologies by introducing a known benign, non-spreading test case into the system and subsequently verifying that both detection of the test case and associated incident reporting occurs.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to test antimalware technologies by introducing a known benign, non-spreading test case into the system and subsequently verifying that both detection of the test case and associated incident reporting occurs.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-04.5", "family": "Endpoint Security", "enhancements": "", "sortId": "END-04.5", "references": "

Micro-Small Business (<10 staff)

∙ EICAR test file

Small Business (10-49 staff)

∙ EICAR test file

Medium Business (50-249 staff)

∙ EICAR test file

Large Business (250-999 staff)

∙ EICAR test file

Enterprise (>1,000 staff)

∙ EICAR test file", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71218, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590451", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590451", "securityControlId": 31366, "ccis": [], "uuid": "6460a4af-e77a-5413-b461-10a0ba8c6f35", "testId": "END-04.7_A01", "test": "malicious code protection mechanisms are configured to perform real-time scans of files from external sources as the files are downloaded, opened or executed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-03c.01[02]\n171A_3.14.5[c]", "defaultText": null }, { "id": 71219, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590451", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590451", "securityControlId": 31366, "ccis": [], "uuid": "f218f6e2-d7e2-5a46-960f-45760d50e1e4", "testId": "END-04.7_A02", "test": "malicious code protection mechanisms are configured to perform scans of the system per an organization-defined frequency.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: at least weekly", "otherId": "SCF Created", "defaultText": null }, { "id": 71220, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590451", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590451", "securityControlId": 31366, "ccis": [], "uuid": "58df59e1-de7f-59d4-97f0-e14c80fee551", "testId": "END-04.7_A03", "test": "malicious code protection mechanisms are configured to perform real-time scans of files from external sources at endpoints or system entry and exit points as the files are downloaded, opened, or executed.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.14.02.c.01[02]", "defaultText": null }, { "id": 71221, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590451", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590451", "securityControlId": 31366, "ccis": [], "uuid": "10e2e574-f5b2-53e4-89cb-e338919dbf9e", "testId": "END-04.7_A04", "test": "malicious code protection mechanisms are configured to perform scans of the system .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least weekly", "otherId": "171A_R3_A.03.14.02.c.01[01]", "defaultText": null }, { "id": 71222, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590452", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590452", "securityControlId": 31366, "ccis": [], "uuid": "e35dc37a-8060-50f1-bbe2-7cea032c7655", "testId": "END-04.7_A05", "test": "real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "CMMC L1 Assessment Guide", "defaultText": null } ], "externalMappings": [ { "id": 571291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584965", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "628da706-8ff6-5bff-a107-ce2ece1c5bef", "parentControlId": 31366, "controlId": "COMP 2.1", "title": "COMP 2.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584965" }, { "id": 571294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584965", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ce124ec-abd1-54e0-85c1-4d6670734b24", "parentControlId": 31366, "controlId": "3.14.5", "title": "3.14.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584965" }, { "id": 571295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584965", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b953ae6c-b028-5ccd-ac1b-e8baa0dd9973", "parentControlId": 31366, "controlId": "03.14.02.a", "title": "03.14.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584965" }, { "id": 571296, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584965", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3aa5c1c9-7a55-5fbd-8f03-f7f5d3fff7ce", "parentControlId": 31366, "controlId": "03.14.02.c.01", "title": "03.14.02.c.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584965" }, { "id": 571297, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584965", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48392c35-13c4-561e-a224-c02a3c159cea", "parentControlId": 31366, "controlId": "03.14.02.c.02", "title": "03.14.02.c.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584965" } ], "id": 31366, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731061", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731061", "catalogueId": 1062, "uuid": "700b90dc-dada-5271-aefb-9f550439eed5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure that anti-malware technologies are continuously running in real-time and cannot be disabled or altered by non-privileged users, unless specifically authorized by management on a case-by-case basis for a limited time period?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Always On Protection", "description": "

Control Description

Mechanisms exist to ensure that anti-malware technologies are continuously running in real-time and cannot be disabled or altered by non-privileged users, unless specifically authorized by management on a case-by-case basis for a limited time period.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Anti-malware technologies are centralized, deployed on all technology assets that can run anti-malware software.\n▪ Anti-malware technologies are configured to generate event logs that can be centrally-reviewed (e.g., forwarded to a SIEM).\n▪ Anti-malware detection tools are configured to provide real-time protection (e.g., always on).

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure that anti-malware technologies are continuously running in real-time and cannot be disabled or altered by non-privileged users, unless specifically authorized by management on a case-by-case basis for a limited time period.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-04.7", "family": "Endpoint Security", "enhancements": "", "sortId": "END-04.7", "references": "

Micro-Small Business (<10 staff)

∙ Antimalware software

Small Business (10-49 staff)

∙ Antimalware software

Medium Business (50-249 staff)

∙ Antimalware software

Large Business (250-999 staff)

∙ Antimalware software

Enterprise (>1,000 staff)

∙ Antimalware software", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71223, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590452", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590452", "securityControlId": 31367, "ccis": [], "uuid": "69fc5c48-1b87-5321-9a98-014f56df2873", "testId": "END-05_A01", "test": "host-based firewall software, or similar technologies, are used on all systems, where technically feasible.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "controlId": "C.3.6", "title": "C.3.6 — Security Functionality Verification", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "6537111f-2fdb-5c66-b628-036fb423c07a", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.6", "title": "NEI 08-09 App E.3.6 — Security Functionality Verification", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "298fcfbd-4c2c-58ac-8958-dc0b1d3189a3", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.3.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "7d134c14-c8a6-52cd-ad1a-579db870e9af", "isPublic": true } ], "id": 31367, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731062", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731062", "catalogueId": 1062, "uuid": "70c3801a-1776-5502-b0d2-5e6cd77e1daa", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize host-based firewall software, or a similar technology, on all endpoint devices, where technically feasible?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Software Firewall", "description": "

Control Description

Mechanisms exist to utilize host-based firewall software, or a similar technology, on all endpoint devices, where technically feasible.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize host-based firewall software, or a similar technology, on all endpoint devices, where technically feasible.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.3.6", "controlId": "END-05", "family": "Endpoint Security", "enhancements": "", "sortId": "END-05", "references": "

Micro-Small Business (<10 staff)

∙ Host-based firewall software

Small Business (10-49 staff)

∙ Host-based firewall software

Medium Business (50-249 staff)

∙ Host-based firewall software

Large Business (250-999 staff)

∙ Host-based firewall software

Enterprise (>1,000 staff)

∙ Host-based firewall software", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71224, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590452", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590452", "securityControlId": 31368, "ccis": [], "uuid": "73f018ff-2711-5419-8276-6329e6757583", "testId": "END-06_A01", "test": "software, firmware and/or information requiring integrity verification tools to be employed to detect unauthorized changes is defined.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-07_ODP[01]\n53A_R5_SI-07_ODP[02]\n53A_R5_SI-07_ODP[03]", "defaultText": null }, { "id": 71225, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590452", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590452", "securityControlId": 31368, "ccis": [], "uuid": "c150a888-8369-5e8d-bc12-bf576123ab48", "testId": "END-06_A02", "test": "actions to be taken when unauthorized changes to software, firmware and/or information are detected are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-07_ODP[04]\n53A_R5_SI-07_ODP[05]\n53A_R5_SI-07_ODP[06]", "defaultText": null }, { "id": 71226, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590453", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590453", "securityControlId": 31368, "ccis": [], "uuid": "c8d04072-b631-545f-8279-c31255bce061", "testId": "END-06_A03", "test": "integrity verification tools are employed to detect unauthorized changes to software, firmware and/or information.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-07a.[01]\n53A_R5_SI-07a.[02]\n53A_R5_SI-07a.[03]", "defaultText": null }, { "id": 71227, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590453", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590453", "securityControlId": 31368, "ccis": [], "uuid": "653ffea2-6227-5148-8d06-07aaaefe104e", "testId": "END-06_A04", "test": "actions are taken when unauthorized changes to the software, firmware and/or information are detected.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-07b.[01]\n53A_R5_SI-07b.[02]\n53A_R5_SI-07b.[03]", "defaultText": null } ], "externalMappings": [ { "id": 571370, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584974", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb0d769f-2b3c-5ed1-a647-0c428fb36eb2", "parentControlId": 31368, "controlId": "SM-6", "title": "SM-6", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584974" }, { "id": 571371, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584974", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53d8c282-382b-51bf-93c6-59da21eff5bc", "parentControlId": 31368, "controlId": "CR 3.4", "title": "CR 3.4", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584974" }, { "id": 571372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584974", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9816788f-c9a1-5039-944a-c101eeaa39db", "parentControlId": 31368, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584974" }, { "id": 571373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584974", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00c05f5e-4857-52f0-aee4-bc40fd72a30b", "parentControlId": 31368, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584974" }, { "id": 571374, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584974", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9187ed77-19ce-5472-8de7-201d6cba2a3e", "parentControlId": 31368, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584974" }, { "id": 571375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584974", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0e3b259-2706-576c-bf69-a7ace4bb265a", "parentControlId": 31368, "controlId": "T1027", "title": "T1027", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584974" }, { "id": 571376, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584974", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "493217a2-e3c1-5c13-ac6e-2cec2fa59b87", "parentControlId": 31368, "controlId": "T1027.002", "title": "T1027.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584974" }, { "id": 571377, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584974", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "758cd595-0fae-5576-8311-c9cc76242d0f", "parentControlId": 31368, "controlId": "T1027.007", "title": "T1027.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584974" }, { "id": 571378, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584974", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "edbf0a8e-a4cf-5cac-8091-f2d107916377", "parentControlId": 31368, "controlId": "T1027.008", "title": "T1027.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584975" }, { "id": 571379, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2dc53c85-16be-5097-b11a-4e74a99ac825", "parentControlId": 31368, "controlId": "T1027.009", "title": "T1027.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584975" }, { "id": 571380, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8124b10-0790-5f10-ab60-ed71d443dd2f", "parentControlId": 31368, "controlId": "T1036", "title": "T1036", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584975" }, { "id": 571381, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b51621f6-d3a6-5320-8c46-38f51693dc9f", "parentControlId": 31368, "controlId": "T1036.001", "title": "T1036.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584975" }, { "id": 571382, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6797f291-5a5d-5295-b961-6d7b171c4ae2", "parentControlId": 31368, "controlId": "T1036.005", "title": "T1036.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584975" }, { "id": 571383, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2191301d-4ef0-5636-8a31-ad60172ff557", "parentControlId": 31368, "controlId": "T1037", "title": "T1037", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584975" }, { "id": 571384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3be9aa6e-d878-501f-a4b6-160094b81ce3", "parentControlId": 31368, "controlId": "T1037.002", "title": "T1037.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584975" }, { "id": 571385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5adfdca7-8e85-5e37-aa01-9850a026ed58", "parentControlId": 31368, "controlId": "T1037.003", "title": "T1037.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584975" }, { "id": 571386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f72164a1-1172-5303-af84-9cca28767f39", "parentControlId": 31368, "controlId": "T1037.004", "title": "T1037.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584975" }, { "id": 571387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f208b987-0231-57e0-ada9-d0ed287df0e4", "parentControlId": 31368, "controlId": "T1037.005", "title": "T1037.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584975" }, { "id": 571388, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4de0b1bb-af03-5c58-88b0-89d377f59f21", "parentControlId": 31368, "controlId": "T1040", "title": "T1040", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584976" }, { "id": 571389, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97a7bcab-ad8a-5646-b516-3765c9e35328", "parentControlId": 31368, "controlId": "T1047", "title": "T1047", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584976" }, { "id": 571390, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "738f6754-c251-5b2f-a7aa-b56e81e3fd89", "parentControlId": 31368, "controlId": "T1053.006", "title": "T1053.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584976" }, { "id": 571391, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "351ae19d-df2b-5d9d-a365-0b57dc469f54", "parentControlId": 31368, "controlId": "T1056.002", "title": "T1056.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584984" }, { "id": 571392, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73d71fd7-e66b-5b84-9852-d96a9ee4b3d6", "parentControlId": 31368, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584984" }, { "id": 571393, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4418f171-146f-5d6c-9431-946ef0334256", "parentControlId": 31368, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584984" }, { "id": 571394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8982cedf-a704-5554-9981-968210903709", "parentControlId": 31368, "controlId": "T1059.002", "title": "T1059.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584984" }, { "id": 571395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa17fbb8-e3e7-51cc-a576-5b2634b474b9", "parentControlId": 31368, "controlId": "T1059.003", "title": "T1059.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584984" }, { "id": 571396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfbc0887-7b9f-51a7-95b6-e1a85b37f189", "parentControlId": 31368, "controlId": "T1059.004", "title": "T1059.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584984" }, { "id": 571397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6935089a-bcc5-52e7-b1a8-e93ee436bad6", "parentControlId": 31368, "controlId": "T1059.005", "title": "T1059.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584985" }, { "id": 571398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c127b90d-f8d5-5b9f-a6b1-a3e211a8364c", "parentControlId": 31368, "controlId": "T1059.006", "title": "T1059.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584985" }, { "id": 571399, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fee3efe9-907c-52cb-8382-0f0054e5cea0", "parentControlId": 31368, "controlId": "T1059.007", "title": "T1059.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584985" }, { "id": 571400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3dad1fdc-69f8-5a30-8b86-e09e537080b9", "parentControlId": 31368, "controlId": "T1059.008", "title": "T1059.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584985" }, { "id": 571401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6e18a5e-0e78-5df1-aa67-78efcb5d9f81", "parentControlId": 31368, "controlId": "T1059.010", "title": "T1059.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584985" }, { "id": 571402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba14f562-fac6-58d1-a09b-5175ae19f8d9", "parentControlId": 31368, "controlId": "T1059.011", "title": "T1059.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584985" }, { "id": 571403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75f628b7-e12b-5de8-af7e-eb44199feca4", "parentControlId": 31368, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584985" }, { "id": 571404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c49b15e9-8fae-5e40-a67e-5a6b44b47dbe", "parentControlId": 31368, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584985" }, { "id": 571405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9bf0660b-f7a2-5c7e-b5b5-a46f364b3ce5", "parentControlId": 31368, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584985" }, { "id": 571406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfd32fc6-2d49-51f3-b38d-f716656edef7", "parentControlId": 31368, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584986" }, { "id": 571407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5d1ab9f-f6bb-5ab8-b0a7-5dba7d5fd2a1", "parentControlId": 31368, "controlId": "T1070.003", "title": "T1070.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584986" }, { "id": 571408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33cb233d-8ce7-56c5-9de1-d8cc5092d67e", "parentControlId": 31368, "controlId": "T1070.007", "title": "T1070.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584986" }, { "id": 571409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5ef860c-c440-5f6c-97f8-9ad17e7f1275", "parentControlId": 31368, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584986" }, { "id": 571410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e03ee654-b238-526f-acc5-309a82169e39", "parentControlId": 31368, "controlId": "T1070.009", "title": "T1070.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584986" }, { "id": 571411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6664f5d4-b29a-57ba-96eb-45de9dd86f50", "parentControlId": 31368, "controlId": "T1070.010", "title": "T1070.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584986" }, { "id": 571412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b44cf39-6b46-524b-bad2-60cc197c641c", "parentControlId": 31368, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584986" }, { "id": 571413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c71d6f21-781f-58ed-89a5-1622eb96f1a2", "parentControlId": 31368, "controlId": "T1080", "title": "T1080", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584986" }, { "id": 571414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5c7e219-bafb-5f27-be94-7150171937b8", "parentControlId": 31368, "controlId": "T1098.001", "title": "T1098.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584986" }, { "id": 571415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "655ede5a-238a-5862-b130-2e868e69ea9a", "parentControlId": 31368, "controlId": "T1098.002", "title": "T1098.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584987" }, { "id": 571416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6dead655-e886-5ade-9bc5-4a70577c8598", "parentControlId": 31368, "controlId": "T1098.003", "title": "T1098.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584987" }, { "id": 571417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24fbdbb5-1ffd-5474-a20f-f4adb1d43022", "parentControlId": 31368, "controlId": "T1112", "title": "T1112", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584987" }, { "id": 571418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed9cd9aa-01cf-5a7e-a769-c86701552af8", "parentControlId": 31368, "controlId": "T1114", "title": "T1114", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584987" }, { "id": 571419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a3ef66d-0c12-5565-b848-c13e8edc01a1", "parentControlId": 31368, "controlId": "T1114.001", "title": "T1114.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584987" }, { "id": 571420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d34938dd-d233-5776-b390-3f866def6a84", "parentControlId": 31368, "controlId": "T1114.002", "title": "T1114.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584987" }, { "id": 571421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5d65a79-d6df-542f-adc0-559fcd144bd2", "parentControlId": 31368, "controlId": "T1114.003", "title": "T1114.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584987" }, { "id": 571422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5659f12c-d96d-578c-8f62-9aa0e5d2d0f9", "parentControlId": 31368, "controlId": "T1119", "title": "T1119", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584987" }, { "id": 571423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584988", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "825f8a0d-7fc6-5dc8-a347-067731e98d19", "parentControlId": 31368, "controlId": "T1127", "title": "T1127", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584988" }, { "id": 571424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584988", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32dde707-749e-5456-af89-7bda6833d7b3", "parentControlId": 31368, "controlId": "T1127.002", "title": "T1127.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584988" }, { "id": 571425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584988", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d958805-9e1d-5405-b6b7-58a8629fef11", "parentControlId": 31368, "controlId": "T1129", "title": "T1129", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584988" }, { "id": 571426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584988", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "468ba3b7-b634-5ea0-bad5-dada8bfee5fd", "parentControlId": 31368, "controlId": "T1133", "title": "T1133", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584988" }, { "id": 571427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584988", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9127ac02-fa73-5516-82c2-30ab726ac2b1", "parentControlId": 31368, "controlId": "T1136", "title": "T1136", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584988" }, { "id": 571428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584988", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b34e73d4-ec88-5b62-9c85-438080b5a4f7", "parentControlId": 31368, "controlId": "T1136.001", "title": "T1136.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584988" }, { "id": 571429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584988", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e5729e4-3469-5c56-8dab-c026c2825699", "parentControlId": 31368, "controlId": "T1136.002", "title": "T1136.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584988" }, { "id": 571430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584988", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5924335e-4dad-56ad-903c-aa07f38ecc40", "parentControlId": 31368, "controlId": "T1136.003", "title": "T1136.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584988" }, { "id": 571431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584988", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80eaae52-b283-53a8-b5d2-ee9fdc333bf9", "parentControlId": 31368, "controlId": "T1176", "title": "T1176", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584988" }, { "id": 571432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584989", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8335f40a-313d-5ee4-be8e-0a1a857de8d7", "parentControlId": 31368, "controlId": "T1185", "title": "T1185", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584989" }, { "id": 571433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584989", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9c267fd-432a-512f-9d50-31d5b798eea5", "parentControlId": 31368, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584989" }, { "id": 571434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584989", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae672f41-f3a4-5ce7-ab77-0c2e156b1daa", "parentControlId": 31368, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584989" }, { "id": 571435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584989", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e87e643c-c659-5688-b2bc-33aacc134265", "parentControlId": 31368, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584989" }, { "id": 571436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584989", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "327544d9-6f98-55c5-b5a8-ba9a75bafd18", "parentControlId": 31368, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584989" }, { "id": 571437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584989", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ae8ae5e-5e5d-57dc-a9ca-1075b878f3dd", "parentControlId": 31368, "controlId": "T1195.003", "title": "T1195.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584989" }, { "id": 571438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584989", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4815ba25-98eb-5c75-88c7-4f299f071340", "parentControlId": 31368, "controlId": "T1203", "title": "T1203", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584989" }, { "id": 571439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584989", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "912aff15-e95f-5fb8-a2b4-afbf886ae796", "parentControlId": 31368, "controlId": "T1204", "title": "T1204", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584989" }, { "id": 571440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584989", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a506d7fc-68bd-5015-b9d9-30a12fd7b8af", "parentControlId": 31368, "controlId": "T1204.002", "title": "T1204.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584989" }, { "id": 571441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58499", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0f59c92-3b42-5c57-a11e-45dcf15408c6", "parentControlId": 31368, "controlId": "T1204.003", "title": "T1204.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58499" }, { "id": 571442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58499", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7d695e2-47f5-551d-a274-14264393be44", "parentControlId": 31368, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58499" }, { "id": 571443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58499", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "645b12f9-cc9d-5f85-9e0a-75ed24aa127f", "parentControlId": 31368, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58499" }, { "id": 571444, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58499", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f18769a4-0b5a-5bf8-ac8f-42fd4d186b85", "parentControlId": 31368, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58499" }, { "id": 571445, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58499", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee395107-3c88-524a-8576-46509a6f9267", "parentControlId": 31368, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58499" }, { "id": 571446, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58499", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1110f9b5-ac16-535c-b3f0-d5f6cb34a637", "parentControlId": 31368, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58499" }, { "id": 571447, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58499", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04d0f2ae-fb05-5746-b955-56d32e83270b", "parentControlId": 31368, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58499" }, { "id": 571448, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d85c3dc-8054-5d7c-9b72-4465a57b515d", "parentControlId": 31368, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584991" }, { "id": 571449, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02e95885-2d85-5369-9d09-a2fbf962ff46", "parentControlId": 31368, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584991" }, { "id": 571450, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "565c2f5d-38fe-549c-b80f-b4260f76b706", "parentControlId": 31368, "controlId": "T1216", "title": "T1216", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584991" }, { "id": 571451, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff294040-c7b8-5388-a173-62d126a3e02d", "parentControlId": 31368, "controlId": "T1216.001", "title": "T1216.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584991" }, { "id": 571452, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76cc2f86-fd00-5a7b-b12c-2a5c5985cf49", "parentControlId": 31368, "controlId": "T1216.002", "title": "T1216.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584991" }, { "id": 571453, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "769dda27-b51e-59c2-8cf0-246f6277b319", "parentControlId": 31368, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584991" }, { "id": 571454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39929953-dbf6-58a4-a111-c2b7ba360486", "parentControlId": 31368, "controlId": "T1218.001", "title": "T1218.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584991" }, { "id": 571455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ceee9a9-fd2d-5462-bb54-21139aaa8269", "parentControlId": 31368, "controlId": "T1218.002", "title": "T1218.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584991" }, { "id": 571456, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "069c7663-96f5-5940-9c38-765fcf184fe8", "parentControlId": 31368, "controlId": "T1218.003", "title": "T1218.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584991" }, { "id": 571457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "751eda38-ff9f-53aa-856d-80061b56720d", "parentControlId": 31368, "controlId": "T1218.004", "title": "T1218.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584992" }, { "id": 571458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584992", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23b1cdc5-7a7f-52cd-a638-958fa08b4b3c", "parentControlId": 31368, "controlId": "T1218.005", "title": "T1218.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584992" }, { "id": 571459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584992", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67efc098-d022-5bf2-b519-93b8febb9317", "parentControlId": 31368, "controlId": "T1218.008", "title": "T1218.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584992" }, { "id": 571460, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584992", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eed71f41-8346-5c1b-86a7-99003f002a46", "parentControlId": 31368, "controlId": "T1218.009", "title": "T1218.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584992" }, { "id": 571461, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584992", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "322ff8cd-3340-5996-a8ea-06544c68a3a0", "parentControlId": 31368, "controlId": "T1218.010", "title": "T1218.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584992" }, { "id": 571462, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584992", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d46028b-d053-5d82-9a71-e033cfad4f8d", "parentControlId": 31368, "controlId": "T1218.011", "title": "T1218.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584992" }, { "id": 571463, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584992", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30c6f131-dac0-571d-b5f9-30a8f52cda65", "parentControlId": 31368, "controlId": "T1218.012", "title": "T1218.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584992" }, { "id": 571464, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584992", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1c36d3f-7aa3-5cc5-a610-2a66e7058ec0", "parentControlId": 31368, "controlId": "T1218.013", "title": "T1218.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584992" }, { "id": 571465, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584992", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59e799f5-8149-5bd0-b86d-dd3a31d60dda", "parentControlId": 31368, "controlId": "T1218.014", "title": "T1218.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584992" }, { "id": 571466, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584993", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d237aed6-da92-54e9-b48d-ae0baf111d40", "parentControlId": 31368, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584993" }, { "id": 571467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584993", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c5ce944-03ff-5206-93fc-55c8c9897f26", "parentControlId": 31368, "controlId": "T1219", "title": "T1219", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584993" }, { "id": 571468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584993", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b341df74-9511-5d28-a4d2-d13d0bbc7d3f", "parentControlId": 31368, "controlId": "T1220", "title": "T1220", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584993" }, { "id": 571469, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584993", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d00a9700-7182-5d9a-b89b-dc68ec9e23b2", "parentControlId": 31368, "controlId": "T1221", "title": "T1221", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584993" }, { "id": 571470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584993", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a415f76-35a0-5b33-82a9-925a0f83e9f7", "parentControlId": 31368, "controlId": "T1222", "title": "T1222", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584993" }, { "id": 571471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584993", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f6dc85a-1f96-5cbb-befd-2586a1796f4d", "parentControlId": 31368, "controlId": "T1222.001", "title": "T1222.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584993" }, { "id": 571472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584993", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d80c9452-9043-55d8-98a0-a5b7bac12a34", "parentControlId": 31368, "controlId": "T1222.002", "title": "T1222.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584993" }, { "id": 571473, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584993", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c47f21f8-45e7-53b1-8aa5-522420d3f9d5", "parentControlId": 31368, "controlId": "T1485", "title": "T1485", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584993" }, { "id": 571474, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584993", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dff592ce-b1bf-5f9d-81a8-16ba251aa891", "parentControlId": 31368, "controlId": "T1485.001", "title": "T1485.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584993" }, { "id": 571475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c323c64e-2007-56f9-a94d-ff401ec7ea53", "parentControlId": 31368, "controlId": "T1486", "title": "T1486", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584994" }, { "id": 571476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "888fe687-f8c7-5dfa-bf84-f735fd4f631e", "parentControlId": 31368, "controlId": "T1490", "title": "T1490", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584994" }, { "id": 571477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75df40ab-eb8c-5879-bf77-03e9567b0504", "parentControlId": 31368, "controlId": "T1491", "title": "T1491", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584994" }, { "id": 571478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66638767-8611-5584-bbe1-f918c4e10ef8", "parentControlId": 31368, "controlId": "T1491.001", "title": "T1491.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584994" }, { "id": 571479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "258a0d14-e298-50b0-b6db-e0627fc37d6f", "parentControlId": 31368, "controlId": "T1491.002", "title": "T1491.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584994" }, { "id": 571480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea42eb41-4c19-5e92-953f-c32f75141102", "parentControlId": 31368, "controlId": "T1495", "title": "T1495", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584994" }, { "id": 571481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53a58136-e00d-5306-914d-ac0beb8b42c7", "parentControlId": 31368, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584994" }, { "id": 571482, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c738285-f504-530b-b51c-3e8929e672e1", "parentControlId": 31368, "controlId": "T1505.001", "title": "T1505.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584994" }, { "id": 571483, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48e4ffc8-9616-55dc-ac49-55fe5f902686", "parentControlId": 31368, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584994" }, { "id": 571484, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24858f38-a9f8-56ad-aae8-659f1af1fa57", "parentControlId": 31368, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584995" }, { "id": 571485, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "284d710a-aa8e-58da-a6c9-b525d99c1c9b", "parentControlId": 31368, "controlId": "T1525", "title": "T1525", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584995" }, { "id": 571486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0b9b77c-a5e7-5daf-a4c2-6b90ad5aedf2", "parentControlId": 31368, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584995" }, { "id": 571487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "931aa9d9-78bf-5530-9df8-03c7934f2f59", "parentControlId": 31368, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584995" }, { "id": 571488, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d025b86-8a6f-5f5f-b124-f5740ddf67c0", "parentControlId": 31368, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584995" }, { "id": 571489, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d36a9ab8-db21-54ea-89d9-9231b551e953", "parentControlId": 31368, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584995" }, { "id": 571490, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88f3b0e2-2a97-5c7d-bdb9-1f0052f8573d", "parentControlId": 31368, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584995" }, { "id": 571491, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c3d8d92-5942-529b-b88e-d86b2a991def", "parentControlId": 31368, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584995" }, { "id": 571492, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eaa8a491-f353-5e07-b768-da57082fc364", "parentControlId": 31368, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584996" }, { "id": 571493, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bee62765-bd2f-5eb5-937b-6625b4367680", "parentControlId": 31368, "controlId": "T1543.002", "title": "T1543.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584996" }, { "id": 571494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad0eed00-8402-52de-af15-c35cd4f4c7cf", "parentControlId": 31368, "controlId": "T1546", "title": "T1546", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584996" }, { "id": 571495, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5711aede-81ed-5c05-a1e2-a71775eb232b", "parentControlId": 31368, "controlId": "T1546.002", "title": "T1546.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584996" }, { "id": 571496, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdc7fcde-584c-565d-a014-5b228da86a49", "parentControlId": 31368, "controlId": "T1546.004", "title": "T1546.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584996" }, { "id": 571497, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bde0e023-f0bd-50f0-8c95-3dd5c6cfb9f6", "parentControlId": 31368, "controlId": "T1546.006", "title": "T1546.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584996" }, { "id": 571498, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c26f899-c0a4-53bd-813d-2cfbcf3496fa", "parentControlId": 31368, "controlId": "T1546.008", "title": "T1546.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584996" }, { "id": 571499, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2935fc3d-bf2b-52c7-95d3-f14fd220bb43", "parentControlId": 31368, "controlId": "T1546.009", "title": "T1546.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584996" }, { "id": 571500, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584996", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e9b6cd3-3505-54bc-8c1c-6ddbf9d553d3", "parentControlId": 31368, "controlId": "T1546.010", "title": "T1546.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584996" }, { "id": 571501, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584997", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2242ffa4-1a3c-51ef-b23f-205a28b70e5a", "parentControlId": 31368, "controlId": "T1546.013", "title": "T1546.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584997" }, { "id": 571502, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584997", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6047f53-add5-5e46-a9dd-150ca96a70d6", "parentControlId": 31368, "controlId": "T1547.002", "title": "T1547.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584997" }, { "id": 571503, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584997", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96a7827e-9d44-5ccb-b787-a2e8817e1de0", "parentControlId": 31368, "controlId": "T1547.003", "title": "T1547.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584997" }, { "id": 571504, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584997", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0a7c083-8c50-56e7-a8e0-023fbf3f8fb5", "parentControlId": 31368, "controlId": "T1547.004", "title": "T1547.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584997" }, { "id": 571505, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584997", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9104b72b-bcf1-5544-b796-14628c280905", "parentControlId": 31368, "controlId": "T1547.005", "title": "T1547.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584997" }, { "id": 571506, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584997", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1065e262-ba06-57bf-afa2-8a529b1e2db1", "parentControlId": 31368, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584997" }, { "id": 571507, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584997", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "939bce7e-223e-5280-826e-b570c82aee51", "parentControlId": 31368, "controlId": "T1547.008", "title": "T1547.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584997" }, { "id": 571508, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584997", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6814e987-7749-5951-8ae7-57ec26b7c3eb", "parentControlId": 31368, "controlId": "T1547.013", "title": "T1547.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584997" }, { "id": 571509, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584997", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e7ede1b-7b42-547a-8c3e-88ba529d875d", "parentControlId": 31368, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584997" }, { "id": 571510, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584997", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9547cbdb-84d5-5475-ae68-80d390202104", "parentControlId": 31368, "controlId": "T1548.004", "title": "T1548.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584997" }, { "id": 571511, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6268f66-b2a4-5380-88f4-e8b72c9c6270", "parentControlId": 31368, "controlId": "T1548.006", "title": "T1548.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584998" }, { "id": 571512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d24eea9-63a9-5afd-b78f-642e1ca6df8d", "parentControlId": 31368, "controlId": "T1550.001", "title": "T1550.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584998" }, { "id": 571513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "159ceda2-266c-5eda-86d1-3cd41eff1620", "parentControlId": 31368, "controlId": "T1550.004", "title": "T1550.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584998" }, { "id": 571514, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47664906-560c-595c-954e-f8c7b20cfe2d", "parentControlId": 31368, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584998" }, { "id": 571515, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f9eb21b-9af9-50d4-b06d-dd2a7c60ec3b", "parentControlId": 31368, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584998" }, { "id": 571516, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0832a036-2363-572c-a38f-c2b724b6b157", "parentControlId": 31368, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584998" }, { "id": 571517, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cced672-c88b-5d72-89df-3eaf64defc49", "parentControlId": 31368, "controlId": "T1553.001", "title": "T1553.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584998" }, { "id": 571518, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "102a0d11-087f-58b1-b059-c26f8317e1dc", "parentControlId": 31368, "controlId": "T1553.003", "title": "T1553.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584999" }, { "id": 571519, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1d730fe-de6b-56e2-a081-df21a7e9f5c5", "parentControlId": 31368, "controlId": "T1553.005", "title": "T1553.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584999" }, { "id": 571520, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8043238-7fc6-58d8-a8ce-9235c310b198", "parentControlId": 31368, "controlId": "T1553.006", "title": "T1553.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584999" }, { "id": 571521, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e751374a-f6bf-5ed4-a98f-32f8a594e09c", "parentControlId": 31368, "controlId": "T1554", "title": "T1554", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584999" }, { "id": 571522, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc75001a-8dd7-5d97-9106-8dd7d1b7ac8c", "parentControlId": 31368, "controlId": "T1556", "title": "T1556", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584999" }, { "id": 571523, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0ea381c-38fd-5ad0-ba69-a15434f0dade", "parentControlId": 31368, "controlId": "T1556.001", "title": "T1556.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584999" }, { "id": 571524, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4055971-0baf-5485-a318-54f54816a2e3", "parentControlId": 31368, "controlId": "T1556.003", "title": "T1556.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584999" }, { "id": 571525, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f517b755-f5c8-5936-9516-c717465920d4", "parentControlId": 31368, "controlId": "T1556.004", "title": "T1556.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584999" }, { "id": 571526, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.584999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5c7d940-888f-5cd9-8a16-b1eab8defa5b", "parentControlId": 31368, "controlId": "T1556.008", "title": "T1556.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.584999" }, { "id": 571527, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aec49af4-6d37-5381-98e1-f72c9071c8d1", "parentControlId": 31368, "controlId": "T1556.009", "title": "T1556.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585" }, { "id": 571528, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7432adf4-b75c-51eb-b4d5-9ddea11a8951", "parentControlId": 31368, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585" }, { "id": 571529, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33de7222-1e34-50c2-80d8-b78097be1c9c", "parentControlId": 31368, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585" }, { "id": 571530, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ccd8a73-1744-5416-baa3-25b405263ffe", "parentControlId": 31368, "controlId": "T1557.004", "title": "T1557.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585" }, { "id": 571531, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e50a9c88-098b-5acf-bb2f-37baed4568d3", "parentControlId": 31368, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585" }, { "id": 571532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4bb6d72-dc5f-55d0-adb6-808712ea65b8", "parentControlId": 31368, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585" }, { "id": 571533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b6a4640-8958-5086-8599-d30fdc8abaae", "parentControlId": 31368, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585" }, { "id": 571534, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d952c154-cbf2-5084-9ef0-9413f64d567b", "parentControlId": 31368, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585" }, { "id": 571535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67355b1c-62a2-5fb2-8b2a-eb0aa49a4d63", "parentControlId": 31368, "controlId": "T1558.005", "title": "T1558.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585" }, { "id": 571536, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48f816d6-6d33-5f84-81b3-3aa32d2e1260", "parentControlId": 31368, "controlId": "T1561", "title": "T1561", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585001" }, { "id": 571537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d39ca573-34d6-57bb-b9c3-d8d5d02e91d6", "parentControlId": 31368, "controlId": "T1561.001", "title": "T1561.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585001" }, { "id": 571538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bad67995-d4a5-551f-8683-a42f5f3ce463", "parentControlId": 31368, "controlId": "T1561.002", "title": "T1561.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585001" }, { "id": 571539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ddb1913-00b6-5749-9c5a-1436b6bafbaa", "parentControlId": 31368, "controlId": "T1562", "title": "T1562", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585001" }, { "id": 571540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99e2a7bf-29e9-573f-b124-f5c57bf1f33e", "parentControlId": 31368, "controlId": "T1562.001", "title": "T1562.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585001" }, { "id": 571541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "362de676-d1ed-5ff2-8d17-1b0cf57a619e", "parentControlId": 31368, "controlId": "T1562.002", "title": "T1562.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585001" }, { "id": 571542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38ee3895-25d5-515a-b45b-c6b6da7f2dc1", "parentControlId": 31368, "controlId": "T1562.004", "title": "T1562.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585001" }, { "id": 571543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea992e4c-531c-5796-8121-30a3fd5fef38", "parentControlId": 31368, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585001" }, { "id": 571544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f57494fa-ac57-5455-a73d-9fadd6017f05", "parentControlId": 31368, "controlId": "T1562.009", "title": "T1562.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585001" }, { "id": 571545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3b550e2-fe6d-5484-b622-d99bff5211b4", "parentControlId": 31368, "controlId": "T1562.010", "title": "T1562.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585002" }, { "id": 571546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5da7a0b5-7978-5af6-8c41-0fed3ee8ea0a", "parentControlId": 31368, "controlId": "T1562.011", "title": "T1562.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585002" }, { "id": 571547, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "321b2abb-0ebb-5bbb-aaa4-fce91317541e", "parentControlId": 31368, "controlId": "T1562.012", "title": "T1562.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585002" }, { "id": 571548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fd33a29-6002-5794-9e6e-edab2de644e7", "parentControlId": 31368, "controlId": "T1564.003", "title": "T1564.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585002" }, { "id": 571549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23bd5fec-b590-5435-a1cc-d359327170f8", "parentControlId": 31368, "controlId": "T1564.004", "title": "T1564.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585002" }, { "id": 571550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0c50fb9-f6e9-5c7d-b789-b4e7411252e3", "parentControlId": 31368, "controlId": "T1564.006", "title": "T1564.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585002" }, { "id": 571551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bffedf25-7961-58cc-9a12-7322cddb9eeb", "parentControlId": 31368, "controlId": "T1564.008", "title": "T1564.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585002" }, { "id": 571552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8baaa25a-9b3e-52f2-95b5-afb8a9b3bce1", "parentControlId": 31368, "controlId": "T1564.009", "title": "T1564.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585002" }, { "id": 571553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13769ac9-1702-584b-92b7-ae47d6d0d35e", "parentControlId": 31368, "controlId": "T1564.010", "title": "T1564.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585002" }, { "id": 571554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8acf7ae-08ab-504e-845f-ce3fd242b54e", "parentControlId": 31368, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585003" }, { "id": 571555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5a6afbb-8d80-5332-846b-9b311b9139af", "parentControlId": 31368, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585003" }, { "id": 571556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "debf71cc-137b-5042-8790-02fd6f6830f6", "parentControlId": 31368, "controlId": "T1565.002", "title": "T1565.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585003" }, { "id": 571557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1315241b-4986-57f0-b57d-409dd8ef963b", "parentControlId": 31368, "controlId": "T1565.003", "title": "T1565.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585003" }, { "id": 571558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e4cc65a-d6fa-51fc-af5c-7e37bcd9a3ca", "parentControlId": 31368, "controlId": "T1569", "title": "T1569", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585003" }, { "id": 571559, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c8c4623-7041-5d0f-91ab-86fbb76c53ef", "parentControlId": 31368, "controlId": "T1569.002", "title": "T1569.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585003" }, { "id": 571560, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "819ff65d-4db1-5a34-a3e8-56f81b695a67", "parentControlId": 31368, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585003" }, { "id": 571561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac213c20-1999-5d5e-9a99-dc01da0040e1", "parentControlId": 31368, "controlId": "T1574.001", "title": "T1574.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585003" }, { "id": 571562, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea0e977d-b255-56c6-90c9-c63fe246f23f", "parentControlId": 31368, "controlId": "T1574.004", "title": "T1574.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585003" }, { "id": 571563, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8552c678-4684-58d8-b592-82a0e69d11dd", "parentControlId": 31368, "controlId": "T1574.006", "title": "T1574.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585003" }, { "id": 571564, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585004", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71f2b7e7-872c-53c1-9b39-121c2ea4d217", "parentControlId": 31368, "controlId": "T1574.007", "title": "T1574.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585004" }, { "id": 571565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585004", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a79a2890-d2d1-52d0-8aa9-900193bfa7f6", "parentControlId": 31368, "controlId": "T1574.008", "title": "T1574.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585004" }, { "id": 571566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585004", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcb280fd-4317-5a38-b5e1-7f59016aabbe", "parentControlId": 31368, "controlId": "T1574.009", "title": "T1574.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585004" }, { "id": 571567, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585004", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd5c1548-aa09-5e69-8e06-ea8495a1e78a", "parentControlId": 31368, "controlId": "T1574.012", "title": "T1574.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585004" }, { "id": 571568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585004", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "739f25e6-47bb-55ae-a4d0-6cfd556d3476", "parentControlId": 31368, "controlId": "T1574.013", "title": "T1574.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585004" }, { "id": 571569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585004", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fff79da2-82a5-5568-ab58-f84b230ac823", "parentControlId": 31368, "controlId": "T1574.014", "title": "T1574.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585004" }, { "id": 571570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585004", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eda6cf30-eb5a-5cbe-8628-660f90913710", "parentControlId": 31368, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585004" }, { "id": 571571, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585004", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a46439e8-fecd-5672-a943-48abfb6c64d6", "parentControlId": 31368, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585004" }, { "id": 571572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585005", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82b77ab5-6d71-50dc-825f-65a1969b2260", "parentControlId": 31368, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585005" }, { "id": 571573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585005", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0f94805-6e62-59c0-a817-8b74863b82d3", "parentControlId": 31368, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585005" }, { "id": 571574, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585005", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8ce8009-ced5-561b-8d2e-213286530733", "parentControlId": 31368, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585005" }, { "id": 571575, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585005", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a2f09d3-1b9d-59cc-a869-95a5e130c86c", "parentControlId": 31368, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585005" }, { "id": 571576, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585005", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1577152-4c98-5b09-8f57-1bad3a9f071b", "parentControlId": 31368, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585005" }, { "id": 571577, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585005", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8ba83cd-a456-59b8-8915-a9f39611fdb0", "parentControlId": 31368, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585005" }, { "id": 571578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585005", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "624dec50-604d-5bda-9220-bbe36afcc1e5", "parentControlId": 31368, "controlId": "T1609", "title": "T1609", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585005" }, { "id": 571579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585005", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff1d1d64-f27a-5ece-8838-1aa7dc136f8f", "parentControlId": 31368, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585005" }, { "id": 571580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585005", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "169eb376-511f-5d84-9624-52be28df5ae4", "parentControlId": 31368, "controlId": "T1647", "title": "T1647", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585005" }, { "id": 571582, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585006", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d81c4695-ddd7-51ea-b1f7-74f224b03c96", "parentControlId": 31368, "controlId": "SI-7", "title": "SI-7", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585006" }, { "id": 571583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585006", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44dfe9af-4746-579a-bc3c-30ae37a0fc35", "parentControlId": 31368, "controlId": "SI-07", "title": "SI-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585006" }, { "id": 571585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585006", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88193c77-9710-5508-837d-14b94ac2d3e4", "parentControlId": 31368, "controlId": "SI-07", "title": "SI-07", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585006" }, { "id": 571586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585006", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c45a8afd-0998-52eb-9e9e-96521945a165", "parentControlId": 31368, "controlId": "SI-07", "title": "SI-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585006" }, { "id": 571587, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585006", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45d555f3-0cc5-5f91-9c03-ff38f42aebec", "parentControlId": 31368, "controlId": "SI-07", "title": "SI-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585006" }, { "id": 571588, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585006", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e089b81-6bfe-563f-8998-eeb46adbe306", "parentControlId": 31368, "controlId": "SI-07", "title": "SI-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585006" }, { "id": 571590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585006", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6501ca7-e49d-5314-96d1-5e8e04b26e93", "parentControlId": 31368, "controlId": "SI-7", "title": "SI-7", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585006" }, { "id": 571591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fa76e62-2e8a-5bb2-b175-8117f8d7b620", "parentControlId": 31368, "controlId": "SI-7", "title": "SI-7", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585007" }, { "id": 571592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d05c1d4-fcb4-5ed6-9ee5-a5d1626a86b9", "parentControlId": 31368, "controlId": "SI-7", "title": "SI-7", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585007" }, { "id": 571595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3fc545c-9cd3-58b4-94ab-add754a55fbe", "parentControlId": 31368, "controlId": "DE.CM-09", "title": "DE.CM-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585007" }, { "controlId": "B.5.3", "title": "B.5.3 — Changes to File System and Operating System Permissions", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-5, AC-6, SI-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "57337236-6b78-5d47-acc7-29675839eb19", "isPublic": true }, { "controlId": "NEI 08-09 App D.5.3", "title": "NEI 08-09 App D.5.3 — Changes to File System and Operating System Permissions", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.5.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "495c9257-c19c-5535-a535-996b222e2fd8", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.5.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "d96bd2e9-3ecc-5fcb-a752-c363a1618455", "isPublic": true }, { "controlId": "C.3.7", "title": "C.3.7 — Software and Information Integrity", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "04b5a60b-71a2-58c6-9f51-5e4aa8b27aa3", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.7", "title": "NEI 08-09 App E.3.7 — Software and Information Integrity", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "3d0e95a8-8418-5783-b612-09664c530532", "isPublic": true }, { "controlId": "CIP-010-4-R2", "title": "CIP-010-4-R2 — Configuration Monitoring for Unauthorized Changes", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3b4f50b5-9ed9-5be7-8e73-b6323bdc355b", "isPublic": true }, { "controlId": "CIP-010-4-2.1", "title": "CIP-010-4-2.1 — Monitor at least once every 35 calendar days for changes to the baseline configuration (as described in Requirement R...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6b53af05-0a89-571e-8a69-07deb339fbb6", "isPublic": true } ], "id": 31368, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731062", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731062", "catalogueId": 1062, "uuid": "ed774b70-fba8-59a4-b43b-d923a83d5c92", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize File Integrity Monitor (FIM), or similar technologies, to detect and report on unauthorized changes to selected files and configuration settings?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Endpoint File Integrity Monitoring (FIM)", "description": "

Control Description

Mechanisms exist to utilize File Integrity Monitor (FIM), or similar technologies, to detect and report on unauthorized changes to selected files and configuration settings.

Evidence Request List (ERL)

E-END-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize File Integrity Monitor (FIM), or similar technologies, to detect and report on unauthorized changes to selected files and configuration settings.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.5.3, C.3.7
NERC-CIP (2026) Requirements: CIP-010-4-R2", "controlId": "END-06", "family": "Endpoint Security", "enhancements": "", "sortId": "END-06", "references": "

Micro-Small Business (<10 staff)

∙ File Integrity Monitor (FIM)\n∙ ManageEngine Endpoint Central (https://manageengine.com)

Small Business (10-49 staff)

∙ File Integrity Monitor (FIM)\n∙ ManageEngine Endpoint Central (https://manageengine.com)

Medium Business (50-249 staff)

∙ File Integrity Monitor (FIM)\n∙ ManageEngine Endpoint Central (https://manageengine.com)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Large Business (250-999 staff)

∙ File Integrity Monitor (FIM)\n∙ ManageEngine Endpoint Central (https://manageengine.com)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Enterprise (>1,000 staff)

∙ File Integrity Monitor (FIM)\n∙ ManageEngine Endpoint Central (https://manageengine.com)\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71228, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590453", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590453", "securityControlId": 31369, "ccis": [], "uuid": "962ff7dd-b2fc-5583-9722-c2869207dbf4", "testId": "END-06.1_A01", "test": "software, firmware and/or information on which an integrity check is to be performed is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: selection to include security relevant events", "otherId": "53A_R5_SI-07(01)_ODP[01]\n53A_R5_SI-07(01)_ODP[05]\n53A_R5_SI-07(01)_ODP[09]", "defaultText": null }, { "id": 71229, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590453", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590453", "securityControlId": 31369, "ccis": [], "uuid": "af69b910-a251-5ad6-af5a-7af9e5fc4adf", "testId": "END-06.1_A02", "test": "an integrity check of software, firmware and/or information is performed per an organization-defined time period.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-07(01)[01]\n53A_R5_SI-07(01)[02]\n53A_R5_SI-07(01)[03]", "defaultText": null }, { "id": 71230, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590453", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590454", "securityControlId": 31369, "ccis": [], "uuid": "e8f6ba59-1087-5e48-8b41-f562f3883d94", "testId": "END-06.1_A03", "test": "transitional states or security-relevant events requiring integrity checks software, firmware and/or information are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-07(01)_ODP[02]\n53A_R5_SI-07(01)_ODP[03]\n53A_R5_SI-07(01)_ODP[06]\n53A_R5_SI-07(01)_ODP[07]\n53A_R5_SI-07(01)_ODP[10]\n53A_R5_SI-07(01)_ODP[11]", "defaultText": null }, { "id": 71231, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590454", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590454", "securityControlId": 31369, "ccis": [], "uuid": "55381e48-3b1e-55fe-b177-ff357fdb637c", "testId": "END-06.1_A04", "test": "the frequency with which to perform an integrity check software, firmware and/or information is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least monthly", "otherId": "53A_R5_SI-07(01)_ODP[04]\n53A_R5_SI-07(01)_ODP[08]\n53A_R5_SI-07(01)_ODP[12]", "defaultText": null } ], "externalMappings": [ { "id": 571636, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585012", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7951487-88be-5ca7-b715-d618341592c9", "parentControlId": 31369, "controlId": "SR 2.4 RE 1", "title": "SR 2.4 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585012" }, { "id": 571639, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585012", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b1899cb-2375-53db-a042-97d4a89d9f92", "parentControlId": 31369, "controlId": "SI-7(1)", "title": "SI-7(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585012" }, { "id": 571640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585012", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "797fbeda-fe52-56bf-beb7-005659d9abcd", "parentControlId": 31369, "controlId": "SI-07(01)", "title": "SI-07(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585012" }, { "id": 571641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585012", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ffefda9-f849-5e38-955d-7bb4ae37b3dc", "parentControlId": 31369, "controlId": "SI-07(01)", "title": "SI-07(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585012" }, { "id": 571642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99162bb5-0717-5e0a-881a-379ec017fcfd", "parentControlId": 31369, "controlId": "SI-07(01)", "title": "SI-07(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585013" }, { "id": 571643, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3012a404-98a1-57d6-9972-a64bc5531bbb", "parentControlId": 31369, "controlId": "SI-07(01)", "title": "SI-07(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585013" }, { "id": 571644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96ef48e1-2090-5084-89c1-7643a86eb62d", "parentControlId": 31369, "controlId": "SI-07(01)", "title": "SI-07(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585013" } ], "id": 31369, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731062", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731062", "catalogueId": 1062, "uuid": "d9b5f620-e46a-5b97-858f-32db814df31e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization validate configurations through integrity checking of software and firmware?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Integrity Checks", "description": "

Control Description

Mechanisms exist to validate configurations through integrity checking of software and firmware.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to validate configurations through integrity checking of software and firmware.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "END-06.1", "family": "Endpoint Security", "enhancements": "", "sortId": "END-06.1", "references": "

Micro-Small Business (<10 staff)

∙ File Integrity Monitor (FIM)

Small Business (10-49 staff)

∙ File Integrity Monitor (FIM)

Medium Business (50-249 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)\n∙ File Integrity Monitor (FIM)

Large Business (250-999 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)\n∙ File Integrity Monitor (FIM)

Enterprise (>1,000 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)\n∙ File Integrity Monitor (FIM)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71232, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590454", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590454", "securityControlId": 31370, "ccis": [], "uuid": "c2850923-acc7-50f4-bee8-bb0c74bea717", "testId": "END-06.2_A01", "test": "security-relevant changes to the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-07(07)_ODP", "defaultText": null }, { "id": 71233, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590454", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590454", "securityControlId": 31370, "ccis": [], "uuid": "8c66d5fb-7ef5-5356-80ba-647afe7f6bf5", "testId": "END-06.2_A02", "test": "the detection of changes is incorporated into the organizational incident response capability.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-07(07)", "defaultText": null } ], "externalMappings": [ { "id": 571670, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585016", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b3100a9-b194-5561-aa08-b6d55f54f052", "parentControlId": 31370, "controlId": "SI-7(7)", "title": "SI-7(7)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585016" }, { "id": 571671, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585016", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82cb97bc-a2a5-5d79-8844-f18ae76c9a7c", "parentControlId": 31370, "controlId": "SI-07(07)", "title": "SI-07(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585016" }, { "id": 571672, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585016", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2c6ef71-bb2b-5979-b440-4014044e92f0", "parentControlId": 31370, "controlId": "SI-07(07)", "title": "SI-07(07)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585016" }, { "id": 571673, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585016", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f24b04e-9689-52ff-a21c-85e04321f76d", "parentControlId": 31370, "controlId": "SI-07(07)", "title": "SI-07(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585016" }, { "id": 571674, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585016", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b9438d6-1c00-56ca-9fac-33a4deae2092", "parentControlId": 31370, "controlId": "SI-07(07)", "title": "SI-07(07)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585016" }, { "id": 571675, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585016", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "502ae74a-b2aa-501a-9aa6-15c8b0e24b98", "parentControlId": 31370, "controlId": "SI-07(07)", "title": "SI-07(07)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585016" } ], "id": 31370, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731063", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731063", "catalogueId": 1062, "uuid": "c1ea9916-4f15-50f0-9303-6459acadc90a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization detect and respond to unauthorized configuration changes as cybersecurity incidents?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Endpoint Detection & Response (EDR)", "description": "

Control Description

Mechanisms exist to detect and respond to unauthorized configuration changes as cybersecurity incidents.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to detect and respond to unauthorized configuration changes as cybersecurity incidents.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-06.2", "family": "Endpoint Security", "enhancements": "", "sortId": "END-06.2", "references": "

Micro-Small Business (<10 staff)

∙ ManageEngine Endpoint Central (https://manageengine.com)

Small Business (10-49 staff)

∙ ManageEngine Endpoint Central (https://manageengine.com)

Medium Business (50-249 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Large Business (250-999 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Enterprise (>1,000 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71234, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590454", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590454", "securityControlId": 31371, "ccis": [], "uuid": "8f8a4bf4-22e2-5fe0-8fc2-209129290c8f", "testId": "END-06.3_A01", "test": "personnel or roles to whom notification is to be provided upon discovering discrepancies during integrity verification is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-07(02)_ODP", "defaultText": null }, { "id": 71235, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590454", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590455", "securityControlId": 31371, "ccis": [], "uuid": "43f47269-f6e9-5b70-9841-fb0d99834d7f", "testId": "END-06.3_A02", "test": "automated tools that provide notification to personnel or roles upon discovering discrepancies during integrity verification are employed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-07(02)", "defaultText": null } ], "externalMappings": [ { "id": 571704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585019", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2a59c2f-2e5f-5c35-b84e-6a97291467e0", "parentControlId": 31371, "controlId": "SI-7(2)", "title": "SI-7(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585019" }, { "id": 571705, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91280691-e2b1-5b6c-9b6a-19eb19a86277", "parentControlId": 31371, "controlId": "SI-07(02)", "title": "SI-07(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58502" }, { "id": 571706, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b17afc3-7d67-52ea-9d82-b625b10b3e0c", "parentControlId": 31371, "controlId": "SI-07(02)", "title": "SI-07(02)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58502" }, { "id": 571707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68b67de5-02c7-55b3-ba2a-589979ad6029", "parentControlId": 31371, "controlId": "SI-07(02)", "title": "SI-07(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58502" }, { "id": 571708, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60a144b3-31f1-5215-b41b-7ce81655948c", "parentControlId": 31371, "controlId": "SI-07(02)", "title": "SI-07(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58502" } ], "id": 31371, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731063", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731063", "catalogueId": 1062, "uuid": "ead27265-8706-5ebf-829f-386a9088c790", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to alert incident response personnel upon discovering discrepancies during integrity verification?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Automated Notifications of Integrity Violations", "description": "

Control Description

Automated mechanisms exist to alert incident response personnel upon discovering discrepancies during integrity verification.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically alert incident response personnel upon discovering discrepancies during integrity verification.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "END-06.3", "family": "Endpoint Security", "enhancements": "", "sortId": "END-06.3", "references": "

Micro-Small Business (<10 staff)

∙ Antivirus/antimalware software\n∙ Keep OS updated

Small Business (10-49 staff)

∙ Endpoint protection platform (e.g., Windows Defender)\n∙ Patch management

Medium Business (50-249 staff)

∙ EDR solution (e.g., CrowdStrike Falcon Go)\n∙ Centralized endpoint management

Large Business (250-999 staff)

∙ Enterprise EDR/EPP (e.g., CrowdStrike, SentinelOne)\n∙ MDM/UEM (e.g., Microsoft Intune)

Enterprise (>1,000 staff)

∙ Enterprise EDR/XDR platform (e.g., CrowdStrike, SentinelOne)\n∙ UEM (e.g., Microsoft Intune, JAMF)\n∙ Zero-trust endpoint controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71236, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590455", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590455", "securityControlId": 31372, "ccis": [], "uuid": "37361bbd-348c-560c-a5db-2c5c9ae378f9", "testId": "END-06.4_A01", "test": "controls to be implemented automatically when integrity violations are discovered are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-07(05)_ODP[01]\n53A_R5_SI-07(05)_ODP[02]", "defaultText": null }, { "id": 71237, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590455", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590455", "securityControlId": 31372, "ccis": [], "uuid": "e6819627-d57c-5db1-acea-2806fde5201f", "testId": "END-06.4_A02", "test": "organization-defined actions are automatically performed when integrity violations are discovered.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-07(05)", "defaultText": null } ], "externalMappings": [ { "id": 571712, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbb847c1-7039-5a1d-99d6-1b50533e67c8", "parentControlId": 31372, "controlId": "SI-7(5)", "title": "SI-7(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58502" }, { "id": 571713, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aadc15af-4835-5c90-910c-31018419d663", "parentControlId": 31372, "controlId": "SI-07(05)", "title": "SI-07(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58502" }, { "id": 571714, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "283c24bb-175f-5197-a474-eb490edae461", "parentControlId": 31372, "controlId": "SI-07(05)", "title": "SI-07(05)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58502" }, { "id": 571715, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585021", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e24e7c56-cc98-503e-ba19-b9a6aedbdd81", "parentControlId": 31372, "controlId": "SI-07(05)", "title": "SI-07(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585021" }, { "id": 571716, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e8b51b1-a236-5df1-8ac3-c2a0c4baf1c2", "parentControlId": 31372, "controlId": "SI-07(05)", "title": "SI-07(05)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585029" } ], "id": 31372, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731063", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731063", "catalogueId": 1062, "uuid": "e509c1d4-fb59-5c05-8ef7-9e982b524b35", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to implement remediation actions when integrity violations are discovered?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Automated Response to Integrity Violations", "description": "

Control Description

Automated mechanisms exist to implement remediation actions when integrity violations are discovered.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically implement remediation actions when integrity violations are discovered.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "END-06.4", "family": "Endpoint Security", "enhancements": "", "sortId": "END-06.4", "references": "

Micro-Small Business (<10 staff)

∙ Antivirus/antimalware software\n∙ Keep OS updated

Small Business (10-49 staff)

∙ Endpoint protection platform (e.g., Windows Defender)\n∙ Patch management

Medium Business (50-249 staff)

∙ EDR solution (e.g., CrowdStrike Falcon Go)\n∙ Centralized endpoint management

Large Business (250-999 staff)

∙ Enterprise EDR/EPP (e.g., CrowdStrike, SentinelOne)\n∙ MDM/UEM (e.g., Microsoft Intune)

Enterprise (>1,000 staff)

∙ Enterprise EDR/XDR platform (e.g., CrowdStrike, SentinelOne)\n∙ UEM (e.g., Microsoft Intune, JAMF)\n∙ Zero-trust endpoint controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71238, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590455", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590455", "securityControlId": 31373, "ccis": [], "uuid": "4cc38215-90f6-5996-8125-be64c4474f8e", "testId": "END-06.5_A01", "test": "system components requiring integrity verification of the boot process are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-07(09)_ODP", "defaultText": null }, { "id": 71239, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590456", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590456", "securityControlId": 31373, "ccis": [], "uuid": "0c193138-2c9c-5b40-a985-744b0bc89b1e", "testId": "END-06.5_A02", "test": "the integrity of the boot process of system components is verified.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-07(09)", "defaultText": null } ], "externalMappings": [ { "id": 571719, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eba30d62-f0ea-5a75-aa32-4057b3c82930", "parentControlId": 31373, "controlId": "CR 3.14", "title": "CR 3.14", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585029" }, { "id": 571720, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "edeba6d2-33de-5494-bd5d-af5e443c96a5", "parentControlId": 31373, "controlId": "EDR 3.14", "title": "EDR 3.14", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585029" }, { "id": 571721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "684f1170-d376-5941-bfc8-6f754c9d77e2", "parentControlId": 31373, "controlId": "HDR 3.14", "title": "HDR 3.14", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585029" }, { "id": 571722, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3d4146e-378c-5234-9f1a-7cb7d161e994", "parentControlId": 31373, "controlId": "NDR 3.14", "title": "NDR 3.14", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585029" }, { "id": 571723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58503", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d863b53-ea6a-5a6d-b874-903f012e6ce3", "parentControlId": 31373, "controlId": "SI-7(9)", "title": "SI-7(9)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58503" }, { "id": 571724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58503", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "509f2541-ccc4-54af-96f5-a37fb88212c7", "parentControlId": 31373, "controlId": "SI-07(09)", "title": "SI-07(09)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58503" }, { "id": 571725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58503", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afc95f60-2f55-596b-ad69-f15fd7272fae", "parentControlId": 31373, "controlId": "SI-07(09)", "title": "SI-07(09)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58503" } ], "id": 31373, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731064", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731064", "catalogueId": 1062, "uuid": "36528b31-0e88-5e35-8a51-e5722eed4d69", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to verify the integrity of the boot process of systems?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Boot Process Integrity", "description": "

Control Description

Automated mechanisms exist to verify the integrity of the boot process of systems.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically verify the integrity of the boot process of systems.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "END-06.5", "family": "Endpoint Security", "enhancements": "", "sortId": "END-06.5", "references": "

Micro-Small Business (<10 staff)

∙ UEFI Secure Boot

Small Business (10-49 staff)

∙ UEFI Secure Boot

Medium Business (50-249 staff)

∙ UEFI Secure Boot

Large Business (250-999 staff)

∙ UEFI Secure Boot

Enterprise (>1,000 staff)

∙ UEFI Secure Boot", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71240, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590456", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590456", "securityControlId": 31374, "ccis": [], "uuid": "b3f08e4a-dc88-5d7a-ba35-f66631bec338", "testId": "END-06.6_A01", "test": "mechanisms to be implemented to protect the integrity of boot firmware in system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-07(10)_ODP[01]", "defaultText": null }, { "id": 71241, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590456", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590456", "securityControlId": 31374, "ccis": [], "uuid": "32cf7a74-9331-577b-9769-a3029a4d75e6", "testId": "END-06.6_A02", "test": "system components requiring mechanisms to protect the integrity of boot firmware are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-07(10)_ODP[02]", "defaultText": null }, { "id": 71242, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590456", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590456", "securityControlId": 31374, "ccis": [], "uuid": "ee793991-354c-58b4-bea5-1feb835ee9b3", "testId": "END-06.6_A03", "test": "mechanisms are implemented to protect the integrity of boot firmware in system components.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-07(10)", "defaultText": null } ], "externalMappings": [ { "id": 571729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58503", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "477bfd93-6003-5bc8-ba9f-d5a93d8a89f5", "parentControlId": 31374, "controlId": "EDR 3.14(1)", "title": "EDR 3.14(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58503" }, { "id": 571730, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58503", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e7c16ff-0dec-5271-991f-685abd6a927a", "parentControlId": 31374, "controlId": "HDR 3.14(1)", "title": "HDR 3.14(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58503" }, { "id": 571731, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d6f1e90-b811-5deb-b095-d428f698edef", "parentControlId": 31374, "controlId": "NDR 3.14(1)", "title": "NDR 3.14(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585031" }, { "id": 571732, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b97c126-05a9-5e5a-b646-f2b18c46de37", "parentControlId": 31374, "controlId": "SI-7(10)", "title": "SI-7(10)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585031" }, { "id": 571733, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "379ee1f4-d73c-5ad1-b51f-8af9ff8cd08f", "parentControlId": 31374, "controlId": "SI-07(10)", "title": "SI-07(10)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585031" }, { "id": 571734, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c4cfa53-66b8-5ff1-b2f4-d42fc95fa08e", "parentControlId": 31374, "controlId": "SI-07(10)", "title": "SI-07(10)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585031" } ], "id": 31374, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731064", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731064", "catalogueId": 1062, "uuid": "004d1b12-be09-5b71-926c-9f5e8266aee1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to protect the integrity of boot firmware in systems?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Protection of Boot Firmware", "description": "

Control Description

Automated mechanisms exist to protect the integrity of boot firmware in systems.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically protect the integrity of boot firmware in systems.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "END-06.6", "family": "Endpoint Security", "enhancements": "", "sortId": "END-06.6", "references": "

Micro-Small Business (<10 staff)

∙ UEFI Secure Boot

Small Business (10-49 staff)

∙ UEFI Secure Boot

Medium Business (50-249 staff)

∙ UEFI Secure Boot

Large Business (250-999 staff)

∙ UEFI Secure Boot

Enterprise (>1,000 staff)

∙ UEFI Secure Boot", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71243, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590457", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590457", "securityControlId": 31375, "ccis": [], "uuid": "0d244270-99b6-5903-bcb1-d8666f779893", "testId": "END-06.7_A01", "test": "the use of binary or machine-executable code is prohibited when it originates from sources with limited or no warranty or without the provision of source code.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-07(08)(a)", "defaultText": null }, { "id": 71244, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590457", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590457", "securityControlId": 31375, "ccis": [], "uuid": "bbc41375-301d-51ad-982f-070106c1bc8f", "testId": "END-06.7_A02", "test": "exceptions to the prohibition of binary or machine-executable code from sources with limited or no warranty or without the provision of source code are allowed only for compelling mission or operational requirements.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-07(08)(b)[01]", "defaultText": null }, { "id": 71245, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590457", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590457", "securityControlId": 31375, "ccis": [], "uuid": "5dae847c-4c5a-5c07-95e5-4747ae6b1e54", "testId": "END-06.7_A03", "test": "exceptions to the prohibition of binary or machine-executable code from sources with limited or no warranty or without the provision of source code are allowed only with the approval of the authorizing official.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-07(08)(b)[02]", "defaultText": null } ], "externalMappings": [ { "id": 571739, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74c97e80-d73b-57f0-a2f3-7018f67aca4a", "parentControlId": 31375, "controlId": "SI-7(14)", "title": "SI-7(14)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585032" }, { "id": 571740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8e53fbb-8672-58df-ae6e-0ed6bc916b87", "parentControlId": 31375, "controlId": "CM-07(08)", "title": "CM-07(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585032" }, { "id": 571741, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96d59481-d920-57d3-b327-4cc4694e131b", "parentControlId": 31375, "controlId": "CM-07(08)", "title": "CM-07(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585032" }, { "id": 571742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d5db5d7-fe4b-5328-a2b6-d45296a7b243", "parentControlId": 31375, "controlId": "CM-7(8)", "title": "CM-7(8)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585032" }, { "id": 571743, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "638f4d62-ea43-5dce-a3dd-4ad244a1cd94", "parentControlId": 31375, "controlId": "SI-7(14)", "title": "SI-7(14)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585032" } ], "id": 31375, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731064", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731064", "catalogueId": 1062, "uuid": "cbe2d5f4-f572-5084-8cd3-35d868355637", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prohibit the use of binary or machine-executable code from sources with limited or no warranty and without access to source code?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Binary or Machine-Executable Code", "description": "

Control Description

Mechanisms exist to prohibit the use of binary or machine-executable code from sources with limited or no warranty and without access to source code.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prohibit the use of binary or machine-executable code from sources with limited or no warranty and without access to source code.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-06.7", "family": "Endpoint Security", "enhancements": "", "sortId": "END-06.7", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Antimalware software

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Antimalware software

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Antimalware software

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Antimalware software

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Antimalware software", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71247, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590457", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590457", "securityControlId": 31377, "ccis": [], "uuid": "f546daf2-dc03-5398-b23a-5487b3a8778f", "testId": "END-07_A01", "test": "Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS), or a similar technology, is deployed on business-critical systems.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71248, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590458", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590458", "securityControlId": 31377, "ccis": [], "uuid": "40db03fa-4bb2-554c-abd9-0060621807f3", "testId": "END-07_A02", "test": "Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS), or a similar technology, is deployed on systems that store, process and/or transmit sensitive / regulated data.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 571759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15752b0a-276e-5c5f-9408-bfce67874249", "parentControlId": 31377, "controlId": "03.14.06.a.01", "title": "03.14.06.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585034" }, { "id": 571760, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ec2b431-aac6-5d39-98ff-ba8c1ac66fd8", "parentControlId": 31377, "controlId": "03.14.06.a.02", "title": "03.14.06.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585034" }, { "id": 571761, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f73735ae-f2dd-5bed-9f40-ba61f61b2320", "parentControlId": 31377, "controlId": "03.14.06.b", "title": "03.14.06.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585034" }, { "id": 571762, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1797afa0-e261-5b41-b805-b064605db6b7", "parentControlId": 31377, "controlId": "03.14.06.c", "title": "03.14.06.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585034" } ], "id": 31377, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731065", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731065", "catalogueId": 1062, "uuid": "60e1e803-69de-51bb-b3bd-12b82cbca10b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS), or similar technologies, to monitor for and protect against anomalous host activity, including lateral movement across the network?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Host Intrusion Detection and Prevention Systems (HIDS / HIPS)", "description": "

Control Description

Mechanisms exist to utilize Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS), or similar technologies, to monitor for and protect against anomalous host activity, including lateral movement across the network.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS), or similar technologies, to monitor for and protect against anomalous host activity, including lateral movement across the network.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-07", "family": "Endpoint Security", "enhancements": "", "sortId": "END-07", "references": "

Micro-Small Business (<10 staff)

∙ Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS)

Small Business (10-49 staff)

∙ Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS)

Medium Business (50-249 staff)

∙ Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS)

Large Business (250-999 staff)

∙ Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS)

Enterprise (>1,000 staff)

∙ Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71249, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590458", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590458", "securityControlId": 31378, "ccis": [], "uuid": "a340234b-7c2a-59dc-aa18-75237556b7e7", "testId": "END-08_A01", "test": "spam protection mechanisms are employed at system entry points to detect unsolicited messages.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-08a.[01]", "defaultText": null }, { "id": 71250, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590458", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590458", "securityControlId": 31378, "ccis": [], "uuid": "24cce580-c1a2-5485-84f1-05694aa83ad8", "testId": "END-08_A02", "test": "spam protection mechanisms are employed at system entry points to act on unsolicited messages.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-08a.[03]", "defaultText": null }, { "id": 71251, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590458", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590458", "securityControlId": 31378, "ccis": [], "uuid": "adeff088-2a9c-5d8a-9b0d-920e328d0564", "testId": "END-08_A03", "test": "spam protection mechanisms are employed at system exit points to detect unsolicited messages.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-08a.[02]", "defaultText": null }, { "id": 71252, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590458", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590458", "securityControlId": 31378, "ccis": [], "uuid": "f56f9874-9ab2-5085-9bbc-57485b6452bd", "testId": "END-08_A04", "test": "spam protection mechanisms are employed at system exit points to act on unsolicited messages.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-08a.[04]", "defaultText": null } ], "externalMappings": [ { "id": 571795, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585038", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfbe20da-5f92-5400-8cac-55f957891309", "parentControlId": 31378, "controlId": "T1137", "title": "T1137", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585038" }, { "id": 571796, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585038", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56ebed96-b6f7-5232-9efa-295872c6d2d5", "parentControlId": 31378, "controlId": "T1137.001", "title": "T1137.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585038" }, { "id": 571797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f157a038-9d50-5bd0-b2df-64adb1187d31", "parentControlId": 31378, "controlId": "T1137.002", "title": "T1137.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585039" }, { "id": 571798, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "806c1879-4ad0-5be9-8840-8559d6c34b46", "parentControlId": 31378, "controlId": "T1137.003", "title": "T1137.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585039" }, { "id": 571799, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a2dd00c-b145-5878-9df6-0938be687d9f", "parentControlId": 31378, "controlId": "T1137.004", "title": "T1137.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585039" }, { "id": 571800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c88bad33-1afb-5c1f-b56c-1f4e22ec67ec", "parentControlId": 31378, "controlId": "T1137.005", "title": "T1137.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585039" }, { "id": 571801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c68466f-f309-5a51-bf76-5cde31146182", "parentControlId": 31378, "controlId": "T1137.006", "title": "T1137.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585039" }, { "id": 571802, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90b5e675-aa64-574e-a3c8-d65c0dbef483", "parentControlId": 31378, "controlId": "T1204", "title": "T1204", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585039" }, { "id": 571803, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c33623e3-29a8-57aa-9bef-0c3bd3aa4922", "parentControlId": 31378, "controlId": "T1204.001", "title": "T1204.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585039" }, { "id": 571804, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9cf0ac47-0b5c-5b0a-9d84-896e2410d08a", "parentControlId": 31378, "controlId": "T1204.002", "title": "T1204.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585039" }, { "id": 571805, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d6313d2-fbe8-5cd5-be36-6505cd198f24", "parentControlId": 31378, "controlId": "T1204.003", "title": "T1204.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585039" }, { "id": 571806, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "440fe4e9-7b83-5e26-a75e-98acb6b6624e", "parentControlId": 31378, "controlId": "T1221", "title": "T1221", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585039" }, { "id": 571807, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af94e8bb-d8f1-51f4-8060-e28625a2648a", "parentControlId": 31378, "controlId": "T1566", "title": "T1566", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58504" }, { "id": 571808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b058e4e0-3bb7-5dfd-a66a-a82430afe562", "parentControlId": 31378, "controlId": "T1566.001", "title": "T1566.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58504" }, { "id": 571809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1e3297e-b2a8-5758-8e16-346bd3b6477f", "parentControlId": 31378, "controlId": "T1566.002", "title": "T1566.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58504" }, { "id": 571810, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02c49b4d-bdf1-5ccc-9394-a9b3592e8166", "parentControlId": 31378, "controlId": "T1566.003", "title": "T1566.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58504" }, { "id": 571811, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "487d6e66-eb3f-5460-8392-53e724ec174f", "parentControlId": 31378, "controlId": "T1598", "title": "T1598", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58504" }, { "id": 571812, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10462081-a341-55f7-88e7-60663f6f3869", "parentControlId": 31378, "controlId": "T1598.001", "title": "T1598.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58504" }, { "id": 571813, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1270a2c-a0d7-539f-8800-b74b3fe2d0ce", "parentControlId": 31378, "controlId": "T1598.002", "title": "T1598.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58504" }, { "id": 571814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "092945d6-1fcd-5ecd-adc6-f1ead9bdd197", "parentControlId": 31378, "controlId": "T1598.003", "title": "T1598.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58504" }, { "id": 571816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd003167-cd6b-5118-bdac-2a31a093833b", "parentControlId": 31378, "controlId": "SI-8", "title": "SI-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585041" }, { "id": 571817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f82c2962-5e62-5197-afe3-f3f35e6eb258", "parentControlId": 31378, "controlId": "SI-08", "title": "SI-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585041" }, { "id": 571818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51057a2b-44f0-5b51-a970-93ec83dea596", "parentControlId": 31378, "controlId": "SI-08", "title": "SI-08", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585041" }, { "id": 571819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62ec354b-2049-56bb-83ec-0635caf725ae", "parentControlId": 31378, "controlId": "SI-08", "title": "SI-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585041" }, { "id": 571820, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e4fb517-2fc5-5e7f-a901-c3ce463e294b", "parentControlId": 31378, "controlId": "SI-08", "title": "SI-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585041" }, { "id": 571821, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d0f4f37-31e6-5bd9-a27b-b77d718e52c4", "parentControlId": 31378, "controlId": "SI-08", "title": "SI-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585041" }, { "controlId": "B.3.11", "title": "B.3.11 — Unauthorized Remote Activation of Services", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-15", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "b7497da7-0de6-5e39-80f2-c79afbf9c9f7", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.11", "title": "NEI 08-09 App D.3.11 — Unauthorized Remote Activation of Services", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.11", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "0a18ed95-cf5e-51ae-9ae7-ecb1ea600001", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.11", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "4c1af5f8-ca21-5c91-89a2-55a9824bbc49", "isPublic": true } ], "id": 31378, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731065", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731065", "catalogueId": 1062, "uuid": "ddd343b0-27a7-54d2-8c15-e68ff0b7e3a7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize anti-phishing and spam protection technologies to detect and take action on unsolicited messages transported by electronic mail?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Phishing & Spam Protection", "description": "

Control Description

Mechanisms exist to utilize anti-phishing and spam protection technologies to detect and take action on unsolicited messages transported by electronic mail.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Anti-spam/phishing technologies are centralized and built into existing email capabilities.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Anti-spam/phishing technologies are centralized and built into existing email capabilities.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize anti-phishing and spam protection technologies to detect and take action on unsolicited messages transported by electronic mail.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.11", "controlId": "END-08", "family": "Endpoint Security", "enhancements": "", "sortId": "END-08", "references": "

Micro-Small Business (<10 staff)

∙ Anti-spam / phishing solution

Small Business (10-49 staff)

∙ Anti-spam / phishing solution

Medium Business (50-249 staff)

∙ Anti-spam / phishing solution

Large Business (250-999 staff)

∙ Anti-spam / phishing solution

Enterprise (>1,000 staff)

∙ Anti-spam / phishing solution", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71253, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590459", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590459", "securityControlId": 31379, "ccis": [], "uuid": "7b984cec-5e9b-5e4d-a663-c834c931b8a5", "testId": "END-08.1_A01", "test": "endpoint security controls and related processes to be centrally managed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-09_ODP", "defaultText": null }, { "id": 71254, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590459", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590459", "securityControlId": 31379, "ccis": [], "uuid": "7d1c2bd9-d152-589c-b634-cbd97ec8ba15", "testId": "END-08.1_A02", "test": "endpoint security controls and related processes are centrally managed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PL-09", "defaultText": null } ], "externalMappings": [ { "id": 571858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c4346f6-d048-540a-8284-a10a10686a71", "parentControlId": 31379, "controlId": "SI-8(1)", "title": "SI-8(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585045" }, { "id": 571859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fef1fce5-fbf2-5194-8f53-4f77c717cf41", "parentControlId": 31379, "controlId": "PL-09", "title": "PL-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585045" }, { "id": 571861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6eea2d76-503a-535e-b0fb-243300d38a03", "parentControlId": 31379, "controlId": "PL-09", "title": "PL-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585046" }, { "id": 571862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2abe057f-24dd-59e3-9543-46efd1a8016b", "parentControlId": 31379, "controlId": "PL-9", "title": "PL-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585046" } ], "id": 31379, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731065", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731065", "catalogueId": 1062, "uuid": "dc2e811b-7e65-5f2f-bedc-4665c4df6dc6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization centrally-manage anti-phishing and spam protection technologies?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Central Management", "description": "

Control Description

Mechanisms exist to centrally-manage anti-phishing and spam protection technologies.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Anti-spam/phishing technologies are centralized and built into existing email capabilities.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Anti-spam/phishing technologies are centralized and built into existing email capabilities.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to centrally-manage anti-phishing and spam protection technologies.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-08.1", "family": "Endpoint Security", "enhancements": "", "sortId": "END-08.1", "references": "

Micro-Small Business (<10 staff)

∙ Antivirus/antimalware software\n∙ Keep OS updated

Small Business (10-49 staff)

∙ Endpoint protection platform (e.g., Windows Defender)\n∙ Patch management

Medium Business (50-249 staff)

∙ EDR solution (e.g., CrowdStrike Falcon Go)\n∙ Centralized endpoint management

Large Business (250-999 staff)

∙ Enterprise EDR/EPP (e.g., CrowdStrike, SentinelOne)\n∙ MDM/UEM (e.g., Microsoft Intune)

Enterprise (>1,000 staff)

∙ Enterprise EDR/XDR platform (e.g., CrowdStrike, SentinelOne)\n∙ UEM (e.g., Microsoft Intune, JAMF)\n∙ Zero-trust endpoint controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71255, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590459", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590459", "securityControlId": 31380, "ccis": [], "uuid": "edd05de2-b32d-53a8-9e77-f05e7c10bccd", "testId": "END-08.2_A01", "test": "the frequency at which to automatically update spam protection mechanisms is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-08(02)_ODP", "defaultText": null }, { "id": 71256, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590459", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590459", "securityControlId": 31380, "ccis": [], "uuid": "20e9d0f7-7672-5642-8f77-7e910ca619fc", "testId": "END-08.2_A02", "test": "spam protection mechanisms are automatically updated frequently.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-08b.\n53A_R5_SI-08(02)", "defaultText": null } ], "externalMappings": [ { "id": 571875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e93433f-1210-539c-b0b1-b9736a74adeb", "parentControlId": 31380, "controlId": "SI-8(2)", "title": "SI-8(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585047" }, { "id": 571876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "637b1031-45ad-5389-b29b-61c4a7d431cb", "parentControlId": 31380, "controlId": "SI-08(02)", "title": "SI-08(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585047" }, { "id": 571877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df823a25-c7c6-5e71-922f-6ec92ba312a3", "parentControlId": 31380, "controlId": "SI-08(02)", "title": "SI-08(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585048" }, { "id": 571878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4c05df8-dc8a-52a8-b47c-04e0a7abef30", "parentControlId": 31380, "controlId": "SI-08(02)", "title": "SI-08(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585048" } ], "id": 31380, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731066", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731066", "catalogueId": 1062, "uuid": "bfec85a6-78a8-5c11-819d-b06523f7908c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization automatically update anti-phishing and spam protection technologies when new releases are available in accordance with configuration and change management practices?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Automatic Spam and Phishing Protection Updates", "description": "

Control Description

Mechanisms exist to automatically update anti-phishing and spam protection technologies when new releases are available in accordance with configuration and change management practices.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Anti-spam/phishing technologies are centralized and built into existing email capabilities.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Anti-spam/phishing technologies are centralized and built into existing email capabilities.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically update anti-phishing and spam protection technologies when new releases are available in accordance with configuration and change management practices.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-08.2", "family": "Endpoint Security", "enhancements": "", "sortId": "END-08.2", "references": "

Micro-Small Business (<10 staff)

∙ Antivirus/antimalware software\n∙ Keep OS updated

Small Business (10-49 staff)

∙ Endpoint protection platform (e.g., Windows Defender)\n∙ Patch management

Medium Business (50-249 staff)

∙ EDR solution (e.g., CrowdStrike Falcon Go)\n∙ Centralized endpoint management

Large Business (250-999 staff)

∙ Enterprise EDR/EPP (e.g., CrowdStrike, SentinelOne)\n∙ MDM/UEM (e.g., Microsoft Intune)

Enterprise (>1,000 staff)

∙ Enterprise EDR/XDR platform (e.g., CrowdStrike, SentinelOne)\n∙ UEM (e.g., Microsoft Intune, JAMF)\n∙ Zero-trust endpoint controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71257, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59046", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59046", "securityControlId": 31381, "ccis": [], "uuid": "0f680a96-2cf6-574b-aa23-ddcb82d9a58c", "testId": "END-09_A01", "test": "an organization-defined isolated trusted communication path (e.g., Control-Alt-Delete in Microsoft Windows) is provided for communications between the user and the trusted components of the system.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-11a.", "defaultText": null }, { "id": 71258, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59046", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59046", "securityControlId": 31381, "ccis": [], "uuid": "13d6c956-b85d-55da-a9a5-897959101c08", "testId": "END-09_A02", "test": "users are permitted to invoke the trusted communication path (e.g., Control-Alt-Delete in Microsoft Windows) for communications between the user and the security functions of the system, including authentication and re-authentication, at a minimum.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-11b.", "defaultText": null }, { "id": 71259, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59046", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59046", "securityControlId": 31381, "ccis": [], "uuid": "1c1192df-49c9-5490-9190-8fd625b1f09b", "testId": "END-09_A03", "test": "logical security functions of the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-11_ODP[01]\n53A_R5_SC-11_ODP[02]", "defaultText": null } ], "externalMappings": [ { "id": 571884, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0f937e9-9ec2-5ef5-a65e-2b0a10f6f504", "parentControlId": 31381, "controlId": "8.5", "title": "8.5", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585048" }, { "id": 571887, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c1a476e-2cea-50d5-b4aa-9467c1c0def1", "parentControlId": 31381, "controlId": "SC-11", "title": "SC-11", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585049" }, { "id": 571888, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "990e9694-7ef0-5030-abe7-fb5ee90c4f00", "parentControlId": 31381, "controlId": "SC-11", "title": "SC-11", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585049" }, { "id": 571889, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "263cde07-d9c5-5d32-aef8-f02d84dd5980", "parentControlId": 31381, "controlId": "SC-11", "title": "SC-11", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585049" }, { "controlId": "B.3.8", "title": "B.3.8 — Trusted Path", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "171466d2-8532-5e08-8dac-96d02736cf54", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.8", "title": "NEI 08-09 App D.3.8 — Trusted Path", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "4c38ffde-5a01-5e65-92bf-f862c350b97f", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "6d49bd7b-4494-55d1-acaf-f144d16aa479", "isPublic": true }, { "controlId": "B.3.14", "title": "B.3.14 — Mobile Code", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-18", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "27cb9906-b506-5a5a-82c3-63c8cb075e95", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.14", "title": "NEI 08-09 App D.3.14 — Mobile Code", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.14", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "8496e13c-cecc-5003-809f-ea5cd3d1f331", "isPublic": true } ], "id": 31381, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731066", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731066", "catalogueId": 1062, "uuid": "9685b5e7-52b4-5672-a78f-fba510f08452", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish a trusted communications path between the user and the security functions of the operating system?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Trusted Path", "description": "

Control Description

Mechanisms exist to establish a trusted communications path between the user and the security functions of the operating system.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to establish a trusted communications path between the user and the security functions of the operating system.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.8, B.3.14", "controlId": "END-09", "family": "Endpoint Security", "enhancements": "", "sortId": "END-09", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71260, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59046", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59046", "securityControlId": 31382, "ccis": [], "uuid": "d0871934-4a8d-5c6c-afd7-00dcbb7776e2", "testId": "END-10_A01", "test": "acceptable mobile code technologies are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-18a.[01]\n53A_R5_SC-18a.[03]\n171A_R3_A.03.13.13.a[02]", "defaultText": null }, { "id": 71261, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590461", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590461", "securityControlId": 31382, "ccis": [], "uuid": "8f612f0b-7a04-56a6-99a3-0126e0fbbc94", "testId": "END-10_A02", "test": "unacceptable mobile code technologies are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-18a.[02]\n53A_R5_SC-18a.[04]\n53A_R5_SC-18(01)[01]\n53A_R5_SC-18(01)_ODP[01]", "defaultText": null }, { "id": 71262, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590463", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590463", "securityControlId": 31382, "ccis": [], "uuid": "3d6ab5aa-5d47-5187-9d3d-1f564c9419ae", "testId": "END-10_A03", "test": "the use of mobile code is authorized, monitored and controlled.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-18b.[01]\n53A_R5_SC-18b.[02]\n53A_R5_SC-18b.[03]\n171A_3.13.13[a]\n171A_3.13.13[b]", "defaultText": null }, { "id": 71263, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590463", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590463", "securityControlId": 31382, "ccis": [], "uuid": "edc123ae-c4c6-56a1-bc3e-d19d309f5d7b", "testId": "END-10_A04", "test": "the download of unacceptable mobile code is prevented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-18(03)[01]", "defaultText": null }, { "id": 71264, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590464", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590464", "securityControlId": 31382, "ccis": [], "uuid": "aa947e28-fc58-55f6-831a-f8a6a87dca45", "testId": "END-10_A05", "test": "the execution of unacceptable mobile code is prevented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-18(03)[02]", "defaultText": null }, { "id": 71265, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590464", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590464", "securityControlId": 31382, "ccis": [], "uuid": "9e42096a-fa2a-5ee1-bf7a-b29aa8f7cc23", "testId": "END-10_A06", "test": "corrective actions to be taken when unacceptable mobile code is identified are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-18(01)_ODP[02]", "defaultText": null }, { "id": 71266, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590464", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590464", "securityControlId": 31382, "ccis": [], "uuid": "62094ac4-3049-54f9-bb5a-1729c2ca32ab", "testId": "END-10_A07", "test": "corrective actions are taken if unacceptable mobile code is identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-18(01)[02]", "defaultText": null }, { "id": 71267, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590464", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590464", "securityControlId": 31382, "ccis": [], "uuid": "ba75f963-8ba9-5220-be8b-c71ba7a241d5", "testId": "END-10_A08", "test": "mobile code requirements for the acquisition, development and use of mobile code to be deployed in the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-18(02)_ODP", "defaultText": null }, { "id": 71268, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590464", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590464", "securityControlId": 31382, "ccis": [], "uuid": "475ba024-689b-5d3e-b2f8-dcd428053a6b", "testId": "END-10_A09", "test": "the acquisition of mobile code to be deployed in the system meets mobile code requirements.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-18(02)[01]", "defaultText": null }, { "id": 71269, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590465", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590465", "securityControlId": 31382, "ccis": [], "uuid": "70317639-0ee4-50e8-9ae3-62108b8a4691", "testId": "END-10_A10", "test": "the development of mobile code to be deployed in the system meets mobile code requirements.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-18(02)[02]", "defaultText": null }, { "id": 71270, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590465", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590465", "securityControlId": 31382, "ccis": [], "uuid": "24de84d0-0986-5474-b5b6-45deb75aff7e", "testId": "END-10_A11", "test": "the use of mobile code to be deployed in the system meets mobile code requirements.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-18(02)[03]", "defaultText": null }, { "id": 71271, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590465", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590465", "securityControlId": 31382, "ccis": [], "uuid": "310cda1b-ef7f-5fc5-9223-3900e72bb2a2", "testId": "END-10_A12", "test": "unacceptable mobile code to be prevented from downloading and executing is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-18(03)_ODP", "defaultText": null }, { "id": 71272, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590465", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590465", "securityControlId": 31382, "ccis": [], "uuid": "116febcb-b973-541b-afbb-0926f97411b2", "testId": "END-10_A13", "test": "software applications in which the automatic execution of mobile code is to be prevented are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-18(04)_ODP[01]", "defaultText": null }, { "id": 71273, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590465", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590465", "securityControlId": 31382, "ccis": [], "uuid": "b673d30a-cf36-5635-a6e0-a7ceed5a64fd", "testId": "END-10_A14", "test": "actions to be enforced by the system prior to executing mobile code are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-18(04)_ODP[02]", "defaultText": null }, { "id": 71274, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590465", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590465", "securityControlId": 31382, "ccis": [], "uuid": "f26a36c9-e553-5bc5-861b-ee2cc61c7d5f", "testId": "END-10_A15", "test": "the automatic execution of mobile code in software applications is prevented.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-18(04)[01]\n53A_R5_SC-18(04)[02]", "defaultText": null }, { "id": 71275, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590466", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590466", "securityControlId": 31382, "ccis": [], "uuid": "2e447577-6e84-54c5-ace5-32c2d7b72000", "testId": "END-10_A16", "test": "platform-independent applications to be included within organizational systems are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-27_ODP", "defaultText": null }, { "id": 71276, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590466", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590466", "securityControlId": 31382, "ccis": [], "uuid": "174ac5f7-ec9d-544b-beed-1776980e8858", "testId": "END-10_A17", "test": "platform-independent applications are included within organizational systems.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-27", "defaultText": null }, { "id": 71277, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590466", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590466", "securityControlId": 31382, "ccis": [], "uuid": "24b27484-2156-530e-8d19-53aa86b275f7", "testId": "END-10_A18", "test": "acceptable mobile code is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.13.13.a[01]", "defaultText": null }, { "id": 71278, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590466", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590466", "securityControlId": 31382, "ccis": [], "uuid": "0fd391b6-c679-55f0-8a5f-577414f639cd", "testId": "END-10_A19", "test": "the use of mobile code is authorized.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.13.13.b[01]", "defaultText": null }, { "id": 71279, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590466", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590466", "securityControlId": 31382, "ccis": [], "uuid": "0aecd377-c056-5a3c-8831-f6b26bc77cdd", "testId": "END-10_A20", "test": "the use of mobile code is monitored.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.13.13.b[02]", "defaultText": null }, { "id": 71280, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590466", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590466", "securityControlId": 31382, "ccis": [], "uuid": "5e6aceef-0af4-5bd3-a32b-e53ee0193bd4", "testId": "END-10_A21", "test": "the use of mobile code is controlled.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.13.13.b[03]", "defaultText": null } ], "externalMappings": [ { "id": 571896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58505", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e2e971a-2e24-5a11-a778-9d1cc7130eef", "parentControlId": 31382, "controlId": "SR 2.4", "title": "SR 2.4", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58505" }, { "id": 571897, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58505", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17385d8f-5191-5e18-8f1e-ac9814da62f4", "parentControlId": 31382, "controlId": "SR 2.4(a)", "title": "SR 2.4(a)", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58505" }, { "id": 571898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58505", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e140d470-0610-5a66-84e0-ec00e70b46a9", "parentControlId": 31382, "controlId": "SR 2.4(b)", "title": "SR 2.4(b)", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58505" }, { "id": 571899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58505", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2aa0d35-1a60-54fc-a9ad-01394311da44", "parentControlId": 31382, "controlId": "SR 2.4(c)", "title": "SR 2.4(c)", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58505" }, { "id": 571900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58505", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64bd5c73-26b9-5ab2-ba59-401367892e40", "parentControlId": 31382, "controlId": "SR 2.4(d)", "title": "SR 2.4(d)", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58505" }, { "id": 571901, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58505", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fc1b89b-1a44-5bd1-8547-011ab83f23c7", "parentControlId": 31382, "controlId": "SAR 2.4", "title": "SAR 2.4", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58505" }, { "id": 571902, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58505", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6f9d389-d7b0-5689-9ce2-bb69dbc343be", "parentControlId": 31382, "controlId": "SAR 2.4(a)", "title": "SAR 2.4(a)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58505" }, { "id": 571903, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "895e1657-d1f4-5cdf-9562-a21113c269d8", "parentControlId": 31382, "controlId": "SAR 2.4(b)", "title": "SAR 2.4(b)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585051" }, { "id": 571904, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71e55c6f-c800-5179-8dd1-68f5a4744eb8", "parentControlId": 31382, "controlId": "SAR 2.4(c)", "title": "SAR 2.4(c)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585051" }, { "id": 571905, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a15b3ca-2c30-56b4-9c6f-62ba1e056ca1", "parentControlId": 31382, "controlId": "SAR 2.4(1)", "title": "SAR 2.4(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585051" }, { "id": 571906, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55d64298-b4b3-576f-a3dc-e9447804dcbe", "parentControlId": 31382, "controlId": "EDR 2.4", "title": "EDR 2.4", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585051" }, { "id": 571907, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd774638-babc-574a-9bed-e8678bc3786f", "parentControlId": 31382, "controlId": "EDR 2.4(a)", "title": "EDR 2.4(a)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585051" }, { "id": 571908, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50176b1f-38e1-5c83-9f3d-48288f7fafc0", "parentControlId": 31382, "controlId": "EDR 2.4(b)", "title": "EDR 2.4(b)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585051" }, { "id": 571909, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4010039-d384-54a7-964d-8a93d76a26a4", "parentControlId": 31382, "controlId": "EDR 2.4(c)", "title": "EDR 2.4(c)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585051" }, { "id": 571910, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80574010-6af3-5c89-8312-db0069f6c2b2", "parentControlId": 31382, "controlId": "HDR 2.4", "title": "HDR 2.4", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585051" }, { "id": 571911, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04eb3b17-9d99-55a1-844b-7b9d4b3cfd0a", "parentControlId": 31382, "controlId": "HDR 2.4(a)", "title": "HDR 2.4(a)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585051" }, { "id": 571912, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b99647e-d310-54bf-8c28-1e8f71ee095b", "parentControlId": 31382, "controlId": "HDR 2.4(b)", "title": "HDR 2.4(b)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585051" }, { "id": 571913, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5112552b-f130-57c5-81c3-cd57634cf00b", "parentControlId": 31382, "controlId": "HDR 2.4(c)", "title": "HDR 2.4(c)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585052" }, { "id": 571914, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5b28d1d-8ba5-5b49-8352-29cfe5360b4a", "parentControlId": 31382, "controlId": "NDR 2.4", "title": "NDR 2.4", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585052" }, { "id": 571915, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d86bee6-b4a6-52e7-b183-b0a2a04e07cb", "parentControlId": 31382, "controlId": "NDR 2.4(a)", "title": "NDR 2.4(a)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585052" }, { "id": 571916, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34798286-970f-5ed6-bafc-4dc6c2ef1ebe", "parentControlId": 31382, "controlId": "NDR 2.4(b)", "title": "NDR 2.4(b)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585052" }, { "id": 571917, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8570caa-210a-5580-b3bb-0c01b41aa18d", "parentControlId": 31382, "controlId": "NDR 2.4(c)", "title": "NDR 2.4(c)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585052" }, { "id": 571918, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9305baf-ed4f-53b8-900d-44176fbf5abd", "parentControlId": 31382, "controlId": "NDR 2.4(1)", "title": "NDR 2.4(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585052" }, { "id": 571919, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0f2bea8-ea36-5d81-ac4e-894bcdfb219c", "parentControlId": 31382, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585052" }, { "id": 571920, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3d3903f-c7cb-57f9-b460-edc8625ad8d7", "parentControlId": 31382, "controlId": "T1055", "title": "T1055", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585053" }, { "id": 571921, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffb41497-e6de-55b5-9d32-918b9ecdc664", "parentControlId": 31382, "controlId": "T1055.001", "title": "T1055.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585053" }, { "id": 571922, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7377d87-399d-50d8-bede-4682163108b3", "parentControlId": 31382, "controlId": "T1055.002", "title": "T1055.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585053" }, { "id": 571923, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d4f253e-20e9-5283-993a-cf91f98ceb0c", "parentControlId": 31382, "controlId": "T1055.003", "title": "T1055.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585053" }, { "id": 571924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47b9e26a-a064-53a7-949b-4a1199588c4f", "parentControlId": 31382, "controlId": "T1055.004", "title": "T1055.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585053" }, { "id": 571925, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c54a6b3-c37f-574f-b4a3-c27e0b4aa508", "parentControlId": 31382, "controlId": "T1055.005", "title": "T1055.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585053" }, { "id": 571926, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3a8b70d-6785-5cae-82c3-88a8cc665fb8", "parentControlId": 31382, "controlId": "T1055.008", "title": "T1055.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585053" }, { "id": 571927, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d8c3ef5-0c5d-5bb3-af8d-3152f015412d", "parentControlId": 31382, "controlId": "T1055.009", "title": "T1055.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585053" }, { "id": 571928, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "058ede01-907b-5acc-9117-55ff25773719", "parentControlId": 31382, "controlId": "T1055.011", "title": "T1055.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585053" }, { "id": 571929, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "969410e3-aecc-5f5b-aed8-94ca5e3150e9", "parentControlId": 31382, "controlId": "T1055.012", "title": "T1055.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585053" }, { "id": 571930, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d11b989-4bc0-5a02-89b1-635728ad4ebd", "parentControlId": 31382, "controlId": "T1055.013", "title": "T1055.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585054" }, { "id": 571931, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fdf0c55-1ca1-561a-a6ad-e04bfa568a66", "parentControlId": 31382, "controlId": "T1055.014", "title": "T1055.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585054" }, { "id": 571932, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42aca9da-53bd-54b4-8e85-73bdac496679", "parentControlId": 31382, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585054" }, { "id": 571933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d614d74-9cf6-57c8-85e7-95e9eff5a960", "parentControlId": 31382, "controlId": "T1059.005", "title": "T1059.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585054" }, { "id": 571934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9219f3ed-95a7-5489-b30c-fe56659e8923", "parentControlId": 31382, "controlId": "T1059.007", "title": "T1059.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585054" }, { "id": 571935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b281a2a-8d30-53d2-9146-c90d8932d32b", "parentControlId": 31382, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585054" }, { "id": 571936, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "059f0159-d88d-51d1-9170-0be4786e57a8", "parentControlId": 31382, "controlId": "T1127.002", "title": "T1127.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585054" }, { "id": 571937, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9c30406-6f1f-561e-8a3d-709c3ae4577d", "parentControlId": 31382, "controlId": "T1137", "title": "T1137", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585054" }, { "id": 571938, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b53f8a2-8e36-51cc-b16d-174bb1992b4d", "parentControlId": 31382, "controlId": "T1137.001", "title": "T1137.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585054" }, { "id": 571939, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88fdadcf-fc74-594f-b302-026701befe32", "parentControlId": 31382, "controlId": "T1137.002", "title": "T1137.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585054" }, { "id": 571940, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5359eee9-a1cd-5e9e-bd19-efd9e346d833", "parentControlId": 31382, "controlId": "T1137.003", "title": "T1137.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585055" }, { "id": 571941, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5d88f40-119c-58dd-993a-81eb09b13efa", "parentControlId": 31382, "controlId": "T1137.004", "title": "T1137.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585055" }, { "id": 571942, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18f6b524-3f71-51b6-a480-e25e64b1f4f3", "parentControlId": 31382, "controlId": "T1137.005", "title": "T1137.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585055" }, { "id": 571943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb8bf692-100c-596d-b454-a82a35b0ea77", "parentControlId": 31382, "controlId": "T1137.006", "title": "T1137.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585055" }, { "id": 571944, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca93110d-9727-555e-82ec-60c94c96e319", "parentControlId": 31382, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585055" }, { "id": 571945, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "987a4fea-5e46-5003-b08e-5397b18f352f", "parentControlId": 31382, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585055" }, { "id": 571946, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc2e9d85-6261-55fe-804f-167b2241c070", "parentControlId": 31382, "controlId": "T1203", "title": "T1203", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585055" }, { "id": 571947, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9bcde928-b9e8-549e-9acf-d81b0b5c5451", "parentControlId": 31382, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585055" }, { "id": 571948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67b8c388-c23b-53fd-ae36-6c21d66a8139", "parentControlId": 31382, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585056" }, { "id": 571949, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3fd1d25-cc4f-5941-8a42-451102cd03eb", "parentControlId": 31382, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585056" }, { "id": 571950, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2feae7db-f6c7-52d2-83ac-d17175abbfdb", "parentControlId": 31382, "controlId": "T1218.001", "title": "T1218.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585056" }, { "id": 571951, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19171b78-d49b-504f-9c92-0b933fd7aaa7", "parentControlId": 31382, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585056" }, { "id": 571952, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7be7efc0-3c11-5796-8366-2fce19311100", "parentControlId": 31382, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585056" }, { "id": 571953, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89efb090-bbe8-5a5e-ba1b-e094ba9054a5", "parentControlId": 31382, "controlId": "T1548.004", "title": "T1548.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585056" }, { "id": 571954, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb674ba4-c241-5022-942d-9589e718f76c", "parentControlId": 31382, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585056" }, { "id": 571955, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0fee8a14-1d05-5ae6-a7ff-60b2a70e4484", "parentControlId": 31382, "controlId": "T1559.001", "title": "T1559.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585056" }, { "id": 571956, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2102dee0-9203-5734-8be6-fc9f594ad709", "parentControlId": 31382, "controlId": "T1559.002", "title": "T1559.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585056" }, { "id": 571957, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df8e1fc0-2f7d-5dbd-a81a-fb441ebb5a27", "parentControlId": 31382, "controlId": "SC-18", "title": "SC-18", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585057" }, { "id": 571958, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd3f36bd-6ac4-5e3a-ba9d-4b66958a7837", "parentControlId": 31382, "controlId": "SC-18(1)", "title": "SC-18(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585057" }, { "id": 571959, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12854683-1fb6-5b32-8148-63ed2af8265d", "parentControlId": 31382, "controlId": "SC-18(2)", "title": "SC-18(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585057" }, { "id": 571960, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d5f3ccf-2f66-507d-ad5f-d0664f481c46", "parentControlId": 31382, "controlId": "SC-18(3)", "title": "SC-18(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585057" }, { "id": 571961, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd0f5cba-0a7c-5344-a5a1-79caa8b61b85", "parentControlId": 31382, "controlId": "SC-18(4)", "title": "SC-18(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585057" }, { "id": 571962, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ee97b1a-d924-5c19-87c4-316ec1ada21c", "parentControlId": 31382, "controlId": "SC-27", "title": "SC-27", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585057" }, { "id": 571963, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5160746d-2a2e-5cc6-b6c4-25b83893ffae", "parentControlId": 31382, "controlId": "SC-18", "title": "SC-18", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585057" }, { "id": 571964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e80c819a-448b-5f2c-a341-225bbac02f82", "parentControlId": 31382, "controlId": "SC-18(01)", "title": "SC-18(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585057" }, { "id": 571965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7febb40e-5c61-5fba-a904-d58aac780b1c", "parentControlId": 31382, "controlId": "SC-18(02)", "title": "SC-18(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585057" }, { "id": 571966, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed1a40e0-aced-5496-a8c5-3fc956015a6f", "parentControlId": 31382, "controlId": "SC-18(03)", "title": "SC-18(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585058" }, { "id": 571967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f69ea2ff-ac82-5062-8ff2-051468d34e4f", "parentControlId": 31382, "controlId": "SC-18(04)", "title": "SC-18(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585058" }, { "id": 571968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "735c1487-8985-5cfd-bfa6-af20b4886bc0", "parentControlId": 31382, "controlId": "SC-27", "title": "SC-27", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585058" }, { "id": 571973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cde84b1a-297b-52d0-aa1e-c050cf11fff3", "parentControlId": 31382, "controlId": "SC-18", "title": "SC-18", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585058" }, { "id": 571974, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b9af9df-38f9-54f9-a48c-9c572fa4ae7a", "parentControlId": 31382, "controlId": "SC-18", "title": "SC-18", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585058" }, { "id": 571975, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1c6b62f-e75a-520a-8b88-7cf872f3c77c", "parentControlId": 31382, "controlId": "SC-18(01)", "title": "SC-18(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585059" }, { "id": 571976, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "943b9a3b-075a-548a-b43f-a9ec096a5be4", "parentControlId": 31382, "controlId": "SC-18(02)", "title": "SC-18(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585059" }, { "id": 571977, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a5d6f56-da14-5886-b1ae-2fb0f117bb5d", "parentControlId": 31382, "controlId": "SC-18(03)", "title": "SC-18(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585059" }, { "id": 571978, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c74f72db-0826-5334-9c09-3f492d085195", "parentControlId": 31382, "controlId": "SC-18(04)", "title": "SC-18(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585059" }, { "id": 571979, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0e51426-af92-552c-9d56-caee15ac2ddb", "parentControlId": 31382, "controlId": "SC-27", "title": "SC-27", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585059" }, { "id": 571980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08821d83-a68b-51ba-99bb-2ca5da03e0b9", "parentControlId": 31382, "controlId": "SC-18", "title": "SC-18", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585059" }, { "id": 571981, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "281c0d6d-6e75-51ac-8261-f69b8a271db4", "parentControlId": 31382, "controlId": "SC-18", "title": "SC-18", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585059" }, { "id": 571983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "200b75fb-3a21-5b68-afd0-52738461fa00", "parentControlId": 31382, "controlId": "SC-18", "title": "SC-18", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585059" }, { "id": 571984, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bd36ced-faa4-5ed0-8962-dbde70801a7b", "parentControlId": 31382, "controlId": "SC-18(2)", "title": "SC-18(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585059" }, { "id": 571985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58506", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b3517ac-8188-5066-9217-c54593a580e1", "parentControlId": 31382, "controlId": "SC-27", "title": "SC-27", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58506" }, { "id": 571990, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58506", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d043ce1-1d43-5d20-a9d1-0d8eca22cbf6", "parentControlId": 31382, "controlId": "3.13.13", "title": "3.13.13", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58506" }, { "id": 571991, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58506", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad66f942-4039-5216-9788-469f84b27b1b", "parentControlId": 31382, "controlId": "03.13.13.a", "title": "03.13.13.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58506" }, { "id": 571992, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58506", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a334a30-611d-5384-8706-9c22066c95bf", "parentControlId": 31382, "controlId": "03.13.13.b", "title": "03.13.13.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58506" }, { "controlId": "B.3.14", "title": "B.3.14 — Mobile Code", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-18", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "767ba119-3392-549b-8f14-83f058f7d495", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.14", "title": "NEI 08-09 App D.3.14 — Mobile Code", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.14", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "7804dcf7-f68b-54a5-8431-34a75be96970", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.14", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "970a22df-71d3-58b5-a789-c9bcdf0f2812", "isPublic": true } ], "id": 31382, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731066", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731066", "catalogueId": 1062, "uuid": "dc0b8f92-b944-5f7d-ad11-67a3bd92c9a2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization address mobile code / operating system-independent applications?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Mobile Code", "description": "

Control Description

Mechanisms exist to address mobile code / operating system-independent applications.

Evidence Request List (ERL)

E-AST-32

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to address mobile code / operating system-independent applications.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.14", "controlId": "END-10", "family": "Endpoint Security", "enhancements": "", "sortId": "END-10", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71281, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590467", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590467", "securityControlId": 31383, "ccis": [], "uuid": "594ae52d-7544-5d3d-bef1-ea1366f7a26d", "testId": "END-11_A01", "test": "system components to be employed with minimal functionality and information storage are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-25_ODP", "defaultText": null }, { "id": 71282, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590467", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590467", "securityControlId": 31383, "ccis": [], "uuid": "c34b2460-dfb8-52dd-bc7b-b09370f89769", "testId": "END-11_A02", "test": "minimal functionality for system components is employed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-25[01]", "defaultText": null }, { "id": 71283, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590467", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590467", "securityControlId": 31383, "ccis": [], "uuid": "c1d4e53f-5b7d-5bcb-a3da-860a4b6bd0fb", "testId": "END-11_A03", "test": "minimal information storage on system components is allocated.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-25[02]", "defaultText": null }, { "id": 71284, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590467", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590467", "securityControlId": 31383, "ccis": [], "uuid": "fd008980-b5ee-5d5c-b1be-f2b2e86c3c5f", "testId": "END-11_A04", "test": "physical isolation techniques are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.13.4e_ODP[1]\n172A_3.13.4e_ODP[2]", "defaultText": null }, { "id": 71285, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590467", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590467", "securityControlId": 31383, "ccis": [], "uuid": "5629b755-870e-5e6a-814c-53e3fde2786a", "testId": "END-11_A05", "test": "logical isolation techniques are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.13.4e_ODP[1]\n172A_3.13.4e_ODP[3]", "defaultText": null }, { "id": 71286, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590468", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590468", "securityControlId": 31383, "ccis": [], "uuid": "023fe44d-80af-5502-b314-39fad62d6366", "testId": "END-11_A06", "test": "physical isolation techniques and/or logical isolation techniques are employed in organizational systems and system components.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.13.4e[a]", "defaultText": null } ], "externalMappings": [ { "id": 572038, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4176c5d-4ef4-5119-8074-407d769be6db", "parentControlId": 31383, "controlId": "SC-25", "title": "SC-25", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585066" }, { "id": 572039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b21e02c4-b0e3-53e9-95bb-955e9571b1f0", "parentControlId": 31383, "controlId": "SC-25", "title": "SC-25", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585066" }, { "id": 572040, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7198b03-6220-54a5-9022-bb3a64a9fed0", "parentControlId": 31383, "controlId": "SC-25", "title": "SC-25", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585066" }, { "controlId": "B.3.19", "title": "B.3.19 — Thin Nodes", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-25", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "76a4b51f-e825-59ab-97c7-9bfe533a1e64", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.19", "title": "NEI 08-09 App D.3.19 — Thin Nodes", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.19", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "eb734ad9-6ad0-5586-abc3-0712cf75ab3d", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.19", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "4373fe45-f95f-534b-91a7-cd8a3acf1028", "isPublic": true } ], "id": 31383, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731067", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731067", "catalogueId": 1062, "uuid": "29cfa503-13b1-5a00-9965-096f8f65c8b6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization configure thin nodes to have minimal functionality and information storage?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Thin Nodes", "description": "

Control Description

Mechanisms exist to configure thin nodes to have minimal functionality and information storage.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to configure thin nodes to have minimal functionality and information storage.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.19", "controlId": "END-11", "family": "Endpoint Security", "enhancements": "", "sortId": "END-11", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71287, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590468", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590468", "securityControlId": 31384, "ccis": [], "uuid": "5c17ca23-eca4-5e71-b082-7176334515af", "testId": "END-12_A01", "test": "connection ports or input/output devices to be disabled or removed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-41_ODP[01]\n53A_R5_SC-41_ODP[02]", "defaultText": null }, { "id": 71288, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590468", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590468", "securityControlId": 31384, "ccis": [], "uuid": "2404a67b-8cdb-5de2-896a-2994e991ce89", "testId": "END-12_A02", "test": "systems or system components with connection ports or input/output devices to be disabled or removed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-41_ODP[03]", "defaultText": null }, { "id": 71289, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590468", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590469", "securityControlId": 31384, "ccis": [], "uuid": "cd380424-0531-524f-aa57-45ec7a350bac", "testId": "END-12_A03", "test": "connection ports or input/output devices that are prohibited are disabled or removed on systems or system components.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-41", "defaultText": null } ], "externalMappings": [ { "id": 572042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585074", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f938443-3f4f-5dae-8d6c-776c86d68116", "parentControlId": 31384, "controlId": "T1025", "title": "T1025", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585074" }, { "id": 572043, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585074", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de1adc64-72ba-58fc-9e00-80e465fc61be", "parentControlId": 31384, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585074" }, { "id": 572044, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585074", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c4bbd69-bd72-51ba-aab1-96e50862fe76", "parentControlId": 31384, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585074" }, { "id": 572045, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67a049a4-d4e6-5bab-a47b-4fc36e798d0b", "parentControlId": 31384, "controlId": "T1091", "title": "T1091", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585075" }, { "id": 572046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3676ffd-9246-565e-9b96-47eab9351455", "parentControlId": 31384, "controlId": "T1200", "title": "T1200", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585075" }, { "id": 572047, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98805b3f-7452-5b8c-aaae-e4cfceeb0ac9", "parentControlId": 31384, "controlId": "SC-41", "title": "SC-41", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585075" }, { "id": 572048, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4824b599-ee67-5d92-80e5-8d9561a6ef67", "parentControlId": 31384, "controlId": "SC-41", "title": "SC-41", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585075" }, { "id": 572049, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4b0e445-f058-5e2d-a035-541b9ff0403c", "parentControlId": 31384, "controlId": "SC-41", "title": "SC-41", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585075" }, { "id": 572050, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d68cae5-ea1b-5e31-a745-23b757c0e601", "parentControlId": 31384, "controlId": "SC-41", "title": "SC-41", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585075" }, { "id": 572051, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c49bb68-1e83-5b6d-b336-3abc9deed845", "parentControlId": 31384, "controlId": "SC-41", "title": "SC-41", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585075" }, { "id": 572052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80efcbdd-f039-5d34-828c-6f67594a3f97", "parentControlId": 31384, "controlId": "SC-41", "title": "SC-41", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585075" }, { "id": 572053, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9dee4992-582c-5dc2-9daa-6f4cd29f187c", "parentControlId": 31384, "controlId": "CIP-007-6 1.2", "title": "CIP-007-6 1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585075" } ], "id": 31384, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731067", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731067", "catalogueId": 1062, "uuid": "dade50c2-c0a4-5e66-8caa-a31ff8c057aa", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization physically disable or remove unnecessary connection ports or input/output devices from sensitive systems?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Port & Input / Output (I/O) Device Access", "description": "

Control Description

Mechanisms exist to physically disable or remove unnecessary connection ports or input/output devices from sensitive systems.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to physically disable or remove unnecessary connection ports or input/output devices from sensitive systems.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-12", "family": "Endpoint Security", "enhancements": "", "sortId": "END-12", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71290, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590469", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590469", "securityControlId": 31385, "ccis": [], "uuid": "c1ac30bd-5b37-5d33-aa0d-a3393e2e4ab6", "testId": "END-13_A01", "test": "environmental sensing capabilities in devices are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-42_ODP[01]\n53A_R5_SC-42_ODP[02]", "defaultText": null }, { "id": 71291, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590469", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590469", "securityControlId": 31385, "ccis": [], "uuid": "c217bfd5-9b19-551d-a02d-12ecb2387688", "testId": "END-13_A02", "test": "facilities, areas or systems where the use of devices possessing environmental sensing capabilities is prohibited are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-42_ODP[03]", "defaultText": null }, { "id": 71292, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590469", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590469", "securityControlId": 31385, "ccis": [], "uuid": "e04e36ae-9473-5018-8ae4-e602454012ea", "testId": "END-13_A03", "test": "exceptions where remote activation of sensors is allowed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-42_ODP[04]", "defaultText": null }, { "id": 71293, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590469", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590469", "securityControlId": 31385, "ccis": [], "uuid": "34f0a319-f602-5d6d-bc59-568ad8216d67", "testId": "END-13_A04", "test": "group of users to whom an explicit indication of sensor use is to be provided is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-42_ODP[05]", "defaultText": null }, { "id": 71294, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590469", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590469", "securityControlId": 31385, "ccis": [], "uuid": "a8a8a576-a9bc-518c-b358-e27ba038ec21", "testId": "END-13_A05", "test": "organization-defined parameters are prohibited.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-42a.", "defaultText": null }, { "id": 71295, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59047", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59047", "securityControlId": 31385, "ccis": [], "uuid": "7779dad5-3f90-52b3-83a8-f14f348afa9a", "testId": "END-13_A06", "test": "an explicit indication of sensor use is provided to a group of users.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-42b.", "defaultText": null } ], "externalMappings": [ { "id": 572054, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85437faa-81d9-539e-9bab-d75b232f2fd8", "parentControlId": 31385, "controlId": "SC-42", "title": "SC-42", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585076" }, { "id": 572055, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4167b179-9e4c-57f2-874d-8d155464f4ca", "parentControlId": 31385, "controlId": "SC-42", "title": "SC-42", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585076" }, { "id": 572056, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ad97e47-aa11-5cec-afdf-4947e11067eb", "parentControlId": 31385, "controlId": "SC-42", "title": "SC-42", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585076" } ], "id": 31385, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731067", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731067", "catalogueId": 1062, "uuid": "bcd158a4-47d3-5534-9e41-292ef3e82b59", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization configure embedded sensors on systems to: \n (1) Prohibit the remote activation of sensing capabilities; and\n (2) Provide an explicit indication of sensor use to users?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Sensor Capability", "description": "

Control Description

Mechanisms exist to configure embedded sensors on systems to: \n(1) Prohibit the remote activation of sensing capabilities; and\n(2) Provide an explicit indication of sensor use to users.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to configure embedded sensors on systems to: \n(1) Prohibit the remote activation of sensing capabilities; and\n(2) Provide an explicit indication of sensor use to users.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-13", "family": "Endpoint Security", "enhancements": "", "sortId": "END-13", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71296, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59047", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59047", "securityControlId": 31386, "ccis": [], "uuid": "b5dbdca7-da00-5486-9e53-5d6c478a0ca1", "testId": "END-13.1_A01", "test": "measures to be employed so that data or information collected by sensors is only used for authorized purposes are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-42(02)_ODP", "defaultText": null }, { "id": 71297, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59047", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59047", "securityControlId": 31386, "ccis": [], "uuid": "fdc6bea8-c4d7-565d-807b-72d578816ce7", "testId": "END-13.1_A02", "test": "organization-defined measures are employed so that data or information collected by sensors is only used for authorized purposes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-42(02)", "defaultText": null } ], "externalMappings": [ { "id": 572057, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cc5ddb1-9429-53c9-bf51-cef6864bed28", "parentControlId": 31386, "controlId": "SC-42(2)", "title": "SC-42(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585076" }, { "id": 572058, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f6a3a15-0a9b-57b3-82ba-5d7f79d2f9dd", "parentControlId": 31386, "controlId": "SC-42(02)", "title": "SC-42(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585076" }, { "id": 572059, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585077", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "455c1f7c-9304-5358-ad59-d6e31e6de74d", "parentControlId": 31386, "controlId": "SC-42(02)", "title": "SC-42(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585077" } ], "id": 31386, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731068", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731068", "catalogueId": 1062, "uuid": "3df98dd3-7a16-5919-806b-3835e5a7857b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize organization-defined measures so that data or information collected by sensors is only used for authorized purposes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Authorized Use", "description": "

Control Description

Mechanisms exist to utilize organization-defined measures so that data or information collected by sensors is only used for authorized purposes.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize organization-defined measures so that data or information collected by sensors is only used for authorized purposes.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-13.1", "family": "Endpoint Security", "enhancements": "", "sortId": "END-13.1", "references": "

Micro-Small Business (<10 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71298, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59047", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59047", "securityControlId": 31387, "ccis": [], "uuid": "4fdb4445-e0ca-542f-b093-42428d01bd43", "testId": "END-13.2_A01", "test": "measures to facilitate an individual’s awareness that Personal Data (PD) is being collected are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-42(04)_ODP[01]", "defaultText": null }, { "id": 71299, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59047", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59047", "securityControlId": 31387, "ccis": [], "uuid": "320aa485-ca4f-5232-b45d-572713f41861", "testId": "END-13.2_A02", "test": "sensors that collect Personal Data (PD) are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-42(04)_ODP[02]", "defaultText": null }, { "id": 71300, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590471", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590471", "securityControlId": 31387, "ccis": [], "uuid": "e2ab23c3-a789-5899-be94-b8dea50c9564", "testId": "END-13.2_A03", "test": "organization-defined measures are employed to facilitate an individual’s awareness that Personal Data (PD) is being collected by sensors
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-42(04)", "defaultText": null } ], "externalMappings": [ { "id": 572065, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585077", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29e1c72d-b47d-5ded-bc96-25addbbc05e5", "parentControlId": 31387, "controlId": "SC-42(04)", "title": "SC-42(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585077" }, { "id": 572066, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585077", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53bf4e70-7652-5fbd-99ff-d8d138437536", "parentControlId": 31387, "controlId": "SC-42(04)", "title": "SC-42(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585077" } ], "id": 31387, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731068", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731068", "catalogueId": 1062, "uuid": "56d60ad1-3976-50c8-9e02-60f22a57e47f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization notify individuals that Personal Data (PD) is collected by sensors?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Notice of Collection", "description": "

Control Description

Mechanisms exist to notify individuals that Personal Data (PD) is collected by sensors.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to notify individuals that Personal Data (PD) is collected by sensors.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-13.2", "family": "Endpoint Security", "enhancements": "", "sortId": "END-13.2", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC) ensure a visible or auditory alert

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC) ensure a visible or auditory alert

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC) ensure a visible or auditory alert

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC) ensure a visible or auditory alert

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC) ensure a visible or auditory alert", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71301, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590471", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590471", "securityControlId": 31388, "ccis": [], "uuid": "1752ff05-4f6e-58c2-8102-6adde4beff8f", "testId": "END-13.3_A01", "test": "processes that implement the privacy principle of minimization are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-08(33)_ODP", "defaultText": null }, { "id": 71302, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590471", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590471", "securityControlId": 31388, "ccis": [], "uuid": "002cd983-920b-5feb-87d7-58e9b9d94188", "testId": "END-13.3_A02", "test": "the privacy principle of minimization is implemented using organization-defined processes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-08(33)", "defaultText": null }, { "id": 71303, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590471", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590471", "securityControlId": 31388, "ccis": [], "uuid": "65082617-e10c-5e1f-812e-ccfc554900b0", "testId": "END-13.3_A03", "test": "the sensors that are configured to minimize the collection of unneeded information about individuals are defined.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-42(05)_ODP", "defaultText": null }, { "id": 71304, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590471", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590471", "securityControlId": 31388, "ccis": [], "uuid": "ae030e26-5cd3-5dd8-8e71-e3737e9bdd96", "testId": "END-13.3_A04", "test": "sensors configured to minimize the collection of information about individuals that is not needed are employed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-42(05)", "defaultText": null }, { "id": 71305, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590471", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590471", "securityControlId": 31388, "ccis": [], "uuid": "d6b8a9d2-be9e-5d5d-9d18-9fcf6c328555", "testId": "END-13.3_A05", "test": "the frequency for reviewing / updating policies that address the use of Personal Data (PD) for internal testing, training and research is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-25_ODP[01]\n53A_R5_PM-25_ODP[02]\n53A_R5_PM-25_ODP[03]\n53A_R5_PM-25_ODP[04]", "defaultText": null }, { "id": 71306, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590472", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590472", "securityControlId": 31388, "ccis": [], "uuid": "90fdd806-38fb-5d94-a0d0-2f70341b6e41", "testId": "END-13.3_A06", "test": "policies that address the use of Personal Data (PD) for internal testing, training and research are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[01]\n53A_R5_PM-25a.[02]\n53A_R5_PM-25a.[03]", "defaultText": null }, { "id": 71307, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590472", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590472", "securityControlId": 31388, "ccis": [], "uuid": "0248486e-261c-5ca6-8737-adbddc7bb67a", "testId": "END-13.3_A07", "test": "procedures that address the use of Personal Data (PD) for internal testing, training and research are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[04]\n53A_R5_PM-25a.[05]\n53A_R5_PM-25a.[06]", "defaultText": null }, { "id": 71308, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590472", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590472", "securityControlId": 31388, "ccis": [], "uuid": "8ed5632a-58b4-598b-85ab-dc51557ac727", "testId": "END-13.3_A08", "test": "policies that address the use of Personal Data (PD) for internal testing, training and research are implemented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[07]\n53A_R5_PM-25a.[08]\n53A_R5_PM-25a.[09]", "defaultText": null }, { "id": 71309, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590472", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590472", "securityControlId": 31388, "ccis": [], "uuid": "dae2d38b-7758-5233-8278-0cd15bb94ed1", "testId": "END-13.3_A09", "test": "procedures that address the use of Personal Data (PD) for internal testing, training and research are implemented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[10]\n53A_R5_PM-25a.[11]\n53A_R5_PM-25a.[12]", "defaultText": null }, { "id": 71310, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590472", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590472", "securityControlId": 31388, "ccis": [], "uuid": "6dc7512a-41bf-52c9-8ddd-cb4b60f77fcd", "testId": "END-13.3_A10", "test": "the amount of Personal Data (PD) used for internal testing, training and research purposes is limited or minimized.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_PM-25b.[01]\n53A_R5_PM-25b.[02]\n53A_R5_PM-25b.[03]", "defaultText": null }, { "id": 71311, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590473", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590473", "securityControlId": 31388, "ccis": [], "uuid": "474b4975-a95c-583f-b1b5-79c8bb70fc5b", "testId": "END-13.3_A11", "test": "the required use of Personal Data (PD) for internal testing, training and research is authorized.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25c.[01]\n53A_R5_PM-25c.[02]\n53A_R5_PM-25c.[03]", "defaultText": null }, { "id": 71312, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590475", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590475", "securityControlId": 31388, "ccis": [], "uuid": "13310e9a-a373-5bbf-a9cb-975c0c7edcc5", "testId": "END-13.3_A12", "test": "policies are reviewed / updated frequently.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25d.[01]\n53A_R5_PM-25d.[02]", "defaultText": null }, { "id": 71313, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590475", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590475", "securityControlId": 31388, "ccis": [], "uuid": "2653900d-eca6-5d25-85cb-f105e46a5a95", "testId": "END-13.3_A13", "test": "procedures are reviewed / updated frequently.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25d.[03]\n53A_R5_PM-25d.[04]", "defaultText": null } ], "externalMappings": [ { "id": 572071, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585078", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb77cb8a-d2d7-5331-8b55-4c3c51003ed4", "parentControlId": 31388, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585078" }, { "id": 572072, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585078", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "224d76a5-7741-549a-9d31-04586aeef313", "parentControlId": 31388, "controlId": "SA-08(33)", "title": "SA-08(33)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585078" }, { "id": 572073, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585078", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83efcaa4-3d08-5b7b-ae3f-335a898605bf", "parentControlId": 31388, "controlId": "SC-42(05)", "title": "SC-42(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585078" }, { "id": 572076, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "715814fb-6354-57ef-9306-92528b298892", "parentControlId": 31388, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585079" }, { "id": 572077, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03a2074e-77cc-549f-87a3-f24b3e10d322", "parentControlId": 31388, "controlId": "SA-08(33)", "title": "SA-08(33)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585079" }, { "id": 572078, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8f5957f-36b1-5a51-ab95-cffa0172675a", "parentControlId": 31388, "controlId": "SC-42(05)", "title": "SC-42(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585079" }, { "id": 572079, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69ecf251-00ba-52e8-ba51-0f127b627852", "parentControlId": 31388, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585079" }, { "id": 572080, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f63eace9-a663-51c3-acfd-89dbf10b7ae3", "parentControlId": 31388, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585079" }, { "id": 572081, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1401b907-7ac6-5b1d-8ee1-b694f7b42951", "parentControlId": 31388, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585079" }, { "id": 572082, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa3a7a08-b230-5fc3-a487-c51b0986bdc3", "parentControlId": 31388, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585079" } ], "id": 31388, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731068", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731068", "catalogueId": 1062, "uuid": "ceff8897-6857-57bd-871c-efa0f549f626", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize sensors that are configured to minimize the collection of information about individuals?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Collection Minimization", "description": "

Control Description

Mechanisms exist to utilize sensors that are configured to minimize the collection of information about individuals.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize sensors that are configured to minimize the collection of information about individuals.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-13.3", "family": "Endpoint Security", "enhancements": "", "sortId": "END-13.3", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71314, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590475", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590475", "securityControlId": 31389, "ccis": [], "uuid": "4b24dcd2-7192-5f6d-8a44-8a93793155ac", "testId": "END-13.4_A01", "test": "sensors to be used to collect data or information are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-42(01)_ODP", "defaultText": null }, { "id": 71315, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590475", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590475", "securityControlId": 31389, "ccis": [], "uuid": "a60f88c3-52c9-50f9-b117-60d73a93f52e", "testId": "END-13.4_A02", "test": "systems are configured so that data or information collected by the sensors is only reported to authorized individuals or roles.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-42(01)", "defaultText": null } ], "externalMappings": [ { "id": 572095, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585081", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a7a4c5b-fdf6-5a45-b46f-54d81b0162f8", "parentControlId": 31389, "controlId": "SC-42(01)", "title": "SC-42(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585081" }, { "id": 572096, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585081", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7e645e5-85d6-5c89-b3b7-3f217942f8ef", "parentControlId": 31389, "controlId": "SC-42(01)", "title": "SC-42(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585081" } ], "id": 31389, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731069", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731069", "catalogueId": 1062, "uuid": "ec4b7440-6d1b-53f4-8d82-3ce557aafe94", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization verify embedded technology sensors are configured so that data collected by the sensor(s) is only reported to authorized individuals or roles?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Sensor Delivery Verification", "description": "

Control Description

Mechanisms exist to verify embedded technology sensors are configured so that data collected by the sensor(s) is only reported to authorized individuals or roles.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to verify embedded technology sensors are configured so that data collected by the sensor(s) is only reported to authorized individuals or roles.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-13.4", "family": "Endpoint Security", "enhancements": "", "sortId": "END-13.4", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71316, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590475", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590475", "securityControlId": 31390, "ccis": [], "uuid": "a9f51a3f-ee65-540e-bd90-5fa995198d78", "testId": "END-14_A01", "test": "collaborative computing devices are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.13.12[a]", "defaultText": null }, { "id": 71317, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590476", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590476", "securityControlId": 31390, "ccis": [], "uuid": "f70ce910-ff09-54c5-b580-6d7b4c8ff53c", "testId": "END-14_A02", "test": "collaborative computing devices provide indication to users of devices in use.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.13.12[b]", "defaultText": null }, { "id": 71318, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590476", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590476", "securityControlId": 31390, "ccis": [], "uuid": "f90e3e74-0924-583c-a082-14a712f590bd", "testId": "END-14_A03", "test": "remote activation of collaborative computing devices is prohibited.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.13.12[c]", "defaultText": null }, { "id": 71319, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590476", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590476", "securityControlId": 31390, "ccis": [], "uuid": "1d19f66e-7f84-5fc5-ba83-82fa09253118", "testId": "END-14_A04", "test": "exceptions where remote activation is to be allowed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-15_ODP\n171A_R3_A.03.13.12.ODP[01]", "defaultText": null }, { "id": 71320, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590476", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590476", "securityControlId": 31390, "ccis": [], "uuid": "5f6d6bdb-7898-5da0-b18d-621337e73700", "testId": "END-14_A05", "test": "the remote activation of collaborative computing devices and applications is prohibited with organization-defined exceptions.
PPTDF Applicability: Technology
Assessment Rigor: 2
SCF Defined Parameters: no exceptions for computing devices", "otherId": "53A_R5_SC-15a.", "defaultText": null }, { "id": 71321, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590476", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590476", "securityControlId": 31390, "ccis": [], "uuid": "736a1a16-e3f5-5cf4-9657-5ea3a7a5d93a", "testId": "END-14_A06", "test": "an explicit indication of use is provided to users physically present at the devices.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-15b.", "defaultText": null }, { "id": 71322, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590477", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590477", "securityControlId": 31390, "ccis": [], "uuid": "9e2280e9-4cfa-565c-835d-b71473eb26b4", "testId": "END-14_A07", "test": "collaborative computing devices are logically or physically disconnected.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-15(01)_ODP", "defaultText": null }, { "id": 71323, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590477", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590477", "securityControlId": 31390, "ccis": [], "uuid": "b67ca0a0-409c-54e7-958a-d09b4a69a59f", "testId": "END-14_A08", "test": "disconnect of collaborative computing devices is/are provided in a manner that supports ease of use.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-15(01)", "defaultText": null }, { "id": 71324, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590477", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590477", "securityControlId": 31390, "ccis": [], "uuid": "34dd9293-a0c8-5f2f-8696-692fdb711d3c", "testId": "END-14_A09", "test": "the remote activation of collaborative computing devices and applications is prohibited with the following exceptions: .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: only as enumerated and justified in the System Security Plan before such remote activation occurs, and only when there are no other options, and the remote activation is operationally critical", "otherId": "171A_R3_A.03.13.12.a", "defaultText": null } ], "externalMappings": [ { "id": 572099, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "444c11ca-f9ee-5545-8633-7c86cfc1e586", "parentControlId": 31390, "controlId": "SC-15", "title": "SC-15", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585082" }, { "id": 572100, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e29b8de-2fdf-55c3-ac75-93276ef42435", "parentControlId": 31390, "controlId": "SC-15(1)", "title": "SC-15(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585082" }, { "id": 572101, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "432ccdb2-569e-5d9d-9536-549e7b5d6dcb", "parentControlId": 31390, "controlId": "SC-15", "title": "SC-15", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585082" }, { "id": 572102, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39e4d344-1813-5d7d-b12b-7f77100523fb", "parentControlId": 31390, "controlId": "SC-15(01)", "title": "SC-15(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585082" }, { "id": 572103, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91a30c44-41fd-543a-aa07-8faa25cd978b", "parentControlId": 31390, "controlId": "SC-15", "title": "SC-15", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585082" }, { "id": 572104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b622b517-3307-5d69-afcd-cfd9b5656bfd", "parentControlId": 31390, "controlId": "SC-15", "title": "SC-15", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585082" }, { "id": 572105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "436f5c47-4533-52cc-af9a-212b915259ec", "parentControlId": 31390, "controlId": "SC-15(01)", "title": "SC-15(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585082" }, { "id": 572106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "326136c1-9655-54eb-87fb-e457d14f3fe2", "parentControlId": 31390, "controlId": "SC-15", "title": "SC-15", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585083" }, { "id": 572107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d4c95bb-c91a-52d3-a17e-8703229dee80", "parentControlId": 31390, "controlId": "SC-15", "title": "SC-15", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585083" }, { "id": 572108, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7265ba67-0069-5f66-ad46-efeec2a34eb0", "parentControlId": 31390, "controlId": "SC-15", "title": "SC-15", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585083" }, { "id": 572110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84080245-cfeb-53e0-9212-6d4753abca03", "parentControlId": 31390, "controlId": "3.13.12", "title": "3.13.12", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585083" }, { "id": 572111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebabe5b7-a415-5e2a-8d57-243986fe0ab1", "parentControlId": 31390, "controlId": "03.13.12.a", "title": "03.13.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585083" }, { "controlId": "B.3.11", "title": "B.3.11 — Unauthorized Remote Activation of Services", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-15", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "c4abc2a0-45ba-5f2c-a76a-8911ce897006", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.11", "title": "NEI 08-09 App D.3.11 — Unauthorized Remote Activation of Services", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.11", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "df4bd0b5-846f-5c7a-a95e-fea4bd793ff2", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.11", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "e121b8d1-c83b-5634-ac09-110feb3c9dd4", "isPublic": true } ], "id": 31390, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731069", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731069", "catalogueId": 1062, "uuid": "5fa42a5b-dc85-585d-9bee-ff4ab7dda421", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization unplug or prohibit the remote activation of collaborative computing devices with the following exceptions: \n (1) Networked whiteboards; \n (2) Video teleconference cameras; and \n (3) Teleconference microphones?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Collaborative Computing Devices", "description": "

Control Description

Mechanisms exist to unplug or prohibit the remote activation of collaborative computing devices with the following exceptions: \n(1) Networked whiteboards; \n(2) Video teleconference cameras; and \n(3) Teleconference microphones.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to unplug or prohibit the remote activation of collaborative computing devices with the following exceptions: \n(1) Networked whiteboards; \n(2) Video teleconference cameras; and \n(3) Teleconference microphones.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.11", "controlId": "END-14", "family": "Endpoint Security", "enhancements": "", "sortId": "END-14", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71325, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590477", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590477", "securityControlId": 31391, "ccis": [], "uuid": "3a6f774e-ca90-5af6-be3b-f8d52299d3c4", "testId": "END-14.1_A01", "test": "systems or system components from which collaborative computing devices are to be disabled or removed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-15(03)_ODP[01]", "defaultText": null }, { "id": 71326, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590477", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590477", "securityControlId": 31391, "ccis": [], "uuid": "5fdc0584-fcd0-5bfe-9dd6-e3461a857bff", "testId": "END-14.1_A02", "test": "secure work areas where collaborative computing devices are to be disabled or removed from systems or system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-15(03)_ODP[02]", "defaultText": null }, { "id": 71327, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590478", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590478", "securityControlId": 31391, "ccis": [], "uuid": "9bd1d538-ffbd-5ca8-ac51-4c20b3908e9c", "testId": "END-14.1_A03", "test": "collaborative computing devices and applications are disabled or removed from systems or system components in secure work areas.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-15(03)", "defaultText": null } ], "externalMappings": [ { "id": 572133, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22cbc2a8-cba5-5677-bc2b-33fd62f1be00", "parentControlId": 31391, "controlId": "SC-15(3)", "title": "SC-15(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585086" }, { "id": 572134, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a2d1533-09d5-5a8d-a907-b6d30ea7a86f", "parentControlId": 31391, "controlId": "SC-15(03)", "title": "SC-15(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585086" }, { "id": 572135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f19ba0a4-8a05-556b-8f54-bc7373a030ac", "parentControlId": 31391, "controlId": "SC-15(03)", "title": "SC-15(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585086" } ], "id": 31391, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731069", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731069", "catalogueId": 1062, "uuid": "d5d4e369-330f-5d13-9554-ccfc240a3d22", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization disable or remove collaborative computing devices from critical systems and secure work areas?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Disabling / Removal In Secure Work Areas", "description": "

Control Description

Mechanisms exist to disable or remove collaborative computing devices from critical systems and secure work areas.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to disable or remove collaborative computing devices from critical systems and secure work areas.

Level 4 - Quantitatively Controlled: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "END-14.1", "family": "Endpoint Security", "enhancements": "", "sortId": "END-14.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Configuration Management (CM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71328, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590478", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590478", "securityControlId": 31392, "ccis": [], "uuid": "64c0e045-2459-5812-b7ca-2d0fc6bb1739", "testId": "END-14.2_A01", "test": "online meetings and teleconferences for which an explicit indication of current participants is to be provided are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-15(04)_ODP", "defaultText": null }, { "id": 71329, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590478", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590478", "securityControlId": 31392, "ccis": [], "uuid": "50476c86-050a-5d9f-8a44-0f7096597828", "testId": "END-14.2_A02", "test": "an explicit indication of current participants in online meetings and teleconferences is provided.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-15(04)", "defaultText": null } ], "externalMappings": [ { "id": 572137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9eeed511-77fa-5f26-8c8e-76cd2fd919d0", "parentControlId": 31392, "controlId": "SC-15(4)", "title": "SC-15(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585087" }, { "id": 572138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "498ef0f2-a6a6-515a-9fa4-91ba172b17f3", "parentControlId": 31392, "controlId": "SC-15(04)", "title": "SC-15(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585087" }, { "id": 572139, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9b5e0a8-a926-53d0-9616-df501a3bed01", "parentControlId": 31392, "controlId": "SC-15(04)", "title": "SC-15(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585087" } ], "id": 31392, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73107", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73107", "catalogueId": 1062, "uuid": "b12d2309-4afa-543f-9351-3193e720118c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to provide an explicit indication of current participants in online meetings and teleconferences?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Explicitly Indicate Current Participants", "description": "

Control Description

Automated mechanisms exist to provide an explicit indication of current participants in online meetings and teleconferences.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically provide an explicit indication of current participants in online meetings and teleconferences.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-14.2", "family": "Endpoint Security", "enhancements": "", "sortId": "END-14.2", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC) ensure a visible or auditory alert

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC) ensure a visible or auditory alert

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC) ensure a visible or auditory alert

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC) ensure a visible or auditory alert

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC) ensure a visible or auditory alert", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71334, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590479", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590479", "securityControlId": 31395, "ccis": [], "uuid": "89287bc5-4d59-5553-9b73-329e71ac6675", "testId": "END-14.5_A01", "test": "antimalware technologies can detect malicious links and/or files in communications.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71335, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590479", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590479", "securityControlId": 31395, "ccis": [], "uuid": "a5b15a05-4f02-5615-8f3d-bd121baca415", "testId": "END-14.5_A02", "test": "antimalware technologies can prevent users from accessing malicious links and/or files sent in communications.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 572147, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c1fa02c-97fd-59d3-bad1-d81c5866c25f", "parentControlId": 31395, "controlId": "CIP-007-6 3.1", "title": "CIP-007-6 3.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585089" } ], "id": 31395, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731071", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731071", "catalogueId": 1062, "uuid": "c9072cc4-ac1c-561d-a005-255d63a6fb9e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to detect malicious links and/or files in communications and prevent users from accessing those malicious links and/or files?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 7.0, "title": "Malicious Link & File Protections", "description": "

Control Description

Automated mechanisms exist to detect malicious links and/or files in communications and prevent users from accessing those malicious links and/or files.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically detect malicious links and/or files in communications and prevent users from accessing those malicious links and/or files.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-14.5", "family": "Endpoint Security", "enhancements": "", "sortId": "END-14.5", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Antimalware software

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Antimalware software

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Antimalware software

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Antimalware software

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Antimalware software", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71336, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59048", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59048", "securityControlId": 31396, "ccis": [], "uuid": "d3e54e23-4d83-5288-bd30-4d130d907c1c", "testId": "END-14.6_A01", "test": "an explicit indication of use is provided to users who are physically present at the devices.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.13.12.b", "defaultText": null } ], "externalMappings": [ { "id": 572148, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27e89aee-2330-5ed0-8ba8-3cff85dfa5ec", "parentControlId": 31396, "controlId": "03.13.12.b", "title": "03.13.12.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585089" } ], "id": 31396, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731071", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731071", "catalogueId": 1062, "uuid": "7258fc3c-8702-5593-bc69-e13641019eec", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization configure collaborative computing devices to provide physically-present individuals with an explicit indication of use?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Explicit Indication Of Use", "description": "

Control Description

Mechanisms exist to configure collaborative computing devices to provide physically-present individuals with an explicit indication of use.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to configure collaborative computing devices to provide physically-present individuals with an explicit indication of use.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-14.6", "family": "Endpoint Security", "enhancements": "", "sortId": "END-14.6", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC) ensure a visible or auditory alert

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC) ensure a visible or auditory alert

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC) ensure a visible or auditory alert

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC) ensure a visible or auditory alert

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC) ensure a visible or auditory alert", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71338, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59048", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59048", "securityControlId": 31398, "ccis": [], "uuid": "cece8df8-b166-5004-9aac-4f3d86ab8338", "testId": "END-16_A01", "test": "system configurations isolate security functions from non-security functions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 572155, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58509", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65bec3a3-230f-558d-81fd-a001df3ef4ad", "parentControlId": 31398, "controlId": "SC-3", "title": "SC-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58509" }, { "id": 572156, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58509", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "085ebaf2-882e-5a9b-a2b8-5a087dbfe05f", "parentControlId": 31398, "controlId": "SC-03", "title": "SC-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58509" }, { "id": 572158, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58509", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21afe7d2-4641-5d77-8894-793aa9d4f5a6", "parentControlId": 31398, "controlId": "SC-03", "title": "SC-03", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58509" }, { "id": 572159, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58509", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b853dd3-5214-5591-8286-0b94f83f56dd", "parentControlId": 31398, "controlId": "SC-03", "title": "SC-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58509" }, { "id": 572160, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58509", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74c95169-ecd0-5abf-8d60-67a7895942a6", "parentControlId": 31398, "controlId": "SC-03", "title": "SC-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58509" }, { "controlId": "B.3.2", "title": "B.3.2 — Application Partitioning and Security Function Isolation", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-2, SC-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "5731ceef-7f9a-548d-a496-7c31d2a02137", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.2", "title": "NEI 08-09 App D.3.2 — Application Partitioning and Security Function Isolation", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "f15e0a98-1489-56ab-b8e9-73971a8da3d2", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "7631bfc5-9ef1-50b3-aa48-ca29f8768ee2", "isPublic": true } ], "id": 31398, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731072", "catalogueId": 1062, "uuid": "2aa4867e-6260-5b34-a71e-e89c55cd0e71", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure security functions are restricted to authorized individuals and enforce least privilege control requirements for necessary job functions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Restrict Access To Security Functions", "description": "

Control Description

Mechanisms exist to ensure security functions are restricted to authorized individuals and enforce least privilege control requirements for necessary job functions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure security functions are restricted to authorized individuals and enforce least privilege control requirements for necessary job functions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.2", "controlId": "END-16", "family": "Endpoint Security", "enhancements": "", "sortId": "END-16", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)\n∙ Privileged Account Management (PAM)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71339, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590481", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590481", "securityControlId": 31399, "ccis": [], "uuid": "46415f60-5adc-5dbd-9381-019370f5b199", "testId": "END-16.1_A01", "test": "host-based boundary protection mechanisms to be implemented are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: Host Intrusion Prevention System(hIPS), Host Intrusion Detection System(hIDS), or minimally a host-based firewall", "otherId": "53A_R5_SC-07(12)_ODP[01]", "defaultText": null }, { "id": 71340, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590481", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590481", "securityControlId": 31399, "ccis": [], "uuid": "453d6201-4d83-51a6-a70f-59b3cb0b78f7", "testId": "END-16.1_A02", "test": "system components where host-based boundary protection mechanisms are to be implemented are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(12)_ODP[02]", "defaultText": null }, { "id": 71341, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590481", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590481", "securityControlId": 31399, "ccis": [], "uuid": "80e74127-41a4-59be-af82-d4faca6d13d1", "testId": "END-16.1_A03", "test": "host-based boundary protection mechanisms are implemented at system components.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(12)", "defaultText": null } ], "externalMappings": [ { "id": 572195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585094", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08b7c2c9-a214-516e-9a25-964179c17521", "parentControlId": 31399, "controlId": "SC-7(12)", "title": "SC-7(12)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585094" }, { "id": 572196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585094", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30070535-639c-503e-a498-05168e9215cd", "parentControlId": 31399, "controlId": "SC-07(12)", "title": "SC-07(12)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585094" }, { "id": 572197, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585094", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7adaf7f-7a04-511f-91bf-95d9ecf0e46f", "parentControlId": 31399, "controlId": "SC-07(12)", "title": "SC-07(12)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585094" } ], "id": 31399, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731072", "catalogueId": 1062, "uuid": "d05d5a08-2b70-5949-bd99-eef43222e2ed", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement underlying software separation mechanisms to facilitate security function isolation?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Host-Based Security Function Isolation", "description": "

Control Description

Mechanisms exist to implement underlying software separation mechanisms to facilitate security function isolation.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Endpoint Security (END) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain END domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of endpoint security operations (e.g., unified endpoint management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement underlying software separation mechanisms to facilitate security function isolation.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "END-16.1", "family": "Endpoint Security", "enhancements": "", "sortId": "END-16.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71342, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590481", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590481", "securityControlId": 31400, "ccis": [], "uuid": "c6a62d24-f8c9-56a3-9bbf-18ba2a7fb34c", "testId": "HRS-01_A01", "test": "personnel security procedures to facilitate the implementation of the personnel security policy and associated personnel security controls are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PS-01a.[03]", "defaultText": null }, { "id": 71343, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590482", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590482", "securityControlId": 31400, "ccis": [], "uuid": "af2e3e9a-b65f-552e-aff0-ba96dd03c54e", "testId": "HRS-01_A02", "test": "an official to manage the personnel security policy and procedures is defined.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_PS-01_ODP[03]\n53A_R5_PS-01_ODP[04]", "defaultText": null }, { "id": 71344, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590482", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590482", "securityControlId": 31400, "ccis": [], "uuid": "13167214-856d-51aa-9a7f-0498263ebd15", "testId": "HRS-01_A03", "test": "a personnel security policy is developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-01a.[01]", "defaultText": null }, { "id": 71345, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590482", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590482", "securityControlId": 31400, "ccis": [], "uuid": "4aa3612a-c5d0-5cf1-bbb1-264a2b779d9f", "testId": "HRS-01_A04", "test": "the personnel security policy is disseminated to organization-defined personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-01a.[02]", "defaultText": null }, { "id": 71346, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590482", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590482", "securityControlId": 31400, "ccis": [], "uuid": "37b8e693-23bd-5921-b211-a40243762fc6", "testId": "HRS-01_A05", "test": "personnel or roles to whom the personnel security policy is to be disseminated is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-01_ODP[01]", "defaultText": null }, { "id": 71347, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590482", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590482", "securityControlId": 31400, "ccis": [], "uuid": "e84bea36-b345-5d7c-a71e-4d7272792dc3", "testId": "HRS-01_A06", "test": "personnel or roles to whom the personnel security procedures are to be disseminated is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-01_ODP[02]", "defaultText": null }, { "id": 71348, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590483", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590483", "securityControlId": 31400, "ccis": [], "uuid": "a029614e-45c0-56bc-b041-ec94a868f403", "testId": "HRS-01_A07", "test": "the frequency at which the current personnel security policy is reviewed / updated is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PS-01_ODP[05]", "defaultText": null }, { "id": 71349, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590483", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590483", "securityControlId": 31400, "ccis": [], "uuid": "ce820726-5063-5fea-b1ab-d5ec10ff7eb2", "testId": "HRS-01_A08", "test": "events that would require the current personnel security policy to be reviewed / updated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-01_ODP[06]", "defaultText": null }, { "id": 71350, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590483", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590483", "securityControlId": 31400, "ccis": [], "uuid": "ffff2ea8-e63b-527b-bfd3-170797c500a6", "testId": "HRS-01_A09", "test": "the frequency at which the current personnel security procedures are reviewed / updated is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PS-01_ODP[07]", "defaultText": null }, { "id": 71351, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590483", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590483", "securityControlId": 31400, "ccis": [], "uuid": "64f4233f-d559-5c43-a4bd-b1067585a7b4", "testId": "HRS-01_A10", "test": "events that would require the personnel security procedures to be reviewed / updated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-01_ODP[08]", "defaultText": null }, { "id": 71352, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590483", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590483", "securityControlId": 31400, "ccis": [], "uuid": "97f304ed-d522-530f-81ca-d22c3623b1ee", "testId": "HRS-01_A11", "test": "the personnel security procedures are disseminated to organization-defined personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-01a.[04]", "defaultText": null }, { "id": 71353, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590483", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590483", "securityControlId": 31400, "ccis": [], "uuid": "ec473b48-d02d-5746-b982-f319fe37c9c6", "testId": "HRS-01_A12", "test": "the organization's personnel security policy addresses purpose.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-01a.01(a)[01]", "defaultText": null }, { "id": 71354, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590484", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590484", "securityControlId": 31400, "ccis": [], "uuid": "b9a177a1-0bc2-5a79-9330-07966d5d8cf8", "testId": "HRS-01_A13", "test": "the organization's personnel security policy addresses scope.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-01a.01(a)[02]", "defaultText": null }, { "id": 71355, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590484", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590484", "securityControlId": 31400, "ccis": [], "uuid": "9a3b1eb0-5d02-5ef1-9c01-8babf73bf5ff", "testId": "HRS-01_A14", "test": "the organization's personnel security policy addresses roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-01a.01(a)[03]", "defaultText": null }, { "id": 71356, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590484", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590484", "securityControlId": 31400, "ccis": [], "uuid": "40fde813-cb71-5fa3-8482-3e4a6c582d67", "testId": "HRS-01_A15", "test": "the organization's personnel security policy addresses responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-01a.01(a)[04]", "defaultText": null }, { "id": 71357, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590484", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590484", "securityControlId": 31400, "ccis": [], "uuid": "c365cf0a-6b47-5cfb-a6fc-d4dbf579cdf2", "testId": "HRS-01_A16", "test": "the organization's personnel security policy addresses management commitment.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-01a.01(a)[05]", "defaultText": null }, { "id": 71358, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590484", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590484", "securityControlId": 31400, "ccis": [], "uuid": "adf748b7-bf38-551e-bc79-2335f172c3fd", "testId": "HRS-01_A17", "test": "the organization's personnel security policy addresses coordination among organizational entities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-01a.01(a)[06]", "defaultText": null }, { "id": 71359, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590485", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590485", "securityControlId": 31400, "ccis": [], "uuid": "e6369f80-f080-5451-b412-262eb3643b0d", "testId": "HRS-01_A18", "test": "the organization's personnel security policy addresses compliance.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PS-01a.01(a)[07]\n171A_3.9.2[a]", "defaultText": null }, { "id": 71360, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590485", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590485", "securityControlId": 31400, "ccis": [], "uuid": "91e1da26-9b26-5130-bfac-3b7c73a180da", "testId": "HRS-01_A19", "test": "the organization's personnel security policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PS-01a.01(b)\n171A_3.9.2[a]", "defaultText": null }, { "id": 71361, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590485", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590485", "securityControlId": 31400, "ccis": [], "uuid": "8f78c6bd-4cce-5bb0-8c50-1eef98b3d88b", "testId": "HRS-01_A20", "test": "an organization-defined official is designated to manage the development, documentation, and dissemination of the personnel security policy and procedures.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_PS-01b.", "defaultText": null }, { "id": 71362, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590491", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590491", "securityControlId": 31400, "ccis": [], "uuid": "e06cc402-1dfa-5f00-b23c-23df3e868af5", "testId": "HRS-01_A21", "test": "the current personnel security policy is reviewed / updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PS-01c.01[01]", "defaultText": null }, { "id": 71363, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590491", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590491", "securityControlId": 31400, "ccis": [], "uuid": "2e07955b-d184-5e5f-8b23-bb79ac4d2710", "testId": "HRS-01_A22", "test": "the current personnel security policy is reviewed / updated following organization-defined events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-01c.01[02]", "defaultText": null }, { "id": 71364, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590491", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590491", "securityControlId": 31400, "ccis": [], "uuid": "03ec11a3-c8e7-5b27-ba13-a91cc8f12c3b", "testId": "HRS-01_A23", "test": "the current personnel security procedures are reviewed / updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PS-01c.02[01]", "defaultText": null }, { "id": 71365, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590491", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590491", "securityControlId": 31400, "ccis": [], "uuid": "fd6722bf-c5da-57b3-b163-31a8acc98f51", "testId": "HRS-01_A24", "test": "the current personnel security procedures are reviewed / updated following organization-defined events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-01c.02[02]", "defaultText": null }, { "id": 71366, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590491", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590491", "securityControlId": 31400, "ccis": [], "uuid": "6350a502-179c-534f-9c69-3af9c6ad213e", "testId": "HRS-01_A25", "test": "information security-related duties, roles, and responsibilities are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.2.2[a]", "defaultText": null }, { "id": 71367, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590492", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590492", "securityControlId": 31400, "ccis": [], "uuid": "a5136501-7071-5add-b876-30a16dc05b9c", "testId": "HRS-01_A26", "test": "information security-related duties, roles, and responsibilities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "171A_3.2.2[b]", "defaultText": null }, { "id": 71368, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590492", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590492", "securityControlId": 31400, "ccis": [], "uuid": "cdce17ac-8fa2-5061-b72a-b298bb25ea4e", "testId": "HRS-01_A27", "test": "personnel are adequately trained to carry out their assigned information security-related duties, roles, and responsibilities.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "171A_3.2.2[c]", "defaultText": null }, { "id": 71369, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590492", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590492", "securityControlId": 31400, "ccis": [], "uuid": "b7e9f10e-6cf4-5eb2-8837-93c4dc6b1ab7", "testId": "HRS-01_A28", "test": "criteria and/or process for terminating system access authorization and any credentials coincident with personnel actions is established.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.9.2[a]", "defaultText": null }, { "id": 71370, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590492", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590492", "securityControlId": 31400, "ccis": [], "uuid": "a79ca63e-c0b2-5a31-bb2b-058a84dbda29", "testId": "HRS-01_A29", "test": "the time period for account inactivity before disabling is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.ODP[01]", "defaultText": null }, { "id": 71371, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590493", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590493", "securityControlId": 31400, "ccis": [], "uuid": "a3c4089c-2866-5907-9a09-42dc7473f204", "testId": "HRS-01_A30", "test": "the time period within which to notify account managers and designated personnel or roles when accounts are no longer required is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.ODP[02]", "defaultText": null }, { "id": 71372, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590493", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590493", "securityControlId": 31400, "ccis": [], "uuid": "9d4b4660-e5c2-5c1e-8d41-076e289f4c91", "testId": "HRS-01_A31", "test": "the time period within which to notify account managers and designated personnel or roles when users are terminated or transferred is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.ODP[03]", "defaultText": null }, { "id": 71373, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590493", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590493", "securityControlId": 31400, "ccis": [], "uuid": "b8a7e27d-c139-5a22-8614-2bf06cd2219d", "testId": "HRS-01_A32", "test": "the time period within which to notify account managers and designated personnel or roles when system usage or the need-to-know changes for an individual is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.ODP[04]", "defaultText": null }, { "id": 71374, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590493", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590493", "securityControlId": 31400, "ccis": [], "uuid": "c576101e-774a-5e29-b1fe-f9f2d68dd64b", "testId": "HRS-01_A33", "test": "personnel management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71375, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590493", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590493", "securityControlId": 31400, "ccis": [], "uuid": "0f705e78-ae5e-5fcb-9db9-0bf357de0519", "testId": "HRS-01_A34", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support personnel management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71376, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590494", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590494", "securityControlId": 31400, "ccis": [], "uuid": "0ce77d88-af74-5f9a-a070-5401150d593e", "testId": "HRS-01_A35", "test": "responsibility and authority for the performance of personnel management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71377, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590494", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590494", "securityControlId": 31400, "ccis": [], "uuid": "0e536011-ebe9-5902-90bf-11e9df7a5688", "testId": "HRS-01_A36", "test": "personnel performing personnel management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 572244, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5851", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfc93863-58bc-506b-87d9-c3580db40e1e", "parentControlId": 31400, "controlId": "7.2(d)", "title": "7.2(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5851" }, { "id": 572245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5851", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db693283-30e3-5b41-916f-ccd05e6d9b49", "parentControlId": 31400, "controlId": "7.3", "title": "7.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5851" }, { "id": 572246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5851", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c10f0508-1f4d-58a4-a4f2-789dc27e10be", "parentControlId": 31400, "controlId": "7.3(a)", "title": "7.3(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5851" }, { "id": 572247, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5851", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be39e7bd-7fc0-5588-bc3f-6f230d9fa7dd", "parentControlId": 31400, "controlId": "7.3(b)", "title": "7.3(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5851" }, { "id": 572248, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5851", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "320888c6-07a6-5685-99fa-20cdc2e9f4b6", "parentControlId": 31400, "controlId": "7.3(c)", "title": "7.3(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5851" }, { "id": 572249, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5851", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e67e780-6687-56a5-a938-4df822b21f5e", "parentControlId": 31400, "controlId": "5.4", "title": "5.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5851" }, { "id": 572257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1dbf3742-0a20-5604-a815-b3ce4a31283f", "parentControlId": 31400, "controlId": "PS-1", "title": "PS-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585101" }, { "id": 572258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "779f1c75-a6ed-5ed6-ad4b-74695cf55dff", "parentControlId": 31400, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585101" }, { "id": 572260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c54aa8da-b073-5fdb-8f5b-75adf859ecc7", "parentControlId": 31400, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585101" }, { "id": 572263, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585102", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8ff381f-b333-5df1-8ac5-f82d69edd964", "parentControlId": 31400, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585102" }, { "id": 572264, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585102", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d877f34d-4f1b-5a1a-9292-0470fd6618c2", "parentControlId": 31400, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585102" }, { "id": 572265, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585102", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97db705b-7f41-5cb5-b97d-5b73f35b31e2", "parentControlId": 31400, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585102" }, { "id": 572266, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585102", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acd5bcb5-841b-5169-881e-8c4b981de58b", "parentControlId": 31400, "controlId": "PS-01", "title": "PS-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585102" }, { "id": 572267, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585102", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9db656af-dae0-54d2-9f73-428273a1b953", "parentControlId": 31400, "controlId": "PS-1", "title": "PS-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585102" }, { "id": 572268, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585102", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e336bfa0-88f8-579a-9224-848d9e0de9ca", "parentControlId": 31400, "controlId": "PS-1", "title": "PS-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585102" }, { "id": 572269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b20a479-655e-5f0e-8b12-33f958b92935", "parentControlId": 31400, "controlId": "PS-1", "title": "PS-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585103" }, { "id": 572273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41eba57b-9078-5faf-b9b8-8650a9ca41dd", "parentControlId": 31400, "controlId": "3.1.22", "title": "3.1.22", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585103" }, { "id": 572274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c45c4a72-dbfc-55b9-93bd-d86e3a400ecd", "parentControlId": 31400, "controlId": "NFO - PS-1", "title": "NFO - PS-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585103" }, { "id": 572275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e93566d9-6812-5a0d-aa14-332c9566da60", "parentControlId": 31400, "controlId": "03.01.01.g.02", "title": "03.01.01.g.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585103" }, { "id": 572276, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ae57efb-a63f-5a06-adab-b7a830c397e7", "parentControlId": 31400, "controlId": "03.15.03.a", "title": "03.15.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585103" }, { "id": 572277, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aeb6df9f-f435-580c-8065-fe419d4e2baa", "parentControlId": 31400, "controlId": "03.15.03.d", "title": "03.15.03.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585103" }, { "id": 572287, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585104", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bccbe4ba-6539-5a88-8a1c-5604305ccc21", "parentControlId": 31400, "controlId": "GV.RR-04", "title": "GV.RR-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585104" }, { "id": 572288, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585105", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3388d317-5c46-59be-b964-83fd77eba495", "parentControlId": 31400, "controlId": "ID.AM", "title": "ID.AM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585105" }, { "id": 572324, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06c4d657-d53d-5a85-869d-fc1658bd97fd", "parentControlId": 31400, "controlId": "WORKFORCE-1g", "title": "WORKFORCE-1g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585109" }, { "id": 572325, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65fe70cf-2565-5544-af3c-43e2f6ed2f93", "parentControlId": 31400, "controlId": "WORKFORCE-3e", "title": "WORKFORCE-3e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585109" }, { "id": 572326, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05bfcc94-5416-5e0b-b10a-0ffa34493379", "parentControlId": 31400, "controlId": "WORKFORCE-3f", "title": "WORKFORCE-3f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585109" }, { "id": 572351, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585112", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d743b6b5-d463-5bc1-87e0-ef6de379c530", "parentControlId": 31400, "controlId": "CIP-003-8 1.1.1", "title": "CIP-003-8 1.1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585112" }, { "id": 572352, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585112", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1efe9342-057a-5b5e-9948-9172efe583b6", "parentControlId": 31400, "controlId": "CIP-004-7 R3", "title": "CIP-004-7 R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585112" }, { "controlId": "C.2.1", "title": "C.2.1 — Personnel Security Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PS-1, PS-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "87703df6-a376-5b84-ba36-c3f1b2ba858c", "isPublic": true }, { "controlId": "NEI 08-09 App E.2.1", "title": "NEI 08-09 App E.2.1 — Personnel Security Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.2.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "f69429c8-8f07-5e27-9f0b-7c4685800f06", "isPublic": true }, { "controlId": "10 CFR 73.56", "title": "10 CFR 73.56 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.2.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "0cf774b6-8a82-544f-8331-d9105119f5f4", "isPublic": true }, { "controlId": "CIP-004-7-R3", "title": "CIP-004-7-R3 — Personnel Risk Assessment Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3b08a52f-7451-5cc6-838d-5ff9ff9a2b2a", "isPublic": true }, { "controlId": "CIP-004-7-3.1", "title": "CIP-004-7-3.1 — Process to confirm identity.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c5a110c0-4e6f-575f-8144-e644dcb175dd", "isPublic": true }, { "controlId": "CIP-004-7-3.2", "title": "CIP-004-7-3.2 — Process to perform a seven year criminal history records check as part of each personnel risk assessment that includes", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "bdd19a56-6fa0-567d-9472-ee5b8dab17dd", "isPublic": true }, { "controlId": "CIP-004-7-3.2.1", "title": "CIP-004-7-3.2.1 — current residence, regardless of duration", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6489766b-e937-5e7d-b05a-e58200c8f82e", "isPublic": true }, { "controlId": "CIP-004-7-3.2.2", "title": "CIP-004-7-3.2.2 — other locations where, during the seven years immediately prior to the date of the criminal history records check, th...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7b1de75b-f6e5-59d4-b115-938c07dfc0b4", "isPublic": true }, { "controlId": "CIP-004-7-3.3", "title": "CIP-004-7-3.3 — Criteria or process to evaluate criminal history records checks for authorizing access.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ddc24f17-6034-5a7c-868f-79ce71bb0c2f", "isPublic": true }, { "controlId": "CIP-004-7-3.4", "title": "CIP-004-7-3.4 — Criteria or process for verifying that personnel risk assessments performed for contractors or service vendors are co...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "fb260c6b-1ff3-595a-9280-3771360a379c", "isPublic": true }, { "controlId": "CIP-004-7-3.5", "title": "CIP-004-7-3.5 — Process to ensure that individuals with authorized electronic or authorized unescorted physical access have had a per...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d0155446-a761-57d1-983e-9b6aa01c1744", "isPublic": true }, { "controlId": "NSS-42G-Sec4.4", "title": "NSS-42G-Sec4.4 — Trustworthiness, Fitness-for-Duty & Insider Threat Mitigation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "0293b673-0116-5660-893e-ba14b897ce0f", "isPublic": true }, { "controlId": "IEC-63096-7.1", "title": "IEC-63096-7.1 — Human Resource Security & Background Vetting (Access Authorization)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "83e523a5-1580-5965-98b0-080ea6e8fe41", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP4", "title": "ONR-SyAP-FSyP4 — Personnel Security & Trustworthiness", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "c15c62ae-1ece-5678-a419-9c5a5b797cf6", "isPublic": true } ], "id": 31400, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731072", "catalogueId": 1062, "uuid": "632ba5c6-15f3-5b3a-bbc3-14bc9a008ead", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of personnel security controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Human Resources Security Management", "description": "

Control Description

Mechanisms exist to facilitate the implementation of personnel security controls.

Evidence Request List (ERL)

E-HRS-01\nE-HRS-15\nE-HRS-27

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ HR maintains a current list of authorized personnel and facilitates the implementation of physical access management controls.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ The HR department works with cybersecurity personnel to facilitate workforce development and awareness to help ensure secure practices are implemented.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of personnel security controls.

Level 4 - Quantitatively Controlled: Human Resources Security (HRS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.2.1
NERC-CIP (2026) Requirements: CIP-004-7-R3", "controlId": "HRS-01", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-01", "references": "

Micro-Small Business (<10 staff)

∙ Employee security policy acknowledgment\n∙ Background check for sensitive roles

Small Business (10-49 staff)

∙ Security awareness policy\n∙ Background checks\n∙ Security onboarding checklist

Medium Business (50-249 staff)

∙ HR security program\n∙ Background checks for all staff\n∙ Security onboarding training

Large Business (250-999 staff)

∙ Enterprise HR security program\n∙ Background screening service\n∙ Automated offboarding workflows

Enterprise (>1,000 staff)

∙ Enterprise HR security framework\n∙ Background screening platform\n∙ Integrated HR/IAM offboarding\n∙ Continuous monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71378, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590494", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590494", "securityControlId": 31401, "ccis": [], "uuid": "d67c7c93-b316-5474-8d35-543a65e53f28", "testId": "HRS-01.1_A01", "test": "the organization proactively governs secure practices to address personnel onboarding, transfers and offboarding actions
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 572427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585129", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d712961b-790a-537b-86c9-c720acd68a07", "parentControlId": 31401, "controlId": "ORG 1.4", "title": "ORG 1.4", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585129" }, { "id": 572431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585129", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6d873ef-84f2-5ee2-a916-21a6940476d3", "parentControlId": 31401, "controlId": "3.9.2", "title": "3.9.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585129" }, { "id": 572436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c3b4f02-176f-5881-a95a-e4c55289ea00", "parentControlId": 31401, "controlId": "CIP-004-7 5.3", "title": "CIP-004-7 5.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58513" }, { "id": 572437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abb23a0f-2bbc-5108-9e52-d7200878d98d", "parentControlId": 31401, "controlId": "CIP-004-7 5.4", "title": "CIP-004-7 5.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58513" }, { "id": 572438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f30d86fe-d0d2-5a2b-baa8-57f4b0710fe2", "parentControlId": 31401, "controlId": "CIP-004-7 6.3", "title": "CIP-004-7 6.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58513" } ], "id": 31401, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731073", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731073", "catalogueId": 1062, "uuid": "fd44961c-a3d4-5796-a7d8-78cfc8ebb7b4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization proactively govern the following personnel management actions:\n(1) Onboarding new personnel (e.g., new hires);\n(2) Transferring personnel into new roles within the organization; and \n(3) Offboarding personnel (e.g., termination of employment)?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Onboarding, Transferring & Offboarding Personnel", "description": "

Control Description

Mechanisms exist to proactively govern the following personnel management actions:\n(1) Onboarding new personnel (e.g., new hires);\n(2) Transferring personnel into new roles within the organization; and \n(3) Offboarding personnel (e.g., termination of employment).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ Responsibility for initial training and enforcing policies being assigned to the individual's immediate supervisor/manager, including the definition and enforcement of the user’s specific role(s) and responsibilities.\n▪ HR requires personnel with access to sensitive/regulated data to sign a Non-Disclosure Agreement (NDA).\n▪ Formal roles and responsibilities for cybersecurity and/or data protection are not consistent and/or standardized.\n▪ HR maintains a current list of authorized personnel and facilitates the implementation of physical access management controls.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ The HR department governs personnel management operations and notifies IT and/or cybersecurity personnel of role changes for logical access provisioning and deprovisioning actions.\n▪ Personnel managers ensure personnel are responsible for educating new hires on the organization's cybersecurity and data protection policies.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to proactively govern the following personnel management actions:\n(1) Onboarding new personnel (e.g., new hires);\n(2) Transferring personnel into new roles within the organization; and \n(3) Offboarding personnel (e.g., termination of employment).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-01.1", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Employee security policy acknowledgment\n∙ Background check for sensitive roles

Small Business (10-49 staff)

∙ Security awareness policy\n∙ Background checks\n∙ Security onboarding checklist

Medium Business (50-249 staff)

∙ HR security program\n∙ Background checks for all staff\n∙ Security onboarding training

Large Business (250-999 staff)

∙ Enterprise HR security program\n∙ Background screening service\n∙ Automated offboarding workflows

Enterprise (>1,000 staff)

∙ Enterprise HR security framework\n∙ Background screening platform\n∙ Integrated HR/IAM offboarding\n∙ Continuous monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71379, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590494", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590494", "securityControlId": 31402, "ccis": [], "uuid": "ce4bf4e0-3a28-540e-bcd3-af8cc5feea92", "testId": "HRS-02_A01", "test": "the frequency at which to review / update position risk designations is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least every three years", "otherId": "53A_R5_PS-02_ODP", "defaultText": null }, { "id": 71380, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590495", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590495", "securityControlId": 31402, "ccis": [], "uuid": "9e3959cb-b186-5eff-97d3-a3378103cc1a", "testId": "HRS-02_A02", "test": "a risk designation is assigned to all organizational positions.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_PS-02a.", "defaultText": null }, { "id": 71381, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590495", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590495", "securityControlId": 31402, "ccis": [], "uuid": "7cb0463d-8e7f-5dbe-986b-0bff442dbecd", "testId": "HRS-02_A03", "test": "screening criteria are established for individuals filling organizational positions.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_PS-02b.", "defaultText": null }, { "id": 71382, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590495", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590495", "securityControlId": 31402, "ccis": [], "uuid": "11afb405-280b-53d5-abd1-e5a1278f1974", "testId": "HRS-02_A04", "test": "position risk designations are reviewed / updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least every three years", "otherId": "53A_R5_PS-02c.", "defaultText": null } ], "externalMappings": [ { "id": 572474, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585134", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfc08f18-947d-5ca6-90d4-d4a7f1aa85fb", "parentControlId": 31402, "controlId": "7.2(a)", "title": "7.2(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585134" }, { "id": 572478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585134", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d7891e2-4206-5c08-99b7-731fbab638f3", "parentControlId": 31402, "controlId": "PS-2", "title": "PS-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585134" }, { "id": 572479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebff3c2d-2efd-5a73-b582-bb91eadc3132", "parentControlId": 31402, "controlId": "PS-02", "title": "PS-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585135" }, { "id": 572481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0f06072-39fd-5575-909f-0042e5256dad", "parentControlId": 31402, "controlId": "PS-02", "title": "PS-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585135" }, { "id": 572484, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3cc6e98a-0347-52a9-bb61-05a8afd72469", "parentControlId": 31402, "controlId": "PS-02", "title": "PS-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585135" }, { "id": 572485, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c816dbd9-ec89-5929-8422-58fc797bd880", "parentControlId": 31402, "controlId": "PS-02", "title": "PS-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585135" }, { "id": 572486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fe731a8-79ec-5bfb-928d-0916d8f7d592", "parentControlId": 31402, "controlId": "PS-02", "title": "PS-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585135" }, { "id": 572487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08b22634-5a00-59b3-8ded-970724bbaf1e", "parentControlId": 31402, "controlId": "PS-02", "title": "PS-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585135" }, { "id": 572488, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585136", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aff12eab-f06b-5162-b0a8-588b4bb6b20e", "parentControlId": 31402, "controlId": "03.01.01.c.01", "title": "03.01.01.c.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585136" }, { "id": 572489, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585136", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c012aaf6-dfd7-5b39-80c8-719d11551116", "parentControlId": 31402, "controlId": "03.01.01.c.02", "title": "03.01.01.c.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585136" }, { "id": 572490, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585136", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89e3c83f-8b27-521c-8536-f3c92891e0dd", "parentControlId": 31402, "controlId": "03.01.01.d.01", "title": "03.01.01.d.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585136" }, { "id": 572491, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585136", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f321fba7-aadb-52c0-a562-a12f415f1e0b", "parentControlId": 31402, "controlId": "03.01.01.d.02", "title": "03.01.01.d.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585136" }, { "id": 572492, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585136", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ed54843-20a3-5ff1-828c-7bfd23d0be28", "parentControlId": 31402, "controlId": "03.01.02", "title": "03.01.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585136" }, { "id": 572493, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585136", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ed2428b-6454-58e7-9383-13d2fa0b5214", "parentControlId": 31402, "controlId": "03.09.01.a", "title": "03.09.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585136" }, { "id": 572494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585136", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "baca4098-4b75-539b-9fbe-9234452b8bb3", "parentControlId": 31402, "controlId": "03.09.01.b", "title": "03.09.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585136" }, { "id": 572496, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585136", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bc24aa8-09b1-5a54-a8db-933827393b56", "parentControlId": 31402, "controlId": "GV.RR-02", "title": "GV.RR-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585137" }, { "id": 572497, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585137", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfa38898-d2fe-51b9-94f4-8734204fcc23", "parentControlId": 31402, "controlId": "PR.AA-05", "title": "PR.AA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585137" }, { "id": 572507, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585138", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b7b734d-89de-5500-ba3a-57d2d69ef997", "parentControlId": 31402, "controlId": "ACCESS-3h", "title": "ACCESS-3h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585138" }, { "id": 572508, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585138", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f3c00f4-faa9-59bb-9eb3-15073530080e", "parentControlId": 31402, "controlId": "WORKFORCE-3a", "title": "WORKFORCE-3a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585138" }, { "controlId": "A.3.1.2", "title": "A.3.1.2 — Cyber Security Team", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-2, PS-2, AT-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "63b99c3a-1fee-502e-97b5-cd86a17369ff", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.2", "title": "NEI 08-09 Sec 3.1.2 — Cyber Security Team", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "fcec8f71-194a-5db9-bc5c-9aa54e32d9be", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(1)", "title": "10 CFR 73.54(d)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "82e0fc13-4ed8-5c06-8de8-b8f9048ebf35", "isPublic": true }, { "controlId": "C.10.10", "title": "C.10.10 — Roles and Responsibilities", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PS-2, PM-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a891c67d-f013-5740-806d-fb7350983c09", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.10", "title": "NEI 08-09 App E.10.10 — Roles and Responsibilities", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.10", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "8e2c4b2c-3cb3-561c-8c7d-461e420447eb", "isPublic": true }, { "controlId": "NSS-42G-Sec4.4", "title": "NSS-42G-Sec4.4 — Trustworthiness, Fitness-for-Duty & Insider Threat Mitigation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "41e48202-ff23-5a7b-87bd-988c17eff0c9", "isPublic": true }, { "controlId": "IEC-63096-7.1", "title": "IEC-63096-7.1 — Human Resource Security & Background Vetting (Access Authorization)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "203f26c2-26e5-53b6-a62e-4030a4ae06ed", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP4", "title": "ONR-SyAP-FSyP4 — Personnel Security & Trustworthiness", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "d0c8c42a-d400-50e9-a152-9d96ab23fadf", "isPublic": true } ], "id": 31402, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731073", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731073", "catalogueId": 1062, "uuid": "b9cd3960-cad4-511d-8ae8-5b46ad54a927", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization manage personnel security risk by assigning a risk designation to all positions and establishing screening criteria for individuals filling those positions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Position Categorization", "description": "

Control Description

Mechanisms exist to manage personnel security risk by assigning a risk designation to all positions and establishing screening criteria for individuals filling those positions.

Evidence Request List (ERL)

E-HRS-01\nE-HRS-02\nE-HRS-03\nE-HRS-04\nE-HRS-11\nE-HRS-22

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ HR, in conjunction with IT and/or cybersecurity personnel, evaluates the business-critical cybersecurity and data protection skills needed to support the organization's mission.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ The HR department, in conjunction with IT and/or cybersecurity personnel, evaluates the business-critical cybersecurity and data protection skills needed to support the organization's mission and identify gaps that exist.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to manage personnel security risk by assigning a risk designation to all positions and establishing screening criteria for individuals filling those positions.

Level 4 - Quantitatively Controlled: Human Resources Security (HRS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.2, C.10.10", "controlId": "HRS-02", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-02", "references": "

Micro-Small Business (<10 staff)

∙ Employee security policy acknowledgment\n∙ Background check for sensitive roles

Small Business (10-49 staff)

∙ Security awareness policy\n∙ Background checks\n∙ Security onboarding checklist

Medium Business (50-249 staff)

∙ HR security program\n∙ Background checks for all staff\n∙ Security onboarding training

Large Business (250-999 staff)

∙ Enterprise HR security program\n∙ Background screening service\n∙ Automated offboarding workflows

Enterprise (>1,000 staff)

∙ Enterprise HR security framework\n∙ Background screening platform\n∙ Integrated HR/IAM offboarding\n∙ Continuous monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71383, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590495", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590495", "securityControlId": 31403, "ccis": [], "uuid": "45b71319-15dd-555a-89e9-633f3b2711d1", "testId": "HRS-02.1_A01", "test": "every user accessing a system, application or service that processes, stores or transmits sensitive / regulated information is cleared and regularly trained to handle the information in question.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 572560, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585144", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad451fd6-b418-539d-ae3e-c3d658effbde", "parentControlId": 31403, "controlId": "03.01.02", "title": "03.01.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585144" }, { "id": 572569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585145", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5af862e-178c-53de-a0fa-90e5b0569325", "parentControlId": 31403, "controlId": "ACCESS-3h", "title": "ACCESS-3h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585145" } ], "id": 31403, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731073", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731073", "catalogueId": 1062, "uuid": "3c033356-1b5f-5121-ae9c-907dcbaea537", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure that every user accessing Technology Assets, Applications and/or Services (TAAS) that process, store and/or transmit sensitive/regulated data is cleared and regularly trained to handle the information in question?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 10.0, "title": "Users With Elevated Privileges", "description": "

Control Description

Mechanisms exist to ensure that every user accessing Technology Assets, Applications and/or Services (TAAS) that process, store and/or transmit sensitive/regulated data is cleared and regularly trained to handle the information in question.

Evidence Request List (ERL)

E-HRS-02\nE-HRS-03\nE-HRS-04\nE-HRS-11\nE-HRS-22

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ The HR department, in conjunction with IT and/or cybersecurity personnel, evaluates risk for individuals requiring elevated privileges or access to sensitive/regulated data.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure that every user accessing Technology Assets, Applications and/or Services (TAAS) that process, store and/or transmit sensitive/regulated data is cleared and regularly trained to handle the information in question.

Level 4 - Quantitatively Controlled: Human Resources Security (HRS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-02.1", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Employee security policy acknowledgment\n∙ Background check for sensitive roles

Small Business (10-49 staff)

∙ Security awareness policy\n∙ Background checks\n∙ Security onboarding checklist

Medium Business (50-249 staff)

∙ HR security program\n∙ Background checks for all staff\n∙ Security onboarding training

Large Business (250-999 staff)

∙ Enterprise HR security program\n∙ Background screening service\n∙ Automated offboarding workflows

Enterprise (>1,000 staff)

∙ Enterprise HR security framework\n∙ Background screening platform\n∙ Integrated HR/IAM offboarding\n∙ Continuous monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71384, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590496", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590496", "securityControlId": 31404, "ccis": [], "uuid": "697b3982-7dea-5fe0-9780-a00680040563", "testId": "HRS-02.2_A01", "test": "additional monitoring to be implemented on individuals during probationary periods is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(21)_ODP[01]", "defaultText": null }, { "id": 71385, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590496", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590496", "securityControlId": 31404, "ccis": [], "uuid": "4b0d050d-72a6-58c9-9c2f-825c04d4ded5", "testId": "HRS-02.2_A02", "test": "the probationary period of individuals is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(21)_ODP[02]", "defaultText": null }, { "id": 71386, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590496", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590496", "securityControlId": 31404, "ccis": [], "uuid": "bceb4ea0-1b21-5254-a7cb-207ac7373e2f", "testId": "HRS-02.2_A03", "test": "additional monitoring of individuals is implemented during probationary period.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(21)", "defaultText": null } ], "externalMappings": [ { "id": 572578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585146", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "416d748f-4518-53b7-a27f-5e8e57176673", "parentControlId": 31404, "controlId": "SI-04(21)", "title": "SI-04(21)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585146" }, { "id": 572579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585146", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4bf834c-5b49-52e2-b4a2-4f260d6da678", "parentControlId": 31404, "controlId": "SI-04(21)", "title": "SI-04(21)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585146" } ], "id": 31404, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731074", "catalogueId": 1062, "uuid": "424a75cf-4534-575a-b77d-3fd53d29613b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify newly onboarded personnel for enhanced monitoring during their probationary period?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Probationary Periods", "description": "

Control Description

Mechanisms exist to identify newly onboarded personnel for enhanced monitoring during their probationary period.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify newly onboarded personnel for enhanced monitoring during their probationary period.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-02.2", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-02.2", "references": "

Micro-Small Business (<10 staff)

∙ Employee security policy acknowledgment\n∙ Background check for sensitive roles

Small Business (10-49 staff)

∙ Security awareness policy\n∙ Background checks\n∙ Security onboarding checklist

Medium Business (50-249 staff)

∙ HR security program\n∙ Background checks for all staff\n∙ Security onboarding training

Large Business (250-999 staff)

∙ Enterprise HR security program\n∙ Background screening service\n∙ Automated offboarding workflows

Enterprise (>1,000 staff)

∙ Enterprise HR security framework\n∙ Background screening platform\n∙ Integrated HR/IAM offboarding\n∙ Continuous monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71387, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590496", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590496", "securityControlId": 31405, "ccis": [], "uuid": "2ab2f4de-1858-5882-adce-46b9574351ed", "testId": "HRS-03_A01", "test": "cybersecurity / data privacy roles and responsibilities are incorporated into organizational position descriptions.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_PS-09[01]\n53A_R5_PS-09[02]", "defaultText": null }, { "id": 71388, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590497", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590497", "securityControlId": 31405, "ccis": [], "uuid": "d60c5e58-415f-5b5d-a127-4c2a289a190b", "testId": "HRS-03_A02", "test": "the incident response plan is protected from unauthorized disclosure.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.06.05.d", "defaultText": null } ], "externalMappings": [ { "id": 572605, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585149", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b91e166-e138-504f-b007-ac0c19f21543", "parentControlId": 31405, "controlId": "ORG 1.3", "title": "ORG 1.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585149" }, { "id": 572606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585149", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88bf0841-2389-573f-9cbb-c2f8b77c2785", "parentControlId": 31405, "controlId": "SM-2", "title": "SM-2", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585149" }, { "id": 572614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c87fd82-bf1a-5ab8-99b2-b505b2cc835f", "parentControlId": 31405, "controlId": "5.3", "title": "5.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58515" }, { "id": 572615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9ed2748-9837-5697-9bca-e2b75d8c19db", "parentControlId": 31405, "controlId": "7.3", "title": "7.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58515" }, { "id": 572616, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585151", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e618e7a-4571-571f-8a30-425d4f81601d", "parentControlId": 31405, "controlId": "7.3(b)", "title": "7.3(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585151" }, { "id": 572617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585151", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "021547de-9446-5c3c-bfee-deb292ed1c90", "parentControlId": 31405, "controlId": "5.2", "title": "5.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585151" }, { "id": 572636, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d32b1b64-bb1d-5e93-bd17-f9b7fe4cd3f1", "parentControlId": 31405, "controlId": "PM-13", "title": "PM-13", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585153" }, { "id": 572637, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd9f8790-cce7-58ae-af8c-4a909e32ba6f", "parentControlId": 31405, "controlId": "PM-13", "title": "PM-13", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585153" }, { "id": 572638, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d526689-6b29-5fa3-8a58-9373480ec86b", "parentControlId": 31405, "controlId": "PS-09", "title": "PS-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585153" }, { "id": 572640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b43b7ebe-c9a8-5264-9dcd-4bc47aadcfd8", "parentControlId": 31405, "controlId": "PS-09", "title": "PS-09", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585153" }, { "id": 572644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "048ad8fc-fa25-5960-8639-aa7b08b52235", "parentControlId": 31405, "controlId": "PM-13", "title": "PM-13", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585154" }, { "id": 572645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbbbc14e-db43-5c03-896a-56b08f79ff21", "parentControlId": 31405, "controlId": "PS-09", "title": "PS-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585154" }, { "id": 572646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db9f9e83-847d-5ec2-bab3-4f14b11fe0d3", "parentControlId": 31405, "controlId": "PM-13", "title": "PM-13", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585154" }, { "id": 572647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "756d3be5-84fa-58cf-95e0-fb1d6dcf221e", "parentControlId": 31405, "controlId": "PS-09", "title": "PS-09", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585154" }, { "id": 572648, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf618a94-ff6d-5c65-a828-9bce767b5d5e", "parentControlId": 31405, "controlId": "PM-13", "title": "PM-13", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585154" }, { "id": 572649, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30011efd-fb33-563f-89ed-62427dad6121", "parentControlId": 31405, "controlId": "PS-09", "title": "PS-09", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585154" }, { "id": 572650, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63b54cbd-7237-59f9-a49c-8c4874aa700b", "parentControlId": 31405, "controlId": "PM-13", "title": "PM-13", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585154" }, { "id": 572651, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d65e940-0ee9-57b1-ada3-97febd3cdef7", "parentControlId": 31405, "controlId": "PS-09", "title": "PS-09", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585155" }, { "id": 572652, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79d89002-829b-5aa7-b3b5-acd2e8b1d969", "parentControlId": 31405, "controlId": "PM-13", "title": "PM-13", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585155" }, { "id": 572655, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3cbb75cf-6bb4-5b79-a98a-6232942e8aab", "parentControlId": 31405, "controlId": "03.01.22.a", "title": "03.01.22.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585155" }, { "id": 572656, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e24b5f9-6be7-5c02-8782-03a8ebbab65d", "parentControlId": 31405, "controlId": "03.06.04.a", "title": "03.06.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585155" }, { "id": 572657, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b743dd7d-e83b-5c46-a4b9-26047cec888a", "parentControlId": 31405, "controlId": "03.06.05.d", "title": "03.06.05.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585155" }, { "id": 572658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e58f6a92-7cc8-5241-abe9-21170533018d", "parentControlId": 31405, "controlId": "03.07.06.a", "title": "03.07.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585155" }, { "id": 572659, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b07be4cd-2560-5fd3-91a1-0f83c6b86621", "parentControlId": 31405, "controlId": "03.08.02", "title": "03.08.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585155" }, { "id": 572660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41a249e9-bdf5-5bea-a915-dceb3fb9a38b", "parentControlId": 31405, "controlId": "03.15.03.b", "title": "03.15.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585155" }, { "id": 572661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585156", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7908104d-73ed-5f47-a659-73e20aed49d6", "parentControlId": 31405, "controlId": "03.16.03.b", "title": "03.16.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585156" }, { "id": 572666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585156", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4041839-3e9f-5386-92cc-50fb558b4610", "parentControlId": 31405, "controlId": "GV.RM-05", "title": "GV.RM-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585156" }, { "id": 572667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585156", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cee76a0b-bccc-5d58-9ec9-6ff6a144fb94", "parentControlId": 31405, "controlId": "GV.RR", "title": "GV.RR", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585156" }, { "id": 572668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585156", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2770c294-c836-5240-be16-e33808a88224", "parentControlId": 31405, "controlId": "GV.RR-02", "title": "GV.RR-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585156" }, { "id": 572669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585157", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b126530-022e-54de-b238-64e82018333a", "parentControlId": 31405, "controlId": "ID.AM", "title": "ID.AM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585157" }, { "id": 572785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585178", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fac3824c-86b7-5312-a62a-7dfb9eaf12ea", "parentControlId": 31405, "controlId": "THREAT-2a", "title": "THREAT-2a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585178" }, { "id": 572786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585178", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d30b8d67-b8ed-5734-9c89-25499ea7be02", "parentControlId": 31405, "controlId": "RESPONSE-3a", "title": "RESPONSE-3a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585178" }, { "id": 572787, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585178", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2968ea48-31b3-58ba-9b6b-b03f65777fd3", "parentControlId": 31405, "controlId": "WORKFORCE-3a", "title": "WORKFORCE-3a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585178" }, { "id": 572788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585178", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "206a4417-8725-59d1-aeee-854cc6591232", "parentControlId": 31405, "controlId": "WORKFORCE-3b", "title": "WORKFORCE-3b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585178" }, { "id": 572789, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585178", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34d6fa01-7f04-564b-a9a6-0be61d06f66a", "parentControlId": 31405, "controlId": "WORKFORCE-3c", "title": "WORKFORCE-3c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585178" }, { "id": 572790, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585178", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8add27f-5c31-50c5-9f7b-1ea9a3604a17", "parentControlId": 31405, "controlId": "WORKFORCE-3d", "title": "WORKFORCE-3d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585178" }, { "id": 572812, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585181", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fec5224b-be9b-544f-a12f-d386f367a035", "parentControlId": 31405, "controlId": "CIP-008-6 1.3", "title": "CIP-008-6 1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585181" }, { "id": 572813, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585181", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbd9da8d-b52b-5aff-bd5e-83d78ed58091", "parentControlId": 31405, "controlId": "CIP-009-6 1.2", "title": "CIP-009-6 1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585181" }, { "id": 572814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585181", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0169779-5d72-569a-aca0-d08d468bee29", "parentControlId": 31405, "controlId": "§117.18(c)(2)", "title": "§117.18(c)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585181" }, { "id": 572815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585181", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "947ef7f0-1811-545e-80d4-fb4baf7f418c", "parentControlId": 31405, "controlId": "§117.18(c)(2)(i)", "title": "§117.18(c)(2)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585181" }, { "id": 572816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585181", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58eed94a-6943-5d87-ba78-675f3278da3c", "parentControlId": 31405, "controlId": "§117.18(c)(2)(ii)", "title": "§117.18(c)(2)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585181" }, { "id": 572817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585181", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16b0f723-b177-5aba-8091-1a8791b90320", "parentControlId": 31405, "controlId": "§117.18(c)(2)(iii)", "title": "§117.18(c)(2)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585181" }, { "id": 572818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585181", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9310984-0bc7-54b2-b0dd-b3eb7f6e5946", "parentControlId": 31405, "controlId": "§117.18(c)(2)(iv)", "title": "§117.18(c)(2)(iv)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585181" }, { "id": 572819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0c5130d-8cb4-5223-9781-45ec055fd165", "parentControlId": 31405, "controlId": "§117.18(c)(2)(v)", "title": "§117.18(c)(2)(v)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585182" }, { "id": 572820, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6c2016f-7892-554b-82d0-5585535bafd6", "parentControlId": 31405, "controlId": "§117.18(c)(2)(vi)", "title": "§117.18(c)(2)(vi)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585182" }, { "id": 572821, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1606048f-339b-53fc-851d-2d9b10e74ab4", "parentControlId": 31405, "controlId": "§117.18(c)(2)(vii)", "title": "§117.18(c)(2)(vii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585182" }, { "id": 572822, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0f0019f-b117-5f7e-a577-97227556d32a", "parentControlId": 31405, "controlId": "§117.18(c)(2)(vii)(A)", "title": "§117.18(c)(2)(vii)(A)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585182" }, { "id": 572823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b331ea3e-23f5-5650-8a6d-d829cd741163", "parentControlId": 31405, "controlId": "§117.18(c)(2)(vii)(B)", "title": "§117.18(c)(2)(vii)(B)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585182" }, { "id": 572824, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed8ff85c-e250-5f12-a23b-23e1e9d4491d", "parentControlId": 31405, "controlId": "§117.18(c)(2)(vii)(C)", "title": "§117.18(c)(2)(vii)(C)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585182" }, { "id": 572825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d8bea1d-a5fe-52c1-80dc-7f64061d1ceb", "parentControlId": 31405, "controlId": "§117.18(c)(2)(vii)(D)", "title": "§117.18(c)(2)(vii)(D)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585182" }, { "id": 572826, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc60caa3-26da-5ca9-9b4b-54868e493df4", "parentControlId": 31405, "controlId": "§117.18(c)(2)(vii)(E)", "title": "§117.18(c)(2)(vii)(E)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585182" }, { "id": 572827, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cce937b4-e41a-5f22-a9fc-c9f4e9c8edcb", "parentControlId": 31405, "controlId": "§117.18(c)(2)(vii)(F)", "title": "§117.18(c)(2)(vii)(F)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585182" }, { "id": 572828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e556aa1-93f9-5e77-b2b0-b6d2bf109a98", "parentControlId": 31405, "controlId": "§117.18(c)(2)(vii)(G)", "title": "§117.18(c)(2)(vii)(G)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585183" }, { "id": 572829, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94dc10c5-ff32-5ab7-a934-f31d99e88dad", "parentControlId": 31405, "controlId": "§117.18(c)(2)(vii)(H)", "title": "§117.18(c)(2)(vii)(H)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585183" }, { "id": 572830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac95b6a8-f24d-50fb-a245-805d294cdfe1", "parentControlId": 31405, "controlId": "§117.18(c)(2)(vii)(I)", "title": "§117.18(c)(2)(vii)(I)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585183" }, { "id": 572831, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e06314f-7faa-5646-bac2-e4bad4010700", "parentControlId": 31405, "controlId": "§117.18(c)(3)", "title": "§117.18(c)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585183" }, { "id": 572832, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80eb86ee-5d50-5abf-aa5c-4a7c12a13671", "parentControlId": 31405, "controlId": "§117.18(c)(3)(i)", "title": "§117.18(c)(3)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585183" }, { "id": 572833, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efed946a-b103-5b51-89f1-8f0e835ae506", "parentControlId": 31405, "controlId": "§117.18(c)(3)(ii)", "title": "§117.18(c)(3)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585183" }, { "id": 572834, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a3c0ab3-f157-55e1-a190-cfb76f701a31", "parentControlId": 31405, "controlId": "§117.18(c)(3)(iii)", "title": "§117.18(c)(3)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585183" }, { "id": 572835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f77d6655-8387-57a0-b0ce-c3b5b3c9b242", "parentControlId": 31405, "controlId": "§117.18(c)(4)", "title": "§117.18(c)(4)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585183" }, { "id": 572836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64e0d392-3ee1-5381-8891-f393ff9692da", "parentControlId": 31405, "controlId": "§117.18(c)(4)(i)", "title": "§117.18(c)(4)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585183" }, { "id": 572837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f98cfe6b-79bc-5b46-9343-96bc687c7786", "parentControlId": 31405, "controlId": "§117.18(c)(4)(ii)", "title": "§117.18(c)(4)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585184" }, { "id": 572838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67e89ea1-d6c0-5645-a4a4-d5c9ef36469c", "parentControlId": 31405, "controlId": "§117.18(c)(4)(iii)", "title": "§117.18(c)(4)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585184" }, { "id": 572839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ac38e75-3a5d-5019-bc5e-1134ccfa5b2c", "parentControlId": 31405, "controlId": "§117.18(c)(4)(iv)", "title": "§117.18(c)(4)(iv)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585184" }, { "id": 572840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c85dd2b6-70e4-54b1-97ee-370b43726d9e", "parentControlId": 31405, "controlId": "§117.18(c)(4)(v)", "title": "§117.18(c)(4)(v)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585184" }, { "id": 572841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27d6eaa0-8d2e-5559-8c15-ca07f06b2247", "parentControlId": 31405, "controlId": "§117.18(c)(4)(vi)", "title": "§117.18(c)(4)(vi)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585184" }, { "id": 572842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "babf46e1-b408-595a-be2a-0c41659e1351", "parentControlId": 31405, "controlId": "9-2.e", "title": "9-2.e", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585184" }, { "controlId": "C.2.1", "title": "C.2.1 — Personnel Security Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PS-1, PS-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "9a3989e1-61f7-5117-a743-3da691972f11", "isPublic": true }, { "controlId": "NEI 08-09 App E.2.1", "title": "NEI 08-09 App E.2.1 — Personnel Security Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.2.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d988da2b-c766-5dfa-b032-3dda05cfaa16", "isPublic": true }, { "controlId": "10 CFR 73.56", "title": "10 CFR 73.56 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.2.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "4bc67679-dc3c-5083-8d69-922bf45444d4", "isPublic": true }, { "controlId": "CIP-004-7-R3", "title": "CIP-004-7-R3 — Personnel Risk Assessment Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "15235a99-45bd-5a80-b5da-675dc0373b5e", "isPublic": true }, { "controlId": "CIP-004-7-3.1", "title": "CIP-004-7-3.1 — Process to confirm identity.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d86a753e-80a3-55f5-af51-b08fa430e435", "isPublic": true }, { "controlId": "CIP-004-7-3.2", "title": "CIP-004-7-3.2 — Process to perform a seven year criminal history records check as part of each personnel risk assessment that includes", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e113810d-c8d4-525d-aa76-7f3adbb54ada", "isPublic": true }, { "controlId": "CIP-004-7-3.2.1", "title": "CIP-004-7-3.2.1 — current residence, regardless of duration", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "83fe5429-9ebc-5ae9-8e98-44dd25aab558", "isPublic": true }, { "controlId": "CIP-004-7-3.2.2", "title": "CIP-004-7-3.2.2 — other locations where, during the seven years immediately prior to the date of the criminal history records check, th...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "11262136-c441-5f66-a92c-965e0d5f08aa", "isPublic": true }, { "controlId": "CIP-004-7-3.3", "title": "CIP-004-7-3.3 — Criteria or process to evaluate criminal history records checks for authorizing access.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "fbb0f584-a1b9-551f-876d-be1442d634f4", "isPublic": true }, { "controlId": "CIP-004-7-3.4", "title": "CIP-004-7-3.4 — Criteria or process for verifying that personnel risk assessments performed for contractors or service vendors are co...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7232809b-e5a3-5bb0-942d-6fd10b21bb5f", "isPublic": true }, { "controlId": "CIP-004-7-3.5", "title": "CIP-004-7-3.5 — Process to ensure that individuals with authorized electronic or authorized unescorted physical access have had a per...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d3732f71-8a96-55d8-94ad-51bc4606ffba", "isPublic": true }, { "controlId": "NSS-42G-Sec4.4", "title": "NSS-42G-Sec4.4 — Trustworthiness, Fitness-for-Duty & Insider Threat Mitigation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "1ac06884-7ada-5626-8a5e-22dc3e29bc16", "isPublic": true }, { "controlId": "IEC-63096-7.1", "title": "IEC-63096-7.1 — Human Resource Security & Background Vetting (Access Authorization)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "e87143c5-3583-5a4f-abaf-8fe2e539362c", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP4", "title": "ONR-SyAP-FSyP4 — Personnel Security & Trustworthiness", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "3e4c9fba-171c-53f5-b858-a39777eee321", "isPublic": true } ], "id": 31405, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731074", "catalogueId": 1062, "uuid": "376214e7-f506-5c17-afe2-4ed8de93655e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define cybersecurity roles & responsibilities for all personnel?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Defined Roles & Responsibilities", "description": "

Control Description

Mechanisms exist to define cybersecurity roles & responsibilities for all personnel.

Evidence Request List (ERL)

E-HRS-01\nE-HRS-02\nE-HRS-03\nE-HRS-04\nE-HRS-11\nE-HRS-13\nE-HRS-18\nE-HRS-22\nE-HRS-28

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ Formal roles and responsibilities for cybersecurity and/or data protection are not consistent and/or standardized.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to define cybersecurity roles & responsibilities for all personnel.

Level 4 - Quantitatively Controlled: Human Resources Security (HRS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.2.1
NERC-CIP (2026) Requirements: CIP-004-7-R3", "controlId": "HRS-03", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-03", "references": "

Micro-Small Business (<10 staff)

∙ NIST NICE cybersecurity workforce framework alignment\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix

Small Business (10-49 staff)

∙ NIST NICE cybersecurity workforce framework alignment\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix

Medium Business (50-249 staff)

∙ NIST NICE cybersecurity workforce framework alignment\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix

Large Business (250-999 staff)

∙ NIST NICE cybersecurity workforce framework alignment\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix

Enterprise (>1,000 staff)

∙ NIST NICE cybersecurity workforce framework alignment\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71389, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590497", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590497", "securityControlId": 31406, "ccis": [], "uuid": "03edd61e-cfc7-57be-976f-3789d4db5645", "testId": "HRS-03.1_A01", "test": "users are formally made aware of their roles and responsibilities to maintain a safe and secure working environment.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71390, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590497", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590497", "securityControlId": 31406, "ccis": [], "uuid": "ab09d0ff-376d-5192-9f2b-4eb29639a955", "testId": "HRS-03.1_A02", "test": "acknowledgement of user awareness is maintained by the organization.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 572999, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f0bf518-8d24-5b8b-a92f-47c65e93d394", "parentControlId": 31406, "controlId": "7.3", "title": "7.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585202" }, { "id": 573000, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87cbe55c-52a5-523f-85ea-e2be5f2137ff", "parentControlId": 31406, "controlId": "7.3(a)", "title": "7.3(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585202" }, { "id": 573001, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ea5e177-8b8a-57e7-acc3-475d9044d6a8", "parentControlId": 31406, "controlId": "7.3(b)", "title": "7.3(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585202" }, { "id": 573002, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd3a20fb-ef30-5149-b00b-74a148aefd42", "parentControlId": 31406, "controlId": "7.3(c)", "title": "7.3(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585202" }, { "id": 573009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78816789-cc3f-5976-9aaf-3588f952d72a", "parentControlId": 31406, "controlId": "03.01.22.a", "title": "03.01.22.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585203" }, { "id": 573010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da5a3d3f-56ee-525e-b102-48cf7d83408a", "parentControlId": 31406, "controlId": "03.15.03.b", "title": "03.15.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585203" }, { "id": 573011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "201e2cb2-ba27-5f5a-8bdf-9f2c560907ac", "parentControlId": 31406, "controlId": "GV.RR-04", "title": "GV.RR-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585203" }, { "id": 573058, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19cbe267-b5ef-5283-ae6f-d3cff59c0508", "parentControlId": 31406, "controlId": "WORKFORCE-1e", "title": "WORKFORCE-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585217" }, { "id": 573059, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc55efa9-b046-55b5-8ef8-ed866b55743c", "parentControlId": 31406, "controlId": "WORKFORCE-2a", "title": "WORKFORCE-2a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585217" }, { "id": 573061, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54b6fc93-893d-5600-8904-c6f7e71e4ba2", "parentControlId": 31406, "controlId": "CIP-004-7 R2", "title": "CIP-004-7 R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585217" }, { "id": 573062, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86645fd5-166b-5691-be78-4244ae1938c3", "parentControlId": 31406, "controlId": "CIP-004-7 2.2", "title": "CIP-004-7 2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585217" }, { "controlId": "CIP-004-7-R2", "title": "CIP-004-7-R2 — Cyber Security Training Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ab2c133e-e5f7-5df9-8bd3-500843101bc8", "isPublic": true }, { "controlId": "CIP-004-7-2.1", "title": "CIP-004-7-2.1 — Training content on: 2.1.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c4c5c294-c73c-59d4-9e95-57c2919fb1ab", "isPublic": true }, { "controlId": "CIP-004-7-2.1.1", "title": "CIP-004-7-2.1.1 — Cyber security policies", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4c73c544-6673-57d1-995d-3957a679c40d", "isPublic": true }, { "controlId": "CIP-004-7-2.1.2", "title": "CIP-004-7-2.1.2 — Physical access controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d1c57fd6-1e8b-5304-8654-862831ec6c16", "isPublic": true }, { "controlId": "CIP-004-7-2.1.3", "title": "CIP-004-7-2.1.3 — Electronic access controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1a84aa38-a330-51f8-b9d5-bb344e71d99b", "isPublic": true }, { "controlId": "CIP-004-7-2.1.4", "title": "CIP-004-7-2.1.4 — The visitor control program", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "64a6fa0f-5a48-54b8-9082-6fa4441a8314", "isPublic": true }, { "controlId": "CIP-004-7-2.1.5", "title": "CIP-004-7-2.1.5 — Handling of BES Cyber System Information and its storage", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "80e40756-f722-5180-96c8-42a5745257ae", "isPublic": true }, { "controlId": "CIP-004-7-2.1.6", "title": "CIP-004-7-2.1.6 — Identification of a Cyber Security Incident and initial notifications in accordance with the entity’s incident respon...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "841b2489-05bc-5a59-ad93-b1af7be2bf7c", "isPublic": true }, { "controlId": "CIP-004-7-2.1.7", "title": "CIP-004-7-2.1.7 — Recovery plans for BES Cyber Systems", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9bf575c9-de40-5a3b-befe-81e91c367209", "isPublic": true }, { "controlId": "CIP-004-7-2.1.8", "title": "CIP-004-7-2.1.8 — Response to Cyber Security Incidents", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5b2d2ca6-cf71-572f-8787-fd487ecc9061", "isPublic": true }, { "controlId": "CIP-004-7-2.1.9", "title": "CIP-004-7-2.1.9 — Cyber security risks associated with a BES Cyber System’s electronic interconnectivity and interoperability with othe...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ef1e8620-4ed5-54a6-912b-cef134cf7674", "isPublic": true }, { "controlId": "CIP-004-7-2.2", "title": "CIP-004-7-2.2 — Require completion of the training specified in Part 2.1 prior to granting authorized electronic access and authorize...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8d5f2acc-5e96-5279-b5a2-30a4cf890f3d", "isPublic": true }, { "controlId": "CIP-004-7-2.3", "title": "CIP-004-7-2.3 — Require completion of the training specified in Part 2.1 at least once every 15 calendar months.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2c4fb4c0-fc52-5281-a4ca-a8b2eac4c0d8", "isPublic": true }, { "controlId": "CIP-004-7-R3", "title": "CIP-004-7-R3 — Personnel Risk Assessment Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0a71cecb-39a1-5d95-9414-850e791cb702", "isPublic": true }, { "controlId": "CIP-004-7-3.1", "title": "CIP-004-7-3.1 — Process to confirm identity.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2aac18df-b23c-5fff-8932-809a24350fad", "isPublic": true }, { "controlId": "CIP-004-7-3.2", "title": "CIP-004-7-3.2 — Process to perform a seven year criminal history records check as part of each personnel risk assessment that includes", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "bcb28f63-684e-50ad-9dec-fbfe7a4ee6fc", "isPublic": true }, { "controlId": "CIP-004-7-3.2.1", "title": "CIP-004-7-3.2.1 — current residence, regardless of duration", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "98399031-7a06-57a3-8b0c-30b4c903d34d", "isPublic": true }, { "controlId": "CIP-004-7-3.2.2", "title": "CIP-004-7-3.2.2 — other locations where, during the seven years immediately prior to the date of the criminal history records check, th...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c9c0765b-94c8-508d-9201-c1cb27bd9fc0", "isPublic": true }, { "controlId": "CIP-004-7-3.3", "title": "CIP-004-7-3.3 — Criteria or process to evaluate criminal history records checks for authorizing access.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6261cf37-e0fb-5f4e-87c4-c4995b6d7f34", "isPublic": true }, { "controlId": "CIP-004-7-3.4", "title": "CIP-004-7-3.4 — Criteria or process for verifying that personnel risk assessments performed for contractors or service vendors are co...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "14827033-e4c5-5d04-ad43-aa4a93ae9996", "isPublic": true }, { "controlId": "CIP-004-7-3.5", "title": "CIP-004-7-3.5 — Process to ensure that individuals with authorized electronic or authorized unescorted physical access have had a per...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "bcffe83a-db7b-5bba-99ed-435550215721", "isPublic": true }, { "controlId": "NSS-42G-Sec4.4", "title": "NSS-42G-Sec4.4 — Trustworthiness, Fitness-for-Duty & Insider Threat Mitigation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "05681e84-af33-5b58-97d8-12a628bbdeee", "isPublic": true }, { "controlId": "IEC-63096-7.1", "title": "IEC-63096-7.1 — Human Resource Security & Background Vetting (Access Authorization)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "51696b6c-c89b-5b21-953c-bbef4ed42e13", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP4", "title": "ONR-SyAP-FSyP4 — Personnel Security & Trustworthiness", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "ddd2473a-8b7d-549d-8202-468f5327159c", "isPublic": true } ], "id": 31406, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731075", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731075", "catalogueId": 1062, "uuid": "32a01e6f-561e-5cca-9c0d-6c3058080f57", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization communicate with users about their roles and responsibilities to maintain a safe and secure working environment?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "User Awareness", "description": "

Control Description

Mechanisms exist to communicate with users about their roles and responsibilities to maintain a safe and secure working environment.

Evidence Request List (ERL)

E-HRS-01\nE-HRS-13\nE-HRS-16\nE-HRS-18

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to communicate with users about their roles and responsibilities to maintain a safe and secure working environment.

Level 4 - Quantitatively Controlled: Human Resources Security (HRS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

NERC-CIP (2026) Requirements: CIP-004-7-R2, CIP-004-7-R3", "controlId": "HRS-03.1", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Small Business (10-49 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Medium Business (50-249 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Large Business (250-999 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Enterprise (>1,000 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71391, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590498", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590498", "securityControlId": 31407, "ccis": [], "uuid": "e9cb4b57-bb31-501c-bc0c-abcfc95e8376", "testId": "HRS-03.2_A01", "test": "defined competency requirements ensure that all cybersecurity / data privacy-related positions are staffed by qualified individuals who have the necessary skill set.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71392, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590498", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590498", "securityControlId": 31407, "ccis": [], "uuid": "fa8c18eb-5436-5cd6-b3a6-ed9da6d41584", "testId": "HRS-03.2_A02", "test": "a risk designation is assigned to all organizational positions.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_PS-02a.", "defaultText": null }, { "id": 71393, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590498", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590498", "securityControlId": 31407, "ccis": [], "uuid": "5f4c09a4-fe2f-5173-83aa-e3f5eac70f96", "testId": "HRS-03.2_A03", "test": "the frequency at which to review / update position risk designations is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least every three years", "otherId": "53A_R5_PS-02_ODP", "defaultText": null }, { "id": 71394, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590498", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590498", "securityControlId": 31407, "ccis": [], "uuid": "a3e8280a-3d84-5558-a563-5b04ae9bb281", "testId": "HRS-03.2_A04", "test": "screening criteria are established for individuals filling organizational positions.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-02b.", "defaultText": null }, { "id": 71395, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590498", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590498", "securityControlId": 31407, "ccis": [], "uuid": "a9bc10d8-c103-5e29-aaff-473be6cdf808", "testId": "HRS-03.2_A05", "test": "position risk designations are reviewed / updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least every three years", "otherId": "53A_R5_PS-02c.", "defaultText": null } ], "externalMappings": [ { "id": 573127, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585225", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d43f95a-f6af-51fd-8051-74904f29fb58", "parentControlId": 31407, "controlId": "7.2", "title": "7.2", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585225" }, { "id": 573128, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585225", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7b02c3a-cae5-51ab-b21e-ad0ad390b104", "parentControlId": 31407, "controlId": "7.2(a)", "title": "7.2(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585225" }, { "id": 573129, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585225", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f196d6e1-b953-5e6d-803c-a6bbd23d2fb3", "parentControlId": 31407, "controlId": "7.2(b)", "title": "7.2(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585225" }, { "id": 573130, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585225", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd2bc698-b740-521e-a0a3-3054b02b983d", "parentControlId": 31407, "controlId": "7.2(c)", "title": "7.2(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585225" }, { "id": 573131, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585225", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9af7ea93-0ac2-5e6a-9019-266b910bed83", "parentControlId": 31407, "controlId": "7.2(d)", "title": "7.2(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585225" }, { "id": 573137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c5f7f45-7441-59a1-9c6f-ee3e739767bb", "parentControlId": 31407, "controlId": "PS-2", "title": "PS-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585226" }, { "id": 573138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7ae4b80-5adf-5c12-a73c-c03ad39954c6", "parentControlId": 31407, "controlId": "PS-02", "title": "PS-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585226" }, { "id": 573140, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23ab4eae-0602-5bf8-8e4b-c447a8558acb", "parentControlId": 31407, "controlId": "PS-02", "title": "PS-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585226" }, { "id": 573141, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0bb52d4a-7906-509f-a62d-5eb3dc1ee8cc", "parentControlId": 31407, "controlId": "PS-02", "title": "PS-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585226" }, { "id": 573142, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bdb4983-ca96-59f9-9b89-c5ba6df1dbf4", "parentControlId": 31407, "controlId": "PS-02", "title": "PS-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585226" }, { "id": 573143, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20fe6c88-4f90-5825-b807-03ddd68f4449", "parentControlId": 31407, "controlId": "PS-02", "title": "PS-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585226" }, { "id": 573144, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585227", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bcf3ddb3-bf6c-54d2-bfec-08a722eb37e9", "parentControlId": 31407, "controlId": "PS-02", "title": "PS-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585227" }, { "id": 573145, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585227", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b6b33e3-d1b7-5184-9660-c00087e5a301", "parentControlId": 31407, "controlId": "03.07.06.d", "title": "03.07.06.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585227" }, { "id": 573155, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585228", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a88a811-8f0c-581d-a4ba-460c3bf3e078", "parentControlId": 31407, "controlId": "ASSET-5e", "title": "ASSET-5e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585228" }, { "id": 573156, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585228", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acd5374f-e74c-5ccc-a200-e0cf7684ba0b", "parentControlId": 31407, "controlId": "THREAT-3e", "title": "THREAT-3e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585228" }, { "id": 573157, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585228", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb6f0ee0-c791-5af1-9590-c19ef8f29797", "parentControlId": 31407, "controlId": "RISK-5e", "title": "RISK-5e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585228" }, { "id": 573158, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585228", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45a97306-16e8-5dbb-ac47-240570e3829f", "parentControlId": 31407, "controlId": "ACCESS-4e", "title": "ACCESS-4e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585228" }, { "id": 573159, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585228", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4928376b-2276-54d7-8f3f-ccb4a4f52f63", "parentControlId": 31407, "controlId": "SITUATION-4e", "title": "SITUATION-4e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585228" }, { "id": 573160, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585228", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6a9609d-9541-548e-a885-302b91b170bd", "parentControlId": 31407, "controlId": "RESPONSE-5e", "title": "RESPONSE-5e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585228" }, { "id": 573161, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585228", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce16242f-8116-57de-9574-3e2373ec28f1", "parentControlId": 31407, "controlId": "THIRD-PARTIES-3e", "title": "THIRD-PARTIES-3e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585228" }, { "id": 573162, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585228", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec08de50-baad-5073-aa83-3cddb4d1ceed", "parentControlId": 31407, "controlId": "WORKFORCE-5e", "title": "WORKFORCE-5e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585228" }, { "id": 573163, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585229", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d0182f9-3a41-5099-9792-211287bd67a3", "parentControlId": 31407, "controlId": "ARCHITECTURE-6e", "title": "ARCHITECTURE-6e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585229" }, { "id": 573164, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585229", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d875fab-5d9c-5b7d-a843-9e3f7de2f822", "parentControlId": 31407, "controlId": "PROGRAM-3e", "title": "PROGRAM-3e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585229" }, { "id": 573190, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585232", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "caadd582-b0df-53af-8ccb-8e389ffafa75", "parentControlId": 31407, "controlId": "C1.e", "title": "C1.e", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585232" } ], "id": 31407, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731075", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731075", "catalogueId": 1062, "uuid": "1f950f31-77d1-5594-953f-28f2c820d7b7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure that all security-related positions are staffed by qualified individuals who have the necessary skill set?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Competency Requirements for Security-Related Positions", "description": "

Control Description

Mechanisms exist to ensure that all security-related positions are staffed by qualified individuals who have the necessary skill set.

Evidence Request List (ERL)

E-HRS-21\nE-HRS-23

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ Formal roles and responsibilities for cybersecurity and/or data protection are not consistent and/or standardized.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure that all security-related positions are staffed by qualified individuals who have the necessary skill set.

Level 4 - Quantitatively Controlled: Human Resources Security (HRS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-03.2", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-03.2", "references": "

Micro-Small Business (<10 staff)

∙ Demonstrated Subject Matter Expert (SME) experience\n∙ Professional references\n∙ Education / certification transcripts

Small Business (10-49 staff)

∙ Demonstrated Subject Matter Expert (SME) experience\n∙ Professional references\n∙ Education / certification transcripts

Medium Business (50-249 staff)

∙ Demonstrated Subject Matter Expert (SME) experience\n∙ Professional references\n∙ Education / certification transcripts

Large Business (250-999 staff)

∙ Demonstrated Subject Matter Expert (SME) experience\n∙ Professional references\n∙ Education / certification transcripts

Enterprise (>1,000 staff)

∙ Demonstrated Subject Matter Expert (SME) experience\n∙ Professional references\n∙ Education / certification transcripts", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71396, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590499", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590499", "securityControlId": 31408, "ccis": [], "uuid": "b6964a78-98d0-54e9-ac38-2fe893aa54a8", "testId": "HRS-04_A01", "test": "conditions that require the rescreening of individuals are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: as required by specific information / access", "otherId": "53A_R5_PS-03_ODP[01]", "defaultText": null }, { "id": 71397, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590499", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590499", "securityControlId": 31408, "ccis": [], "uuid": "748c66a0-9be1-5a47-ab93-1eec9745c797", "testId": "HRS-04_A02", "test": "the frequency of rescreening individuals where it is so indicated is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least every three years", "otherId": "53A_R5_PS-03_ODP[02]", "defaultText": null }, { "id": 71398, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590499", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590499", "securityControlId": 31408, "ccis": [], "uuid": "2d71672e-6407-5d45-9d6d-95cc6f60a844", "testId": "HRS-04_A03", "test": "individuals are screened prior to authorizing access to the system.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_PS-03a.\n171A_R3_A.03.09.01.a", "defaultText": null }, { "id": 71399, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590499", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590499", "securityControlId": 31408, "ccis": [], "uuid": "f430599e-cf9e-5dc5-883a-f90d1d3f55fa", "testId": "HRS-04_A04", "test": "individuals are rescreened in accordance with organization-defined conditions.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_PS-03b.[01]", "defaultText": null }, { "id": 71400, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590499", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590499", "securityControlId": 31408, "ccis": [], "uuid": "6e4f3d01-6dd1-5f53-a395-0e99a6e15af1", "testId": "HRS-04_A05", "test": "individuals are screened prior to authorizing access to organizational systems.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "171A_3.9.1", "defaultText": null }, { "id": 71401, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5905", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5905", "securityControlId": 31408, "ccis": [], "uuid": "24acfd86-f903-5f03-8fe9-d86834b85c94", "testId": "HRS-04_A06", "test": "where rescreening is so indicated, individuals are rescreened per organization-defined frequency.
PPTDF Applicability: People
Assessment Rigor: 3
SCF Defined Parameters: at least every three years", "otherId": "53A_R5_PS-03b.[02]", "defaultText": null }, { "id": 71402, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5905", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5905", "securityControlId": 31408, "ccis": [], "uuid": "f1bfe1f8-67ba-538a-9598-4b8fe78ac92f", "testId": "HRS-04_A07", "test": "conditions that require the rescreening of individuals are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.09.01.ODP[01]", "defaultText": null }, { "id": 71403, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5905", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5905", "securityControlId": 31408, "ccis": [], "uuid": "946f0fd3-019d-56fd-976e-6304fa5b7f73", "testId": "HRS-04_A08", "test": "individuals are rescreened in accordance with the following conditions: .
PPTDF Applicability: People
Assessment Rigor: NIST 800-171
SCF Defined Parameters: an organizational policy requiring rescreening when there is a significant incident, or change in status, related to an individual", "otherId": "171A_R3_A.03.09.01.b", "defaultText": null }, { "id": 71404, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5905", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5905", "securityControlId": 31408, "ccis": [], "uuid": "4f761599-0f06-505d-8552-d0bce768b636", "testId": "HRS-04_A09", "test": "upon individual reassignment or transfer to other positions in the organization, the ongoing operational need for current logical and physical access authorizations to the system and facility is reviewed.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "171A_R3_A.03.09.02.b.01[01]", "defaultText": null } ], "externalMappings": [ { "id": 573211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f9e134b-89d4-5117-83e0-447d00d638c6", "parentControlId": 31408, "controlId": "ORG 1.2", "title": "ORG 1.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585234" }, { "id": 573212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9b158f1-d00a-539f-9052-4c0b00328723", "parentControlId": 31408, "controlId": "7.2(b)", "title": "7.2(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585234" }, { "id": 573213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf46b172-19d7-5531-b1dc-4318c1ec9139", "parentControlId": 31408, "controlId": "7.2(c)", "title": "7.2(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585234" }, { "id": 573214, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87d7acfe-bc3a-5b84-88ed-dd4173e5855d", "parentControlId": 31408, "controlId": "6.1", "title": "6.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585235" }, { "id": 573219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6a0f683-174b-5634-a1ea-737d41092cd7", "parentControlId": 31408, "controlId": "PS-3", "title": "PS-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585235" }, { "id": 573220, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9eeb490b-61e1-56a1-b604-7dbcc44a5acc", "parentControlId": 31408, "controlId": "PS-03", "title": "PS-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585235" }, { "id": 573221, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7170715e-1ac3-5e45-a0a2-f2312623f01e", "parentControlId": 31408, "controlId": "PS-03", "title": "PS-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585235" }, { "id": 573223, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585236", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "271236c6-0c85-5b9f-a5c8-55bb1e076a44", "parentControlId": 31408, "controlId": "PS-03", "title": "PS-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585236" }, { "id": 573224, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585236", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "865b4e0d-5513-5e94-9c9b-1f484734a1a8", "parentControlId": 31408, "controlId": "PS-03", "title": "PS-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585236" }, { "id": 573225, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585236", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c273dbc-52ab-53db-a475-ec39dbbc0ba8", "parentControlId": 31408, "controlId": "PS-03", "title": "PS-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585236" }, { "id": 573226, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585236", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6cefcef-f2ce-58bc-baf1-697f33942497", "parentControlId": 31408, "controlId": "PS-03", "title": "PS-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585236" }, { "id": 573227, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585236", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b119b2a1-d783-552a-8668-cda84e4ae51f", "parentControlId": 31408, "controlId": "PS-3", "title": "PS-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585236" }, { "id": 573228, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585236", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1af0861e-6478-5e69-9c4b-39ad720a5186", "parentControlId": 31408, "controlId": "PS-3", "title": "PS-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585236" }, { "id": 573229, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585236", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1776278-6f30-560d-a92f-71bdfcea21e4", "parentControlId": 31408, "controlId": "PS-3", "title": "PS-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585236" }, { "id": 573232, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c42605b-ba13-53b0-95f1-730e004bc3ed", "parentControlId": 31408, "controlId": "3.9.1", "title": "3.9.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585237" }, { "id": 573233, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "818fdbec-25ad-5a86-b3d4-5c8142d7eee2", "parentControlId": 31408, "controlId": "03.09.01.a", "title": "03.09.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585237" }, { "id": 573234, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "250ab24d-cc81-5152-8ba6-621ff4ba9234", "parentControlId": 31408, "controlId": "03.09.01.b", "title": "03.09.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585237" }, { "id": 573249, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d49e0aa0-97bc-56fc-8dad-a3ef3f70d531", "parentControlId": 31408, "controlId": "WORKFORCE-1a", "title": "WORKFORCE-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585239" }, { "id": 573250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f7b2f73-92a8-5243-8946-3f1383631492", "parentControlId": 31408, "controlId": "WORKFORCE-1b", "title": "WORKFORCE-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585239" }, { "id": 573251, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efdb529e-9d3d-5ba1-9c1a-48542d14244f", "parentControlId": 31408, "controlId": "WORKFORCE-1c", "title": "WORKFORCE-1c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585239" }, { "id": 573252, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4e14808-6744-5cff-b7a8-7f924f7da95f", "parentControlId": 31408, "controlId": "WORKFORCE-1f", "title": "WORKFORCE-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585239" }, { "id": 573273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585241", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd846f37-c79c-5218-8a1c-ad884dfe051c", "parentControlId": 31408, "controlId": "CIP-004-7 3.1", "title": "CIP-004-7 3.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585241" }, { "id": 573274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585241", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d41c549-e0b2-5c62-b6a8-637d6af6b7a5", "parentControlId": 31408, "controlId": "CIP-004-7 3.2", "title": "CIP-004-7 3.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585241" }, { "id": 573275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585241", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88733de7-4aca-5962-91f0-2f1260a4355a", "parentControlId": 31408, "controlId": "CIP-004-7 3.2.1", "title": "CIP-004-7 3.2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585241" }, { "id": 573276, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585242", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d4c60fc-e8ca-5f66-9b46-23714c047ff3", "parentControlId": 31408, "controlId": "CIP-004-7 3.2.2", "title": "CIP-004-7 3.2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585242" }, { "id": 573277, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585242", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d3b0ae8-d450-5522-99c6-1f470502ef0f", "parentControlId": 31408, "controlId": "CIP-004-7 3.3", "title": "CIP-004-7 3.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585242" }, { "id": 573278, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585242", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60c9ec9d-9e0d-5466-9d57-29fb88cc7655", "parentControlId": 31408, "controlId": "CIP-004-7 3.4", "title": "CIP-004-7 3.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585242" }, { "id": 573279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585242", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c691ad05-6053-5c1b-80a2-fc479b27baaf", "parentControlId": 31408, "controlId": "CIP-004-7 3.5", "title": "CIP-004-7 3.5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585242" }, { "controlId": "NSS-42G-Sec4.4", "title": "NSS-42G-Sec4.4 — Trustworthiness, Fitness-for-Duty & Insider Threat Mitigation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "02f1042d-687c-5c98-a24e-1548b9154ace", "isPublic": true }, { "controlId": "IEC-63096-7.1", "title": "IEC-63096-7.1 — Human Resource Security & Background Vetting (Access Authorization)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "919929d5-c1fe-530d-a70e-906b6e1104f1", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP4", "title": "ONR-SyAP-FSyP4 — Personnel Security & Trustworthiness", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "905deba6-47d7-5ad1-8ddb-5189ed52b1b2", "isPublic": true } ], "id": 31408, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731075", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731075", "catalogueId": 1062, "uuid": "9c7179ab-6047-5cf7-8714-0e330d7e8415", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization manage personnel security risk by screening individuals prior to authorizing access?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Personnel Screening", "description": "

Control Description

Mechanisms exist to manage personnel security risk by screening individuals prior to authorizing access.

Evidence Request List (ERL)

E-HRS-17\nE-HRS-21

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to manage personnel security risk by screening individuals prior to authorizing access.

Level 4 - Quantitatively Controlled: Human Resources Security (HRS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-04", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-04", "references": "

Micro-Small Business (<10 staff)

∙ Criminal, education and employment background checks\n∙ Professional references\n∙ Education / certification transcripts

Small Business (10-49 staff)

∙ Criminal, education and employment background checks\n∙ Professional references\n∙ Education / certification transcripts

Medium Business (50-249 staff)

∙ Criminal, education and employment background checks\n∙ Professional references\n∙ Education / certification transcripts

Large Business (250-999 staff)

∙ Criminal, education and employment background checks\n∙ Professional references\n∙ Education / certification transcripts

Enterprise (>1,000 staff)

∙ Criminal, education and employment background checks\n∙ Professional references\n∙ Education / certification transcripts", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71405, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5905", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5905", "securityControlId": 31409, "ccis": [], "uuid": "fabb5b19-f0b7-5535-a396-72955812eb88", "testId": "HRS-04.1_A01", "test": "enhanced personnel screening for individuals is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.9.1e_ODP[1]", "defaultText": null }, { "id": 71406, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590501", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590501", "securityControlId": 31409, "ccis": [], "uuid": "fd27c357-d71c-51a9-955c-a3b17d1f8345", "testId": "HRS-04.1_A02", "test": "the frequency with which to reassess individual positions and access to sensitive / regulated data is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least every three years", "otherId": "172A_3.9.1e_ODP[2]", "defaultText": null }, { "id": 71407, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590501", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590501", "securityControlId": 31409, "ccis": [], "uuid": "8505651d-b0d5-5566-90db-dfd9e6ac0a3f", "testId": "HRS-04.1_A03", "test": "individuals that require enhanced personnel screening are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.9.1e[a]", "defaultText": null }, { "id": 71408, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590501", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590501", "securityControlId": 31409, "ccis": [], "uuid": "2de37f2e-5de1-556f-bb75-0dd601cddbfc", "testId": "HRS-04.1_A04", "test": "positions that require access to sensitive / regulated data are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.9.1e[b]", "defaultText": null }, { "id": 71409, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590501", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590501", "securityControlId": 31409, "ccis": [], "uuid": "f050a044-1e40-5424-a4f6-b25d841a9abd", "testId": "HRS-04.1_A05", "test": "enhanced personnel screening is conducted for individuals.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "172A_3.9.1e[c]", "defaultText": null }, { "id": 71410, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590501", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590501", "securityControlId": 31409, "ccis": [], "uuid": "9de5cf65-f9aa-59b2-a10e-1c2175ad0dc9", "testId": "HRS-04.1_A06", "test": "individual positions and access to sensitive / regulated data is reassessed per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least every three years", "otherId": "172A_3.9.1e[d]", "defaultText": null }, { "id": 71411, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590502", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590502", "securityControlId": 31409, "ccis": [], "uuid": "6977699e-6d0f-5103-8359-137e494c61dd", "testId": "HRS-04.1_A07", "test": "individuals with access to sensitive / regulated data are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.9.2e[a]", "defaultText": null }, { "id": 71412, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590503", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590503", "securityControlId": 31409, "ccis": [], "uuid": "2e7d201f-9b67-5211-b778-7820999077f5", "testId": "HRS-04.1_A08", "test": "adverse information about individuals with access to sensitive / regulated data is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.9.2e[b]", "defaultText": null }, { "id": 71413, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590503", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590503", "securityControlId": 31409, "ccis": [], "uuid": "61759b4f-48f4-5eb1-9335-600aa02e05eb", "testId": "HRS-04.1_A09", "test": "organizational systems to which individuals have access are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.9.2e[c]", "defaultText": null }, { "id": 71414, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590503", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590503", "securityControlId": 31409, "ccis": [], "uuid": "d58a8a3e-c899-5162-a4a1-3a8d7023ab01", "testId": "HRS-04.1_A10", "test": "mechanisms are in place to protect organizational systems if adverse information develops or is obtained about individuals with access to sensitive / regulated data.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.9.2e[d]", "defaultText": null }, { "id": 71415, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590503", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590503", "securityControlId": 31409, "ccis": [], "uuid": "9fbb3c47-5db6-5982-88c3-c9d43224cf57", "testId": "HRS-04.1_A11", "test": "individuals accessing a system, application or service processing, storing or transmitting sensitive / regulated data are cleared.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-03(01)[01]", "defaultText": null }, { "id": 71416, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590503", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590503", "securityControlId": 31409, "ccis": [], "uuid": "4c016559-2048-5d61-aba4-cc385370ec68", "testId": "HRS-04.1_A12", "test": "individuals accessing a system, application or service processing, storing or transmitting sensitive / regulated data are indoctrinated to the highest classification level of the information to which they have access on the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-03(01)[02]", "defaultText": null }, { "id": 71417, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590504", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590504", "securityControlId": 31409, "ccis": [], "uuid": "c45b0984-4daf-58d4-9220-3e90510717cc", "testId": "HRS-04.1_A13", "test": "additional personnel screening criteria to be satisfied for individuals accessing a system, application or service processing, storing or transmitting information requiring special protection are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-03(03)_ODP", "defaultText": null }, { "id": 71418, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590504", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590504", "securityControlId": 31409, "ccis": [], "uuid": "6f3bfbf2-9cd7-5fc5-92c1-05050cc30771", "testId": "HRS-04.1_A14", "test": "individuals accessing a system, application or service processing, storing or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned duties.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-03(03)(a)", "defaultText": null }, { "id": 71419, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590504", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590504", "securityControlId": 31409, "ccis": [], "uuid": "5d358d54-3611-52c9-8659-005c75dcc43e", "testId": "HRS-04.1_A15", "test": "individuals accessing a system, application or service processing, storing or transmitting information requiring special protection satisfy additional personnel screening criteria.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-03(03)(b)", "defaultText": null }, { "id": 71420, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590504", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590504", "securityControlId": 31409, "ccis": [], "uuid": "164308e1-46fa-57ac-8c92-167354558f65", "testId": "HRS-04.1_A16", "test": "conditions that require the rescreening of individuals are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.09.01.ODP[01]", "defaultText": null } ], "externalMappings": [ { "id": 573322, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7c71c62-cc62-521e-89e4-f37bc3e8050b", "parentControlId": 31409, "controlId": "5.2", "title": "5.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585247" }, { "id": 573323, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0afc1a58-95ac-5956-aed2-e6a3f4926170", "parentControlId": 31409, "controlId": "6.1", "title": "6.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585247" }, { "id": 573335, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585248", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b29b1aee-d1a1-5405-b6f2-c31bce6e6452", "parentControlId": 31409, "controlId": "PS-3(1)", "title": "PS-3(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585248" }, { "id": 573336, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585248", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eae0f10f-bf48-5142-a789-b7d064113bf0", "parentControlId": 31409, "controlId": "PS-3(3)", "title": "PS-3(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585248" }, { "id": 573337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f7c8453-22fb-517d-b46d-76e85949265e", "parentControlId": 31409, "controlId": "PS-03(01)", "title": "PS-03(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585249" }, { "id": 573338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ab0d4b2-3519-504f-8f96-0c91986b53d0", "parentControlId": 31409, "controlId": "PS-03(03)", "title": "PS-03(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585249" }, { "id": 573339, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74d8058b-042a-5157-b48c-8cedcd3d324b", "parentControlId": 31409, "controlId": "PS-03(01)", "title": "PS-03(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585249" }, { "id": 573340, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd8616a0-ba6b-5d2e-bbb4-429c31c10f13", "parentControlId": 31409, "controlId": "PS-03(03)", "title": "PS-03(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585249" }, { "id": 573341, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f65143c7-3781-5fbd-86ea-8cf76108fbd9", "parentControlId": 31409, "controlId": "3.9.1", "title": "3.9.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585257" }, { "id": 573342, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "684bb933-4107-5e0a-ac80-6e0d396df6c9", "parentControlId": 31409, "controlId": "03.01.22.a", "title": "03.01.22.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585257" }, { "id": 573343, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d692ec0-47da-53c5-9191-e4fb1eddb65a", "parentControlId": 31409, "controlId": "03.02.02.a.01", "title": "03.02.02.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585257" }, { "id": 573344, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23666c83-b60d-5c3b-b22c-2916f64163fe", "parentControlId": 31409, "controlId": "03.09.01.a", "title": "03.09.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585257" }, { "id": 573345, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e382700b-36f2-5e0c-bb13-2cf465c49676", "parentControlId": 31409, "controlId": "03.09.01.b", "title": "03.09.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585257" }, { "id": 573355, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c413a28-eaac-5b74-bf7a-29eddd7b2603", "parentControlId": 31409, "controlId": "ACCESS-3h", "title": "ACCESS-3h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585259" }, { "id": 573356, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70f758a0-bb6e-5ae9-a1a5-a5ce4611e7a5", "parentControlId": 31409, "controlId": "WORKFORCE-1f", "title": "WORKFORCE-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585259" } ], "id": 31409, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731075", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731076", "catalogueId": 1062, "uuid": "50f23d69-7820-5103-b93f-c8f081b42d09", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure that individuals accessing a system that stores, transmits or processes information requiring special protection satisfy organization-defined personnel screening criteria?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Roles With Special Protection Measures", "description": "

Control Description

Mechanisms exist to ensure that individuals accessing a system that stores, transmits or processes information requiring special protection satisfy organization-defined personnel screening criteria.

Evidence Request List (ERL)

E-HRS-17\nE-HRS-21

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure that individuals accessing a system that stores, transmits or processes information requiring special protection satisfy organization-defined personnel screening criteria.

Level 4 - Quantitatively Controlled: Human Resources Security (HRS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-04.1", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Criminal, education and employment background checks

Small Business (10-49 staff)

∙ Criminal, education and employment background checks

Medium Business (50-249 staff)

∙ Criminal, education and employment background checks

Large Business (250-999 staff)

∙ Criminal, education and employment background checks

Enterprise (>1,000 staff)

∙ Criminal, education and employment background checks", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71421, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590504", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590504", "securityControlId": 31410, "ccis": [], "uuid": "ee3fd8c3-b7ee-503b-a4da-42ce48e531e0", "testId": "HRS-04.2_A01", "test": "individuals accessing a system, application or service processing, storing or transmitting types of sensitive / regulated data that require formal indoctrination are formally indoctrinated for all of the relevant types of information to which they have access on the system.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PS-03(02)", "defaultText": null } ], "externalMappings": [ { "id": 573391, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585264", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03f66bfa-14a7-50be-b9f2-c7e0a98b2b7c", "parentControlId": 31410, "controlId": "7.3", "title": "7.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585264" }, { "id": 573392, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585264", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31b8c037-6fef-5bed-8336-b281b4971cab", "parentControlId": 31410, "controlId": "7.3(a)", "title": "7.3(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585264" }, { "id": 573393, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585264", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98df166b-c502-5c0a-a06e-72cc2e15b0d0", "parentControlId": 31410, "controlId": "7.3(b)", "title": "7.3(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585264" }, { "id": 573394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585264", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c2f416f-1a94-55c0-a4ab-c6e2107c9f99", "parentControlId": 31410, "controlId": "7.3(c)", "title": "7.3(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585264" }, { "id": 573395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585264", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f3dd2d2-04ea-5269-aee6-41b87aea6ce4", "parentControlId": 31410, "controlId": "5.4", "title": "5.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585264" }, { "id": 573400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a47c251-cc36-573f-9ade-5eb5b588c6b1", "parentControlId": 31410, "controlId": "PS-3(2)", "title": "PS-3(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585265" }, { "id": 573401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "782ef769-6a48-53be-b606-c880b9b7fe36", "parentControlId": 31410, "controlId": "PS-03(02)", "title": "PS-03(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585265" }, { "id": 573402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abe3b136-c824-5755-b1c7-a6b7e23d3a14", "parentControlId": 31410, "controlId": "PS-03(02)", "title": "PS-03(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585265" }, { "id": 573403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa053896-dec6-5c32-ac59-059fea5ac662", "parentControlId": 31410, "controlId": "3.2.1", "title": "3.2.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585265" }, { "id": 573404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01565b9d-9421-5d77-8095-55315e202ac0", "parentControlId": 31410, "controlId": "3.2.2", "title": "3.2.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585265" }, { "id": 573405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61936461-44cf-5f45-aaf9-d12ac1ac006f", "parentControlId": 31410, "controlId": "03.01.22.a", "title": "03.01.22.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585265" }, { "id": 573406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "094066d7-ffcc-51b4-9634-edb378cbdbf2", "parentControlId": 31410, "controlId": "03.02.02.a.01", "title": "03.02.02.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585265" }, { "id": 573407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8598d560-aac3-5e62-a3bf-473813ac0aaa", "parentControlId": 31410, "controlId": "03.06.04.a", "title": "03.06.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585265" }, { "id": 573408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c759d07-109a-5bc3-afb0-d02995a37938", "parentControlId": 31410, "controlId": "03.06.04.a.01", "title": "03.06.04.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585265" }, { "id": 573409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585266", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ada1d0c-0691-5786-98f8-4584554e66a0", "parentControlId": 31410, "controlId": "03.15.03.b", "title": "03.15.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585266" }, { "id": 573410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585266", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9b7ce26-0327-5dac-a2a6-9d21f618c41c", "parentControlId": 31410, "controlId": "WORKFORCE-1e", "title": "WORKFORCE-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585266" }, { "id": 573411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585266", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87cfb7cc-fe7c-58f4-af4d-35f31c54adc5", "parentControlId": 31410, "controlId": "WORKFORCE-2a", "title": "WORKFORCE-2a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585266" } ], "id": 31410, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731076", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731076", "catalogueId": 1062, "uuid": "90efb907-da4b-51b9-9119-88d7ac122876", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization formally educate authorized users on proper data handling practices for all the relevant types of data to which they have access?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Formal Indoctrination", "description": "

Control Description

Mechanisms exist to formally educate authorized users on proper data handling practices for all the relevant types of data to which they have access.

Evidence Request List (ERL)

E-HRS-18

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ The HR department governs personnel management operations and notifies IT and/or cybersecurity personnel of role changes for logical access provisioning and deprovisioning actions.\n▪ Personnel managers ensure personnel are responsible for educating new hires on the organization's cybersecurity and data protection policies.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to formally educate authorized users on proper data handling practices for all the relevant types of data to which they have access.

Level 4 - Quantitatively Controlled: Human Resources Security (HRS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-04.2", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-04.2", "references": "

Micro-Small Business (<10 staff)

∙ Formal onboarding training

Small Business (10-49 staff)

∙ Formal onboarding training

Medium Business (50-249 staff)

∙ Formal onboarding training

Large Business (250-999 staff)

∙ Formal onboarding training

Enterprise (>1,000 staff)

∙ Formal onboarding training", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71422, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590505", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590505", "securityControlId": 31411, "ccis": [], "uuid": "dc47ada0-f292-5871-937b-776ec532e9e2", "testId": "HRS-04.3_A01", "test": "information types that are processed, stored or transmitted by a system, application or service that requires individuals accessing the system to meet citizenship requirements are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PS-03(04)_ODP[01]", "defaultText": null }, { "id": 71423, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590505", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590505", "securityControlId": 31411, "ccis": [], "uuid": "41236185-67f6-54c2-85a7-47179053b141", "testId": "HRS-04.3_A02", "test": "citizenship requirements to be met by individuals to access a system, application or service processing, storing or transmitting information are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PS-03(04)_ODP[02]", "defaultText": null }, { "id": 71424, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590505", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590505", "securityControlId": 31411, "ccis": [], "uuid": "3c5c74a6-e723-5df4-b579-d535eb0d9b63", "testId": "HRS-04.3_A03", "test": "individuals accessing a system, application or service processing, storing or transmitting information types meet citizenship requirements.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PS-03(04)", "defaultText": null } ], "externalMappings": [ { "id": 573438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebe6de5d-801d-5eec-b00a-56cabc16f529", "parentControlId": 31411, "controlId": "PS-03(04)", "title": "PS-03(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585269" }, { "id": 573439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b29a21e4-9ffb-5079-83bc-7f35b621474e", "parentControlId": 31411, "controlId": "PS-03(04)", "title": "PS-03(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585269" } ], "id": 31411, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731076", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731076", "catalogueId": 1062, "uuid": "a1204830-e655-5c9a-b7b7-7f0d94124726", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization verify that individuals accessing a system processing, storing, or transmitting sensitive information meet applicable statutory, regulatory and/or contractual requirements for citizenship?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 5.0, "title": "Citizenship Requirements", "description": "

Control Description

Mechanisms exist to verify that individuals accessing a system processing, storing, or transmitting sensitive information meet applicable statutory, regulatory and/or contractual requirements for citizenship.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to verify that individuals accessing a system processing, storing, or transmitting sensitive information meet applicable statutory, regulatory and/or contractual requirements for citizenship.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-04.3", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-04.3", "references": "

Micro-Small Business (<10 staff)

∙ Employee security policy acknowledgment\n∙ Background check for sensitive roles

Small Business (10-49 staff)

∙ Security awareness policy\n∙ Background checks\n∙ Security onboarding checklist

Medium Business (50-249 staff)

∙ HR security program\n∙ Background checks for all staff\n∙ Security onboarding training

Large Business (250-999 staff)

∙ Enterprise HR security program\n∙ Background screening service\n∙ Automated offboarding workflows

Enterprise (>1,000 staff)

∙ Enterprise HR security framework\n∙ Background screening platform\n∙ Integrated HR/IAM offboarding\n∙ Continuous monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71427, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590506", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590506", "securityControlId": 31413, "ccis": [], "uuid": "a3ccd465-3685-5eff-9968-aade3a52cd33", "testId": "HRS-05_A01", "test": "through terms of employment, all employees and contractors are required to apply cybersecurity / data privacy principles in their daily work.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71428, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590506", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590506", "securityControlId": 31413, "ccis": [], "uuid": "ecfad53f-befa-5886-bd0d-268bed0249a0", "testId": "HRS-05_A02", "test": "rules are provided to individuals who require access to the system.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.15.03.b", "defaultText": null } ], "externalMappings": [ { "id": 573471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a51e5047-79f6-576b-8017-3d38cf59d208", "parentControlId": 31413, "controlId": "7.3", "title": "7.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585273" }, { "id": 573472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1547f181-6301-5358-bda9-8c8933b342d0", "parentControlId": 31413, "controlId": "7.3(a)", "title": "7.3(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585273" }, { "id": 573473, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25335c15-783f-56c7-9316-0f088078cef5", "parentControlId": 31413, "controlId": "7.3(b)", "title": "7.3(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585273" }, { "id": 573474, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15763d74-1346-52da-9e1a-4ee674a99914", "parentControlId": 31413, "controlId": "7.3(c)", "title": "7.3(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585273" }, { "id": 573475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d120285-b476-5c22-b4fa-b06dfde8c08b", "parentControlId": 31413, "controlId": "5.4", "title": "5.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585273" }, { "id": 573476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f459b5af-17e2-5593-85cd-80aae46778d9", "parentControlId": 31413, "controlId": "5.14", "title": "5.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585273" }, { "id": 573477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1b7be9d-64d0-51ce-b411-8aaadbd55a0f", "parentControlId": 31413, "controlId": "6.2", "title": "6.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585274" }, { "id": 573488, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5950e4d8-1aa2-523c-8f24-7fbb3966b24f", "parentControlId": 31413, "controlId": "PL-4", "title": "PL-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585275" }, { "id": 573489, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bd94865-e6ed-55a2-aac9-c6b42e872f0b", "parentControlId": 31413, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585275" }, { "id": 573491, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79f75805-b8b3-5f2a-b297-f50b61a04082", "parentControlId": 31413, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585275" }, { "id": 573493, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "823f1893-b962-568b-9495-09b04d6e2753", "parentControlId": 31413, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585275" }, { "id": 573494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb05a5ec-5ef2-5e56-8cf5-e8b0e9026a30", "parentControlId": 31413, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585275" }, { "id": 573495, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "206314ac-a139-55df-a7a8-820523d2a83a", "parentControlId": 31413, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585276" }, { "id": 573496, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba2fb5fe-d2b3-5cc4-84ae-3f80904c5d23", "parentControlId": 31413, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585276" }, { "id": 573497, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aac1f12d-9b32-5915-8854-268fd195ac73", "parentControlId": 31413, "controlId": "PL-4", "title": "PL-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585276" }, { "id": 573498, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ab444df-d65b-55ef-a982-b7fdbf6a0b9b", "parentControlId": 31413, "controlId": "PL-4", "title": "PL-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585276" }, { "id": 573501, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7016e1ea-2688-5932-85f5-fd5c7e3fade2", "parentControlId": 31413, "controlId": "3.1.22", "title": "3.1.22", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585276" }, { "id": 573502, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3edb7c6d-e6c9-5133-bfa6-64eab962e6f7", "parentControlId": 31413, "controlId": "NFO - PL-4", "title": "NFO - PL-4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585276" }, { "id": 573503, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b1251b4-2205-5ec8-8c01-dabd1e082a42", "parentControlId": 31413, "controlId": "03.01.01.h", "title": "03.01.01.h", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585276" }, { "id": 573504, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e915f45-b5da-5b6e-a589-a04f17ec58e5", "parentControlId": 31413, "controlId": "03.01.22.a", "title": "03.01.22.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585277" }, { "id": 573505, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d71a9784-b035-5722-a218-c3b5a029ed47", "parentControlId": 31413, "controlId": "03.15.03.a", "title": "03.15.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585277" }, { "id": 573507, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "109d357f-f420-5073-87c4-bd3af6dddad6", "parentControlId": 31413, "controlId": "ID.AM", "title": "ID.AM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585277" }, { "id": 573524, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf4d127b-df1d-5abc-bafe-7144c389f59f", "parentControlId": 31413, "controlId": "WORKFORCE-1e", "title": "WORKFORCE-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585279" }, { "controlId": "C.2.2", "title": "C.2.2 — Personnel Termination or Transfer", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PS-4, PS-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "07b00101-c17a-5e87-b936-e7023a6179ba", "isPublic": true }, { "controlId": "NEI 08-09 App E.2.2", "title": "NEI 08-09 App E.2.2 — Personnel Termination or Transfer", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.2.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "2c80e3ce-1eeb-52cc-b251-43c66fd8ab2e", "isPublic": true }, { "controlId": "10 CFR 73.56", "title": "10 CFR 73.56 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.2.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "c54f18b9-826a-5774-b9d9-c7aae9ce9ae8", "isPublic": true }, { "controlId": "CIP-004-7-R5", "title": "CIP-004-7-R5 — Access Revocation Process", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "269efe2c-3edd-505c-9c10-086126cd8448", "isPublic": true }, { "controlId": "CIP-004-7-5.1", "title": "CIP-004-7-5.1 — A process to initiate removal of an individual’s ability for unescorted physical access and Interactive Remote Access...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "67cbaf7c-1969-5f0c-9928-d1b01714f716", "isPublic": true }, { "controlId": "CIP-004-7-5.2", "title": "CIP-004-7-5.2 — For reassignments or transfers, revoke the individual’s authorized electronic access to individual accounts and autho...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1ab4a31d-b270-5e2e-bfbe-a13b560e3b45", "isPublic": true }, { "controlId": "CIP-004-7-5.3", "title": "CIP-004-7-5.3 — For termination actions, revoke the individual’s non-shared user accounts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9e1db7a4-80ec-5bea-93bf-dfa014f722b2", "isPublic": true }, { "controlId": "CIP-004-7-5.4", "title": "CIP-004-7-5.4 — For termination actions, change passwords for shared account(s) known to the user within 30 calendar days of the term...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "de6109ff-74ae-5a73-a9a6-c29c8050cac1", "isPublic": true }, { "controlId": "NSS-42G-Sec4.4", "title": "NSS-42G-Sec4.4 — Trustworthiness, Fitness-for-Duty & Insider Threat Mitigation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "597092f8-cff8-5f9a-9cee-f47968f17b65", "isPublic": true }, { "controlId": "IEC-63096-7.1", "title": "IEC-63096-7.1 — Human Resource Security & Background Vetting (Access Authorization)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "06f0ef3d-6110-5409-b7c4-b1a3fe9403db", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP4", "title": "ONR-SyAP-FSyP4 — Personnel Security & Trustworthiness", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "df808c0c-c346-5c2f-b909-320690709a31", "isPublic": true } ], "id": 31413, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731077", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731077", "catalogueId": 1062, "uuid": "b2443a49-63bc-5d8a-81f9-09bebf61bfdd", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require all employees and contractors to apply cybersecurity and data protection principles in their daily work to enable secure, compliant and resilient capabilities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Terms of Employment", "description": "

Control Description

Mechanisms exist to require all employees and contractors to apply cybersecurity and data protection principles in their daily work to enable secure, compliant and resilient capabilities.

Evidence Request List (ERL)

E-HRS-16\nE-HRS-22

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ HR defines terms of employment, including acceptable and unacceptable rules of behavior for the use of technologies, including consequences for unacceptable behavior.\n▪ HR maintains formal Terms of Employment (ToE) and/or Rules of Behavior (RoB) that stipulates acceptable and unacceptable employee activities.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require all employees and contractors to apply cybersecurity and data protection principles in their daily work to enable secure, compliant and resilient capabilities.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.2.2
NERC-CIP (2026) Requirements: CIP-004-7-R5", "controlId": "HRS-05", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-05", "references": "

Micro-Small Business (<10 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Small Business (10-49 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Medium Business (50-249 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Large Business (250-999 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Enterprise (>1,000 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71429, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590506", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590506", "securityControlId": 31414, "ccis": [], "uuid": "b5da7217-2b6a-52d7-ae5a-d0882f3f18a4", "testId": "HRS-05.1_A01", "test": "rules that describe responsibilities and expected behavior for system usage and protecting sensitive / regulated data are established.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-04a.[01]\n53A_R5_PL-04a.[02]", "defaultText": null }, { "id": 71430, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590507", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590507", "securityControlId": 31414, "ccis": [], "uuid": "56bd2d70-c463-54da-b88b-a96f621fc2ce", "testId": "HRS-05.1_A02", "test": "before authorizing access to information and the system, a documented acknowledgement from such individuals indicating that they have read, understand and agree to abide by the rules of behavior is received.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_PL-04b.", "defaultText": null }, { "id": 71431, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590507", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590507", "securityControlId": 31414, "ccis": [], "uuid": "a983bff7-b765-51b4-8e97-a950d395fa30", "testId": "HRS-05.1_A03", "test": "the frequency at which the rules of behavior are reviewed and updated is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least every 3 years", "otherId": "53A_R5_PL-04_ODP[01]\n53A_R5_PL-04_ODP[02]\n171A_R3_A.03.15.03.ODP[01]", "defaultText": null }, { "id": 71432, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590507", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590507", "securityControlId": 31414, "ccis": [], "uuid": "5ee04345-a236-5a42-93da-f78f32172ee8", "testId": "HRS-05.1_A04", "test": "the rules of behavior are reviewed / updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least every 3 years", "otherId": "53A_R5_PL-04c.", "defaultText": null }, { "id": 71433, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590507", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590507", "securityControlId": 31414, "ccis": [], "uuid": "b39b1292-86af-50e0-8b98-863d64a61c0e", "testId": "HRS-05.1_A05", "test": "the frequency for individuals to read and re-acknowledge the rules of behavior is defined.
PPTDF Applicability: People
Assessment Rigor: 1
SCF Defined Parameters: at least every 12 months, or when there are significant incidents or significant changes to risks", "otherId": "53A_R5_PL-04_ODP[03]", "defaultText": null }, { "id": 71434, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590507", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590507", "securityControlId": 31414, "ccis": [], "uuid": "b51f55ca-48ef-59d3-a646-98fdd8c221ce", "testId": "HRS-05.1_A06", "test": "individuals who have acknowledged a previous version of the rules of behavior are required to read and reacknowledge the organization's current rules of behavior.
PPTDF Applicability: People
Assessment Rigor: 1
SCF Defined Parameters: at least annually and when the rules are revised or changed", "otherId": "53A_R5_PL-04d.", "defaultText": null }, { "id": 71435, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590508", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590508", "securityControlId": 31414, "ccis": [], "uuid": "3c88c23c-cd38-52e6-9082-ebeb94a69cd1", "testId": "HRS-05.1_A07", "test": "rules that describe responsibilities and expected behavior for system usage and protecting CUI are established.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.15.03.a", "defaultText": null }, { "id": 71436, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590508", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590508", "securityControlId": 31414, "ccis": [], "uuid": "530b9fe8-3fd7-54de-ae38-d2134838a73e", "testId": "HRS-05.1_A08", "test": "the rules of behavior are reviewed .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months, or when there are significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.15.03.d[01]", "defaultText": null }, { "id": 71437, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590508", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590508", "securityControlId": 31414, "ccis": [], "uuid": "5b85787a-3851-5971-9077-96aad93a9190", "testId": "HRS-05.1_A09", "test": "the rules of behavior are updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months, or when there are significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.15.03.d[02]", "defaultText": null } ], "externalMappings": [ { "id": 573609, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d1c694d-5727-5130-9888-f28c06ecf346", "parentControlId": 31414, "controlId": "7.3", "title": "7.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585288" }, { "id": 573610, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b079785-a36b-5b92-abe5-1f90bf323653", "parentControlId": 31414, "controlId": "7.3(a)", "title": "7.3(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585288" }, { "id": 573611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a794e33a-118f-511a-9da6-62eb9b88deb6", "parentControlId": 31414, "controlId": "7.3(b)", "title": "7.3(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585288" }, { "id": 573612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97a97fa8-ecc8-5f94-8e80-252adc36347b", "parentControlId": 31414, "controlId": "7.3(c)", "title": "7.3(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585289" }, { "id": 573613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5609602d-ed28-5e27-8951-0b36b564892c", "parentControlId": 31414, "controlId": "5.4", "title": "5.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585289" }, { "id": 573614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4cdd1254-915e-5f4e-9c56-c8ed8fe2e855", "parentControlId": 31414, "controlId": "5.1", "title": "5.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585289" }, { "id": 573615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53444392-0f44-56ff-b589-1302a871472b", "parentControlId": 31414, "controlId": "5.14", "title": "5.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585289" }, { "id": 573616, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "624541b3-20ec-5ef3-aa10-45065e4873c9", "parentControlId": 31414, "controlId": "6.2", "title": "6.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585289" }, { "id": 573631, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0bc656ab-ff7b-58de-a680-daf456681709", "parentControlId": 31414, "controlId": "PL-4", "title": "PL-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585291" }, { "id": 573632, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5787177-eb2f-56b2-a83d-0629d96623fe", "parentControlId": 31414, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585291" }, { "id": 573634, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42985ec7-c293-5b8d-bdd9-d344d7ab2105", "parentControlId": 31414, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585291" }, { "id": 573636, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ecf8680a-106d-55d7-ac6d-370763712141", "parentControlId": 31414, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585291" }, { "id": 573637, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e24379f-37f6-559c-91f5-f1a46069fc24", "parentControlId": 31414, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585291" }, { "id": 573638, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c611766-3bef-5ebe-ace6-86efca2f27ef", "parentControlId": 31414, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585291" }, { "id": 573639, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8bfee01-ebd7-56bd-9b2d-5a832f9d0723", "parentControlId": 31414, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585292" }, { "id": 573640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41d0a16e-572e-5f4a-8bd7-67d294a10417", "parentControlId": 31414, "controlId": "PL-4", "title": "PL-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585292" }, { "id": 573641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7b92a07-97b1-5d40-9b2b-175efc1b2196", "parentControlId": 31414, "controlId": "PL-4", "title": "PL-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585292" }, { "id": 573644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47001b9a-291e-5c74-bebe-7df5e99fad49", "parentControlId": 31414, "controlId": "3.1.22", "title": "3.1.22", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585292" }, { "id": 573645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90fc4af1-0a02-565a-84d9-e11208370404", "parentControlId": 31414, "controlId": "NFO - PL-4", "title": "NFO - PL-4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585292" }, { "id": 573646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c0df131-bb70-5ac8-bcc8-5dae7f9213bc", "parentControlId": 31414, "controlId": "03.01.12.a", "title": "03.01.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585292" }, { "id": 573647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0496aa57-6188-518b-810f-15d8701bcb13", "parentControlId": 31414, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585293" }, { "id": 573648, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbd11dad-1b22-5213-a6bb-a9442e4bb8ee", "parentControlId": 31414, "controlId": "03.01.22.a", "title": "03.01.22.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585293" }, { "id": 573649, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a7fc8c6-5cf2-5924-982f-c7a44267a64a", "parentControlId": 31414, "controlId": "03.15.03.a", "title": "03.15.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585293" }, { "id": 573650, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9feda7c-57b4-5c83-addd-f51e57cc15f2", "parentControlId": 31414, "controlId": "03.15.03.d", "title": "03.15.03.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585293" }, { "id": 573655, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18796e2d-eae9-5c79-855a-9edb4667b2ea", "parentControlId": 31414, "controlId": "ID.AM", "title": "ID.AM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585293" }, { "id": 573673, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74193ccc-d800-5dac-b79e-4192e24d69da", "parentControlId": 31414, "controlId": "WORKFORCE-1e", "title": "WORKFORCE-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585304" } ], "id": 31414, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731077", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731077", "catalogueId": 1062, "uuid": "f36d6696-1388-5418-b7fd-352959084712", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define acceptable and unacceptable rules of behavior for the use of technologies, including consequences for unacceptable behavior?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Rules of Behavior", "description": "

Control Description

Mechanisms exist to define acceptable and unacceptable rules of behavior for the use of technologies, including consequences for unacceptable behavior.

Evidence Request List (ERL)

E-HRS-22

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ HR maintains formal Terms of Employment (ToE) and/or Rules of Behavior (RoB) that stipulates acceptable and unacceptable employee activities.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ HR defines terms of employment, including acceptable and unacceptable rules of behavior for the use of technologies, including consequences for unacceptable behavior.\n▪ HR maintains formal Terms of Employment (ToE) and/or Rules of Behavior (RoB) that stipulates acceptable and unacceptable employee activities.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to define acceptable and unacceptable rules of behavior for the use of technologies, including consequences for unacceptable behavior.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-05.1", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-05.1", "references": "

Micro-Small Business (<10 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Small Business (10-49 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Medium Business (50-249 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Large Business (250-999 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Enterprise (>1,000 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71438, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590508", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590508", "securityControlId": 31415, "ccis": [], "uuid": "c027d5e0-8941-5f0d-b5dd-ec19b6abe90b", "testId": "HRS-05.2_A01", "test": "the rules of behavior include restrictions on the use of social media, social networking sites and external sites/applications.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-04(01)(a)", "defaultText": null }, { "id": 71439, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590509", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590509", "securityControlId": 31415, "ccis": [], "uuid": "3245500f-b40e-5dbb-98e9-55a78b699e52", "testId": "HRS-05.2_A02", "test": "the rules of behavior include restrictions on posting organizational information on public websites.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-04(01)(b)", "defaultText": null }, { "id": 71440, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590509", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590509", "securityControlId": 31415, "ccis": [], "uuid": "e865587a-7227-5d55-87c7-3f66b70222c0", "testId": "HRS-05.2_A03", "test": "the rules of behavior include restrictions on the use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-04(01)(c)", "defaultText": null }, { "id": 71441, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590509", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590509", "securityControlId": 31415, "ccis": [], "uuid": "f9595a0c-0ede-54db-b0a1-48d684af2f17", "testId": "HRS-05.2_A04", "test": "rules that describe responsibilities and expected behavior for system usage and protecting sensitive / regulated data are established.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 71442, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590509", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590509", "securityControlId": 31415, "ccis": [], "uuid": "a45a3436-8b75-5f73-ab03-51acbfb09c0a", "testId": "HRS-05.2_A05", "test": "rules that describe responsibilities and expected behavior for system usage and protecting CUI are established.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.15.03.a", "defaultText": null } ], "externalMappings": [ { "id": 573753, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5fc40564-9c52-5d92-a860-189804b68435", "parentControlId": 31415, "controlId": "7.3", "title": "7.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585313" }, { "id": 573754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41b4e3eb-2e1b-56b2-830f-a786fb84016c", "parentControlId": 31415, "controlId": "7.3(a)", "title": "7.3(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585313" }, { "id": 573755, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62335ef7-17f8-5ade-9904-40ad392be6a2", "parentControlId": 31415, "controlId": "7.3(b)", "title": "7.3(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585313" }, { "id": 573756, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b9ed0ef-c9b1-5f8a-b9dc-6c94275344fb", "parentControlId": 31415, "controlId": "7.3(c)", "title": "7.3(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585313" }, { "id": 573757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b49184ea-1a76-547a-ac0c-7a1d9746097a", "parentControlId": 31415, "controlId": "5.4", "title": "5.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585313" }, { "id": 573758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e76829b-8ea4-5d27-b4b9-9d872e48beeb", "parentControlId": 31415, "controlId": "5.1", "title": "5.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585314" }, { "id": 573759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "065af796-4b85-578c-8688-075a1fa0197f", "parentControlId": 31415, "controlId": "6.2", "title": "6.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585314" }, { "id": 573766, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a71411d6-f9af-570b-9946-781dd3e030c8", "parentControlId": 31415, "controlId": "PL-4(1)", "title": "PL-4(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585315" }, { "id": 573767, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff5f7dc9-fdec-59ba-89ff-86406c2cdaa3", "parentControlId": 31415, "controlId": "PL-04(01)", "title": "PL-04(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585315" }, { "id": 573769, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4dcd57e-5e91-5c12-a9a8-cf5ba479eae0", "parentControlId": 31415, "controlId": "PL-04(01)", "title": "PL-04(01)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585315" }, { "id": 573770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3dfd3f85-5471-51e9-b1c9-b07395a87db0", "parentControlId": 31415, "controlId": "PL-04(01)", "title": "PL-04(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585315" }, { "id": 573771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bcab733-ee5a-54b0-8c0f-db1936cf880d", "parentControlId": 31415, "controlId": "PL-04(01)", "title": "PL-04(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585315" }, { "id": 573772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "737b9459-d918-565a-a3ba-e5d2120f3d4e", "parentControlId": 31415, "controlId": "PL-04(01)", "title": "PL-04(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585315" }, { "id": 573773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9131a19-6a4d-5cb0-ac60-9b68689ee020", "parentControlId": 31415, "controlId": "PL-04(01)", "title": "PL-04(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585315" }, { "id": 573774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "327431c9-4173-5118-bd3d-7b4f2753bb6f", "parentControlId": 31415, "controlId": "3.1.22", "title": "3.1.22", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585315" }, { "id": 573775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73e61276-c56a-5420-8162-92943649b705", "parentControlId": 31415, "controlId": "NFO - PL-4(1)", "title": "NFO - PL-4(1)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585316" }, { "id": 573776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2042c89c-9a56-5bb8-b780-049579c3cc66", "parentControlId": 31415, "controlId": "03.15.03.a", "title": "03.15.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585316" }, { "id": 573780, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f333557-c490-5e08-93ba-5fd8ff659b94", "parentControlId": 31415, "controlId": "WORKFORCE-1e", "title": "WORKFORCE-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585316" } ], "id": 31415, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731077", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731077", "catalogueId": 1062, "uuid": "9fd0a3ac-ecdd-538e-8681-8abbf36a9641", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define rules of behavior that contain explicit restrictions on the use of social media and networking sites, posting information on commercial websites and sharing account information?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Social Media & Social Networking Restrictions", "description": "

Control Description

Mechanisms exist to define rules of behavior that contain explicit restrictions on the use of social media and networking sites, posting information on commercial websites and sharing account information.

Evidence Request List (ERL)

E-DCH-11\nE-HRS-22

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ HR maintains formal Terms of Employment (ToE) and/or Rules of Behavior (RoB) that stipulates acceptable and unacceptable employee activities.\n▪ ToE and/or RoB address the use of entity-issued and personally-owned devices.\n▪ ToE and/or RoB address the requirement to comply with applicable software usage requirements and copyright laws.\n▪ ToE and/or RoB address posting content to websites, social media or other publicly-accessible sources.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ HR defines terms of employment, including acceptable and unacceptable rules of behavior for the use of technologies, including consequences for unacceptable behavior.\n▪ HR maintains formal Terms of Employment (ToE) and/or Rules of Behavior (RoB) that stipulates acceptable and unacceptable employee activities.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to define rules of behavior that contain explicit restrictions on the use of social media and networking sites, posting information on commercial websites and sharing account information.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-05.2", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-05.2", "references": "

Micro-Small Business (<10 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Small Business (10-49 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Medium Business (50-249 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Large Business (250-999 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Enterprise (>1,000 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71443, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59051", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59051", "securityControlId": 31416, "ccis": [], "uuid": "9f3dca00-5b47-5ba4-b7c5-394ef7cbe1d6", "testId": "HRS-05.3_A01", "test": "rules that describe responsibilities and expected behavior for system usage and protecting sensitive / regulated data are established.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-04a.[01]\n53A_R5_PL-04a.[02]", "defaultText": null }, { "id": 71444, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59051", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59051", "securityControlId": 31416, "ccis": [], "uuid": "601d7183-ee49-55ab-8d6a-5aae48db6c52", "testId": "HRS-05.3_A02", "test": "before authorizing access to information and the system, a documented acknowledgement from such individuals indicating that they have read, understand and agree to abide by the rules of behavior is received.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_PL-04b.", "defaultText": null }, { "id": 71445, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59051", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59051", "securityControlId": 31416, "ccis": [], "uuid": "4b8d7a5d-d61f-538e-9d8f-51fb2d9c158e", "testId": "HRS-05.3_A03", "test": "rules that describe responsibilities and expected behavior for system usage and protecting CUI are established.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.15.03.a", "defaultText": null } ], "externalMappings": [ { "id": 573839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585323", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3346bffa-12db-5dd0-a96d-d8dd680182ed", "parentControlId": 31416, "controlId": "7.3", "title": "7.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585323" }, { "id": 573840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585323", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "120f51a5-bc8f-56ca-a9b2-40482352bf34", "parentControlId": 31416, "controlId": "7.3(a)", "title": "7.3(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585323" }, { "id": 573841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585324", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a58ce975-8520-5a4f-a1ac-bcb69d769a69", "parentControlId": 31416, "controlId": "7.3(b)", "title": "7.3(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585324" }, { "id": 573842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585324", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a31a320-b1f7-5004-acca-368eb2952fb5", "parentControlId": 31416, "controlId": "7.3(c)", "title": "7.3(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585324" }, { "id": 573843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585324", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7114169-0831-569e-9623-39eac5e92c76", "parentControlId": 31416, "controlId": "5.4", "title": "5.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585324" }, { "id": 573844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585324", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb304ff8-bf7f-52fb-8330-60eb1b472b06", "parentControlId": 31416, "controlId": "5.1", "title": "5.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585324" }, { "id": 573845, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585324", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5e0c1ee-f603-5ab6-92f5-5e9cdbedf67b", "parentControlId": 31416, "controlId": "6.2", "title": "6.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585324" }, { "id": 573853, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585325", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5809a35f-43e0-51a8-b815-fe8300fbdc75", "parentControlId": 31416, "controlId": "SC-19", "title": "SC-19", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585325" }, { "id": 573854, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585325", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d7e5adf-53fc-56bb-8c59-8e0e2eae95be", "parentControlId": 31416, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585325" }, { "id": 573856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585325", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dce874a0-6d03-553f-826b-fb829419e951", "parentControlId": 31416, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585325" }, { "id": 573858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585325", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "910bf132-b91f-5dee-b35e-dae231c08415", "parentControlId": 31416, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585326" }, { "id": 573859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8748e06-395f-5efa-be3b-1e95b7375db5", "parentControlId": 31416, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585326" }, { "id": 573860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9280c69-0882-548a-8690-3834cc685c7a", "parentControlId": 31416, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585326" }, { "id": 573861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ade1cdf7-cf08-5e85-8ae5-88bd1bea287e", "parentControlId": 31416, "controlId": "PL-04", "title": "PL-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585326" }, { "id": 573862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "216759bb-a22c-5760-8c04-612a03f1939e", "parentControlId": 31416, "controlId": "PL-4", "title": "PL-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585326" }, { "id": 573863, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fc8dce9-e07a-5051-8bf0-6a1a115c4094", "parentControlId": 31416, "controlId": "PL-4", "title": "PL-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585326" }, { "id": 573866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fd8fdfe-7d5b-5a44-8771-b517ca7ce034", "parentControlId": 31416, "controlId": "03.01.01.h", "title": "03.01.01.h", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585326" }, { "id": 573867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1729d826-9190-51ad-b3bd-6192db2db27c", "parentControlId": 31416, "controlId": "03.01.12.a", "title": "03.01.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585327" }, { "id": 573868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "200db1ca-dba5-5187-90e4-3a9aa6fe86e3", "parentControlId": 31416, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585327" }, { "id": 573869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585327", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "deb1543f-f878-566b-aefa-72f6f17cdd44", "parentControlId": 31416, "controlId": "03.15.03.a", "title": "03.15.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585327" }, { "id": 573877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585328", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "371466d4-602c-53b8-b699-5a19a273a249", "parentControlId": 31416, "controlId": "WORKFORCE-1e", "title": "WORKFORCE-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585328" } ], "id": 31416, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731078", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731078", "catalogueId": 1062, "uuid": "ca8fb76d-6086-5c1e-bea0-040e6be008e0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish usage restrictions and implementation guidance for communications technologies based on the potential to cause damage to Technology Assets, Applications and/or Services (TAAS), if used maliciously?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Technology Use Restrictions", "description": "

Control Description

Mechanisms exist to establish usage restrictions and implementation guidance for organizational technologies based on the potential to cause damage to Technology Assets, Applications and/or Services (TAAS), if used maliciously.

Evidence Request List (ERL)

E-HRS-22

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ HR maintains formal Terms of Employment (ToE) and/or Rules of Behavior (RoB) that stipulates acceptable and unacceptable employee activities.\n▪ ToE and/or RoB address the use of entity-issued and personally-owned devices.\n▪ ToE and/or RoB address the requirement to comply with applicable software usage requirements and copyright laws.\n▪ ToE and/or RoB address posting content to websites, social media or other publicly-accessible sources.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ HR defines terms of employment, including acceptable and unacceptable rules of behavior for the use of technologies, including consequences for unacceptable behavior.\n▪ HR maintains formal Terms of Employment (ToE) and/or Rules of Behavior (RoB) that stipulates acceptable and unacceptable employee activities.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to establish usage restrictions and implementation guidance for organizational technologies based on the potential to cause damage to Technology Assets, Applications and/or Services (TAAS), if used maliciously.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-05.3", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-05.3", "references": "

Micro-Small Business (<10 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Small Business (10-49 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Medium Business (50-249 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Large Business (250-999 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Enterprise (>1,000 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71446, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590511", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590511", "securityControlId": 31417, "ccis": [], "uuid": "df2d2e5f-8a85-5a8a-a4d2-238b26ec9982", "testId": "HRS-05.4_A01", "test": "rules that describe responsibilities and expected behavior for information and system usage, cybersecurity / data privacy are established for individuals requiring access to the system.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-04a.[01]\n53A_R5_PL-04a.[02]", "defaultText": null }, { "id": 71447, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590511", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590511", "securityControlId": 31417, "ccis": [], "uuid": "37f736e9-74fe-587f-9ad2-bae489f8c5f8", "testId": "HRS-05.4_A02", "test": "before authorizing access to information and the system, a documented acknowledgement from such individuals indicating that they have read, understand and agree to abide by the rules of behavior is received.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_PL-04b.", "defaultText": null } ], "externalMappings": [ { "id": 573950, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585344", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7881fb2-bf05-5484-b900-9f3c9ee1d04c", "parentControlId": 31417, "controlId": "7.3", "title": "7.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585344" }, { "id": 573951, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585344", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "103ff0c1-c556-5cd5-827f-d2d8ca45fe74", "parentControlId": 31417, "controlId": "7.3(a)", "title": "7.3(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585344" }, { "id": 573952, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01654852-cece-5651-a5c9-e7b6da6feefe", "parentControlId": 31417, "controlId": "7.3(b)", "title": "7.3(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585345" }, { "id": 573953, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa5a4b1c-c7e0-5729-a336-d2e019cce405", "parentControlId": 31417, "controlId": "7.3(c)", "title": "7.3(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585345" }, { "id": 573960, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "038f919d-bb4d-5f57-9121-23f8aabf98bb", "parentControlId": 31417, "controlId": "03.15.03.a", "title": "03.15.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585345" }, { "id": 573961, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46d7eda6-dec9-5816-90b7-4f2e68e28bbb", "parentControlId": 31417, "controlId": "WORKFORCE-1e", "title": "WORKFORCE-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585346" } ], "id": 31417, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731078", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731078", "catalogueId": 1062, "uuid": "613422ea-5f97-5094-b367-bc023a16b66b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization govern usage policies for critical technologies?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Use of Critical Technologies", "description": "

Control Description

Mechanisms exist to govern usage policies for critical technologies.

Evidence Request List (ERL)

E-HRS-22

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ HR maintains formal Terms of Employment (ToE) and/or Rules of Behavior (RoB) that stipulates acceptable and unacceptable employee activities.\n▪ ToE and/or RoB address the use of entity-issued and personally-owned devices.\n▪ ToE and/or RoB address the requirement to comply with applicable software usage requirements and copyright laws.\n▪ ToE and/or RoB address posting content to websites, social media or other publicly-accessible sources.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ HR defines terms of employment, including acceptable and unacceptable rules of behavior for the use of technologies, including consequences for unacceptable behavior.\n▪ HR maintains formal Terms of Employment (ToE) and/or Rules of Behavior (RoB) that stipulates acceptable and unacceptable employee activities.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to govern usage policies for critical technologies.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-05.4", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-05.4", "references": "

Micro-Small Business (<10 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Small Business (10-49 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Medium Business (50-249 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Large Business (250-999 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Enterprise (>1,000 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71448, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590511", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590511", "securityControlId": 31418, "ccis": [], "uuid": "d3375e99-d7af-5d44-b451-f192e8e86a0f", "testId": "HRS-05.5_A01", "test": "rules that describe responsibilities and expected behavior for system usage and protecting sensitive / regulated data are established.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-04a.[01]\n53A_R5_PL-04a.[02]", "defaultText": null }, { "id": 71449, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590511", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590511", "securityControlId": 31418, "ccis": [], "uuid": "deaeff8f-d8dc-5ec8-bf73-ce399d09a6bf", "testId": "HRS-05.5_A02", "test": "before authorizing access to information and the system, a documented acknowledgement from such individuals indicating that they have read, understand and agree to abide by the rules of behavior is received.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_PL-04b.", "defaultText": null }, { "id": 71450, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590511", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590511", "securityControlId": 31418, "ccis": [], "uuid": "091f57ca-da76-5810-b180-e0fd37f7e8f8", "testId": "HRS-05.5_A03", "test": "rules that describe responsibilities and expected behavior for system usage and protecting CUI are established.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.15.03.a", "defaultText": null } ], "externalMappings": [ { "id": 573967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f43d646-c3cd-5165-821c-09d814721f55", "parentControlId": 31418, "controlId": "7.3", "title": "7.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585346" }, { "id": 573968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4f1c00a-3b7f-5366-b13b-542933e98adf", "parentControlId": 31418, "controlId": "7.3(a)", "title": "7.3(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585347" }, { "id": 573969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6937a462-9f6a-505d-9537-9bd2729f8d1f", "parentControlId": 31418, "controlId": "7.3(b)", "title": "7.3(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585347" }, { "id": 573970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3a27833-105e-5caa-8e46-d95b372d30a3", "parentControlId": 31418, "controlId": "7.3(c)", "title": "7.3(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585347" }, { "id": 573971, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd90025a-4bb3-5348-b222-a759886c76d4", "parentControlId": 31418, "controlId": "6.2", "title": "6.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585347" }, { "id": 573976, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55d9f04b-8378-5e75-a28f-715a0a055f7a", "parentControlId": 31418, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585347" }, { "id": 573977, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c051669-587b-580d-aa60-dee7ce76e12c", "parentControlId": 31418, "controlId": "03.15.03.a", "title": "03.15.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585348" }, { "id": 573980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4250e8b7-41b7-5e4e-b9cc-f2c53dd924bd", "parentControlId": 31418, "controlId": "WORKFORCE-1e", "title": "WORKFORCE-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585348" } ], "id": 31418, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731078", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731078", "catalogueId": 1062, "uuid": "959b49b2-13f6-5bf9-8309-a986c714ef5a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization manage business risks associated with permitting mobile device access to organizational resources?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Use of Mobile Devices", "description": "

Control Description

Mechanisms exist to manage business risks associated with permitting mobile device access to organizational resources.

Evidence Request List (ERL)

E-HRS-22

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to manage business risks associated with permitting mobile device access to organizational resources.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-05.5", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-05.5", "references": "

Micro-Small Business (<10 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Small Business (10-49 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Medium Business (50-249 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Large Business (250-999 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)

Enterprise (>1,000 staff)

∙ Formal onboarding training\n∙ Acceptable Use / Rules of Behavior (RoB)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71452, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590512", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590512", "securityControlId": 31420, "ccis": [], "uuid": "c8aea5c0-89d2-5c16-9066-a027d2ac5a70", "testId": "HRS-05.7_A01", "test": "personnel receive recurring familiarization with the organization's cybersecurity / data privacy policies.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71453, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590513", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590513", "securityControlId": 31420, "ccis": [], "uuid": "a6162ddc-fd46-5bb5-a9df-92aaf254f023", "testId": "HRS-05.7_A02", "test": "a documented acknowledgement from individuals indicating that they have read, understand, and agree to abide by the rules of behavior is received before authorizing access to sensitive / regulated data and the system.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71454, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590513", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590513", "securityControlId": 31420, "ccis": [], "uuid": "dd2297c5-eb61-55e3-b594-b5025c2434c4", "testId": "HRS-05.7_A03", "test": "a documented acknowledgement from individuals indicating that they have read, understand, and agree to abide by the rules of behavior is received before authorizing access to CUI and the system.
PPTDF Applicability: People
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.15.03.c", "defaultText": null } ], "externalMappings": [ { "id": 574033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585354", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4aaf22fb-5ad8-5319-a110-86b0facf02f4", "parentControlId": 31420, "controlId": "7.3", "title": "7.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585354" }, { "id": 574034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585354", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f36e6a9-0267-52b0-813b-cfb9865a9ed9", "parentControlId": 31420, "controlId": "7.3(c)", "title": "7.3(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585354" }, { "id": 574037, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "406a9a29-3fc5-56fc-b74c-6811ca01af0b", "parentControlId": 31420, "controlId": "03.15.03.b", "title": "03.15.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585355" }, { "id": 574038, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10728bc2-f4be-5fa4-90a6-be7cb00614cc", "parentControlId": 31420, "controlId": "03.15.03.c", "title": "03.15.03.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585355" }, { "id": 574039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0add2b9e-5762-566c-9ffa-f559c4d82b00", "parentControlId": 31420, "controlId": "03.15.03.d", "title": "03.15.03.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585355" }, { "id": 574041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc39229f-91c5-5186-8eb3-0ece94c9f8aa", "parentControlId": 31420, "controlId": "GV.PO", "title": "GV.PO", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585355" }, { "id": 574042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af591575-c0ff-5628-99ec-9247dda2841f", "parentControlId": 31420, "controlId": "GV.PO-01", "title": "GV.PO-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585355" }, { "id": 574043, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e745126-3e31-5090-9955-32595831c7ce", "parentControlId": 31420, "controlId": "GV.PO-02", "title": "GV.PO-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585355" }, { "id": 574047, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585356", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec649707-aade-5572-9c99-9a7f7bc4cf17", "parentControlId": 31420, "controlId": "WORKFORCE-1e", "title": "WORKFORCE-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585356" } ], "id": 31420, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731079", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731079", "catalogueId": 1062, "uuid": "9b70724f-6b0a-5645-ab12-d51a4f9ace45", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure personnel receive recurring familiarization with the organization's security, compliance and resilience policies and provide acknowledgement?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Policy Familiarization & Acknowledgement", "description": "

Control Description

Mechanisms exist to ensure personnel receive recurring familiarization with the organization's security, compliance and resilience policies and provide acknowledgement.

Evidence Request List (ERL)

E-HRS-18\nE-SAT-02\nE-SAT-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure personnel receive recurring familiarization with the organization's security, compliance and resilience policies and provide acknowledgement.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-05.7", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-05.7", "references": "

Micro-Small Business (<10 staff)

∙ Formal onboarding training\n∙ Written policy acknowledgement

Small Business (10-49 staff)

∙ Formal onboarding training\n∙ Written policy acknowledgement

Medium Business (50-249 staff)

∙ Formal onboarding training\n∙ Written policy acknowledgement

Large Business (250-999 staff)

∙ Formal onboarding training\n∙ Written policy acknowledgement

Enterprise (>1,000 staff)

∙ Formal onboarding training\n∙ Written policy acknowledgement", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71455, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590513", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590513", "securityControlId": 31421, "ccis": [], "uuid": "0f67e281-1581-5d6d-a641-6d835005ec2f", "testId": "HRS-06_A01", "test": "access agreements are developed and documented for organizational systems.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PS-06a.", "defaultText": null }, { "id": 71456, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590513", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590513", "securityControlId": 31421, "ccis": [], "uuid": "19eb33f2-6fde-50dd-8395-480758076556", "testId": "HRS-06_A02", "test": "individuals requiring access to organizational information and systems sign appropriate access agreements prior to being granted access.
PPTDF Applicability: People
Assessment Rigor: 1
SCF Defined Parameters: at least annually and any time there is a change to the user's level of access", "otherId": "53A_R5_PS-06c.01", "defaultText": null }, { "id": 71457, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590513", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590514", "securityControlId": 31421, "ccis": [], "uuid": "72ad95db-bd35-5bef-971f-4c8938c91de2", "testId": "HRS-06_A03", "test": "individuals requiring access to organizational information and systems re-sign access agreements to maintain access to organizational systems when access agreements have been updated or frequency.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least annually and any time there is a change to the user's level of access", "otherId": "53A_R5_PS-06c.02", "defaultText": null }, { "id": 71458, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590514", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590514", "securityControlId": 31421, "ccis": [], "uuid": "7a90ae74-3af5-5b4c-a257-c3bfd4b42810", "testId": "HRS-06_A04", "test": "the frequency at which to review / update access agreements is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually and any time there is a change to the user's level of access", "otherId": "53A_R5_PS-06_ODP[01]", "defaultText": null }, { "id": 71459, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590514", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590514", "securityControlId": 31421, "ccis": [], "uuid": "5765d2c0-c1c5-5ba5-becf-f3b29e084e08", "testId": "HRS-06_A05", "test": "the frequency at which to re-sign access agreements to maintain access to organizational information is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least annually and any time there is a change to the user's level of access", "otherId": "53A_R5_PS-06_ODP[02]", "defaultText": null }, { "id": 71460, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590514", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590514", "securityControlId": 31421, "ccis": [], "uuid": "b82daa9f-8a2e-5d39-856b-aa9c9fe09689", "testId": "HRS-06_A06", "test": "the access agreements are reviewed / updated frequently.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PS-06b.", "defaultText": null } ], "externalMappings": [ { "id": 574069, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ae46eff-c8fe-535f-9335-6abece5e8b9b", "parentControlId": 31421, "controlId": "5.1", "title": "5.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585358" }, { "id": 574070, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8592f036-c944-5b49-ad4f-3a3e4ad51485", "parentControlId": 31421, "controlId": "5.14", "title": "5.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585358" }, { "id": 574078, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20d9a388-8106-584e-90b1-907fddb9f0fa", "parentControlId": 31421, "controlId": "PS-6", "title": "PS-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585359" }, { "id": 574079, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2592472-93bb-5c9b-b8d7-60ebeee8e4dd", "parentControlId": 31421, "controlId": "PS-6(2)", "title": "PS-6(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585359" }, { "id": 574080, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59e8461b-d6c5-5310-a15c-6e305a367efa", "parentControlId": 31421, "controlId": "PS-06", "title": "PS-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585359" }, { "id": 574081, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9622c243-3e5d-5baa-938f-79c601c53a44", "parentControlId": 31421, "controlId": "PS-06(02)", "title": "PS-06(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585359" }, { "id": 574084, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58536", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad591b36-2776-5220-9c29-1961aeceb595", "parentControlId": 31421, "controlId": "PS-06", "title": "PS-06", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58536" }, { "id": 574085, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58536", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68514f81-289c-5cc1-9a7e-f1b8e39a2dfe", "parentControlId": 31421, "controlId": "PS-06", "title": "PS-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58536" }, { "id": 574086, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58536", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8aabc1a-68ad-5de1-a954-1e2f64184201", "parentControlId": 31421, "controlId": "PS-06(02)", "title": "PS-06(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58536" }, { "id": 574087, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58536", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7507bebc-efb3-566d-9ac7-57e4465c185d", "parentControlId": 31421, "controlId": "PS-06", "title": "PS-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58536" }, { "id": 574088, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58536", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69d9ff54-e31c-5c9b-aaa7-37c8905b72c6", "parentControlId": 31421, "controlId": "PS-06", "title": "PS-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58536" }, { "id": 574089, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58536", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42d68dda-1fc9-5451-91d6-153cd2bbefd2", "parentControlId": 31421, "controlId": "PS-06", "title": "PS-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58536" }, { "id": 574090, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58536", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efba6d9f-f30b-5c79-9bab-f706e056c327", "parentControlId": 31421, "controlId": "PS-6", "title": "PS-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58536" }, { "id": 574091, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83de5280-c567-5e51-b422-55abc60f4869", "parentControlId": 31421, "controlId": "PS-6", "title": "PS-6", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585361" }, { "id": 574092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17ff8fa0-b134-5831-86f1-a32c090461c2", "parentControlId": 31421, "controlId": "PS-6", "title": "PS-6", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585361" }, { "id": 574095, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1dc6287e-0b89-5196-805b-8d71494857c3", "parentControlId": 31421, "controlId": "NFO - PS-6", "title": "NFO - PS-6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585361" }, { "id": 574096, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "674c2bb2-87f7-5e93-aed9-aea178cdbb90", "parentControlId": 31421, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585361" }, { "id": 574097, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e2724f8-c6f6-5fd8-a070-dbae8225aed0", "parentControlId": 31421, "controlId": "03.12.05.a", "title": "03.12.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585361" }, { "id": 574098, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46a19521-f7eb-514d-a01e-3a18db002e65", "parentControlId": 31421, "controlId": "03.15.03.b", "title": "03.15.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585361" }, { "id": 574099, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "199b6674-d56a-5792-98e2-ed13b79e1f33", "parentControlId": 31421, "controlId": "03.15.03.c", "title": "03.15.03.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585361" }, { "id": 574102, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22a62da9-69fe-5f0f-8ee0-02c1d7215db6", "parentControlId": 31421, "controlId": "WORKFORCE-1e", "title": "WORKFORCE-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585362" }, { "controlId": "C.2.2", "title": "C.2.2 — Personnel Termination or Transfer", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PS-4, PS-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "b26fb479-33a7-5be3-aa43-c70eca62266e", "isPublic": true }, { "controlId": "NEI 08-09 App E.2.2", "title": "NEI 08-09 App E.2.2 — Personnel Termination or Transfer", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.2.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "32515375-9bd0-5b11-884b-a8250b36d68c", "isPublic": true }, { "controlId": "10 CFR 73.56", "title": "10 CFR 73.56 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.2.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "d858fe7a-19f7-58d0-a213-52abed26fe04", "isPublic": true }, { "controlId": "CIP-004-7-R5", "title": "CIP-004-7-R5 — Access Revocation Process", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "06fbefc6-1dac-588b-8d5a-3a920b6dfe2c", "isPublic": true }, { "controlId": "CIP-004-7-5.1", "title": "CIP-004-7-5.1 — A process to initiate removal of an individual’s ability for unescorted physical access and Interactive Remote Access...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "fbfbd07c-95de-5887-a42f-3bd66228b01c", "isPublic": true }, { "controlId": "CIP-004-7-5.2", "title": "CIP-004-7-5.2 — For reassignments or transfers, revoke the individual’s authorized electronic access to individual accounts and autho...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "44bb2a63-776e-5141-805f-89e4174e382d", "isPublic": true }, { "controlId": "CIP-004-7-5.3", "title": "CIP-004-7-5.3 — For termination actions, revoke the individual’s non-shared user accounts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "260fcf34-f460-551d-a9fe-2e2fe2601853", "isPublic": true }, { "controlId": "CIP-004-7-5.4", "title": "CIP-004-7-5.4 — For termination actions, change passwords for shared account(s) known to the user within 30 calendar days of the term...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "59d3d699-cc56-5505-99ab-61132fe2d28f", "isPublic": true }, { "controlId": "NSS-42G-Sec4.4", "title": "NSS-42G-Sec4.4 — Trustworthiness, Fitness-for-Duty & Insider Threat Mitigation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "2f330cb1-28b8-56a9-926f-dc8b1301fe23", "isPublic": true }, { "controlId": "IEC-63096-7.1", "title": "IEC-63096-7.1 — Human Resource Security & Background Vetting (Access Authorization)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "eaa57211-802b-529e-bae1-c1c3f8279847", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP4", "title": "ONR-SyAP-FSyP4 — Personnel Security & Trustworthiness", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "5f49239e-eada-5734-9126-f5f7c2d3e9f3", "isPublic": true } ], "id": 31421, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731079", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731079", "catalogueId": 1062, "uuid": "47b6bf84-8bec-54f5-8855-0ad303e9250c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require internal and third-party users to sign appropriate access agreements prior to being granted access?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Access Agreements", "description": "

Control Description

Mechanisms exist to require internal and third-party users to sign appropriate access agreements prior to being granted access.

Evidence Request List (ERL)

E-HRS-16

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ HR defines terms of employment, including acceptable and unacceptable rules of behavior for the use of technologies, including consequences for unacceptable behavior.\n▪ HR maintains formal Terms of Employment (ToE) and/or Rules of Behavior (RoB) that stipulates acceptable and unacceptable employee activities.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require internal and third-party users to sign appropriate access agreements prior to being granted access.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.2.2
NERC-CIP (2026) Requirements: CIP-004-7-R5", "controlId": "HRS-06", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-06", "references": "

Micro-Small Business (<10 staff)

∙ Access agreement\n∙ Non-Disclosure Agreements (NDAs)

Small Business (10-49 staff)

∙ Access agreement\n∙ Non-Disclosure Agreements (NDAs)

Medium Business (50-249 staff)

∙ Access agreement\n∙ Non-Disclosure Agreements (NDAs)

Large Business (250-999 staff)

∙ Access agreement\n∙ Non-Disclosure Agreements (NDAs)

Enterprise (>1,000 staff)

∙ Access agreement\n∙ Non-Disclosure Agreements (NDAs)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71461, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590514", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590514", "securityControlId": 31422, "ccis": [], "uuid": "3198eeb4-fbb5-57dc-82c9-8417110942c8", "testId": "HRS-06.1_A01", "test": "individuals requiring access to organizational information and systems sign appropriate access agreements prior to being granted access.
PPTDF Applicability: People
Assessment Rigor: 1
SCF Defined Parameters: at least annually and any time there is a change to the user's level of access", "otherId": "53A_R5_PS-06c.01", "defaultText": null }, { "id": 71462, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590528", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590528", "securityControlId": 31422, "ccis": [], "uuid": "f9d9ce43-2854-5d27-a4de-80b676fa8f56", "testId": "HRS-06.1_A02", "test": "individuals requiring access to organizational information and systems re-sign access agreements to maintain access to organizational systems when access agreements have been updated or frequency.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually and any time there is a change to the user's level of access", "otherId": "53A_R5_PS-06c.02", "defaultText": null }, { "id": 71463, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590528", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590528", "securityControlId": 31422, "ccis": [], "uuid": "1e745c81-a19a-579b-a3e3-4e6b87aa8ece", "testId": "HRS-06.1_A03", "test": "the frequency at which to review / update access agreements is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually and any time there is a change to the user's level of access", "otherId": "53A_R5_PS-06_ODP[01]", "defaultText": null }, { "id": 71464, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590529", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590529", "securityControlId": 31422, "ccis": [], "uuid": "6b840d8a-2d98-52fd-9aa2-f349d3ebacef", "testId": "HRS-06.1_A04", "test": "the frequency at which to re-sign access agreements to maintain access to organizational information is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually and any time there is a change to the user's level of access", "otherId": "53A_R5_PS-06_ODP[02]", "defaultText": null }, { "id": 71465, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590529", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590529", "securityControlId": 31422, "ccis": [], "uuid": "e7c0f4bc-b8cd-57b6-bf35-13d1232bda12", "testId": "HRS-06.1_A05", "test": "access agreements are developed and documented for organizational systems.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-06a.", "defaultText": null }, { "id": 71466, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590529", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590529", "securityControlId": 31422, "ccis": [], "uuid": "e107c89c-9ff0-5bb5-87a0-af07e871434c", "testId": "HRS-06.1_A06", "test": "the access agreements are reviewed / updated frequently.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PS-06b.", "defaultText": null }, { "id": 71467, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590529", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590529", "securityControlId": 31422, "ccis": [], "uuid": "7f0d7612-0826-56ed-bc2e-6dfd2ac1ce8f", "testId": "HRS-06.1_A07", "test": "access to sensitive / regulated data requiring special protection is granted only to individuals who have a valid access authorization that is demonstrated by assigned duties.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-06(02)(a)", "defaultText": null }, { "id": 71468, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590529", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590529", "securityControlId": 31422, "ccis": [], "uuid": "f4489dd6-61c7-5bab-b8bc-db15cdf68725", "testId": "HRS-06.1_A08", "test": "access to sensitive / regulated data requiring special protection is granted only to individuals who satisfy associated personnel security criteria.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_PS-06(02)(b)", "defaultText": null }, { "id": 71469, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59053", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59053", "securityControlId": 31422, "ccis": [], "uuid": "bb7a64ea-fc49-58c4-be6e-48ee1ea74da7", "testId": "HRS-06.1_A09", "test": "access to sensitive / regulated data requiring special protection is granted only to individuals who have read, understood and signed a non-disclosure agreement.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_PS-06(02)(c)", "defaultText": null } ], "externalMappings": [ { "id": 574141, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a166913-0ed8-5c8e-a6e1-41c0f67a6957", "parentControlId": 31422, "controlId": "5.14", "title": "5.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585366" }, { "id": 574142, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5740f99-da58-5f32-a1e5-0d80bb3e1b51", "parentControlId": 31422, "controlId": "6.6", "title": "6.6", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585367" }, { "id": 574150, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3272ce68-4a67-566d-982d-f2503967e5a3", "parentControlId": 31422, "controlId": "PS-6", "title": "PS-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585367" }, { "id": 574151, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5f47548-06e5-57b0-b46b-be6e08c4a979", "parentControlId": 31422, "controlId": "PS-6(2)", "title": "PS-6(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585367" }, { "id": 574152, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f00b924-42f1-5287-a951-f4250f344629", "parentControlId": 31422, "controlId": "PS-06", "title": "PS-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585368" }, { "id": 574153, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "483e5dd7-9114-58f5-8cd0-05a17ab45ad4", "parentControlId": 31422, "controlId": "PS-06(02)", "title": "PS-06(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585368" }, { "id": 574156, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41a43034-a37a-5b5c-afec-46cf283186a9", "parentControlId": 31422, "controlId": "PS-06", "title": "PS-06", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585368" }, { "id": 574157, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7a413dc-a996-5b26-8c01-39417183f2e4", "parentControlId": 31422, "controlId": "PS-06", "title": "PS-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585368" }, { "id": 574158, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aaebe3e4-e13a-5768-ba73-916c1f91ddf0", "parentControlId": 31422, "controlId": "PS-06(02)", "title": "PS-06(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585368" }, { "id": 574159, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3186ec8-5e24-52ab-9058-6b107f38b7e5", "parentControlId": 31422, "controlId": "PS-06", "title": "PS-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585368" }, { "id": 574160, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59f70a0b-c48b-53d1-819f-8d814890e798", "parentControlId": 31422, "controlId": "PS-06", "title": "PS-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585368" }, { "id": 574161, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f154ccad-fc7a-58fc-b1d0-d0130d35c695", "parentControlId": 31422, "controlId": "PS-06", "title": "PS-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585369" }, { "id": 574162, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e5f98fb-1e85-5ee1-8104-a812192798b3", "parentControlId": 31422, "controlId": "PS-6", "title": "PS-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585369" }, { "id": 574163, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea6aff05-b0f7-57ce-ab03-2b332abb5363", "parentControlId": 31422, "controlId": "PS-6", "title": "PS-6", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585369" }, { "id": 574164, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b1ca7e1-769d-548d-8c50-b7d6e60fa193", "parentControlId": 31422, "controlId": "PS-6", "title": "PS-6", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585369" }, { "id": 574167, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12aa8ba3-ec7c-58b0-9e21-5e882cb51aa4", "parentControlId": 31422, "controlId": "03.12.05.a", "title": "03.12.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585369" }, { "id": 574168, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abbb2506-f1a0-5906-8d4b-aa82bc420a6e", "parentControlId": 31422, "controlId": "03.15.03.c", "title": "03.15.03.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585369" } ], "id": 31422, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73108", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73108", "catalogueId": 1062, "uuid": "651b8cbb-0e82-57ed-960f-b2dd675bcdfb", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require Non-Disclosure Agreements (NDAs) or similar confidentiality agreements that reflect the needs to protect data and operational details, or both employees and third-parties?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Confidentiality Agreements", "description": "

Control Description

Mechanisms exist to require Non-Disclosure Agreements (NDAs) or similar confidentiality agreements that reflect the needs to protect data and operational details, or both employees and third-parties.

Evidence Request List (ERL)

E-HRS-20

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ HR requires personnel with access to sensitive/regulated data to sign a Non-Disclosure Agreement (NDA).

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require Non-Disclosure Agreements (NDAs) or similar confidentiality agreements that reflect the needs to protect data and operational details, or both employees and third-parties.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-06.1", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-06.1", "references": "

Micro-Small Business (<10 staff)

∙ Access agreement\n∙ Non-Disclosure Agreements (NDAs)

Small Business (10-49 staff)

∙ Access agreement\n∙ Non-Disclosure Agreements (NDAs)

Medium Business (50-249 staff)

∙ Access agreement\n∙ Non-Disclosure Agreements (NDAs)

Large Business (250-999 staff)

∙ Access agreement\n∙ Non-Disclosure Agreements (NDAs)

Enterprise (>1,000 staff)

∙ Access agreement\n∙ Non-Disclosure Agreements (NDAs)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71470, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59053", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59053", "securityControlId": 31423, "ccis": [], "uuid": "698d52be-316c-59e9-9234-4c63da4c061a", "testId": "HRS-06.2_A01", "test": "individuals are notified of applicable, legally binding post-employment requirements for the protection of organizational information.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PS-06(03)(a)", "defaultText": null }, { "id": 71471, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59053", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59053", "securityControlId": 31423, "ccis": [], "uuid": "5b0a3ff9-c550-5ca3-bc02-e2155f4c949b", "testId": "HRS-06.2_A02", "test": "individuals are required to sign an acknowledgement of applicable, legally binding post-employment requirements as part of being granted initial access to covered information.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_PS-06(03)(b)", "defaultText": null } ], "externalMappings": [ { "id": 574218, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585375", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a613c3d1-cf4e-503b-8a85-74752042f601", "parentControlId": 31423, "controlId": "PS-6(3)", "title": "PS-6(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585375" }, { "id": 574219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585375", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a25af0b6-c52d-5241-b7c0-dd071c513a43", "parentControlId": 31423, "controlId": "PS-06(03)", "title": "PS-06(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585375" }, { "id": 574220, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585375", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "041c6796-7a94-520e-a773-56f587356a69", "parentControlId": 31423, "controlId": "PS-06(03)", "title": "PS-06(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585375" } ], "id": 31423, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73108", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73108", "catalogueId": 1062, "uuid": "7044ed09-ae75-5c51-83c4-90d5ab6acfef", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization notify individuals of their applicable, legally-binding post-employment requirements for the protection of sensitive/regulated data?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Post-Employment Requirements Awareness", "description": "

Control Description

Mechanisms exist to notify individuals of their applicable, legally-binding post-employment requirements for the protection of sensitive/regulated data.

Evidence Request List (ERL)

E-HRS-19

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to notify individuals of their applicable, legally-binding post-employment requirements for the protection of sensitive/regulated data.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-06.2", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-06.2", "references": "

Micro-Small Business (<10 staff)

∙ Non-Disclosure Agreements (NDAs)

Small Business (10-49 staff)

∙ Non-Disclosure Agreements (NDAs)

Medium Business (50-249 staff)

∙ Non-Disclosure Agreements (NDAs)

Large Business (250-999 staff)

∙ Non-Disclosure Agreements (NDAs)

Enterprise (>1,000 staff)

∙ Non-Disclosure Agreements (NDAs)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71472, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590531", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590531", "securityControlId": 31424, "ccis": [], "uuid": "47428fa6-ddb7-59bb-a76b-919b7dcb8023", "testId": "HRS-07_A01", "test": "a formal sanctions process is employed for individuals failing to comply with established cybersecurity / data privacy policies and procedures.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PS-08a.", "defaultText": null }, { "id": 71473, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590531", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590531", "securityControlId": 31424, "ccis": [], "uuid": "d70dc56f-5d24-5664-9f3b-1b4ebd387d3c", "testId": "HRS-07_A02", "test": "criteria and/or process for terminating system access authorization and any credentials coincide with personnel actions is established.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.9.2[a]", "defaultText": null }, { "id": 71474, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590531", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590531", "securityControlId": 31424, "ccis": [], "uuid": "239090c3-7220-55a4-9cea-673894d54c53", "testId": "HRS-07_A03", "test": "personnel or roles to be notified when a formal employee sanctions process is initiated is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PS-08_ODP[01]", "defaultText": null }, { "id": 71475, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590531", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590531", "securityControlId": 31424, "ccis": [], "uuid": "527fb4ee-14fd-5d82-8ece-580dd43e0a92", "testId": "HRS-07_A04", "test": "the time period within which organization-defined personnel or roles must be notified when a formal employee sanctions process is initiated is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: within twenty-four (24) hours", "otherId": "53A_R5_PS-08_ODP[02]", "defaultText": null }, { "id": 71476, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590531", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590531", "securityControlId": 31424, "ccis": [], "uuid": "bb4a5912-d4ac-504c-8f8a-587aa2eed86b", "testId": "HRS-07_A05", "test": "personnel or roles is/are notified within an organization-defined time period when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: within twenty-four (24) hours", "otherId": "53A_R5_PS-08b.", "defaultText": null }, { "id": 71477, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590532", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590532", "securityControlId": 31424, "ccis": [], "uuid": "574b2840-c0b9-5736-81b0-7603d4c41c9d", "testId": "HRS-07_A06", "test": "system access and credentials are terminated consistent with personnel actions such as termination or transfer.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.9.2[b]", "defaultText": null }, { "id": 71478, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590532", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590532", "securityControlId": 31424, "ccis": [], "uuid": "10253a71-3c20-5371-96d7-97d1f72bc6f7", "testId": "HRS-07_A07", "test": "the system is protected during and after personnel transfer actions.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.9.2[c]", "defaultText": null }, { "id": 71479, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590532", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590532", "securityControlId": 31424, "ccis": [], "uuid": "6d18833b-d5d7-56be-8a84-b4c20488ebbc", "testId": "HRS-07_A08", "test": "individuals with access to sensitive / regulated data are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.9.2e[a]", "defaultText": null }, { "id": 71480, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590532", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590532", "securityControlId": 31424, "ccis": [], "uuid": "972b30d3-58c9-50c6-a1ab-e3ea9ed9d879", "testId": "HRS-07_A09", "test": "adverse information about individuals with access to sensitive / regulated data is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.9.2e[b]", "defaultText": null }, { "id": 71481, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590532", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590532", "securityControlId": 31424, "ccis": [], "uuid": "b83a01a1-b6b6-5950-a2ce-9fa97a8b71d0", "testId": "HRS-07_A10", "test": "organizational systems to which individuals have access are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.9.2e[c]", "defaultText": null }, { "id": 71482, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590532", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590532", "securityControlId": 31424, "ccis": [], "uuid": "745ca30c-316b-5040-8129-247c3f6c55cd", "testId": "HRS-07_A11", "test": "mechanisms are in place to protect organizational systems if adverse information develops or is obtained about individuals with access to sensitive / regulated data.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.9.2e[d]", "defaultText": null } ], "externalMappings": [ { "id": 574236, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585377", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72f86bf4-ad9e-5202-8d9f-a6987de40c9e", "parentControlId": 31424, "controlId": "6.4", "title": "6.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585377" }, { "id": 574239, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585377", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e68f99c5-bdd8-5da4-be47-a0f02a1cdb82", "parentControlId": 31424, "controlId": "PS-8", "title": "PS-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585377" }, { "id": 574240, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585377", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abc4b838-b255-5243-afa9-d25b683e300b", "parentControlId": 31424, "controlId": "PS-08", "title": "PS-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585377" }, { "id": 574241, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585385", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a912cf5-14f3-5e88-9d28-fad1a062b42f", "parentControlId": 31424, "controlId": "PS-08", "title": "PS-08", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585385" }, { "id": 574243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585386", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b895b1b8-9948-51b7-8e7c-7ad81fa9b043", "parentControlId": 31424, "controlId": "PS-08", "title": "PS-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585386" }, { "id": 574244, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585386", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8d8d66d-5a3e-5f4b-ad3c-6804f175d51a", "parentControlId": 31424, "controlId": "PS-08", "title": "PS-08", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585386" }, { "id": 574245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585386", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac98c95b-d3e7-5681-8efe-916dce96b836", "parentControlId": 31424, "controlId": "PS-08", "title": "PS-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585386" }, { "id": 574246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585386", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "504e542f-0ff3-5bd7-b764-d2b1da5ce958", "parentControlId": 31424, "controlId": "PS-08", "title": "PS-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585386" }, { "id": 574247, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585386", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b6d0286-b512-5622-bf76-4a8b91886273", "parentControlId": 31424, "controlId": "NFO - PS-8", "title": "NFO - PS-8", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585386" }, { "id": 574248, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585386", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ceb85117-6c73-5fac-97b6-bb42cabf8b8a", "parentControlId": 31424, "controlId": "03.01.01.f.04", "title": "03.01.01.f.04", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585386" }, { "id": 574249, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585386", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef8ea7ed-ee7c-528e-82a9-24e71c3a63bd", "parentControlId": 31424, "controlId": "03.01.01.f.05", "title": "03.01.01.f.05", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585386" }, { "id": 574254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "085f247f-d973-5a63-a11a-edfab1d08d92", "parentControlId": 31424, "controlId": "GV.PO", "title": "GV.PO", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585387" }, { "id": 574255, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6ca6dce-a028-5ec1-9587-266ccfb300bb", "parentControlId": 31424, "controlId": "GV.PO-01", "title": "GV.PO-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585387" }, { "id": 574256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68182abe-d848-563d-8d6f-e46a9d04002a", "parentControlId": 31424, "controlId": "GV.PO-02", "title": "GV.PO-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585387" }, { "id": 574260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d9ce755-7ebb-5290-bc6c-464d914f4fe9", "parentControlId": 31424, "controlId": "WORKFORCE-1g", "title": "WORKFORCE-1g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585388" }, { "controlId": "NSS-42G-Sec4.4", "title": "NSS-42G-Sec4.4 — Trustworthiness, Fitness-for-Duty & Insider Threat Mitigation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "2188d2c4-22e8-544d-8a7b-58e78dedee26", "isPublic": true }, { "controlId": "IEC-63096-7.1", "title": "IEC-63096-7.1 — Human Resource Security & Background Vetting (Access Authorization)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "115f532e-bb83-58d0-9d56-dd80f067de86", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP4", "title": "ONR-SyAP-FSyP4 — Personnel Security & Trustworthiness", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "764d930e-3239-5024-b6a5-2ca26202d7e0", "isPublic": true } ], "id": 31424, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73108", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73108", "catalogueId": 1062, "uuid": "010dd6e6-966f-5ccd-b2a6-6d4ab969bdc7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization sanction personnel failing to comply with established security policies, standards and procedures?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Personnel Sanctions", "description": "

Control Description

Mechanisms exist to sanction personnel failing to comply with established security policies, standards and procedures.

Evidence Request List (ERL)

E-HRS-27\nE-HRS-29

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ Requests for investigations are handled through a formal, management-approved process.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to sanction personnel failing to comply with established security policies, standards and procedures.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-07", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-07", "references": "

Micro-Small Business (<10 staff)

∙ Employee security policy acknowledgment\n∙ Background check for sensitive roles

Small Business (10-49 staff)

∙ Security awareness policy\n∙ Background checks\n∙ Security onboarding checklist

Medium Business (50-249 staff)

∙ HR security program\n∙ Background checks for all staff\n∙ Security onboarding training

Large Business (250-999 staff)

∙ Enterprise HR security program\n∙ Background screening service\n∙ Automated offboarding workflows

Enterprise (>1,000 staff)

∙ Enterprise HR security framework\n∙ Background screening platform\n∙ Integrated HR/IAM offboarding\n∙ Continuous monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71483, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590532", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590532", "securityControlId": 31425, "ccis": [], "uuid": "26c0ab5d-c2c6-5778-823e-e05b949b4024", "testId": "HRS-07.1_A01", "test": "individuals with access to sensitive / regulated data are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.9.2e[a]", "defaultText": null }, { "id": 71484, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590533", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590533", "securityControlId": 31425, "ccis": [], "uuid": "d9e31932-3aa3-5492-be47-208dc055bf51", "testId": "HRS-07.1_A02", "test": "adverse information about individuals with access to sensitive / regulated data is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.9.2e[b]", "defaultText": null }, { "id": 71485, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590533", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590533", "securityControlId": 31425, "ccis": [], "uuid": "1f4c0fbe-a405-5c9f-8588-0561a36843f2", "testId": "HRS-07.1_A03", "test": "organizational systems to which individuals have access are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.9.2e[c]", "defaultText": null }, { "id": 71486, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590533", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590533", "securityControlId": 31425, "ccis": [], "uuid": "47e817e1-b9f9-58ee-bd96-460a414cfbd2", "testId": "HRS-07.1_A04", "test": "mechanisms are in place to protect organizational systems if adverse information develops or is obtained about individuals with access to sensitive / regulated data.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.9.2e[d]", "defaultText": null } ], "externalMappings": [ { "id": 574304, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "519e207a-0e9e-542f-8986-1848fe5916e0", "parentControlId": 31425, "controlId": "6.4", "title": "6.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585393" }, { "id": 574306, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2208fc4-0b3f-5781-a1e9-16f2df7b575b", "parentControlId": 31425, "controlId": "03.01.01.f.04", "title": "03.01.01.f.04", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585393" }, { "id": 574307, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c9cd79c-d359-5d36-a601-8ddd6dfd78e1", "parentControlId": 31425, "controlId": "03.01.01.f.05", "title": "03.01.01.f.05", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585393" }, { "id": 574309, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7e721d8-aecf-5b28-ab80-72d047abbc14", "parentControlId": 31425, "controlId": "WORKFORCE-1g", "title": "WORKFORCE-1g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585393" } ], "id": 31425, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731081", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731081", "catalogueId": 1062, "uuid": "3ef3007c-2a27-5bce-ac66-ea8c2def623b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct employee misconduct investigations when there is reasonable assurance that a policy has been violated?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Workplace Investigations", "description": "

Control Description

Mechanisms exist to conduct employee misconduct investigations when there is reasonable assurance that a policy has been violated.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ Requests for investigations are handled through a formal, management-approved process.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conduct employee misconduct investigations when there is reasonable assurance that a policy has been violated.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-07.1", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-07.1", "references": "

Micro-Small Business (<10 staff)

∙ Employee security policy acknowledgment\n∙ Background check for sensitive roles

Small Business (10-49 staff)

∙ Security awareness policy\n∙ Background checks\n∙ Security onboarding checklist

Medium Business (50-249 staff)

∙ HR security program\n∙ Background checks for all staff\n∙ Security onboarding training

Large Business (250-999 staff)

∙ Enterprise HR security program\n∙ Background screening service\n∙ Automated offboarding workflows

Enterprise (>1,000 staff)

∙ Enterprise HR security framework\n∙ Background screening platform\n∙ Integrated HR/IAM offboarding\n∙ Continuous monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71492, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590534", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590534", "securityControlId": 31428, "ccis": [], "uuid": "14dc512f-5e5f-53f0-a3c3-55f2938d83cc", "testId": "HRS-08_A01", "test": "criteria and/or process for terminating system access authorization and any credentials coincide with personnel actions is established.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.9.2[a]", "defaultText": null }, { "id": 71493, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590534", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590534", "securityControlId": 31428, "ccis": [], "uuid": "fd09dc65-3f41-5974-ae25-cbdf3ad435c2", "testId": "HRS-08_A02", "test": "system access and credentials are terminated consistent with personnel actions such as termination or transfer.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.9.2[b]", "defaultText": null }, { "id": 71494, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590534", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590534", "securityControlId": 31428, "ccis": [], "uuid": "8c06b67c-50c5-5fe2-a6e2-0da3a1da9d71", "testId": "HRS-08_A03", "test": "the system is protected during and after personnel transfer actions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.9.2[c]", "defaultText": null }, { "id": 71495, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590535", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590535", "securityControlId": 31428, "ccis": [], "uuid": "21069c85-f8a8-590e-b4ee-24924c114d64", "testId": "HRS-08_A04", "test": "transfer or reassignment actions to be initiated following transfer or reassignment are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-05_ODP[01]", "defaultText": null }, { "id": 71496, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590535", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590535", "securityControlId": 31428, "ccis": [], "uuid": "5c72f348-6187-5015-8fcc-97bd3e4a5884", "testId": "HRS-08_A05", "test": "the time period within which transfer or reassignment actions must occur following transfer or reassignment is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: twenty-four (24) hours", "otherId": "53A_R5_PS-05_ODP[02]", "defaultText": null }, { "id": 71497, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590535", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590535", "securityControlId": 31428, "ccis": [], "uuid": "023a658a-a776-5cda-adc0-88a260d49018", "testId": "HRS-08_A06", "test": "personnel or roles to be notified when individuals are reassigned or transferred to other positions within the organization is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-05_ODP[03]", "defaultText": null }, { "id": 71498, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590535", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590535", "securityControlId": 31428, "ccis": [], "uuid": "cdc69255-11e1-5552-8de8-9762b9a00546", "testId": "HRS-08_A07", "test": "time period within which to notify organization-defined personnel or roles when individuals are reassigned or transferred to other positions within the organization is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: twenty-four (24) hours", "otherId": "53A_R5_PS-05_ODP[04]", "defaultText": null }, { "id": 71499, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590535", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590535", "securityControlId": 31428, "ccis": [], "uuid": "30177c27-b606-5577-99cd-47add52c89e0", "testId": "HRS-08_A08", "test": "the ongoing operational need for current logical and physical access authorizations to systems and facilities are reviewed and confirmed when individuals are reassigned or transferred to other positions within the organization.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-05a.", "defaultText": null }, { "id": 71500, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590535", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590535", "securityControlId": 31428, "ccis": [], "uuid": "1c381370-863e-52a6-8d5b-51f912107209", "testId": "HRS-08_A09", "test": "transfer or reassignment actions are initiated within an organization-defined time period following the formal transfer action.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: twenty-four (24) hours", "otherId": "53A_R5_PS-05b.", "defaultText": null }, { "id": 71501, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590535", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590536", "securityControlId": 31428, "ccis": [], "uuid": "a31612ca-8788-513e-8deb-ecfb4f086b18", "testId": "HRS-08_A10", "test": "access authorization is modified as needed to correspond with any changes in operational need due to reassignment or transfer.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PS-05c.", "defaultText": null }, { "id": 71502, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590536", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590536", "securityControlId": 31428, "ccis": [], "uuid": "ed47173c-a62a-51ec-95dc-a6356d66486d", "testId": "HRS-08_A11", "test": "personnel or roles are notified within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: twenty-four (24) hours", "otherId": "53A_R5_PS-05d.", "defaultText": null }, { "id": 71503, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590536", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590536", "securityControlId": 31428, "ccis": [], "uuid": "174e473a-dd18-5a9a-9ebf-661500200db9", "testId": "HRS-08_A12", "test": "the time period within which to disable system access is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.09.02.ODP[01]", "defaultText": null }, { "id": 71504, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590536", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590536", "securityControlId": 31428, "ccis": [], "uuid": "0605e6c6-a685-5a8b-8a1a-f25067c3e5d5", "testId": "HRS-08_A13", "test": "upon individual reassignment or transfer to other positions in the organization, the ongoing operational need for current logical and physical access authorizations to the system and facility is reviewed.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.09.02.b.01[01]", "defaultText": null }, { "id": 71505, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590536", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590536", "securityControlId": 31428, "ccis": [], "uuid": "36775d70-c268-5e93-9fbf-2e93e3290cc8", "testId": "HRS-08_A14", "test": "upon individual reassignment or transfer to other positions in the organization, the ongoing operational need for current logical and physical access authorizations to the system and facility is confirmed.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.09.02.b.01[02]", "defaultText": null }, { "id": 71506, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590536", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590536", "securityControlId": 31428, "ccis": [], "uuid": "cf472b27-81bd-50a5-bd6f-4e3cabb2db55", "testId": "HRS-08_A15", "test": "upon individual reassignment or transfer to other positions in the organization, access authorization is modified to correspond with any changes in operational need.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.09.02.b.02", "defaultText": null } ], "externalMappings": [ { "id": 574332, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de930dc4-bf26-59b8-a11c-645f64e6813c", "parentControlId": 31428, "controlId": "6.5", "title": "6.5", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585396" }, { "id": 574336, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b2ed60a-093c-5563-bd49-aae06a1d93b7", "parentControlId": 31428, "controlId": "PS-5", "title": "PS-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585397" }, { "id": 574337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b02bbd4-919a-5162-84bf-17e5d6e5b1eb", "parentControlId": 31428, "controlId": "PS-05", "title": "PS-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585397" }, { "id": 574338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49765aec-9c27-5f21-a25a-414429979596", "parentControlId": 31428, "controlId": "PS-05", "title": "PS-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585397" }, { "id": 574340, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62de2470-03f8-5910-989e-4d04dff2c5d5", "parentControlId": 31428, "controlId": "PS-05", "title": "PS-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585397" }, { "id": 574341, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d03f71b-ea70-5206-b4c1-bbe00adbd95b", "parentControlId": 31428, "controlId": "PS-05", "title": "PS-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585397" }, { "id": 574342, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14030c6e-7c14-5596-8618-5710f1ee5035", "parentControlId": 31428, "controlId": "PS-05", "title": "PS-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585397" }, { "id": 574343, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed2e17bf-795f-5385-b756-1a3e1d705848", "parentControlId": 31428, "controlId": "PS-05", "title": "PS-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585397" }, { "id": 574344, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e88535a-bda0-5387-a3d0-76ec56a4fa8c", "parentControlId": 31428, "controlId": "3.9.2", "title": "3.9.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585398" }, { "id": 574345, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5a73721-d61f-552b-ad67-28d395472f13", "parentControlId": 31428, "controlId": "03.01.01.g.02", "title": "03.01.01.g.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585398" }, { "id": 574346, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4e07673-98d2-5a2f-9704-e0475e2c99ec", "parentControlId": 31428, "controlId": "03.09.02.a", "title": "03.09.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585398" }, { "id": 574347, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac3ef4ae-7511-547b-a423-6b9754128e22", "parentControlId": 31428, "controlId": "03.09.02.b.01", "title": "03.09.02.b.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585398" }, { "id": 574357, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585399", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a890c2a3-6045-5957-90b5-d8eb61747517", "parentControlId": 31428, "controlId": "WORKFORCE-1d", "title": "WORKFORCE-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585399" }, { "controlId": "C.2.2", "title": "C.2.2 — Personnel Termination or Transfer", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PS-4, PS-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "399e8269-1684-5c58-9642-63d701fbbc2d", "isPublic": true }, { "controlId": "NEI 08-09 App E.2.2", "title": "NEI 08-09 App E.2.2 — Personnel Termination or Transfer", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.2.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "061be8ff-39f2-579f-bc36-ba81cf64e687", "isPublic": true }, { "controlId": "10 CFR 73.56", "title": "10 CFR 73.56 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.2.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "3dd8e726-9712-5bd0-b3b9-ecb6adfdc435", "isPublic": true }, { "controlId": "CIP-004-7-R5", "title": "CIP-004-7-R5 — Access Revocation Process", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "fb25cc17-52b6-5a0d-b0cb-50679a85a8e5", "isPublic": true }, { "controlId": "CIP-004-7-5.1", "title": "CIP-004-7-5.1 — A process to initiate removal of an individual’s ability for unescorted physical access and Interactive Remote Access...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6dded8c9-414a-5380-9008-47db94316edc", "isPublic": true }, { "controlId": "CIP-004-7-5.2", "title": "CIP-004-7-5.2 — For reassignments or transfers, revoke the individual’s authorized electronic access to individual accounts and autho...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d3158bb5-a16a-5dfd-a65a-6b1b4b2460a2", "isPublic": true }, { "controlId": "CIP-004-7-5.3", "title": "CIP-004-7-5.3 — For termination actions, revoke the individual’s non-shared user accounts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7381ea80-4505-5b3e-a4bf-76f6809a2c80", "isPublic": true }, { "controlId": "CIP-004-7-5.4", "title": "CIP-004-7-5.4 — For termination actions, change passwords for shared account(s) known to the user within 30 calendar days of the term...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4806c693-5efe-50ed-8110-e6f50353ba33", "isPublic": true }, { "controlId": "NSS-42G-Sec4.4", "title": "NSS-42G-Sec4.4 — Trustworthiness, Fitness-for-Duty & Insider Threat Mitigation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "1b3352a7-a5d7-5ad9-aca1-dda178499f8e", "isPublic": true }, { "controlId": "IEC-63096-7.1", "title": "IEC-63096-7.1 — Human Resource Security & Background Vetting (Access Authorization)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "8b08bdf6-5a7b-5730-bb30-146707184988", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP4", "title": "ONR-SyAP-FSyP4 — Personnel Security & Trustworthiness", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "7484ffb8-7bdf-5007-ac41-729e38f28143", "isPublic": true } ], "id": 31428, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731082", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731082", "catalogueId": 1062, "uuid": "a0cbd550-87dc-5215-8815-3cfc709029f6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization adjust logical and physical access authorizations to Technology Assets, Applications and/or Services (TAAS) and facilities upon personnel reassignment or transfer, in a timely manner?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Personnel Transfer", "description": "

Control Description

Mechanisms exist to adjust logical and physical access authorizations to Technology Assets, Applications and/or Services (TAAS) and facilities upon personnel reassignment or transfer, in a timely manner.

Evidence Request List (ERL)

E-HRS-29

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to adjust logical and physical access authorizations to Technology Assets, Applications and/or Services (TAAS) and facilities upon personnel reassignment or transfer, in a timely manner.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.2.2
NERC-CIP (2026) Requirements: CIP-004-7-R5", "controlId": "HRS-08", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-08", "references": "

Micro-Small Business (<10 staff)

∙ Employee security policy acknowledgment\n∙ Background check for sensitive roles

Small Business (10-49 staff)

∙ Security awareness policy\n∙ Background checks\n∙ Security onboarding checklist

Medium Business (50-249 staff)

∙ HR security program\n∙ Background checks for all staff\n∙ Security onboarding training

Large Business (250-999 staff)

∙ Enterprise HR security program\n∙ Background screening service\n∙ Automated offboarding workflows

Enterprise (>1,000 staff)

∙ Enterprise HR security framework\n∙ Background screening platform\n∙ Integrated HR/IAM offboarding\n∙ Continuous monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71507, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590536", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590536", "securityControlId": 31429, "ccis": [], "uuid": "3cd7b163-264e-58db-920f-57dbad8044fd", "testId": "HRS-09_A01", "test": "criteria and/or process for terminating system access authorization and any credentials coincide with personnel actions is established.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.9.2[a]", "defaultText": null }, { "id": 71508, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590537", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590537", "securityControlId": 31429, "ccis": [], "uuid": "04dae9e7-4374-5309-bcfb-b0e371367dc2", "testId": "HRS-09_A02", "test": "system access and credentials are terminated consistent with personnel actions such as termination or transfer.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.9.2[b]", "defaultText": null }, { "id": 71509, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590537", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590537", "securityControlId": 31429, "ccis": [], "uuid": "7d01aa49-8083-5a59-a800-073071647f84", "testId": "HRS-09_A03", "test": "the system is protected during and after personnel transfer actions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.9.2[c]", "defaultText": null }, { "id": 71510, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590537", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590537", "securityControlId": 31429, "ccis": [], "uuid": "634edc1c-68c1-5016-9503-320b475fa7cb", "testId": "HRS-09_A04", "test": "the time period within which to disable system access is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PS-04_ODP[01]\n171A_R3_A.03.09.02.ODP[01]", "defaultText": null }, { "id": 71511, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590537", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590537", "securityControlId": 31429, "ccis": [], "uuid": "56a2e43c-a487-5afc-9c86-cbcccd6233e9", "testId": "HRS-09_A05", "test": "cybersecurity topics to be discussed when conducting exit interviews are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-04_ODP[02]", "defaultText": null }, { "id": 71512, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590538", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590538", "securityControlId": 31429, "ccis": [], "uuid": "e5459f7e-c54a-5764-bd31-0644bb52f9d0", "testId": "HRS-09_A06", "test": "upon termination of individual employment, authenticators associated with the individual are terminated or revoked.
PPTDF Applicability: Technology
Assessment Rigor: 2
SCF Defined Parameters: four (4) hours", "otherId": "53A_R5_PS-04a.\n171A_R3_A.03.09.02.a.02[01]", "defaultText": null }, { "id": 71513, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590538", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590538", "securityControlId": 31429, "ccis": [], "uuid": "feb2071f-00d2-5747-bf20-0df08330f3f5", "testId": "HRS-09_A07", "test": "upon termination of individual employment, credentials associated with the individual are terminated or revoked.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_PS-04b.\n171A_R3_A.03.09.02.a.02[02]", "defaultText": null }, { "id": 71514, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590539", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590539", "securityControlId": 31429, "ccis": [], "uuid": "6d581aa7-f0eb-599f-b25e-c055befd72ef", "testId": "HRS-09_A08", "test": "upon termination of individual employment, exit interviews that include a discussion of cybersecurity topics are conducted.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PS-04c.", "defaultText": null }, { "id": 71515, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590539", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590539", "securityControlId": 31429, "ccis": [], "uuid": "2a4861b3-70c3-59a6-ba19-edba1c0d5920", "testId": "HRS-09_A09", "test": "upon termination of individual employment, security-related system property is retrieved.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PS-04d.\n171A_R3_A.03.09.02.a.03", "defaultText": null }, { "id": 71516, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590539", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590539", "securityControlId": 31429, "ccis": [], "uuid": "00776158-9148-5085-a6b7-a63209b7e3ec", "testId": "HRS-09_A10", "test": "upon termination of individual employment, access to organizational information and systems formerly controlled by the terminated individual are retained.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_PS-04e.", "defaultText": null }, { "id": 71517, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590539", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590539", "securityControlId": 31429, "ccis": [], "uuid": "b7b20ee3-111a-5704-8b5a-385a31a5d575", "testId": "HRS-09_A11", "test": "upon termination of individual employment, system access is disabled within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 71518, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59054", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59054", "securityControlId": 31429, "ccis": [], "uuid": "5721d9f6-10b1-5316-93b4-a72f812718e3", "testId": "HRS-09_A12", "test": "upon termination of individual employment, system access is disabled within .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: four (4) hours", "otherId": "171A_R3_A.03.09.02.a.01", "defaultText": null } ], "externalMappings": [ { "id": 574396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585403", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3af0ae9d-8d28-589b-bb48-7ab4bb2250d4", "parentControlId": 31429, "controlId": "6.5", "title": "6.5", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585403" }, { "id": 574400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "baa3efd7-709f-51c1-824d-88b6e04821b6", "parentControlId": 31429, "controlId": "PS-4", "title": "PS-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585404" }, { "id": 574401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7d91c1d-15af-5190-9e21-f00f3aa44879", "parentControlId": 31429, "controlId": "PS-04", "title": "PS-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585404" }, { "id": 574402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb0f71bf-87ac-5553-a55b-21989cc66516", "parentControlId": 31429, "controlId": "PS-04", "title": "PS-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585404" }, { "id": 574404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b25d5400-8cda-5635-9f6a-189a5b22c321", "parentControlId": 31429, "controlId": "PS-04", "title": "PS-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585404" }, { "id": 574405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "406e2e22-ba71-5d62-8b00-1424e2ac834a", "parentControlId": 31429, "controlId": "PS-04", "title": "PS-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585404" }, { "id": 574406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42afc348-c561-5eda-9b1c-d10fcaaa840c", "parentControlId": 31429, "controlId": "PS-04", "title": "PS-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585405" }, { "id": 574407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1bb58e7-0d19-5460-944f-f64f2414ff8d", "parentControlId": 31429, "controlId": "PS-04", "title": "PS-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585405" }, { "id": 574408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c6f9467-443e-51ad-8467-55da54d48a58", "parentControlId": 31429, "controlId": "3.9.2", "title": "3.9.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585405" }, { "id": 574409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfdfb321-9a67-54ba-b834-a113ac19d1d8", "parentControlId": 31429, "controlId": "03.01.01.f.03", "title": "03.01.01.f.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585405" }, { "id": 574410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74fb6cd1-b05d-5240-bd98-d659b1601311", "parentControlId": 31429, "controlId": "03.01.01.g.02", "title": "03.01.01.g.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585405" }, { "id": 574411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70cebed1-b9ba-5c17-8d93-0bdb9b043901", "parentControlId": 31429, "controlId": "03.09.02.a", "title": "03.09.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585405" }, { "id": 574412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cdca1dc6-b0aa-5da5-94e7-7d7505db41da", "parentControlId": 31429, "controlId": "03.09.02.a.03", "title": "03.09.02.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585405" }, { "id": 574413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f1bd833-268c-5881-8222-8ceee99b3f52", "parentControlId": 31429, "controlId": "03.09.02.b.01", "title": "03.09.02.b.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585405" }, { "id": 574431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "783d6106-a05b-57d9-8f8c-c0312a3ab7e2", "parentControlId": 31429, "controlId": "WORKFORCE-1d", "title": "WORKFORCE-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585407" }, { "id": 574432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e7b4c77-be2d-571e-892d-43645e1738d9", "parentControlId": 31429, "controlId": "WORKFORCE-1g", "title": "WORKFORCE-1g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585408" }, { "controlId": "C.2.2", "title": "C.2.2 — Personnel Termination or Transfer", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PS-4, PS-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "011c7b37-be5d-5ed7-9217-75b85c5fe168", "isPublic": true }, { "controlId": "NEI 08-09 App E.2.2", "title": "NEI 08-09 App E.2.2 — Personnel Termination or Transfer", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.2.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "43696441-f1d4-5bb8-8f5c-ec65b9306e5c", "isPublic": true }, { "controlId": "10 CFR 73.56", "title": "10 CFR 73.56 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.2.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "ee914ae4-4f4b-5884-b09f-065955a3aa67", "isPublic": true }, { "controlId": "CIP-004-7-R5", "title": "CIP-004-7-R5 — Access Revocation Process", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "775b002f-cf4e-55c1-96ee-2162f676e418", "isPublic": true }, { "controlId": "CIP-004-7-5.1", "title": "CIP-004-7-5.1 — A process to initiate removal of an individual’s ability for unescorted physical access and Interactive Remote Access...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "03586f48-12c0-5f1e-b16a-2f47d7642ddb", "isPublic": true }, { "controlId": "CIP-004-7-5.2", "title": "CIP-004-7-5.2 — For reassignments or transfers, revoke the individual’s authorized electronic access to individual accounts and autho...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2c268fa0-c253-54cb-ac8f-90a36bb99845", "isPublic": true }, { "controlId": "CIP-004-7-5.3", "title": "CIP-004-7-5.3 — For termination actions, revoke the individual’s non-shared user accounts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5cb59aff-be26-52b2-9ebe-a47d00f31d42", "isPublic": true }, { "controlId": "CIP-004-7-5.4", "title": "CIP-004-7-5.4 — For termination actions, change passwords for shared account(s) known to the user within 30 calendar days of the term...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6107eab7-591b-51a5-8bd2-c04b96d9e334", "isPublic": true }, { "controlId": "NSS-42G-Sec4.4", "title": "NSS-42G-Sec4.4 — Trustworthiness, Fitness-for-Duty & Insider Threat Mitigation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "199878da-ebbe-5a81-9f41-03635558ae05", "isPublic": true }, { "controlId": "IEC-63096-7.1", "title": "IEC-63096-7.1 — Human Resource Security & Background Vetting (Access Authorization)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "88fbede6-e9fb-525a-b6c2-569d55601782", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP4", "title": "ONR-SyAP-FSyP4 — Personnel Security & Trustworthiness", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "a5794c86-ebb6-5970-b153-cb69e257aef8", "isPublic": true } ], "id": 31429, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731082", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731082", "catalogueId": 1062, "uuid": "9a96cf94-5a55-5e29-b7a8-c141bc47b3a5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization govern the termination of individual employment?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Personnel Termination", "description": "

Control Description

Mechanisms exist to govern the termination of individual employment.

Evidence Request List (ERL)

E-HRS-19\nE-HRS-29

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ HR, in conjunction with an individual's manager/supervisor, collects assets and return those assets to IT and/or cybersecurity personnel, upon termination of employment.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to govern the termination of individual employment.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.2.2
NERC-CIP (2026) Requirements: CIP-004-7-R5", "controlId": "HRS-09", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-09", "references": "

Micro-Small Business (<10 staff)

∙ Employee security policy acknowledgment\n∙ Background check for sensitive roles

Small Business (10-49 staff)

∙ Security awareness policy\n∙ Background checks\n∙ Security onboarding checklist

Medium Business (50-249 staff)

∙ HR security program\n∙ Background checks for all staff\n∙ Security onboarding training

Large Business (250-999 staff)

∙ Enterprise HR security program\n∙ Background screening service\n∙ Automated offboarding workflows

Enterprise (>1,000 staff)

∙ Enterprise HR security framework\n∙ Background screening platform\n∙ Integrated HR/IAM offboarding\n∙ Continuous monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71519, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59054", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59054", "securityControlId": 31430, "ccis": [], "uuid": "ca593247-10aa-5702-86e5-f040b1689c6d", "testId": "HRS-09.1_A01", "test": "upon termination of individual employment, security-related system property is retrieved.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.09.02.a.03", "defaultText": null } ], "externalMappings": [ { "id": 574478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585413", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8542598c-ed01-561a-891b-a4f43774bf29", "parentControlId": 31430, "controlId": "03.09.02.a.03", "title": "03.09.02.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585413" } ], "id": 31430, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731082", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731082", "catalogueId": 1062, "uuid": "1b5715bb-7c6a-562c-95fd-8bb2e68fbe57", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization retrieve organization-owned assets upon termination of an individual's employment?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Asset Collection", "description": "

Control Description

Mechanisms exist to retrieve organization-owned assets upon termination of an individual's employment.

Evidence Request List (ERL)

E-HRS-19

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to retrieve organization-owned assets upon termination of an individual's employment.

Level 4 - Quantitatively Controlled: Human Resources Security (HRS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-09.1", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-09.1", "references": "

Micro-Small Business (<10 staff)

∙ Employee security policy acknowledgment\n∙ Background check for sensitive roles

Small Business (10-49 staff)

∙ Security awareness policy\n∙ Background checks\n∙ Security onboarding checklist

Medium Business (50-249 staff)

∙ HR security program\n∙ Background checks for all staff\n∙ Security onboarding training

Large Business (250-999 staff)

∙ Enterprise HR security program\n∙ Background screening service\n∙ Automated offboarding workflows

Enterprise (>1,000 staff)

∙ Enterprise HR security framework\n∙ Background screening platform\n∙ Integrated HR/IAM offboarding\n∙ Continuous monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71520, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59054", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59054", "securityControlId": 31431, "ccis": [], "uuid": "b9b4412e-b889-506f-bd34-7d924dcc755c", "testId": "HRS-09.2_A01", "test": "time period within which to disable accounts of individuals who are discovered to pose significant risk is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: one (1) hour", "otherId": "53A_R5_AC-02(13)_ODP[01]", "defaultText": null }, { "id": 71521, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59054", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59054", "securityControlId": 31431, "ccis": [], "uuid": "3c2b0b3a-ca09-5589-9742-a94756555daa", "testId": "HRS-09.2_A02", "test": "significant risks leading to disabling accounts are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-02(13)_ODP[02]", "defaultText": null }, { "id": 71522, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590541", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590541", "securityControlId": 31431, "ccis": [], "uuid": "44c7628e-406a-5d0a-afce-e449e9b9bc6c", "testId": "HRS-09.2_A03", "test": "accounts of individuals are disabled within an organization-defined time period of discovery of organization-defined significant risks.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: one (1) hour", "otherId": "53A_R5_AC-02(13)", "defaultText": null }, { "id": 71523, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590541", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590541", "securityControlId": 31431, "ccis": [], "uuid": "0c120423-b161-5004-8ce8-e8d659d79636", "testId": "HRS-09.2_A04", "test": "individuals with access to sensitive / regulated data are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "172A_3.9.2e[a]", "defaultText": null }, { "id": 71524, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590541", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590541", "securityControlId": 31431, "ccis": [], "uuid": "f57bb9fc-a8e8-5594-842f-7355e5cc2e57", "testId": "HRS-09.2_A05", "test": "adverse information about individuals with access to sensitive / regulated data is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "172A_3.9.2e[b]", "defaultText": null }, { "id": 71525, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590541", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590541", "securityControlId": 31431, "ccis": [], "uuid": "ca823018-3465-5dde-8c49-e4a0f6632de4", "testId": "HRS-09.2_A06", "test": "organizational systems to which individuals have access are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "172A_3.9.2e[c]", "defaultText": null }, { "id": 71526, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590541", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590541", "securityControlId": 31431, "ccis": [], "uuid": "e8419429-7b18-5c87-8dae-f78285013029", "testId": "HRS-09.2_A07", "test": "mechanisms are in place to protect organizational systems if adverse information develops or is obtained about individuals with access to sensitive / regulated data.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.9.2e[d]", "defaultText": null } ], "externalMappings": [ { "id": 574488, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8c6cad6-902c-563c-8efa-bc6f33dfe8fc", "parentControlId": 31431, "controlId": "AC-02(13)", "title": "AC-02(13)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585414" }, { "id": 574490, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45546f40-e55c-563d-a478-f64f3545c1f7", "parentControlId": 31431, "controlId": "AC-02(13)", "title": "AC-02(13)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585414" }, { "id": 574491, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "550f3ecb-86fb-5f03-be0d-2936974acc33", "parentControlId": 31431, "controlId": "AC-02(13)", "title": "AC-02(13)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585414" }, { "id": 574492, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "808397a8-5023-548a-b052-eb193f6af28d", "parentControlId": 31431, "controlId": "AC-02(13)", "title": "AC-02(13)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585414" }, { "id": 574493, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3aaedcc-6fa7-5829-84db-8a7f6825f2c0", "parentControlId": 31431, "controlId": "AC-02(13)", "title": "AC-02(13)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585414" }, { "id": 574494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585414", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "707e5c2c-e4ab-5e46-aa90-82507e8966dc", "parentControlId": 31431, "controlId": "03.09.02.a.01", "title": "03.09.02.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585414" }, { "id": 574495, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e7562f8-5992-5faf-80ab-d914223525fc", "parentControlId": 31431, "controlId": "03.09.02.a.02", "title": "03.09.02.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585415" }, { "id": 574496, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a405a5c-a715-5157-8aa0-2d6e0a59327a", "parentControlId": 31431, "controlId": "03.09.02.b.01", "title": "03.09.02.b.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585415" } ], "id": 31431, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731083", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731083", "catalogueId": 1062, "uuid": "315c1875-c45e-5c33-b509-f34be036f353", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization expedite the process of removing \"high risk\" individual’s access to Technology Assets, Applications, Services and/or Data (TAASD) upon termination, as determined by management?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "High-Risk Terminations", "description": "

Control Description

Mechanisms exist to expedite the process of removing \"high risk\" individual’s access to Technology Assets, Applications, Services and/or Data (TAASD) upon termination, as determined by management.

Evidence Request List (ERL)

E-HRS-19

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to expedite the process of removing \"high risk\" individual’s access to TAASD upon termination, as determined by management.

Level 4 - Quantitatively Controlled: Human Resources Security (HRS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-09.2", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-09.2", "references": "

Micro-Small Business (<10 staff)

∙ Employee security policy acknowledgment\n∙ Background check for sensitive roles

Small Business (10-49 staff)

∙ Security awareness policy\n∙ Background checks\n∙ Security onboarding checklist

Medium Business (50-249 staff)

∙ HR security program\n∙ Background checks for all staff\n∙ Security onboarding training

Large Business (250-999 staff)

∙ Enterprise HR security program\n∙ Background screening service\n∙ Automated offboarding workflows

Enterprise (>1,000 staff)

∙ Enterprise HR security framework\n∙ Background screening platform\n∙ Integrated HR/IAM offboarding\n∙ Continuous monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71527, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590541", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590541", "securityControlId": 31432, "ccis": [], "uuid": "8f537cf0-c9d0-5ae6-9d53-7af228378089", "testId": "HRS-09.3_A01", "test": "terminated individuals are notified of applicable, legally binding post-employment requirements for the protection of organizational information.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PS-04(01)(a)", "defaultText": null }, { "id": 71528, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590541", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590541", "securityControlId": 31432, "ccis": [], "uuid": "e80fb163-a586-5f97-bdaf-f0527042f839", "testId": "HRS-09.3_A02", "test": "terminated individuals are required to sign an acknowledgement of post-employment requirements as part of the organizational termination process.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_PS-04(01)(b)", "defaultText": null } ], "externalMappings": [ { "id": 574517, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585417", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06684f99-1ab1-56a9-9a53-8fdfe1fba4c4", "parentControlId": 31432, "controlId": "6.5", "title": "6.5", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585417" }, { "id": 574520, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585417", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b9c7cb5-3f51-53e0-993c-cfa4d1c9a281", "parentControlId": 31432, "controlId": "PS-4(1)", "title": "PS-4(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585417" }, { "id": 574521, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585418", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed142b87-7224-54cb-9e31-fe97e10efb55", "parentControlId": 31432, "controlId": "PS-04(01)", "title": "PS-04(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585418" }, { "id": 574522, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585418", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "773a23bf-f8df-58d2-b307-6bd29c4a34a7", "parentControlId": 31432, "controlId": "PS-04(01)", "title": "PS-04(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585418" } ], "id": 31432, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731083", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731083", "catalogueId": 1062, "uuid": "79ff7999-baf5-538a-ac76-020210a00224", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization govern former employee behavior by formally notifying terminated individuals of their applicable, legally binding post-employment requirements for the protection of sensitive/regulated data?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Post-Employment Requirements Notification", "description": "

Control Description

Mechanisms exist to govern former employee behavior by formally notifying terminated individuals of their applicable, legally binding post-employment requirements for the protection of sensitive/regulated data.

Evidence Request List (ERL)

E-HRS-19

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to govern former employee behavior by formally notifying terminated individuals of their applicable, legally binding post-employment requirements for the protection of sensitive/regulated data.

Level 4 - Quantitatively Controlled: Human Resources Security (HRS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-09.3", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-09.3", "references": "

Micro-Small Business (<10 staff)

∙ Non-Disclosure Agreements (NDAs)

Small Business (10-49 staff)

∙ Non-Disclosure Agreements (NDAs)

Medium Business (50-249 staff)

∙ Non-Disclosure Agreements (NDAs)

Large Business (250-999 staff)

∙ Non-Disclosure Agreements (NDAs)

Enterprise (>1,000 staff)

∙ Non-Disclosure Agreements (NDAs)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71529, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590542", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590542", "securityControlId": 31433, "ccis": [], "uuid": "a3f9c703-5317-5bf3-9032-6f35a507ea8f", "testId": "HRS-09.4_A01", "test": "automated mechanisms to notify personnel or roles of individual termination actions and/or to disable access to system resources are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PS-04(02)_ODP[01]", "defaultText": null }, { "id": 71530, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590542", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590542", "securityControlId": 31433, "ccis": [], "uuid": "96bc8562-1c1e-5949-bf4f-a0f15df5f431", "testId": "HRS-09.4_A02", "test": "personnel or roles to be notified upon termination of an individual is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PS-04(02)_ODP[03]", "defaultText": null }, { "id": 71531, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590542", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590542", "securityControlId": 31433, "ccis": [], "uuid": "e7281268-9999-54b3-af6c-f49ceb7ee663", "testId": "HRS-09.4_A03", "test": "automated mechanisms are used to notify personnel or roles of individual termination actions and/or disable access to system resources.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PS-04(02)\n53A_R5_PS-04(02)_ODP[02]", "defaultText": null } ], "externalMappings": [ { "id": 574528, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585418", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a350b900-5b5e-559c-8681-3ff26f79f0dc", "parentControlId": 31433, "controlId": "PS-4(2)", "title": "PS-4(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585418" }, { "id": 574529, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585418", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36b4d619-5679-5e66-85e7-07eaaf148665", "parentControlId": 31433, "controlId": "PS-04(02)", "title": "PS-04(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585418" }, { "id": 574530, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a23aa4b-7d4f-5ec8-8c3e-c22c8171fe1b", "parentControlId": 31433, "controlId": "PS-04(02)", "title": "PS-04(02)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585419" }, { "id": 574531, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0750d761-60be-516d-b71f-d1c7cbcd5a5a", "parentControlId": 31433, "controlId": "PS-04(02)", "title": "PS-04(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585419" }, { "id": 574532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ceeaf824-d420-576b-957d-2ec322f1d04f", "parentControlId": 31433, "controlId": "PS-04(02)", "title": "PS-04(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585419" }, { "id": 574533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48f0c2d2-44f2-564e-a737-370c87ac4483", "parentControlId": 31433, "controlId": "03.01.01.g.02", "title": "03.01.01.g.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585419" }, { "id": 574534, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02de4e30-18f8-5529-98e0-845d39392c9e", "parentControlId": 31433, "controlId": "03.09.02.a.01", "title": "03.09.02.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585419" }, { "id": 574535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58894a09-975f-53a6-9082-78cfd49983ad", "parentControlId": 31433, "controlId": "03.09.02.a.02", "title": "03.09.02.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585419" } ], "id": 31433, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731083", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731083", "catalogueId": 1062, "uuid": "e4cb42f2-06a8-5508-84be-755c07bac6d3", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to notify Identity and Access Management (IAM) personnel or roles upon termination of an individual employment or contract?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Automated Employment Status Notifications", "description": "

Control Description

Automated mechanisms exist to notify Identity and Access Management (IAM) personnel or roles upon termination of an individual employment or contract.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically notify Identity and Access Management (IAM) personnel or roles upon termination of an individual employment or contract.

Level 4 - Quantitatively Controlled: Human Resources Security (HRS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Human Resources Security (HRS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "HRS-09.4", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-09.4", "references": "

Micro-Small Business (<10 staff)

∙ Employee security policy acknowledgment\n∙ Background check for sensitive roles

Small Business (10-49 staff)

∙ Security awareness policy\n∙ Background checks\n∙ Security onboarding checklist

Medium Business (50-249 staff)

∙ HR security program\n∙ Background checks for all staff\n∙ Security onboarding training

Large Business (250-999 staff)

∙ Enterprise HR security program\n∙ Background screening service\n∙ Automated offboarding workflows

Enterprise (>1,000 staff)

∙ Enterprise HR security framework\n∙ Background screening platform\n∙ Integrated HR/IAM offboarding\n∙ Continuous monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71532, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590542", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590542", "securityControlId": 31434, "ccis": [], "uuid": "e9214f31-0261-5cf4-8e7c-5e0e74688cb6", "testId": "HRS-10_A01", "test": "personnel or roles to be notified of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PS-07_ODP[01]", "defaultText": null }, { "id": 71533, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590542", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590542", "securityControlId": 31434, "ccis": [], "uuid": "9e3a8378-fafa-5812-bb2a-8edd4ebfb566", "testId": "HRS-10_A02", "test": "time period within which third-party providers are required to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PS-07_ODP[02]", "defaultText": null }, { "id": 71534, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590543", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590543", "securityControlId": 31434, "ccis": [], "uuid": "d2113e23-fe59-5897-bcac-01a299c7472e", "testId": "HRS-10_A03", "test": "personnel security requirements are established, including security roles and responsibilities for external providers.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PS-07a.", "defaultText": null }, { "id": 71535, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590543", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590543", "securityControlId": 31434, "ccis": [], "uuid": "b52e1e8c-1d2b-5772-9349-3cf4a40816a2", "testId": "HRS-10_A04", "test": "external providers are required to comply with personnel security policies and procedures established by the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PS-07b.", "defaultText": null }, { "id": 71536, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590543", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590543", "securityControlId": 31434, "ccis": [], "uuid": "5373ad11-ab1f-5773-a72f-912becf6b9be", "testId": "HRS-10_A05", "test": "personnel security requirements are documented.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PS-07c.", "defaultText": null }, { "id": 71537, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590543", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590543", "securityControlId": 31434, "ccis": [], "uuid": "a94ce3e6-6704-546a-8b09-40f2cd185b08", "testId": "HRS-10_A06", "test": "external providers are required to notify personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: within twenty-four (24) hours", "otherId": "53A_R5_PS-07d.", "defaultText": null }, { "id": 71538, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590543", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590543", "securityControlId": 31434, "ccis": [], "uuid": "15ad4c03-e9d8-5a29-a0f4-491ec37e606e", "testId": "HRS-10_A07", "test": "provider compliance with personnel security requirements is monitored.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PS-07e.", "defaultText": null } ], "externalMappings": [ { "id": 574548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0417ab4d-0343-51be-a6f6-ac0b19aef7ac", "parentControlId": 31434, "controlId": "PS-7", "title": "PS-7", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585421" }, { "id": 574549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7902ab52-7d6a-5ca8-82c7-0ff56e556258", "parentControlId": 31434, "controlId": "PS-07", "title": "PS-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585421" }, { "id": 574550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "059891fb-6465-57ac-8ff1-2806c0357be3", "parentControlId": 31434, "controlId": "PS-07", "title": "PS-07", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585421" }, { "id": 574551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6528c3ba-0c34-5b31-94ac-155e4e9bf747", "parentControlId": 31434, "controlId": "PS-07", "title": "PS-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585421" }, { "id": 574552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9d5f984-9822-5852-9175-b1944c5fa999", "parentControlId": 31434, "controlId": "PS-07", "title": "PS-07", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585421" }, { "id": 574553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa295c71-83aa-5ce8-9ffa-ca13e7dd2ff3", "parentControlId": 31434, "controlId": "PS-07", "title": "PS-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585421" }, { "id": 574554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "926bfec1-99d2-599c-bd40-fc7e9e4f8eef", "parentControlId": 31434, "controlId": "PS-07", "title": "PS-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585421" }, { "id": 574555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "139397ea-594c-54dd-8f53-5102a8e77ae5", "parentControlId": 31434, "controlId": "PS-7", "title": "PS-7", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585421" }, { "id": 574556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81652887-f6a3-5f1f-82f7-ffaf3bedd0ee", "parentControlId": 31434, "controlId": "PS-7", "title": "PS-7", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585422" }, { "id": 574558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585422", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e46af77-fbfc-54ca-8266-85b7d1fdc3ed", "parentControlId": 31434, "controlId": "NFO - PS-7", "title": "NFO - PS-7", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585422" }, { "id": 574559, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585422", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80f4d39f-6771-503e-bdc7-67603c4b2731", "parentControlId": 31434, "controlId": "03.16.03.b", "title": "03.16.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585422" }, { "controlId": "NSS-42G-Sec4.4", "title": "NSS-42G-Sec4.4 — Trustworthiness, Fitness-for-Duty & Insider Threat Mitigation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "6f4d4fef-7062-557c-b12e-4c849ff501f4", "isPublic": true }, { "controlId": "IEC-63096-7.1", "title": "IEC-63096-7.1 — Human Resource Security & Background Vetting (Access Authorization)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "1858d97a-0548-55ae-b221-674cc95949a7", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP4", "title": "ONR-SyAP-FSyP4 — Personnel Security & Trustworthiness", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "ca4bf69b-2cf4-5c21-aa38-8b6dfa7c08e9", "isPublic": true } ], "id": 31434, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731084", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731084", "catalogueId": 1062, "uuid": "b06b1366-864c-5daf-b90c-294af4f7abbb", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization govern third-party personnel by reviewing and monitoring third-party security, compliance and/or resilience roles and responsibilities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Third-Party Personnel", "description": "

Control Description

Mechanisms exist to govern third-party personnel by reviewing and monitoring third-party security, compliance and/or resilience roles and responsibilities.

Evidence Request List (ERL)

E-HRS-16\nE-HRS-18\nE-HRS-22

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to govern third-party personnel by reviewing and monitoring third-party security, compliance and/or resilience roles and responsibilities.

Level 4 - Quantitatively Controlled: Human Resources Security (HRS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-10", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-10", "references": "

Micro-Small Business (<10 staff)

∙ Contract Statement of Work (SOW) review.\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix

Small Business (10-49 staff)

∙ Contract Statement of Work (SOW) review.\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix

Medium Business (50-249 staff)

∙ Contract Statement of Work (SOW) review.\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix

Large Business (250-999 staff)

∙ Contract Statement of Work (SOW) review.\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix

Enterprise (>1,000 staff)

∙ Contract Statement of Work (SOW) review.\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71539, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590544", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590544", "securityControlId": 31435, "ccis": [], "uuid": "8ad608cd-885f-508f-a872-3b3450d4e5d8", "testId": "HRS-11_A01", "test": "the duties of individuals requiring separation to reduce the risk of malevolent activity are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.4[a]\n53A_R5_AC-05_ODP", "defaultText": null }, { "id": 71540, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590544", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590544", "securityControlId": 31435, "ccis": [], "uuid": "523c50be-3748-50e3-b25f-90d5aae53a72", "testId": "HRS-11_A02", "test": "responsibilities for duties that require separation are assigned to separate individuals.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.4[b]\n53A_R5_AC-05a.", "defaultText": null }, { "id": 71541, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590544", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590544", "securityControlId": 31435, "ccis": [], "uuid": "6d432028-412c-5eff-a990-c9b398a38530", "testId": "HRS-11_A03", "test": "separate accounts for individuals whose duties and accesses must be separated to reduce the risk of malevolent activity or collusion are established
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.4[c]\n53A_R5_AC-05b.", "defaultText": null } ], "externalMappings": [ { "id": 574589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae3e83f4-52e0-53d7-9484-81a024987cc3", "parentControlId": 31435, "controlId": "USER 2.2", "title": "USER 2.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585433" }, { "id": 574590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0584fc90-4fbd-5c46-bf56-50d936e123ad", "parentControlId": 31435, "controlId": "5.3", "title": "5.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585433" }, { "id": 574591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585434", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3d7d600-639c-5b42-8440-0a3880cdfb23", "parentControlId": 31435, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585434" }, { "id": 574595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585434", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ff03f13-eb2a-577d-ba6c-9bc029c57cd3", "parentControlId": 31435, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585434" }, { "id": 574596, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585434", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2b57389-a578-57b9-9f9d-3b89212a829d", "parentControlId": 31435, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585434" }, { "id": 574597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585434", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d50d28a-befd-534d-b560-b1c809b6a6f0", "parentControlId": 31435, "controlId": "T1003.002", "title": "T1003.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585434" }, { "id": 574598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585434", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0019fc72-2a1d-5ff8-8b52-ac56496a8f4b", "parentControlId": 31435, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585434" }, { "id": 574599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96aa5b65-f4a6-5f50-9192-c7edbe9170da", "parentControlId": 31435, "controlId": "T1003.004", "title": "T1003.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585435" }, { "id": 574600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a15032d-c2a5-5eef-a656-a0a63ddee333", "parentControlId": 31435, "controlId": "T1003.005", "title": "T1003.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585435" }, { "id": 574601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4017f2fe-6679-5976-918c-9a32215573e1", "parentControlId": 31435, "controlId": "T1003.006", "title": "T1003.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585435" }, { "id": 574602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3cc092d-db4c-5e95-bc1b-8a2224775426", "parentControlId": 31435, "controlId": "T1003.007", "title": "T1003.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585435" }, { "id": 574603, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf26f8ed-c399-5c3f-8b69-101c2fdedaa0", "parentControlId": 31435, "controlId": "T1003.008", "title": "T1003.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585435" }, { "id": 574604, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5769cc8-10d3-5b3d-b59b-6c51491cae48", "parentControlId": 31435, "controlId": "T1021", "title": "T1021", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585435" }, { "id": 574605, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f7bfa14-222b-531e-8c86-838dd4ddac02", "parentControlId": 31435, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585435" }, { "id": 574606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77a2c1a0-167c-58c9-876c-b4f45074e456", "parentControlId": 31435, "controlId": "T1021.002", "title": "T1021.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585435" }, { "id": 574607, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e850822-620f-52c1-a83a-ba2b9e96c698", "parentControlId": 31435, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585435" }, { "id": 574608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585436", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0cde4efd-70f7-59cb-83b1-e52d0830058b", "parentControlId": 31435, "controlId": "T1021.004", "title": "T1021.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585436" }, { "id": 574609, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585436", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e3eb626-916b-5f1e-8449-d1b2dc93d174", "parentControlId": 31435, "controlId": "T1021.006", "title": "T1021.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585436" }, { "id": 574610, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585436", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fe71099-1644-51be-9b07-76aa7aa60075", "parentControlId": 31435, "controlId": "T1021.007", "title": "T1021.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585436" }, { "id": 574611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585436", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ecf9cca3-0589-5b9d-859e-ba938a1f68f9", "parentControlId": 31435, "controlId": "T1047", "title": "T1047", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585436" }, { "id": 574612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585436", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87799354-ee1e-5d82-8253-28a221ab63d9", "parentControlId": 31435, "controlId": "T1053", "title": "T1053", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585436" }, { "id": 574613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585436", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1e5da5c-7f56-5571-bbf5-20accb2d3071", "parentControlId": 31435, "controlId": "T1053.002", "title": "T1053.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585436" }, { "id": 574614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585436", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce026d52-aca9-56c1-b333-57cb82db155c", "parentControlId": 31435, "controlId": "T1053.003", "title": "T1053.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585436" }, { "id": 574615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585436", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbfbfad1-482d-5273-bb33-d976269b9868", "parentControlId": 31435, "controlId": "T1053.005", "title": "T1053.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585436" }, { "id": 574616, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca217c02-6ebb-5e55-a3b6-6deb8b6a01ee", "parentControlId": 31435, "controlId": "T1053.006", "title": "T1053.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585437" }, { "id": 574617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70a903f7-6b65-5fb6-84dc-2291b8b29950", "parentControlId": 31435, "controlId": "T1053.007", "title": "T1053.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585437" }, { "id": 574618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa80f208-25aa-526f-8699-fcf9490c7d15", "parentControlId": 31435, "controlId": "T1055", "title": "T1055", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585437" }, { "id": 574619, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64bff839-c87c-5c9b-9120-19e418064116", "parentControlId": 31435, "controlId": "T1055.008", "title": "T1055.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585437" }, { "id": 574620, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "458a2200-dedc-59be-bc14-ae5436f9c479", "parentControlId": 31435, "controlId": "T1056.003", "title": "T1056.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585437" }, { "id": 574621, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65f4f75e-f93a-56d8-bba2-f75397532a55", "parentControlId": 31435, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585437" }, { "id": 574622, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "809693b1-f138-5a12-a965-103b6d5e5a88", "parentControlId": 31435, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585437" }, { "id": 574623, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "021322bb-819d-53d3-8cc5-468e1b89c7a1", "parentControlId": 31435, "controlId": "T1059.008", "title": "T1059.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585438" }, { "id": 574624, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbb2f91a-fcac-51e3-b043-3f5d8d638fc8", "parentControlId": 31435, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585438" }, { "id": 574625, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40a59ad1-0a71-5610-9e8d-b5fdc1eca13b", "parentControlId": 31435, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585438" }, { "id": 574626, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ad8757c-6937-5875-99d2-4ce998bb10e4", "parentControlId": 31435, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585438" }, { "id": 574627, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a9651e0-c967-5fc2-9563-359796934189", "parentControlId": 31435, "controlId": "T1070.003", "title": "T1070.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585438" }, { "id": 574628, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43b9ea22-ff5a-52a3-b2c3-c020f1954268", "parentControlId": 31435, "controlId": "T1070.007", "title": "T1070.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585438" }, { "id": 574629, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "980bc6af-97db-5f6e-8979-8296f088816a", "parentControlId": 31435, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585438" }, { "id": 574630, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d91a2f01-ac26-511d-9d21-3906f217eb0e", "parentControlId": 31435, "controlId": "T1070.009", "title": "T1070.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585438" }, { "id": 574631, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3486a57-44cd-5994-8e36-5090756da506", "parentControlId": 31435, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585438" }, { "id": 574632, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d0d701b-d32f-5300-9ba4-288dcd263211", "parentControlId": 31435, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585439" }, { "id": 574633, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5f40948-ec37-5636-8361-46cfd491a62f", "parentControlId": 31435, "controlId": "T1078.001", "title": "T1078.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585439" }, { "id": 574634, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b86f694-a877-5907-9d42-a1a822d1e67b", "parentControlId": 31435, "controlId": "T1078.002", "title": "T1078.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585439" }, { "id": 574635, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "012ca898-fc7b-5853-988d-1c13a9fb2646", "parentControlId": 31435, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585439" }, { "id": 574636, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c4c325d-7ab3-5dec-af6a-47fa33b894ea", "parentControlId": 31435, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585439" }, { "id": 574637, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5dd1bf5b-8052-5caf-ad04-e4ae125dac16", "parentControlId": 31435, "controlId": "T1087.004", "title": "T1087.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585439" }, { "id": 574638, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9742d946-7950-5f54-8805-7acf37d9c0fd", "parentControlId": 31435, "controlId": "T1098", "title": "T1098", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585439" }, { "id": 574639, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0877637c-3f03-5dcb-aa66-36e97ff97d7f", "parentControlId": 31435, "controlId": "T1098.001", "title": "T1098.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585439" }, { "id": 574640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5de380a1-59ea-50fe-ab2c-fb8944627be9", "parentControlId": 31435, "controlId": "T1098.002", "title": "T1098.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585439" }, { "id": 574641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58544", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53c60aa1-5914-505c-ad01-b3f0cf672e1e", "parentControlId": 31435, "controlId": "T1098.003", "title": "T1098.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58544" }, { "id": 574642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58544", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8d74b2a-1bc2-5681-8728-c4f7f985d222", "parentControlId": 31435, "controlId": "T1098.004", "title": "T1098.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58544" }, { "id": 574643, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58544", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2476c9d-d0a9-50b6-a658-f343b22bee90", "parentControlId": 31435, "controlId": "T1098.005", "title": "T1098.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58544" }, { "id": 574644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58544", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29359add-8705-50b1-9b01-130b64ef38b1", "parentControlId": 31435, "controlId": "T1098.007", "title": "T1098.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58544" }, { "id": 574645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58544", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26d05fcf-59b9-565a-8a32-11a4a36c0b6c", "parentControlId": 31435, "controlId": "T1110", "title": "T1110", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58544" }, { "id": 574646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58544", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37bb1693-6fb6-5d11-8b05-7c140d87fef8", "parentControlId": 31435, "controlId": "T1110.001", "title": "T1110.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58544" }, { "id": 574647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58544", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5360b14d-526a-5288-b536-5395fecce6a2", "parentControlId": 31435, "controlId": "T1110.002", "title": "T1110.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58544" }, { "id": 574648, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58544", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1cf1789-b172-5d49-8211-c61361402f2e", "parentControlId": 31435, "controlId": "T1110.003", "title": "T1110.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58544" }, { "id": 574649, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58544", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "143f5b6f-16cc-56fc-b3f6-c7e7877f3f8c", "parentControlId": 31435, "controlId": "T1110.004", "title": "T1110.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585441" }, { "id": 574650, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c95e48f3-ea58-52cf-96d7-7c3da1e5a512", "parentControlId": 31435, "controlId": "T1134", "title": "T1134", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585441" }, { "id": 574651, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78ce73f4-46a4-5a2a-b8a6-4000b4d2afff", "parentControlId": 31435, "controlId": "T1134.001", "title": "T1134.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585441" }, { "id": 574652, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bee3f2b-7167-508b-ba97-1c23cb6bcf89", "parentControlId": 31435, "controlId": "T1134.002", "title": "T1134.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585441" }, { "id": 574653, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "736d5dc0-67c7-5a39-8901-a1c69a876b82", "parentControlId": 31435, "controlId": "T1134.003", "title": "T1134.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585441" }, { "id": 574654, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41c4e15c-e9ed-507e-b255-feeb590b30e6", "parentControlId": 31435, "controlId": "T1134.005", "title": "T1134.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585441" }, { "id": 574655, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bc9092d-0212-5b9c-b60e-ee739eacec5c", "parentControlId": 31435, "controlId": "T1136", "title": "T1136", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585441" }, { "id": 574656, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d66eba68-52f0-5529-bd46-24f7300c7d5c", "parentControlId": 31435, "controlId": "T1136.001", "title": "T1136.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585441" }, { "id": 574657, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a320794b-f2fa-5188-96e1-dfb175455f03", "parentControlId": 31435, "controlId": "T1136.002", "title": "T1136.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585441" }, { "id": 574658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4f0eb96-4913-59af-948f-4230a85ae899", "parentControlId": 31435, "controlId": "T1136.003", "title": "T1136.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585441" }, { "id": 574659, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65e93869-f7fa-5840-97f2-c3c1cd51269e", "parentControlId": 31435, "controlId": "T1185", "title": "T1185", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585442" }, { "id": 574660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6319759-2615-522f-bd9f-9e9719537092", "parentControlId": 31435, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585442" }, { "id": 574661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d12d210c-a489-5b91-89c9-bbc0e52aa1f2", "parentControlId": 31435, "controlId": "T1197", "title": "T1197", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585442" }, { "id": 574662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8faacd29-7c3a-50b1-952e-a74880b52d10", "parentControlId": 31435, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585442" }, { "id": 574663, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa97e3bc-aac6-5957-adbe-0e7230bcd20e", "parentControlId": 31435, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585442" }, { "id": 574664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72bab594-9eb0-5ac2-bc02-25da984f90e0", "parentControlId": 31435, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585442" }, { "id": 574665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd03ac53-b77e-577d-978f-b5f79fa2a0ed", "parentControlId": 31435, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585442" }, { "id": 574666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "794e423a-ac57-5ed4-b927-958e27926005", "parentControlId": 31435, "controlId": "T1213.003", "title": "T1213.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585442" }, { "id": 574667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a6bb546-bf49-5ed5-a400-8aaf56f1d3d1", "parentControlId": 31435, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585443" }, { "id": 574668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b749a488-d431-593c-93b1-1343728e98ac", "parentControlId": 31435, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585443" }, { "id": 574669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "935bd39b-38f4-5c73-9828-96fdd7327126", "parentControlId": 31435, "controlId": "T1218.007", "title": "T1218.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585443" }, { "id": 574670, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e02c176d-83f5-50cb-8f36-52b29c63d5f2", "parentControlId": 31435, "controlId": "T1222", "title": "T1222", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585443" }, { "id": 574671, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86253294-1560-5631-84cd-e7feb713e1e6", "parentControlId": 31435, "controlId": "T1222.001", "title": "T1222.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585443" }, { "id": 574672, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b08a30f-eca9-5b85-88e8-02b10666ebfc", "parentControlId": 31435, "controlId": "T1222.002", "title": "T1222.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585443" }, { "id": 574673, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86ed88eb-0a73-5e1c-87e5-217533ff73af", "parentControlId": 31435, "controlId": "T1484", "title": "T1484", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585443" }, { "id": 574674, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0985cbca-d045-5143-9e60-39b7e2b97398", "parentControlId": 31435, "controlId": "T1489", "title": "T1489", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585443" }, { "id": 574675, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9356b2a-d4b3-537c-90ce-81d7638eca75", "parentControlId": 31435, "controlId": "T1495", "title": "T1495", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585443" }, { "id": 574676, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585444", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7e2d9e7-dc09-5f6e-ae4d-38802ee8e041", "parentControlId": 31435, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585444" }, { "id": 574677, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585444", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b3039fb-065f-5ff2-91a8-af63de031a36", "parentControlId": 31435, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585444" }, { "id": 574678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585444", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2afd665a-4bb1-5480-9017-b2b3304da4f8", "parentControlId": 31435, "controlId": "T1505.003", "title": "T1505.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585444" }, { "id": 574679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585444", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31ddc78f-55b7-5f41-b849-83c484c17686", "parentControlId": 31435, "controlId": "T1505.005", "title": "T1505.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585444" }, { "id": 574680, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585444", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "020fb967-d32c-57a4-8fdf-04a775c954b3", "parentControlId": 31435, "controlId": "T1525", "title": "T1525", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585444" }, { "id": 574681, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585444", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff650db8-5a9b-5850-a5e8-ead957db5679", "parentControlId": 31435, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585444" }, { "id": 574682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585444", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4380d75-ddea-5b54-92fc-4f7aff9cf224", "parentControlId": 31435, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585444" }, { "id": 574683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585444", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f717354d-ae74-5045-a6c1-6206fdfda0a9", "parentControlId": 31435, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585444" }, { "id": 574684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585444", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "999ee877-9e3e-5395-b1fb-b7778d1cea22", "parentControlId": 31435, "controlId": "T1538", "title": "T1538", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585444" }, { "id": 574685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ac06241-aa66-5b6e-9149-c0c14a43299a", "parentControlId": 31435, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585445" }, { "id": 574686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3bdb05e-5b6c-5d42-a925-1020e88a3bba", "parentControlId": 31435, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585445" }, { "id": 574687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "276fa6fc-9e8f-59c9-bf7a-0e08fc8a44f3", "parentControlId": 31435, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585445" }, { "id": 574688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9bb382cb-d79c-5517-9f06-89c20f52245f", "parentControlId": 31435, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585445" }, { "id": 574689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75e417bd-9861-5f32-91f2-3087c7c2fcf5", "parentControlId": 31435, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585445" }, { "id": 574690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24e83f33-1bc9-5896-a0c8-0f3417fbc4a6", "parentControlId": 31435, "controlId": "T1543.001", "title": "T1543.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585445" }, { "id": 574691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "610ce796-8500-5c86-8d08-21d087a231e6", "parentControlId": 31435, "controlId": "T1543.002", "title": "T1543.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585445" }, { "id": 574692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1dc8fc5e-4b27-50d8-badc-78b55b7fa5c3", "parentControlId": 31435, "controlId": "T1543.003", "title": "T1543.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585445" }, { "id": 574693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d81d8f91-6527-5828-8861-eca5229b7482", "parentControlId": 31435, "controlId": "T1543.004", "title": "T1543.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585446" }, { "id": 574694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81765040-534d-5e98-82e6-89cf73e84f71", "parentControlId": 31435, "controlId": "T1543.005", "title": "T1543.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585446" }, { "id": 574695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d0fc140-4bdd-51b2-8f9d-864a9c36f6fd", "parentControlId": 31435, "controlId": "T1546.003", "title": "T1546.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585446" }, { "id": 574696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56f4cc2d-aa11-5448-9e51-e481cbe75e7a", "parentControlId": 31435, "controlId": "T1547.004", "title": "T1547.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585446" }, { "id": 574697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2017b499-0794-5249-9a75-705fd2d18b20", "parentControlId": 31435, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585446" }, { "id": 574698, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02f59756-4644-52d4-9ae8-a6b355392a37", "parentControlId": 31435, "controlId": "T1547.009", "title": "T1547.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585446" }, { "id": 574699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a74bba5-3c1a-5aaa-957b-b9aea63acb21", "parentControlId": 31435, "controlId": "T1547.012", "title": "T1547.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585446" }, { "id": 574700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "722a7aa3-dab4-565a-a1ff-90743ba41e44", "parentControlId": 31435, "controlId": "T1547.013", "title": "T1547.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585446" }, { "id": 574701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3f5df0a-3b49-57bd-ae31-efb6a114927a", "parentControlId": 31435, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585446" }, { "id": 574702, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585447", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c97cc1d2-51f8-5aec-ba1b-1f88847bc56d", "parentControlId": 31435, "controlId": "T1548.002", "title": "T1548.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585447" }, { "id": 574703, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585447", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afb8c855-cdd1-59e8-8f39-53b4f887f203", "parentControlId": 31435, "controlId": "T1548.003", "title": "T1548.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585447" }, { "id": 574704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585447", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6472cf23-6739-5e47-a79a-a664aef43595", "parentControlId": 31435, "controlId": "T1548.006", "title": "T1548.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585447" }, { "id": 574705, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585447", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ddf2f80-9540-5971-a745-803833d11e63", "parentControlId": 31435, "controlId": "T1550", "title": "T1550", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585447" }, { "id": 574706, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585447", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56c0716d-e269-5f29-8087-8afd8e76d3aa", "parentControlId": 31435, "controlId": "T1550.002", "title": "T1550.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585447" }, { "id": 574707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585447", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6a6968a-d519-59eb-a2d1-825e00dfdede", "parentControlId": 31435, "controlId": "T1550.003", "title": "T1550.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585447" }, { "id": 574708, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585447", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54a20af6-abe1-5ee2-a687-b4af3af4266c", "parentControlId": 31435, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585447" }, { "id": 574709, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585447", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86f1f64c-3286-5567-82ed-0f3e9c977b12", "parentControlId": 31435, "controlId": "T1552.001", "title": "T1552.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585447" }, { "id": 574710, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585447", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ecc8e4e-f8ad-5db8-b31e-9e81eb9b76aa", "parentControlId": 31435, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585447" }, { "id": 574711, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29f1121b-1bdd-5f48-b5a8-7cd330fb70c1", "parentControlId": 31435, "controlId": "T1552.006", "title": "T1552.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585448" }, { "id": 574712, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "adfe5648-c7cc-537b-b509-9fdcb84a9db6", "parentControlId": 31435, "controlId": "T1552.007", "title": "T1552.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585448" }, { "id": 574713, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6c1c5fc-129d-583e-be4b-524ae8377578", "parentControlId": 31435, "controlId": "T1556", "title": "T1556", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585448" }, { "id": 574714, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3545e10-21bc-56d5-9a2c-34370889f2f4", "parentControlId": 31435, "controlId": "T1556.001", "title": "T1556.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585448" }, { "id": 574715, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a615dce-3bcc-5a24-ac3a-c061413e81b6", "parentControlId": 31435, "controlId": "T1556.003", "title": "T1556.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585448" }, { "id": 574716, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "350e15fb-fef3-54a5-86b2-7cdf8f28b4c3", "parentControlId": 31435, "controlId": "T1556.004", "title": "T1556.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585448" }, { "id": 574717, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c1e77d5-564e-5415-8c1f-6be2047689e4", "parentControlId": 31435, "controlId": "T1556.005", "title": "T1556.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585448" }, { "id": 574718, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a989246b-8e97-5557-8d4a-6357a3787721", "parentControlId": 31435, "controlId": "T1556.009", "title": "T1556.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585449" }, { "id": 574719, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fa0a3a5-da4e-5e91-85ba-2d8c7e956ca9", "parentControlId": 31435, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585449" }, { "id": 574720, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66c95aeb-cfbb-5767-90d3-1621e992fd9d", "parentControlId": 31435, "controlId": "T1558.001", "title": "T1558.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585449" }, { "id": 574721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "281892a3-4496-5d9c-8610-9e2b80a7cf41", "parentControlId": 31435, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585449" }, { "id": 574722, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fa0c4fd-a092-54bd-b7cc-607df9771fa5", "parentControlId": 31435, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585449" }, { "id": 574723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1aec27ab-5b84-5637-8af5-f86a51ea1471", "parentControlId": 31435, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585449" }, { "id": 574724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e2349e6-e426-5a0b-afcd-3a094b2267fa", "parentControlId": 31435, "controlId": "T1559.001", "title": "T1559.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585449" }, { "id": 574725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c72d3e85-3b73-5f14-b36b-4e1875cab9da", "parentControlId": 31435, "controlId": "T1562", "title": "T1562", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585449" }, { "id": 574726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f2e64c8-4198-566f-88b5-32ce5a9130cf", "parentControlId": 31435, "controlId": "T1562.001", "title": "T1562.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585449" }, { "id": 574727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65a43e95-c576-5135-bafb-ad0e1886b8b2", "parentControlId": 31435, "controlId": "T1562.002", "title": "T1562.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585449" }, { "id": 574728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58545", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03db731e-70cf-5f37-b6d5-dbbf8579bc32", "parentControlId": 31435, "controlId": "T1562.004", "title": "T1562.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58545" }, { "id": 574729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58545", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "858f694e-5436-5318-9891-3ac1d86501af", "parentControlId": 31435, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58545" }, { "id": 574730, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58545", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4788660c-68ad-5d91-b8e5-b126bb4fc4de", "parentControlId": 31435, "controlId": "T1562.007", "title": "T1562.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58545" }, { "id": 574731, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58545", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37f59413-9ee6-55c1-9286-28114338e282", "parentControlId": 31435, "controlId": "T1562.008", "title": "T1562.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58545" }, { "id": 574732, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58545", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6c47154-5032-56dc-9823-9fba8ffd3422", "parentControlId": 31435, "controlId": "T1562.009", "title": "T1562.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58545" }, { "id": 574733, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58545", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5c276be-1fee-5831-987d-6a9a31765b49", "parentControlId": 31435, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58545" }, { "id": 574734, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58545", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12481377-525e-5e29-9868-e536b399025b", "parentControlId": 31435, "controlId": "T1563.001", "title": "T1563.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58545" }, { "id": 574735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58545", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93084158-e890-5c12-aaa1-de4cd36afc4d", "parentControlId": 31435, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58545" }, { "id": 574736, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58545", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1eb04a51-984f-568d-bd85-6d1dd85e049e", "parentControlId": 31435, "controlId": "T1569", "title": "T1569", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58545" }, { "id": 574737, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2305d996-9dfc-5c27-9dd3-a8006b8df2df", "parentControlId": 31435, "controlId": "T1569.001", "title": "T1569.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585451" }, { "id": 574738, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83699fa0-df66-5ca5-a600-1ba504726f92", "parentControlId": 31435, "controlId": "T1569.002", "title": "T1569.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585451" }, { "id": 574739, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c703e4e-3484-50bf-9eac-bd04879a945e", "parentControlId": 31435, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585451" }, { "id": 574740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b2f90a3-0470-5953-a4fa-00deeff1a558", "parentControlId": 31435, "controlId": "T1574.004", "title": "T1574.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585451" }, { "id": 574741, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95f041c1-89f9-574d-9f14-8fb7a8f07254", "parentControlId": 31435, "controlId": "T1574.005", "title": "T1574.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585451" }, { "id": 574742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb3978b3-2dc0-5cec-8e20-088a17e46dbe", "parentControlId": 31435, "controlId": "T1574.007", "title": "T1574.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585451" }, { "id": 574743, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1983b663-f555-579c-8385-04c2f2a0dd1c", "parentControlId": 31435, "controlId": "T1574.008", "title": "T1574.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585451" }, { "id": 574744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "910ab044-fa4a-5de4-8125-062f8c0531d8", "parentControlId": 31435, "controlId": "T1574.009", "title": "T1574.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585451" }, { "id": 574745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db70c439-652e-59b6-9a9b-fa94db3824d4", "parentControlId": 31435, "controlId": "T1574.010", "title": "T1574.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585452" }, { "id": 574746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d439990-2c26-58c9-b93b-64984c0c1912", "parentControlId": 31435, "controlId": "T1574.012", "title": "T1574.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585452" }, { "id": 574747, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e287f4c1-cd5c-5c70-8b05-c5acba190c75", "parentControlId": 31435, "controlId": "T1578", "title": "T1578", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585452" }, { "id": 574748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb025ebb-f4c4-52e1-8da7-3822e61282bd", "parentControlId": 31435, "controlId": "T1578.001", "title": "T1578.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585452" }, { "id": 574749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5ab7392-101f-5392-afe2-878d348c5785", "parentControlId": 31435, "controlId": "T1578.002", "title": "T1578.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585452" }, { "id": 574750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0948293f-2326-53aa-a217-aea447d8636f", "parentControlId": 31435, "controlId": "T1578.003", "title": "T1578.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585452" }, { "id": 574751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03d54cfa-ccba-56c5-9b3c-1aea8f7d6318", "parentControlId": 31435, "controlId": "T1580", "title": "T1580", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585452" }, { "id": 574752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75798a1f-765e-5d90-9585-53c1609ee8c2", "parentControlId": 31435, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585452" }, { "id": 574753, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23544b5b-b844-5bc5-a776-04ea3894034a", "parentControlId": 31435, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585452" }, { "id": 574754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdeb9271-5f65-5c1d-b2bc-d4dc53a1149d", "parentControlId": 31435, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585453" }, { "id": 574755, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a24a352-303c-5837-8192-b98110002cec", "parentControlId": 31435, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585453" }, { "id": 574756, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9280bb2b-e610-52f6-9e42-fe4c42bc79c9", "parentControlId": 31435, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585453" }, { "id": 574757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1553b6e-ac0d-56e4-9243-4a59eb87be41", "parentControlId": 31435, "controlId": "T1606", "title": "T1606", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585453" }, { "id": 574758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c8ce9dd-f833-58db-93ed-936ee4791524", "parentControlId": 31435, "controlId": "T1609", "title": "T1609", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585453" }, { "id": 574759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ccf0711-3071-53eb-a757-8fac17f2dc2d", "parentControlId": 31435, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585453" }, { "id": 574760, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8580535b-6bdd-511a-902b-984c326e9ca8", "parentControlId": 31435, "controlId": "T1619", "title": "T1619", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585453" }, { "id": 574761, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5779e0ef-3b13-5cda-8c7d-ffcc2041d662", "parentControlId": 31435, "controlId": "T1657", "title": "T1657", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585453" }, { "id": 574767, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585454", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d8d0e67-cb97-5671-a55b-3900de55fa29", "parentControlId": 31435, "controlId": "AC-5", "title": "AC-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585454" }, { "id": 574768, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585454", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fd85873-ce96-5747-bec8-264cac7be8f3", "parentControlId": 31435, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585454" }, { "id": 574770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585454", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d015376-bbea-5f8d-9554-d9c93501ab0f", "parentControlId": 31435, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585454" }, { "id": 574771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d62d63a-5b31-5c20-9a01-13dd1106ab60", "parentControlId": 31435, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585455" }, { "id": 574772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37a1edbb-f278-5c76-9bdb-ecf5f01785d1", "parentControlId": 31435, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585455" }, { "id": 574773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a637ff56-4242-5c4d-a9dd-f0ae60a7090f", "parentControlId": 31435, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585455" }, { "id": 574774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a2e9329-8963-5fe7-8c45-f5e2310c5b09", "parentControlId": 31435, "controlId": "AC-5", "title": "AC-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585455" }, { "id": 574775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b41c681-a564-5c96-b853-4f3423cdf0d0", "parentControlId": 31435, "controlId": "AC-5", "title": "AC-5", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585455" }, { "id": 574778, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f9af9b1-abd4-5315-8128-7ca76c52c283", "parentControlId": 31435, "controlId": "3.1.4", "title": "3.1.4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585455" }, { "id": 574779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "936fef72-80f5-57fc-8fdb-f2f94a52f1ee", "parentControlId": 31435, "controlId": "03.01.04.a", "title": "03.01.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585455" }, { "id": 574784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585456", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c276bb8-8d69-5bbb-b423-7cb1d62395de", "parentControlId": 31435, "controlId": "PR.AA-05", "title": "PR.AA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585456" }, { "id": 574790, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585457", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45512940-0b0b-56c6-9374-3988ae062e45", "parentControlId": 31435, "controlId": "ACCESS-2e", "title": "ACCESS-2e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585457" }, { "id": 574791, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585457", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e886ba03-73dc-5884-8c5a-80f697fe6f62", "parentControlId": 31435, "controlId": "ACCESS-3f", "title": "ACCESS-3f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585457" }, { "controlId": "B.1.5", "title": "B.1.5 — Separation of Functions", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "49cd19ae-37c5-51e9-a75a-26ec43239091", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.5", "title": "NEI 08-09 App D.1.5 — Separation of Functions", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "25a5507d-568f-5895-8666-3047539f3341", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "7f1747ed-6ebf-58f1-bd41-2d6942a3c803", "isPublic": true }, { "controlId": "NSS-42G-Sec4.4", "title": "NSS-42G-Sec4.4 — Trustworthiness, Fitness-for-Duty & Insider Threat Mitigation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d3b16e8e-2e2e-5228-8064-70d093d1bd71", "isPublic": true }, { "controlId": "IEC-63096-7.1", "title": "IEC-63096-7.1 — Human Resource Security & Background Vetting (Access Authorization)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "b9be4998-e317-5f3a-8a84-adaf0402ccc1", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP4", "title": "ONR-SyAP-FSyP4 — Personnel Security & Trustworthiness", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "95e39d33-2a9b-56f4-94cc-7972603bbfd8", "isPublic": true } ], "id": 31435, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731084", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731084", "catalogueId": 1062, "uuid": "b30f0e0a-60d2-513d-b2bc-938cf2984a3e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Separation of Duties (SoD)", "description": "

Control Description

Mechanisms exist to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion.

Evidence Request List (ERL)

E-HRS-25

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ The HR department, in conjunction with IT and/or cybersecurity personnel, implements and maintains Separation of Duties (SoD) to prevent potential malevolent activity without collusion.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.5", "controlId": "HRS-11", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-11", "references": "

Micro-Small Business (<10 staff)

∙ Documented / assigned Separation of Duties (SoD)

Small Business (10-49 staff)

∙ Documented / assigned Separation of Duties (SoD)

Medium Business (50-249 staff)

∙ Documented / assigned Separation of Duties (SoD)

Large Business (250-999 staff)

∙ Documented / assigned Separation of Duties (SoD)

Enterprise (>1,000 staff)

∙ Documented / assigned Separation of Duties (SoD)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71542, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590544", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590544", "securityControlId": 31436, "ccis": [], "uuid": "d7f0c70b-74b5-5604-87d1-9a0be5830bef", "testId": "HRS-11_A04", "test": "duties of individuals requiring separation are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.04.a", "defaultText": null }, { "id": 71543, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590544", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590544", "securityControlId": 31436, "ccis": [], "uuid": "08cfeb8d-8b47-5dbc-85fb-da1e24ba57d7", "testId": "HRS-12_A01", "test": "incompatible development-specific roles are prevented through limiting and reviewing developer privileges to change hardware, software and firmware components within a production/operational environment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 574834, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06574ecb-e422-51b1-8533-56941bd90116", "parentControlId": 31436, "controlId": "5.3", "title": "5.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585462" }, { "id": 574837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc82b46b-557d-5696-b650-3f7fba58fd3d", "parentControlId": 31436, "controlId": "03.01.04.a", "title": "03.01.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585462" }, { "controlId": "NSS-42G-Sec4.4", "title": "NSS-42G-Sec4.4 — Trustworthiness, Fitness-for-Duty & Insider Threat Mitigation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7aeb2613-9442-535b-9777-466c146c7020", "isPublic": true }, { "controlId": "IEC-63096-7.1", "title": "IEC-63096-7.1 — Human Resource Security & Background Vetting (Access Authorization)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "3794b2c2-b344-50d8-bad5-36d260671996", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP4", "title": "ONR-SyAP-FSyP4 — Personnel Security & Trustworthiness", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "357cfb2d-d1d9-5eff-a296-24b23d8a8600", "isPublic": true } ], "id": 31436, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731084", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731084", "catalogueId": 1062, "uuid": "9fa2e3ba-c533-5b7d-bf74-d2c27ea37440", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization avoid incompatible development-specific roles through limiting and reviewing developer privileges to change hardware, software and firmware components within a production/operational environment?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Incompatible Roles", "description": "

Control Description

Mechanisms exist to avoid incompatible development-specific roles through limiting and reviewing developer privileges to change hardware, software and firmware components within a production/operational environment.

Evidence Request List (ERL)

E-HRS-25

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ The HR department, in conjunction with IT and/or cybersecurity personnel, evaluates risk for individuals requiring elevated privileges or access to sensitive/regulated data.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to avoid incompatible development-specific roles through limiting and reviewing developer privileges to change hardware, software and firmware components within a production/operational environment.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-12", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-12", "references": "

Micro-Small Business (<10 staff)

∙ Employee security policy acknowledgment\n∙ Background check for sensitive roles

Small Business (10-49 staff)

∙ Security awareness policy\n∙ Background checks\n∙ Security onboarding checklist

Medium Business (50-249 staff)

∙ HR security program\n∙ Background checks for all staff\n∙ Security onboarding training

Large Business (250-999 staff)

∙ Enterprise HR security program\n∙ Background screening service\n∙ Automated offboarding workflows

Enterprise (>1,000 staff)

∙ Enterprise HR security framework\n∙ Background screening platform\n∙ Integrated HR/IAM offboarding\n∙ Continuous monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71544, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590545", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590545", "securityControlId": 31437, "ccis": [], "uuid": "7fc93c40-d148-5f32-9851-27acbac46ba8", "testId": "HRS-12.1_A01", "test": "privileged commands and/or other actions requiring dual authorization are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-03(02)_ODP", "defaultText": null }, { "id": 71545, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590545", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590545", "securityControlId": 31437, "ccis": [], "uuid": "6aad187e-7823-5ae3-b08c-b94b3568a326", "testId": "HRS-12.1_A02", "test": "dual authorization is enforced for organization-defined privileged commands and/or other actions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-03(02)", "defaultText": null }, { "id": 71546, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590545", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590545", "securityControlId": 31437, "ccis": [], "uuid": "423225cd-4da5-5ab3-b15a-a58e77ba410f", "testId": "HRS-12.1_A03", "test": "critical or sensitive system and organizational operations for which dual authorization is to be enforced are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.1.1e[a]\n53A_R5_CM-05(04)_ODP[01]", "defaultText": null }, { "id": 71547, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590545", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590545", "securityControlId": 31437, "ccis": [], "uuid": "3017d53c-868e-57cb-9df4-0d3c5f3b33d2", "testId": "HRS-12.1_A04", "test": "dual authorization is employed to execute critical or sensitive system and organizational operations.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.1.1e[b]\n53A_R5_CM-05(04)[01]\n53A_R5_CM-05(04)[02]", "defaultText": null } ], "externalMappings": [ { "id": 574841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d2829cd-cff1-5a28-9452-0f938728b7c5", "parentControlId": 31437, "controlId": "AC-3(2)", "title": "AC-3(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585463" }, { "id": 574842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1ba0119-c1f9-570c-8064-ee20aa94380a", "parentControlId": 31437, "controlId": "AC-03(02)", "title": "AC-03(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585463" }, { "id": 574844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5c413e1-c849-5109-82f9-249f2eb16ecb", "parentControlId": 31437, "controlId": "AC-03(02)", "title": "AC-03(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585463" } ], "id": 31437, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731085", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731085", "catalogueId": 1062, "uuid": "3ac3ee99-771e-5854-be88-ab929ec89775", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce a two-person rule for implementing changes to sensitive Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Two-Person Rule", "description": "

Control Description

Mechanisms exist to enforce a two-person rule for implementing changes to sensitive Technology Assets, Applications and/or Services (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enforce a two-person rule for implementing changes to sensitive Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-12.1", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-12.1", "references": "

Micro-Small Business (<10 staff)

∙ Employee security policy acknowledgment\n∙ Background check for sensitive roles

Small Business (10-49 staff)

∙ Security awareness policy\n∙ Background checks\n∙ Security onboarding checklist

Medium Business (50-249 staff)

∙ HR security program\n∙ Background checks for all staff\n∙ Security onboarding training

Large Business (250-999 staff)

∙ Enterprise HR security program\n∙ Background screening service\n∙ Automated offboarding workflows

Enterprise (>1,000 staff)

∙ Enterprise HR security framework\n∙ Background screening platform\n∙ Integrated HR/IAM offboarding\n∙ Continuous monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71548, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590546", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590546", "securityControlId": 31438, "ccis": [], "uuid": "e98b2851-f17c-5e0c-8110-876738b21bba", "testId": "HRS-13_A01", "test": "critical cybersecurity / data privacy skills needed to support the organization's mission are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71549, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590546", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590546", "securityControlId": 31438, "ccis": [], "uuid": "03f7e477-02b3-5d0c-bfca-25590284e26f", "testId": "HRS-13_A02", "test": "gaps / shortfalls in identified critical cybersecurity / data privacy skills needed to support the organization's mission are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 574857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "268a7472-0c28-58d7-b312-9a827197d26d", "parentControlId": 31438, "controlId": "WORKFORCE-4b", "title": "WORKFORCE-4b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585464" }, { "id": 574858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02d86181-fc06-510a-a818-93345e975427", "parentControlId": 31438, "controlId": "WORKFORCE-4c", "title": "WORKFORCE-4c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585464" }, { "controlId": "NSS-42G-Sec4.4", "title": "NSS-42G-Sec4.4 — Trustworthiness, Fitness-for-Duty & Insider Threat Mitigation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "39f918ec-501d-5694-9b66-2000c49b5fdb", "isPublic": true }, { "controlId": "IEC-63096-7.1", "title": "IEC-63096-7.1 — Human Resource Security & Background Vetting (Access Authorization)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "a7649ce7-fc77-5390-a62c-69232015054b", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP4", "title": "ONR-SyAP-FSyP4 — Personnel Security & Trustworthiness", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (HRS Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "792a6787-a019-56b5-aac7-742fde952586", "isPublic": true } ], "id": 31438, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731085", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731085", "catalogueId": 1062, "uuid": "a29ca286-b3d7-5743-8c65-1e824299381c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization evaluate the critical security, compliance and resilience skills needed to support the organization's mission and identify gaps that exist?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Identify Critical Skills & Gaps", "description": "

Control Description

Mechanisms exist to evaluate the critical security, compliance and resilience skills needed to support the organization's mission and identify gaps that exist.

Evidence Request List (ERL)

E-HRS-23\nE-HRS-24

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Human Resources Security (HRS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with HRS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Personnel management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ The Human Resources (HR) department provides guidance on secure HR practices for hiring, retaining and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ HR, in conjunction with IT and/or cybersecurity personnel, evaluates the business-critical cybersecurity and data protection skills needed to support the organization's mission.\n▪ HR, in conjunction with IT and/or cybersecurity personnel, identifies vital cybersecurity and data privacy staff and identify gaps that exist.\n▪ HR, in conjunction with IT and/or cybersecurity personnel, establishes redundancy for vital cybersecurity and data privacy staff.

Level 2 - Planned & Tracked: Human Resources Security (HRS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Personnel management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Personnel management is decentralized at a localized/regionalized function, where there are non-standardized methods to govern personnel matters across the organization.\n▪ Localized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization.\n▪ The HR department, in conjunction with IT and/or cybersecurity personnel, evaluates the business-critical cybersecurity and data protection skills needed to support the organization's mission and identify gaps that exist.

Level 3 - Well Defined: Human Resources Security (HRS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with HRS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with HRS domain capabilities are well-documented and kept current by process owners.\n▪ A Human Resources (HR) team, or similar function, is appropriately staffed and supported to implement and maintain HRS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of human resources security operations (e.g., personnel management software solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with HRS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to evaluate the critical security, compliance and resilience skills needed to support the organization's mission and identify gaps that exist.

Level 4 - Quantitatively Controlled: Human Resources Security (HRS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "HRS-13", "family": "Human Resources Security", "enhancements": "", "sortId": "HRS-13", "references": "

Micro-Small Business (<10 staff)

∙ Employee security policy acknowledgment\n∙ Background check for sensitive roles

Small Business (10-49 staff)

∙ Security awareness policy\n∙ Background checks\n∙ Security onboarding checklist

Medium Business (50-249 staff)

∙ Identification of critical skills per team/department\n∙ Formal assessment to identify skills gaps

Large Business (250-999 staff)

∙ Identification of critical skills per team/department\n∙ Formal assessment to identify skills gaps

Enterprise (>1,000 staff)

∙ Identification of critical skills per team/department\n∙ Formal assessment to identify skills gaps", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71560, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590548", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590548", "securityControlId": 31446, "ccis": [], "uuid": "bbdeb17d-190e-536a-a5aa-ea696f20fb37", "testId": "IAC-01_A01", "test": "a capability to govern logical identification and access management controls is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71561, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590548", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590548", "securityControlId": 31446, "ccis": [], "uuid": "b0007d98-2a78-50a8-b53f-98131342777d", "testId": "IAC-01_A02", "test": "the Identity & Access Management (IAM) program is organization-wide.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-01_ODP[03]", "defaultText": null }, { "id": 71562, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590549", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590549", "securityControlId": 31446, "ccis": [], "uuid": "7ac9070c-3378-5604-b64f-71641b3b5365", "testId": "IAC-01_A03", "test": "Identity and Access Management (IAM) operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71563, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59055", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59055", "securityControlId": 31446, "ccis": [], "uuid": "05194f96-94a9-5807-8d67-3a72f99e50fd", "testId": "IAC-01_A04", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support Identity and Access Management (IAM) operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71564, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59055", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59055", "securityControlId": 31446, "ccis": [], "uuid": "16964458-f45a-5699-a42a-433c2f7c2dd8", "testId": "IAC-01_A05", "test": "responsibility and authority for the performance of Identity and Access Management (IAM)-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71565, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59055", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59055", "securityControlId": 31446, "ccis": [], "uuid": "5ac91b21-e8b5-5a50-b076-c6d5b7e7ff91", "testId": "IAC-01_A06", "test": "personnel performing Identity and Access Management (IAM)-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 574931, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ec13869-6d02-5f08-8a28-41247f8396f1", "parentControlId": 31446, "controlId": "USER 1.1", "title": "USER 1.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585482" }, { "id": 574932, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2c0f395-48bc-57ee-931a-57df7d75e28d", "parentControlId": 31446, "controlId": "CR 1.3", "title": "CR 1.3", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585482" }, { "id": 574933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e701a1f8-d953-57b2-adf7-6b7294d57558", "parentControlId": 31446, "controlId": "5.15", "title": "5.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585482" }, { "id": 574934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10e97e82-0c8a-57b0-a7d2-2922cac83158", "parentControlId": 31446, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585482" }, { "id": 574945, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b0e42dd-e063-5c5a-b74b-7195dffd3f5a", "parentControlId": 31446, "controlId": "AC-1", "title": "AC-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585484" }, { "id": 574946, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e172d53-fcdc-572d-8e9a-618a2a3de081", "parentControlId": 31446, "controlId": "IA-1", "title": "IA-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585484" }, { "id": 574947, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73aa8fe3-26f9-55bf-aef6-508af2e860ce", "parentControlId": 31446, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585484" }, { "id": 574948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d103d1c4-7a08-5d34-b4ac-f7ddd198ea40", "parentControlId": 31446, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585484" }, { "id": 574951, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585485", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d1c8b37-1d8f-5bf5-bac8-cc63bbece301", "parentControlId": 31446, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585485" }, { "id": 574952, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585485", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3347908b-af59-55f3-abe7-442dbf2a3bbe", "parentControlId": 31446, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585485" }, { "id": 574957, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585485", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10241b22-fabb-5481-b651-3caa7c3c4102", "parentControlId": 31446, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585485" }, { "id": 574958, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585485", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4927db41-e44c-5cda-aaa2-e37a98acfd47", "parentControlId": 31446, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585485" }, { "id": 574959, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585485", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d864077-87f6-5013-a475-5badebb7d664", "parentControlId": 31446, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585485" }, { "id": 574960, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585486", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce497f52-8587-507d-b19e-8fa74bd8ffb6", "parentControlId": 31446, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585486" }, { "id": 574961, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585486", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5772ced9-5d43-5d41-87cc-632928a1576b", "parentControlId": 31446, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585486" }, { "id": 574962, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585486", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "853617a4-71d1-55b1-9727-bb4e7783872b", "parentControlId": 31446, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585486" }, { "id": 574963, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585486", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e54eaa37-85ff-5e86-8fe2-b1cd8c6f3f0a", "parentControlId": 31446, "controlId": "AC-01", "title": "AC-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585486" }, { "id": 574964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585486", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ba2c510-e0eb-5ea9-9e85-dd71a22f1e21", "parentControlId": 31446, "controlId": "IA-01", "title": "IA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585486" }, { "id": 574965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585486", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a0e6ea3-9c0c-5ad8-80f0-1333709c41a5", "parentControlId": 31446, "controlId": "AC-1", "title": "AC-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585486" }, { "id": 574966, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585486", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "becef86a-6656-56df-9205-0e14a22864e8", "parentControlId": 31446, "controlId": "IA-1", "title": "IA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585486" }, { "id": 574967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585486", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5137c6fb-6b3f-55a2-8b4d-038d8fe70048", "parentControlId": 31446, "controlId": "AC-1", "title": "AC-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585486" }, { "id": 574968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585487", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c22fcabb-bf00-5ac8-947d-596ab6653305", "parentControlId": 31446, "controlId": "IA-1", "title": "IA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585487" }, { "id": 574969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585487", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a792b0f7-2e22-5d78-97de-f6faf52bb912", "parentControlId": 31446, "controlId": "AC-1", "title": "AC-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585487" }, { "id": 574976, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585487", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0899c839-058f-547b-ac2e-2ad6a4ec818e", "parentControlId": 31446, "controlId": "3.1.1", "title": "3.1.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585487" }, { "id": 574977, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35af52af-1ca3-553e-b93b-2c5a867f9d11", "parentControlId": 31446, "controlId": "NFO - AC-1", "title": "NFO - AC-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585488" }, { "id": 574978, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f1f35a9-e979-5996-9335-7a34b6ad646b", "parentControlId": 31446, "controlId": "NFO - IA-1", "title": "NFO - IA-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585488" }, { "id": 574979, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c18f5a23-786a-58e9-a29d-713a4fb8cd5a", "parentControlId": 31446, "controlId": "03.01.01.a", "title": "03.01.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585488" }, { "id": 574980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d3b2818-13d8-512b-bd23-cc1c5146b41c", "parentControlId": 31446, "controlId": "03.01.18.b", "title": "03.01.18.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585488" }, { "id": 574981, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "633db2d9-b659-5aea-a847-b92f5d26f481", "parentControlId": 31446, "controlId": "03.05.01.a", "title": "03.05.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585488" }, { "id": 574982, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1fba918-d1a4-584f-b4e3-a6e96cb81a7c", "parentControlId": 31446, "controlId": "03.05.05.a", "title": "03.05.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585488" }, { "id": 574983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "594820bd-95b3-5ddb-956c-b0c1b5d393aa", "parentControlId": 31446, "controlId": "03.05.12.e", "title": "03.05.12.e", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585488" }, { "id": 574985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9203995e-f382-545b-82a8-882b512d4374", "parentControlId": 31446, "controlId": "PR.AA", "title": "PR.AA", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585488" }, { "id": 574986, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585489", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "409e81a3-3967-5bf1-b7d8-6d47368c0dfb", "parentControlId": 31446, "controlId": "PR.AA-05", "title": "PR.AA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585489" }, { "id": 575058, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585497", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae703cde-6751-5646-81fd-5985ecc0fe44", "parentControlId": 31446, "controlId": "ACCESS-2a", "title": "ACCESS-2a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585497" }, { "id": 575059, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585497", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "135074a2-539c-5425-8c20-acc45058e232", "parentControlId": 31446, "controlId": "ACCESS-2c", "title": "ACCESS-2c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585497" }, { "id": 575060, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585497", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07b9eedc-4006-5ed3-9409-c1a56aa56fe7", "parentControlId": 31446, "controlId": "ACCESS-2f", "title": "ACCESS-2f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585497" }, { "id": 575061, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585497", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3b6c365-b7d9-5cb8-b46e-608938f1b83b", "parentControlId": 31446, "controlId": "ARCHITECTURE-3a", "title": "ARCHITECTURE-3a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585497" }, { "id": 575107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd140906-ffd5-5abb-95fe-873c65ff4696", "parentControlId": 31446, "controlId": "CIP-003-8 1.1.2", "title": "CIP-003-8 1.1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585502" }, { "id": 575108, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f61feba-d601-58a8-a68d-1e39befcfa8b", "parentControlId": 31446, "controlId": "CIP-003-8 1.2.3", "title": "CIP-003-8 1.2.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585502" }, { "id": 575109, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be7ef1e8-a3e4-5130-a483-fc05518e950b", "parentControlId": 31446, "controlId": "CIP-004-7 R4", "title": "CIP-004-7 R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585502" }, { "id": 575110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585503", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba6732c4-2baa-5a3b-ab8c-ca5e75c30861", "parentControlId": 31446, "controlId": "CIP-004-7 4.1.1", "title": "CIP-004-7 4.1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585503" }, { "id": 575111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585503", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a35d068a-d31c-58c1-ad7d-1d8c8f349e61", "parentControlId": 31446, "controlId": "CIP-004-7 R6", "title": "CIP-004-7 R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585503" }, { "id": 575112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585503", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2586c28b-0237-5bce-9388-4e3c1748c362", "parentControlId": 31446, "controlId": "CIP-007-6 5.1", "title": "CIP-007-6 5.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585503" }, { "id": 575172, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d4eb101-06a7-5587-a064-66346d1e8b8b", "parentControlId": 31446, "controlId": "B2", "title": "B2", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58551" }, { "id": 575173, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1925cf81-1bc5-5feb-ba1e-f8e93ca85139", "parentControlId": 31446, "controlId": "B2.d", "title": "B2.d", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58551" }, { "controlId": "B.1.1", "title": "B.1.1 — Access Control Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "f0ccc416-b16b-512a-a9fd-c5029c762607", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.1", "title": "NEI 08-09 App D.1.1 — Access Control Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "53892f83-6d4e-5111-abf1-51ea5cda9692", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "e940b6ae-418a-5e7b-b530-8167a82dd4b2", "isPublic": true }, { "controlId": "B.4.1", "title": "B.4.1 — Identification and Authentication Policies and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IA-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "943a4cc1-8f82-539c-9285-dfb4426949dc", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.1", "title": "NEI 08-09 App D.4.1 — Identification and Authentication Policies and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "751c94bd-131f-5441-9629-908bae1786e0", "isPublic": true }, { "controlId": "CIP-004-7-R4", "title": "CIP-004-7-R4 — Access Management Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0f6c9774-7cb3-5d91-9617-242541291e78", "isPublic": true }, { "controlId": "CIP-004-7-4.1", "title": "CIP-004-7-4.1 — Process to authorize based on need, as determined by the Responsible Entity, except for CIP Exceptional Circumstances", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8411d0df-77e8-5e09-a814-16b45dc2302e", "isPublic": true }, { "controlId": "CIP-004-7-4.1.1", "title": "CIP-004-7-4.1.1 — Electronic access", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "bd525b09-67d8-523d-9b2b-e5a4a9785f84", "isPublic": true }, { "controlId": "CIP-004-7-4.1.2", "title": "CIP-004-7-4.1.2 — Unescorted physical access into a Physical Security Perimeter", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4dcf03e0-e47e-5193-b2b3-b43df9396b1a", "isPublic": true }, { "controlId": "CIP-004-7-4.2", "title": "CIP-004-7-4.2 — Verify at least once each calendar quarter that individuals with active electronic access or unescorted physical acce...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2336aff1-ebed-57b0-8337-5de2d382b030", "isPublic": true }, { "controlId": "CIP-004-7-4.3", "title": "CIP-004-7-4.3 — For electronic access, verify at least once every 15 calendar months that all user accounts, user account groups, or...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "40f6f610-eca2-547a-82d2-49d820ac45d4", "isPublic": true }, { "controlId": "CIP-004-7-R6", "title": "CIP-004-7-R6 — Access Authorization for Transient Cyber Assets and Removable Media", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e5d8a2f6-ae73-5c5a-b495-4a5bf10f2618", "isPublic": true }, { "controlId": "CIP-004-7-6.1", "title": "CIP-004-7-6.1 — Prior to provisioning, authorize (unless already authorized according to Part 4.1.) based on need, as determined by t...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "01a84131-08ce-5b4a-85e8-514415772c90", "isPublic": true }, { "controlId": "CIP-004-7-6.1.1", "title": "CIP-004-7-6.1.1 — Provisioned electronic access to electronic BCSI", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "22bb189c-6efc-57eb-a348-478118048e58", "isPublic": true }, { "controlId": "CIP-004-7-6.1.2", "title": "CIP-004-7-6.1.2 — Provisioned physical access to physical BCSI.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f9e030dd-7430-5d6a-aa93-ada51ebdab17", "isPublic": true }, { "controlId": "CIP-004-7-6.2", "title": "CIP-004-7-6.2 — Verify at least once every 15 calendar months that all individuals with provisioned access to BCSI: 6.2.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2b5071d0-c859-5c45-96c6-db39e0835ffc", "isPublic": true }, { "controlId": "CIP-004-7-6.2.1", "title": "CIP-004-7-6.2.1 — have an authorization record", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "582cef9a-6f76-55f2-a581-98b8be37b9d5", "isPublic": true }, { "controlId": "CIP-004-7-6.2.2", "title": "CIP-004-7-6.2.2 — still need the provisioned access to perform their current work functions, as determined by the Responsible Entity.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ad53d38b-c63f-574c-b2df-bbe94291f94b", "isPublic": true }, { "controlId": "CIP-004-7-6.3", "title": "CIP-004-7-6.3 — For termination actions, remove the individual’s ability to use provisioned access to BCSI (unless already revoked ac...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5fadc08f-bf87-57fc-b9a1-6f1ce56791eb", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "9d9065a2-8ddd-5b4a-94dc-37bdeed4fb82", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "1c9cfc5c-baf1-5794-a9e4-e0c0cf088f59", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "f37c0b18-3404-5195-9c7f-33aac10c9a35", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "07c00dd6-fa94-55e0-a410-4eee0f630c7e", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "6814f1ad-f661-5e2f-8030-e6cde1e23b4f", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "cc35a9dd-64c8-5118-a5a0-874e7ca59dfe", "isPublic": true } ], "id": 31446, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731088", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731088", "catalogueId": 1062, "uuid": "9f472b40-170c-5569-a2b9-6364245bdac1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of identification and access management controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Identity & Access Management (IAM)", "description": "

Control Description

Mechanisms exist to facilitate the implementation of identification and access management controls.

Evidence Request List (ERL)

E-AST-01\nE-IAM-05\nE-IAM-12\nE-MON-11

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.\n▪ Active Directory (AD), or a similar technologies, are used to centrally manage identities and permissions, but asset/process owners are authorized to operate a decentralized access control program for their specific Technology Assets, Applications, Services and/or Data (TAASD).

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.\n▪ IAM restricts the assignment of privileged accounts to entity-defined personnel and/or roles (privilege assignment requires management approval).

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of identification and access management controls.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.1, B.4.1
NERC-CIP (2026) Requirements: CIP-004-7-R4, CIP-004-7-R6", "controlId": "IAC-01", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-01", "references": "

Micro-Small Business (<10 staff)

∙ Strong password policy\n∙ MFA for key accounts

Small Business (10-49 staff)

∙ Password manager\n∙ MFA on all accounts\n∙ Identity policy

Medium Business (50-249 staff)

∙ Identity & Access Management (IAM) program

Large Business (250-999 staff)

∙ Identity & Access Management (IAM) program

Enterprise (>1,000 staff)

∙ Identity & Access Management (IAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71570, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590551", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590551", "securityControlId": 31448, "ccis": [], "uuid": "02b2404f-12e9-59b0-acd3-62f070abfb5d", "testId": "IAC-01.2_A01", "test": "access to the system is authorized based on a valid access authorization.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.01.01.d.01", "defaultText": null }, { "id": 71571, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590552", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590552", "securityControlId": 31448, "ccis": [], "uuid": "12fe307b-096e-5bfc-85b4-07aea1a94a45", "testId": "IAC-01.2_A02", "test": "system users are uniquely identified.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.05.01.a[01]", "defaultText": null }, { "id": 71572, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590552", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590552", "securityControlId": 31448, "ccis": [], "uuid": "85075a4d-e502-519f-a9c5-f0fb1c13d3cc", "testId": "IAC-01.2_A03", "test": "system users are authenticated.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.05.01.a[02]", "defaultText": null }, { "id": 71573, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590552", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590552", "securityControlId": 31448, "ccis": [], "uuid": "63dcad4d-6e01-514a-a68e-24aba5ab7a43", "testId": "IAC-01.2_A04", "test": "an inventory of Authenticate, Authorize and Audit (AAA) solutions exists, including instances on-premises and hosted by an External Service Provider (ESP).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71574, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590552", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590552", "securityControlId": 31448, "ccis": [], "uuid": "9f280583-3bbd-53f9-9264-e47465a160d5", "testId": "IAC-01.2_A05", "test": "procedures exist to govern on-premises Authenticate, Authorize and Audit (AAA) solutions by assigned stakeholders.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71575, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590552", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590552", "securityControlId": 31448, "ccis": [], "uuid": "b7066b15-1f0a-5da7-a956-6895fccdb77b", "testId": "IAC-01.2_A06", "test": "contracts with External Service Providers (ESPs) contain explicit governance requirements for ESP-controlled Authenticate, Authorize and Audit (AAA) solutions.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71576, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590552", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590552", "securityControlId": 31448, "ccis": [], "uuid": "bfe5d936-e38d-51cf-8118-2307b1e6a6cc", "testId": "IAC-01.2_A07", "test": "access to the system is authorized based on intended system usage.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.d.02", "defaultText": null }, { "id": 71577, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590552", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590552", "securityControlId": 31448, "ccis": [], "uuid": "8ff3ff27-6cfe-554e-a4d9-5d7477f9892f", "testId": "IAC-01.2_A08", "test": "each type of wireless access to the system is authorized prior to establishing such connections.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.16.b", "defaultText": null } ], "externalMappings": [ { "id": 575258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585527", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfc0f124-fef3-5704-aae4-4b56cb9ca111", "parentControlId": 31448, "controlId": "USER 1.4", "title": "USER 1.4", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585528" }, { "id": 575259, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b348ad2f-506a-570b-8c2f-07c25b35fb94", "parentControlId": 31448, "controlId": "USER 1.6", "title": "USER 1.6", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585528" }, { "id": 575260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3990114-0ec4-57a6-8357-7ddfd1405958", "parentControlId": 31448, "controlId": "USER 1.7", "title": "USER 1.7", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585528" }, { "id": 575261, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9beb46d-67e4-514a-997a-2e700a05778e", "parentControlId": 31448, "controlId": "SR 1.1 RE 1", "title": "SR 1.1 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585528" }, { "id": 575262, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4d45b6e-c16e-52d8-841f-e6a4afe261b7", "parentControlId": 31448, "controlId": "SR 1.5(h)", "title": "SR 1.5(h)", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585528" }, { "id": 575263, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b77527b-5c59-502b-88eb-b3bab78da706", "parentControlId": 31448, "controlId": "SR 1.5(i)", "title": "SR 1.5(i)", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585528" }, { "id": 575264, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d78ee55-1de3-5e0e-9445-3404686113b2", "parentControlId": 31448, "controlId": "SR 1.5(j)", "title": "SR 1.5(j)", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585528" }, { "id": 575265, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61277070-389c-5e03-8d53-c1929cdf6975", "parentControlId": 31448, "controlId": "SR 1.5(k)", "title": "SR 1.5(k)", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585528" }, { "id": 575270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00a4b177-c2ea-55e8-b801-c8b6c4fd545c", "parentControlId": 31448, "controlId": "IA-04", "title": "IA-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585529" }, { "id": 575271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "928f9b1e-57ec-5078-97cf-774667cd6cb5", "parentControlId": 31448, "controlId": "IA-04(04)", "title": "IA-04(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585529" }, { "id": 575274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba31af19-bf54-5899-8539-29322f15a8f4", "parentControlId": 31448, "controlId": "IA-04", "title": "IA-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58553" }, { "id": 575275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4a14574-542b-5fc4-a110-9defa7b676eb", "parentControlId": 31448, "controlId": "IA-04(04)", "title": "IA-04(04)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58553" }, { "id": 575276, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e914afd6-fcde-5c1b-9997-b141939377c7", "parentControlId": 31448, "controlId": "IA-04", "title": "IA-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58553" }, { "id": 575277, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8193f43-da8e-5652-b621-9c0e1418724e", "parentControlId": 31448, "controlId": "IA-04(04)", "title": "IA-04(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58553" }, { "id": 575278, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b12be67a-4e20-5a72-8af4-cf4f2779c76b", "parentControlId": 31448, "controlId": "IA-04", "title": "IA-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58553" }, { "id": 575279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8f2edf4-8b49-5f63-87f7-b372a6844f4f", "parentControlId": 31448, "controlId": "IA-04", "title": "IA-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58553" }, { "id": 575280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "147b76d3-2b46-59f6-83f5-2daed256f3d4", "parentControlId": 31448, "controlId": "IA-04(04)", "title": "IA-04(04)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58553" }, { "id": 575281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2eba44e9-f759-543f-8df7-baf08419b176", "parentControlId": 31448, "controlId": "IA-04", "title": "IA-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58553" }, { "id": 575282, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53c842f9-fbb5-5451-94a3-d12252cdd1cb", "parentControlId": 31448, "controlId": "IA-04(04)", "title": "IA-04(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58553" }, { "id": 575283, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585531", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2967693-8571-5de4-8b46-3fe6fac1cf6e", "parentControlId": 31448, "controlId": "IA-4", "title": "IA-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585531" }, { "id": 575284, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585531", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f34e613-c351-52ac-82c5-f1cb9e2e6300", "parentControlId": 31448, "controlId": "IA-4", "title": "IA-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585531" }, { "id": 575285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585531", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42d862ee-5bcd-5dba-8fdc-24cf1d9d8bee", "parentControlId": 31448, "controlId": "IA-4", "title": "IA-4", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585531" }, { "id": 575288, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585531", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3306662b-c057-5a9f-a00a-9a0b56090c2c", "parentControlId": 31448, "controlId": "03.05.01.a", "title": "03.05.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585531" }, { "id": 575289, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585531", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12495ca4-d486-5228-a5a8-a4903e01f170", "parentControlId": 31448, "controlId": "03.05.02", "title": "03.05.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585531" }, { "id": 575290, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585531", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e31807d-f1be-5299-9df7-cdd5c1c85efc", "parentControlId": 31448, "controlId": "03.05.05.d", "title": "03.05.05.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585531" }, { "id": 575291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b990289-c687-5f05-bcb9-38225c9e518e", "parentControlId": 31448, "controlId": "03.05.07.a", "title": "03.05.07.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585532" }, { "id": 575292, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f2b35dc-4b19-53d0-8fa0-e7e5da4c2efc", "parentControlId": 31448, "controlId": "03.05.07.b", "title": "03.05.07.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585532" }, { "id": 575293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c2fdc73-3940-55d7-867a-19f81728c95e", "parentControlId": 31448, "controlId": "03.05.07.c", "title": "03.05.07.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585532" }, { "id": 575294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "442f1168-1cb9-5bc9-b212-bbc045b05116", "parentControlId": 31448, "controlId": "03.05.07.d", "title": "03.05.07.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585532" }, { "id": 575295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a60f5aa4-611d-5c08-a8ae-9b44f0d4dcb6", "parentControlId": 31448, "controlId": "03.05.07.e", "title": "03.05.07.e", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585532" }, { "id": 575296, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "113b1878-364e-5ac6-ae58-b306b0553cda", "parentControlId": 31448, "controlId": "03.05.12.d", "title": "03.05.12.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585532" }, { "id": 575297, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d52b6fa-c1bb-57c7-a1b2-6515bfda78d4", "parentControlId": 31448, "controlId": "03.05.12.f", "title": "03.05.12.f", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585532" }, { "id": 575298, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b32045ed-6595-5c6c-9666-cce51ab0fb3d", "parentControlId": 31448, "controlId": "03.07.05.a", "title": "03.07.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585532" }, { "id": 575309, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585533", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02087628-d3d1-53a7-9e77-716d9aa8b21c", "parentControlId": 31448, "controlId": "PR.AA", "title": "PR.AA", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585533" }, { "id": 575310, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585534", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fdce76f-77cb-51eb-8265-16cd6f5238d2", "parentControlId": 31448, "controlId": "PR.AA-03", "title": "PR.AA-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585534" }, { "id": 575311, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585534", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9064aaf4-5df7-5ffa-9068-a95698968c17", "parentControlId": 31448, "controlId": "PR.AA-04", "title": "PR.AA-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585534" }, { "id": 575312, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585534", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b529d7a1-2fbe-5848-a235-dc38fa57e71f", "parentControlId": 31448, "controlId": "PR.AA-05", "title": "PR.AA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585534" }, { "id": 575320, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585535", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcd9a3f5-9d49-54a7-b56e-78b82a560e51", "parentControlId": 31448, "controlId": "ACCESS-1b", "title": "ACCESS-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585535" }, { "id": 575340, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585537", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a543e037-d079-551e-9ae5-256a005ac775", "parentControlId": 31448, "controlId": "CIP-007-6 5.1", "title": "CIP-007-6 5.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585537" } ], "id": 31448, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731088", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731088", "catalogueId": 1062, "uuid": "c12280e7-9130-5a5a-ad92-711368af9851", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization strictly govern the use of Authenticate, Authorize and Audit (AAA) solutions, both on-premises and those hosted by an External Service Provider (ESP)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Authenticate, Authorize and Audit (AAA)", "description": "

Control Description

Mechanisms exist to strictly govern the use of Authenticate, Authorize and Audit (AAA) solutions, both on-premises and those hosted by an External Service Provider (ESP).

Evidence Request List (ERL)

E-IAM-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.\n▪ IAM restricts the assignment of privileged accounts to entity-defined personnel and/or roles (privilege assignment requires management approval).\n▪ LAC and RBAC enforcements limit the ability of non-administrators from making unauthorized configuration changes to TAAS.\n▪ IAM proactively governs account management of individual, group, system, application, guest and temporary accounts.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to strictly govern the use of Authenticate, Authorize and Audit (AAA) solutions, both on-premises and those hosted by an External Service Provider (ESP).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-01.2", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-01.2", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71578, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590553", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590553", "securityControlId": 31449, "ccis": [], "uuid": "cb74d752-a344-53a0-b199-b8554db67426", "testId": "IAC-01.3_A01", "test": "a current list of authorized users and services is maintained.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 575402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585544", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b27c36fe-27f5-5683-86c6-c2b0a712e0a4", "parentControlId": 31449, "controlId": "CIP-007-6 5.2", "title": "CIP-007-6 5.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585544" }, { "controlId": "B.1.2", "title": "B.1.2 — Account Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "8d19e7fd-555d-5799-aeaa-813fa1df5d06", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.2", "title": "NEI 08-09 App D.1.2 — Account Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d142bf9e-d55a-5188-af02-d174cb0dc276", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "478ce655-9403-5875-960c-b4e4332fce42", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "eabf3818-d3b4-563a-aa83-07d02b3b1bbf", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "72b4cd84-0b66-54ff-8e5a-f3ed0292954f", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "15e3f38c-48ae-5213-82c0-52b6fc72089d", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "b6eb8ac4-d967-5105-9689-1bea75f05264", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "b523a6f5-9149-58d6-b66f-a42029ae09ef", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "459a12f0-1b02-50b8-83a3-9b5f26c744fa", "isPublic": true } ], "id": 31449, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731089", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731089", "catalogueId": 1062, "uuid": "597bb68a-3870-5f4f-9ef9-f8944b87ebd7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain a current list of authorized users and service accounts?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "User & Service Account Inventories", "description": "

Control Description

Mechanisms exist to maintain a current list of authorized users and service accounts.

Evidence Request List (ERL)

E-IAM-04\nE-IAM-10\nE-IAM-11

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.\n▪ Active Directory (AD), or a similar technologies, are used to centrally manage identities and permissions, but asset/process owners are authorized to operate a decentralized access control program for their specific Technology Assets, Applications, Services and/or Data (TAASD).

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain a current list of authorized users and service accounts.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.2", "controlId": "IAC-01.3", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-01.3", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71579, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590553", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590553", "securityControlId": 31450, "ccis": [], "uuid": "aa56ea4a-0bd3-5bf1-8ee6-7e0c9717916b", "testId": "IAC-02_A01", "test": "system, application and service users are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.5.1[a]\n53A_R5_IA-02[01]", "defaultText": null }, { "id": 71580, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590553", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590553", "securityControlId": 31450, "ccis": [], "uuid": "84e1044e-c14d-57a8-8a6f-e21dec78e703", "testId": "IAC-02_A02", "test": "the identity of each user is authenticated or verified as a prerequisite to system access.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.5.2[a]\n53A_R5_IA-02[01]", "defaultText": null }, { "id": 71581, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590553", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590553", "securityControlId": 31450, "ccis": [], "uuid": "e9176e1b-cfcc-5ace-914e-3f7ecd118126", "testId": "IAC-02_A03", "test": "processes acting on behalf of users are associated with uniquely identified and authenticated system users.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.5.1[b]\n171A_R3_A.03.05.01.a[03]", "defaultText": null }, { "id": 71582, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590553", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590553", "securityControlId": 31450, "ccis": [], "uuid": "a635feba-20cd-5033-9cfa-efab3d098ec9", "testId": "IAC-02_A04", "test": "the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.5.2[b]", "defaultText": null }, { "id": 71583, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590554", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590554", "securityControlId": 31450, "ccis": [], "uuid": "4cda49f0-a0b0-5006-a861-25fc86cef90f", "testId": "IAC-02_A05", "test": "the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.5.2[c]", "defaultText": null }, { "id": 71584, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590554", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590554", "securityControlId": 31450, "ccis": [], "uuid": "a58b2e8c-e746-5cae-9fd8-8c24bb84d0ed", "testId": "IAC-02_A06", "test": "the unique identification of authenticated organizational users is associated with processes acting on behalf of those users.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IA-02[02]", "defaultText": null }, { "id": 71585, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590554", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590554", "securityControlId": 31450, "ccis": [], "uuid": "2819ccd9-327a-5da7-9fcb-056b9bcb3ac9", "testId": "IAC-02_A07", "test": "devices accessing the system are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.5.1[c]", "defaultText": null }, { "id": 71586, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590554", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590554", "securityControlId": 31450, "ccis": [], "uuid": "36c90495-c769-5323-9df0-525ac4d236cd", "testId": "IAC-02_A08", "test": "individual identifiers are managed by uniquely identifying each individual as .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: privileged or non-privileged users; contractors, foreign nationals, and/or non-organizational users", "otherId": "171A_R3_A.03.05.05.d", "defaultText": null } ], "externalMappings": [ { "id": 575431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585548", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "849e3e5f-c421-527b-91d8-d972357add16", "parentControlId": 31450, "controlId": "USER 1.1", "title": "USER 1.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585548" }, { "id": 575432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585548", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15945df5-2c08-56ea-b721-b985c27c220f", "parentControlId": 31450, "controlId": "SR 1.1", "title": "SR 1.1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585548" }, { "id": 575433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585548", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3829cd56-e73a-5a2d-b37f-f3f4475d40ed", "parentControlId": 31450, "controlId": "SR 1.1 RE 1", "title": "SR 1.1 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585548" }, { "id": 575434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585548", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d953f19-9b0b-5d85-89aa-06dd710a2237", "parentControlId": 31450, "controlId": "CR 1.1", "title": "CR 1.1", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585548" }, { "id": 575435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585548", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63841f3b-8b4c-531a-a252-96cd275a964b", "parentControlId": 31450, "controlId": "5.15", "title": "5.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585548" }, { "id": 575438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58555", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e68a0cf-39bb-5259-8a5c-f1244a51fc08", "parentControlId": 31450, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58555" }, { "id": 575439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58555", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec82525d-3424-5759-805d-1dca896e5175", "parentControlId": 31450, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58555" }, { "id": 575440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58555", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c735c29d-ccdd-567a-bdc2-d41b33d4dcb6", "parentControlId": 31450, "controlId": "T1003.002", "title": "T1003.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58555" }, { "id": 575441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58555", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b820e11-98c2-5127-87f4-ebacec5feafa", "parentControlId": 31450, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58555" }, { "id": 575442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fb3d912-ace3-55e0-ad09-ba293a176a9a", "parentControlId": 31450, "controlId": "T1003.004", "title": "T1003.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585551" }, { "id": 575443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "794e5666-bf39-53d9-9d2b-f7b37f99cc24", "parentControlId": 31450, "controlId": "T1003.005", "title": "T1003.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585551" }, { "id": 575444, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17b8cf78-2e83-5318-bb74-9be28030b1b0", "parentControlId": 31450, "controlId": "T1003.006", "title": "T1003.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585551" }, { "id": 575445, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04c68530-c7f5-529e-8cad-868c87e59fa0", "parentControlId": 31450, "controlId": "T1003.007", "title": "T1003.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585551" }, { "id": 575446, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da287a87-91d0-599d-bc03-9fb7689dce56", "parentControlId": 31450, "controlId": "T1003.008", "title": "T1003.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585551" }, { "id": 575447, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82344a48-82a3-546f-a7ce-98b1bdd789b6", "parentControlId": 31450, "controlId": "T1021", "title": "T1021", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585551" }, { "id": 575448, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dff25b6f-6d20-5562-9ab7-dc0b530d1271", "parentControlId": 31450, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585551" }, { "id": 575449, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c810f9e-3593-5baf-a3e6-8b2b40d19dad", "parentControlId": 31450, "controlId": "T1021.002", "title": "T1021.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585551" }, { "id": 575450, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d4b230f-a33a-5d7f-9a01-7a86fcd15f7b", "parentControlId": 31450, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585551" }, { "id": 575451, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5344beb-9840-556c-aa55-3bc3a6f19cd4", "parentControlId": 31450, "controlId": "T1021.004", "title": "T1021.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585552" }, { "id": 575452, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585552", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28cae0f0-04a2-5504-979b-77c5bdb36889", "parentControlId": 31450, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585552" }, { "id": 575453, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585552", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1d511fb-9b92-5aaf-95a3-534f54c7dc83", "parentControlId": 31450, "controlId": "T1021.006", "title": "T1021.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585552" }, { "id": 575454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585552", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38d9efa1-fbac-5f6f-8a26-3a44cb143d5d", "parentControlId": 31450, "controlId": "T1021.007", "title": "T1021.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585552" }, { "id": 575455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585552", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52bdbcde-62ea-59bd-abdf-52e7275fbf45", "parentControlId": 31450, "controlId": "T1021.008", "title": "T1021.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585552" }, { "id": 575456, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585552", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0c4c674-33bf-54d3-bc84-216546d283bf", "parentControlId": 31450, "controlId": "T1036.007", "title": "T1036.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585552" }, { "id": 575457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585552", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3405c11-3b9e-5aff-9b87-ddb5b5dc1189", "parentControlId": 31450, "controlId": "T1036.010", "title": "T1036.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585552" }, { "id": 575458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585552", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f98dcf2-423f-5ee1-bac9-d0f3a2a2a46b", "parentControlId": 31450, "controlId": "T1040", "title": "T1040", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585552" }, { "id": 575459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585552", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "493c5705-4393-56ba-911e-4c4aafbae848", "parentControlId": 31450, "controlId": "T1047", "title": "T1047", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585552" }, { "id": 575460, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585552", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8178e035-a0ea-569c-94fe-5b0d7347fcbe", "parentControlId": 31450, "controlId": "T1053", "title": "T1053", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585552" }, { "id": 575461, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0dc51cf9-43c8-5904-979f-5f4bae04ece2", "parentControlId": 31450, "controlId": "T1053.002", "title": "T1053.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585553" }, { "id": 575462, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86c77c01-5b83-570b-9eb2-87759ae17609", "parentControlId": 31450, "controlId": "T1053.003", "title": "T1053.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585553" }, { "id": 575463, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbc2ee3f-d19b-5583-bc7f-ac6b0bee7fc8", "parentControlId": 31450, "controlId": "T1053.005", "title": "T1053.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585553" }, { "id": 575464, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "133f814f-1e9e-5e46-aeb6-14151f36f117", "parentControlId": 31450, "controlId": "T1053.006", "title": "T1053.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585553" }, { "id": 575465, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86f4f187-004d-52e8-8797-2a385d374aa7", "parentControlId": 31450, "controlId": "T1053.007", "title": "T1053.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585553" }, { "id": 575466, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84b6881d-f051-5c98-8453-d8adce4802e1", "parentControlId": 31450, "controlId": "T1055", "title": "T1055", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585553" }, { "id": 575467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "812d2fca-3c5b-5bcf-aecb-4c4654a68e11", "parentControlId": 31450, "controlId": "T1055.008", "title": "T1055.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585553" }, { "id": 575468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2448e7ab-efea-5b5e-9ad2-cbffa1d174f6", "parentControlId": 31450, "controlId": "T1056.003", "title": "T1056.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585554" }, { "id": 575469, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9256f55e-caa2-58dc-8eaa-aac329c3fa2c", "parentControlId": 31450, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585554" }, { "id": 575470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a413afbb-6648-52b0-9d0d-621021b96252", "parentControlId": 31450, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585554" }, { "id": 575471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d890035-d381-5c79-a07a-f759e9762573", "parentControlId": 31450, "controlId": "T1059.008", "title": "T1059.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585554" }, { "id": 575472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46546746-b687-5b86-8926-30954459aaef", "parentControlId": 31450, "controlId": "T1059.009", "title": "T1059.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585554" }, { "id": 575473, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "028aa528-4f5c-55ae-8799-8d974e0ffd08", "parentControlId": 31450, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585554" }, { "id": 575474, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c681b18a-3157-53d9-a4d9-8664e38abff5", "parentControlId": 31450, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585554" }, { "id": 575475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbe97e05-e151-5af7-8e3f-f5b05167ca85", "parentControlId": 31450, "controlId": "T1078.002", "title": "T1078.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585554" }, { "id": 575476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c88ed0d8-57fa-5632-9055-9fceaeb813bf", "parentControlId": 31450, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585554" }, { "id": 575477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585555", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "646332e2-4fe8-5695-a38b-146bf9c3e1a1", "parentControlId": 31450, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585555" }, { "id": 575478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585555", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f485839f-1168-59e8-afef-704c94fd9d92", "parentControlId": 31450, "controlId": "T1087.004", "title": "T1087.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585555" }, { "id": 575479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585555", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58f559f8-3622-5489-bf55-545d49e40c0e", "parentControlId": 31450, "controlId": "T1098", "title": "T1098", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585555" }, { "id": 575480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585555", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "147b49a6-cd1e-5995-89b2-b27f2368d3c6", "parentControlId": 31450, "controlId": "T1098.001", "title": "T1098.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585555" }, { "id": 575481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62838212-cdc8-5a2a-a338-46162f24775c", "parentControlId": 31450, "controlId": "T1098.002", "title": "T1098.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585556" }, { "id": 575482, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5cde80f-2302-574c-9b29-f595969f64aa", "parentControlId": 31450, "controlId": "T1098.003", "title": "T1098.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585556" }, { "id": 575483, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73af403b-0a38-5327-b725-73240175c513", "parentControlId": 31450, "controlId": "T1098.004", "title": "T1098.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585556" }, { "id": 575484, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c65f797f-9cef-5e04-8205-0ec85abbab2c", "parentControlId": 31450, "controlId": "T1098.007", "title": "T1098.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585557" }, { "id": 575485, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2777a574-c111-5217-a670-eb47bb6f3815", "parentControlId": 31450, "controlId": "T1110", "title": "T1110", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585557" }, { "id": 575486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6809b61f-706a-5e9d-8b7a-574e88722d88", "parentControlId": 31450, "controlId": "T1110.001", "title": "T1110.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585557" }, { "id": 575487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfc9909f-c27a-5d8c-9d81-3045ad15a343", "parentControlId": 31450, "controlId": "T1110.002", "title": "T1110.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585557" }, { "id": 575488, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe40c67e-6dde-53ee-810f-4d403eb5909a", "parentControlId": 31450, "controlId": "T1110.003", "title": "T1110.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585557" }, { "id": 575489, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2245cbe-85fa-585f-b08e-a4458869647f", "parentControlId": 31450, "controlId": "T1110.004", "title": "T1110.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585557" }, { "id": 575490, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c51bec47-e6c9-5d0e-8194-e31957a3ec78", "parentControlId": 31450, "controlId": "T1111", "title": "T1111", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585557" }, { "id": 575491, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7cf0d18-b352-5598-9b29-0e64e303ef1a", "parentControlId": 31450, "controlId": "T1114", "title": "T1114", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585557" }, { "id": 575492, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fcaba00-8c5e-5443-9dd0-9657f625f706", "parentControlId": 31450, "controlId": "T1114.002", "title": "T1114.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585558" }, { "id": 575493, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0765a282-4947-5587-ba0d-c7b90019d933", "parentControlId": 31450, "controlId": "T1133", "title": "T1133", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585558" }, { "id": 575494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7ea1620-7663-5c76-ac73-d2757d7db70c", "parentControlId": 31450, "controlId": "T1134", "title": "T1134", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585558" }, { "id": 575495, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "faa192df-9429-52aa-a55c-d2eb806c464e", "parentControlId": 31450, "controlId": "T1134.001", "title": "T1134.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585558" }, { "id": 575496, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8600ca06-d67e-5413-bb72-45fb8bd31b23", "parentControlId": 31450, "controlId": "T1134.002", "title": "T1134.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585558" }, { "id": 575497, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "512e0fc0-cdbb-59ac-af2d-d90142c49342", "parentControlId": 31450, "controlId": "T1134.003", "title": "T1134.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585558" }, { "id": 575498, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eacab3e0-5cb8-5275-8a88-9da4d724e861", "parentControlId": 31450, "controlId": "T1136", "title": "T1136", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585558" }, { "id": 575499, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d65687e3-91c5-5d33-bee2-d1a397335c05", "parentControlId": 31450, "controlId": "T1136.001", "title": "T1136.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585558" }, { "id": 575500, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16c8b2c0-dc3b-56dd-bd85-45db03b002cb", "parentControlId": 31450, "controlId": "T1136.002", "title": "T1136.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585558" }, { "id": 575501, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "253d8275-3c08-5f4b-9309-2361473b34e1", "parentControlId": 31450, "controlId": "T1136.003", "title": "T1136.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585559" }, { "id": 575502, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16a3728b-b825-5d7e-b516-edf41f2753db", "parentControlId": 31450, "controlId": "T1185", "title": "T1185", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585559" }, { "id": 575503, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eea3b251-eb5f-5812-ab12-ccfbd2b81ec7", "parentControlId": 31450, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585559" }, { "id": 575504, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4344e63-fe00-57f7-a942-a337f9dadfd6", "parentControlId": 31450, "controlId": "T1197", "title": "T1197", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585559" }, { "id": 575505, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f188c5d-88b5-546a-9a8b-d0d95a8b769f", "parentControlId": 31450, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585559" }, { "id": 575506, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "386be2e8-4ce5-502f-b798-821d4e092d24", "parentControlId": 31450, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585559" }, { "id": 575507, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d70d5abc-87f0-5384-a1e7-7bad7a6f2eea", "parentControlId": 31450, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585559" }, { "id": 575508, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b56f27f-9886-540e-b38f-69309c107656", "parentControlId": 31450, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585559" }, { "id": 575509, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6665120-e736-5a26-9498-ec48c56bda61", "parentControlId": 31450, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58556" }, { "id": 575510, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac860821-143e-58b8-a442-74ead5383fbd", "parentControlId": 31450, "controlId": "T1213.003", "title": "T1213.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58556" }, { "id": 575511, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12177bdb-a27c-5c12-9618-31d12d6cce04", "parentControlId": 31450, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58556" }, { "id": 575512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2838a28c-c6af-5562-b255-a34fb2fad2a8", "parentControlId": 31450, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58556" }, { "id": 575513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a82584b1-19e7-5fd1-b41c-657d9749a265", "parentControlId": 31450, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58556" }, { "id": 575514, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec00c174-7f4a-554e-94ff-ffce4df6c12b", "parentControlId": 31450, "controlId": "T1218.007", "title": "T1218.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58556" }, { "id": 575515, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b165b664-abd1-5646-99c5-556e2854445d", "parentControlId": 31450, "controlId": "T1222", "title": "T1222", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58556" }, { "id": 575516, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7ec3bed-3243-53d4-a35d-0eeb413851f0", "parentControlId": 31450, "controlId": "T1222.001", "title": "T1222.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585561" }, { "id": 575517, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9bc37f43-e479-5aa9-a6c2-37eae2cbcf09", "parentControlId": 31450, "controlId": "T1222.002", "title": "T1222.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585561" }, { "id": 575518, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8328404f-10c7-5749-a6b4-04d7a19bc336", "parentControlId": 31450, "controlId": "T1484", "title": "T1484", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585561" }, { "id": 575519, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4474851-cf8d-511a-8f24-9d0bc963cc8c", "parentControlId": 31450, "controlId": "T1489", "title": "T1489", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585561" }, { "id": 575520, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2e7c918-0d8b-528a-82b5-c205a6b6cf85", "parentControlId": 31450, "controlId": "T1495", "title": "T1495", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585561" }, { "id": 575521, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71fc6998-2881-57cb-9aa1-702805649308", "parentControlId": 31450, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585561" }, { "id": 575522, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1aaea5fc-aa35-5035-a483-6b7b51a56e89", "parentControlId": 31450, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585561" }, { "id": 575523, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e2a1ab2-e1b0-5019-9fcb-b5e2560ad197", "parentControlId": 31450, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585561" }, { "id": 575524, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7e619b1-b6de-5b12-a006-791c0f453776", "parentControlId": 31450, "controlId": "T1525", "title": "T1525", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585561" }, { "id": 575525, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47b73a0f-e4e4-58ab-826d-34f6cacf0a0d", "parentControlId": 31450, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585562" }, { "id": 575526, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85235629-4780-5475-8e69-09cf80f9159b", "parentControlId": 31450, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585562" }, { "id": 575527, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6eddd54e-0fa8-5fa8-8ff1-139242c9074b", "parentControlId": 31450, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585563" }, { "id": 575528, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29d58505-f8c3-5c50-ba06-a7fbf177db1c", "parentControlId": 31450, "controlId": "T1538", "title": "T1538", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585563" }, { "id": 575529, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40c0c3cc-2c83-574b-84ab-6bbbaa204203", "parentControlId": 31450, "controlId": "T1539", "title": "T1539", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585563" }, { "id": 575530, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81d985bd-c58d-5b0e-8434-3e0120fd3ce3", "parentControlId": 31450, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585563" }, { "id": 575531, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "addb4831-62e1-5623-a87f-b42ca9a4e951", "parentControlId": 31450, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585563" }, { "id": 575532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d92185c-6563-5e5d-ab92-99e162f54bf1", "parentControlId": 31450, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585563" }, { "id": 575533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585564", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb863a30-4f0b-52a5-8a87-a2aa15181f6d", "parentControlId": 31450, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585564" }, { "id": 575534, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585564", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "608a0f0d-e1b5-5482-a06c-5b7718710ff1", "parentControlId": 31450, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585564" }, { "id": 575535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585564", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d06668b1-eb08-52a9-9fc8-4433984dd2b4", "parentControlId": 31450, "controlId": "T1543.001", "title": "T1543.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585564" }, { "id": 575536, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585564", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1adbcbe0-ffd7-5f94-9ba7-848573207616", "parentControlId": 31450, "controlId": "T1543.002", "title": "T1543.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585564" }, { "id": 575537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585564", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2960983a-0a4d-53fb-992f-0e867d211b93", "parentControlId": 31450, "controlId": "T1543.003", "title": "T1543.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585564" }, { "id": 575538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585564", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73b43ecb-7910-5138-8a59-614544c37fee", "parentControlId": 31450, "controlId": "T1543.004", "title": "T1543.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585564" }, { "id": 575539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585564", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c336ff8-1542-5cd9-8e1c-71a0081fcec3", "parentControlId": 31450, "controlId": "T1543.005", "title": "T1543.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585564" }, { "id": 575540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585564", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b60ac02d-2b70-5aa5-8c1b-2cd556b2a831", "parentControlId": 31450, "controlId": "T1546.003", "title": "T1546.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585564" }, { "id": 575541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6186aac9-3b64-5c9f-8349-0d2816fe5fcf", "parentControlId": 31450, "controlId": "T1547.004", "title": "T1547.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585573" }, { "id": 575542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f6aaf44-b40e-5559-9789-092b7a275ae3", "parentControlId": 31450, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585573" }, { "id": 575543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "547cebea-2e72-533f-b5d6-1067611cf4ea", "parentControlId": 31450, "controlId": "T1547.009", "title": "T1547.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585573" }, { "id": 575544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3ae172b-ecb0-55ff-b6b6-88e0dc837449", "parentControlId": 31450, "controlId": "T1547.012", "title": "T1547.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585573" }, { "id": 575545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "595312ac-6d0e-5e1c-8272-771e0fddef99", "parentControlId": 31450, "controlId": "T1547.013", "title": "T1547.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585573" }, { "id": 575546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8df988b3-dde7-5776-b0cf-78372cd4d957", "parentControlId": 31450, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585573" }, { "id": 575547, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe14f19c-8ac5-50a0-9d1b-8befd358672b", "parentControlId": 31450, "controlId": "T1548.002", "title": "T1548.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585573" }, { "id": 575548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52a56404-4252-54f8-bf20-7b0320573634", "parentControlId": 31450, "controlId": "T1548.003", "title": "T1548.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585573" }, { "id": 575549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9383d79-ce9b-5d61-8d70-3b4f7a033097", "parentControlId": 31450, "controlId": "T1550", "title": "T1550", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585573" }, { "id": 575550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ade247ca-191e-5a46-866e-1ee7b0c90c35", "parentControlId": 31450, "controlId": "T1550.001", "title": "T1550.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585574" }, { "id": 575551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7aa41e35-a72c-5ae8-ac5b-00a2578fa985", "parentControlId": 31450, "controlId": "T1550.002", "title": "T1550.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585574" }, { "id": 575552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cdd6fc95-df21-54dd-bc27-cf108a9f5146", "parentControlId": 31450, "controlId": "T1550.003", "title": "T1550.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585574" }, { "id": 575553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8aea2230-fa58-53bc-8e8d-8490fbe44e08", "parentControlId": 31450, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585574" }, { "id": 575554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34f72471-8143-58ed-9a30-5b034e289855", "parentControlId": 31450, "controlId": "T1552.001", "title": "T1552.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585574" }, { "id": 575555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "771530a1-8c64-5e50-afe1-105c1b00b7e4", "parentControlId": 31450, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585574" }, { "id": 575556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1462e27-cb63-52c0-bc25-e998211ae5b4", "parentControlId": 31450, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585574" }, { "id": 575557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "787a82b9-23aa-5e22-a3b0-d42b3a61ae3f", "parentControlId": 31450, "controlId": "T1552.006", "title": "T1552.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585574" }, { "id": 575558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea527890-383f-537f-b800-fe7ad3fba4d2", "parentControlId": 31450, "controlId": "T1552.007", "title": "T1552.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585574" }, { "id": 575559, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae429b23-500a-58b3-905c-ea64a78c57f6", "parentControlId": 31450, "controlId": "T1555.005", "title": "T1555.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585575" }, { "id": 575560, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "200e813f-cd6b-54a3-9dec-bd15081ea3a4", "parentControlId": 31450, "controlId": "T1556", "title": "T1556", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585575" }, { "id": 575561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d8375c0-f59b-5637-adef-81daee57c9bb", "parentControlId": 31450, "controlId": "T1556.001", "title": "T1556.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585575" }, { "id": 575562, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22c0ed7e-150a-57df-9bc3-5a67301c717d", "parentControlId": 31450, "controlId": "T1556.003", "title": "T1556.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585575" }, { "id": 575563, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "096de072-bd7e-53e6-b91e-6a6ee27ffc92", "parentControlId": 31450, "controlId": "T1556.004", "title": "T1556.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585575" }, { "id": 575564, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec1fe2a7-74a2-5c83-b187-579622451485", "parentControlId": 31450, "controlId": "T1556.006", "title": "T1556.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585575" }, { "id": 575565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c184df80-17f0-54f4-88ca-b61ddbd61dda", "parentControlId": 31450, "controlId": "T1556.007", "title": "T1556.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585575" }, { "id": 575566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585575", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30b14b22-a2e9-5820-bf3f-56f63e6c29ce", "parentControlId": 31450, "controlId": "T1556.009", "title": "T1556.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585575" }, { "id": 575567, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585576", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fc9338e-ea65-5007-9210-9a9e2d472f23", "parentControlId": 31450, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585576" }, { "id": 575568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585576", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0496f57-b132-5f39-b1b2-4515cccced99", "parentControlId": 31450, "controlId": "T1558.001", "title": "T1558.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585576" }, { "id": 575569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585576", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44cdc487-d73f-5207-bce9-4e0118048def", "parentControlId": 31450, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585576" }, { "id": 575570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585576", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53b8af57-749b-5d2a-9a1b-73177c2857cf", "parentControlId": 31450, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585576" }, { "id": 575571, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585576", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da1d6d77-b0af-5920-b291-c72327d23df3", "parentControlId": 31450, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585576" }, { "id": 575572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f68dd72-bd39-546c-a69a-51f9c37e39d5", "parentControlId": 31450, "controlId": "T1558.005", "title": "T1558.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585577" }, { "id": 575573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81b0723f-d667-5845-bdcb-ede06d1ed361", "parentControlId": 31450, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585577" }, { "id": 575574, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a59886f5-c4ec-5f87-958d-ec025d0eedd2", "parentControlId": 31450, "controlId": "T1559.001", "title": "T1559.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585578" }, { "id": 575575, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e38e3d9-329a-5a1f-8901-32bf8523e886", "parentControlId": 31450, "controlId": "T1562", "title": "T1562", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585578" }, { "id": 575576, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88391027-f3de-5532-a830-dd74c7603bd3", "parentControlId": 31450, "controlId": "T1562.001", "title": "T1562.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585578" }, { "id": 575577, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd02c444-3b04-5e69-a724-61c6b7d07035", "parentControlId": 31450, "controlId": "T1562.002", "title": "T1562.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585578" }, { "id": 575578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3f91d7a-9afe-585f-a216-a6b661de6616", "parentControlId": 31450, "controlId": "T1562.004", "title": "T1562.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585578" }, { "id": 575579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "faf2c52c-1fb8-52fa-9980-2f2f1d73e076", "parentControlId": 31450, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585578" }, { "id": 575580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d5def58-c746-5aba-b77d-4182b158e5e5", "parentControlId": 31450, "controlId": "T1562.007", "title": "T1562.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585578" }, { "id": 575581, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585578", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd21fc6d-5980-5844-9f40-0c94176fd40a", "parentControlId": 31450, "controlId": "T1562.008", "title": "T1562.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585578" }, { "id": 575582, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b395204c-375c-5c17-b9f1-a6dae1a19da7", "parentControlId": 31450, "controlId": "T1562.009", "title": "T1562.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585579" }, { "id": 575583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8932778d-4bbf-5faa-8ba7-2a6ff585d0ab", "parentControlId": 31450, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585579" }, { "id": 575584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c70cc28-7208-5c79-aa5d-d87b335477f1", "parentControlId": 31450, "controlId": "T1563.001", "title": "T1563.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585579" }, { "id": 575585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff227822-60b5-59ad-90e9-d0d169f8e133", "parentControlId": 31450, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585579" }, { "id": 575586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee31cb4c-b7f2-545b-aa31-1328981f2193", "parentControlId": 31450, "controlId": "T1569", "title": "T1569", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585579" }, { "id": 575587, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e1a8358-6db4-56b3-b251-797f7e7f70ca", "parentControlId": 31450, "controlId": "T1569.001", "title": "T1569.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585579" }, { "id": 575588, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fa8329a-96ff-5f2b-adcb-a3a80175d096", "parentControlId": 31450, "controlId": "T1569.002", "title": "T1569.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585579" }, { "id": 575589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e65c9bd9-f99f-53b2-92c2-03a3f147fe0f", "parentControlId": 31450, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585579" }, { "id": 575590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585579", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e012754-9add-54fc-8dba-877ad077f82b", "parentControlId": 31450, "controlId": "T1574.005", "title": "T1574.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585579" }, { "id": 575591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9286e72-3a91-59d7-a5ca-376c6e7e4192", "parentControlId": 31450, "controlId": "T1574.010", "title": "T1574.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58558" }, { "id": 575592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80084dae-7406-5838-a140-8c47a3c15421", "parentControlId": 31450, "controlId": "T1574.012", "title": "T1574.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585581" }, { "id": 575593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0ddd680-afd2-5746-bff6-9f16b8bf640b", "parentControlId": 31450, "controlId": "T1578", "title": "T1578", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585581" }, { "id": 575594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "656a152d-8ee1-519e-a7d7-b788b8506364", "parentControlId": 31450, "controlId": "T1578.001", "title": "T1578.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585581" }, { "id": 575595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1e1ded0-e649-5887-ba7c-ce9c87a266b7", "parentControlId": 31450, "controlId": "T1578.002", "title": "T1578.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585581" }, { "id": 575596, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fcc48c8-3ff6-5798-939e-e7251c4d9f76", "parentControlId": 31450, "controlId": "T1578.003", "title": "T1578.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585581" }, { "id": 575597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0633bb76-31fa-552e-9d6b-573d6fcb9367", "parentControlId": 31450, "controlId": "T1580", "title": "T1580", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585581" }, { "id": 575598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f4151f6-55b7-51ee-9a00-59b5b5143418", "parentControlId": 31450, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585581" }, { "id": 575599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cde99f0d-fd0b-59c8-94dd-bdc7c3ec55e9", "parentControlId": 31450, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585581" }, { "id": 575600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41c08f11-c9c5-55f5-9d48-9df348e4df21", "parentControlId": 31450, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585581" }, { "id": 575601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff669bcd-daa5-519c-bd45-91a6e65cb1ab", "parentControlId": 31450, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585582" }, { "id": 575602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3245b9a-d172-56c1-a9a0-33f6edc1b6a7", "parentControlId": 31450, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585582" }, { "id": 575603, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fdf4e3a-622f-59ba-acf7-e452cd64f8f8", "parentControlId": 31450, "controlId": "T1610", "title": "T1610", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585582" }, { "id": 575604, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee7ec306-f76e-55ef-acb2-bd2df5a4bbdb", "parentControlId": 31450, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585582" }, { "id": 575605, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f80e0fb3-7cee-5f70-b6b2-aa02f417d527", "parentControlId": 31450, "controlId": "T1613", "title": "T1613", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585582" }, { "id": 575606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75a11a48-a961-5f3e-b97c-e0f2b44257cd", "parentControlId": 31450, "controlId": "T1619", "title": "T1619", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585582" }, { "id": 575607, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1ea3830-1c22-56b0-a435-55623c9ad5d7", "parentControlId": 31450, "controlId": "T1621", "title": "T1621", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585582" }, { "id": 575608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31714ecc-bffa-5ddc-88bd-0c06b6fd7d47", "parentControlId": 31450, "controlId": "T1648", "title": "T1648", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585582" }, { "id": 575609, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d78d5a70-e139-5f1c-b853-948777ab2b45", "parentControlId": 31450, "controlId": "T1649", "title": "T1649", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585582" }, { "id": 575610, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e3d0670-fed5-59e5-a1ce-b5499f50ff61", "parentControlId": 31450, "controlId": "T1651", "title": "T1651", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585583" }, { "id": 575613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db58adce-df97-5f30-9ca8-782b3ed9ea7b", "parentControlId": 31450, "controlId": "IA-2", "title": "IA-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585583" }, { "id": 575614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "378da4bf-23f5-57db-b338-38e25aaa1dbf", "parentControlId": 31450, "controlId": "IA-02", "title": "IA-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585583" }, { "id": 575615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f5ae560-62cf-58a6-a649-4fcaf8490235", "parentControlId": 31450, "controlId": "IA-02", "title": "IA-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585583" }, { "id": 575617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65b7b038-db00-5649-8bc6-8cfe7e56f4ab", "parentControlId": 31450, "controlId": "IA-02", "title": "IA-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585585" }, { "id": 575618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8be1a06-665a-564d-87a5-d5672d405e57", "parentControlId": 31450, "controlId": "IA-02", "title": "IA-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585585" }, { "id": 575619, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fb2879d-1608-5cce-b13e-6d3390635907", "parentControlId": 31450, "controlId": "IA-02", "title": "IA-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585585" }, { "id": 575620, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9253b7f-b69c-5901-888d-300a3f7351cc", "parentControlId": 31450, "controlId": "IA-02", "title": "IA-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585585" }, { "id": 575621, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89b31336-ace3-5db8-97f9-1f7d59911bee", "parentControlId": 31450, "controlId": "IA-2", "title": "IA-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585585" }, { "id": 575622, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c948b5b-68dd-528b-9fde-9f988fb37a2a", "parentControlId": 31450, "controlId": "IA-2", "title": "IA-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585586" }, { "id": 575623, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585586", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e59656c-31d4-5041-818d-2af2766c99c7", "parentControlId": 31450, "controlId": "IA-2", "title": "IA-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585586" }, { "id": 575627, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585586", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b9dc9fe-9a5f-59d9-94bb-fa24b9a09fdf", "parentControlId": 31450, "controlId": "3.1.1", "title": "3.1.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585586" }, { "id": 575628, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585586", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f44912b-7c44-5c1f-ab4f-409e2ab3b1c3", "parentControlId": 31450, "controlId": "3.5.1", "title": "3.5.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585586" }, { "id": 575629, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585586", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42853832-687c-5588-bb74-130dbebcb0ff", "parentControlId": 31450, "controlId": "3.5.2", "title": "3.5.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585586" }, { "id": 575630, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585586", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6e61f74-eefb-5655-8170-bfae75332828", "parentControlId": 31450, "controlId": "03.05.01.a", "title": "03.05.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585586" }, { "id": 575631, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585587", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e31312ad-39ec-5de6-93e5-f7cad7db22bf", "parentControlId": 31450, "controlId": "03.05.05.d", "title": "03.05.05.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585587" }, { "id": 575641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585588", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e622589-172c-5ef6-9d29-6195f41b0bd9", "parentControlId": 31450, "controlId": "PR.AA-01", "title": "PR.AA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585588" }, { "id": 575642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585588", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a820f389-3a21-522e-832f-09f128cd2407", "parentControlId": 31450, "controlId": "PR.AA-03", "title": "PR.AA-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585588" }, { "id": 575643, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585588", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c2c3dba-bfad-52ba-9e26-36d7ad5e777f", "parentControlId": 31450, "controlId": "PR.AA-05", "title": "PR.AA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585588" }, { "id": 575718, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585599", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a910657-a10a-53ff-a6d1-5213e2645555", "parentControlId": 31450, "controlId": "B2.a", "title": "B2.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585599" }, { "controlId": "B.4.2", "title": "B.4.2 — User Identification and Authentication", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IA-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ea644f02-eaff-5011-be42-e14251331d97", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.2", "title": "NEI 08-09 App D.4.2 — User Identification and Authentication", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "49132631-dfb4-53cf-b293-f8748dace8ae", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.4.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "a4ef8782-c764-53d0-adcb-c73d52544672", "isPublic": true }, { "controlId": "B.4.4", "title": "B.4.4 — Non-Authenticated Human Machine Interaction Security", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-14, IA-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "581039a1-fc26-59d7-9602-e96774acb28e", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.4", "title": "NEI 08-09 App D.4.4 — Non-Authenticated Human Machine Interaction Security", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "1908ef7c-c08c-5dd9-9909-3ea75aa87a36", "isPublic": true }, { "controlId": "CIP-007-6-R5", "title": "CIP-007-6-R5 — System Access Control and Authentication", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "62ea070d-ad97-5295-b5c1-190add3ddff2", "isPublic": true }, { "controlId": "CIP-007-6-5.1", "title": "CIP-007-6-5.1 — Have a method(s) to enforce authentication of interactive user access, where technically feasible.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "30c2b6f4-4118-5483-9581-5cd9f7feaf0f", "isPublic": true }, { "controlId": "CIP-007-6-5.2", "title": "CIP-007-6-5.2 — Identify and inventory all known enabled default or other generic account types, either by system, by groups of syste...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f3166491-a088-5d86-9337-e6c0f67f5a5a", "isPublic": true }, { "controlId": "CIP-007-6-5.3", "title": "CIP-007-6-5.3 — Identify individuals who have authorized access to shared accounts.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ecf95947-017e-5c99-842e-7dd5ce9b2504", "isPublic": true }, { "controlId": "CIP-007-6-5.4", "title": "CIP-007-6-5.4 — Change known default passwords, per Cyber Asset capability", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c4ae1a02-a69b-5adc-8278-042bf341f7e7", "isPublic": true }, { "controlId": "CIP-007-6-5.5", "title": "CIP-007-6-5.5 — For password-only authentication for interactive user access, either technically or procedurally enforce the followin...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3ab69702-3ba9-5490-997c-4fd8c071aba4", "isPublic": true }, { "controlId": "CIP-007-6-5.5.1", "title": "CIP-007-6-5.5.1 — Password length that is, at least, the lesser of eight characters or the maximum length supported by the Cyber Asset", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a4a426e2-70ea-566b-ad81-af32301d3f4e", "isPublic": true }, { "controlId": "CIP-007-6-5.5.2", "title": "CIP-007-6-5.5.2 — Minimum password complexity that is the lesser of three or more different types of characters (e.g., uppercase alphab...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1e3f4131-3bcc-57fe-8e6b-78ce7a39338a", "isPublic": true }, { "controlId": "CIP-007-6-5.6", "title": "CIP-007-6-5.6 — Where technically feasible, for password-only authentication for interactive user access, either technically or proce...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "016b2105-7627-56eb-a25f-74a7a4eff39a", "isPublic": true }, { "controlId": "CIP-007-6-5.7", "title": "CIP-007-6-5.7 — Where technically feasible, either:  Limit the number of unsuccessful authentication attempts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b67d9937-9ed6-5563-a1e0-886d25c753fa", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "bf20858a-3bcc-507b-af8a-47333b4c5353", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "cda2d370-c263-5bf3-87c0-985eb89888b0", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "f7ec5a14-0050-589e-af34-ab69703aa05e", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "0bb18fa0-c7d6-547d-aae9-b615dda1e833", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "5c7e9190-4604-5e85-85d4-b701aab903b9", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "1de837bb-3a1e-5f95-8717-f97ae837cfa0", "isPublic": true } ], "id": 31450, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731089", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731089", "catalogueId": 1062, "uuid": "47c800d5-7485-5b44-97fc-3fb91adb977a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization uniquely identify and centrally Authenticate, Authorize and Audit (AAA) organizational users and processes acting on behalf of organizational users?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Identification & Authentication for Organizational Users", "description": "

Control Description

Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) organizational users and processes acting on behalf of organizational users.

Evidence Request List (ERL)

E-IAM-05\nE-IAM-06\nE-IAM-13

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.\n▪ Active Directory (AD), or a similar technologies, are used to centrally manage identities and permissions, but asset/process owners are authorized to operate a decentralized access control program for their specific Technology Assets, Applications, Services and/or Data (TAASD).

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) organizational users and processes acting on behalf of organizational users.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.4.2, B.4.4
NERC-CIP (2026) Requirements: CIP-007-6-R5", "controlId": "IAC-02", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-02", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71587, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590555", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590555", "securityControlId": 31451, "ccis": [], "uuid": "f37375ed-a076-5938-8e94-2c1141a74ae9", "testId": "IAC-02.1_A01", "test": "users are required to be individually authenticated before granting access to the shared accounts or resources when shared accounts or authenticators are employed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-02(05)", "defaultText": null } ], "externalMappings": [ { "id": 575741, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c616cffd-2187-5812-b862-eab9bf145b65", "parentControlId": 31451, "controlId": "IA-2(5)", "title": "IA-2(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585602" }, { "id": 575742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95093c13-903d-5bb1-8c4b-2d8c31fbd4fb", "parentControlId": 31451, "controlId": "IA-02(05)", "title": "IA-02(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585602" }, { "id": 575743, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5391ac02-ecce-5c7f-97f4-837aed841a18", "parentControlId": 31451, "controlId": "IA-02(05)", "title": "IA-02(05)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585602" }, { "id": 575744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2581f77c-505c-5db2-8864-58646d85eb5b", "parentControlId": 31451, "controlId": "IA-02(05)", "title": "IA-02(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585602" }, { "id": 575745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585603", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "425e9c26-ae6a-537a-ad4e-d378195c2357", "parentControlId": 31451, "controlId": "IA-02(05)", "title": "IA-02(05)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585603" } ], "id": 31451, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731089", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73109", "catalogueId": 1062, "uuid": "c5a7a2fc-022b-5e58-ac7e-298042fa20c9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require individuals to be authenticated with an individual authenticator when a group authenticator is utilized?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Group Authentication", "description": "

Control Description

Mechanisms exist to require individuals to be authenticated with an individual authenticator when a group authenticator is utilized.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.\n▪ IAM proactively governs account management of individual, group, system, application, guest and temporary accounts.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require individuals to be authenticated with an individual authenticator when a group authenticator is utilized.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-02.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71588, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590555", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590555", "securityControlId": 31452, "ccis": [], "uuid": "2c7e63d9-fd08-5aa5-b44e-da872ad1f058", "testId": "IAC-02.2_A01", "test": "replay-resistant authentication mechanisms for access to privileged accounts are implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.5.4\n53A_R5_IA-02[01]\n53A_R5_IA-02(08)_ODP\n171A_R3_A.03.05.04[01]", "defaultText": null }, { "id": 71589, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590555", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590555", "securityControlId": 31452, "ccis": [], "uuid": "1520eac1-4282-530b-85cd-cadd082df622", "testId": "IAC-02.2_A02", "test": "replay-resistant authentication mechanisms for access to non-privileged accounts are implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.5.4\n53A_R5_IA-02[01]\n53A_R5_IA-02(08)_ODP\n171A_R3_A.03.05.04[02]", "defaultText": null }, { "id": 71590, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590555", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590555", "securityControlId": 31452, "ccis": [], "uuid": "d2390218-7d01-5105-b393-c3e88edca86d", "testId": "IAC-02.2_A03", "test": "replay resistance is implemented in the establishment of nonlocal maintenance and diagnostic sessions.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.5.4\n53A_R5_IA-02[01]\n53A_R5_IA-02(08)_ODP\n171A_R3_A.03.07.05.b[02]", "defaultText": null }, { "id": 71591, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590555", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590555", "securityControlId": 31452, "ccis": [], "uuid": "bf33f228-02ce-5914-80e3-31f5096d5beb", "testId": "IAC-02.2_A04", "test": "systems and system components to identify and authenticate are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.5.1e_ODP[1]", "defaultText": null }, { "id": 71592, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590556", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590556", "securityControlId": 31452, "ccis": [], "uuid": "d842ae68-538b-5b07-9bfd-55b1b702e36c", "testId": "IAC-02.2_A05", "test": "bidirectional authentication that is cryptographically-based is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.5.1e[a]", "defaultText": null }, { "id": 71593, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590556", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590556", "securityControlId": 31452, "ccis": [], "uuid": "ceaf58ea-5fe0-5295-88a2-90655347cf72", "testId": "IAC-02.2_A06", "test": "bidirectional authentication that is replay-resistant is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.5.1e[b]", "defaultText": null }, { "id": 71594, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590556", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590556", "securityControlId": 31452, "ccis": [], "uuid": "f94f5f71-7643-524f-b463-ef3711b46916", "testId": "IAC-02.2_A07", "test": "systems and system components are identified and authenticated before establishing a network connection using bidirectional authentication that is cryptographically-based and replay- resistant.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.5.1e[c]", "defaultText": null } ], "externalMappings": [ { "id": 575767, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "414c21a9-785b-5a0e-9e48-62ad7eb16297", "parentControlId": 31452, "controlId": "IA-2(8)", "title": "IA-2(8)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585605" }, { "id": 575768, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc831801-0b2d-5b26-8deb-6207b19c66d7", "parentControlId": 31452, "controlId": "IA-2(9)", "title": "IA-2(9)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585605" }, { "id": 575769, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b311b468-e344-5075-a68d-64e1cce20593", "parentControlId": 31452, "controlId": "IA-02(08)", "title": "IA-02(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585605" }, { "id": 575770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "009740cd-3c94-5a75-a28f-7d16fce5221a", "parentControlId": 31452, "controlId": "IA-02(08)", "title": "IA-02(08)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585605" }, { "id": 575771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "718f599b-8144-5c35-a4b8-2ea649154dd5", "parentControlId": 31452, "controlId": "IA-02(08)", "title": "IA-02(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585605" }, { "id": 575772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30b17114-313d-5e0b-a413-95b3f1a5ffbf", "parentControlId": 31452, "controlId": "IA-02(08)", "title": "IA-02(08)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585606" }, { "id": 575773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69ac8389-ce3a-51c3-876e-e6475d6860d0", "parentControlId": 31452, "controlId": "IA-02(08)", "title": "IA-02(08)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585606" }, { "id": 575774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fcdb9b9-bf2e-545a-8a0e-98178cb2b8c4", "parentControlId": 31452, "controlId": "IA-02(08)", "title": "IA-02(08)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585606" }, { "id": 575775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b481898f-2f1d-50ad-9f33-02c98ec99529", "parentControlId": 31452, "controlId": "3.5.4", "title": "3.5.4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585606" }, { "id": 575776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5485505c-1578-5099-b336-470fbe0d653f", "parentControlId": 31452, "controlId": "03.05.04", "title": "03.05.04", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585606" }, { "id": 575777, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f78adcc-6783-53d2-9fdc-92f780f53ef3", "parentControlId": 31452, "controlId": "03.07.05.b", "title": "03.07.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585606" }, { "id": 575783, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585607", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a7a2f46-1a28-5bc0-83f6-70bfc274956d", "parentControlId": 31452, "controlId": "PR.AA-04", "title": "PR.AA-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585607" } ], "id": 31452, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73109", "catalogueId": 1062, "uuid": "c06460ea-3044-5028-abf3-2165266a71a2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to employ replay-resistant authentication?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Replay-Resistant Authentication", "description": "

Control Description

Automated mechanisms exist to employ replay-resistant authentication.

Evidence Request List (ERL)

E-AST-01\nE-IAM-05\nE-IAM-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically employ replay-resistant authentication.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-02.2", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-02.2", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71595, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590556", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590556", "securityControlId": 31453, "ccis": [], "uuid": "44022085-a855-5fb2-be1a-03dde60c8bb3", "testId": "IAC-02.3_A01", "test": "Personal Identity Verification (PIV)-compliant credentials are accepted and electronically verified.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-02(12)", "defaultText": null }, { "id": 71596, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590556", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590556", "securityControlId": 31453, "ccis": [], "uuid": "6305c52d-edd0-5de9-b731-ae0308d26a54", "testId": "IAC-02.3_A02", "test": "organizational controls for using federated or PKI credentials are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-08(05)_ODP", "defaultText": null }, { "id": 71597, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590556", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590556", "securityControlId": 31453, "ccis": [], "uuid": "373475c6-fa65-53d5-86a1-a6729797883e", "testId": "IAC-02.3_A03", "test": "federated or PKI credentials that meet policy are accepted.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-08(05)[01]", "defaultText": null }, { "id": 71598, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590556", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590556", "securityControlId": 31453, "ccis": [], "uuid": "de80db48-403a-5260-99c9-6f4c5138bbb6", "testId": "IAC-02.3_A04", "test": "federated or PKI credentials that meet policy are verified.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-08(05)[02]", "defaultText": null } ], "externalMappings": [ { "id": 575812, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0c18f9e-0ac6-5c72-bf97-0184acb9a287", "parentControlId": 31453, "controlId": "IA-2(12)", "title": "IA-2(12)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58561" }, { "id": 575813, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b6fc40e-413c-5ebe-8225-3ca725f31464", "parentControlId": 31453, "controlId": "IA-8(5)", "title": "IA-8(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58561" }, { "id": 575814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c7a4b77-2c38-5e33-b1d2-c252e48ee3cf", "parentControlId": 31453, "controlId": "IA-02(12)", "title": "IA-02(12)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58561" }, { "id": 575815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cfd06806-107e-5818-b946-c0465dd96ecc", "parentControlId": 31453, "controlId": "IA-08(05)", "title": "IA-08(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58561" }, { "id": 575816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0da8a924-244a-5f08-b575-39da921919fb", "parentControlId": 31453, "controlId": "IA-02(12)", "title": "IA-02(12)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585611" }, { "id": 575817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52bcc8cd-fbce-5cd1-b51b-79bef09c899b", "parentControlId": 31453, "controlId": "IA-02(12)", "title": "IA-02(12)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585611" }, { "id": 575818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52a3fd25-508e-5c8e-981b-622954e444fa", "parentControlId": 31453, "controlId": "IA-08(05)", "title": "IA-08(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585611" }, { "id": 575819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eca3bd42-d179-54ad-aeb6-739e5b14f7bd", "parentControlId": 31453, "controlId": "IA-02(12)", "title": "IA-02(12)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585611" }, { "id": 575820, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25ac3bcf-6beb-5072-a59a-f6bbb1b36219", "parentControlId": 31453, "controlId": "IA-02(12)", "title": "IA-02(12)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585611" }, { "id": 575821, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea9ae4a8-33e7-5149-97df-7b4bcce20865", "parentControlId": 31453, "controlId": "IA-02(12)", "title": "IA-02(12)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585611" } ], "id": 31453, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73109", "catalogueId": 1062, "uuid": "d79d864b-6f5c-538a-9fa5-051223f5e1bf", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization accept and electronically verify organizational Personal Identity Verification (PIV) credentials?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Acceptance of PIV Credentials", "description": "

Control Description

Mechanisms exist to accept and electronically verify organizational Personal Identity Verification (PIV) credentials.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to accept and electronically verify organizational Personal Identity Verification (PIV) credentials.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-02.3", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-02.3", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71599, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590557", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590557", "securityControlId": 31454, "ccis": [], "uuid": "8c963b54-44d2-51b6-a8af-34a66a0d9420", "testId": "IAC-02.4_A01", "test": "out-of-band authentication mechanisms to be implemented are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-02(13)_ODP[01]", "defaultText": null }, { "id": 71600, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590557", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590557", "securityControlId": 31454, "ccis": [], "uuid": "01d85b0c-a9b1-5344-aadf-2170711a2780", "testId": "IAC-02.4_A02", "test": "conditions under which out-of-band authentication is to be implemented are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-02(13)_ODP[02]", "defaultText": null }, { "id": 71601, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590557", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590557", "securityControlId": 31454, "ccis": [], "uuid": "023a6a2f-4c27-5312-b418-6ba97e6fd6d9", "testId": "IAC-02.4_A03", "test": "out-of-band authentication mechanisms are implemented under organization-defined conditions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-02(13)", "defaultText": null } ], "externalMappings": [ { "id": 575829, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7b1190b-6d5e-5ecc-8003-b41365cffdeb", "parentControlId": 31454, "controlId": "IA-2(13)", "title": "IA-2(13)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585612" }, { "id": 575830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dac527d5-8a4b-5a38-87a8-c5c1636190ab", "parentControlId": 31454, "controlId": "IA-02(13)", "title": "IA-02(13)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585612" }, { "id": 575831, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2054533b-d169-5c55-8e2c-16937d62e5ee", "parentControlId": 31454, "controlId": "IA-02(13)", "title": "IA-02(13)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585612" } ], "id": 31454, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73109", "catalogueId": 1062, "uuid": "9e81bd98-fbf1-528c-ad93-869b82bc0834", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement Out-of-Band Authentication (OOBA) under specific conditions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Out-of-Band Authentication (OOBA)", "description": "

Control Description

Mechanisms exist to implement Out-of-Band Authentication (OOBA) under specific conditions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement Out-of-Band Authentication (OOBA) under specific conditions.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-02.4", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-02.4", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71602, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590557", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590557", "securityControlId": 31455, "ccis": [], "uuid": "3ff5825b-42dd-584f-9060-8b485ad77337", "testId": "IAC-03_A01", "test": "non-organizational users or processes acting on behalf of non-organizational users are uniquely identified and authenticated.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-08", "defaultText": null } ], "externalMappings": [ { "id": 575845, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a614b8e-8ae7-5bf0-bc9e-2dd3f97ea2f1", "parentControlId": 31455, "controlId": "USER 1.1", "title": "USER 1.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585614" }, { "id": 575846, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16a26401-1d41-5e59-846c-191c06eafa10", "parentControlId": 31455, "controlId": "SR 1.1", "title": "SR 1.1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585614" }, { "id": 575847, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5266bc0-2218-51fe-95d7-c151a985e670", "parentControlId": 31455, "controlId": "SR 1.1 RE 1", "title": "SR 1.1 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585614" }, { "id": 575848, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1fd8483-0874-538b-aa13-5f2dd499f1e7", "parentControlId": 31455, "controlId": "CR 1.1", "title": "CR 1.1", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585614" }, { "id": 575849, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e566f23-8e90-5781-a986-d647ab367d61", "parentControlId": 31455, "controlId": "CR 1.1(1)", "title": "CR 1.1(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585615" }, { "id": 575850, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97ea3079-13ce-5ec3-84ef-58c1874be860", "parentControlId": 31455, "controlId": "5.16", "title": "5.16", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585615" }, { "id": 575852, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9091cb2d-c81e-5286-8e13-2fe7f1225171", "parentControlId": 31455, "controlId": "T1053", "title": "T1053", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585615" }, { "id": 575853, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83feb400-471a-5c29-94b6-48c64b936b79", "parentControlId": 31455, "controlId": "T1053.007", "title": "T1053.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585615" }, { "id": 575854, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "121c4b33-8a90-5999-86c3-ab480ed780e5", "parentControlId": 31455, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585615" }, { "id": 575855, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46f3e750-f16c-57fc-8c7a-effccf5e554e", "parentControlId": 31455, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585615" }, { "id": 575856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "975aff83-7366-537c-9692-1d05ef16da1f", "parentControlId": 31455, "controlId": "T1059.008", "title": "T1059.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585615" }, { "id": 575857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4b33a29-b0c5-5f3e-b2a4-4197aaca26d5", "parentControlId": 31455, "controlId": "T1087.004", "title": "T1087.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585615" }, { "id": 575858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d04dba10-1e7d-526b-9d5b-5f9376f2afb8", "parentControlId": 31455, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585615" }, { "id": 575859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2da516bb-278b-500f-8848-e8bdb1aeb842", "parentControlId": 31455, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585616" }, { "id": 575860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2cc2bba-bb5b-5851-adcd-e141dd3fb5da", "parentControlId": 31455, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585616" }, { "id": 575861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ef370a1-47fc-55e0-903d-8adeaf5ba438", "parentControlId": 31455, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585616" }, { "id": 575862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4f3d241-9031-5035-8829-362dd8bc04c6", "parentControlId": 31455, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585616" }, { "id": 575863, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d31599c6-8c62-578c-bd98-da63782c1c1e", "parentControlId": 31455, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585616" }, { "id": 575864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e3b06c1-c17b-5c8e-861b-a8fef8741c32", "parentControlId": 31455, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585616" }, { "id": 575865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a10551b-92a7-5a7a-9bce-3dcc1bb85824", "parentControlId": 31455, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585616" }, { "id": 575866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a521ae42-6d3a-52fb-ad55-434372c845bb", "parentControlId": 31455, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585624" }, { "id": 575867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa5482fb-0847-56e0-b1dc-fe86ca71257e", "parentControlId": 31455, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585624" }, { "id": 575868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1905375e-23cc-5991-bbe6-e303b77ba785", "parentControlId": 31455, "controlId": "T1538", "title": "T1538", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585625" }, { "id": 575869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f9dc926-8fdc-520b-983d-c2be192b9550", "parentControlId": 31455, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585625" }, { "id": 575870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd946eb7-090b-50c5-9435-9f9b68d7ba1c", "parentControlId": 31455, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585625" }, { "id": 575871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8dba3373-fe8c-5c44-9926-c832e39b213f", "parentControlId": 31455, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585626" }, { "id": 575872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a907ddf-9d82-5502-904b-2ffdc13962f2", "parentControlId": 31455, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585626" }, { "id": 575873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9ee5e34-d40b-5e7e-adaf-7141849a61a1", "parentControlId": 31455, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585626" }, { "id": 575875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d21fbefb-c8e3-50e7-85ac-85de6c58ae26", "parentControlId": 31455, "controlId": "IA-8", "title": "IA-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585626" }, { "id": 575876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58c61524-5b36-51e4-9a04-e19c10433786", "parentControlId": 31455, "controlId": "IA-08", "title": "IA-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585627" }, { "id": 575877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89c08635-924d-5802-8cc8-54ccc8966436", "parentControlId": 31455, "controlId": "IA-08", "title": "IA-08", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585627" }, { "id": 575878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebf0c272-0294-5d48-92ea-69bad64f6380", "parentControlId": 31455, "controlId": "IA-08", "title": "IA-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585627" }, { "id": 575879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b954149-6e55-5f2c-897b-c6b1e0948eac", "parentControlId": 31455, "controlId": "IA-08", "title": "IA-08", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585627" }, { "id": 575880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6351b1cc-bfa6-57c9-bad3-e41626595e2a", "parentControlId": 31455, "controlId": "IA-08", "title": "IA-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585627" }, { "id": 575881, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce3890de-1e09-5c9d-a492-ca4e190f9b90", "parentControlId": 31455, "controlId": "IA-08", "title": "IA-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585627" }, { "id": 575882, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cbaeeea8-d71a-5fe2-867b-46b969d4cc52", "parentControlId": 31455, "controlId": "IA-8", "title": "IA-8", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585627" }, { "id": 575883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ba51e08-577d-5840-9212-89a00f13e2d8", "parentControlId": 31455, "controlId": "IA-8", "title": "IA-8", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585627" }, { "id": 575886, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "736cf08b-1efb-5139-83fe-708eb498406d", "parentControlId": 31455, "controlId": "03.05.01.a", "title": "03.05.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585628" }, { "id": 575889, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42a541d1-d6b1-5b3d-84e0-51261c14435c", "parentControlId": 31455, "controlId": "PR.AA-01", "title": "PR.AA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585628" }, { "id": 575890, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "760affc0-9b63-5c0f-a7a8-983c98c316f6", "parentControlId": 31455, "controlId": "PR.AA-03", "title": "PR.AA-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585628" }, { "id": 575891, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "161a78e9-fcb3-56b2-b926-748a1869fe33", "parentControlId": 31455, "controlId": "PR.AA-05", "title": "PR.AA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585628" }, { "id": 575918, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585632", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59271389-5148-5c91-bb88-d73f4a1ca544", "parentControlId": 31455, "controlId": "B2.a", "title": "B2.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585632" }, { "controlId": "B.4.5", "title": "B.4.5 — Device Identification and Authentication", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IA-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "654d6a40-2405-53d2-a5e4-afbe55c90e49", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.5", "title": "NEI 08-09 App D.4.5 — Device Identification and Authentication", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "81ef90d6-a750-5d37-9e80-d3cdc5cad2b7", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.4.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "0d9a0dbe-3e54-50e5-989b-56a92bece95e", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "0213e52b-44df-5917-8b29-736fa28b9994", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "8c659d78-a315-5c3c-8e7d-fdd94ad397d1", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "ba2f86d8-476d-5f96-aee0-23ebaaed35af", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "09c0a468-d523-5933-ace2-255589a71943", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "c9cef74a-aff8-5098-b779-269f70a4ee71", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "e7ecd7b8-e725-541b-aea0-17c37b2c19c0", "isPublic": true } ], "id": 31455, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731091", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731091", "catalogueId": 1062, "uuid": "e17bcf05-a952-5a70-b799-cc1b6be4262f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization uniquely identify and centrally Authenticate, Authorize and Audit (AAA) third-party users and processes that provide services to the organization?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Identification & Authentication for Non-Organizational Users", "description": "

Control Description

Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) third-party users and processes that provide services to the organization.

Evidence Request List (ERL)

E-IAM-05\nE-IAM-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) third-party users and processes that provide services to the organization.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.4.5", "controlId": "IAC-03", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-03", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71603, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590558", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590558", "securityControlId": 31456, "ccis": [], "uuid": "5e374253-1000-58eb-898f-27d10b028f79", "testId": "IAC-03.1_A01", "test": "Personal Identity Verification (PIV)-compliant credentials from other federal agencies are accepted.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-08(01)[01]", "defaultText": null }, { "id": 71604, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590558", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590558", "securityControlId": 31456, "ccis": [], "uuid": "63a197b3-3e70-5686-aec2-07cc3d3730f5", "testId": "IAC-03.1_A02", "test": "Personal Identity Verification (PIV)-compliant credentials from other federal agencies are electronically verified.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-08(01)[02]", "defaultText": null } ], "externalMappings": [ { "id": 575932, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585633", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6dd7518c-20fd-5931-bbf4-3b7d6f529347", "parentControlId": 31456, "controlId": "IA-8(1)", "title": "IA-8(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585633" }, { "id": 575933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585633", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc5fc772-cb55-539e-8d18-26b3af303289", "parentControlId": 31456, "controlId": "IA-08(01)", "title": "IA-08(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585633" }, { "id": 575934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9374af9-8754-538a-a826-76bf82661997", "parentControlId": 31456, "controlId": "IA-08(01)", "title": "IA-08(01)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585634" }, { "id": 575935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46284e70-4577-57cb-8d8c-149f74b6fae4", "parentControlId": 31456, "controlId": "IA-08(01)", "title": "IA-08(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585634" }, { "id": 575936, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6324bbf8-dc78-5571-ae31-86b354c91bd0", "parentControlId": 31456, "controlId": "IA-08(01)", "title": "IA-08(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585634" }, { "id": 575937, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7d7ba37-1d95-58d4-b381-c5d4350724be", "parentControlId": 31456, "controlId": "IA-08(01)", "title": "IA-08(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585634" }, { "id": 575938, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9ce9b34-bdce-5460-8f0c-145514226836", "parentControlId": 31456, "controlId": "IA-08(01)", "title": "IA-08(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585634" } ], "id": 31456, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731091", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731091", "catalogueId": 1062, "uuid": "041fde97-8157-51ce-b54d-41ec1b43cc09", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization accept and electronically verify Personal Identity Verification (PIV) credentials from third-parties?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Acceptance of PIV Credentials from Other Organizations", "description": "

Control Description

Mechanisms exist to accept and electronically verify Personal Identity Verification (PIV) credentials from third-parties.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to accept and electronically verify Personal Identity Verification (PIV) credentials from third-parties.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-03.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71605, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590558", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590558", "securityControlId": 31457, "ccis": [], "uuid": "0e37688e-e110-5618-8822-4889ca23124f", "testId": "IAC-03.2_A01", "test": "only external authenticators that are NIST-compliant are accepted.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-08(02)(a)", "defaultText": null }, { "id": 71606, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590558", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590558", "securityControlId": 31457, "ccis": [], "uuid": "238f143c-8605-5fae-bebe-fa4fa08780ab", "testId": "IAC-03.2_A02", "test": "a list of accepted external authenticators is documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-08(02)(b)[01]", "defaultText": null }, { "id": 71607, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590558", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590558", "securityControlId": 31457, "ccis": [], "uuid": "a041342b-e455-5ff4-9bf6-3f7ce1d8f511", "testId": "IAC-03.2_A03", "test": "a list of accepted external authenticators is maintained.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-08(02)(b)[02]", "defaultText": null } ], "externalMappings": [ { "id": 575947, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585635", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09888c66-b311-53b0-8cc4-2d3f1d99a723", "parentControlId": 31457, "controlId": "IA-8(2)", "title": "IA-8(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585635" }, { "id": 575948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585635", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37e37843-6416-52ab-9ec0-142a84d526e0", "parentControlId": 31457, "controlId": "IA-08(02)", "title": "IA-08(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585635" }, { "id": 575949, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585635", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c6fc0fb-1ffc-5387-b258-a10784fbfa85", "parentControlId": 31457, "controlId": "IA-08(02)", "title": "IA-08(02)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585635" }, { "id": 575950, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585635", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32591d25-cb5c-555e-8fa6-e0e4b5105dac", "parentControlId": 31457, "controlId": "IA-08(02)", "title": "IA-08(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585635" }, { "id": 575951, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb83f569-91aa-5b6d-9bce-ff8af284aa16", "parentControlId": 31457, "controlId": "IA-08(02)", "title": "IA-08(02)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585636" }, { "id": 575952, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2c05363-baa7-50ec-bb4b-6fa6d5b94b51", "parentControlId": 31457, "controlId": "IA-08(02)", "title": "IA-08(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585636" }, { "id": 575953, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ccf8e497-6d91-5630-8c08-39c4f1d372ac", "parentControlId": 31457, "controlId": "IA-08(02)", "title": "IA-08(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585636" } ], "id": 31457, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731091", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731091", "catalogueId": 1062, "uuid": "cfc57fb0-305b-5087-aa8e-232ffcee8a8e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to accept Federal Identity, Credential and Access Management (FICAM)-approved third-party credentials?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 2.0, "title": "Acceptance of Third-Party Credentials", "description": "

Control Description

Automated mechanisms exist to accept Federal Identity, Credential and Access Management (FICAM)-approved third-party credentials.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically accept Federal Identity, Credential and Access Management (FICAM)-approved third-party credentials.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-03.2", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-03.2", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71608, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590558", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590558", "securityControlId": 31458, "ccis": [], "uuid": "57e1d2d2-23bd-5293-8e55-29eb620fbc4c", "testId": "IAC-03.3_A01", "test": "identity management profiles are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-08(04)_ODP", "defaultText": null }, { "id": 71609, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590559", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590559", "securityControlId": 31458, "ccis": [], "uuid": "58e3a8f2-22c2-5a81-a325-d76c3e0aa7ce", "testId": "IAC-03.3_A02", "test": "there is conformance with identity management profiles for identity management.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-08(04)", "defaultText": null } ], "externalMappings": [ { "id": 575969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b972ee22-59e1-5cc4-b26e-030499c676a8", "parentControlId": 31458, "controlId": "IA-8(4)", "title": "IA-8(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585638" }, { "id": 575970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97434f08-c81d-52f8-b7cc-98e4caf64814", "parentControlId": 31458, "controlId": "IA-08(04)", "title": "IA-08(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585638" }, { "id": 575971, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80f4e05b-c47c-575a-b4c5-ec0a8b850fdb", "parentControlId": 31458, "controlId": "IA-08(04)", "title": "IA-08(04)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585638" }, { "id": 575972, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b20958f-b71c-50fa-8925-7caa522dbdc2", "parentControlId": 31458, "controlId": "IA-08(04)", "title": "IA-08(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585638" }, { "id": 575973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91771c5d-470d-5a23-907d-33c703547e21", "parentControlId": 31458, "controlId": "IA-08(04)", "title": "IA-08(04)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585638" }, { "id": 575974, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e37e899-9da0-535e-a816-389af6cdf8b0", "parentControlId": 31458, "controlId": "IA-08(04)", "title": "IA-08(04)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585638" }, { "id": 575975, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "058e8632-1d20-5739-b4c1-e67a3a2a08f5", "parentControlId": 31458, "controlId": "IA-08(04)", "title": "IA-08(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585638" } ], "id": 31458, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731092", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731092", "catalogueId": 1062, "uuid": "39383ff8-b30e-529f-ad20-3be1e0454504", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conform systems to Federal Identity, Credential and Access Management (FICAM)-issued profiles?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Use of FICAM-Issued Profiles", "description": "

Control Description

Mechanisms exist to conform systems to Federal Identity, Credential and Access Management (FICAM)-issued profiles.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conform systems to Federal Identity, Credential and Access Management (FICAM)-issued profiles.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-03.3", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-03.3", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71610, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590559", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590559", "securityControlId": 31459, "ccis": [], "uuid": "1b5edd47-1510-557c-b2f1-aaa29d1819be", "testId": "IAC-03.4_A01", "test": "disassociability measures are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-08(06)_ODP", "defaultText": null }, { "id": 71611, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590559", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590559", "securityControlId": 31459, "ccis": [], "uuid": "0015aa38-03bf-58f3-a972-ed62690db22e", "testId": "IAC-03.4_A02", "test": "measures to disassociate user attributes or identifier assertion relationships among individuals, credential service providers and relying parties are implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-08(06)", "defaultText": null } ], "externalMappings": [ { "id": 575982, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8b5883b-db1b-525b-9a21-8a185beaa36c", "parentControlId": 31459, "controlId": "IA-08(06)", "title": "IA-08(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585639" }, { "id": 575983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f599bfdb-f37d-52da-ba75-9086e6f271cb", "parentControlId": 31459, "controlId": "IA-08(06)", "title": "IA-08(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585639" } ], "id": 31459, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731092", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731092", "catalogueId": 1062, "uuid": "61d23d99-e019-52de-8cf8-180c01605abb", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization disassociate user attributes or credential assertion relationships among individuals, credential service providers and relying parties?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Disassociability", "description": "

Control Description

Mechanisms exist to disassociate user attributes or credential assertion relationships among individuals, credential service providers and relying parties.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to disassociate user attributes or credential assertion relationships among individuals, credential service providers and relying parties.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-03.4", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-03.4", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71612, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590561", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590561", "securityControlId": 31460, "ccis": [], "uuid": "226f2af8-5c26-5440-bd1b-37af1a39ddde", "testId": "IAC-03.5_A01", "test": "the use of external authenticators is restricted to those that are National Institute of Standards and Technology (NIST)-compliant and maintain a list of accepted external authenticators.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 575984, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14c3a28c-1088-59ef-b1e3-49225ad80b6c", "parentControlId": 31460, "controlId": "IA-8(3)", "title": "IA-8(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585639" }, { "id": 575985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "247165ee-70b0-5052-bf30-57de97b0b21d", "parentControlId": 31460, "controlId": "PR.AA-04", "title": "PR.AA-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58564" } ], "id": 31460, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731093", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731093", "catalogueId": 1062, "uuid": "aa1c1b37-7f86-5fca-95e4-4a128ef3db55", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict the use of external authenticators to those that are National Institute of Standards and Technology (NIST)-compliant and maintain a list of accepted external authenticators?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Acceptance of External Authenticators", "description": "

Control Description

Mechanisms exist to restrict the use of external authenticators to those that are National Institute of Standards and Technology (NIST)-compliant and maintain a list of accepted external authenticators.

Evidence Request List (ERL)

E-IAM-05\nE-IAM-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict the use of external authenticators to those that are National Institute of Standards and Technology (NIST)-compliant and maintain a list of accepted external authenticators.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-03.5", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-03.5", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71613, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590561", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590561", "securityControlId": 31461, "ccis": [], "uuid": "a74eb51e-c682-5aed-8162-9dd51d507cc2", "testId": "IAC-04_A01", "test": "devices or types of devices to be uniquely identified and authenticated before establishing a connection are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-03_ODP[01]\n171A_R3_A.03.05.02.ODP[01]", "defaultText": null }, { "id": 71614, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590561", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590561", "securityControlId": 31461, "ccis": [], "uuid": "57a75d48-b613-5b67-9d95-a6ee456b140d", "testId": "IAC-04_A02", "test": "organization-defined devices or types of devices are authenticated before establishing a system connection.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-03\n53A_R5_IA-03_ODP[02]", "defaultText": null }, { "id": 71615, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590562", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590562", "securityControlId": 31461, "ccis": [], "uuid": "1acff5bf-9ed2-5792-9ff7-439e66177b5e", "testId": "IAC-04_A03", "test": "devices and/or types of devices are uniquely identified and authenticated before establishing a local connection.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_IA-03\n53A_R5_IA-03_ODP[02]", "defaultText": null }, { "id": 71616, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590562", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590562", "securityControlId": 31461, "ccis": [], "uuid": "ab616893-9964-5a73-868f-a5fd2faae415", "testId": "IAC-04_A04", "test": "devices and/or types of devices are uniquely identified and authenticated before establishing a remote connection.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_IA-03\n53A_R5_IA-03_ODP[02]", "defaultText": null }, { "id": 71617, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590562", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590562", "securityControlId": 31461, "ccis": [], "uuid": "664ad77c-bcbf-54c8-b4cc-4442909c76da", "testId": "IAC-04_A05", "test": "device identification and authentication are handled based on attestation by configuration management process.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_IA-03(04)", "defaultText": null }, { "id": 71618, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590562", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590562", "securityControlId": 31461, "ccis": [], "uuid": "64b9b025-4e90-51d0-9789-e03ebca7a9ee", "testId": "IAC-04_A06", "test": "devices and/or types of devices requiring use of cryptographically based, bidirectional authentication to authenticate before establishing one or more connections are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IA-03(01)_ODP[01]", "defaultText": null }, { "id": 71619, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590562", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590562", "securityControlId": 31461, "ccis": [], "uuid": "ab2d1c8c-4f6d-5327-a6ba-636ef464de29", "testId": "IAC-04_A07", "test": "devices and/or types of devices are authenticated before establishing a local connection using bidirectional authentication that is cryptographically based.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_IA-03(01)\n53A_R5_IA-03(01)_ODP[02]", "defaultText": null }, { "id": 71620, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590562", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590562", "securityControlId": 31461, "ccis": [], "uuid": "b2e56b4f-3481-5338-87b8-95c1f46a0e32", "testId": "IAC-04_A08", "test": "devices and/or types of devices are authenticated before establishing a remote connection using bidirectional authentication that is cryptographically based.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_IA-03(01)\n53A_R5_IA-03(01)_ODP[02]", "defaultText": null }, { "id": 71621, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590563", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590563", "securityControlId": 31461, "ccis": [], "uuid": "01330540-fc6f-57e3-9dec-81973c9d265a", "testId": "IAC-04_A09", "test": "devices and/or types of devices are authenticated before establishing a network connection using bidirectional authentication that is cryptographically based.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_IA-03(01)\n53A_R5_IA-03(01)_ODP[02]", "defaultText": null }, { "id": 71622, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590563", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590563", "securityControlId": 31461, "ccis": [], "uuid": "ca3243de-fc2f-5634-b4af-e086451e453c", "testId": "IAC-04_A10", "test": " are uniquely identified before establishing a system connection.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: all devices for identification, where feasible for authentication, and document when not feasible", "otherId": "171A_R3_A.03.05.02[01]", "defaultText": null }, { "id": 71623, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590563", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590563", "securityControlId": 31461, "ccis": [], "uuid": "944c512a-2e16-566e-9030-597591bb761f", "testId": "IAC-04_A11", "test": " are authenticated before establishing a system connection.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: all devices for identification, where feasible for authentication, and document when not feasible", "otherId": "171A_R3_A.03.05.02[02]", "defaultText": null } ], "externalMappings": [ { "id": 575998, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585642", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b00a279f-ef10-5e1a-b46e-5284c6e9ed9e", "parentControlId": 31461, "controlId": "USER 1.1", "title": "USER 1.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585642" }, { "id": 575999, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585642", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7dc897b-71eb-54ec-98b4-62151b1cec67", "parentControlId": 31461, "controlId": "USER 1.19", "title": "USER 1.19", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585642" }, { "id": 576000, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585642", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64f198da-95b4-5069-98f5-c2f250f8f5fe", "parentControlId": 31461, "controlId": "SR 1.2", "title": "SR 1.2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585642" }, { "id": 576001, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585642", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b010164-d4fb-59bf-bfda-7f358b136a06", "parentControlId": 31461, "controlId": "SR 1.2 RE 1", "title": "SR 1.2 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585642" }, { "id": 576002, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585642", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b59fa2fd-9c42-5898-9432-b6cddfe1acc3", "parentControlId": 31461, "controlId": "CR 1.2", "title": "CR 1.2", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585642" }, { "id": 576003, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585643", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c462457-622d-5e90-972e-be478fa82f64", "parentControlId": 31461, "controlId": "CR 1.2(1)", "title": "CR 1.2(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585643" }, { "id": 576004, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585643", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9071a892-e1c4-5a91-81a6-5d8b925c52d2", "parentControlId": 31461, "controlId": "5.16", "title": "5.16", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585643" }, { "id": 576006, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585643", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82403dad-8a8e-5dda-9e6c-0448bf5e2732", "parentControlId": 31461, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585643" }, { "id": 576007, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585643", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8efd4d6-0ce4-5389-9289-353b608485af", "parentControlId": 31461, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585643" }, { "id": 576008, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585643", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb8021fd-d1cd-5451-84ca-3f9d3cdfb159", "parentControlId": 31461, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585643" }, { "id": 576009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585643", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c067cd82-1435-5361-b470-1ec6b2d04f9f", "parentControlId": 31461, "controlId": "T1552.005", "title": "T1552.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585643" }, { "id": 576010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585643", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fd7299b-37d3-5128-8b3a-c1d722500419", "parentControlId": 31461, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585643" }, { "id": 576011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585643", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd683963-65bc-5e4f-a390-aa14b09fac92", "parentControlId": 31461, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585644" }, { "id": 576012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b90079a-bbeb-513b-8a71-1d06916ce0de", "parentControlId": 31461, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585644" }, { "id": 576013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7214bcb3-c5ca-561d-8857-ed34c3f618d4", "parentControlId": 31461, "controlId": "T1621", "title": "T1621", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585644" }, { "id": 576015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03acf74b-c095-5d1c-aa84-761de00fa3ba", "parentControlId": 31461, "controlId": "IA-3", "title": "IA-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585644" }, { "id": 576016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "793066b4-804b-53ac-af68-3ba2de78c76f", "parentControlId": 31461, "controlId": "IA-3(1)", "title": "IA-3(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585644" }, { "id": 576017, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e24c444e-dc28-58da-b092-de22f636769e", "parentControlId": 31461, "controlId": "IA-3(4)", "title": "IA-3(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585644" }, { "id": 576018, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e9749d3-cbc4-57da-abc2-4785ee759da2", "parentControlId": 31461, "controlId": "IA-03", "title": "IA-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585644" }, { "id": 576019, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585645", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b588e360-b561-5314-bda2-2542ab307dab", "parentControlId": 31461, "controlId": "IA-03(01)", "title": "IA-03(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585645" }, { "id": 576020, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585645", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f08265bd-fb96-5b67-b3b2-27568094940a", "parentControlId": 31461, "controlId": "IA-03(04)", "title": "IA-03(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585645" }, { "id": 576022, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585645", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8668689f-891e-55e6-8c3b-de6a04d73e17", "parentControlId": 31461, "controlId": "IA-03", "title": "IA-03", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585645" }, { "id": 576023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585645", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "716a7878-b862-542c-a073-88f5493b0587", "parentControlId": 31461, "controlId": "IA-03", "title": "IA-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585645" }, { "id": 576024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585645", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "009f751b-406d-580a-8ca0-1427394edd3b", "parentControlId": 31461, "controlId": "IA-03(01)", "title": "IA-03(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585645" }, { "id": 576025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585645", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "958917f9-cce9-5e37-980c-bdbc1fd992e5", "parentControlId": 31461, "controlId": "IA-03(04)", "title": "IA-03(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585645" }, { "id": 576026, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585645", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b8128e0-82eb-5f5e-b277-6386113b721b", "parentControlId": 31461, "controlId": "IA-03", "title": "IA-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585645" }, { "id": 576027, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585645", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8c4a38a-5255-5882-b770-8ea8f08cdf89", "parentControlId": 31461, "controlId": "IA-03", "title": "IA-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585645" }, { "id": 576028, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585646", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10ad149d-d3cf-55a5-a928-6f4404272c88", "parentControlId": 31461, "controlId": "IA-03", "title": "IA-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585646" }, { "id": 576030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585646", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84e6549a-0163-5055-871e-c940ee65554b", "parentControlId": 31461, "controlId": "IA-3", "title": "IA-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585646" }, { "id": 576034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585646", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ee229da-1ad0-5dc7-bd84-3ad7215c6876", "parentControlId": 31461, "controlId": "3.5.1", "title": "3.5.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585646" }, { "id": 576035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585647", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bbafa2e-7c1a-5e90-a1d0-8a48fc4533a8", "parentControlId": 31461, "controlId": "3.5.2", "title": "3.5.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585647" }, { "id": 576036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585648", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39fd5566-1207-5b06-9e2c-611fe623e9bd", "parentControlId": 31461, "controlId": "03.01.18.b", "title": "03.01.18.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585648" }, { "id": 576037, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585648", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0e0d6b1-1e31-5e54-9a6c-c3d77c3c7dd6", "parentControlId": 31461, "controlId": "03.05.02", "title": "03.05.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585648" }, { "id": 576045, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585649", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9ef2f94-349a-5bba-a3a4-e8dd85dec85d", "parentControlId": 31461, "controlId": "PR.AA-01", "title": "PR.AA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585649" }, { "id": 576046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585649", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6bedbe1-09ec-5294-9a62-b457ff3a0cc7", "parentControlId": 31461, "controlId": "PR.AA-03", "title": "PR.AA-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585649" }, { "id": 576047, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585649", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "716c5bbd-7cf8-5eb7-82f3-05adddf1e4df", "parentControlId": 31461, "controlId": "PR.AA-05", "title": "PR.AA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585649" }, { "id": 576071, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585652", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f28cd33c-3a61-5bd5-b198-77234d3a1bf4", "parentControlId": 31461, "controlId": "CIP-005-7 1.4", "title": "CIP-005-7 1.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585652" }, { "id": 576078, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0eea4024-634e-5da8-a34b-bc8fb0ea806c", "parentControlId": 31461, "controlId": "B2.b", "title": "B2.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585653" }, { "controlId": "B.4.5", "title": "B.4.5 — Device Identification and Authentication", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IA-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "64f99164-1109-54c0-bcf6-a6f9e5d0fbce", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.5", "title": "NEI 08-09 App D.4.5 — Device Identification and Authentication", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6af8d760-057c-5ff1-a833-b877abb30275", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.4.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "9ec32465-3ef0-5102-919b-1d91ba4c8b43", "isPublic": true }, { "controlId": "B.4.6", "title": "B.4.6 — Identifier Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IA-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "303506f2-c991-5d95-8343-70b43fcb6b1f", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.6", "title": "NEI 08-09 App D.4.6 — Identifier Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "21c6b090-2bc5-553b-9bdc-a5db5383a8ee", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "c369a82e-8ac4-5cb4-ae49-28aaf82ac918", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "07399353-e47c-5f9c-99df-5e17dfabcdb5", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "4f4fb25c-6561-5591-983d-d96ac4389339", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "e0668c89-9203-5a99-8303-b3d5140d38e6", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "e793e8f4-bb28-5649-b552-88f3b1294740", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "e4ab7534-b51b-56ce-a9c7-2d9d4c827c69", "isPublic": true } ], "id": 31461, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731093", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731093", "catalogueId": 1062, "uuid": "7f9188f9-12a7-5d37-bf85-96c3f8744a37", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization uniquely identify and centrally Authenticate, Authorize and Audit (AAA) devices before establishing a connection using bidirectional authentication that is cryptographically- based and replay resistant?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Identification & Authentication for Devices", "description": "

Control Description

Mechanisms exist to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) devices before establishing a connection using bidirectional authentication that is cryptographically- based and replay resistant.

Evidence Request List (ERL)

E-IAM-05\nE-IAM-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to uniquely identify and centrally Authenticate, Authorize and Audit (AAA) devices before establishing a connection using bidirectional authentication that is cryptographically- based and replay resistant.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.4.5, B.4.6", "controlId": "IAC-04", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-04", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71624, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590563", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590563", "securityControlId": 31462, "ccis": [], "uuid": "c892b012-f5d2-5af0-b02c-f04c9b94426f", "testId": "IAC-04.1_A01", "test": "configuration management process to be employed to handle device identification and authentication based on attestation is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-03(04)_ODP", "defaultText": null } ], "externalMappings": [ { "id": 576082, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "908ce9d3-c91d-57bd-8962-8b2bac686ff2", "parentControlId": 31462, "controlId": "IA-3(4)", "title": "IA-3(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585653" }, { "id": 576083, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0cd33e76-12dc-5dca-ada1-c41f9865a1f6", "parentControlId": 31462, "controlId": "IA-03(04)", "title": "IA-03(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585653" }, { "id": 576085, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585654", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4c8a68f-7b93-5aae-808e-589b604bee6a", "parentControlId": 31462, "controlId": "IA-03(04)", "title": "IA-03(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585654" } ], "id": 31462, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731093", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731093", "catalogueId": 1062, "uuid": "7efa9419-74bf-552f-b934-3d2fccf17ec8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure device identification and authentication is accurate by centrally-managing the joining of systems to the domain as part of the initial asset configuration management process?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Device Attestation", "description": "

Control Description

Mechanisms exist to ensure device identification and authentication is accurate by centrally-managing the joining of systems to the domain as part of the initial asset configuration management process.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure device identification and authentication is accurate by centrally-managing the joining of systems to the domain as part of the initial asset configuration management process.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "IAC-04.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71626, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590564", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590564", "securityControlId": 31464, "ccis": [], "uuid": "bc2d5496-25c1-549e-a44f-add5677143be", "testId": "IAC-05_A01", "test": "system services and applications to be uniquely identified and authenticated are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-09_ODP", "defaultText": null }, { "id": 71627, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590564", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590564", "securityControlId": 31464, "ccis": [], "uuid": "b5facdf3-775d-5c91-a4aa-f07181ca9adc", "testId": "IAC-05_A02", "test": "system services and applications are uniquely identified and authenticated before establishing communications with devices, users or other services or applications.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-09", "defaultText": null } ], "externalMappings": [ { "id": 576097, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585655", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a887f66-4f4b-5ee5-b530-4b4779d5194e", "parentControlId": 31464, "controlId": "USER 1.1", "title": "USER 1.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585655" }, { "id": 576098, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585655", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7765e1d7-a92d-5986-91a3-3bc17b6b7899", "parentControlId": 31464, "controlId": "USER 1.6", "title": "USER 1.6", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585655" }, { "id": 576099, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585655", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ecb2436d-4112-5535-ab75-36b6d50b8285", "parentControlId": 31464, "controlId": "SR 1.2", "title": "SR 1.2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585655" }, { "id": 576100, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585655", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "734b2bc2-353c-5fbf-afa7-45ff0c60df42", "parentControlId": 31464, "controlId": "SR 1.2 RE 1", "title": "SR 1.2 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585656" }, { "id": 576101, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdb32ba8-5400-5774-ab2b-befcdc123f74", "parentControlId": 31464, "controlId": "5.16", "title": "5.16", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585656" }, { "id": 576103, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7032682-1f6d-5aea-adb2-885c15cfc06b", "parentControlId": 31464, "controlId": "T1036", "title": "T1036", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585656" }, { "id": 576104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7986113-188c-5fef-a783-344c6d50d7d5", "parentControlId": 31464, "controlId": "T1036.001", "title": "T1036.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585656" }, { "id": 576105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd2835a6-79d6-5fb3-8f3c-d4d2d8ed9f4b", "parentControlId": 31464, "controlId": "T1036.005", "title": "T1036.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585656" }, { "id": 576106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f41f446-6f9f-528f-9afe-872eeb8b5218", "parentControlId": 31464, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585656" }, { "id": 576107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ea544ed-df88-592d-9bbe-e9158c68cacb", "parentControlId": 31464, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585656" }, { "id": 576108, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "743891f7-75b3-5e4c-a4ef-9728281539a7", "parentControlId": 31464, "controlId": "T1059.002", "title": "T1059.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585656" }, { "id": 576109, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ef4b297-cfee-55f6-8b1b-f5c7c87fe951", "parentControlId": 31464, "controlId": "T1213.003", "title": "T1213.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585656" }, { "id": 576110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585657", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd5e9391-0289-556b-8b3c-c741137cdea3", "parentControlId": 31464, "controlId": "T1525", "title": "T1525", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585657" }, { "id": 576111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585657", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efa8fa25-4f96-5648-9038-439f509ed71a", "parentControlId": 31464, "controlId": "T1546", "title": "T1546", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585657" }, { "id": 576112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585657", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "914049bd-dd91-56d3-825b-6edaf40d4edd", "parentControlId": 31464, "controlId": "T1546.006", "title": "T1546.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585657" }, { "id": 576113, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585657", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43fb3408-3ad9-5321-a179-fcc95d103548", "parentControlId": 31464, "controlId": "T1546.013", "title": "T1546.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585657" }, { "id": 576114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585657", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "647f14f1-cad3-5287-b771-d04a2d189dc2", "parentControlId": 31464, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585657" }, { "id": 576115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585657", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "661b88d4-5cf9-5d69-aa58-4916251f3e5d", "parentControlId": 31464, "controlId": "T1553.004", "title": "T1553.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585657" }, { "id": 576116, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585657", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db404f20-45ad-5881-9f4b-b588663eaa92", "parentControlId": 31464, "controlId": "T1554", "title": "T1554", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585657" }, { "id": 576117, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585657", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a01befa0-00fd-51f2-82f6-d0538f810488", "parentControlId": 31464, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585658" }, { "id": 576118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585658", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b501b4b0-47cc-5691-bc34-91e9f393294b", "parentControlId": 31464, "controlId": "T1562.009", "title": "T1562.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585658" }, { "id": 576119, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585658", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc041a5e-a96a-5561-b534-b018efee6182", "parentControlId": 31464, "controlId": "T1566", "title": "T1566", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585658" }, { "id": 576120, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585658", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c117b192-db32-57ad-89d5-bcb751f70ddb", "parentControlId": 31464, "controlId": "T1566.001", "title": "T1566.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585658" }, { "id": 576121, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585658", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8b649fd-40c4-58f2-a821-d9e9dc8b9d1b", "parentControlId": 31464, "controlId": "T1566.002", "title": "T1566.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585658" }, { "id": 576122, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585658", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2eb375cb-1cbc-5035-be3c-7e66fb2ac1de", "parentControlId": 31464, "controlId": "T1598", "title": "T1598", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585658" }, { "id": 576123, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585658", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "774113fc-7a40-5055-a6d1-67fba86d99ea", "parentControlId": 31464, "controlId": "T1598.002", "title": "T1598.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585658" }, { "id": 576124, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585658", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8187938-0229-528a-839b-c7aacdc57d02", "parentControlId": 31464, "controlId": "T1598.003", "title": "T1598.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585658" }, { "id": 576125, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585658", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d2004d5-57d3-5409-a6fb-f00ec3b87285", "parentControlId": 31464, "controlId": "IA-9", "title": "IA-9", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585658" }, { "id": 576126, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585659", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86a04299-830f-5da5-8615-625851c27841", "parentControlId": 31464, "controlId": "IA-09", "title": "IA-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585659" }, { "id": 576127, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585659", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f50e03a-dd68-5578-a058-259872a4cfc6", "parentControlId": 31464, "controlId": "IA-09", "title": "IA-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585659" }, { "id": 576128, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585659", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e0ded35-a180-52e3-8939-b38bdb49ab96", "parentControlId": 31464, "controlId": "IA-9", "title": "IA-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585659" }, { "id": 576129, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585659", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9cc66ba-652e-5407-b98c-847baee170bd", "parentControlId": 31464, "controlId": "IA-9", "title": "IA-9", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585659" }, { "id": 576132, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585659", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d1b18e5-5fcf-58a4-8f91-d6a416cf7d4e", "parentControlId": 31464, "controlId": "03.05.01.a", "title": "03.05.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585659" }, { "id": 576133, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585659", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b937ccd9-2ed2-5e0e-a8d2-09cd4eaabc8f", "parentControlId": 31464, "controlId": "03.05.02", "title": "03.05.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585659" }, { "id": 576136, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58566", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96f524e4-dbe3-570a-b78c-b411ff621a36", "parentControlId": 31464, "controlId": "PR.AA-01", "title": "PR.AA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58566" }, { "id": 576137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58566", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8685c0d2-0e63-5d63-bfe4-32bab4a45627", "parentControlId": 31464, "controlId": "PR.AA-03", "title": "PR.AA-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58566" }, { "id": 576138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58566", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76fc972e-13a2-5217-954c-c14aad304b73", "parentControlId": 31464, "controlId": "PR.AA-05", "title": "PR.AA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58566" }, { "controlId": "B.4.7", "title": "B.4.7 — Authenticator Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IA-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "e24ccb97-d775-510d-835f-5623b662b1da", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.7", "title": "NEI 08-09 App D.4.7 — Authenticator Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "366745e0-a686-5f95-915c-0fd35b161b77", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.4.7", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "03f31bbd-110e-5c1f-9c37-751a30beed29", "isPublic": true }, { "controlId": "CIP-007-6-R5", "title": "CIP-007-6-R5 — System Access Control and Authentication", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "72538631-577b-503e-930d-9871225e77a1", "isPublic": true }, { "controlId": "CIP-007-6-5.1", "title": "CIP-007-6-5.1 — Have a method(s) to enforce authentication of interactive user access, where technically feasible.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "82e78398-61dd-569a-8be2-77f03a4d5447", "isPublic": true }, { "controlId": "CIP-007-6-5.2", "title": "CIP-007-6-5.2 — Identify and inventory all known enabled default or other generic account types, either by system, by groups of syste...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3048b75c-413d-5fc1-888d-1b28e26bd125", "isPublic": true }, { "controlId": "CIP-007-6-5.3", "title": "CIP-007-6-5.3 — Identify individuals who have authorized access to shared accounts.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "752a38a1-d477-5a43-a96d-63248f7dc9da", "isPublic": true }, { "controlId": "CIP-007-6-5.4", "title": "CIP-007-6-5.4 — Change known default passwords, per Cyber Asset capability", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5a9a8b25-b1f4-5d44-beaf-c63e4666fff1", "isPublic": true }, { "controlId": "CIP-007-6-5.5", "title": "CIP-007-6-5.5 — For password-only authentication for interactive user access, either technically or procedurally enforce the followin...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0b4d6f02-8974-53ef-9952-91724e87ff3c", "isPublic": true }, { "controlId": "CIP-007-6-5.5.1", "title": "CIP-007-6-5.5.1 — Password length that is, at least, the lesser of eight characters or the maximum length supported by the Cyber Asset", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "17f234f1-e992-5cef-af4c-22071fc9754f", "isPublic": true }, { "controlId": "CIP-007-6-5.5.2", "title": "CIP-007-6-5.5.2 — Minimum password complexity that is the lesser of three or more different types of characters (e.g., uppercase alphab...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0408932b-dc5a-5eba-b3f6-17498e44a7d9", "isPublic": true }, { "controlId": "CIP-007-6-5.6", "title": "CIP-007-6-5.6 — Where technically feasible, for password-only authentication for interactive user access, either technically or proce...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6361077a-e467-5a30-9472-0253f0ba446a", "isPublic": true }, { "controlId": "CIP-007-6-5.7", "title": "CIP-007-6-5.7 — Where technically feasible, either:  Limit the number of unsuccessful authentication attempts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "cf2c275c-f3dc-51d3-947a-3bb81aa46dcd", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b0b8c8a7-056e-5155-9b22-24d1f6b35a38", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "372a1295-fba5-5464-aba3-96927cd1dc57", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "e1743b6e-a67b-58c8-ab31-ec660c54b6a3", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "8f415434-20e0-5e61-a84b-3a9136b02622", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "43832aa8-f1b6-589c-9da4-e10c65e2b208", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "0ab45c86-e89d-522c-85d6-c1afa9c0ffde", "isPublic": true } ], "id": 31464, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731094", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731094", "catalogueId": 1062, "uuid": "0285d60b-d115-5257-834e-0d6c1c6442a9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify and authenticate third-party Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Identification & Authentication for Third-Party Technology Assets, Applications and/or Services (TAAS)", "description": "

Control Description

Mechanisms exist to identify and authenticate third-party Technology Assets, Applications and/or Services (TAAS).

Evidence Request List (ERL)

E-IAM-05\nE-IAM-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify and authenticate third-party Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.4.7
NERC-CIP (2026) Requirements: CIP-007-6-R5", "controlId": "IAC-05", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-05", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71628, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590564", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590564", "securityControlId": 31465, "ccis": [], "uuid": "8ff84977-67d3-54d2-8b11-9f9fd4ff4087", "testId": "IAC-05.1_A01", "test": "third-party service providers provide the organization with current and accurate information for any third-party user with access to the organization's data or assets.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 576154, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585662", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "065ea50b-8280-5877-80bb-917fd6c03abb", "parentControlId": 31465, "controlId": "IA-9(1)", "title": "IA-9(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585662" } ], "id": 31465, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731094", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731094", "catalogueId": 1062, "uuid": "99c5a46e-10c2-54ba-983e-df6aeb286bdf", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure external service providers provide current and accurate information for any third-party user with access to its data or assets?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Sharing Identification & Authentication Information", "description": "

Control Description

Mechanisms exist to ensure external service providers provide current and accurate information for any third-party user with access to the organization's data or assets.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure external service providers provide current and accurate information for any third-party user with access to the organization's data or assets.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "IAC-05.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-05.1", "references": "

Micro-Small Business (<10 staff)

∙ Policy prohibiting sharing of passwords or credentials

Small Business (10-49 staff)

∙ No credential-sharing policy\n∙ User acknowledgment required

Medium Business (50-249 staff)

∙ Formal policy prohibiting sharing of identification/authentication info\n∙ User training

Large Business (250-999 staff)

∙ Technical controls preventing credential sharing\n∙ PAM for shared account management

Enterprise (>1,000 staff)

∙ Enterprise IAM/PAM with individual accountability\n∙ Shared account vaulting (CyberArk)\n∙ Technical enforcement of no credential sharing", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71629, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590564", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590564", "securityControlId": 31466, "ccis": [], "uuid": "43018586-9fe6-5151-a5fe-abdbda1711fb", "testId": "IAC-05.2_A01", "test": "privileged access by non-organizational users is prohibited.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 576162, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585663", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13d6a468-a5d1-5232-9793-4622cdf30952", "parentControlId": 31466, "controlId": "AC-06(06)", "title": "AC-06(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585663" }, { "id": 576163, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585663", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35b5c505-c4b4-5b39-879d-9d75f69628e2", "parentControlId": 31466, "controlId": "AC-06(06)", "title": "AC-06(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585663" }, { "id": 576165, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585663", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04b91881-dbcc-5797-ba51-ee5b1a356645", "parentControlId": 31466, "controlId": "AC-6(6)", "title": "AC-6(6)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585663" }, { "id": 576168, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585663", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7300560-6715-51f7-bf84-059f8fc5d78c", "parentControlId": 31466, "controlId": "03.07.05.a", "title": "03.07.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585663" } ], "id": 31466, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731095", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731095", "catalogueId": 1062, "uuid": "2ad66e6c-adca-524c-9288-f7c20996531a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prohibit privileged access by non-organizational users?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Privileged Access by Non-Organizational Users", "description": "

Control Description

Mechanisms exist to prohibit privileged access by non-organizational users.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prohibit privileged access by non-organizational users.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-05.2", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-05.2", "references": "

Micro-Small Business (<10 staff)

∙ Require separate accounts for non-organizational privileged users

Small Business (10-49 staff)

∙ Separate privileged accounts for contractors/third parties

Medium Business (50-249 staff)

∙ Formal policy for non-organizational privileged user access\n∙ Separate account management

Large Business (250-999 staff)

∙ PAM solution for third-party privileged access management\n∙ Session recording

Enterprise (>1,000 staff)

∙ Enterprise PAM for third-party privileged access (e.g., BeyondTrust, CyberArk)\n∙ Just-in-time access\n∙ Session recording and monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71630, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590564", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590564", "securityControlId": 31467, "ccis": [], "uuid": "1508e027-4ce2-5a8c-a4af-b21ee0edf87f", "testId": "IAC-06_A01", "test": "multi-factor authentication for access to privileged accounts is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: local, network and remote", "otherId": "53A_R5_IA-02(01)\n171A_R3_A.03.05.03[01]", "defaultText": null }, { "id": 71631, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590565", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590565", "securityControlId": 31467, "ccis": [], "uuid": "cb218c0d-480a-599d-9a3c-a869f36c9cf8", "testId": "IAC-06_A02", "test": "multi-factor authentication for access to non-privileged accounts is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: local, network and remote", "otherId": "53A_R5_IA-02(02)\n171A_R3_A.03.05.03[02]", "defaultText": null }, { "id": 71632, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590565", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590565", "securityControlId": 31467, "ccis": [], "uuid": "17e87389-a443-5226-9b10-c610145da854", "testId": "IAC-06_A03", "test": "system components that are known, authenticated, in a properly configured state or in a trust profile are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "172A_3.5.3e[a]", "defaultText": null }, { "id": 71633, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590565", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590565", "securityControlId": 31467, "ccis": [], "uuid": "969415e8-7e5c-5c93-8fb9-03b4e0142797", "testId": "IAC-06_A04", "test": "automated or manual/procedural mechanisms to prohibit system components from connecting to organizational systems are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "172A_3.5.3e[b]", "defaultText": null }, { "id": 71634, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590565", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590565", "securityControlId": 31467, "ccis": [], "uuid": "4b47d0d9-edd1-5a3f-af49-8f463beb6f54", "testId": "IAC-06_A05", "test": "automated or manual/procedural mechanisms are employed to prohibit system components from connecting to organizational systems unless the components are known, authenticated, in a properly configured state or in a trust profile.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "172A_3.5.3e[c]", "defaultText": null }, { "id": 71635, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590565", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590565", "securityControlId": 31467, "ccis": [], "uuid": "7e77e482-8e72-5692-a275-e320a1ab8a2c", "testId": "IAC-06_A06", "test": "multi-factor authentication is implemented in the establishment of nonlocal maintenance and diagnostic sessions.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.07.05.b[01]", "defaultText": null } ], "externalMappings": [ { "id": 576192, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585674", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92f6a5e3-b9c0-5983-984b-d74e22f57efd", "parentControlId": 31467, "controlId": "USER 1.9", "title": "USER 1.9", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585674" }, { "id": 576193, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585675", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "edd1b2ca-d426-5a56-a84a-d4aa9e6acf92", "parentControlId": 31467, "controlId": "SR 1.1 RE 2", "title": "SR 1.1 RE 2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585675" }, { "id": 576194, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585675", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ee8d0c7-2fc5-50bc-9c12-1ee2a0113f7b", "parentControlId": 31467, "controlId": "CR 1.1(2)", "title": "CR 1.1(2)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585675" }, { "id": 576198, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585675", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1844e9c8-64cb-5f4c-af52-5dcc24626927", "parentControlId": 31467, "controlId": "IA-2(11)", "title": "IA-2(11)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585675" }, { "id": 576199, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585675", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e7ba9d6-bd3a-51fa-ad6e-db5e0b9b3e03", "parentControlId": 31467, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585675" }, { "id": 576200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585675", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8efadc90-39d7-5b9d-a3fd-e7dc4a336fee", "parentControlId": 31467, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585675" }, { "id": 576203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585676", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8eaab6c-a5be-56a6-84c5-3e550d1897e1", "parentControlId": 31467, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585676" }, { "id": 576204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585676", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acfc1faa-4b88-5900-a81c-7cbd5c93076f", "parentControlId": 31467, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585676" }, { "id": 576205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585676", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87c7bb71-a242-5841-998e-e2714a25e3fd", "parentControlId": 31467, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585676" }, { "id": 576206, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585676", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35eddd5a-0c80-5c83-bb0e-6cdf83b34019", "parentControlId": 31467, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585676" }, { "id": 576207, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585676", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7d3e26f-e624-525f-af1c-0a35d9fedb29", "parentControlId": 31467, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585676" }, { "id": 576208, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585676", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7b96556-675e-558a-82d1-cb00848fff1e", "parentControlId": 31467, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585676" }, { "id": 576209, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585676", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51878992-13ac-5628-951a-1a60373bef55", "parentControlId": 31467, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585676" }, { "id": 576210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585676", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6d94439-e640-5fb9-ad53-58329d246a0b", "parentControlId": 31467, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585677" }, { "id": 576211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b3f2599-f4e4-58f6-81c4-f3ccb809f4ca", "parentControlId": 31467, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585677" }, { "id": 576212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2befefef-bcf6-5567-83dc-30143d11c669", "parentControlId": 31467, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585677" }, { "id": 576213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00ec5e91-7a00-5648-abc1-6d353ff31aab", "parentControlId": 31467, "controlId": "3.5.3", "title": "3.5.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585677" }, { "id": 576214, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdc49c61-7959-5a3f-97b5-96a9d5c695ea", "parentControlId": 31467, "controlId": "3.7.5", "title": "3.7.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585677" }, { "id": 576215, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fd39f1b-6f97-53d1-b9df-127c9d8eece2", "parentControlId": 31467, "controlId": "03.05.03", "title": "03.05.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585677" }, { "id": 576216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b7cb588-969f-5aaa-94b2-73167cd7bb7a", "parentControlId": 31467, "controlId": "03.07.05.b", "title": "03.07.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585677" }, { "id": 576249, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585681", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65ffe1b2-1c8c-5a34-8be0-ef83c53c5788", "parentControlId": 31467, "controlId": "ACCESS-1h", "title": "ACCESS-1h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585681" }, { "id": 576250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585681", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d67f3c37-f371-5966-a202-8ed3c2c3a736", "parentControlId": 31467, "controlId": "ACCESS-1i", "title": "ACCESS-1i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585681" }, { "id": 576273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3cca5289-7952-5059-b99a-e55f50f50172", "parentControlId": 31467, "controlId": "CIP-005-7 2.3", "title": "CIP-005-7 2.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585684" }, { "controlId": "B.4.2", "title": "B.4.2 — User Identification and Authentication", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IA-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "684ca3c1-ee9a-5b26-be93-7787724fb58e", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.2", "title": "NEI 08-09 App D.4.2 — User Identification and Authentication", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "ff596326-e73e-57d0-8f24-7b65fc4319ed", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.4.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "302f9057-ea4c-5662-8128-b1ad3fb67472", "isPublic": true }, { "controlId": "CIP-005-7-R2", "title": "CIP-005-7-R2 — Interactive Remote Access Management", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ebf44af2-9de1-53e6-bac7-c4ef6dc2398b", "isPublic": true }, { "controlId": "CIP-005-7-2.1", "title": "CIP-005-7-2.1 — For all Interactive Remote Access, utilize an Intermediate System such that the Cyber Asset initiating Interactive Re...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "11e7c71d-f4bd-5ef5-8b4e-c6e0597ac430", "isPublic": true }, { "controlId": "CIP-005-7-2.2", "title": "CIP-005-7-2.2 — For all Interactive Remote Access sessions, utilize encryption that terminates at an Intermediate System.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "bf4ed353-710a-512f-aac5-f889e9ed7edb", "isPublic": true }, { "controlId": "CIP-005-7-2.3", "title": "CIP-005-7-2.3 — Require multi-factor authentication for all Interactive Remote Access sessions.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "183352f0-f248-5014-acce-23a88336b973", "isPublic": true }, { "controlId": "CIP-005-7-2.4", "title": "CIP-005-7-2.4 — Have one or more methods for determining active vendor remote access sessions (including Interactive Remote Access an...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "af61ea6b-38c0-54d6-933f-0b885e86bb86", "isPublic": true }, { "controlId": "CIP-005-7-2.5", "title": "CIP-005-7-2.5 — Have one or more method(s) to disable active vendor remote access (including Interactive Remote Access and system- to...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1b117f79-072e-5bee-8ded-78f65445ef1a", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "2ecb53cc-9e7f-5b30-89bc-bf08c043af67", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "aad0bd58-baee-56a5-b19d-8740e3ce4172", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "c8fa1280-ec2a-595d-bac9-edbd1a6de6d5", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "79aa2947-6677-5953-9013-09ccd8339066", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "8a4cb4e3-6807-5b8b-ba33-44702708880f", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "26632597-4ced-5d0a-a8f5-3265b65970a6", "isPublic": true } ], "id": 31467, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731095", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731095", "catalogueId": 1062, "uuid": "0b88584c-2dd0-5031-8905-8c2eae0cf756", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to enforce Multi-Factor Authentication (MFA) for:\n (1) Remote network access; \n (2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n (3) Non-console access to critical TAAS that store, transmit and/or process sensitive/regulated data?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Multi-Factor Authentication (MFA)", "description": "

Control Description

Automated mechanisms exist to enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/ or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive/regulated data.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.\n▪ TAAS are configured to use Multi-Fact or Authentication (MFA) to authenticate network access for privileged and non-privileged accounts.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically enforce Multi-Factor Authentication (MFA) for:\n(1) Remote network access; \n(2) Third-party Technology Assets, Applications and/or Services (TAAS); and/or\n(3) Non-console access to critical TAAS that store, transmit and/or process sensitive/regulated data.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.4.2
NERC-CIP (2026) Requirements: CIP-005-7-R2", "controlId": "IAC-06", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-06", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71636, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590566", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590566", "securityControlId": 31468, "ccis": [], "uuid": "7daa2c12-735c-585d-b6e2-f06cd3f8741d", "testId": "IAC-06.1_A01", "test": "privileged accounts are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.5.3[a]", "defaultText": null }, { "id": 71637, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590566", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590566", "securityControlId": 31468, "ccis": [], "uuid": "d6c38516-427e-5734-bc7a-e9e7ecea0620", "testId": "IAC-06.1_A02", "test": "multifactor authentication is implemented for network access to privileged accounts.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.5.3[c]\n53A_R5_IA-02(01)", "defaultText": null } ], "externalMappings": [ { "id": 576354, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585693", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7605f1a8-400b-5b3e-ad8b-6eaa6d6a20b8", "parentControlId": 31468, "controlId": "IA-2(1)", "title": "IA-2(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585693" }, { "id": 576355, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585693", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15e8c3b8-8de8-53b9-81d7-e08d71e52197", "parentControlId": 31468, "controlId": "IA-2(4)", "title": "IA-2(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585693" }, { "id": 576356, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585693", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "730db33b-dfce-588c-9c1d-880136404ac8", "parentControlId": 31468, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585693" }, { "id": 576357, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585693", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "151e5d0a-25d8-5f58-8e13-6600e74b2796", "parentControlId": 31468, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585693" }, { "id": 576360, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585694", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96228cae-04d8-5b56-b36e-3fb430d8c815", "parentControlId": 31468, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585694" }, { "id": 576361, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585694", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1924d040-8efc-53c4-83da-9d8366a3d0e1", "parentControlId": 31468, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585694" }, { "id": 576362, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585694", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aafa1de7-02ec-5ed0-822e-361992034459", "parentControlId": 31468, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585694" }, { "id": 576363, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585694", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0895688-bfde-5907-805f-7ecb1a78ef4f", "parentControlId": 31468, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585694" }, { "id": 576364, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585694", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34e64dc2-ce50-5232-afd6-8f71feebef2b", "parentControlId": 31468, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585694" }, { "id": 576365, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585694", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e9acc64-edfd-5f77-b73f-90c745bfa2c0", "parentControlId": 31468, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585694" }, { "id": 576366, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585695", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50924c90-5763-5118-b8b8-6ebc90205f2c", "parentControlId": 31468, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585695" }, { "id": 576367, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585695", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57918a14-522e-5859-ab80-fdeb5217ed85", "parentControlId": 31468, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585695" }, { "id": 576368, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585695", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad78fd73-318d-58cc-8c75-62ab7942597f", "parentControlId": 31468, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585695" }, { "id": 576369, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585695", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e03a9747-6277-51f8-982b-16a17473cea1", "parentControlId": 31468, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585695" }, { "id": 576370, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585695", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bf30174-336b-5f5f-9a6e-60a3e2728620", "parentControlId": 31468, "controlId": "3.5.3", "title": "3.5.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585695" }, { "id": 576371, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585695", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0de248ba-b178-5584-b3a2-493d22259b67", "parentControlId": 31468, "controlId": "03.05.03", "title": "03.05.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585695" }, { "id": 576394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44b35a3f-94cd-5ac1-b468-44e7d63a1302", "parentControlId": 31468, "controlId": "ACCESS-1h", "title": "ACCESS-1h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585698" } ], "id": 31468, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731095", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731095", "catalogueId": 1062, "uuid": "acaa8174-5cf1-5bce-8265-c0616bf12bd5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize Multi-Factor Authentication (MFA) to authenticate network access for privileged accounts?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Network Access to Privileged Accounts", "description": "

Control Description

Mechanisms exist to utilize Multi-Factor Authentication (MFA) to authenticate network access for privileged accounts.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize Multi-Factor Authentication (MFA) to authenticate network access for privileged accounts.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-06.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-06.1", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71638, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590566", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590566", "securityControlId": 31469, "ccis": [], "uuid": "17ffcb50-18a6-5b7a-93de-24fbf5182532", "testId": "IAC-06.2_A01", "test": "multifactor authentication is implemented for network access to non-privileged accounts.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.5.3[d]\n53A_R5_IA-02(02)", "defaultText": null } ], "externalMappings": [ { "id": 576432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585702", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e77dd137-d3ba-599e-88e5-c1a6c830203a", "parentControlId": 31469, "controlId": "IA-2(2)", "title": "IA-2(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585702" }, { "id": 576433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585702", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f28f2264-d57e-5ec8-bd90-cd33e7557183", "parentControlId": 31469, "controlId": "IA-2(4)", "title": "IA-2(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585702" }, { "id": 576434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585702", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17e5198f-efa9-5bd1-87db-7c69b7ffadcd", "parentControlId": 31469, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585702" }, { "id": 576435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585702", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8c33e12-f174-5918-92d3-ba3f40f14725", "parentControlId": 31469, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585702" }, { "id": 576438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "345cbe61-ad06-57e8-b176-a64c6f8278ac", "parentControlId": 31469, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585703" }, { "id": 576439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2207b6fa-bc82-5d39-b847-b98246ba3e06", "parentControlId": 31469, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585703" }, { "id": 576440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "650dd72c-ea43-50e3-a1a5-20d9bdec11b7", "parentControlId": 31469, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585703" }, { "id": 576441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c90f752-7170-59be-9577-713cd923e4d9", "parentControlId": 31469, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585703" }, { "id": 576442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fae995af-127d-5fa2-acf5-2c75fe09d5e3", "parentControlId": 31469, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585703" }, { "id": 576443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d12260c-d3c5-5624-af22-02143fba386e", "parentControlId": 31469, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585703" }, { "id": 576444, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f57aa7b6-06b7-55fb-ae3c-64c30a82c70d", "parentControlId": 31469, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585703" }, { "id": 576445, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae79bfa5-69db-5ac9-ab57-8519a732df2b", "parentControlId": 31469, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585703" }, { "id": 576446, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4c7cbf4-c951-5147-990d-8c6856b83502", "parentControlId": 31469, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585704" }, { "id": 576447, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2397c695-4d8c-5d3f-aa32-e2a6ad63aea4", "parentControlId": 31469, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585704" }, { "id": 576448, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53db9527-b226-5bc2-b1b8-2fc2c586ed61", "parentControlId": 31469, "controlId": "3.5.3", "title": "3.5.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585704" }, { "id": 576449, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6bc560c-2a69-584d-aaf8-b480d29b910e", "parentControlId": 31469, "controlId": "03.05.03", "title": "03.05.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585704" } ], "id": 31469, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731096", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731096", "catalogueId": 1062, "uuid": "542ba22b-4fd3-5c32-97af-bf5fa2283ea3", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize Multi-Factor Authentication (MFA) to authenticate network access for non-privileged accounts?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Network Access to Non-Privileged Accounts", "description": "

Control Description

Mechanisms exist to utilize Multi-Factor Authentication (MFA) to authenticate network access for non-privileged accounts.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize Multi-Factor Authentication (MFA) to authenticate network access for non-privileged accounts.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-06.2", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-06.2", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71639, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590567", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590567", "securityControlId": 31470, "ccis": [], "uuid": "aed9aa0f-8ada-5fb4-88a3-272eca804534", "testId": "IAC-06.3_A01", "test": "privileged accounts are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.5.3[a]", "defaultText": null }, { "id": 71640, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590567", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590567", "securityControlId": 31470, "ccis": [], "uuid": "ed2759bb-66e6-5639-b5cb-4cd310a6fdb6", "testId": "IAC-06.3_A02", "test": "multifactor authentication is implemented for local access to privileged accounts.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.5.3[b]", "defaultText": null } ], "externalMappings": [ { "id": 576501, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c092675f-cc17-5c9a-98fb-e04e7dfe6408", "parentControlId": 31470, "controlId": "IA-2(3)", "title": "IA-2(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58571" }, { "id": 576502, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec0a76a6-3ab7-52d2-8943-514424c58b22", "parentControlId": 31470, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58571" }, { "id": 576503, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea358858-203e-527e-8296-de73beaf62f8", "parentControlId": 31470, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58571" }, { "id": 576506, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e952fd7-e39c-51d2-8e04-e9c1ea2a406c", "parentControlId": 31470, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58571" }, { "id": 576507, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db28f5c2-5fca-5ab1-b313-bdd017c73d75", "parentControlId": 31470, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585711" }, { "id": 576508, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21194ab5-f8f0-5e5b-9fb5-991ff5206256", "parentControlId": 31470, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585711" }, { "id": 576509, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e8bc40b-31ab-5b6c-b23d-92218a5f3472", "parentControlId": 31470, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585711" }, { "id": 576510, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b7e13be-ab5e-5324-95ec-a5c0c9acfcfa", "parentControlId": 31470, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585711" }, { "id": 576511, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26809599-97aa-5918-a86b-0b13efeafef8", "parentControlId": 31470, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585711" }, { "id": 576512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c05f188-de75-5fe8-9d09-11474b999e6d", "parentControlId": 31470, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585711" }, { "id": 576513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b2fde51-6917-512b-9297-3352ed1cc756", "parentControlId": 31470, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585711" }, { "id": 576514, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e0ac18a-4d61-5f71-97d1-263a13488431", "parentControlId": 31470, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585711" }, { "id": 576515, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c907a38d-3a00-5bdb-8231-ed059c52d54a", "parentControlId": 31470, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585711" }, { "id": 576516, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c468888-34ab-521b-a018-2ab4238f319e", "parentControlId": 31470, "controlId": "3.5.3", "title": "3.5.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58572" }, { "id": 576517, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a998a836-87aa-569f-aec5-c9bcbb41bad6", "parentControlId": 31470, "controlId": "03.05.03", "title": "03.05.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58572" }, { "id": 576528, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585721", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "adb6ea72-57ae-579b-80f6-9eda99aa1573", "parentControlId": 31470, "controlId": "ACCESS-1h", "title": "ACCESS-1h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585721" } ], "id": 31470, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731096", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731096", "catalogueId": 1062, "uuid": "9eaf2ccc-9755-59fa-adfc-db4861bec82b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize Multi-Factor Authentication (MFA) to authenticate local access for privileged accounts?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Local Access to Privileged Accounts", "description": "

Control Description

Mechanisms exist to utilize Multi-Factor Authentication (MFA) to authenticate local access for privileged accounts.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize Multi-Factor Authentication (MFA) to authenticate local access for privileged accounts.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-06.3", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-06.3", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)\n∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71641, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590567", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590567", "securityControlId": 31471, "ccis": [], "uuid": "f0c9db07-d414-50f3-bb34-8111fc5626d8", "testId": "IAC-06.4_A01", "test": "multi-factor authentication for access to privileged accounts is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: local, network and remote", "otherId": "53A_R5_IA-02(01)\n171A_R3_A.03.05.03[01]", "defaultText": null }, { "id": 71642, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590568", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590568", "securityControlId": 31471, "ccis": [], "uuid": "22a66d14-eaa5-5eb2-81d5-64be99f7c9a1", "testId": "IAC-06.4_A02", "test": "multi-factor authentication for access to non-privileged accounts is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: local, network and remote", "otherId": "53A_R5_IA-02(02)\n171A_R3_A.03.05.03[02]", "defaultText": null } ], "externalMappings": [ { "id": 576568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "877e3322-c94b-5a11-bc1e-efac79b216b2", "parentControlId": 31471, "controlId": "IA-2(6)", "title": "IA-2(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585726" }, { "id": 576569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4faaa92-0adf-5eda-9f19-8d0fbb302d08", "parentControlId": 31471, "controlId": "IA-2(11)", "title": "IA-2(11)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585726" }, { "id": 576570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aaa251aa-b408-504f-8355-f32f09ce6903", "parentControlId": 31471, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585726" }, { "id": 576571, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61c3a9dc-05df-5bd5-b40f-b189482e9f53", "parentControlId": 31471, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585726" }, { "id": 576572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aed57709-465a-5c2f-b554-573f4d6d2243", "parentControlId": 31471, "controlId": "IA-02(06)", "title": "IA-02(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585727" }, { "id": 576575, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "915357a1-1186-5b5d-8e67-053393b38d78", "parentControlId": 31471, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585727" }, { "id": 576576, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a7c2d7b-1702-510f-8958-f813c0e58b5f", "parentControlId": 31471, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585727" }, { "id": 576577, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bed030e0-e73d-52b9-a55e-f947e7895aad", "parentControlId": 31471, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585727" }, { "id": 576578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8605a0ac-4535-5464-9369-a6ad9ddbcfc4", "parentControlId": 31471, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585727" }, { "id": 576579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cec3d67-69ae-5e2e-b395-3f0a69cec7ed", "parentControlId": 31471, "controlId": "IA-02(06)", "title": "IA-02(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585727" }, { "id": 576580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22b59ae1-3cfc-5ea3-bc70-4eb83ca66583", "parentControlId": 31471, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585727" }, { "id": 576581, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fea93ec5-254b-5ba8-9f5d-01651aecdb8e", "parentControlId": 31471, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585727" }, { "id": 576582, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585728", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b424886-b69c-5c29-adc7-f20754220597", "parentControlId": 31471, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585728" }, { "id": 576583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585728", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65ec1f01-cad0-583e-92c4-eedb95f0f2eb", "parentControlId": 31471, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585728" }, { "id": 576584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585728", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "852a44b8-b5e3-5ddf-9004-c42b4176197b", "parentControlId": 31471, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585728" }, { "id": 576585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585728", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5e01430-deef-50d3-a5d2-fb23a7f208ed", "parentControlId": 31471, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585728" } ], "id": 31471, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731096", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731096", "catalogueId": 1062, "uuid": "7cb2f749-72f1-5004-abf1-4596142d7f91", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implements Multi-Factor Authentication (MFA) for access to privileged and non-privileged accounts such that one of the factors is securely provided by a device separate from the system gaining access?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Out-of-Band Multi-Factor Authentication", "description": "

Control Description

Mechanisms exist to implement Multi-Factor Authentication (MFA) for access to privileged and non-privileged accounts such that one of the factors is independently provided by a device separate from the system being accessed.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement Multi-Factor Authentication (MFA) for access to privileged and non-privileged accounts such that one of the factors is independently provided by a device separate from the system being accessed.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-06.4", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-06.4", "references": "

Micro-Small Business (<10 staff)

∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Small Business (10-49 staff)

∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Medium Business (50-249 staff)

∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Large Business (250-999 staff)

∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)

Enterprise (>1,000 staff)

∙ Yubico (https://yubico.com)\n∙ Duo (https://duo.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71644, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590568", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590568", "securityControlId": 31473, "ccis": [], "uuid": "d11c078b-1866-5f21-b8a5-728b1c1edc14", "testId": "IAC-07_A01", "test": "the validation and verification of identity evidence is conducted in person before a designated registration authority.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-12(04)", "defaultText": null }, { "id": 71645, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590568", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590568", "securityControlId": 31473, "ccis": [], "uuid": "ad7f491e-9c70-5721-aefb-bea93936d3a3", "testId": "IAC-07_A02", "test": "authorization is received from organizational personnel or roles to assign an individual, group, role, service, or device identifier.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.05.05.a", "defaultText": null }, { "id": 71646, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590568", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590568", "securityControlId": 31473, "ccis": [], "uuid": "83a5e984-2328-5ec4-b4ef-ee8db43419b0", "testId": "IAC-07_A03", "test": "system accounts are created in accordance with organizational policy, procedures, prerequisites, and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.01.01.b[01]", "defaultText": null }, { "id": 71647, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590569", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590569", "securityControlId": 31473, "ccis": [], "uuid": "e62a1a25-480b-5305-b76f-c1a9c2c9c6c7", "testId": "IAC-07_A04", "test": "system accounts are enabled in accordance with organizational policy, procedures, prerequisites, and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.01.01.b[02]", "defaultText": null }, { "id": 71648, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590569", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590569", "securityControlId": 31473, "ccis": [], "uuid": "c84cfd45-d930-549e-9d41-5466872bf1b9", "testId": "IAC-07_A05", "test": "system accounts are modified in accordance with organizational policy, procedures, prerequisites, and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.01.01.b[03]", "defaultText": null }, { "id": 71649, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590569", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590569", "securityControlId": 31473, "ccis": [], "uuid": "c8aa20b5-cf2d-50a8-9d44-fe7eaf893f74", "testId": "IAC-07_A06", "test": "system accounts are disabled in accordance with organizational policy, procedures, prerequisites, and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.01.01.b[04]", "defaultText": null }, { "id": 71650, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590569", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590569", "securityControlId": 31473, "ccis": [], "uuid": "9dfd8df3-b238-51b5-b000-d3fa8127b81b", "testId": "IAC-07_A07", "test": "system accounts are removed in accordance with organizational policy, procedures, prerequisites, and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.01.01.b[05]", "defaultText": null } ], "externalMappings": [ { "id": 576635, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fa6f69d-81e4-59b8-8033-ad2a8a20da77", "parentControlId": 31473, "controlId": "USER 1.2", "title": "USER 1.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585734" }, { "id": 576636, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d23789bb-3b14-5cec-bde3-83ab1dc43d30", "parentControlId": 31473, "controlId": "5.16", "title": "5.16", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585734" }, { "id": 576637, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b88ee4b2-7268-586e-a12a-1bd974a242da", "parentControlId": 31473, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585734" }, { "id": 576642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca318259-d7c6-58f0-a170-1c458710fa91", "parentControlId": 31473, "controlId": "IA-5(3)", "title": "IA-5(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585734" }, { "id": 576643, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9e52ca7-449b-5089-bb5f-247807f653f5", "parentControlId": 31473, "controlId": "IA-12(04)", "title": "IA-12(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585735" }, { "id": 576645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "deb00501-7bd7-539e-8ce3-7a92b89e2206", "parentControlId": 31473, "controlId": "IA-12(04)", "title": "IA-12(04)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585735" }, { "id": 576647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4a428a1-190a-559e-816f-49f4ea9454f0", "parentControlId": 31473, "controlId": "IA-12(04)", "title": "IA-12(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585735" }, { "id": 576648, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be2955c1-e8ce-519c-b91b-3afa47922870", "parentControlId": 31473, "controlId": "IA-12(04)", "title": "IA-12(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585735" }, { "id": 576649, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef23913c-74e3-571c-bb41-b216b0b213ff", "parentControlId": 31473, "controlId": "03.01.01.g.01", "title": "03.01.01.g.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585735" }, { "id": 576650, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eabf6aba-6400-5e28-8e2f-57905ad3acba", "parentControlId": 31473, "controlId": "03.01.01.g.02", "title": "03.01.01.g.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585735" }, { "id": 576651, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "befa98c5-150c-505d-9610-81ddf9ce2fbc", "parentControlId": 31473, "controlId": "03.01.01.g.03", "title": "03.01.01.g.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585735" }, { "id": 576652, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93bc664c-2d0c-5c29-a8a6-2988d0685367", "parentControlId": 31473, "controlId": "03.05.05.a", "title": "03.05.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585736" }, { "id": 576653, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82dbff4a-3ea2-5e26-8eb4-5579be4da50a", "parentControlId": 31473, "controlId": "03.09.02.a.01", "title": "03.09.02.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585736" }, { "id": 576654, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb773d91-14f5-50ae-984d-beed18533033", "parentControlId": 31473, "controlId": "03.09.02.a.02", "title": "03.09.02.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585736" }, { "id": 576683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdec7231-7a1f-575e-a36a-581a1cf56e4c", "parentControlId": 31473, "controlId": "ACCESS-1a", "title": "ACCESS-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585739" }, { "id": 576684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5e4a70e-c6ba-5ae1-a483-968c674f1958", "parentControlId": 31473, "controlId": "ACCESS-1c", "title": "ACCESS-1c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585739" }, { "id": 576685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2252f70-71f1-5fdb-9a0e-0b0dbaad0e0a", "parentControlId": 31473, "controlId": "ACCESS-1f", "title": "ACCESS-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585739" }, { "id": 576686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bcf3717-4dcf-59e9-8f99-3dd86b70ef72", "parentControlId": 31473, "controlId": "ACCESS-2f", "title": "ACCESS-2f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585739" }, { "id": 576687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e3b16cc-e8e7-5cb0-aa72-e19a4d1121fa", "parentControlId": 31473, "controlId": "ACCESS-2g", "title": "ACCESS-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585739" }, { "id": 576694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4da694bc-44c1-57f7-aff5-16dad07648f2", "parentControlId": 31473, "controlId": "CIP-004-7 6.1.1", "title": "CIP-004-7 6.1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58574" }, { "id": 576695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ae05860-f0c5-56ff-930b-7074c2c6c601", "parentControlId": 31473, "controlId": "CIP-004-7 6.1.2", "title": "CIP-004-7 6.1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58574" }, { "id": 576696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e8d4620-9945-526d-9d43-cc0fc4d9e290", "parentControlId": 31473, "controlId": "CIP-004-7 6.3", "title": "CIP-004-7 6.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585741" }, { "controlId": "B.1.2", "title": "B.1.2 — Account Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "9b9c5d58-e475-5621-bf50-a71c0cefe785", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.2", "title": "NEI 08-09 App D.1.2 — Account Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "1a594637-3712-510f-98d5-0d9ff5e8207b", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "57f44825-53db-5536-b335-3eb6130403d5", "isPublic": true }, { "controlId": "CIP-004-7-R4", "title": "CIP-004-7-R4 — Access Management Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c1650037-9ef4-506b-b39c-3992b79212ab", "isPublic": true }, { "controlId": "CIP-004-7-4.1", "title": "CIP-004-7-4.1 — Process to authorize based on need, as determined by the Responsible Entity, except for CIP Exceptional Circumstances", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "503800a0-5ed8-5e47-8503-fc3b0606a093", "isPublic": true }, { "controlId": "CIP-004-7-4.1.1", "title": "CIP-004-7-4.1.1 — Electronic access", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6bb47aa2-5eb5-5ba7-a60a-a488444b4e3f", "isPublic": true }, { "controlId": "CIP-004-7-4.1.2", "title": "CIP-004-7-4.1.2 — Unescorted physical access into a Physical Security Perimeter", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1c8325ef-3d96-50a1-b05b-43339633fbbf", "isPublic": true }, { "controlId": "CIP-004-7-4.2", "title": "CIP-004-7-4.2 — Verify at least once each calendar quarter that individuals with active electronic access or unescorted physical acce...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1f448ff9-1680-54d4-ba09-d8fd2ea0a87f", "isPublic": true }, { "controlId": "CIP-004-7-4.3", "title": "CIP-004-7-4.3 — For electronic access, verify at least once every 15 calendar months that all user accounts, user account groups, or...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1c7e259b-5f3b-5ee5-a6ae-dc17cc59fa8b", "isPublic": true }, { "controlId": "CIP-004-7-R5", "title": "CIP-004-7-R5 — Access Revocation Process", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a431bc41-56fe-540a-995f-b25db89ec9ea", "isPublic": true }, { "controlId": "CIP-004-7-5.1", "title": "CIP-004-7-5.1 — A process to initiate removal of an individual’s ability for unescorted physical access and Interactive Remote Access...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9d2d3e5a-f59d-568a-a91f-a7aecb4f3428", "isPublic": true }, { "controlId": "CIP-004-7-5.2", "title": "CIP-004-7-5.2 — For reassignments or transfers, revoke the individual’s authorized electronic access to individual accounts and autho...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1d3036a8-2505-56a2-b6b5-21b21034d297", "isPublic": true }, { "controlId": "CIP-004-7-5.3", "title": "CIP-004-7-5.3 — For termination actions, revoke the individual’s non-shared user accounts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9e14d2f7-bb4c-5b3b-a179-84f198d44c8b", "isPublic": true }, { "controlId": "CIP-004-7-5.4", "title": "CIP-004-7-5.4 — For termination actions, change passwords for shared account(s) known to the user within 30 calendar days of the term...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3cb1539f-b826-5f14-b6ac-4f8885242d57", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "62b2a7ec-af5c-50c0-8275-d4b2dc423575", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "7d1f3cdb-fcec-5fbf-926e-27fa7679ab43", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "26358f0c-c5bc-50a3-bb01-e8c0e3a13dfe", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "04ed03b0-d1f7-54cb-b05e-653cac3c1c68", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "29e465f6-7b64-57d5-8e25-fdff62a720ec", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "930f6fa1-1ff5-5cf6-8be6-8205ece9c09d", "isPublic": true } ], "id": 31473, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731097", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731097", "catalogueId": 1062, "uuid": "ce046c4a-b979-5bd7-b2b6-ea60be0e4e5c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize a formal user registration and de-registration process that governs the assignment of access rights?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "User Provisioning & De-Provisioning", "description": "

Control Description

Mechanisms exist to utilize a formal user registration and de-registration process that governs the assignment of access rights.

Evidence Request List (ERL)

E-HRS-12\nE-HRS-18\nE-HRS-19

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.\n▪ IAM restricts the assignment of privileged accounts to entity-defined personnel and/or roles (privilege assignment requires management approval).

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize a formal user registration and de-registration process that governs the assignment of access rights.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.2
NERC-CIP (2026) Requirements: CIP-004-7-R4, CIP-004-7-R5", "controlId": "IAC-07", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-07", "references": "

Micro-Small Business (<10 staff)

∙ Documented process for adding/removing user access

Small Business (10-49 staff)

∙ User provisioning and de-provisioning procedure\n∙ Timely removal of access on departure

Medium Business (50-249 staff)

∙ Formal user lifecycle management process\n∙ Provisioning workflows\n∙ Timely de-provisioning

Large Business (250-999 staff)

∙ Enterprise IAM with automated provisioning/de-provisioning (e.g., SailPoint, Saviynt)

Enterprise (>1,000 staff)

∙ Enterprise IGA platform (e.g., SailPoint, Saviynt, Microsoft Entra ID Governance)\n∙ Automated lifecycle management\n∙ Role-based access provisioning", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71651, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590569", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590569", "securityControlId": 31474, "ccis": [], "uuid": "36eab0ca-93e4-5ab8-9796-eabfd855a822", "testId": "IAC-07.1_A01", "test": "user access rights are revoked following changes in personnel roles and duties, if no longer necessary or permitted.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 576740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585746", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96200292-aed3-5549-a994-8c7ac688a477", "parentControlId": 31474, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585746" }, { "id": 576744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585746", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "def96111-9f7e-53a0-a148-bb3c3e284721", "parentControlId": 31474, "controlId": "03.01.01.g.01", "title": "03.01.01.g.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585746" }, { "id": 576745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585746", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4860a0c-9f8a-500a-824c-186c9841252c", "parentControlId": 31474, "controlId": "03.01.01.g.02", "title": "03.01.01.g.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585746" }, { "id": 576746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585747", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "025f5117-a657-5336-bf3d-08f1d01af875", "parentControlId": 31474, "controlId": "03.01.01.g.03", "title": "03.01.01.g.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585747" }, { "id": 576747, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585747", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88c5ddfa-1daa-5008-8ab6-37f50f0cb275", "parentControlId": 31474, "controlId": "03.05.05.a", "title": "03.05.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585747" }, { "id": 576748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585747", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1d271ab-6fbc-5aef-a13e-726163c81e41", "parentControlId": 31474, "controlId": "03.09.02.b.02", "title": "03.09.02.b.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585747" }, { "id": 576769, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5d5346c-b67d-56c5-b64e-baacf16c152b", "parentControlId": 31474, "controlId": "ACCESS-2f", "title": "ACCESS-2f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585749" }, { "id": 576770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "918ec0dd-c702-5528-95b1-e9246211a2fe", "parentControlId": 31474, "controlId": "ACCESS-2g", "title": "ACCESS-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585749" }, { "id": 576771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bad20a5e-ce61-5881-8664-018dd0b599fe", "parentControlId": 31474, "controlId": "ACCESS-2h", "title": "ACCESS-2h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585749" } ], "id": 31474, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731098", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731098", "catalogueId": 1062, "uuid": "e2ad0f5b-5d1f-5ec1-83cb-f16c3e5dee3d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization revoke user access rights following changes in personnel roles and duties, if no longer necessary or permitted?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Change of Roles & Duties", "description": "

Control Description

Mechanisms exist to revoke user access rights following changes in personnel roles and duties, if no longer necessary or permitted.

Evidence Request List (ERL)

E-HRS-12\nE-HRS-19

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.\n▪ Active Directory (AD), or a similar technologies, are used to centrally manage identities and permissions, but asset/process owners are authorized to operate a decentralized access control program for their specific Technology Assets, Applications, Services and/or Data (TAASD).

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to revoke user access rights following changes in personnel roles and duties, if no longer necessary or permitted.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-07.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-07.1", "references": "

Micro-Small Business (<10 staff)

∙ Update access rights promptly when roles change

Small Business (10-49 staff)

∙ Access change procedure for role changes\n∙ Notify IT/security of role changes

Medium Business (50-249 staff)

∙ Formal access modification process for role changes\n∙ Timely access updates

Large Business (250-999 staff)

∙ Enterprise IAM with role-change workflow integration with HR\n∙ Automated access adjustment

Enterprise (>1,000 staff)

∙ Enterprise IGA platform with HR integration\n∙ Automated role-change access adjustments\n∙ Access certification", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71652, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59057", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59057", "securityControlId": 31475, "ccis": [], "uuid": "0df8d24e-2717-59fd-ad24-988569b9883e", "testId": "IAC-07.2_A01", "test": "prerequisites and criteria for group and role membership are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-02_ODP[01]", "defaultText": null }, { "id": 71653, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59057", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59057", "securityControlId": 31475, "ccis": [], "uuid": "68160a49-631e-591b-952c-6f89cb205e93", "testId": "IAC-07.2_A02", "test": "criteria for account creation, enabling, modification, disabling and removal are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-02_ODP[04]\n171A_3.9.2[b]", "defaultText": null }, { "id": 71654, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59057", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59057", "securityControlId": 31475, "ccis": [], "uuid": "3b3d3c98-62c1-5a70-822e-78a7050cf814", "testId": "IAC-07.2_A03", "test": "personnel or roles required to approve requests to create accounts is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-02_ODP[03]", "defaultText": null }, { "id": 71655, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59057", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59057", "securityControlId": 31475, "ccis": [], "uuid": "0938b509-4779-55da-8b66-7684ef19cc0c", "testId": "IAC-07.2_A04", "test": "account managers are assigned.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_AC-02b.", "defaultText": null }, { "id": 71656, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59057", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59057", "securityControlId": 31475, "ccis": [], "uuid": "e51dbd59-e627-549c-9010-e911e3202c9b", "testId": "IAC-07.2_A05", "test": "attributes (as required) for each account are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02_ODP[02]", "defaultText": null }, { "id": 71657, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59057", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59057", "securityControlId": 31475, "ccis": [], "uuid": "b8fc6e3a-a441-53b4-b85b-dd565fe648e1", "testId": "IAC-07.2_A06", "test": "personnel or roles to be notified is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02_ODP[05]", "defaultText": null }, { "id": 71658, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59057", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59057", "securityControlId": 31475, "ccis": [], "uuid": "5577aa74-1125-555e-b925-ea35c0e274cb", "testId": "IAC-07.2_A07", "test": "time period within which to notify account managers when accounts are no longer required is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02_ODP[06]", "defaultText": null }, { "id": 71659, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590571", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590571", "securityControlId": 31475, "ccis": [], "uuid": "15c804cd-ecde-5ae9-b198-26eb9b590f3e", "testId": "IAC-07.2_A08", "test": "time period within which to notify account managers when users are terminated or transferred is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02_ODP[07]", "defaultText": null }, { "id": 71660, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590571", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590571", "securityControlId": 31475, "ccis": [], "uuid": "5fdf9949-08ec-5361-bd38-ffcdbe288a2e", "testId": "IAC-07.2_A09", "test": "time period within which to notify account managers when system usage or the need to know changes for an individual is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02_ODP[08]", "defaultText": null }, { "id": 71661, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590571", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590571", "securityControlId": 31475, "ccis": [], "uuid": "77dfcd20-2914-5ed0-b895-4cf1aa21af13", "testId": "IAC-07.2_A10", "test": "attributes needed to authorize system access (as required) are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02_ODP[09]", "defaultText": null }, { "id": 71662, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590572", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590572", "securityControlId": 31475, "ccis": [], "uuid": "75174724-367d-570e-b2e7-02395dc891e7", "testId": "IAC-07.2_A11", "test": "the frequency of account review is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: quarterly for privileged access, annually for non-privileged access", "otherId": "53A_R5_AC-02_ODP[10]", "defaultText": null }, { "id": 71663, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590573", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590573", "securityControlId": 31475, "ccis": [], "uuid": "da114c34-c12b-5f53-b09a-662163c802b3", "testId": "IAC-07.2_A12", "test": "account types allowed for use within the system are defined and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02a.[01]", "defaultText": null }, { "id": 71664, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590573", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590573", "securityControlId": 31475, "ccis": [], "uuid": "4acea47d-bd14-5417-a503-b305e6cac13b", "testId": "IAC-07.2_A13", "test": "account types specifically prohibited for use within the system are defined and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02a.[02]", "defaultText": null }, { "id": 71665, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590573", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590573", "securityControlId": 31475, "ccis": [], "uuid": "46e549a3-940c-52ef-939f-7eb14934027a", "testId": "IAC-07.2_A14", "test": "prerequisites and criteria for group and role membership are required.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02c.", "defaultText": null }, { "id": 71666, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590573", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590573", "securityControlId": 31475, "ccis": [], "uuid": "43a04621-910c-5ec3-b35a-579c8650de83", "testId": "IAC-07.2_A15", "test": "authorized users of the system are specified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02d.01", "defaultText": null }, { "id": 71667, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590573", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590573", "securityControlId": 31475, "ccis": [], "uuid": "b299de5f-2855-5fc0-949f-58d95576d213", "testId": "IAC-07.2_A16", "test": "group and role memberships are specified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_AC-02d.02\n171A_R3_A.03.01.01.c.02", "defaultText": null }, { "id": 71668, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590573", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590573", "securityControlId": 31475, "ccis": [], "uuid": "235693ee-aa1d-55e3-9f47-7a799dd23c30", "testId": "IAC-07.2_A17", "test": "access authorizations (i.e., privileges) for each account are specified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_AC-02d.03[01]\n171A_R3_A.03.01.01.c.03", "defaultText": null }, { "id": 71669, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590574", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590574", "securityControlId": 31475, "ccis": [], "uuid": "f6ea880e-e1b7-5898-8920-0ea26b0ac946", "testId": "IAC-07.2_A18", "test": "attributes (as required) are specified for each account.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-02d.03[02]", "defaultText": null }, { "id": 71670, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590574", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590574", "securityControlId": 31475, "ccis": [], "uuid": "055e0b55-5844-53c0-8122-c9256c359fa6", "testId": "IAC-07.2_A19", "test": "approvals are required by personnel or roles for requests to create accounts.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_AC-02e.", "defaultText": null }, { "id": 71671, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590574", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590574", "securityControlId": 31475, "ccis": [], "uuid": "e74f7abc-de39-54d1-a589-9e7948fc032b", "testId": "IAC-07.2_A20", "test": "accounts are created in accordance with policy, procedures, prerequisites and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-02f.[01]", "defaultText": null }, { "id": 71672, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590574", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590574", "securityControlId": 31475, "ccis": [], "uuid": "ce11fd60-2468-5987-9291-581fb41aebc7", "testId": "IAC-07.2_A21", "test": "accounts are enabled in accordance with policy, procedures, prerequisites and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-02f.[02]", "defaultText": null }, { "id": 71673, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590574", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590574", "securityControlId": 31475, "ccis": [], "uuid": "b1617e56-88d6-5108-abdb-ca9020c79542", "testId": "IAC-07.2_A22", "test": "accounts are modified in accordance with policy, procedures, prerequisites and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_AC-02f.[03]\n171A_3.9.2[b]", "defaultText": null }, { "id": 71674, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590575", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590575", "securityControlId": 31475, "ccis": [], "uuid": "063bcf74-f122-59b7-8249-2358691c740a", "testId": "IAC-07.2_A23", "test": "accounts are disabled in accordance with policy, procedures, prerequisites and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_AC-02f.[04]\n171A_3.9.2[b]", "defaultText": null }, { "id": 71675, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590575", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590575", "securityControlId": 31475, "ccis": [], "uuid": "efaaeb78-7274-5dac-847f-0b32d3bdf3e3", "testId": "IAC-07.2_A24", "test": "accounts are removed in accordance with policy, procedures, prerequisites and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-02f.[05]", "defaultText": null }, { "id": 71676, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590575", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590575", "securityControlId": 31475, "ccis": [], "uuid": "a7896de7-f6a3-5361-a6e7-330ecc5a6328", "testId": "IAC-07.2_A25", "test": "the use of accounts is monitored.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-02g.", "defaultText": null }, { "id": 71677, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590575", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590575", "securityControlId": 31475, "ccis": [], "uuid": "793a9be2-a021-5d4c-a60a-2552664b5332", "testId": "IAC-07.2_A26", "test": "account managers and personnel or roles are notified within an organization-defined time period when accounts are no longer required.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: twenty-four (24) hours when accounts are no longer required", "otherId": "53A_R5_AC-02h.01", "defaultText": null }, { "id": 71678, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590575", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590575", "securityControlId": 31475, "ccis": [], "uuid": "109e6514-2466-5370-be9a-010c1d12a3c3", "testId": "IAC-07.2_A27", "test": "account managers and personnel or roles are notified within an organization-defined time period when users are terminated or transferred.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: eight (8) hours when users are terminated or transferred", "otherId": "53A_R5_AC-02h.02", "defaultText": null }, { "id": 71679, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590575", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590575", "securityControlId": 31475, "ccis": [], "uuid": "9a91e93d-2930-54aa-a7c0-0b7102a18e10", "testId": "IAC-07.2_A28", "test": "account managers and personnel or roles are notified within an organization-defined time period when system usage or the need to know changes for an individual.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: eight (8) hours when system usage or need-to-know changes for an individual", "otherId": "53A_R5_AC-02h.03", "defaultText": null }, { "id": 71680, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590576", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590576", "securityControlId": 31475, "ccis": [], "uuid": "dab43046-8b59-572a-9ae5-e62b64edf728", "testId": "IAC-07.2_A29", "test": "access to the system is authorized based on a valid access authorization.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-02i.01", "defaultText": null }, { "id": 71681, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590576", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590576", "securityControlId": 31475, "ccis": [], "uuid": "b3b61f41-6a67-5a28-bf68-82faa8b98b69", "testId": "IAC-07.2_A30", "test": "access to the system is authorized based on intended system usage.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-02i.02", "defaultText": null }, { "id": 71682, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590576", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590576", "securityControlId": 31475, "ccis": [], "uuid": "1ebc27ad-885e-54d3-9999-fbfba1ad7c7d", "testId": "IAC-07.2_A31", "test": "access to the system is authorized based on attributes (as required).
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-02i.03", "defaultText": null }, { "id": 71683, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590576", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590576", "securityControlId": 31475, "ccis": [], "uuid": "6ebfbc5f-3571-5682-8a5f-fbc56145fde5", "testId": "IAC-07.2_A32", "test": "accounts are reviewed for compliance with account management requirements frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: quarterly for privileged access, annually for non-privileged access", "otherId": "53A_R5_AC-02j.", "defaultText": null }, { "id": 71684, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590577", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590577", "securityControlId": 31475, "ccis": [], "uuid": "d6c12653-dae3-5582-a046-b01af2db8061", "testId": "IAC-07.2_A33", "test": "a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02k.[01]", "defaultText": null }, { "id": 71685, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590577", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590577", "securityControlId": 31475, "ccis": [], "uuid": "19d6a6a9-ce80-54cb-9b4c-9cf1130975d8", "testId": "IAC-07.2_A34", "test": "a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02k.[02]", "defaultText": null }, { "id": 71686, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590577", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590577", "securityControlId": 31475, "ccis": [], "uuid": "611a6dbc-bd20-5d68-9f23-b2aaf8d0247e", "testId": "IAC-07.2_A35", "test": "account management processes are aligned with personnel termination processes.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02l.[01]", "defaultText": null }, { "id": 71687, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590577", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590577", "securityControlId": 31475, "ccis": [], "uuid": "235c3795-bc33-5559-9960-ba6c78d788b2", "testId": "IAC-07.2_A36", "test": "account management processes are aligned with personnel transfer processes.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02l.[02]", "defaultText": null }, { "id": 71688, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590577", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590577", "securityControlId": 31475, "ccis": [], "uuid": "6c6fdbb7-5bf6-5981-b0fe-3d53a7e54c73", "testId": "IAC-07.2_A37", "test": "privileged user accounts are established and administered in accordance with organization-defined criteria.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02(07)_ODP\n53A_R5_AC-02(07)(a)", "defaultText": null }, { "id": 71689, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590578", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590578", "securityControlId": 31475, "ccis": [], "uuid": "e8754039-00d2-597a-9864-0f64afb1fd0f", "testId": "IAC-07.2_A38", "test": "privileged role or attribute assignments are monitored.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-02(07)(b)", "defaultText": null }, { "id": 71690, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590578", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590578", "securityControlId": 31475, "ccis": [], "uuid": "8c3350a7-0a82-5cb2-8dfd-a6cd0c0ae6ec", "testId": "IAC-07.2_A39", "test": "changes to roles or attributes are monitored.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02(07)(c)", "defaultText": null }, { "id": 71691, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590578", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590578", "securityControlId": 31475, "ccis": [], "uuid": "97d499f7-6301-56e2-afd7-e48bb3251cda", "testId": "IAC-07.2_A40", "test": "access is revoked when privileged role or attribute assignments are no longer appropriate.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02(07)(d)", "defaultText": null } ], "externalMappings": [ { "id": 576798, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2ce2ed4-6022-5567-982b-8efbcf30bbfb", "parentControlId": 31475, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585752" }, { "id": 576801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec723683-b28d-52ff-8a0a-ce88ae040a40", "parentControlId": 31475, "controlId": "AC-2(10)", "title": "AC-2(10)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585753" }, { "id": 576802, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26f9dd57-cef6-5bfa-976e-803256f9040a", "parentControlId": 31475, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585753" }, { "id": 576804, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6eff3b0-550c-5c8b-be6f-1cbea07a74cf", "parentControlId": 31475, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585753" }, { "id": 576806, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "673fadb5-2ee1-5a5b-a328-070f52f32c0e", "parentControlId": 31475, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585753" }, { "id": 576807, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "432b242a-78f3-52dc-b325-141f8adb5ea5", "parentControlId": 31475, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585753" }, { "id": 576808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffb6613a-42f4-535d-b839-556d7ec15ca9", "parentControlId": 31475, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585753" }, { "id": 576809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585754", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "791306f0-c617-535a-966d-f040a092c3b5", "parentControlId": 31475, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585754" }, { "id": 576810, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585754", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea9d9a27-b596-5183-84b8-a5b9b455d9f7", "parentControlId": 31475, "controlId": "AC-2", "title": "AC-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585754" }, { "id": 576811, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585754", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6dadc51-3460-5c7b-9ab3-472d59f04664", "parentControlId": 31475, "controlId": "AC-2", "title": "AC-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585754" }, { "id": 576812, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585754", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29765982-2ae4-554b-be17-d3a6fbc4ea36", "parentControlId": 31475, "controlId": "AC-2", "title": "AC-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585754" }, { "id": 576815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585754", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aec1750a-271d-5678-8519-6040cd520d39", "parentControlId": 31475, "controlId": "03.09.02.a.01", "title": "03.09.02.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585754" }, { "id": 576816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585755", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7f9ae72-9f5d-5a29-b9d2-3d47c82a7482", "parentControlId": 31475, "controlId": "03.09.02.a.02", "title": "03.09.02.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585755" } ], "id": 31475, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731098", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731098", "catalogueId": 1062, "uuid": "bd0376da-3626-5421-8ad5-b732ba1a9824", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization revoke user access rights in a timely manner, upon termination of employment or contract?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Termination of Employment", "description": "

Control Description

Mechanisms exist to revoke user access rights in a timely manner, upon termination of employment or contract.

Evidence Request List (ERL)

E-HRS-19

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.\n▪ Active Directory (AD), or a similar technologies, are used to centrally manage identities and permissions, but asset/process owners are authorized to operate a decentralized access control program for their specific Technology Assets, Applications, Services and/or Data (TAASD).

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to revoke user access rights in a timely manner, upon termination of employment or contract.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-07.2", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-07.2", "references": "

Micro-Small Business (<10 staff)

∙ Revoke all access immediately upon employee termination

Small Business (10-49 staff)

∙ Documented termination procedure with immediate access revocation

Medium Business (50-249 staff)

∙ Formal termination checklist\n∙ Same-day access revocation process

Large Business (250-999 staff)

∙ Enterprise automated offboarding workflow\n∙ HR-to-IAM integration for immediate access revocation

Enterprise (>1,000 staff)

∙ Enterprise IGA with automated offboarding\n∙ HR system integration\n∙ Immediate access revocation across all systems\n∙ Exit interview and access audit", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71692, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590578", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590578", "securityControlId": 31476, "ccis": [], "uuid": "e5896d86-ec81-55a2-a262-fbb57025521c", "testId": "IAC-08_A01", "test": "the organization implements a role-based access scheme or an attribute-based access scheme.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-02(07)_ODP", "defaultText": null }, { "id": 71693, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590578", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590578", "securityControlId": 31476, "ccis": [], "uuid": "db735463-b9a3-59d9-b75e-d800737ddb51", "testId": "IAC-08_A02", "test": "privileged user accounts are established and administered in accordance with organization-defined parameters.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-02(07)(a)", "defaultText": null }, { "id": 71694, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590578", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590578", "securityControlId": 31476, "ccis": [], "uuid": "8954c0b5-ba68-5cad-ac82-469438ab335a", "testId": "IAC-08_A03", "test": "access to sensitive / regulated data requiring special protection is granted only to individuals who have a valid access authorization that is demonstrated by assigned duties.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PS-06(02)(a)", "defaultText": null }, { "id": 71695, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590579", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590579", "securityControlId": 31476, "ccis": [], "uuid": "f8f4c804-92aa-5bc6-bea4-d4f42d3f1fca", "testId": "IAC-08_A04", "test": "access to sensitive / regulated data requiring special protection is granted only to individuals who satisfy associated personnel security criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PS-06(02)(b)", "defaultText": null }, { "id": 71696, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590579", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590579", "securityControlId": 31476, "ccis": [], "uuid": "40d582db-e85e-5626-9944-223829125872", "testId": "IAC-08_A05", "test": "access to sensitive / regulated data requiring special protection is granted only to individuals who have read, understood and signed a non-disclosure agreement.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PS-06(02)(c)", "defaultText": null }, { "id": 71697, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590579", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590579", "securityControlId": 31476, "ccis": [], "uuid": "c41c5619-f078-5c61-8fdf-4264804c95a3", "testId": "IAC-08_A06", "test": "privileged role or attribute assignments are monitored.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-02(07)(b)", "defaultText": null }, { "id": 71698, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590579", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590579", "securityControlId": 31476, "ccis": [], "uuid": "e5391149-0e15-59ac-a292-4941ab2a84c2", "testId": "IAC-08_A07", "test": "changes to roles or attributes are monitored.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02(07)(c)", "defaultText": null }, { "id": 71699, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590579", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590579", "securityControlId": 31476, "ccis": [], "uuid": "7a400714-5b19-57fc-b882-0fd01f123688", "testId": "IAC-08_A08", "test": "access is revoked when privileged role or attribute assignments are no longer appropriate.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-02(07)(d)", "defaultText": null }, { "id": 71700, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59058", "securityControlId": 31476, "ccis": [], "uuid": "a3d0d64d-7566-54d6-9fa3-a8df2813e997", "testId": "IAC-08_A09", "test": "security functions for authorized access are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.05.ODP[01]", "defaultText": null }, { "id": 71701, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59058", "securityControlId": 31476, "ccis": [], "uuid": "58033b4f-cbb4-5ddf-9096-1810e3a477df", "testId": "IAC-08_A10", "test": "security-relevant information for authorized access is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.05.ODP[02]", "defaultText": null }, { "id": 71702, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59058", "securityControlId": 31476, "ccis": [], "uuid": "b2d59fe8-6801-5862-800c-12fa44f59596", "testId": "IAC-08_A11", "test": "access to is authorized.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at a minimum and if applicable: establishing system accounts and assigning privileges, configuring access authorizations, configuring settings for events to be audited, establishing vulnerability scanning parameters, establishing intrusion detection parameters, and managing audit information", "otherId": "171A_R3_A.03.01.05.b[01]", "defaultText": null }, { "id": 71703, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59058", "securityControlId": 31476, "ccis": [], "uuid": "70d01c07-5f2b-5e88-a3ed-5a9f1fd4477e", "testId": "IAC-08_A12", "test": "access to is authorized.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at a minimum and if applicable: threat and vulnerability information, filtering rules for routers or firewalls, configuration parameters for security services, cryptographic key management information, security architecture, access control lists, and audit information", "otherId": "171A_R3_A.03.01.05.b[02]", "defaultText": null }, { "id": 71704, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59058", "securityControlId": 31476, "ccis": [], "uuid": "fe19de4f-6981-55d8-9d93-7703ae38d00b", "testId": "IAC-08_A13", "test": "logical access restrictions associated with changes to the system are defined and documented.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.05[04]", "defaultText": null }, { "id": 71705, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590581", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590581", "securityControlId": 31476, "ccis": [], "uuid": "2ee09a46-22a2-58c6-b331-53dbf360cdbf", "testId": "IAC-08_A14", "test": "the incident response plan is protected from unauthorized disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.06.05.d", "defaultText": null } ], "externalMappings": [ { "id": 576879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4522b85b-b8b8-54ad-b389-2cf58288cfd9", "parentControlId": 31476, "controlId": "USER 1.5", "title": "USER 1.5", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58577" }, { "id": 576880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5f20b62-7db6-5902-ae96-59eb8cb56f26", "parentControlId": 31476, "controlId": "SR 2.1 RE 2", "title": "SR 2.1 RE 2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58577" }, { "id": 576881, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4d5beba-f3e3-56e9-b929-350b8238639a", "parentControlId": 31476, "controlId": "CR 2.1", "title": "CR 2.1", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58577" }, { "id": 576882, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2dd5325-0a2e-5722-b0aa-079b1b7bc066", "parentControlId": 31476, "controlId": "CR 2.1(1)", "title": "CR 2.1(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58577" }, { "id": 576883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7197efa8-8803-551e-9694-3c34775aaa03", "parentControlId": 31476, "controlId": "CR 2.1(2)", "title": "CR 2.1(2)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58577" }, { "id": 576884, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66a23b75-d710-55e5-9c25-b7ef11c9564d", "parentControlId": 31476, "controlId": "5.15", "title": "5.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58577" }, { "id": 576885, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1768b040-028c-5354-ae47-5736a6e1093d", "parentControlId": 31476, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58577" }, { "id": 576893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585772", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78a60dd2-0932-5e8f-bd2f-33c4caf2facc", "parentControlId": 31476, "controlId": "AC-2(7)", "title": "AC-2(7)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585772" }, { "id": 576894, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585772", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d21f2098-ce0e-5723-b10e-f8a914d7ab3e", "parentControlId": 31476, "controlId": "AC-02(07)", "title": "AC-02(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585772" }, { "id": 576898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585772", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32185bf3-9369-5cf7-a3e1-a4852e80732e", "parentControlId": 31476, "controlId": "AC-02(07)", "title": "AC-02(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585772" }, { "id": 576899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585772", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c73f4c8-df04-52d3-a3ca-c64e1cc80958", "parentControlId": 31476, "controlId": "3.1.1", "title": "3.1.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585772" }, { "id": 576900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585772", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38a39118-9728-5180-a3c0-1e583a9c216f", "parentControlId": 31476, "controlId": "3.1.2", "title": "3.1.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585772" }, { "id": 576901, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585772", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42a8cebd-272a-5b3f-90cf-509ed2979b7f", "parentControlId": 31476, "controlId": "3.1.3", "title": "3.1.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585772" }, { "id": 576902, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585772", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4099c1a7-ad52-5fad-884f-524a0fc129d8", "parentControlId": 31476, "controlId": "03.01.01.c.01", "title": "03.01.01.c.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585772" }, { "id": 576903, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d914bc3-5b17-504c-925f-33e8b69dbb05", "parentControlId": 31476, "controlId": "03.01.01.c.02", "title": "03.01.01.c.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585773" }, { "id": 576904, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "861fead6-d8ae-574d-ad28-f6ed757087eb", "parentControlId": 31476, "controlId": "03.01.01.c.03", "title": "03.01.01.c.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585773" }, { "id": 576905, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38319e21-ba67-57e9-b7a9-440e9da8caf4", "parentControlId": 31476, "controlId": "03.01.02", "title": "03.01.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585773" }, { "id": 576906, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2533dc2-d688-5383-8b47-b099fdbe2d1e", "parentControlId": 31476, "controlId": "03.01.05.b", "title": "03.01.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585773" }, { "id": 576907, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c60dbe41-a373-5e0f-8c49-169a10544d9e", "parentControlId": 31476, "controlId": "03.01.06.a", "title": "03.01.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585773" }, { "id": 576908, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fbab84e-b7b9-5a91-9572-c75243f4f5d1", "parentControlId": 31476, "controlId": "03.01.12.a", "title": "03.01.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585773" }, { "id": 576909, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec37c3bf-8122-5691-977a-8d1be1dc26e9", "parentControlId": 31476, "controlId": "03.03.08.b", "title": "03.03.08.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585773" }, { "id": 576910, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7022f32-b5ed-58f7-bcea-d23f0d64ae0c", "parentControlId": 31476, "controlId": "03.04.05", "title": "03.04.05", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585773" }, { "id": 576911, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8b57b09-7d2d-59ad-9d45-abaa9eb28be1", "parentControlId": 31476, "controlId": "03.06.05.d", "title": "03.06.05.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585773" }, { "id": 576912, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585774", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "827124fd-f94b-54d5-89db-9f4df44e8333", "parentControlId": 31476, "controlId": "03.07.06.a", "title": "03.07.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585774" }, { "id": 576925, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585775", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6c3ce86-b0ac-5c3a-ac7a-b8cc95e2fef3", "parentControlId": 31476, "controlId": "PR.AA-05", "title": "PR.AA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585776" }, { "id": 576963, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585781", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2701280-d5b8-5134-a533-eea0513e2e46", "parentControlId": 31476, "controlId": "ACCESS-1g", "title": "ACCESS-1g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585781" }, { "id": 576964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585781", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d08b3bc0-c52b-503f-a77a-1588273749f3", "parentControlId": 31476, "controlId": "ACCESS-2b", "title": "ACCESS-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585781" }, { "id": 576965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585781", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75e60d2b-7ca2-5500-9f8c-234ca7875fd1", "parentControlId": 31476, "controlId": "ARCHITECTURE-3c", "title": "ARCHITECTURE-3c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585781" }, { "id": 576999, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585786", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de9ed602-d02e-5993-aca8-74a9fdd68882", "parentControlId": 31476, "controlId": "CIP-004-7 4.1", "title": "CIP-004-7 4.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585787" }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7c9c65fd-3332-5463-b206-37bfe9c3b8a2", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "6c0e4ddc-ebf0-53ce-b953-38575b648d5d", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "7f60ab73-3cf3-5d4f-809a-6e42b93298c6", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "7eba5324-6d24-5e88-92a5-0c93e1208277", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "1b7c4aa3-5664-5543-8329-f04fa87066ed", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "ef336865-acaf-5ef6-9d94-0fc90fe0aed6", "isPublic": true } ], "id": 31476, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731098", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731098", "catalogueId": 1062, "uuid": "4512a78f-6352-5a93-9a24-f28608f1acb6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce Role-Based Access Control (RBAC) for Technology Assets, Applications, Services and/or Data (TAASD) to restrict access to individuals assigned specific roles with legitimate business needs?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Role-Based Access Control (RBAC)", "description": "

Control Description

Mechanisms exist to enforce Role-Based Access Control (RBAC) for Technology Assets, Applications, Services and/or Data (TAASD) to restrict access to individuals assigned specific roles with legitimate business needs.

Evidence Request List (ERL)

E-HRS-12\nE-IAM-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.\n▪ Active Directory (AD), or a similar technologies, are used to centrally manage identities and permissions, but asset/process owners are authorized to operate a decentralized access control program for their specific Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Logical Access Control (LAC) limits the ability of non-administrators from making unauthorized configuration changes to systems, applications and services.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.\n▪ IAM restricts the assignment of privileged accounts to entity-defined personnel and/or roles (privilege assignment requires management approval).

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enforce Role-Based Access Control (RBAC) for TAASD to restrict access to individuals assigned specific roles with legitimate business needs.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "IAC-08", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-08", "references": "

Micro-Small Business (<10 staff)

∙ Role-Based Access Control (RBAC)

Small Business (10-49 staff)

∙ Role-Based Access Control (RBAC)

Medium Business (50-249 staff)

∙ Role-Based Access Control (RBAC)

Large Business (250-999 staff)

∙ Role-Based Access Control (RBAC)

Enterprise (>1,000 staff)

∙ Role-Based Access Control (RBAC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71706, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590581", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590581", "securityControlId": 31477, "ccis": [], "uuid": "49bc3c55-db9c-5cfa-9a3c-ddcb600e16e4", "testId": "IAC-09_A01", "test": "personnel or roles from whom authorization must be received to assign an identifier are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-04_ODP[01]", "defaultText": null }, { "id": 71707, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590581", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590581", "securityControlId": 31477, "ccis": [], "uuid": "826e434e-af3f-53ca-a15a-0932b6adbedf", "testId": "IAC-09_A02", "test": "system identifiers are managed by receiving authorization from personnel or roles to assign to an individual, group, role or device identifier.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-04a.", "defaultText": null }, { "id": 71708, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590581", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590581", "securityControlId": 31477, "ccis": [], "uuid": "ef490bc7-4d48-51f7-8608-67f4117a5fc7", "testId": "IAC-09_A03", "test": "the time period for preventing the reuse of identifiers is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least two (2) years", "otherId": "53A_R5_IA-04_ODP[02]\n171A_3.5.5[a]\n171A_R3_A.03.05.05.ODP[01]", "defaultText": null }, { "id": 71709, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590582", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590582", "securityControlId": 31477, "ccis": [], "uuid": "ff7bceeb-4b7f-5434-a059-bbc416760fe6", "testId": "IAC-09_A04", "test": "the reuse of identifiers for an organization-defined time period is prevented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-04d.\n171A_3.5.5[b]", "defaultText": null }, { "id": 71710, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590582", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590582", "securityControlId": 31477, "ccis": [], "uuid": "40a74379-c76d-5bf4-bd01-acae904d6983", "testId": "IAC-09_A05", "test": "an identifier that identifies an individual, group, role, service, or device is selected.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-04b.\n171A_R3_A.03.05.05.b[01]", "defaultText": null }, { "id": 71711, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590582", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590582", "securityControlId": 31477, "ccis": [], "uuid": "ca8f75d8-9286-5140-b6b3-30caf2d533dc", "testId": "IAC-09_A06", "test": "an identifier that identifies an individual, group, role, service, or device is assigned.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-04c.\n171A_R3_A.03.05.05.b[02]", "defaultText": null }, { "id": 71712, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590585", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590585", "securityControlId": 31477, "ccis": [], "uuid": "9887b49f-631b-514c-8185-935614f4bb6a", "testId": "IAC-09_A07", "test": "the reuse of identifiers for is prevented.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least ten (10) years", "otherId": "171A_R3_A.03.05.05.c", "defaultText": null } ], "externalMappings": [ { "id": 577096, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e67ca5c1-2f42-5bab-9d65-1e793f55d625", "parentControlId": 31477, "controlId": "SR 1.4", "title": "SR 1.4", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585798" }, { "id": 577097, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf7d25eb-bac4-5ac6-968f-121d9684c824", "parentControlId": 31477, "controlId": "CR 1.4", "title": "CR 1.4", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585799" }, { "id": 577098, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4efc12f-dd5a-590a-9e82-3b6da548a245", "parentControlId": 31477, "controlId": "5.16", "title": "5.16", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585799" }, { "id": 577100, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a57e70f-33f4-58a5-92b8-2c298f7eb483", "parentControlId": 31477, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585799" }, { "id": 577101, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa8a5a6a-c653-5261-8deb-f4e8c6d892c7", "parentControlId": 31477, "controlId": "T1003.005", "title": "T1003.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585799" }, { "id": 577102, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9e4563c-3056-5227-803f-2ec3056c2e69", "parentControlId": 31477, "controlId": "T1003.006", "title": "T1003.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585799" }, { "id": 577103, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6705712f-c1db-54f0-9594-3a3f57017953", "parentControlId": 31477, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585799" }, { "id": 577104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c3940d6-ee04-5975-a596-2e0602e38674", "parentControlId": 31477, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585799" }, { "id": 577105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e349a69-1f34-54d7-b562-1cd6b890e425", "parentControlId": 31477, "controlId": "T1053", "title": "T1053", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585799" }, { "id": 577106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40f0873e-4f14-5f52-a586-30f8e260996a", "parentControlId": 31477, "controlId": "T1053.002", "title": "T1053.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5858" }, { "id": 577107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5858", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2926d9ab-7d69-5ba2-a50c-477f125214fb", "parentControlId": 31477, "controlId": "T1053.005", "title": "T1053.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5858" }, { "id": 577108, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5858", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1714512-943b-5d9b-9b2f-530bc71708d8", "parentControlId": 31477, "controlId": "T1098.007", "title": "T1098.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5858" }, { "id": 577109, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5858", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ca080e0-5a59-5bbc-acf5-6b45f1cd61bf", "parentControlId": 31477, "controlId": "T1110", "title": "T1110", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5858" }, { "id": 577110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5858", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a0da57b-95d0-5939-9f80-9dceeff234d0", "parentControlId": 31477, "controlId": "T1110.001", "title": "T1110.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5858" }, { "id": 577111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5858", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c684c632-22ba-5b80-abd7-baa40e8e3275", "parentControlId": 31477, "controlId": "T1110.002", "title": "T1110.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5858" }, { "id": 577112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5858", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ede9b8c-f2bb-507a-a642-138c20fe99f5", "parentControlId": 31477, "controlId": "T1110.003", "title": "T1110.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5858" }, { "id": 577113, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5858", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe8cdf94-e906-5c31-a472-918b71e1fa56", "parentControlId": 31477, "controlId": "T1110.004", "title": "T1110.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5858" }, { "id": 577114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5858", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4324c169-53c0-5a12-8817-eb8e78a20396", "parentControlId": 31477, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5858" }, { "id": 577115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5858", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6bce694-951e-54ae-9b8c-065c9ad62103", "parentControlId": 31477, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5858" }, { "id": 577116, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6762825a-60da-54b8-8e3b-7099911c78ca", "parentControlId": 31477, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585801" }, { "id": 577117, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b0cf7f6-f0f0-5998-99b4-92732cea22d0", "parentControlId": 31477, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585801" }, { "id": 577118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03930be8-b97f-577c-a738-483681639a50", "parentControlId": 31477, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585801" }, { "id": 577119, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7747ae3c-ef85-50e1-ad74-f5917cf4b5ec", "parentControlId": 31477, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585801" }, { "id": 577120, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2db0ace-085e-59cf-88bf-92841306e8cf", "parentControlId": 31477, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585801" }, { "id": 577121, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "157f8912-a61d-5adf-8641-30bf8980a742", "parentControlId": 31477, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585801" }, { "id": 577122, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49ddb519-7c4b-519b-8df0-b2af0f5ea202", "parentControlId": 31477, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585801" }, { "id": 577123, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e44aede-1bc1-55cd-9f56-3915078ddc30", "parentControlId": 31477, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585802" }, { "id": 577124, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9083c6cb-2102-5cef-a109-492e5ee1f7ec", "parentControlId": 31477, "controlId": "T1550.001", "title": "T1550.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585802" }, { "id": 577125, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46ac9de4-831c-52ac-821b-223933ea2f0f", "parentControlId": 31477, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585802" }, { "id": 577126, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f35bfb3d-7955-5e72-a8a9-2f4c0e5fc3d3", "parentControlId": 31477, "controlId": "T1552.005", "title": "T1552.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585802" }, { "id": 577127, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2c1cd49-77b4-59b5-8963-f03548850c13", "parentControlId": 31477, "controlId": "T1562", "title": "T1562", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585802" }, { "id": 577128, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8375a4eb-5843-50b9-ac5c-d9c11fc6b48d", "parentControlId": 31477, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585802" }, { "id": 577129, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f9555da-4cb6-5960-ba90-66b795318c0b", "parentControlId": 31477, "controlId": "T1578", "title": "T1578", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585802" }, { "id": 577130, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b85b72bc-df9f-50e9-8b7f-3ce11c3bfb42", "parentControlId": 31477, "controlId": "T1578.001", "title": "T1578.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585802" }, { "id": 577131, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2fba1bd-3d7c-5b3b-84ed-7377a1bdeeb8", "parentControlId": 31477, "controlId": "T1578.002", "title": "T1578.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585802" }, { "id": 577132, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c08c9050-174a-5faf-b209-8d1c074f21ac", "parentControlId": 31477, "controlId": "T1578.003", "title": "T1578.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585803" }, { "id": 577133, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc59f955-36e2-5917-9818-2677dc3e3a2b", "parentControlId": 31477, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585803" }, { "id": 577134, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cee3575c-05cf-5f9a-956f-deaf0d946a46", "parentControlId": 31477, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585803" }, { "id": 577135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39ffc24e-6ff9-502d-9cb5-e4cbac4a2478", "parentControlId": 31477, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585803" }, { "id": 577137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a36a0925-f809-5ad2-8c2d-b4514a6409b2", "parentControlId": 31477, "controlId": "IA-4", "title": "IA-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585803" }, { "id": 577138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8595baa-5f6a-51b1-bb01-db8c883b474f", "parentControlId": 31477, "controlId": "IA-04", "title": "IA-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585803" }, { "id": 577140, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f207b29-c105-5874-94f1-8ce49d8d2900", "parentControlId": 31477, "controlId": "IA-04", "title": "IA-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585803" }, { "id": 577142, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f47afba5-4c8a-514a-b2b1-d8727edc906f", "parentControlId": 31477, "controlId": "IA-04", "title": "IA-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585804" }, { "id": 577143, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1059fa44-96b9-5389-8ed7-66aed5fcf119", "parentControlId": 31477, "controlId": "IA-04", "title": "IA-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585804" }, { "id": 577144, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b1c04be-f35f-5b91-ba02-75b03cf365aa", "parentControlId": 31477, "controlId": "IA-04", "title": "IA-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585804" }, { "id": 577145, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d3aa09f-b58e-5348-8038-4d9f5e0c5001", "parentControlId": 31477, "controlId": "IA-04", "title": "IA-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585804" }, { "id": 577146, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35380fc1-1fc8-5617-9cdc-fd1c57d30bdd", "parentControlId": 31477, "controlId": "IA-4", "title": "IA-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585804" }, { "id": 577147, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f55e434c-42da-5c1a-aab6-d61cf3eec815", "parentControlId": 31477, "controlId": "IA-4", "title": "IA-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585804" }, { "id": 577148, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b179d970-e2a3-5b5a-8017-cb412868f6a5", "parentControlId": 31477, "controlId": "IA-4", "title": "IA-4", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585804" }, { "id": 577151, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585805", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ebc88a8-4e05-587b-aa06-c9e227ef0730", "parentControlId": 31477, "controlId": "3.5.5", "title": "3.5.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585805" }, { "id": 577152, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585805", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3515f80-9c54-57e9-861a-717cc1d7a1cd", "parentControlId": 31477, "controlId": "03.05.05.b", "title": "03.05.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585805" }, { "id": 577153, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585805", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54a0b797-dd88-5d82-8978-bec7cebd183a", "parentControlId": 31477, "controlId": "03.05.05.c", "title": "03.05.05.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585805" }, { "id": 577154, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585805", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "674c3e83-b193-5467-ab41-0bdde693bf34", "parentControlId": 31477, "controlId": "03.05.05.d", "title": "03.05.05.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585805" }, { "controlId": "B.1.3", "title": "B.1.3 — Access Enforcement", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "80ba3e40-1fd7-5197-b036-29aff9b000d2", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.3", "title": "NEI 08-09 App D.1.3 — Access Enforcement", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "0a0648cb-a9c0-5632-9107-3000aab359da", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "3b3f9b0e-177d-562b-91a3-c45566502c70", "isPublic": true }, { "controlId": "B.4.6", "title": "B.4.6 — Identifier Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IA-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "75e0f311-4567-5353-a9a8-4281dba9d55d", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.6", "title": "NEI 08-09 App D.4.6 — Identifier Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "01b910f9-84c5-506c-8ffa-bbb6b5fd672d", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d6127463-0209-5359-88a3-e7902f8a1952", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "f73cfb46-09ec-544a-8c44-e6dd5f49c84c", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "d8287213-667d-5192-8df8-04c26401ec03", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "98ee13f0-3a34-57c5-b8b7-d46580bcb829", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "5e5b46a4-ce49-527a-a681-00e10ee076e8", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "22d9d1b5-9e80-5f19-9a60-0e0e11bb58dd", "isPublic": true } ], "id": 31477, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731099", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731099", "catalogueId": 1062, "uuid": "3decf0e6-d63f-5bdd-b7d9-9650957b9121", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization govern naming standards for usernames and Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Identifier Management (User Names)", "description": "

Control Description

Mechanisms exist to govern naming standards for usernames and Technology Assets, Applications and/or Services (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to govern naming standards for usernames and Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.3, B.4.6", "controlId": "IAC-09", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-09", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71713, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590586", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590586", "securityControlId": 31478, "ccis": [], "uuid": "4b9cd04c-31dd-5940-8fb8-f92175f7c90a", "testId": "IAC-09.1_A01", "test": "characteristics used to identify individual status is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: contractors; foreign nationals", "otherId": "53A_R5_IA-04(04)_ODP", "defaultText": null }, { "id": 71714, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590586", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590586", "securityControlId": 31478, "ccis": [], "uuid": "fce6df34-b572-5997-b04c-983380bb981d", "testId": "IAC-09.1_A02", "test": "individual identifiers are managed by uniquely identifying each individual as characteristics.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: contractors; foreign nationals", "otherId": "53A_R5_IA-04(04)", "defaultText": null } ], "externalMappings": [ { "id": 577203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3edaaaef-eaed-51db-a33e-36a204dc087f", "parentControlId": 31478, "controlId": "SR 1.4", "title": "SR 1.4", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585819" }, { "id": 577204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bcc58e87-bfac-53bf-8785-14901717c4a1", "parentControlId": 31478, "controlId": "CR 1.4", "title": "CR 1.4", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585819" }, { "id": 577205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b54dacd7-24f2-5c58-93e3-9a16e9257910", "parentControlId": 31478, "controlId": "5.16", "title": "5.16", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585819" }, { "id": 577208, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc03410e-5135-5576-bef9-6c17121773cb", "parentControlId": 31478, "controlId": "IA-4(4)", "title": "IA-4(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58582" }, { "id": 577209, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb9823d6-f24f-5eec-8e28-7f95fb10bb23", "parentControlId": 31478, "controlId": "IA-04(04)", "title": "IA-04(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58582" }, { "id": 577211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8efc0581-675e-5e48-b4ad-8864ebf6c5fa", "parentControlId": 31478, "controlId": "IA-04(04)", "title": "IA-04(04)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58582" }, { "id": 577212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22aba714-ccff-5943-9216-b549b9559463", "parentControlId": 31478, "controlId": "IA-04(04)", "title": "IA-04(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58582" }, { "id": 577213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cacb3e97-0938-55c6-abb1-57efe584ebee", "parentControlId": 31478, "controlId": "IA-04(04)", "title": "IA-04(04)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58582" }, { "id": 577214, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3782f05-45d2-5986-9789-81de23523731", "parentControlId": 31478, "controlId": "IA-04(04)", "title": "IA-04(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58582" }, { "id": 577215, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc40ddf5-5c74-568a-aca8-cf620530a3b0", "parentControlId": 31478, "controlId": "03.05.05.b", "title": "03.05.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58582" } ], "id": 31478, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731099", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731099", "catalogueId": 1062, "uuid": "cd99c89c-f86f-5d63-9e0d-359ef8483867", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure proper user identification management for non-consumer users and administrators?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "User Identity (ID) Management", "description": "

Control Description

Mechanisms exist to ensure proper user identification management for non-consumer users and administrators.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure proper user identification management for non-consumer users and administrators.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-09.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-09.1", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71715, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590586", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590586", "securityControlId": 31479, "ccis": [], "uuid": "792e85f2-5568-5400-9466-6d4f1f41fd52", "testId": "IAC-09.2_A01", "test": "characteristic used to identify individual status are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: contractors; foreign nationals", "otherId": "53A_R5_IA-04(04)_ODP\n171A_R3_A.03.05.05.ODP[02]", "defaultText": null }, { "id": 71716, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590586", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590586", "securityControlId": 31479, "ccis": [], "uuid": "f4326918-fef4-56b6-9eef-ebafb5c45fbf", "testId": "IAC-09.2_A02", "test": "individual identifiers are managed by uniquely identifying each individual per an organization-defined characteristic.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: contractors; foreign nationals", "otherId": "53A_R5_IA-04(04)", "defaultText": null }, { "id": 71717, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590587", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590587", "securityControlId": 31479, "ccis": [], "uuid": "83f58ec7-0265-5405-9cf3-66dda8c8b552", "testId": "IAC-09.2_A03", "test": "individual identifiers are managed by uniquely identifying each individual as .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: privileged or non-privileged users; contractors, foreign nationals, and/or non-organizational users", "otherId": "171A_R3_A.03.05.05.d", "defaultText": null } ], "externalMappings": [ { "id": 577240, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12ccd199-b50b-5426-b3a9-8f9851af2df1", "parentControlId": 31479, "controlId": "IA-4(4)", "title": "IA-4(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585825" }, { "id": 577241, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f75c43f4-0913-5785-a51f-b10d5d0c972f", "parentControlId": 31479, "controlId": "IA-04(04)", "title": "IA-04(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585825" }, { "id": 577243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8b1d7a2-95e6-508d-804b-cec455c1684d", "parentControlId": 31479, "controlId": "IA-04(04)", "title": "IA-04(04)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585825" }, { "id": 577244, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89d3d511-e945-5047-9d4c-fa7aeb6ce818", "parentControlId": 31479, "controlId": "IA-04(04)", "title": "IA-04(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585825" }, { "id": 577245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87718fa2-a116-5d34-b786-4881d3603ca3", "parentControlId": 31479, "controlId": "IA-04(04)", "title": "IA-04(04)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585826" }, { "id": 577246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c89c637-b2be-5e4d-89fd-08ff72ae033f", "parentControlId": 31479, "controlId": "IA-04(04)", "title": "IA-04(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585826" }, { "id": 577247, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1f3f3a4-4fc8-5547-8cac-c12ec04d6448", "parentControlId": 31479, "controlId": "03.05.05.d", "title": "03.05.05.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585826" } ], "id": 31479, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.7311", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.7311", "catalogueId": 1062, "uuid": "162774f4-efd5-585a-b535-2b2e7742c434", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify contractors and other third-party users through unique username characteristics?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Identity User Status", "description": "

Control Description

Mechanisms exist to identify contractors and other third-party users through unique username characteristics.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify contractors and other third-party users through unique username characteristics.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-09.2", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-09.2", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71718, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590587", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590587", "securityControlId": 31480, "ccis": [], "uuid": "e2581079-2091-5451-8427-dab6630071d2", "testId": "IAC-09.3_A01", "test": "individual identifiers are dynamically managed in accordance with dynamic identifier policy.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-04(05)", "defaultText": null }, { "id": 71719, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590587", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590587", "securityControlId": 31480, "ccis": [], "uuid": "3e63b9c3-e1a8-549b-a497-f9cb0d9f4769", "testId": "IAC-09.3_A02", "test": "rules for dynamically binding identities and authenticators are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(10)_ODP", "defaultText": null }, { "id": 71720, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590587", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590587", "securityControlId": 31480, "ccis": [], "uuid": "1d78f9d9-92c3-5052-8ab9-cce970d9bec0", "testId": "IAC-09.3_A03", "test": "identities and authenticators are dynamically bound using organization-defined binding rules.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(10)", "defaultText": null } ], "externalMappings": [ { "id": 577268, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfe7de20-3034-5de0-b3dd-c580594ddd93", "parentControlId": 31480, "controlId": "IA-4(5)", "title": "IA-4(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585828" }, { "id": 577269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3947c6c0-9255-57eb-9831-2a816513ec17", "parentControlId": 31480, "controlId": "IA-5(2)", "title": "IA-5(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585828" }, { "id": 577270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d0ad927-4317-554b-8bc4-21ef1c0093dd", "parentControlId": 31480, "controlId": "IA-5(10)", "title": "IA-5(10)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585828" }, { "id": 577271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2283a5ac-3327-5b70-9d2d-e1430d547085", "parentControlId": 31480, "controlId": "IA-04(05)", "title": "IA-04(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585828" }, { "id": 577272, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e546a9c1-9d0e-5f01-93e1-815b19cd7393", "parentControlId": 31480, "controlId": "IA-05(10)", "title": "IA-05(10)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585829" }, { "id": 577273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c47f35aa-1f03-5472-a514-9bbb0cce85b8", "parentControlId": 31480, "controlId": "IA-04(05)", "title": "IA-04(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585829" }, { "id": 577274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ca24245-6127-5611-b7cb-8b2383d34fd6", "parentControlId": 31480, "controlId": "IA-05(10)", "title": "IA-05(10)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585829" } ], "id": 31480, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.7311", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.7311", "catalogueId": 1062, "uuid": "b5bc13fe-a5e7-568e-9546-5b313f706163", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization dynamically manage usernames and system identifiers?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Dynamic Management", "description": "

Control Description

Mechanisms exist to dynamically manage usernames and system identifiers.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to dynamically manage usernames and system identifiers.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-09.3", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-09.3", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71721, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590587", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590587", "securityControlId": 31481, "ccis": [], "uuid": "8a1bc056-9cfd-599f-bf2a-a3d9bb836499", "testId": "IAC-09.4_A01", "test": "external organizations with whom to coordinate the cross-organization management of identifiers are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-04(06)_ODP", "defaultText": null }, { "id": 71722, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590588", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590588", "securityControlId": 31481, "ccis": [], "uuid": "73bde980-8c67-5f77-9569-1dead5acca6f", "testId": "IAC-09.4_A02", "test": "cross-organization management of identifiers is coordinated with external organizations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-04(06)", "defaultText": null } ], "externalMappings": [ { "id": 577276, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ea18f1a-1b04-5e1e-a1b0-1a42bfded363", "parentControlId": 31481, "controlId": "5.16", "title": "5.16", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585829" }, { "id": 577278, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97b29f97-add4-552b-a88d-67acf3b94475", "parentControlId": 31481, "controlId": "IA-4(6)", "title": "IA-4(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585829" }, { "id": 577279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10ae289c-9f52-570f-b736-4ccaa56243e1", "parentControlId": 31481, "controlId": "IA-04(06)", "title": "IA-04(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585829" }, { "id": 577280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585829", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c01e2fe-497d-5a62-9f63-0f140d38db14", "parentControlId": 31481, "controlId": "IA-04(06)", "title": "IA-04(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585829" }, { "id": 577281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd0864cb-4555-5d1f-b72e-15b7d9ced9e9", "parentControlId": 31481, "controlId": "IA-4(6)", "title": "IA-4(6)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58583" } ], "id": 31481, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.7311", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.7311", "catalogueId": 1062, "uuid": "2ee204a7-9124-501c-b135-bce642ae550e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization coordinate username identifiers with external organizations for cross-organization management of identifiers?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Cross-Organization Management", "description": "

Control Description

Mechanisms exist to coordinate username identifiers with external organizations for cross-organization management of identifiers.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to coordinate username identifiers with external organizations for cross-organization management of identifiers.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-09.4", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-09.4", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71723, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590588", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590588", "securityControlId": 31482, "ccis": [], "uuid": "3b92cc5e-045c-5774-a696-e716399ec460", "testId": "IAC-09.5_A01", "test": "security controls implemented to manage the risk of compromise due to individuals having accounts on multiple systems are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(08)_ODP", "defaultText": null }, { "id": 71724, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590588", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590588", "securityControlId": 31482, "ccis": [], "uuid": "cf635718-9745-55e8-bc2b-f783db349c41", "testId": "IAC-09.5_A02", "test": "security controls are implemented to manage the risk of compromise due to individuals having accounts on multiple systems.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(08)", "defaultText": null } ], "externalMappings": [ { "id": 577290, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8237c40b-abd5-5650-9b4a-0e379e00b802", "parentControlId": 31482, "controlId": "IA-5(8)", "title": "IA-5(8)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585831" }, { "id": 577291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05d23c2e-7de8-56b4-ac54-c47e08f8efe4", "parentControlId": 31482, "controlId": "IA-05(08)", "title": "IA-05(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585831" }, { "id": 577293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40e149c4-6763-52d3-b0c2-d81e8fe68475", "parentControlId": 31482, "controlId": "IA-05(08)", "title": "IA-05(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585831" }, { "id": 577294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "227c64d8-8029-5aed-8c80-b3d9d6c035d6", "parentControlId": 31482, "controlId": "03.01.07.b", "title": "03.01.07.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585831" }, { "id": 577295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae2c7da7-1ebc-50d2-9d3a-727c85b7ee1a", "parentControlId": 31482, "controlId": "03.05.05.d", "title": "03.05.05.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585831" } ], "id": 31482, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.7311", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731101", "catalogueId": 1062, "uuid": "ba7cb304-08a4-5e47-9378-edade5d7c7a1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization uniquely manage privileged accounts to identify the account as a privileged user or service?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Privileged Account Identifiers", "description": "

Control Description

Mechanisms exist to uniquely manage privileged accounts to identify the account as a privileged user or service.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to uniquely manage privileged accounts to identify the account as a privileged user or service.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-09.5", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-09.5", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71725, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590588", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590588", "securityControlId": 31483, "ccis": [], "uuid": "77c69a4d-5314-55e2-8e31-0333651ec5e8", "testId": "IAC-09.6_A01", "test": "pairwise pseudonymous identifiers are generated.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-04(08)", "defaultText": null } ], "externalMappings": [ { "id": 577308, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28b6a56b-5d31-5faf-9790-59e832b09c6c", "parentControlId": 31483, "controlId": "DM-3(1)", "title": "DM-3(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585833" }, { "id": 577309, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "013fdd24-921f-50e2-8680-207a34314660", "parentControlId": 31483, "controlId": "IA-04(08)", "title": "IA-04(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585833" }, { "id": 577310, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efa2fc22-5628-5e12-a181-42a9bd12ae6a", "parentControlId": 31483, "controlId": "IA-04(08)", "title": "IA-04(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585833" } ], "id": 31483, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731101", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731101", "catalogueId": 1062, "uuid": "133ee8ba-4167-53ef-9fa5-dc52d137bfb2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization generate pairwise pseudonymous identifiers with no identifying information about a data subject to discourage activity tracking and profiling of the data subject?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Pairwise Pseudonymous Identifiers (PPID)", "description": "

Control Description

Mechanisms exist to generate pairwise pseudonymous identifiers with no identifying information about a data subject to discourage activity tracking and profiling of the data subject.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to generate pairwise pseudonymous identifiers with no identifying information about a data subject to discourage activity tracking and profiling of the data subject.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-09.6", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-09.6", "references": "

Medium Business (50-249 staff)

∙ Use pseudonymous identifiers where required for privacy

Large Business (250-999 staff)

∙ PPID implementation for applicable services\n∙ Privacy-preserving identity design

Enterprise (>1,000 staff)

∙ Enterprise PPID implementation (e.g., OpenID Connect pairwise identifiers)\n∙ Privacy-by-design identity framework", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71726, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590589", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590589", "securityControlId": 31484, "ccis": [], "uuid": "f123c6a7-1fb2-5e4f-9e12-a425ec92bc25", "testId": "IAC-10_A01", "test": "the number of generations during which a password cannot be reused is specified.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.5.8[a]", "defaultText": null }, { "id": 71727, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590589", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590589", "securityControlId": 31484, "ccis": [], "uuid": "dfc546af-3add-591f-a640-f08afc37e274", "testId": "IAC-10_A02", "test": "reuse of passwords is prohibited during the specified number of generations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.5.8[b]", "defaultText": null }, { "id": 71728, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590589", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590589", "securityControlId": 31484, "ccis": [], "uuid": "3797dc12-5bed-5772-ba92-e9560f7f73f3", "testId": "IAC-10_A03", "test": "an immediate change to a permanent password is required when a temporary password is used for system logon.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.5.9", "defaultText": null }, { "id": 71729, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590589", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590589", "securityControlId": 31484, "ccis": [], "uuid": "f9c4c508-de76-5b27-aa60-4c6054889a67", "testId": "IAC-10_A04", "test": "the frequency for changing or refreshing authenticators is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-05_ODP[01]\n171A_R3_A.03.05.12.ODP[01]", "defaultText": null }, { "id": 71730, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590589", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590589", "securityControlId": 31484, "ccis": [], "uuid": "d018b0c6-1be8-58f2-a507-c058442a0233", "testId": "IAC-10_A05", "test": "events that trigger the change or refreshment of authenticators are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-05_ODP[02]\n171A_R3_A.03.05.12.ODP[02]", "defaultText": null }, { "id": 71731, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590589", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590589", "securityControlId": 31484, "ccis": [], "uuid": "1822eaf6-a0d6-580f-a58e-a0536b1258b9", "testId": "IAC-10_A06", "test": "the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution is verified.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05a.\n171A_R3_A.03.05.12.a", "defaultText": null }, { "id": 71732, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59059", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59059", "securityControlId": 31484, "ccis": [], "uuid": "2ecbac96-ff14-5f23-adab-a540e31b3c44", "testId": "IAC-10_A07", "test": "initial authenticator content for any authenticators issued by the organization is established.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-05b.\n171A_R3_A.03.05.12.b", "defaultText": null }, { "id": 71733, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59059", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59059", "securityControlId": 31484, "ccis": [], "uuid": "bd88a73c-4fb2-55cd-b6e0-5459944cb689", "testId": "IAC-10_A08", "test": "system authenticators are managed to ensure that authenticators have sufficient strength of mechanism for their intended use.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05c.", "defaultText": null }, { "id": 71734, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59059", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59059", "securityControlId": 31484, "ccis": [], "uuid": "8469e8fd-aa5d-5435-b3b8-b8850ccca1de", "testId": "IAC-10_A09", "test": "system authenticators are managed through the establishment and implementation of administrative procedures for initial authenticator distribution. lost, compromised or damaged authenticators. and the revocation of authenticators.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05d.", "defaultText": null }, { "id": 71735, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59059", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59059", "securityControlId": 31484, "ccis": [], "uuid": "91f4d58f-45c4-551b-8d6c-99978ee36e20", "testId": "IAC-10_A10", "test": "default authenticators are changed at first use.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05e.\n171A_R3_A.03.05.12.d", "defaultText": null }, { "id": 71736, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59059", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59059", "securityControlId": 31484, "ccis": [], "uuid": "ed68617b-2eb0-529f-a0c7-4db5961d1033", "testId": "IAC-10_A11", "test": "authenticators are changed or refreshed per an organization-defined frequency or when organization-defined events occur.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-05f.", "defaultText": null }, { "id": 71737, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590591", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590591", "securityControlId": 31484, "ccis": [], "uuid": "987faf8d-5a61-5e98-aaf3-98b072f1acdf", "testId": "IAC-10_A12", "test": "system authenticators are managed through the protection of authenticator content from unauthorized disclosure and modification.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_IA-05g.", "defaultText": null }, { "id": 71738, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590591", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590591", "securityControlId": 31484, "ccis": [], "uuid": "8d0dae07-a828-54bf-9223-9a77e6807c07", "testId": "IAC-10_A13", "test": "system authenticators are managed through the requirement for individuals to take specific controls to protect authenticators.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_IA-05h.[01]", "defaultText": null }, { "id": 71739, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590591", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590591", "securityControlId": 31484, "ccis": [], "uuid": "b0c9da88-34e5-5047-a260-101295e03e35", "testId": "IAC-10_A14", "test": "system authenticators are managed through the requirement for devices to implement specific controls to protect authenticators.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_IA-05h.[02]", "defaultText": null }, { "id": 71740, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590591", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590591", "securityControlId": 31484, "ccis": [], "uuid": "1cb52ccc-031a-5978-bec6-06528049cc13", "testId": "IAC-10_A15", "test": "system authenticators are managed through the change of authenticators for group or role accounts when membership to those accounts changes.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_IA-05i.", "defaultText": null }, { "id": 71741, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590591", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590591", "securityControlId": 31484, "ccis": [], "uuid": "4cc8af3b-91fc-543e-af5e-dff78b23fe29", "testId": "IAC-10_A16", "test": "the frequency at which to update the list of commonly used, expected or compromised passwords is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IA-05(01)_ODP[01]", "defaultText": null }, { "id": 71742, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590591", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590591", "securityControlId": 31484, "ccis": [], "uuid": "3a9e8488-c3fe-59ec-ba15-f1569fe6e845", "testId": "IAC-10_A17", "test": "authenticator composition and complexity rules are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IA-05(01)_ODP[02]", "defaultText": null }, { "id": 71743, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590592", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590592", "securityControlId": 31484, "ccis": [], "uuid": "224feaeb-e906-57a8-b162-6438c0e3db48", "testId": "IAC-10_A18", "test": "administrative procedures for initial authenticator distribution are established.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.12.c[01]", "defaultText": null }, { "id": 71744, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590592", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590592", "securityControlId": 31484, "ccis": [], "uuid": "3995f63b-d990-5043-9c1d-1fc95d540beb", "testId": "IAC-10_A19", "test": "administrative procedures for lost, compromised, or damaged authenticators are established.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.12.c[02]", "defaultText": null }, { "id": 71745, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590592", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590592", "securityControlId": 31484, "ccis": [], "uuid": "a7ce91aa-79ec-5c9b-be52-f6e45ae010e9", "testId": "IAC-10_A20", "test": "administrative procedures for revoking authenticators are established.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.12.c[03]", "defaultText": null }, { "id": 71746, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590592", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590592", "securityControlId": 31484, "ccis": [], "uuid": "77fa33db-8133-55c0-801d-f63188cf0aa9", "testId": "IAC-10_A21", "test": "administrative procedures for initial authenticator distribution are implemented.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.12.c[04]", "defaultText": null }, { "id": 71747, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590592", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590592", "securityControlId": 31484, "ccis": [], "uuid": "ba98a8c9-4e71-506b-9aa1-a60366fa1cb4", "testId": "IAC-10_A22", "test": "administrative procedures for lost, compromised, or damaged authenticators are implemented.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.12.c[05]", "defaultText": null }, { "id": 71748, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590592", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590592", "securityControlId": 31484, "ccis": [], "uuid": "4acfb305-d0d2-5e59-804e-896407f21b69", "testId": "IAC-10_A23", "test": "administrative procedures for revoking authenticators are implemented.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.12.c[06]", "defaultText": null }, { "id": 71749, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590592", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590592", "securityControlId": 31484, "ccis": [], "uuid": "63f2abdb-c2cf-59b6-970e-f18ccd7e4f92", "testId": "IAC-10_A24", "test": "authenticator content is protected from unauthorized disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null }, { "id": 71750, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590593", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590593", "securityControlId": 31484, "ccis": [], "uuid": "637f53e6-3573-5851-914b-670e35cf7eb3", "testId": "IAC-10_A25", "test": "authenticators are changed or refreshed or when the following events occur: .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: SDP values:\n(1) never for passwords where MFA is employed, at least every five (5) years for hard tokens and identification badges, and at least every three (3)\nyears for all other authenticators.\n(2) after a relevant security incident or any evidence of\ncompromise or loss.", "otherId": "171A_R3_A.03.05.12.e", "defaultText": null }, { "id": 71751, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590593", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590593", "securityControlId": 31484, "ccis": [], "uuid": "25e06930-e1ef-5699-b9b3-2f1297c53be7", "testId": "IAC-10_A26", "test": "authenticator content is protected from unauthorized disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.12.f[01]", "defaultText": null }, { "id": 71752, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590593", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590593", "securityControlId": 31484, "ccis": [], "uuid": "c6995a1a-9ea0-5109-8c74-9b80c492f4ec", "testId": "IAC-10_A27", "test": "authenticator content is protected from unauthorized modification.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.12.f[02]", "defaultText": null } ], "externalMappings": [ { "id": 577345, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aee82cd9-cee1-50c9-bf7e-5745dd1691e8", "parentControlId": 31484, "controlId": "USER 1.11", "title": "USER 1.11", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585837" }, { "id": 577346, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "617eb87e-eb04-5d70-b877-2bcc963286fb", "parentControlId": 31484, "controlId": "CR 1.5", "title": "CR 1.5", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585837" }, { "id": 577347, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "922b5981-cd9d-5769-b95f-607522988383", "parentControlId": 31484, "controlId": "CR 1.9", "title": "CR 1.9", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585837" }, { "id": 577350, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "594a7f63-0aa1-5f50-93d4-a9f3640df1b4", "parentControlId": 31484, "controlId": "5.17", "title": "5.17", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585837" }, { "id": 577351, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac9f7729-9844-57af-912a-77c8027b4311", "parentControlId": 31484, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585838" }, { "id": 577356, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08a678e7-1233-56f7-9606-d720606e680c", "parentControlId": 31484, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585838" }, { "id": 577357, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e822cfd0-f1e8-5b95-b806-7a9c1e04f211", "parentControlId": 31484, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585838" }, { "id": 577358, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ea393e8-9c73-511e-b796-803f30d333b0", "parentControlId": 31484, "controlId": "T1003.002", "title": "T1003.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585838" }, { "id": 577359, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5353cffd-6a18-5001-a9c4-3e457424495c", "parentControlId": 31484, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585838" }, { "id": 577360, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eedf7c93-7e88-5ca6-a0d2-69023bdb2226", "parentControlId": 31484, "controlId": "T1003.004", "title": "T1003.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585839" }, { "id": 577361, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "950d6186-a80a-5e66-8202-37fb15e5d135", "parentControlId": 31484, "controlId": "T1003.005", "title": "T1003.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585839" }, { "id": 577362, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f72035c-7230-5442-bcca-0d69da3313df", "parentControlId": 31484, "controlId": "T1003.006", "title": "T1003.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585839" }, { "id": 577363, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f942d78-69b5-5508-9cbb-a00c7de3bade", "parentControlId": 31484, "controlId": "T1003.007", "title": "T1003.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585839" }, { "id": 577364, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25c02351-022e-5c37-b77e-653ded33de8d", "parentControlId": 31484, "controlId": "T1003.008", "title": "T1003.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585839" }, { "id": 577365, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b9d7f39-b680-5cf4-a6b4-6ce00aa07281", "parentControlId": 31484, "controlId": "T1021", "title": "T1021", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585839" }, { "id": 577366, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed78e377-2790-5970-8fd1-7db5c26ece9c", "parentControlId": 31484, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585839" }, { "id": 577367, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32070d89-6ecb-520d-a61b-bb63e4e894c0", "parentControlId": 31484, "controlId": "T1021.004", "title": "T1021.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585839" }, { "id": 577368, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d6eaa60-91d6-5483-a7fa-ca01d2b369a9", "parentControlId": 31484, "controlId": "T1021.007", "title": "T1021.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585839" }, { "id": 577369, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a3a36a3-2ba9-5bd2-ba65-534fd26caf17", "parentControlId": 31484, "controlId": "T1021.008", "title": "T1021.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58584" }, { "id": 577370, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4915eb1-cd2b-5a76-97fd-197f922d3345", "parentControlId": 31484, "controlId": "T1040", "title": "T1040", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58584" }, { "id": 577371, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "336fa0b8-2db9-5238-bb4a-462d2b1f268f", "parentControlId": 31484, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58584" }, { "id": 577372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f213309d-2046-593c-bd75-42e76d0ff4fd", "parentControlId": 31484, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58584" }, { "id": 577373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2e259ff-46fd-5f1d-8e97-523008098219", "parentControlId": 31484, "controlId": "T1078.002", "title": "T1078.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58584" }, { "id": 577374, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3d2970b-c9cd-5646-8469-e54d655cab48", "parentControlId": 31484, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58584" }, { "id": 577375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9790618c-6dc9-53a2-8c71-9e5f5e78b8c0", "parentControlId": 31484, "controlId": "T1098.001", "title": "T1098.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58584" }, { "id": 577376, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62d35cb0-30e4-5036-b546-180171bdfd1c", "parentControlId": 31484, "controlId": "T1098.002", "title": "T1098.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58584" }, { "id": 577377, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "163ba52d-91b6-5afc-96e3-8e454994dafb", "parentControlId": 31484, "controlId": "T1098.003", "title": "T1098.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58584" }, { "id": 577378, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f50464a-ff2a-559f-a5a8-90ea4845a05a", "parentControlId": 31484, "controlId": "T1098.004", "title": "T1098.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585841" }, { "id": 577379, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b05ffae1-cbca-5477-82d0-55b216505775", "parentControlId": 31484, "controlId": "T1098.006", "title": "T1098.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585841" }, { "id": 577380, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24a40197-2897-50b3-ae0a-0152eacbd350", "parentControlId": 31484, "controlId": "T1110", "title": "T1110", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585841" }, { "id": 577381, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "212cc39c-a4aa-5ebf-b5bd-af3af467921a", "parentControlId": 31484, "controlId": "T1110.001", "title": "T1110.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585841" }, { "id": 577382, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3119a770-ab36-5b1c-a2a6-96de3fab7ccd", "parentControlId": 31484, "controlId": "T1110.002", "title": "T1110.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585841" }, { "id": 577383, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05df1b82-bc06-56c7-a666-5fc99b388756", "parentControlId": 31484, "controlId": "T1110.003", "title": "T1110.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585841" }, { "id": 577384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce91c87c-2e5e-5c89-9c00-cd46fd4be0c2", "parentControlId": 31484, "controlId": "T1110.004", "title": "T1110.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585841" }, { "id": 577385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "923f930b-04dc-5613-bed1-1519ad36403b", "parentControlId": 31484, "controlId": "T1111", "title": "T1111", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585841" }, { "id": 577386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8c6e2fc-0d83-5fb6-b973-fc79dd7d5040", "parentControlId": 31484, "controlId": "T1114", "title": "T1114", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585841" }, { "id": 577387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9475b3b0-aafc-58ac-88d0-086f432d2fd9", "parentControlId": 31484, "controlId": "T1114.002", "title": "T1114.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585842" }, { "id": 577388, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1546855-ae87-5f24-a2e9-57a53ed75ca4", "parentControlId": 31484, "controlId": "T1133", "title": "T1133", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585842" }, { "id": 577389, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "175e045e-41b9-5479-b02e-451237846430", "parentControlId": 31484, "controlId": "T1136", "title": "T1136", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585842" }, { "id": 577390, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a0913f1-893f-56df-9857-abf8ea24484a", "parentControlId": 31484, "controlId": "T1136.001", "title": "T1136.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585842" }, { "id": 577391, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33754db2-e2f4-50b9-ac23-7de673eda4f6", "parentControlId": 31484, "controlId": "T1136.002", "title": "T1136.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585842" }, { "id": 577392, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7eb2995-0fe4-59be-9049-4a634eee7295", "parentControlId": 31484, "controlId": "T1136.003", "title": "T1136.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585842" }, { "id": 577393, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "241a01ad-58df-5bff-a15c-80c488bf311a", "parentControlId": 31484, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585842" }, { "id": 577394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6da7c0f5-b7fd-53fd-a0a3-779d5d6ea6f0", "parentControlId": 31484, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585842" }, { "id": 577395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea4b9639-d2bc-564a-bc1c-84ace3b621be", "parentControlId": 31484, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585843" }, { "id": 577396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f50192f7-7f6c-5936-b9a6-b234ff5b2085", "parentControlId": 31484, "controlId": "T1539", "title": "T1539", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585843" }, { "id": 577397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68dddb41-4e08-5f6c-b4ee-a8093d6a584e", "parentControlId": 31484, "controlId": "T1550.003", "title": "T1550.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585843" }, { "id": 577398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "752367ce-349f-51a0-a9a1-a2ac156bed4f", "parentControlId": 31484, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585843" }, { "id": 577399, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14a33ecd-9fd1-5400-8a81-15ffdbca62d4", "parentControlId": 31484, "controlId": "T1552.001", "title": "T1552.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585843" }, { "id": 577400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af96d29a-a868-5b7d-a5bc-4331ae70ff88", "parentControlId": 31484, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585843" }, { "id": 577401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1570832b-497c-5d09-91b0-66f241e0f0a5", "parentControlId": 31484, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585843" }, { "id": 577402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30534d3c-bdd3-5886-9e1f-30b1e72b66db", "parentControlId": 31484, "controlId": "T1552.006", "title": "T1552.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585843" }, { "id": 577403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1725f53e-7f0e-5d0f-9f6d-c30622451038", "parentControlId": 31484, "controlId": "T1555", "title": "T1555", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585843" }, { "id": 577404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "085df2ce-3832-519d-b7ad-5ede2e6a0304", "parentControlId": 31484, "controlId": "T1555.001", "title": "T1555.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585843" }, { "id": 577405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51811193-ebf0-5c0c-bb77-0c17a19ce74a", "parentControlId": 31484, "controlId": "T1555.002", "title": "T1555.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585844" }, { "id": 577406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a1ac30e-2131-5241-9545-3b031f30b345", "parentControlId": 31484, "controlId": "T1555.004", "title": "T1555.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585844" }, { "id": 577407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8598e6f2-4d18-5d84-ad51-262ab0a064c8", "parentControlId": 31484, "controlId": "T1555.005", "title": "T1555.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585844" }, { "id": 577408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0dffc42-b789-5973-9456-0515561414de", "parentControlId": 31484, "controlId": "T1556", "title": "T1556", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585844" }, { "id": 577409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "822511bc-8524-55cf-9863-8a1341ab22dd", "parentControlId": 31484, "controlId": "T1556.001", "title": "T1556.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585844" }, { "id": 577410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e00cfa8d-0168-5dd5-9af7-b84923c93d14", "parentControlId": 31484, "controlId": "T1556.003", "title": "T1556.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585844" }, { "id": 577411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c0518fa-28b2-5532-98ed-e462964a910f", "parentControlId": 31484, "controlId": "T1556.004", "title": "T1556.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585844" }, { "id": 577412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdba6618-6020-596f-9722-c00cd906aba8", "parentControlId": 31484, "controlId": "T1556.005", "title": "T1556.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585844" }, { "id": 577413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06d8715d-db37-53f2-8cb1-0f7182b45150", "parentControlId": 31484, "controlId": "T1556.009", "title": "T1556.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585844" }, { "id": 577414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585845", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ceb1c5bc-737c-5f72-8d92-8a807edbaead", "parentControlId": 31484, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585845" }, { "id": 577415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585845", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47fcb496-5e0d-5a71-823e-800604abe345", "parentControlId": 31484, "controlId": "T1558.001", "title": "T1558.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585845" }, { "id": 577416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585845", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "654a056c-ec4a-5c34-8f03-363e628fb37b", "parentControlId": 31484, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585845" }, { "id": 577417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585845", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "107f4f57-9c0a-542d-a909-158b64dd0736", "parentControlId": 31484, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585845" }, { "id": 577418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585845", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27caf4b0-06f3-565a-a2aa-ad7bf1a6291e", "parentControlId": 31484, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585845" }, { "id": 577419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585845", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8681fa7-4eeb-5df8-8396-46e8fff5ce2f", "parentControlId": 31484, "controlId": "T1558.005", "title": "T1558.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585845" }, { "id": 577420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585845", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be5fa18a-8722-51c4-8bd6-2baac165d222", "parentControlId": 31484, "controlId": "T1563.001", "title": "T1563.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585845" }, { "id": 577421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585845", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "021333d6-aa0c-5ef7-87bb-3748cc35af70", "parentControlId": 31484, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585846" }, { "id": 577422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6d9ad41-5859-519c-aefd-36ffbf2d0de5", "parentControlId": 31484, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585846" }, { "id": 577423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fd0a50b-1d36-53a5-9e2c-9040979adf74", "parentControlId": 31484, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585846" }, { "id": 577424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03f1a405-0457-5e1d-9252-80bd60f13fbe", "parentControlId": 31484, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585846" }, { "id": 577425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ef4b228-7aed-55a6-aa3f-512ff1eb1094", "parentControlId": 31484, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585846" }, { "id": 577426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05c0a070-ad34-5c9c-b7af-94c6f56670e4", "parentControlId": 31484, "controlId": "T1621", "title": "T1621", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585846" }, { "id": 577427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95a97a23-6989-510a-be00-dca34ae88c3c", "parentControlId": 31484, "controlId": "T1649", "title": "T1649", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585846" }, { "id": 577429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da87922a-e760-5a29-8819-85bdf529ac51", "parentControlId": 31484, "controlId": "IA-5", "title": "IA-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585846" }, { "id": 577430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51880ba6-31d4-5c84-b070-6aa102fe1acb", "parentControlId": 31484, "controlId": "IA-5(4)", "title": "IA-5(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585846" }, { "id": 577431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2763f0a-99c8-56df-92a0-bf9d49cb632d", "parentControlId": 31484, "controlId": "IA-05", "title": "IA-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585847" }, { "id": 577432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "191edf7d-7cdc-5eb3-b279-dc9576156d7b", "parentControlId": 31484, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585847" }, { "id": 577435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d5503a8-b6a5-5113-8fab-5df6cc695ffb", "parentControlId": 31484, "controlId": "IA-05", "title": "IA-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585847" }, { "id": 577436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44bbae47-e77c-5ba2-b39f-3edd89fccae6", "parentControlId": 31484, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585847" }, { "id": 577437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd7b25f6-2140-5514-b3c7-989429f1cb91", "parentControlId": 31484, "controlId": "IA-05", "title": "IA-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585847" }, { "id": 577438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "115a04d7-269c-53e3-a6b8-69c28e3da9ab", "parentControlId": 31484, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585847" }, { "id": 577439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c909baab-b6ae-5b9a-b8da-99a5ee99692f", "parentControlId": 31484, "controlId": "IA-05", "title": "IA-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585847" }, { "id": 577440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8ac003a-2f89-5d55-ac88-c95862644fb2", "parentControlId": 31484, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585848" }, { "id": 577441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585848", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1393a079-4efa-5034-8b6f-b74f52ed4ac7", "parentControlId": 31484, "controlId": "IA-05", "title": "IA-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585848" }, { "id": 577442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585848", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "117b3862-1007-51ec-81e6-aca49c76758f", "parentControlId": 31484, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585848" }, { "id": 577443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585848", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "686e8784-d767-5e0a-9d05-76b85f09c70a", "parentControlId": 31484, "controlId": "IA-05", "title": "IA-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585848" }, { "id": 577444, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585848", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27a6ee6a-69e9-5d0e-9cf7-5ac9d36042f7", "parentControlId": 31484, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585848" }, { "id": 577445, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585848", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1a3a317-d10f-52b0-aff9-f446a7bca72f", "parentControlId": 31484, "controlId": "IA-5", "title": "IA-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585848" }, { "id": 577446, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585848", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7ba6d70-2e76-5611-b4e0-6ce3f1d97978", "parentControlId": 31484, "controlId": "IA-5", "title": "IA-5", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585848" }, { "id": 577447, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585848", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75df1e01-7d68-551f-a7c5-95870fc38737", "parentControlId": 31484, "controlId": "IA-5", "title": "IA-5", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585848" }, { "id": 577450, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07e180f3-1c52-5b69-9e11-97b49fe73bc9", "parentControlId": 31484, "controlId": "3.5.8", "title": "3.5.8", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585849" }, { "id": 577451, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03cb9320-1fd4-531b-afa4-800638a5cdd0", "parentControlId": 31484, "controlId": "3.5.9", "title": "3.5.9", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585849" }, { "id": 577452, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b144cb52-98c6-5a5e-a7af-ce01fbab0d09", "parentControlId": 31484, "controlId": "03.05.07.a", "title": "03.05.07.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585849" }, { "id": 577453, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1f769e8-84b2-54be-9ef1-73e62a5bef77", "parentControlId": 31484, "controlId": "03.05.07.b", "title": "03.05.07.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585849" }, { "id": 577454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a33e0a7-f978-5a8e-a69a-b0aa476897e6", "parentControlId": 31484, "controlId": "03.05.07.c", "title": "03.05.07.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585849" }, { "id": 577455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc14394e-99ca-5e4c-adac-4d239d8d141c", "parentControlId": 31484, "controlId": "03.05.07.d", "title": "03.05.07.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585849" }, { "id": 577456, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585849", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6584dfa4-1106-59e6-ba65-54d8be44e7ef", "parentControlId": 31484, "controlId": "03.05.07.e", "title": "03.05.07.e", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585849" }, { "id": 577457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac836a54-1331-5f6c-ae5e-86e0f25865bc", "parentControlId": 31484, "controlId": "03.05.07.f", "title": "03.05.07.f", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58585" }, { "id": 577458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c43d63c-42cd-53e3-8d0a-bf06de85629d", "parentControlId": 31484, "controlId": "03.05.12.a", "title": "03.05.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58585" }, { "id": 577459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "112d6f54-ed2b-5309-890d-e805a01490eb", "parentControlId": 31484, "controlId": "03.05.12.b", "title": "03.05.12.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58585" }, { "id": 577460, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7cf743e6-3ff7-5647-8fc0-d132c39325d3", "parentControlId": 31484, "controlId": "03.05.12.c", "title": "03.05.12.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58585" }, { "id": 577461, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "727fcb54-7799-522f-bb68-8fa61e63e81f", "parentControlId": 31484, "controlId": "03.05.12.d", "title": "03.05.12.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58585" }, { "id": 577462, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2fda5f9-1dd5-509d-a822-3051c95c5ccd", "parentControlId": 31484, "controlId": "03.05.12.e", "title": "03.05.12.e", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58585" }, { "id": 577463, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b2f7ccd-bb43-52e4-862d-4eed7a26e049", "parentControlId": 31484, "controlId": "03.05.12.f", "title": "03.05.12.f", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58585" }, { "id": 577537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585867", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8bb0c3f-f0dc-50cd-90de-e0b5460249c4", "parentControlId": 31484, "controlId": "ACCESS-1b", "title": "ACCESS-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585867" }, { "id": 577561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58587", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd2c0bbd-654d-57a8-a554-cf3f2e6b2c79", "parentControlId": 31484, "controlId": "CIP-007-6 5.6", "title": "CIP-007-6 5.6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58587" }, { "id": 577562, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58587", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b73f7440-3722-5856-88b0-01520e4c02b9", "parentControlId": 31484, "controlId": "§117.15(e)(5)", "title": "§117.15(e)(5)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58587" }, { "controlId": "B.4.3", "title": "B.4.3 — Password Requirements", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IA-5(1)", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "549da2da-371e-54a5-b3cc-836bac89b8e5", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.3", "title": "NEI 08-09 App D.4.3 — Password Requirements", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "f2d6b99f-5f6d-5a70-bde5-3a644585941d", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.4.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "a143dbac-3cea-52dc-b5a6-792783901959", "isPublic": true }, { "controlId": "B.4.7", "title": "B.4.7 — Authenticator Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IA-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "4ac91ec1-f681-5d5c-bc32-5306e86ad2ea", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.7", "title": "NEI 08-09 App D.4.7 — Authenticator Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "89bb445b-6981-5c90-8a7b-b3b9d58e10f3", "isPublic": true }, { "controlId": "CIP-007-6-R5", "title": "CIP-007-6-R5 — System Access Control and Authentication", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1e99f73f-42fd-53ad-a15e-9b4bb255be10", "isPublic": true }, { "controlId": "CIP-007-6-5.1", "title": "CIP-007-6-5.1 — Have a method(s) to enforce authentication of interactive user access, where technically feasible.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3712380b-c88e-5de7-820a-19c8416112c4", "isPublic": true }, { "controlId": "CIP-007-6-5.2", "title": "CIP-007-6-5.2 — Identify and inventory all known enabled default or other generic account types, either by system, by groups of syste...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "06e2f0c0-b3a1-5f3b-b254-0610c8bfb28a", "isPublic": true }, { "controlId": "CIP-007-6-5.3", "title": "CIP-007-6-5.3 — Identify individuals who have authorized access to shared accounts.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3a76ecb8-e341-51c5-b6a9-b6c2d60a20f1", "isPublic": true }, { "controlId": "CIP-007-6-5.4", "title": "CIP-007-6-5.4 — Change known default passwords, per Cyber Asset capability", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "37ccf4a6-5615-5eff-8725-db0966ed2ffe", "isPublic": true }, { "controlId": "CIP-007-6-5.5", "title": "CIP-007-6-5.5 — For password-only authentication for interactive user access, either technically or procedurally enforce the followin...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1a2a6f97-eb47-5593-adb5-94641a3b9266", "isPublic": true }, { "controlId": "CIP-007-6-5.5.1", "title": "CIP-007-6-5.5.1 — Password length that is, at least, the lesser of eight characters or the maximum length supported by the Cyber Asset", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ded968db-da2c-53bc-bf3b-0d3407c3ef0e", "isPublic": true }, { "controlId": "CIP-007-6-5.5.2", "title": "CIP-007-6-5.5.2 — Minimum password complexity that is the lesser of three or more different types of characters (e.g., uppercase alphab...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4c58f561-c194-5a37-8340-c78b02b79bc9", "isPublic": true }, { "controlId": "CIP-007-6-5.6", "title": "CIP-007-6-5.6 — Where technically feasible, for password-only authentication for interactive user access, either technically or proce...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "fc292b48-bc15-50dc-9126-acbd08a4b53e", "isPublic": true }, { "controlId": "CIP-007-6-5.7", "title": "CIP-007-6-5.7 — Where technically feasible, either:  Limit the number of unsuccessful authentication attempts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f0d1896e-ba48-574e-b671-388b4b3fcccb", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "eb9f8dd3-c501-5eb9-aca2-135af5e022b9", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "d32f920d-9ef8-5cf9-a0dc-c7f1b2e74a4f", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "f5f38b66-2341-5ae6-8302-bd296c74c36b", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "dd889306-1b64-5d1a-a622-a637b1a2f158", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "6619807d-7cba-599b-885e-9a271aa2f589", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "d811e585-8e71-5cc7-8408-19af1362d3d6", "isPublic": true } ], "id": 31484, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731101", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731101", "catalogueId": 1062, "uuid": "a91f52ce-b48d-5636-a286-39cb46ef9a21", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Authenticator Management", "description": "

Control Description

Mechanisms exist to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to:\n(1) Securely manage authenticators for users and devices; and\n(2) Ensure the strength of authentication is appropriate to the classification of the data being accessed.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.4.3, B.4.7
NERC-CIP (2026) Requirements: CIP-007-6-R5", "controlId": "IAC-10", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-10", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71753, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590593", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590593", "securityControlId": 31485, "ccis": [], "uuid": "ba94bb84-17eb-5277-8003-af0eac37f7a5", "testId": "IAC-10.1_A01", "test": "for password-based authentication, a list of commonly used, expected or compromised passwords is maintained and updated frequently and when organizational passwords are suspected to have been compromised directly or indirectly.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(01)(a)", "defaultText": null }, { "id": 71754, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590594", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590594", "securityControlId": 31485, "ccis": [], "uuid": "ab4c6131-9f1e-5ed9-9c3a-45012945fc96", "testId": "IAC-10.1_A02", "test": "for password-based authentication when passwords are created or updated by users, the passwords are verified not to be found on the list of commonly used, expected or compromised passwords.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(01)(b)", "defaultText": null }, { "id": 71755, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590594", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590594", "securityControlId": 31485, "ccis": [], "uuid": "31c0ab04-eedf-58be-a1a4-a1fd33a05bcb", "testId": "IAC-10.1_A03", "test": "for password-based authentication, passwords are only transmitted over cryptographically protected channels.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(01)(c)", "defaultText": null }, { "id": 71756, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590594", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590594", "securityControlId": 31485, "ccis": [], "uuid": "e83620e2-c222-5b86-9c34-80f4be9fb245", "testId": "IAC-10.1_A04", "test": "for password-based authentication, passwords are stored using an approved salted key derivation function, preferably using a keyed hash.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_IA-05(01)(d)", "defaultText": null }, { "id": 71757, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590594", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590594", "securityControlId": 31485, "ccis": [], "uuid": "fdf5e6d2-ab33-5064-b698-42c1fcf337c8", "testId": "IAC-10.1_A05", "test": "for password-based authentication, immediate selection of a new password is required upon account recovery.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_IA-05(01)(e)", "defaultText": null }, { "id": 71758, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590594", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590594", "securityControlId": 31485, "ccis": [], "uuid": "aacbb12a-3ebf-50e3-b34d-5db64a063a0f", "testId": "IAC-10.1_A06", "test": "for password-based authentication, user selection of long passwords and passphrases is allowed, including spaces and all printable characters.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_IA-05(01)(f)", "defaultText": null }, { "id": 71759, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590594", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590594", "securityControlId": 31485, "ccis": [], "uuid": "a59d49b3-101e-51d5-b8ed-491d5d206677", "testId": "IAC-10.1_A07", "test": "for password-based authentication, automated tools are employed to assist the user in selecting strong password authenticators.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_IA-05(01)(g)", "defaultText": null }, { "id": 71760, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590594", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590594", "securityControlId": 31485, "ccis": [], "uuid": "89b90e17-c0d4-55a3-ab6e-9be71482f5c2", "testId": "IAC-10.1_A08", "test": "organization-defined composition and complexity rules for passwords are enforced.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_IA-05(01)(h)\n171A_3.5.7[c]", "defaultText": null }, { "id": 71761, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590595", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590595", "securityControlId": 31485, "ccis": [], "uuid": "767c26eb-3659-5b05-a1fc-4862430b7d59", "testId": "IAC-10.1_A09", "test": "password composition and complexity rules are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.5.7[a]\n171A_R3_A.03.05.07.ODP[02]", "defaultText": null }, { "id": 71762, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590599", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590599", "securityControlId": 31485, "ccis": [], "uuid": "2b639d6b-5d8f-5155-9d3c-8db320383947", "testId": "IAC-10.1_A10", "test": "password change of character requirements are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.5.7[b]", "defaultText": null }, { "id": 71763, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590599", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590599", "securityControlId": 31485, "ccis": [], "uuid": "33c96066-59c3-5dc0-b9da-2080da918568", "testId": "IAC-10.1_A11", "test": "minimum password complexity requirements, as defined, are enforced when new passwords are created.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.5.7[c]", "defaultText": null }, { "id": 71764, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590599", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590599", "securityControlId": 31485, "ccis": [], "uuid": "6b2a2c68-9862-5993-9112-59c61cbbabc6", "testId": "IAC-10.1_A12", "test": "minimum password change of character requirements as defined are enforced when new passwords are created.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.5.7[d]", "defaultText": null }, { "id": 71765, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5906", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5906", "securityControlId": 31485, "ccis": [], "uuid": "bed12504-e630-5186-a01f-05bdead37fdf", "testId": "IAC-10.1_A13", "test": "the following composition and complexity rules for passwords are enforced: .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: SDP values:\n(1) Must have a minimum length of 16 characters.\n(2) Contains a string of characters that does not include the user’s account name or full name.", "otherId": "171A_R3_A.03.05.07.f", "defaultText": null } ], "externalMappings": [ { "id": 577640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585887", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd2a6240-340b-5b2b-ba1f-dd88771107da", "parentControlId": 31485, "controlId": "USER 1.11", "title": "USER 1.11", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585887" }, { "id": 577641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585887", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5be8da2a-1734-5353-bdf2-84ae87afc253", "parentControlId": 31485, "controlId": "SR 1.7", "title": "SR 1.7", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585887" }, { "id": 577642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585888", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1d0046b-adce-5bc4-bc2c-a350d98e58a3", "parentControlId": 31485, "controlId": "SR 1.7 RE 1", "title": "SR 1.7 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585888" }, { "id": 577643, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585888", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3470b8a0-4e3d-58fa-a459-555b815ce4e2", "parentControlId": 31485, "controlId": "SR 1.7 RE 2", "title": "SR 1.7 RE 2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585888" }, { "id": 577644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585888", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6e294d2-7f7e-5581-914a-26de7f2495bb", "parentControlId": 31485, "controlId": "CR 1.5(c)", "title": "CR 1.5(c)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585888" }, { "id": 577645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585888", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79e0822d-e62b-53dd-9cd2-259d1b5becbd", "parentControlId": 31485, "controlId": "CR 1.7", "title": "CR 1.7", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585888" }, { "id": 577646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585888", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b677f3c-5841-543c-882e-cc172fa18c6f", "parentControlId": 31485, "controlId": "CR 1.7(1)", "title": "CR 1.7(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585888" }, { "id": 577647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585888", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af4f40ec-473c-5246-a16a-9885dc8ffb4a", "parentControlId": 31485, "controlId": "CR 1.7(2)", "title": "CR 1.7(2)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585888" }, { "id": 577648, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585888", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2265de4-e434-55a8-9d1f-abbdd30bf34a", "parentControlId": 31485, "controlId": "5.17", "title": "5.17", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585888" }, { "id": 577653, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8c5b2eb-91d4-59a6-b31c-c5c430dbf741", "parentControlId": 31485, "controlId": "IA-5(1)", "title": "IA-5(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585889" }, { "id": 577654, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b9353a4-ab45-5343-9ff3-90d01a199de3", "parentControlId": 31485, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585889" }, { "id": 577656, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "468a640c-be6a-5362-ab63-31e0f00d6d1b", "parentControlId": 31485, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585889" }, { "id": 577657, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62b78526-e222-53f3-b8b9-73e8c0581a79", "parentControlId": 31485, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585889" }, { "id": 577658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57a7200f-2cc0-50b9-94da-25ca1bf38e1f", "parentControlId": 31485, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585889" }, { "id": 577659, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd45a524-9e8a-5e9e-9f8c-de72fc873da8", "parentControlId": 31485, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585889" }, { "id": 577660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1db5dd5-d9cd-563e-bad5-4242c68a64bb", "parentControlId": 31485, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585889" }, { "id": 577661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e61cc10-9036-5f84-841e-9c47885f2cba", "parentControlId": 31485, "controlId": "3.5.7", "title": "3.5.7", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58589" }, { "id": 577662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e1d1e02-f97e-5e06-ad20-25b9f3597f1c", "parentControlId": 31485, "controlId": "03.05.07.e", "title": "03.05.07.e", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58589" }, { "id": 577663, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be793e49-8713-5edd-a5a9-e9876df75b05", "parentControlId": 31485, "controlId": "03.05.07.f", "title": "03.05.07.f", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58589" }, { "id": 577664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef3438f1-6316-5f5b-b133-d02b5315d849", "parentControlId": 31485, "controlId": "03.05.12.b", "title": "03.05.12.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58589" }, { "id": 577665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58a9f40a-6033-5691-83f1-5babd89b04ee", "parentControlId": 31485, "controlId": "03.05.12.c", "title": "03.05.12.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58589" }, { "id": 577666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69a0d7e4-8551-503f-8e3b-7eb603fdc2bf", "parentControlId": 31485, "controlId": "03.05.12.d", "title": "03.05.12.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58589" }, { "id": 577667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd1a3a7c-f1cb-5b1f-bdcd-556150cdc717", "parentControlId": 31485, "controlId": "03.05.12.e", "title": "03.05.12.e", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585891" }, { "id": 577668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1e58eb8-c817-5bba-9bd3-6c282dd0f716", "parentControlId": 31485, "controlId": "03.05.12.f", "title": "03.05.12.f", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585891" }, { "id": 577725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c17e504e-73fc-5d49-98d7-2c5715691eae", "parentControlId": 31485, "controlId": "ACCESS-1b", "title": "ACCESS-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585897" }, { "id": 577726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4eacd211-500a-5174-a1ce-52e8750341ed", "parentControlId": 31485, "controlId": "ACCESS-1d", "title": "ACCESS-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585897" }, { "id": 577759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9690cdb9-e12b-54d6-bc23-1c00eef5402b", "parentControlId": 31485, "controlId": "CIP-007-6 5.5.1", "title": "CIP-007-6 5.5.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585901" }, { "id": 577760, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7723f4e1-8f87-5106-91e2-e9c6e9084628", "parentControlId": 31485, "controlId": "CIP-007-6 5.5.2", "title": "CIP-007-6 5.5.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585901" }, { "controlId": "B.4.3", "title": "B.4.3 — Password Requirements", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IA-5(1)", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "200cc687-430a-5aaf-b72f-39cef3dd441c", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.3", "title": "NEI 08-09 App D.4.3 — Password Requirements", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "a831f3cf-63e1-5188-b986-a74b0b8b575a", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.4.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "9b2c5ea3-f1ad-5673-a30a-072fd6e30d9e", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "636f06b5-d1e2-58bc-8569-75559e08906a", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "3c684995-dd1d-5ba9-95fd-908656411c88", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "7999a85e-b815-5f2a-9b53-9241b4dc539b", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "36acd249-42c9-58db-a81a-98cd109595b6", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "b00b24ac-cc50-541c-85e6-3bfffc7914b7", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "ddd9ab3a-cd23-5684-9455-0ee8d19d507c", "isPublic": true } ], "id": 31485, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731101", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731101", "catalogueId": 1062, "uuid": "bb8a4c2a-e21e-5833-abac-77b94d2d77ef", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce complexity, length and lifespan considerations to ensure strong criteria for password-based authentication?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Password-Based Authentication", "description": "

Control Description

Mechanisms exist to enforce complexity, length and lifespan considerations to ensure strong criteria for password-based authentication.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enforce complexity, length and lifespan considerations to ensure strong criteria for password-based authentication.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.4.3", "controlId": "IAC-10.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-10.1", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71766, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5906", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5906", "securityControlId": 31486, "ccis": [], "uuid": "91b3ef6b-aa4e-5b8c-96e6-51bceb67fbc8", "testId": "IAC-10.2_A01", "test": "authorized access to the corresponding private key is enforced for public key-based authentication.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(02)(a)(01)", "defaultText": null }, { "id": 71767, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5906", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5906", "securityControlId": 31486, "ccis": [], "uuid": "864dabbf-cbda-5316-9eb7-9a8694681e74", "testId": "IAC-10.2_A02", "test": "the authenticated identity is mapped to the account of the individual or group for public key-based authentication.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(02)(a)(02)", "defaultText": null }, { "id": 71768, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5906", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5906", "securityControlId": 31486, "ccis": [], "uuid": "a1d5a622-3d81-5b7d-9846-e5bf6fe430db", "testId": "IAC-10.2_A03", "test": "when public key infrastructure (PKI) is used, certificates are validated by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(02)(b)(01)", "defaultText": null }, { "id": 71769, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590601", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590601", "securityControlId": 31486, "ccis": [], "uuid": "1bc48eb0-d705-5c45-b465-01ebc52e2b61", "testId": "IAC-10.2_A04", "test": "when public key infrastructure (PKI) is used, a local cache of revocation data is implemented to support path discovery and validation.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(02)(b)(02)", "defaultText": null } ], "externalMappings": [ { "id": 577816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce7a80e7-b2a9-5784-ac12-04940985a700", "parentControlId": 31486, "controlId": "SR 1.8", "title": "SR 1.8", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585907" }, { "id": 577817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "003523af-80b3-5d7d-b040-66c53d6d7ac8", "parentControlId": 31486, "controlId": "SR 1.9(a)", "title": "SR 1.9(a)", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585908" }, { "id": 577818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef763a08-371f-5dda-8d05-beb14cde4402", "parentControlId": 31486, "controlId": "SR 1.9(b)", "title": "SR 1.9(b)", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585908" }, { "id": 577819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e643775d-f155-5f90-b3f7-e35e15765706", "parentControlId": 31486, "controlId": "SR 1.9(c)", "title": "SR 1.9(c)", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585908" }, { "id": 577820, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "004dda5c-4911-5deb-b96c-40790b56b954", "parentControlId": 31486, "controlId": "SR 1.9(d)", "title": "SR 1.9(d)", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585908" }, { "id": 577821, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc36241a-be96-5b42-93bc-08f2d7ba4208", "parentControlId": 31486, "controlId": "SR 1.9(e)", "title": "SR 1.9(e)", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585908" }, { "id": 577822, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38d5a2dd-7131-5add-b2b2-18f87e88f03c", "parentControlId": 31486, "controlId": "CR 1.9(a)", "title": "CR 1.9(a)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585908" }, { "id": 577823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "104c6be2-b1ce-5096-be35-8687754cf95d", "parentControlId": 31486, "controlId": "CR 1.9(b)", "title": "CR 1.9(b)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585908" }, { "id": 577824, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "404528d1-b958-5d70-913a-4c50e6b3cd5c", "parentControlId": 31486, "controlId": "CR 1.9(c)", "title": "CR 1.9(c)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585908" }, { "id": 577825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c923376-5ab3-5f26-bded-55c53c683a74", "parentControlId": 31486, "controlId": "IA-5(2)", "title": "IA-5(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585908" }, { "id": 577826, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585908", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c1509eb-066f-544b-aed3-825f438254b3", "parentControlId": 31486, "controlId": "IA-05(02)", "title": "IA-05(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585908" }, { "id": 577828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3ea88f0-4333-5a00-adcd-89e289ed358c", "parentControlId": 31486, "controlId": "IA-05(02)", "title": "IA-05(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585909" }, { "id": 577829, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e135058-3053-5025-a53b-c6e198f581b0", "parentControlId": 31486, "controlId": "IA-05(02)", "title": "IA-05(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585909" }, { "id": 577830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bcdc2f35-41f5-5801-91b7-0f2cc40f3fa3", "parentControlId": 31486, "controlId": "IA-05(02)", "title": "IA-05(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585909" }, { "id": 577831, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "183a9c56-5c65-5f1c-a1a5-f8ad534e7059", "parentControlId": 31486, "controlId": "IA-05(02)", "title": "IA-05(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585909" }, { "id": 577845, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56508a42-30b9-5e11-9bb3-835ffe30e484", "parentControlId": 31486, "controlId": "ACCESS-1b", "title": "ACCESS-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585911" } ], "id": 31486, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731102", "catalogueId": 1062, "uuid": "a18a845f-6a53-56d9-9731-7e2e596d46b2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information for PKI-based authentication?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "PKI-Based Authentication", "description": "

Control Description

Automated mechanisms exist to validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information for PKI-based authentication.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information for PKI-based authentication.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-10.2", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-10.2", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71770, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590601", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590601", "securityControlId": 31487, "ccis": [], "uuid": "150a8a42-1c39-5ca8-82aa-07d371e31e53", "testId": "IAC-10.3_A01", "test": "the validation and verification of identity evidence is conducted in person before a designated registration authority.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-12(04)", "defaultText": null } ], "externalMappings": [ { "id": 577869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a10c242-3953-563b-9b51-c6aa5efb962a", "parentControlId": 31487, "controlId": "IA-5(3)", "title": "IA-5(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585913" }, { "id": 577870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1adf7e3-df3f-59b8-8b76-bd602d1e1bf1", "parentControlId": 31487, "controlId": "IA-12(04)", "title": "IA-12(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585913" }, { "id": 577872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585914", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9b8d772-ed10-5eba-8c49-42873314e363", "parentControlId": 31487, "controlId": "IA-12(04)", "title": "IA-12(04)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585914" }, { "id": 577873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585914", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "842a0667-6f99-5731-be1b-9534c81b509d", "parentControlId": 31487, "controlId": "IA-12(04)", "title": "IA-12(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585914" }, { "id": 577874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585914", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c414c2d2-c8d6-5fc3-901c-13623469a1e8", "parentControlId": 31487, "controlId": "IA-12(04)", "title": "IA-12(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585914" }, { "id": 577875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585914", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21f0bfea-e910-55ab-b2a8-7def2f861324", "parentControlId": 31487, "controlId": "03.05.12.a", "title": "03.05.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585914" } ], "id": 31487, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731102", "catalogueId": 1062, "uuid": "812d9487-6dd9-5384-bca7-55a064eb49b8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct in-person or trusted third-party identify verification before user accounts for third-parties are created?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "In-Person or Trusted Third-Party Registration", "description": "

Control Description

Mechanisms exist to conduct in-person or trusted third-party identify verification before user accounts for third-parties are created.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conduct in-person or trusted third-party identify verification before user accounts for third-parties are created.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-10.3", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-10.3", "references": "

Micro-Small Business (<10 staff)

∙ Verify identity in-person or via trusted third party for sensitive accounts

Small Business (10-49 staff)

∙ In-person or trusted third-party identity proofing for high-assurance accounts

Medium Business (50-249 staff)

∙ Formal identity proofing process for high-assurance accounts\n∙ NIST IAL2/IAL3 compliance

Large Business (250-999 staff)

∙ Formal identity proofing program\n∙ Third-party identity verification service\n∙ NIST SP 800-63A compliance

Enterprise (>1,000 staff)

∙ Enterprise identity proofing solution (e.g., ID.me, Jumio)\n∙ NIST IAL3 compliance\n∙ Remote proofing capabilities", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71771, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590601", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590601", "securityControlId": 31488, "ccis": [], "uuid": "fbdd99e8-994a-5a3d-ac8b-9f0c7a67251c", "testId": "IAC-10.4_A01", "test": "authenticator composition and complexity rules are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(01)_ODP[02]", "defaultText": null }, { "id": 71772, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590601", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590601", "securityControlId": 31488, "ccis": [], "uuid": "e12a611a-fb5e-575c-a291-9e01589d6bf7", "testId": "IAC-10.4_A02", "test": "for password-based authentication, composition and complexity rules are enforced.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(01)(h)", "defaultText": null }, { "id": 71773, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590602", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590602", "securityControlId": 31488, "ccis": [], "uuid": "4898ebca-0e2b-5fa0-b050-65f522c007ec", "testId": "IAC-10.4_A03", "test": "automated mechanisms for the generation, protection, rotation and management of passwords for systems and system components that do not support multifactor authentication or complex account management are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.5.2e[b]", "defaultText": null }, { "id": 71774, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590602", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590602", "securityControlId": 31488, "ccis": [], "uuid": "34063240-3501-5819-b997-6be6469bb3e4", "testId": "IAC-10.4_A04", "test": "automated mechanisms for the generation, protection, rotation and management of passwords for systems and system components that do not support multifactor authentication or complex account management are employed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "172A_3.5.2e[c]", "defaultText": null }, { "id": 71775, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590602", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590602", "securityControlId": 31488, "ccis": [], "uuid": "61e2dd3b-9a8b-5aa7-acf9-7ba084cc3d8c", "testId": "IAC-10.4_A05", "test": "the frequency at which to update the list of commonly used, expected, or compromised passwords is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.05.07.ODP[01]", "defaultText": null }, { "id": 71776, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590602", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590602", "securityControlId": 31488, "ccis": [], "uuid": "46755c3d-dff9-561f-979f-c08eb50117f2", "testId": "IAC-10.4_A06", "test": "a list of commonly used, expected, or compromised passwords is maintained.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.05.07.a[01]", "defaultText": null }, { "id": 71777, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590602", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590602", "securityControlId": 31488, "ccis": [], "uuid": "5e7b72c9-8378-5af8-815b-068c0c376620", "testId": "IAC-10.4_A07", "test": "a list of commonly used, expected, or compromised passwords is updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71778, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590602", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590602", "securityControlId": 31488, "ccis": [], "uuid": "c1496d01-a97a-58cb-957d-7db21bfdf827", "testId": "IAC-10.4_A08", "test": "a list of commonly used, expected, or compromised passwords is updated when organizational passwords are suspected to have been compromised.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.05.07.a[03]", "defaultText": null }, { "id": 71779, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590603", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590603", "securityControlId": 31488, "ccis": [], "uuid": "16b870ab-8621-5f65-92bc-e407908c5c42", "testId": "IAC-10.4_A09", "test": "passwords are verified not to be found on the list of commonly used, expected, or compromised passwords when they are created or updated by users.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.05.07.b", "defaultText": null }, { "id": 71780, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590603", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590603", "securityControlId": 31488, "ccis": [], "uuid": "02cefe2f-c645-5500-9673-ee0ecd94999f", "testId": "IAC-10.4_A10", "test": "a list of commonly used, expected, or compromised passwords is updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least quarterly", "otherId": "171A_R3_A.03.05.07.a[02]", "defaultText": null } ], "externalMappings": [ { "id": 577889, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585915", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d5d7d5e-8c1f-58e9-a8e5-848abb1ba92a", "parentControlId": 31488, "controlId": "IA-5(4)", "title": "IA-5(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585915" }, { "id": 577890, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1682bc8-6598-5cd5-85e9-45e24c67e4b0", "parentControlId": 31488, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585916" }, { "id": 577892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ea6cabd-56f2-5746-9e2c-16b069ce63fb", "parentControlId": 31488, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585916" }, { "id": 577893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cfd3d302-856c-5b9b-a90e-48bbfa441b51", "parentControlId": 31488, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585916" }, { "id": 577894, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1eda5546-8942-5b26-b5dc-598baa609976", "parentControlId": 31488, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585916" }, { "id": 577895, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "931c134a-512b-527f-935f-d16558634ad5", "parentControlId": 31488, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585916" }, { "id": 577896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83028f32-7b05-5361-ba14-2f493c91c148", "parentControlId": 31488, "controlId": "IA-05(01)", "title": "IA-05(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585916" }, { "id": 577897, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40f340fb-38a5-5042-a920-f86ec72d7b05", "parentControlId": 31488, "controlId": "03.05.07.a", "title": "03.05.07.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585916" }, { "id": 577898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ecbdfe13-4f53-543a-9a0c-0fe381e900f8", "parentControlId": 31488, "controlId": "03.05.07.b", "title": "03.05.07.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585917" } ], "id": 31488, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731103", "catalogueId": 1062, "uuid": "d34c5ef4-b205-552c-8de0-334d1389eeca", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to determine if password authenticators are sufficiently strong enough to satisfy organization-defined password length and complexity requirements?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Automated Support For Password Strength", "description": "

Control Description

Automated mechanisms exist to determine if password authenticators are sufficiently strong enough to satisfy organization-defined password length and complexity requirements.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.\n▪ Password managers are not governed.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically determine if password authenticators are sufficiently strong enough to satisfy organization-defined password length and complexity requirements.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "IAC-10.4", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-10.4", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71781, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590603", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590603", "securityControlId": 31489, "ccis": [], "uuid": "3fbf2c1d-2574-5480-bc00-611ace621728", "testId": "IAC-10.5_A01", "test": "authenticators are protected commensurate with the security category of the information to which use of the authenticator permits access.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(06)", "defaultText": null }, { "id": 71782, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590603", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590603", "securityControlId": 31489, "ccis": [], "uuid": "8eea787a-b7cc-5828-84a3-4cb15b437927", "testId": "IAC-10.5_A02", "test": "authenticator content is protected from unauthorized disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.05.12.f[01]", "defaultText": null }, { "id": 71783, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590603", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590603", "securityControlId": 31489, "ccis": [], "uuid": "99023434-8a69-5a7a-957a-22623b2350e6", "testId": "IAC-10.5_A03", "test": "authenticator content is protected from unauthorized modification.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.05.12.f[02]", "defaultText": null }, { "id": 71784, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590604", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590604", "securityControlId": 31489, "ccis": [], "uuid": "5cf7541b-0d08-5c26-9334-443e217b58ca", "testId": "IAC-10.5_A04", "test": "passwords are stored in a cryptographically protected form.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.5.10[a]\n171A_R3_A.03.05.07.d", "defaultText": null }, { "id": 71785, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590604", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590604", "securityControlId": 31489, "ccis": [], "uuid": "f5c532a0-4c05-5de4-bb5b-e57f91d2506d", "testId": "IAC-10.5_A05", "test": "passwords are cryptographically protected in transit.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.5.10[b]", "defaultText": null }, { "id": 71786, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590604", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590604", "securityControlId": 31489, "ccis": [], "uuid": "1c643189-31c7-50e0-8bbe-aa7e553caaec", "testId": "IAC-10.5_A06", "test": "passwords are only transmitted over cryptographically protected channels.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.07.c", "defaultText": null } ], "externalMappings": [ { "id": 577934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b777bdb7-75f6-5e84-ad3a-a0b2a6cca2c1", "parentControlId": 31489, "controlId": "CR 1.5(d)", "title": "CR 1.5(d)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585921" }, { "id": 577935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3f9f125-b18c-5d00-8d8e-e1e8f8652eb9", "parentControlId": 31489, "controlId": "5.17", "title": "5.17", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585921" }, { "id": 577939, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc8f529c-f991-5a6f-b15e-3f307d378339", "parentControlId": 31489, "controlId": "IA-5(6)", "title": "IA-5(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585921" }, { "id": 577940, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "810ba0da-9cf3-5c51-bae3-edfdbe328825", "parentControlId": 31489, "controlId": "IA-05(06)", "title": "IA-05(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585921" }, { "id": 577942, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af2039be-3642-517b-a620-bf1d65bb0da9", "parentControlId": 31489, "controlId": "IA-05(06)", "title": "IA-05(06)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58593" }, { "id": 577943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03086069-9de4-5d36-9e3c-6ac201ffa293", "parentControlId": 31489, "controlId": "IA-05(06)", "title": "IA-05(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58593" }, { "id": 577944, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3793505-f3e8-59c9-b6ac-6faab5949112", "parentControlId": 31489, "controlId": "IA-05(06)", "title": "IA-05(06)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58593" }, { "id": 577945, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c05887b1-1089-51ac-8e88-9c4b3e80315a", "parentControlId": 31489, "controlId": "IA-05(06)", "title": "IA-05(06)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58593" }, { "id": 577946, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2cedef5-24a0-5f4e-9efb-94fca7cccf74", "parentControlId": 31489, "controlId": "3.5.10", "title": "3.5.10", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58593" }, { "id": 577947, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "562784a1-4102-5923-a656-11eb32e7d5a1", "parentControlId": 31489, "controlId": "03.05.07.c", "title": "03.05.07.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58593" }, { "id": 577948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8ea93a4-a4e5-555b-9b8c-c3bcbe9db5de", "parentControlId": 31489, "controlId": "03.05.07.d", "title": "03.05.07.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585931" }, { "id": 577949, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585931", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64094689-8c65-5a30-b0d8-797ab48d6035", "parentControlId": 31489, "controlId": "03.05.12.f", "title": "03.05.12.f", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585931" } ], "id": 31489, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731103", "catalogueId": 1062, "uuid": "88c415c1-dabe-504d-9b04-2dec8abb91a5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect authenticators commensurate with the sensitivity of the information to which use of the authenticator permits access?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Protection of Authenticators", "description": "

Control Description

Mechanisms exist to protect authenticators commensurate with the sensitivity of the information to which use of the authenticator permits access.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.\n▪ Password managers are not governed.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to protect authenticators commensurate with the sensitivity of the information to which use of the authenticator permits access.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-10.5", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-10.5", "references": "

Micro-Small Business (<10 staff)

∙ Store passwords in a password manager\n∙ Never share passwords

Small Business (10-49 staff)

∙ Password manager for credential storage\n∙ Policy for authenticator protection

Medium Business (50-249 staff)

∙ Formal authenticator protection policy\n∙ Password manager deployment\n∙ Hardware token protection

Large Business (250-999 staff)

∙ Enterprise password management (e.g., CyberArk, 1Password)\n∙ Hardware token management\n∙ PKI for certificate protection

Enterprise (>1,000 staff)

∙ Enterprise credential management platform (e.g., CyberArk, Thales)\n∙ HSM for cryptographic authenticator protection\n∙ Hardware token lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71787, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590608", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590608", "securityControlId": 31490, "ccis": [], "uuid": "bb483f5b-9b20-561a-8ad7-d54e81164297", "testId": "IAC-10.6_A01", "test": "unencrypted static authenticators are not embedded in applications or other forms of static storage.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(07)", "defaultText": null } ], "externalMappings": [ { "id": 578010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585938", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e35b5af9-ef13-5ea6-b9c6-044081487f2d", "parentControlId": 31490, "controlId": "IA-5(7)", "title": "IA-5(7)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585938" }, { "id": 578011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585938", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4356622-b29b-5f7a-ad3e-bc8cc258bef1", "parentControlId": 31490, "controlId": "IA-05(07)", "title": "IA-05(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585938" }, { "id": 578012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585938", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22cc3447-44aa-54da-92ab-e735078f8e7b", "parentControlId": 31490, "controlId": "IA-05(07)", "title": "IA-05(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585938" }, { "id": 578013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585938", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f58aaa07-f577-5ed2-ae47-43aaccc8f717", "parentControlId": 31490, "controlId": "03.05.07.d", "title": "03.05.07.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585938" } ], "id": 31490, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731103", "catalogueId": 1062, "uuid": "437828df-f6d4-5df8-aa54-4723d06aa44d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure that unencrypted, static authenticators are not embedded in applications, scripts or stored on function keys?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "No Embedded Unencrypted Static Authenticators", "description": "

Control Description

Mechanisms exist to ensure that unencrypted, static authenticators are not embedded in applications, scripts or stored on function keys.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure that unencrypted, static authenticators are not embedded in applications, scripts or stored on function keys.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-10.6", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-10.6", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71788, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590608", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590608", "securityControlId": 31491, "ccis": [], "uuid": "52c04b23-416b-59fd-b37c-d44d203ff626", "testId": "IAC-10.7_A01", "test": "organization-defined token quality requirements are satisfied for hardware token-based authentication.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 578038, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585941", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8e85b4e-7b7e-55ff-ac7a-071a64e779df", "parentControlId": 31491, "controlId": "IA-5(11)", "title": "IA-5(11)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585941" }, { "id": 578039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585941", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be580c51-87b5-54c2-b6a5-c5bd36c1581a", "parentControlId": 31491, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585941" }, { "id": 578040, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585941", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39b89bb0-140c-51d1-8d86-db783caff8cb", "parentControlId": 31491, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585941" }, { "id": 578043, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585942", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1613c75e-3a80-57ae-b4a9-f00275216d58", "parentControlId": 31491, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585942" }, { "id": 578044, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585942", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14ee647b-6c80-5211-accd-01d045e7eb01", "parentControlId": 31491, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585942" }, { "id": 578045, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585942", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58672727-cbba-55cd-a5d7-d138b2e6af52", "parentControlId": 31491, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585942" }, { "id": 578046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585942", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "569e81fc-2f76-5846-ab8e-c19175a3a802", "parentControlId": 31491, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585942" }, { "id": 578047, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585942", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0cf7ecdc-9ccc-59bd-8a9c-4d8342ec5865", "parentControlId": 31491, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585942" }, { "id": 578048, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585942", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a756d822-f6a8-5bac-b914-d2a8f9c40cb0", "parentControlId": 31491, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585943" }, { "id": 578049, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3526195-b75b-5547-8354-25493ab939da", "parentControlId": 31491, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585943" }, { "id": 578050, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db2cb3f5-48c2-55d9-8f73-f78884e99c5e", "parentControlId": 31491, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585943" }, { "id": 578051, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "660a79b1-d638-5e5c-9021-46d42e969082", "parentControlId": 31491, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585943" }, { "id": 578052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49bbc8d8-857f-5d93-9ab8-9f0a565fe3da", "parentControlId": 31491, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585943" } ], "id": 31491, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731104", "catalogueId": 1062, "uuid": "21decb75-360b-52f8-9e43-99634b97a9bb", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to ensure organization-defined token quality requirements are satisfied for hardware token-based authentication?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Hardware Token-Based Authentication", "description": "

Control Description

Automated mechanisms exist to ensure organization-defined token quality requirements are satisfied for hardware token-based authentication.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically ensure organization-defined token quality requirements are satisfied for hardware token-based authentication.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-10.7", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-10.7", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71789, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590608", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590608", "securityControlId": 31492, "ccis": [], "uuid": "a69cc587-5e16-569f-9d09-4343c8a2bde8", "testId": "IAC-10.8_A01", "test": "developers and installers of system components are required to provide unique authenticators or change default authenticators prior to delivery and installation.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(05)", "defaultText": null } ], "externalMappings": [ { "id": 578090, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0525af94-a94a-5634-8944-e2ce159a2bb8", "parentControlId": 31492, "controlId": "CR 1.5(a)", "title": "CR 1.5(a)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585947" }, { "id": 578091, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585947", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3c01f6d-5ed5-5f70-a0a6-05cbd6aeca2f", "parentControlId": 31492, "controlId": "CR 1.5(b)", "title": "CR 1.5(b)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585948" }, { "id": 578093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab1b58a6-7bd5-5e44-b4b0-0fa33e35b339", "parentControlId": 31492, "controlId": "5.17", "title": "5.17", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585948" }, { "id": 578097, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a31ab2cd-d546-5b5a-90ea-a25708d3433d", "parentControlId": 31492, "controlId": "IA-5", "title": "IA-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585948" }, { "id": 578098, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "022e91a8-15c6-5638-993f-d38560d50e97", "parentControlId": 31492, "controlId": "IA-5(5)", "title": "IA-5(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585948" }, { "id": 578099, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2be178ff-f5ea-5cb1-a989-1ba3a9d386e7", "parentControlId": 31492, "controlId": "IA-05", "title": "IA-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585948" }, { "id": 578100, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b84b627-0883-5bf1-b76f-2d95e76ff348", "parentControlId": 31492, "controlId": "IA-05(05)", "title": "IA-05(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585949" }, { "id": 578102, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09239627-0afc-5622-94e3-301fd0db98fd", "parentControlId": 31492, "controlId": "IA-05", "title": "IA-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585949" }, { "id": 578103, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3dfd5fad-ca50-5835-99bd-1d17d88b4040", "parentControlId": 31492, "controlId": "IA-05", "title": "IA-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585949" }, { "id": 578104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b54999ea-629d-5895-88d8-47f53110c873", "parentControlId": 31492, "controlId": "IA-05(05)", "title": "IA-05(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585949" }, { "id": 578105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c44434e-12e9-5a00-85cb-bd4cfc7bc3ea", "parentControlId": 31492, "controlId": "IA-05", "title": "IA-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585949" }, { "id": 578106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73086162-2440-59fb-a085-2f54abb29b54", "parentControlId": 31492, "controlId": "IA-05", "title": "IA-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585949" }, { "id": 578107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fea4db99-92d3-535c-95c3-7a5885672121", "parentControlId": 31492, "controlId": "IA-05", "title": "IA-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585949" }, { "id": 578108, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5209ac0f-1e10-5ebd-b4b3-6dc97a55b591", "parentControlId": 31492, "controlId": "IA-5", "title": "IA-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585949" }, { "id": 578109, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84115b3f-1c88-5790-92c0-a9ea4fda78d7", "parentControlId": 31492, "controlId": "IA-5(5)", "title": "IA-5(5)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585949" }, { "id": 578110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58595", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0316ed58-95ee-5e62-8826-5001d1d5e5c3", "parentControlId": 31492, "controlId": "IA-5", "title": "IA-5", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58595" }, { "id": 578111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58595", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1cc5b3e8-760e-5e03-98b0-89d15fd0f116", "parentControlId": 31492, "controlId": "IA-5", "title": "IA-5", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58595" }, { "id": 578115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58595", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "939a8622-86a5-5d34-86ee-26f25ec61d11", "parentControlId": 31492, "controlId": "03.05.07.e", "title": "03.05.07.e", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58595" }, { "id": 578116, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58595", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37067261-eb5a-56b0-82f6-f0024ec502e4", "parentControlId": 31492, "controlId": "03.05.12.d", "title": "03.05.12.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58595" }, { "id": 578148, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585954", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d9fdf25-ce81-51bf-abc8-326933a1f403", "parentControlId": 31492, "controlId": "CIP-007-6 5.4", "title": "CIP-007-6 5.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585954" } ], "id": 31492, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731104", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731104", "catalogueId": 1062, "uuid": "200f86e9-bfb6-51a0-a7a7-a357fd3acac2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure default authenticators are changed as part of account creation or system installation?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Default Authenticators", "description": "

Control Description

Mechanisms exist to ensure default authenticators are changed as part of account creation or system installation.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure default authenticators are changed as part of account creation or system installation.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-10.8", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-10.8", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71790, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590608", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590608", "securityControlId": 31493, "ccis": [], "uuid": "2d2e041d-5a8d-5191-82be-18e3bcff780e", "testId": "IAC-10.9_A01", "test": "security controls implemented to manage the risk of compromise due to individuals having accounts on multiple systems are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(08)_ODP", "defaultText": null }, { "id": 71791, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590609", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590609", "securityControlId": 31493, "ccis": [], "uuid": "982eb09c-de27-5255-ad47-6ec492dab977", "testId": "IAC-10.9_A02", "test": "security controls are implemented to manage the risk of compromise due to individuals having accounts on multiple systems.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(08)", "defaultText": null } ], "externalMappings": [ { "id": 578165, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585956", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9213d13a-348a-51b0-b4f5-9ea5daa43e6a", "parentControlId": 31493, "controlId": "IA-5(8)", "title": "IA-5(8)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585956" }, { "id": 578166, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585956", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a8e96d6-e464-5eff-b845-e666305c6cca", "parentControlId": 31493, "controlId": "IA-05(08)", "title": "IA-05(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585956" }, { "id": 578168, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585956", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44c02270-da0b-554a-a3ba-0df613ab94e3", "parentControlId": 31493, "controlId": "IA-05(08)", "title": "IA-05(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585956" } ], "id": 31493, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731104", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731104", "catalogueId": 1062, "uuid": "df6421fe-f9bd-562d-979b-fe88b446e2e3", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement security safeguards to manage the risk of compromise due to individuals having accounts on multiple Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Multiple System Accounts", "description": "

Control Description

Mechanisms exist to implement security safeguards to manage the risk of compromise due to individuals having accounts on multiple Technology Assets, Applications and/or Services (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement security safeguards to manage the risk of compromise due to individuals having accounts on multiple Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-10.9", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-10.9", "references": "

Micro-Small Business (<10 staff)

∙ Policy limiting and documenting multiple system accounts per user

Small Business (10-49 staff)

∙ Policy controlling multiple account assignments per user

Medium Business (50-249 staff)

∙ Formal multiple account management policy\n∙ Periodic review of multi-account assignments

Large Business (250-999 staff)

∙ Enterprise IAM with multi-account visibility and management

Enterprise (>1,000 staff)

∙ Enterprise IGA platform with unified account view\n∙ Automated detection of excessive accounts\n∙ Access certification", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71792, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590609", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590609", "securityControlId": 31494, "ccis": [], "uuid": "d5252a28-6877-5ac8-b9ed-dc9574cfc56b", "testId": "IAC-10.10_A01", "test": "the time period after which the use of cached authenticators is prohibited is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(13)_ODP", "defaultText": null }, { "id": 71793, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590609", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590609", "securityControlId": 31494, "ccis": [], "uuid": "643c937b-a960-520d-834f-34907aa03566", "testId": "IAC-10.10_A02", "test": "the use of cached authenticators is prohibited after an organization-defined time period.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(13)", "defaultText": null } ], "externalMappings": [ { "id": 578176, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585957", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34975b33-95c3-5e11-9ef8-df31a0809234", "parentControlId": 31494, "controlId": "IA-5(13)", "title": "IA-5(13)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585957" }, { "id": 578177, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585957", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7770b182-049c-552b-9ec5-2751c57949dd", "parentControlId": 31494, "controlId": "IA-05(13)", "title": "IA-05(13)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585957" }, { "id": 578178, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585957", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd346807-9f74-5353-aa17-8c9d7df8ddd9", "parentControlId": 31494, "controlId": "IA-05(13)", "title": "IA-05(13)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585957" } ], "id": 31494, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731105", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731105", "catalogueId": 1062, "uuid": "c4ae5f54-410d-5387-afdc-75f66ad06cac", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to prohibit the use of cached authenticators after organization-defined time period?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Expiration of Cached Authenticators", "description": "

Control Description

Automated mechanisms exist to prohibit the use of cached authenticators after organization-defined time period.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically prohibit the use of cached authenticators after organization-defined time period.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-10.10", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-10.10", "references": "

Micro-Small Business (<10 staff)

∙ Clear cached credentials on shared/public systems

Small Business (10-49 staff)

∙ Policy requiring clearing of cached authenticators on shared systems

Medium Business (50-249 staff)

∙ Formal cached authenticator expiration policy\n∙ Technical controls for cache expiry

Large Business (250-999 staff)

∙ Enterprise endpoint policy for authenticator cache expiration (e.g., GPO)\n∙ Automated enforcement

Enterprise (>1,000 staff)

∙ Enterprise endpoint management with cached credential expiration policies (e.g., Microsoft Intune, JAMF)\n∙ Automated enforcement", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71794, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590609", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590609", "securityControlId": 31495, "ccis": [], "uuid": "6d000fe0-9a16-5578-b9e8-09ae06472249", "testId": "IAC-10.11_A01", "test": "password managers employed for generating and managing passwords are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(18)_ODP[01]", "defaultText": null }, { "id": 71795, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59061", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59061", "securityControlId": 31495, "ccis": [], "uuid": "c192bf39-d22c-5b73-81b4-a113ab2dc90c", "testId": "IAC-10.11_A02", "test": "password managers are employed to generate and manage passwords.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(18)(a)", "defaultText": null }, { "id": 71796, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59061", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59061", "securityControlId": 31495, "ccis": [], "uuid": "4ec22577-987a-513c-9171-3263a89f176b", "testId": "IAC-10.11_A03", "test": "systems and system components that do not support multifactor authentication or complex account management are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.5.2e[a]", "defaultText": null }, { "id": 71797, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59061", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59061", "securityControlId": 31495, "ccis": [], "uuid": "436405c6-1b7a-5f24-8935-f82a371060a6", "testId": "IAC-10.11_A04", "test": "automated mechanisms for the generation, protection, rotation and management of passwords for systems and system components that do not support multifactor authentication or complex account management are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.5.2e[b]", "defaultText": null }, { "id": 71798, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59061", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59061", "securityControlId": 31495, "ccis": [], "uuid": "f7e8443f-d43e-5632-8938-0ab2a0a7f090", "testId": "IAC-10.11_A05", "test": "automated mechanisms for the generation, protection, rotation and management of passwords for systems and system components that do not support multifactor authentication or complex account management are employed.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.5.2e[c]", "defaultText": null }, { "id": 71799, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59061", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59061", "securityControlId": 31495, "ccis": [], "uuid": "18c6e834-81fe-5cd4-ae1b-cd4a144a7e89", "testId": "IAC-10.11_A06", "test": "controls for protecting passwords are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IA-05(18)_ODP[02]", "defaultText": null }, { "id": 71800, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59061", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59061", "securityControlId": 31495, "ccis": [], "uuid": "d25de4f0-e333-5412-9c53-59ad61d5ae8b", "testId": "IAC-10.11_A07", "test": "the passwords are protected using controls.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_IA-05(18)(b)", "defaultText": null }, { "id": 71801, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590611", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590611", "securityControlId": 31495, "ccis": [], "uuid": "fe9b8479-917a-5c1e-b0de-9d8c496eea24", "testId": "IAC-10.11_A08", "test": "the frequency at which to update the list of commonly used, expected, or compromised passwords is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.07.ODP[01]", "defaultText": null }, { "id": 71802, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590611", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590611", "securityControlId": 31495, "ccis": [], "uuid": "be8d043c-7869-56f7-bb0b-8dc1a196cdc7", "testId": "IAC-10.11_A09", "test": "a list of commonly used, expected, or compromised passwords is maintained.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.07.a[01]", "defaultText": null }, { "id": 71803, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590611", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590611", "securityControlId": 31495, "ccis": [], "uuid": "3412da35-09f2-5f77-bf79-cac52a3b0d90", "testId": "IAC-10.11_A10", "test": "a list of commonly used, expected, or compromised passwords is updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 71804, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590611", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590611", "securityControlId": 31495, "ccis": [], "uuid": "6e71f28b-d875-5de1-a8a3-09147a187218", "testId": "IAC-10.11_A11", "test": "a list of commonly used, expected, or compromised passwords is updated when organizational passwords are suspected to have been compromised.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.07.a[03]", "defaultText": null }, { "id": 71805, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590611", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590611", "securityControlId": 31495, "ccis": [], "uuid": "2bf6bde7-bd71-582f-8d4c-5f20ef04d6b7", "testId": "IAC-10.11_A12", "test": "passwords are verified not to be found on the list of commonly used, expected, or compromised passwords when they are created or updated by users.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.07.b", "defaultText": null }, { "id": 71806, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590611", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590611", "securityControlId": 31495, "ccis": [], "uuid": "a9082880-350b-5b01-bda3-308864cd2806", "testId": "IAC-10.11_A13", "test": "a list of commonly used, expected, or compromised passwords is updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least quarterly", "otherId": "171A_R3_A.03.05.07.a[02]", "defaultText": null } ], "externalMappings": [ { "id": 578181, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585958", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c38e611-fa0b-53ba-af69-494fdf449f36", "parentControlId": 31495, "controlId": "5.17", "title": "5.17", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585958" }, { "id": 578182, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585958", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c61438d3-ddd6-579d-9b14-03ffad26c58e", "parentControlId": 31495, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585958" }, { "id": 578187, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b4a6556-ed60-5beb-9ec9-edc68679f954", "parentControlId": 31495, "controlId": "IA-05(18)", "title": "IA-05(18)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585959" }, { "id": 578188, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f566e93-e800-539c-9ef3-0a39b243a832", "parentControlId": 31495, "controlId": "IA-05(18)", "title": "IA-05(18)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585959" }, { "id": 578189, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4bfe0302-56b3-539a-9140-42fdd1efde18", "parentControlId": 31495, "controlId": "03.05.07.a", "title": "03.05.07.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585959" }, { "id": 578190, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7c5361d-e71a-546d-8689-d24af9a7b44c", "parentControlId": 31495, "controlId": "03.05.07.b", "title": "03.05.07.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585959" }, { "id": 578191, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85a76cbd-b44a-5811-a6da-f91850f52ec4", "parentControlId": 31495, "controlId": "03.05.07.c", "title": "03.05.07.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585959" }, { "id": 578192, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0595d13-c048-5e4e-9884-893b9a9e01dc", "parentControlId": 31495, "controlId": "03.05.07.d", "title": "03.05.07.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585959" }, { "id": 578193, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.585959", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2382c2a-1406-50e0-91be-5968bd656fa2", "parentControlId": 31495, "controlId": "03.05.07.f", "title": "03.05.07.f", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.585959" } ], "id": 31495, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731105", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731105", "catalogueId": 1062, "uuid": "dce35fc7-fdab-53d5-a7c8-ba5d782d6ce0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect and store passwords via a password manager tool?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 8.0, "title": "Password Managers", "description": "

Control Description

Mechanisms exist to protect and store passwords via a password manager tool.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.\n▪ Password managers are provided, but decentralized and not actively governed.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to protect and store passwords via a password manager tool.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-10.11", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-10.11", "references": "

Micro-Small Business (<10 staff)

∙ Keeper (https://keepersecurity.com)\n∙ LastPass (https://lastpass.com\n∙ 1Password (https://1password.com)

Small Business (10-49 staff)

∙ Keeper (https://keepersecurity.com)\n∙ LastPass (https://lastpass.com\n∙ 1Password (https://1password.com)

Medium Business (50-249 staff)

∙ Keeper (https://keepersecurity.com)\n∙ LastPass (https://lastpass.com\n∙ 1Password (https://1password.com)\n∙ Delinea Secret Server (https://delinea.com)\n∙ ManageEngine Enterprise Password Management (https://manageengine.com)\n∙ Securden (https://securden.com)\n∙ CyberArk (https://cyberark.com)

Large Business (250-999 staff)

∙ Keeper (https://keepersecurity.com)\n∙ LastPass (https://lastpass.com\n∙ 1Password (https://1password.com)\n∙ Delinea Secret Server (https://delinea.com)\n∙ ManageEngine Enterprise Password Management (https://manageengine.com)\n∙ Securden (https://securden.com)\n∙ CyberArk (https://cyberark.com)

Enterprise (>1,000 staff)

∙ Keeper (https://keepersecurity.com)\n∙ LastPass (https://lastpass.com\n∙ 1Password (https://1password.com)\n∙ Delinea Secret Server (https://delinea.com)\n∙ ManageEngine Enterprise Password Management (https://manageengine.com)\n∙ Securden (https://securden.com)\n∙ CyberArk (https://cyberark.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71807, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590612", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590612", "securityControlId": 31496, "ccis": [], "uuid": "d83f671c-ce9c-5e00-9963-766044ce8992", "testId": "IAC-10.12_A01", "test": "biometric quality requirements for biometric-based authentication are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(12)_ODP", "defaultText": null }, { "id": 71808, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590612", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590612", "securityControlId": 31496, "ccis": [], "uuid": "4fe15906-6b24-59c7-8188-f24e951eaa9f", "testId": "IAC-10.12_A02", "test": "mechanisms that satisfy organization-defined biometric quality requirements are employed for biometric-based authentication.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(12)", "defaultText": null } ], "externalMappings": [ { "id": 578218, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586015", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5adaef64-25c8-5f40-96a0-119fa90eeac2", "parentControlId": 31496, "controlId": "IA-5(12)", "title": "IA-5(12)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586015" }, { "id": 578219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586015", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c72ae3d-950e-5938-adfb-5e2b24301626", "parentControlId": 31496, "controlId": "IA-05(12)", "title": "IA-05(12)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586015" }, { "id": 578220, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586015", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e0c4a4c-9461-52f7-ab73-9a4518ef449e", "parentControlId": 31496, "controlId": "IA-05(12)", "title": "IA-05(12)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586015" } ], "id": 31496, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731105", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731105", "catalogueId": 1062, "uuid": "5b8d1d2b-2480-5df7-b14d-146ce39ffdd4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure biometric-based authentication satisfies organization-defined biometric quality requirements for false positives and false negatives?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Biometric Authentication", "description": "

Control Description

Mechanisms exist to ensure biometric-based authentication satisfies organization-defined biometric quality requirements for false positives and false negatives.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure biometric-based authentication satisfies organization-defined biometric quality requirements for false positives and false negatives.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-10.12", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-10.12", "references": "

Micro-Small Business (<10 staff)

∙ Use fingerprint/face recognition on personal devices where available

Small Business (10-49 staff)

∙ Biometric authentication policy for approved use cases

Medium Business (50-249 staff)

∙ Formal biometric authentication policy\n∙ Approved biometric use cases and controls

Large Business (250-999 staff)

∙ Enterprise biometric authentication deployment\n∙ Privacy and data protection controls for biometrics

Enterprise (>1,000 staff)

∙ Enterprise biometric authentication platform\n∙ Privacy-compliant biometric data handling\n∙ Fallback authentication mechanisms\n∙ BIPA/GDPR compliance", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71809, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590612", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590612", "securityControlId": 31497, "ccis": [], "uuid": "1834dde5-736c-57b8-835b-1e57618fb714", "testId": "IAC-10.13_A01", "test": "authentication credentials are changed at predefined intervals.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71810, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590612", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590612", "securityControlId": 31497, "ccis": [], "uuid": "51de62a2-4556-57f3-9cd1-ffaf29db911c", "testId": "IAC-10.13_A02", "test": "authentication credentials are changed upon suspicion of credential compromise.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 578224, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586016", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d5af074-b911-5664-af32-f3b1ffa5a6cc", "parentControlId": 31497, "controlId": "USER 1.12", "title": "USER 1.12", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586016" } ], "id": 31497, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731106", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731106", "catalogueId": 1062, "uuid": "a69f8629-2d5e-5750-a5e6-bb3c6cea0f93", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization change authentication credentials:\n(1) At predefined intervals; and/or\n(2) Upon suspicion of credential compromise?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Events Requiring Authenticator Change", "description": "

Control Description

Mechanisms exist to change authentication credentials:\n(1) At predefined intervals; and/or\n(2) Upon suspicion of credential compromise.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to change authentication credentials:\n(1) At predefined intervals; and/or\n(2) Upon suspicion of credential compromise.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-10.13", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-10.13", "references": "

Micro-Small Business (<10 staff)

∙ Change passwords when compromise is suspected

Small Business (10-49 staff)

∙ Policy requiring authenticator change upon suspected compromise

Medium Business (50-249 staff)

∙ Formal authenticator replacement triggers and procedures

Large Business (250-999 staff)

∙ Enterprise process for forced authenticator change on compromise indicators\n∙ Automated triggering from SIEM

Enterprise (>1,000 staff)

∙ Enterprise IAM with automated authenticator reset workflows triggered by security events\n∙ SIEM/SOAR integration", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71812, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590613", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590613", "securityControlId": 31499, "ccis": [], "uuid": "f67d3071-c5e7-5575-9b88-9c8be4984dea", "testId": "IAC-11_A01", "test": "authentication information is obscured during the authentication process.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.5.11", "defaultText": null }, { "id": 71813, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590613", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590613", "securityControlId": 31499, "ccis": [], "uuid": "8c4a9c9b-bfdc-5eca-8283-17ae7551f40d", "testId": "IAC-11_A02", "test": "feedback of authentication information during the authentication process is obscured.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-06\n171A_R3_A.03.05.11", "defaultText": null } ], "externalMappings": [ { "id": 578232, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "956683c1-706d-5fd1-b308-f7c0f09be347", "parentControlId": 31499, "controlId": "USER 1.14", "title": "USER 1.14", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586017" }, { "id": 578233, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c763594d-acd1-52bf-8bca-d7df54b18c52", "parentControlId": 31499, "controlId": "SR 1.10", "title": "SR 1.10", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586017" }, { "id": 578234, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74949084-63f9-5912-b96b-b440b0affa8b", "parentControlId": 31499, "controlId": "CR 1.10", "title": "CR 1.10", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586017" }, { "id": 578235, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59f8b0c7-f51b-5e33-9b02-932ad96ed507", "parentControlId": 31499, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586017" }, { "id": 578236, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95ef0ec3-123f-5faf-9ba5-0b27225c3cfa", "parentControlId": 31499, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586017" }, { "id": 578237, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca246e93-2c67-5dba-8015-93e50911cafb", "parentControlId": 31499, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586017" }, { "id": 578238, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e339f99d-fad3-58fb-afa0-b8d61d03e7b0", "parentControlId": 31499, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586017" }, { "id": 578239, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "969c1487-0650-5ae1-8ce5-031f76ce2bdd", "parentControlId": 31499, "controlId": "T1578", "title": "T1578", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586017" }, { "id": 578240, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05111a0b-1184-5d98-9769-1ce877dd9b29", "parentControlId": 31499, "controlId": "T1578.001", "title": "T1578.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586017" }, { "id": 578241, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0dd0cd5b-4eea-5ba7-b195-af8a56786def", "parentControlId": 31499, "controlId": "T1578.002", "title": "T1578.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586018" }, { "id": 578242, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a941e574-313f-5a61-b2cd-6404d6c9d5ad", "parentControlId": 31499, "controlId": "T1578.003", "title": "T1578.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586018" }, { "id": 578243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "693ba4e5-9175-567f-83e2-4f3bbf82fbce", "parentControlId": 31499, "controlId": "IA-6", "title": "IA-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586018" }, { "id": 578244, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b46f3efc-dd1a-597a-ac56-37ba493ab6f6", "parentControlId": 31499, "controlId": "IA-06", "title": "IA-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586018" }, { "id": 578245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16f46740-b9c0-51d5-9864-9553f364e6e7", "parentControlId": 31499, "controlId": "IA-06", "title": "IA-06", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586018" }, { "id": 578246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb6acdb7-4160-5e45-b831-ec0e2a914a43", "parentControlId": 31499, "controlId": "IA-06", "title": "IA-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586018" }, { "id": 578247, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d76228cf-cfc8-55b5-8821-8aedfbe488ab", "parentControlId": 31499, "controlId": "IA-06", "title": "IA-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586018" }, { "id": 578248, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586019", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99caf6e3-f425-5a82-9b3c-ab8983be7a0e", "parentControlId": 31499, "controlId": "IA-06", "title": "IA-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586019" }, { "id": 578249, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586019", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "291debf7-a4b3-5b22-af65-eedbd613cb3d", "parentControlId": 31499, "controlId": "IA-06", "title": "IA-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586019" }, { "id": 578250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586019", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c720a074-5f1a-5c04-9df1-8a743d3fed59", "parentControlId": 31499, "controlId": "3.5.11", "title": "3.5.11", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586019" }, { "id": 578251, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586019", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a52c4a0e-fb93-5e4f-a090-979b575fab78", "parentControlId": 31499, "controlId": "03.05.11", "title": "03.05.11", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586019" }, { "controlId": "B.4.8", "title": "B.4.8 — Authenticator Feedback", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IA-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "7c9e7c3a-960a-5660-bf64-2c4167edb630", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.8", "title": "NEI 08-09 App D.4.8 — Authenticator Feedback", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "5c19f804-5fd0-5960-89fd-d0bc0f454b61", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.4.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "321a41e1-c9e8-58b7-bf30-dc26d1b15d2c", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "fa8aa64f-ec88-5c67-885a-f3cb19b468d6", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "635c51f7-8822-56a5-8056-6f7157bb5817", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "174fd1a1-731d-59f3-a213-aebf14d9bd97", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "d62d4dd9-82b8-5532-b643-57c2c2847ef2", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "4797c57f-ae97-51b2-ba06-02b37e43cfcd", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "b3b80267-dac6-5294-845c-ff21443a45fa", "isPublic": true } ], "id": 31499, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731106", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731106", "catalogueId": 1062, "uuid": "179ca10c-ceb8-5f9c-b710-ccabf3a76f42", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization obscure the feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Authenticator Feedback", "description": "

Control Description

Mechanisms exist to obscure the feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to obscure the feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.4.8", "controlId": "IAC-11", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-11", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71814, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590614", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590614", "securityControlId": 31500, "ccis": [], "uuid": "d7e8b4ed-1d47-5e79-841f-9ed81e034024", "testId": "IAC-12_A01", "test": "mechanisms for authentication to a cryptographic module are implemented that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards and guidelines for such authentication.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-07", "defaultText": null } ], "externalMappings": [ { "id": 578281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7f8b55f-d6cb-5465-ab5b-c5f735fbaed6", "parentControlId": 31500, "controlId": "T1195.003", "title": "T1195.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586031" }, { "id": 578282, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66964c83-1130-5fe2-b9e6-da4d568b33f3", "parentControlId": 31500, "controlId": "T1495", "title": "T1495", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586031" }, { "id": 578283, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00c4c7bb-5f87-5098-8753-d33d903654e0", "parentControlId": 31500, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586031" }, { "id": 578284, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00c0331a-9faa-5949-aa4b-b4089ff27c2a", "parentControlId": 31500, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586031" }, { "id": 578285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d86c4d36-adec-52c5-a066-b219b382e160", "parentControlId": 31500, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586031" }, { "id": 578286, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7740b770-7e7c-524a-ae0e-49ec6ef3dc37", "parentControlId": 31500, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586031" }, { "id": 578287, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebe2f103-c70b-5655-9549-50edc11827a8", "parentControlId": 31500, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586031" }, { "id": 578288, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a3e66a7-b53f-5f69-83da-4330f793d12a", "parentControlId": 31500, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586031" }, { "id": 578289, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e196228-4358-5f79-9b7a-0dae783ad135", "parentControlId": 31500, "controlId": "T1553.006", "title": "T1553.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586032" }, { "id": 578290, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0718fc86-0f7e-5591-bffb-3fc73511f892", "parentControlId": 31500, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586032" }, { "id": 578291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab2d05c7-6266-576a-b959-66a7cb8dc9c9", "parentControlId": 31500, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586032" }, { "id": 578292, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c76fb42-f4f3-5c11-ac59-b8fdc52cdc79", "parentControlId": 31500, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586032" }, { "id": 578293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e57e5c3-5770-5b57-a202-c1db4ff147f5", "parentControlId": 31500, "controlId": "IA-7", "title": "IA-7", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586032" }, { "id": 578294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a35c2bd-ae6a-5d18-a4e6-aa526b420d87", "parentControlId": 31500, "controlId": "IA-07", "title": "IA-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586032" }, { "id": 578296, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba5b7333-5d02-5256-9c28-d75712b432fb", "parentControlId": 31500, "controlId": "IA-07", "title": "IA-07", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586032" }, { "id": 578297, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1fcc7f2-18ba-5dd0-a19a-81aa57fb3d65", "parentControlId": 31500, "controlId": "IA-07", "title": "IA-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586033" }, { "id": 578298, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586033", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6b3d566-a627-5381-a907-8544df12ba2f", "parentControlId": 31500, "controlId": "IA-07", "title": "IA-07", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586033" }, { "id": 578299, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586033", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "419bb60c-4e9a-5700-afcd-2644e8c6c0ba", "parentControlId": 31500, "controlId": "IA-07", "title": "IA-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586033" }, { "id": 578300, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586033", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28f3701f-c6a6-533e-9c92-d036209ccd7c", "parentControlId": 31500, "controlId": "IA-07", "title": "IA-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586033" }, { "controlId": "B.4.9", "title": "B.4.9 — Cryptographic Module Authentication", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IA-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "df2850ff-3650-5967-88b8-c78f2339697e", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.9", "title": "NEI 08-09 App D.4.9 — Cryptographic Module Authentication", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.9", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "56d2c139-a306-5848-ab96-e942d6e6bdfe", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.4.9", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "a9a39c73-efd6-5ba3-a3c4-ce4d9dd84085", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "dabb1dfd-b953-5ce4-924e-45f836c75da1", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "62582b60-5e33-547b-a5fa-1d4acb65deb1", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "1da69b03-2a4d-5b0f-9685-91ddf0f618c9", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "c8e85693-094e-5372-80f3-8152ca11837c", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "3cce13ce-0c89-520c-9a86-bd7dd14ef678", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "064598ad-17fc-5efc-9ef9-d3dd13dc9c8a", "isPublic": true } ], "id": 31500, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731107", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731107", "catalogueId": 1062, "uuid": "f676a2b4-8f31-51cb-8bf2-aa3d823204ef", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure cryptographic modules adhere to applicable statutory, regulatory and contractual requirements for security strength?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 8.0, "title": "Cryptographic Module Authentication", "description": "

Control Description

Mechanisms exist to ensure cryptographic modules adhere to applicable statutory, regulatory and contractual requirements for security strength.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure cryptographic modules adhere to applicable statutory, regulatory and contractual requirements for security strength.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.4.9", "controlId": "IAC-12", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-12", "references": "

Micro-Small Business (<10 staff)

∙ Use strong encryption for authentication systems (HTTPS/TLS)

Small Business (10-49 staff)

∙ Cryptographic module standards for authentication systems

Medium Business (50-249 staff)

∙ Formal cryptographic authentication policy\n∙ FIPS 140-2 validated modules where required

Large Business (250-999 staff)

∙ FIPS 140-2 validated cryptographic modules for authentication

Enterprise (>1,000 staff)

∙ FIPS 140-2/140-3 validated cryptographic modules (e.g., HSM, FIPS-compliant libraries)\n∙ Enterprise crypto standards", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71815, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590614", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590614", "securityControlId": 31501, "ccis": [], "uuid": "b42fbbdc-f50a-5e50-9cca-07f75a6734d4", "testId": "IAC-12.1_A01", "test": "Hardware Security Modules (HSM) protect authenticators on which the component relies.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 578317, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4dbb120e-4af1-5732-92ed-6c7af52b2a8d", "parentControlId": 31501, "controlId": "SR 1.5 RE 1", "title": "SR 1.5 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586035" }, { "id": 578318, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "534fbfb2-0edf-5ab0-9bbb-d1c706a12a70", "parentControlId": 31501, "controlId": "SR 1.9 RE 1", "title": "SR 1.9 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586035" }, { "id": 578319, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0e0f92f-a716-5881-960f-7285859697cc", "parentControlId": 31501, "controlId": "CR 1.5(1)", "title": "CR 1.5(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586035" }, { "id": 578320, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0906ae59-d7b2-5798-9277-2a7052179e86", "parentControlId": 31501, "controlId": "CR 1.9(1)", "title": "CR 1.9(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586035" }, { "id": 578321, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7f26ed2-d4ca-52de-b92c-abb367719781", "parentControlId": 31501, "controlId": "CR 1.14(1)", "title": "CR 1.14(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586036" } ], "id": 31501, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731107", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731107", "catalogueId": 1062, "uuid": "8a48f075-5e94-5f2b-912a-39c3e7396e3e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to utilize Hardware Security Modules (HSM) to protect authenticators on which the component relies?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 3.0, "title": "Hardware Security Modules (HSM)", "description": "

Control Description

Automated mechanisms exist to utilize Hardware Security Modules (HSM) to protect authenticators on which the component relies.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically utilize Hardware Security Modules (HSM) to protect authenticators on which the component relies.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-12.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-12.1", "references": "

Medium Business (50-249 staff)

∙ HSM for key protection in high-security authentication systems

Large Business (250-999 staff)

∙ HSM deployment for authentication key protection (e.g., Thales Luna, AWS CloudHSM)

Enterprise (>1,000 staff)

∙ Enterprise HSM platform (e.g., Thales Luna, nCipher, AWS CloudHSM)\n∙ PKI integration\n∙ Centralized key management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71816, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590614", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590614", "securityControlId": 31502, "ccis": [], "uuid": "1df7d0e3-4c47-599c-bfdd-260ab029b5ac", "testId": "IAC-13_A01", "test": "supplemental authentication techniques or mechanisms to be employed when accessing the system under specific circumstances or situations are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-10_ODP[01]", "defaultText": null }, { "id": 71817, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590614", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590614", "securityControlId": 31502, "ccis": [], "uuid": "f50a6ed5-b575-5ca6-80e5-995232f0d8fc", "testId": "IAC-13_A02", "test": "circumstances or situations that require individuals accessing the system to employ supplemental authentication techniques or mechanisms are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-10_ODP[02]", "defaultText": null }, { "id": 71818, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590615", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590615", "securityControlId": 31502, "ccis": [], "uuid": "4ac16dc1-1dba-5c05-a10d-fa62cc6ca7de", "testId": "IAC-13_A03", "test": "individuals accessing the system are required to employ supplemental authentication techniques or mechanisms under specific circumstances or situations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-10", "defaultText": null } ], "externalMappings": [ { "id": 578327, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ced46396-2cb9-5639-a4c4-bb52f2d222d6", "parentControlId": 31502, "controlId": "IA-10", "title": "IA-10", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586036" }, { "id": 578328, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f9d5313-7aa3-5b02-9d18-dff19f1f4ede", "parentControlId": 31502, "controlId": "IA-10", "title": "IA-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586036" }, { "id": 578329, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "277c4b36-7e1e-55b2-9ea3-02fcf3bc6dc9", "parentControlId": 31502, "controlId": "IA-10", "title": "IA-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586036" }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "3796e3d8-497a-541a-98c4-306c86fe631f", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "6cca6024-0d27-5ab4-aa14-3105287ab689", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "d9fb8392-d8b1-5b74-91a3-dac044b66f8e", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "8c79a557-0416-5314-8336-774e366e38d1", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "0181a94b-fb47-5e9d-aa63-cf8df9334b5c", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "f37e40f1-1d19-5085-bcdb-de0ac889461e", "isPublic": true } ], "id": 31502, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731108", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731108", "catalogueId": 1062, "uuid": "80374d43-dd49-5ab1-b8cb-bbfea4da940b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization allow individuals to utilize alternative methods of authentication under specific circumstances or situations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Adaptive Identification & Authentication", "description": "

Control Description

Mechanisms exist to allow individuals to utilize alternative methods of authentication under specific circumstances or situations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to allow individuals to utilize alternative methods of authentication under specific circumstances or situations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-13", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-13", "references": "

Micro-Small Business (<10 staff)

∙ Enable risk-based authentication, if supported

Small Business (10-49 staff)

∙ Risk-based/adaptive MFA policy\n∙ Step-up authentication for high-risk actions

Medium Business (50-249 staff)

∙ Adaptive authentication implementation\n∙ Risk scoring for authentication decisions

Large Business (250-999 staff)

∙ Enterprise adaptive IAM platform (e.g., Okta Adaptive MFA, Microsoft Entra)\n∙ Risk-based conditional access

Enterprise (>1,000 staff)

∙ Enterprise adaptive identity platform (e.g., Okta, Microsoft Entra ID)\n∙ Continuous risk assessment\n∙ Machine learning-based risk scoring\n∙ Zero-trust access policies", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71819, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590615", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590615", "securityControlId": 31503, "ccis": [], "uuid": "72bad0ec-2295-5ef4-a022-12320c7c3b09", "testId": "IAC-13.1_A01", "test": "system accounts and services for which a single sign-on capability must be provided are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-02(10)_ODP", "defaultText": null }, { "id": 71820, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590615", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590615", "securityControlId": 31503, "ccis": [], "uuid": "c964ec11-e7b7-537b-887a-735ba42d589e", "testId": "IAC-13.1_A02", "test": "a single sign-on capability is provided for organization-defined system accounts and services.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-02(10)", "defaultText": null } ], "externalMappings": [ { "id": 578336, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5f34bf2-c3a6-517c-8caf-adebc8423be5", "parentControlId": 31503, "controlId": "IA-02(10)", "title": "IA-02(10)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586037" }, { "id": 578337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61118a8e-d548-5eee-8a1b-11157726f5b3", "parentControlId": 31503, "controlId": "IA-02(10)", "title": "IA-02(10)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586037" } ], "id": 31503, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731108", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731108", "catalogueId": 1062, "uuid": "9175bb40-41b5-54c1-ba43-2cd4ee3e040d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide a Single Sign-On (SSO) capability to its Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Single Sign-On (SSO) Transparent Authentication", "description": "

Control Description

Mechanisms exist to provide a transparent authentication (e.g., Single Sign-On (SSO)) capability to the organization's Technology Assets, Applications and/or Services (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide a transparent authentication (e.g., Single Sign-On (SSO)) capability to the organization's Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-13.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-13.1", "references": "

Micro-Small Business (<10 staff)

∙ Use SSO to simplify access to multiple systems

Small Business (10-49 staff)

∙ SSO solution for key applications (e.g., Google SSO, Microsoft SSO)

Medium Business (50-249 staff)

∙ Enterprise SSO implementation (e.g., Okta, Azure AD)\n∙ Transparent authentication

Large Business (250-999 staff)

∙ Enterprise SSO platform (e.g., Okta, Microsoft Entra)\n∙ SAML/OIDC federation\n∙ Transparent auth for all apps

Enterprise (>1,000 staff)

∙ Enterprise SSO platform (e.g., Okta, Microsoft Entra ID)\n∙ Universal SSO for all applications\n∙ Federated identity management\n∙ Zero-trust continuous authentication", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71821, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590615", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590615", "securityControlId": 31504, "ccis": [], "uuid": "75e3bf40-eff5-545a-9777-5a16b522f90a", "testId": "IAC-13.2_A01", "test": "external organizations to be used for federating credentials are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(09)_ODP", "defaultText": null }, { "id": 71822, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590615", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590615", "securityControlId": 31504, "ccis": [], "uuid": "3c080a51-a262-5a0f-a843-301b2d27f6d8", "testId": "IAC-13.2_A02", "test": "external organizations are used to federate credentials.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(09)", "defaultText": null } ], "externalMappings": [ { "id": 578341, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586038", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89443031-baa1-54f5-83bf-a01a380dbca5", "parentControlId": 31504, "controlId": "IA-05(09)", "title": "IA-05(09)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586038" }, { "id": 578342, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586038", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27896db7-fa99-587e-aa70-216e07dbfe24", "parentControlId": 31504, "controlId": "IA-05(09)", "title": "IA-05(09)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586038" }, { "id": 578343, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586038", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8af7292e-0f03-5a3b-84a9-2936c24a848b", "parentControlId": 31504, "controlId": "IA-5(9)", "title": "IA-5(9)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586038" } ], "id": 31504, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731108", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731108", "catalogueId": 1062, "uuid": "659836b6-42d4-578e-b103-ce4320850829", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization federate credentials to allow cross-organization authentication of individuals and devices?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Federated Credential Management", "description": "

Control Description

Mechanisms exist to federate credentials to allow cross-organization authentication of individuals and devices.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to federate credentials to allow cross-organization authentication of individuals and devices.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-13.2", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-13.2", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71824, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590616", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590616", "securityControlId": 31506, "ccis": [], "uuid": "8156fe6a-4659-5023-a4f7-7245b12dda20", "testId": "IAC-14_A01", "test": "circumstances or situations that require re-authentication are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-11_ODP\n171A_R3_A.03.05.01.ODP[01]", "defaultText": null }, { "id": 71825, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590616", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590616", "securityControlId": 31506, "ccis": [], "uuid": "e01aab49-e5f9-5db9-a2bc-2cbf4ac7204e", "testId": "IAC-14_A02", "test": "users are reauthenticated per organization-defined circumstances or situations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-11", "defaultText": null }, { "id": 71826, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590616", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590616", "securityControlId": 31506, "ccis": [], "uuid": "48f916e1-6162-5caf-8934-5144f8338b69", "testId": "IAC-14_A03", "test": "users are reauthenticated when .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: roles, authenticators, or credentials change (including modification of user privilege); when security categories of systems change; when the execution of privileged functions occurs; and after a session termination", "otherId": "171A_R3_A.03.05.01.b", "defaultText": null } ], "externalMappings": [ { "id": 578355, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fad6bf68-d4de-5a61-acf3-9b90e7287fd3", "parentControlId": 31506, "controlId": "T1110", "title": "T1110", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586039" }, { "id": 578356, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3166891-b6ce-5be2-9c29-8c1056978a96", "parentControlId": 31506, "controlId": "T1110.001", "title": "T1110.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58604" }, { "id": 578357, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42bde204-da5b-57a5-a15f-37d0284bf41c", "parentControlId": 31506, "controlId": "T1110.002", "title": "T1110.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58604" }, { "id": 578358, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0730e0b-3c27-599b-9eec-8ade32be5535", "parentControlId": 31506, "controlId": "T1110.003", "title": "T1110.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58604" }, { "id": 578359, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "411eff12-7d06-51de-bd3f-499e32718f22", "parentControlId": 31506, "controlId": "T1110.004", "title": "T1110.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58604" }, { "id": 578360, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "405fa6f1-3560-5f3f-8bfc-f51ded7b8717", "parentControlId": 31506, "controlId": "T1556.006", "title": "T1556.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58604" }, { "id": 578361, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "382670dc-d833-562e-b62c-ec552774c2ef", "parentControlId": 31506, "controlId": "T1556.007", "title": "T1556.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58604" }, { "id": 578362, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8516e3d-4ddc-5128-a2a2-983b17835e9c", "parentControlId": 31506, "controlId": "IA-11", "title": "IA-11", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58604" }, { "id": 578363, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75693277-bd5d-5864-bc8a-63c34b0250ae", "parentControlId": 31506, "controlId": "IA-11", "title": "IA-11", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58604" }, { "id": 578364, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58604", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd9e83c0-0a9b-5db7-bf42-42cd38124966", "parentControlId": 31506, "controlId": "IA-11", "title": "IA-11", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58604" }, { "id": 578365, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba6740b5-3d04-584f-bd76-fa3455545afe", "parentControlId": 31506, "controlId": "IA-11", "title": "IA-11", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586041" }, { "id": 578366, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbd45bc9-3b1b-567b-ae20-d3af4431b6ff", "parentControlId": 31506, "controlId": "IA-11", "title": "IA-11", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586041" }, { "id": 578367, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d018f8f5-95bd-5797-9379-9dbb57f2f904", "parentControlId": 31506, "controlId": "IA-11", "title": "IA-11", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586041" }, { "id": 578368, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33341fc9-c343-5937-96ae-9f75e5841787", "parentControlId": 31506, "controlId": "IA-11", "title": "IA-11", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586041" }, { "id": 578369, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "200794f9-19f7-5d86-a1d7-348f2dc0811d", "parentControlId": 31506, "controlId": "03.05.01.b", "title": "03.05.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586041" }, { "controlId": "B.1.12", "title": "B.1.12 — Permitted Actions without Identification or Authentication", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-14", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "78bb264a-d2c9-5291-8142-8c020a17fc7c", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.12", "title": "NEI 08-09 App D.1.12 — Permitted Actions without Identification or Authentication", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.12", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d2a7e480-999a-5d9c-bbe2-d2f25342c56d", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.12", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "f6479552-7cc1-5ede-be72-872e3bbbab94", "isPublic": true }, { "controlId": "B.4.4", "title": "B.4.4 — Non-Authenticated Human Machine Interaction Security", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-14, IA-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "3b532938-ba74-5ab5-8de6-b147a42903ae", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.4", "title": "NEI 08-09 App D.4.4 — Non-Authenticated Human Machine Interaction Security", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "5587e39b-626b-5ee2-b136-bbe4f786ad78", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7afe2648-e616-59a9-9dfa-fbc04033da66", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "79814468-2cee-57b0-9695-30e7ae474f8f", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "c2bef22f-9338-5192-9814-2ec3f0caaa91", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "e71eefff-a568-5214-9c48-6002179560eb", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "570efde0-1b43-5804-b37d-ab0ff66ebd4c", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "2a8eccf1-0471-5c51-93ec-20110ca69096", "isPublic": true } ], "id": 31506, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731109", "catalogueId": 1062, "uuid": "de03b2b1-b842-5d29-84f7-f3c3108118d9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization force users and devices to re-authenticate according to organization-defined circumstances that necessitate re-authentication?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Re-Authentication", "description": "

Control Description

Mechanisms exist to force users and devices to re-authenticate according to organization-defined circumstances that necessitate re-authentication.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to force users and devices to re-authenticate according to organization-defined circumstances that necessitate re-authentication.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.12, B.4.4", "controlId": "IAC-14", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-14", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Identity & Access Management (IAM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71827, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590617", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590617", "securityControlId": 31507, "ccis": [], "uuid": "ce221207-89d3-5000-9c58-e8bfe6366ec3", "testId": "IAC-15_A01", "test": "criteria for account creation, enabling, modification, disabling and removal are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-02_ODP[04]", "defaultText": null }, { "id": 71828, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590617", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590617", "securityControlId": 31507, "ccis": [], "uuid": "d2436d44-06f4-5e30-b832-de85004ea900", "testId": "IAC-15_A02", "test": "approvals are required by organization-defined personnel or roles for requests to create accounts.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-02e.", "defaultText": null }, { "id": 71829, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590617", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590617", "securityControlId": 31507, "ccis": [], "uuid": "b9eb2814-59b7-5870-a571-07bfa9e1405d", "testId": "IAC-15_A03", "test": "accounts are created in accordance with organization-defined policy, procedures, prerequisites and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-02f.[01]", "defaultText": null }, { "id": 71830, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590617", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590617", "securityControlId": 31507, "ccis": [], "uuid": "dae28879-67b8-5d1c-b867-ad8cc029fb8a", "testId": "IAC-15_A04", "test": "accounts are enabled in accordance with organization-defined policy, procedures, prerequisites and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-02f.[02]", "defaultText": null }, { "id": 71831, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590617", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590617", "securityControlId": 31507, "ccis": [], "uuid": "169cd148-53d0-5e93-b523-ace5fe11cce5", "testId": "IAC-15_A05", "test": "accounts are modified in accordance with organization-defined policy, procedures, prerequisites and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-02f.[03]", "defaultText": null }, { "id": 71832, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590617", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590617", "securityControlId": 31507, "ccis": [], "uuid": "b4e1aeb7-1420-5077-a620-d31ffe97115b", "testId": "IAC-15_A06", "test": "accounts are disabled in accordance with organization-defined policy, procedures, prerequisites and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-02f.[04]", "defaultText": null }, { "id": 71833, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590618", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590618", "securityControlId": 31507, "ccis": [], "uuid": "5fdcf9dd-947e-5e40-8d96-64ade3c0cae9", "testId": "IAC-15_A07", "test": "accounts are removed in accordance with organization-defined policy, procedures, prerequisites and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-02f.[05]", "defaultText": null }, { "id": 71834, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590618", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590618", "securityControlId": 31507, "ccis": [], "uuid": "9a5a0c50-b866-5e28-9edb-af9dd9811036", "testId": "IAC-15_A08", "test": "the use of accounts is monitored.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-02g.", "defaultText": null }, { "id": 71835, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590618", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590618", "securityControlId": 31507, "ccis": [], "uuid": "63fe8f21-2ac8-50ed-985a-ca4a5f4557f5", "testId": "IAC-15_A09", "test": "accounts are reviewed for compliance with account management requirements organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: quarterly for privileged access, annually for non-privileged access", "otherId": "53A_R5_AC-02j.", "defaultText": null }, { "id": 71836, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590618", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590618", "securityControlId": 31507, "ccis": [], "uuid": "0807dd61-2646-5cf5-9812-0d1dc8dc7bba", "testId": "IAC-15_A10", "test": "account management processes are aligned with personnel termination processes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-02l.[01]", "defaultText": null }, { "id": 71837, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590618", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590619", "securityControlId": 31507, "ccis": [], "uuid": "63b6325c-c973-5932-8fb6-c4acb79b6640", "testId": "IAC-15_A11", "test": "account management processes are aligned with personnel transfer processes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-02l.[02]", "defaultText": null }, { "id": 71838, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590619", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590619", "securityControlId": 31507, "ccis": [], "uuid": "d984489f-46ce-52b6-8ff0-36ad728a5b50", "testId": "IAC-15_A12", "test": "account managers and organization-defined personnel or roles are notified within an organization-defined time period when accounts are no longer required.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: twenty-four (24) hours when accounts are no longer required", "otherId": "53A_R5_AC-02h.01", "defaultText": null }, { "id": 71839, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590619", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590619", "securityControlId": 31507, "ccis": [], "uuid": "472fb7ac-a459-5983-b772-803a87fb614e", "testId": "IAC-15_A13", "test": "account managers and organization-defined personnel or roles are notified within an organization-defined time period when users are terminated or transferred.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: eight (8) hours when users are terminated or transferred", "otherId": "53A_R5_AC-02h.02", "defaultText": null }, { "id": 71840, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590619", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590619", "securityControlId": 31507, "ccis": [], "uuid": "3480ceca-ca28-5c6c-b0b4-440933710771", "testId": "IAC-15_A14", "test": "account managers and organization-defined personnel or roles are notified within an organization-defined time period when system usage or the need to know changes for an individual.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: eight (8) hours when system usage or need-to-know changes for an individual", "otherId": "53A_R5_AC-02h.03", "defaultText": null }, { "id": 71841, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590619", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590619", "securityControlId": 31507, "ccis": [], "uuid": "05de41d2-6894-54a7-86be-f58a8914a84d", "testId": "IAC-15_A15", "test": "access to the system is authorized based on a valid access authorization.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_AC-02i.01", "defaultText": null }, { "id": 71842, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590619", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59062", "securityControlId": 31507, "ccis": [], "uuid": "e680f943-8e51-51e6-bb16-bccfd6ea42be", "testId": "IAC-15_A16", "test": "access to the system is authorized based on intended system usage.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_AC-02i.02", "defaultText": null }, { "id": 71843, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59062", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59062", "securityControlId": 31507, "ccis": [], "uuid": "e738fcf3-c40c-56a4-83ba-bd12078574b3", "testId": "IAC-15_A17", "test": "access to the system is authorized based on organization-defined attributes (as required).
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_AC-02i.03", "defaultText": null }, { "id": 71844, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59062", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59062", "securityControlId": 31507, "ccis": [], "uuid": "095343e3-0509-5957-acb5-9352fe6e9c6d", "testId": "IAC-15_A18", "test": "the use of system accounts is monitored.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.e", "defaultText": null }, { "id": 71845, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59062", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59062", "securityControlId": 31507, "ccis": [], "uuid": "cf8bc6d2-f742-56a8-bb08-ec6bd71da301", "testId": "IAC-15_A19", "test": "system accounts are disabled when the accounts have expired.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.f.01", "defaultText": null }, { "id": 71846, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59062", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59062", "securityControlId": 31507, "ccis": [], "uuid": "a447dcdf-d561-543d-9223-70c9b4b8e437", "testId": "IAC-15_A20", "test": "system accounts are disabled when the accounts have been inactive for .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at most 90 days", "otherId": "171A_R3_A.03.01.01.f.02", "defaultText": null }, { "id": 71847, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59062", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59062", "securityControlId": 31507, "ccis": [], "uuid": "95aae51d-a458-5ece-9814-7d3ac98ed3d4", "testId": "IAC-15_A21", "test": "system accounts are disabled when the accounts are no longer associated with a user or individual.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.f.03", "defaultText": null }, { "id": 71848, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59062", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59062", "securityControlId": 31507, "ccis": [], "uuid": "23d5441f-2597-56d3-914b-e91c6fc15046", "testId": "IAC-15_A22", "test": "system accounts are disabled when the accounts violate organizational policy.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.f.04", "defaultText": null }, { "id": 71849, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59062", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59062", "securityControlId": 31507, "ccis": [], "uuid": "389fc0a3-cc45-55af-adab-0a38f85282fc", "testId": "IAC-15_A23", "test": "system accounts are disabled when significant risks associated with individuals are discovered.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.f.05", "defaultText": null }, { "id": 71850, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59062", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59062", "securityControlId": 31507, "ccis": [], "uuid": "60078d6b-b277-563d-93f3-482e2dc26ec6", "testId": "IAC-15_A24", "test": "account types specifically prohibited for use within the system are defined and documented.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_AC-02a.[02]", "defaultText": null }, { "id": 71851, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590621", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590621", "securityControlId": 31507, "ccis": [], "uuid": "517645de-a02e-5f5c-88ba-f52ddeac0cb6", "testId": "IAC-15_A25", "test": "the types of transactions and functions that authorized users are permitted to execute are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.2[a]", "defaultText": null }, { "id": 71852, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590621", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590621", "securityControlId": 31507, "ccis": [], "uuid": "2d79b45d-ef1d-58b7-b93b-61f9c4d9dc6f", "testId": "IAC-15_A26", "test": "personnel or roles required to approve requests to create accounts is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02_ODP[03]", "defaultText": null }, { "id": 71853, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590621", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590621", "securityControlId": 31507, "ccis": [], "uuid": "42bf203f-4bc5-59da-b63c-157ef633c388", "testId": "IAC-15_A27", "test": "criteria for account creation, enabling, modification, disabling and removal are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02_ODP[04]", "defaultText": null }, { "id": 71854, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590621", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590621", "securityControlId": 31507, "ccis": [], "uuid": "33e59c17-ece3-54b7-bde8-d7021b8bf28a", "testId": "IAC-15_A28", "test": "account types allowed for use within the system are defined and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02a.[01]", "defaultText": null }, { "id": 71855, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590621", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590621", "securityControlId": 31507, "ccis": [], "uuid": "91ee0cb0-d519-595d-91b7-662b3d8f35d9", "testId": "IAC-15_A29", "test": "account managers are assigned.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_AC-02b.", "defaultText": null }, { "id": 71856, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590621", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590621", "securityControlId": 31507, "ccis": [], "uuid": "5cb01676-e154-5641-b48b-75fe6240fcaa", "testId": "IAC-15_A30", "test": "system access is limited to the defined types of transactions and functions for authorized users.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.2[b]", "defaultText": null }, { "id": 71857, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590622", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590622", "securityControlId": 31507, "ccis": [], "uuid": "13ae2b1e-09e5-51cf-aa04-9ec0425fd432", "testId": "IAC-15_A31", "test": "prerequisites and criteria for group and role membership are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02_ODP[01]", "defaultText": null }, { "id": 71858, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590622", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590622", "securityControlId": 31507, "ccis": [], "uuid": "675795fb-3ebb-5c95-9441-7b4222b09009", "testId": "IAC-15_A32", "test": "attributes (as required) for each account are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02_ODP[02]", "defaultText": null }, { "id": 71859, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590622", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590622", "securityControlId": 31507, "ccis": [], "uuid": "baa6edbc-0db9-5f0a-a9ec-e00f57af278f", "testId": "IAC-15_A33", "test": "personnel or roles required to approve requests to create accounts is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02_ODP[03]", "defaultText": null }, { "id": 71860, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590622", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590622", "securityControlId": 31507, "ccis": [], "uuid": "0d748529-c076-58fa-b22b-558b9c630216", "testId": "IAC-15_A34", "test": "personnel or roles to be notified is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02_ODP[05]", "defaultText": null }, { "id": 71861, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590622", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590622", "securityControlId": 31507, "ccis": [], "uuid": "fd250615-8af8-5565-8ed6-490636ec9c31", "testId": "IAC-15_A35", "test": "time period within which to notify account managers when accounts are no longer required is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02_ODP[06]", "defaultText": null }, { "id": 71862, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590623", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590623", "securityControlId": 31507, "ccis": [], "uuid": "738e5841-3ba0-5b01-86d1-b6c0b8555a66", "testId": "IAC-15_A36", "test": "time period within which to notify account managers when users are terminated or transferred is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02_ODP[07]", "defaultText": null }, { "id": 71863, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590623", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590623", "securityControlId": 31507, "ccis": [], "uuid": "40887148-7d96-5188-aea4-d6bbcf3dbbd3", "testId": "IAC-15_A37", "test": "time period within which to notify account managers when system usage or the need to know changes for an individual is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02_ODP[08]", "defaultText": null }, { "id": 71864, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590623", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590623", "securityControlId": 31507, "ccis": [], "uuid": "71de4f36-c3af-5430-b50e-ce4f2d79cd0e", "testId": "IAC-15_A38", "test": "attributes needed to authorize system access (as required) are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02_ODP[09]", "defaultText": null }, { "id": 71865, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590623", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590623", "securityControlId": 31507, "ccis": [], "uuid": "cbe3dc7e-9f0a-521d-8765-0ac2433eb32b", "testId": "IAC-15_A39", "test": "the frequency of account review is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: quarterly for privileged access, annually for non-privileged access", "otherId": "53A_R5_AC-02_ODP[10]", "defaultText": null }, { "id": 71866, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590623", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590623", "securityControlId": 31507, "ccis": [], "uuid": "2df5d82d-1965-5fe6-ae41-ada139697b8e", "testId": "IAC-15_A40", "test": "organization-defined prerequisites and criteria for group and role membership are required.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02c.", "defaultText": null }, { "id": 71867, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590624", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590624", "securityControlId": 31507, "ccis": [], "uuid": "9f58d81a-4d39-5c94-af1d-4437aa19704c", "testId": "IAC-15_A41", "test": "authorized users of the system are specified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_AC-02d.01\n171A_R3_A.03.01.01.c.01", "defaultText": null }, { "id": 71868, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590624", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590624", "securityControlId": 31507, "ccis": [], "uuid": "d3b5292b-1003-56d9-a2ce-db49808aad8c", "testId": "IAC-15_A42", "test": "group and role membership are specified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02d.02", "defaultText": null }, { "id": 71869, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590624", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590624", "securityControlId": 31507, "ccis": [], "uuid": "95b4f406-9c31-51d4-90e9-ac2540c80c45", "testId": "IAC-15_A43", "test": "access authorizations (e.g., privileges) are specified for each account.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02d.03[01]", "defaultText": null }, { "id": 71870, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590624", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590624", "securityControlId": 31507, "ccis": [], "uuid": "df110b3e-1708-5b38-8eef-04652d938536", "testId": "IAC-15_A44", "test": "organization-defined attributes (as required) are specified for each account.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-02d.03[02]", "defaultText": null }, { "id": 71871, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590624", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590624", "securityControlId": 31507, "ccis": [], "uuid": "90a3f7a9-4b85-5e85-95a0-33b9007f43ae", "testId": "IAC-15_A45", "test": "a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02k.[01]", "defaultText": null }, { "id": 71872, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590624", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590624", "securityControlId": 31507, "ccis": [], "uuid": "14108d43-4acf-53b3-ab09-574c77375254", "testId": "IAC-15_A46", "test": "a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-02k.[02]", "defaultText": null }, { "id": 71873, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590624", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590624", "securityControlId": 31507, "ccis": [], "uuid": "fc1d069c-9d46-5ded-bd2c-b124f77a7d3c", "testId": "IAC-15_A47", "test": "the time period for account inactivity before disabling is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.ODP[01]", "defaultText": null }, { "id": 71874, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590624", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590624", "securityControlId": 31507, "ccis": [], "uuid": "787087fd-3e88-5eff-bf27-7910e3764752", "testId": "IAC-15_A48", "test": "system account types allowed are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.a[01]", "defaultText": null }, { "id": 71875, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590625", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590625", "securityControlId": 31507, "ccis": [], "uuid": "e4f2261a-c6b4-5f2c-a99a-f85f8b09110d", "testId": "IAC-15_A49", "test": "system account types prohibited are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.a[02]", "defaultText": null }, { "id": 71876, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590625", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590625", "securityControlId": 31507, "ccis": [], "uuid": "bc22acf8-c516-5cf4-a54f-3d82325b7d5f", "testId": "IAC-15_A50", "test": "account managers and designated personnel or roles are notified within when accounts are no longer required.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: 24 hours", "otherId": "171A_R3_A.03.01.01.g.01", "defaultText": null }, { "id": 71877, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590625", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590625", "securityControlId": 31507, "ccis": [], "uuid": "39a11503-9bb7-565b-a8d6-cac7089d7a15", "testId": "IAC-15_A51", "test": "account managers and designated personnel or roles are notified within when users are terminated or transferred.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: 24 hours", "otherId": "171A_R3_A.03.01.01.g.02", "defaultText": null }, { "id": 71878, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590625", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590625", "securityControlId": 31507, "ccis": [], "uuid": "84689d71-983d-5779-95db-d0fd4c0e073c", "testId": "IAC-15_A52", "test": "account managers and designated personnel or roles are notified within when system usage or the need-to-know changes for an individual.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: 24 hours", "otherId": "171A_R3_A.03.01.01.g.03", "defaultText": null }, { "id": 71879, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590626", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590626", "securityControlId": 31507, "ccis": [], "uuid": "1a38286e-cfd3-566d-b138-83e1c26bfea7", "testId": "IAC-15_A53", "test": "a new password is selected upon first use after account recovery.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.05.07.e", "defaultText": null } ], "externalMappings": [ { "id": 578396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80e2727c-d751-560b-a551-2a23ee86d23d", "parentControlId": 31507, "controlId": "USER 1.2", "title": "USER 1.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586044" }, { "id": 578397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a5c7760-3f94-50e0-ae64-9e77ef72bb82", "parentControlId": 31507, "controlId": "USER 1.3", "title": "USER 1.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586044" }, { "id": 578398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "750a5846-2af2-597c-8d7e-117457185c2e", "parentControlId": 31507, "controlId": "SR 1.3", "title": "SR 1.3", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586044" }, { "id": 578400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "034bd4be-7104-57f6-82e8-4ca6b9e9b541", "parentControlId": 31507, "controlId": "5.15", "title": "5.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586045" }, { "id": 578401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb52e6b0-4a44-50f4-95b2-ff4481fcec64", "parentControlId": 31507, "controlId": "5.16", "title": "5.16", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586045" }, { "id": 578402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4b048f1-5a68-523b-adc8-791f14b5f1f0", "parentControlId": 31507, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586045" }, { "id": 578409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e1966de-1885-525d-9317-49aff0da6c37", "parentControlId": 31507, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586046" }, { "id": 578410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56870dd0-6023-50ce-9b6d-afda8f212862", "parentControlId": 31507, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586046" }, { "id": 578411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b47d2572-efd1-51ad-a75e-fef03f63568a", "parentControlId": 31507, "controlId": "T1003.002", "title": "T1003.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586046" }, { "id": 578412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4e5b3d0-9318-504d-8671-981aeee79f7a", "parentControlId": 31507, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586046" }, { "id": 578413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cffb518f-0e5f-5e3c-9a52-5daf06ffaf5a", "parentControlId": 31507, "controlId": "T1003.004", "title": "T1003.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586046" }, { "id": 578414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9264986d-a9da-5a31-a506-ecefdf538704", "parentControlId": 31507, "controlId": "T1003.005", "title": "T1003.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586046" }, { "id": 578415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "effd7980-6efa-5035-a996-d8d61fb8021c", "parentControlId": 31507, "controlId": "T1003.006", "title": "T1003.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586046" }, { "id": 578416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9abc16f-78c3-5a6b-bd86-9ce7f8c1ed92", "parentControlId": 31507, "controlId": "T1003.007", "title": "T1003.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586047" }, { "id": 578417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ff31ae9-e3cc-5522-b666-f8bb7b026b66", "parentControlId": 31507, "controlId": "T1003.008", "title": "T1003.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586047" }, { "id": 578418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb020843-4dfc-587f-9a0a-f5b2fb688ef8", "parentControlId": 31507, "controlId": "T1005", "title": "T1005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586047" }, { "id": 578419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c513079e-c26d-5d7c-87c3-63fc0370c9c6", "parentControlId": 31507, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586047" }, { "id": 578420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94894d2d-e955-50cf-a45a-411c241f0c3c", "parentControlId": 31507, "controlId": "T1021", "title": "T1021", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586047" }, { "id": 578421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89d078b5-e2e5-5af1-946e-0346a9a93a44", "parentControlId": 31507, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586047" }, { "id": 578422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7bd44470-1d3f-5683-9cad-a88a330b6592", "parentControlId": 31507, "controlId": "T1021.002", "title": "T1021.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586047" }, { "id": 578423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c63c1d20-6930-5d65-b5ea-f13035c3ce3c", "parentControlId": 31507, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586047" }, { "id": 578424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5551c943-950e-5ad1-a4a0-b3fb185eb670", "parentControlId": 31507, "controlId": "T1021.004", "title": "T1021.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586048" }, { "id": 578425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9213c48c-c141-553e-bcf0-b38c969e6974", "parentControlId": 31507, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586048" }, { "id": 578426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c3837bf-0312-5603-bc1c-0e19257110a4", "parentControlId": 31507, "controlId": "T1021.006", "title": "T1021.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586048" }, { "id": 578427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f5a84e4-ba6d-549e-982a-f3ae73bd2f62", "parentControlId": 31507, "controlId": "T1021.007", "title": "T1021.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586048" }, { "id": 578428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7168d4b-9ea5-54ae-b297-37a66e260fce", "parentControlId": 31507, "controlId": "T1021.008", "title": "T1021.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586048" }, { "id": 578429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37805e7c-49cd-5806-9206-498ae163be8c", "parentControlId": 31507, "controlId": "T1025", "title": "T1025", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586048" }, { "id": 578430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8ea861d-6d9e-541c-8861-69502be38bf2", "parentControlId": 31507, "controlId": "T1036", "title": "T1036", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586048" }, { "id": 578431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdeea25f-ed43-5d50-87df-d91dd7b457a9", "parentControlId": 31507, "controlId": "T1036.003", "title": "T1036.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586048" }, { "id": 578432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff25f6b6-ee95-5a5a-a24e-1459b3a2f592", "parentControlId": 31507, "controlId": "T1036.005", "title": "T1036.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586048" }, { "id": 578433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3737d13e-b68b-5478-bc26-aa5400c83a1d", "parentControlId": 31507, "controlId": "T1036.010", "title": "T1036.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586048" }, { "id": 578434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4764e4ca-6a35-546d-b1bf-448d6dd563a7", "parentControlId": 31507, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586049" }, { "id": 578435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e5095be-efde-5bcd-9f9c-32d29a38ff22", "parentControlId": 31507, "controlId": "T1047", "title": "T1047", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586049" }, { "id": 578436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21e044fe-6f47-54cc-b3df-7ed362c97357", "parentControlId": 31507, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586049" }, { "id": 578437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3064595-05a9-5c2d-b13c-660061846d4c", "parentControlId": 31507, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586049" }, { "id": 578438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2738f561-d3c8-5ff6-aaf8-b191915cd32f", "parentControlId": 31507, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586049" }, { "id": 578439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce260c0e-0b11-5ae3-b236-5cde9be4fce6", "parentControlId": 31507, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586049" }, { "id": 578440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78b9badc-eb7f-523b-b204-753b31b1a1f9", "parentControlId": 31507, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586049" }, { "id": 578441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586049", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69323feb-6df7-5f91-835c-20a969d798a0", "parentControlId": 31507, "controlId": "T1053", "title": "T1053", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586049" }, { "id": 578442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49a6cb74-6d18-538f-8ed3-681fbdcf658a", "parentControlId": 31507, "controlId": "T1053.002", "title": "T1053.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58605" }, { "id": 578443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3d58126-58ef-5c09-803d-faf8083e1c8e", "parentControlId": 31507, "controlId": "T1053.003", "title": "T1053.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58605" }, { "id": 578444, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c799eda7-14e4-52bf-9961-3ca8012abd08", "parentControlId": 31507, "controlId": "T1053.005", "title": "T1053.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58605" }, { "id": 578445, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad8eaa18-dcdc-5c9c-a0d0-073b15d0a8aa", "parentControlId": 31507, "controlId": "T1053.006", "title": "T1053.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58605" }, { "id": 578446, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a109d78-37bc-5684-8c33-38e08096c678", "parentControlId": 31507, "controlId": "T1053.007", "title": "T1053.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58605" }, { "id": 578447, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83f7427a-ec69-536f-9fea-855a36d2e098", "parentControlId": 31507, "controlId": "T1055", "title": "T1055", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58605" }, { "id": 578448, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c5339f8-4d08-57a7-8acd-15ce3ff1607a", "parentControlId": 31507, "controlId": "T1055.008", "title": "T1055.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58605" }, { "id": 578449, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55e278ee-34f2-5c3f-b4ba-db993a97eec7", "parentControlId": 31507, "controlId": "T1056.003", "title": "T1056.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58605" }, { "id": 578450, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e15b574-4c96-5fca-bb19-4b27b219f737", "parentControlId": 31507, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58605" }, { "id": 578451, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54da90e2-7457-593d-82b4-2b0d4e8a63e0", "parentControlId": 31507, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586051" }, { "id": 578452, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be0d5573-5d9b-5311-9fbb-8a8170a2a925", "parentControlId": 31507, "controlId": "T1059.002", "title": "T1059.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586051" }, { "id": 578453, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01559574-ab9b-51d0-b041-d0bc8e63f7f4", "parentControlId": 31507, "controlId": "T1059.003", "title": "T1059.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586051" }, { "id": 578454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a9f34a0-60da-5194-b35a-c2f4ebfd8ed0", "parentControlId": 31507, "controlId": "T1059.004", "title": "T1059.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586051" }, { "id": 578455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d734e1f9-1f39-5bbf-9510-d29daaa4e72b", "parentControlId": 31507, "controlId": "T1059.005", "title": "T1059.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586051" }, { "id": 578456, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a453f0c-6269-5177-a4fd-941409fb3e18", "parentControlId": 31507, "controlId": "T1059.006", "title": "T1059.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586051" }, { "id": 578457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1588f04-d601-5eb9-b586-193532310e16", "parentControlId": 31507, "controlId": "T1059.007", "title": "T1059.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586051" }, { "id": 578458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1fac028-3a14-521c-8011-924bdb382490", "parentControlId": 31507, "controlId": "T1059.008", "title": "T1059.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586051" }, { "id": 578459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "255510be-58b7-553e-8336-40c93cc347ea", "parentControlId": 31507, "controlId": "T1059.009", "title": "T1059.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586051" }, { "id": 578460, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586051", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87e9237e-fe91-5fca-83d6-84149ef92b60", "parentControlId": 31507, "controlId": "T1059.010", "title": "T1059.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586051" }, { "id": 578461, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c478814-3ced-55b0-9557-2bf38ad4dd4c", "parentControlId": 31507, "controlId": "T1059.011", "title": "T1059.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586052" }, { "id": 578462, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99dae62b-db80-5c3b-8116-bf1a6568bd2e", "parentControlId": 31507, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586052" }, { "id": 578463, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5090c372-7109-59c3-8422-c9c48d33b0a6", "parentControlId": 31507, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586052" }, { "id": 578464, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2aa72bc-4933-5592-99ea-a6e2025b468d", "parentControlId": 31507, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586052" }, { "id": 578465, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "827bf127-12ad-5c62-9308-928010533ba9", "parentControlId": 31507, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586052" }, { "id": 578466, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b90c19a9-3dc9-54e0-bb9a-8a64bd832668", "parentControlId": 31507, "controlId": "T1070.003", "title": "T1070.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586052" }, { "id": 578467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a19fa2a-102f-51ec-a263-632a49cb19fb", "parentControlId": 31507, "controlId": "T1070.007", "title": "T1070.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586052" }, { "id": 578468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f586b6cf-b17a-5194-8269-b4728323d080", "parentControlId": 31507, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586052" }, { "id": 578469, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bead43a5-9d4d-5df9-8eec-d68545e2c248", "parentControlId": 31507, "controlId": "T1070.009", "title": "T1070.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586053" }, { "id": 578470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f508d57-da80-5257-897f-436231f26022", "parentControlId": 31507, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586053" }, { "id": 578471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bce79130-c5c8-5ec0-be91-88d97bf65d2e", "parentControlId": 31507, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586053" }, { "id": 578472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27ed1e61-a505-5b3d-a561-93bf0288b71f", "parentControlId": 31507, "controlId": "T1078.001", "title": "T1078.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586053" }, { "id": 578473, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b0c5f47-ee71-5fd4-b93a-f808c786cc19", "parentControlId": 31507, "controlId": "T1078.002", "title": "T1078.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586053" }, { "id": 578474, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "867f5c31-d9bd-524d-9e6d-a0e1a779b063", "parentControlId": 31507, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586053" }, { "id": 578475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "356b7671-9feb-51ee-9e6e-4c131bf0ff96", "parentControlId": 31507, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586053" }, { "id": 578476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe1b5aa5-e98b-5ded-b360-05f2f4819a49", "parentControlId": 31507, "controlId": "T1087", "title": "T1087", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586053" }, { "id": 578477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df722270-74d2-5462-b1cf-052b27780ca0", "parentControlId": 31507, "controlId": "T1087.004", "title": "T1087.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586053" }, { "id": 578478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba2b7b67-e0cb-5ed5-9ae7-1df4745517ca", "parentControlId": 31507, "controlId": "T1098", "title": "T1098", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586054" }, { "id": 578479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5d82a4e-043e-5743-be24-df12053c094e", "parentControlId": 31507, "controlId": "T1098.001", "title": "T1098.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586054" }, { "id": 578480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b57f928-ca1e-5b48-b65f-ba1f7828c3a2", "parentControlId": 31507, "controlId": "T1098.002", "title": "T1098.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586054" }, { "id": 578481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3cbf774-ad0e-570b-8124-e818f660a19b", "parentControlId": 31507, "controlId": "T1098.003", "title": "T1098.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586054" }, { "id": 578482, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1e1b61a-9a38-5d2d-b6ea-75263bd0f8dc", "parentControlId": 31507, "controlId": "T1098.005", "title": "T1098.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586054" }, { "id": 578483, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eefba465-86d4-58a0-92d5-a5b48842ef40", "parentControlId": 31507, "controlId": "T1098.006", "title": "T1098.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586054" }, { "id": 578484, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db0ed7eb-2214-55a9-888a-f567455997a5", "parentControlId": 31507, "controlId": "T1098.007", "title": "T1098.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586054" }, { "id": 578485, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51696661-2596-5d52-a6b8-68f01915548a", "parentControlId": 31507, "controlId": "T1110", "title": "T1110", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586054" }, { "id": 578486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95547e39-fae0-5dc9-b312-f27f7994f260", "parentControlId": 31507, "controlId": "T1110.001", "title": "T1110.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586054" }, { "id": 578487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41f5bf03-283b-56a5-aa0e-e3ff0940033b", "parentControlId": 31507, "controlId": "T1110.002", "title": "T1110.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586055" }, { "id": 578488, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e422ae1-bfc9-5ce4-b852-8a06756035bc", "parentControlId": 31507, "controlId": "T1110.003", "title": "T1110.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586055" }, { "id": 578489, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72993876-561b-555c-a43e-799be6914ac1", "parentControlId": 31507, "controlId": "T1110.004", "title": "T1110.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586055" }, { "id": 578490, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "684787fe-2f68-5420-a553-94531aa036c3", "parentControlId": 31507, "controlId": "T1134", "title": "T1134", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586055" }, { "id": 578491, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac5fb31d-3bac-5900-b31d-70c69d835446", "parentControlId": 31507, "controlId": "T1134.001", "title": "T1134.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586055" }, { "id": 578492, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8987b7b4-950e-5cc5-8ea1-4320a17015f4", "parentControlId": 31507, "controlId": "T1134.002", "title": "T1134.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586055" }, { "id": 578493, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09967dab-7a98-5736-a837-ac90647dc496", "parentControlId": 31507, "controlId": "T1134.003", "title": "T1134.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586055" }, { "id": 578494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa87aa17-d565-54ae-a241-375029631dcd", "parentControlId": 31507, "controlId": "T1136", "title": "T1136", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586055" }, { "id": 578495, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "542ae90f-9321-5378-bbdb-3f004271c038", "parentControlId": 31507, "controlId": "T1136.001", "title": "T1136.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586056" }, { "id": 578496, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f315653-fccf-57bb-8bfc-44f67f238391", "parentControlId": 31507, "controlId": "T1136.002", "title": "T1136.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586056" }, { "id": 578497, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8aa88c63-be8e-5e76-944c-8c2a0be00693", "parentControlId": 31507, "controlId": "T1136.003", "title": "T1136.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586056" }, { "id": 578498, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6034a13-6c75-5ee7-a058-5fa6c5c809c2", "parentControlId": 31507, "controlId": "T1185", "title": "T1185", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586056" }, { "id": 578499, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a99aee4-5c7b-5691-aa2e-a13e2c3a1953", "parentControlId": 31507, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586056" }, { "id": 578500, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfb9d29d-bd83-5fc3-b420-867a7ae98fb9", "parentControlId": 31507, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586056" }, { "id": 578501, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89de75ca-8195-5a70-9271-07b0b1044b4b", "parentControlId": 31507, "controlId": "T1197", "title": "T1197", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586056" }, { "id": 578502, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f184f0f8-c02c-5a65-b053-6b149a6efbea", "parentControlId": 31507, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586056" }, { "id": 578503, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab446de2-d031-5f59-afe4-b997db0e18bc", "parentControlId": 31507, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586056" }, { "id": 578504, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aeb1dae4-b9de-5bd0-b1bf-d55fede8b4f0", "parentControlId": 31507, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586056" }, { "id": 578505, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3042a4c8-de2a-5252-8750-4d028d877c22", "parentControlId": 31507, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586057" }, { "id": 578506, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67c9d836-a7bc-5de2-b751-a3a4d8c42694", "parentControlId": 31507, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586057" }, { "id": 578507, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e29c8d6-65b1-5dd0-8e98-66be2950fd0e", "parentControlId": 31507, "controlId": "T1213.003", "title": "T1213.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586057" }, { "id": 578508, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e01c7bc-fcfb-566b-9f8f-0bee95091fd0", "parentControlId": 31507, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586057" }, { "id": 578509, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3884677c-f978-5b79-837b-6aa8dd2d19bc", "parentControlId": 31507, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586057" }, { "id": 578510, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e517a772-3779-596f-a3b2-e66d7462e12c", "parentControlId": 31507, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586057" }, { "id": 578511, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e82c9f7-adf3-581b-9aad-6ff69cdbbaae", "parentControlId": 31507, "controlId": "T1218.007", "title": "T1218.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586057" }, { "id": 578512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7fcf8ad-6ed7-55ed-bb0f-c38d7e61515d", "parentControlId": 31507, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586057" }, { "id": 578513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fe259dc-5014-5d90-ad0b-42928077068c", "parentControlId": 31507, "controlId": "T1222", "title": "T1222", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586057" }, { "id": 578514, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a3a3eed-89bb-52ff-b1fb-77525e5b7954", "parentControlId": 31507, "controlId": "T1222.001", "title": "T1222.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586058" }, { "id": 578515, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0cffb914-a278-57fb-84bd-d80ee4b1a456", "parentControlId": 31507, "controlId": "T1222.002", "title": "T1222.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586058" }, { "id": 578516, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd766053-d657-5415-b106-343330c2ecd8", "parentControlId": 31507, "controlId": "T1484", "title": "T1484", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586058" }, { "id": 578517, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e351f2d2-e6b8-58ec-94ba-212a22780055", "parentControlId": 31507, "controlId": "T1485.001", "title": "T1485.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586058" }, { "id": 578518, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a05ad0ab-8ab4-501c-afb6-24e760353173", "parentControlId": 31507, "controlId": "T1489", "title": "T1489", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586058" }, { "id": 578519, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f485341-d352-5af9-8a49-a94b73b92f93", "parentControlId": 31507, "controlId": "T1490", "title": "T1490", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586058" }, { "id": 578520, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31d5e2cc-f532-5461-866c-d13cf7d4eb51", "parentControlId": 31507, "controlId": "T1495", "title": "T1495", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586058" }, { "id": 578521, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f2d2d00-8d4e-51ed-bf0d-894916cdd362", "parentControlId": 31507, "controlId": "T1496.002", "title": "T1496.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586058" }, { "id": 578522, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a61da8a-cf52-5c02-b907-be8b8fe0d1bd", "parentControlId": 31507, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586059" }, { "id": 578523, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f88b79c3-785b-55a9-af9b-a9e0f711700b", "parentControlId": 31507, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586059" }, { "id": 578524, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09091b53-fd87-5ffd-ba3c-f63582d559a0", "parentControlId": 31507, "controlId": "T1505.003", "title": "T1505.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586059" }, { "id": 578525, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c21dd3e-1a44-5a16-b82a-16daf748f5af", "parentControlId": 31507, "controlId": "T1505.005", "title": "T1505.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586059" }, { "id": 578526, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d8cab46-e3fe-5ba3-89d1-5c663686b6c0", "parentControlId": 31507, "controlId": "T1525", "title": "T1525", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586059" }, { "id": 578527, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be3dc439-7a42-5954-96eb-a9f930e6e236", "parentControlId": 31507, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586059" }, { "id": 578528, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f76facf-bd95-5e22-b467-0ff0ddf1ee35", "parentControlId": 31507, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586059" }, { "id": 578529, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b76340e-3013-506d-a206-71c33dbd8e0c", "parentControlId": 31507, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586059" }, { "id": 578530, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff6e8c2e-b133-5afb-b16e-dd5c30696bda", "parentControlId": 31507, "controlId": "T1538", "title": "T1538", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586059" }, { "id": 578531, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3511622f-3bf6-5da3-85b2-411510830d0a", "parentControlId": 31507, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58606" }, { "id": 578532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58e2f72f-9d5b-5268-b940-f789f4dfc020", "parentControlId": 31507, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58606" }, { "id": 578533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "610bd43b-fc99-53fc-a24b-8e2c94dc1322", "parentControlId": 31507, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58606" }, { "id": 578534, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97d90581-d07e-5b1a-885d-dc7e2c9ff9d9", "parentControlId": 31507, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58606" }, { "id": 578535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46c0180a-1078-5df3-96a9-5bbe1f7be485", "parentControlId": 31507, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58606" }, { "id": 578536, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9245a0c9-91a7-53ad-a84a-69833ec20fab", "parentControlId": 31507, "controlId": "T1543.001", "title": "T1543.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58606" }, { "id": 578537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cb80ad1-3754-53bf-9dee-df5fb94b03ca", "parentControlId": 31507, "controlId": "T1543.002", "title": "T1543.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58606" }, { "id": 578538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c915b0e-e2d9-5040-adba-bd2f7ca481c5", "parentControlId": 31507, "controlId": "T1543.003", "title": "T1543.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58606" }, { "id": 578539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "066bb4d2-d9ec-557e-a887-99fb970201de", "parentControlId": 31507, "controlId": "T1543.004", "title": "T1543.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58606" }, { "id": 578540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b6ba281-7b1c-54f2-aa0d-20b61d2ea5a3", "parentControlId": 31507, "controlId": "T1543.005", "title": "T1543.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58606" }, { "id": 578541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0dcdbf85-b127-5f2a-a5ab-e4e313dd6e9c", "parentControlId": 31507, "controlId": "T1546", "title": "T1546", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586061" }, { "id": 578542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2783278-9422-565e-b216-f20394c5c9fd", "parentControlId": 31507, "controlId": "T1546.003", "title": "T1546.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586061" }, { "id": 578543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "367d8baf-d29c-5815-95b0-e763b0334063", "parentControlId": 31507, "controlId": "T1547.004", "title": "T1547.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586061" }, { "id": 578544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1662fc89-4208-5b84-841b-f2b0e586cc02", "parentControlId": 31507, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586061" }, { "id": 578545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d61d34b9-bb87-55a8-977b-e80773f2cd51", "parentControlId": 31507, "controlId": "T1547.009", "title": "T1547.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586061" }, { "id": 578546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "990d5c52-f819-5a96-9e18-7625a692fa73", "parentControlId": 31507, "controlId": "T1547.012", "title": "T1547.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586061" }, { "id": 578547, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c7dc390-8297-53b4-ab5e-cad68f0a8e6a", "parentControlId": 31507, "controlId": "T1547.013", "title": "T1547.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586061" }, { "id": 578548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "644026a6-95d1-52a9-896a-35098ed3ae2e", "parentControlId": 31507, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586061" }, { "id": 578549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40fa0522-48c7-55c3-826a-745414732846", "parentControlId": 31507, "controlId": "T1548.002", "title": "T1548.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586062" }, { "id": 578550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f91dfea-4074-50e3-9d0c-2d636aeea4af", "parentControlId": 31507, "controlId": "T1548.003", "title": "T1548.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586062" }, { "id": 578551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f796e4a8-ba49-509d-a2f0-f6c7d1f24cd2", "parentControlId": 31507, "controlId": "T1548.005", "title": "T1548.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586062" }, { "id": 578552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9605a322-cc3c-54b2-aa50-bc690114a131", "parentControlId": 31507, "controlId": "T1548.006", "title": "T1548.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586062" }, { "id": 578553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8878643e-30f1-5917-9303-d4268e376cdc", "parentControlId": 31507, "controlId": "T1550", "title": "T1550", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586062" }, { "id": 578554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ca1b638-1532-5737-8eba-8b8c03c0bea6", "parentControlId": 31507, "controlId": "T1550.002", "title": "T1550.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586062" }, { "id": 578555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "992da67b-30e4-5a2b-b042-b6a4e177c21d", "parentControlId": 31507, "controlId": "T1550.003", "title": "T1550.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586062" }, { "id": 578556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93609305-c9c2-5942-8344-f869ed2937d4", "parentControlId": 31507, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586062" }, { "id": 578557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10b38477-7379-592d-992f-9e8c0808d4fb", "parentControlId": 31507, "controlId": "T1552.001", "title": "T1552.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586062" }, { "id": 578558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86c8748c-ae82-5b18-83a9-01b8c69b64af", "parentControlId": 31507, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586063" }, { "id": 578559, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de39faf4-d050-5455-9fb8-ddf804781432", "parentControlId": 31507, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586063" }, { "id": 578560, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5e539a7-c1e4-5e71-9d11-ad0116006f47", "parentControlId": 31507, "controlId": "T1552.006", "title": "T1552.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586063" }, { "id": 578561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "849afc53-ab61-50c6-aadd-00b20beab906", "parentControlId": 31507, "controlId": "T1552.007", "title": "T1552.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586063" }, { "id": 578562, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7eb15e40-7f02-528d-8a87-3824d8f7faa3", "parentControlId": 31507, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586063" }, { "id": 578563, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c39c49d-2c42-5af5-9f22-ddb9296d0dbc", "parentControlId": 31507, "controlId": "T1555.005", "title": "T1555.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586063" }, { "id": 578564, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e696533-fc3a-5f77-921c-d4145d6229b6", "parentControlId": 31507, "controlId": "T1555.006", "title": "T1555.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586063" }, { "id": 578565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "badb5aff-18f1-586e-8aa8-cda92da6add5", "parentControlId": 31507, "controlId": "T1556", "title": "T1556", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586063" }, { "id": 578566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586063", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34803798-f097-53ba-be99-b872953e8ed3", "parentControlId": 31507, "controlId": "T1556.001", "title": "T1556.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586063" }, { "id": 578567, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e871d5c7-cfa0-5498-ba54-f598ffcfd575", "parentControlId": 31507, "controlId": "T1556.003", "title": "T1556.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586064" }, { "id": 578568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70b52da5-c8ba-591a-9761-b160b94deabe", "parentControlId": 31507, "controlId": "T1556.004", "title": "T1556.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586064" }, { "id": 578569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a83b0340-afe5-5210-97e2-f412187b853e", "parentControlId": 31507, "controlId": "T1556.005", "title": "T1556.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586064" }, { "id": 578570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c20c92e5-115c-5694-ae2a-2ea7f32b6f16", "parentControlId": 31507, "controlId": "T1556.006", "title": "T1556.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586064" }, { "id": 578571, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec14c009-44c6-546d-bdb0-a04a6eef3d8e", "parentControlId": 31507, "controlId": "T1556.007", "title": "T1556.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586064" }, { "id": 578572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fae080fb-ed3a-5d6d-8048-5dc1d84b8399", "parentControlId": 31507, "controlId": "T1556.009", "title": "T1556.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586064" }, { "id": 578573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73837b38-da28-5ce7-aae6-6596ea01a1a5", "parentControlId": 31507, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586064" }, { "id": 578574, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b984b468-65a7-5da5-93c1-e6f8509e7b2a", "parentControlId": 31507, "controlId": "T1558.001", "title": "T1558.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586064" }, { "id": 578575, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1236a495-bd03-5ca7-bc7b-5df5e3d49d10", "parentControlId": 31507, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586064" }, { "id": 578576, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f9cd0a5-aa95-5eb9-a5f1-1dfe91abc26d", "parentControlId": 31507, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586065" }, { "id": 578577, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99605046-6dc2-5acc-abd0-de5a06ab4531", "parentControlId": 31507, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586065" }, { "id": 578578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acf5b5b3-198b-5bda-b4b9-f9bde142e02a", "parentControlId": 31507, "controlId": "T1558.005", "title": "T1558.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586065" }, { "id": 578579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7cbe5c2e-5e68-519c-a09b-009e200c9c78", "parentControlId": 31507, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586065" }, { "id": 578580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a00b996-626f-58fa-9d41-60da1181b985", "parentControlId": 31507, "controlId": "T1559.001", "title": "T1559.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586065" }, { "id": 578581, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f774da1-a256-5e05-8a3f-0cb552fdc7f8", "parentControlId": 31507, "controlId": "T1562", "title": "T1562", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586065" }, { "id": 578582, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d8d886e-857f-59c4-8695-bd500814e412", "parentControlId": 31507, "controlId": "T1562.001", "title": "T1562.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586065" }, { "id": 578583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ff21860-1318-5c7b-93f8-197e3afa5424", "parentControlId": 31507, "controlId": "T1562.002", "title": "T1562.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586065" }, { "id": 578584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a13942c-6f06-5dd7-bc6c-d7e7fc42876c", "parentControlId": 31507, "controlId": "T1562.004", "title": "T1562.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586065" }, { "id": 578585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9bb792a-1577-585a-97a3-e87ed8e90184", "parentControlId": 31507, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586066" }, { "id": 578586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17c269f3-1658-5b11-9f88-6642a561cf1b", "parentControlId": 31507, "controlId": "T1562.007", "title": "T1562.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586066" }, { "id": 578587, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1301fafe-dae7-535b-9a56-b05f149ba665", "parentControlId": 31507, "controlId": "T1562.008", "title": "T1562.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586066" }, { "id": 578588, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da21b34e-03f2-5ea8-9285-18c3acc68e3c", "parentControlId": 31507, "controlId": "T1562.009", "title": "T1562.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586066" }, { "id": 578589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c85e14de-2ea6-598b-85a4-a53326f2a5f0", "parentControlId": 31507, "controlId": "T1562.012", "title": "T1562.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586066" }, { "id": 578590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31ce00c9-37de-5fe3-b5d8-641ef914b87f", "parentControlId": 31507, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586066" }, { "id": 578591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2c85c4c-00fb-510c-b289-b8ba062320ad", "parentControlId": 31507, "controlId": "T1563.001", "title": "T1563.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586075" }, { "id": 578592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7cebe07-8bfb-5eef-b71b-4dca79cae90f", "parentControlId": 31507, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586075" }, { "id": 578593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6df9664-0e01-54ea-8a10-c885684de795", "parentControlId": 31507, "controlId": "T1566.003", "title": "T1566.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586075" }, { "id": 578594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9cceb1ad-4d39-5dc6-b59a-37d5590f3e0b", "parentControlId": 31507, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586075" }, { "id": 578595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ded7da8a-5030-567d-a5ba-0412cb664988", "parentControlId": 31507, "controlId": "T1569", "title": "T1569", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586075" }, { "id": 578596, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e4cab25-2eed-5773-9faa-4b0db23a3855", "parentControlId": 31507, "controlId": "T1569.001", "title": "T1569.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586075" }, { "id": 578597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8b36042-409a-554c-902b-1dd1cba0b371", "parentControlId": 31507, "controlId": "T1569.002", "title": "T1569.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586075" }, { "id": 578598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61536f53-9c36-569d-8bd4-313ede9032a0", "parentControlId": 31507, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586075" }, { "id": 578599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7389dfa3-0097-5ac6-8855-4b2e91e252ba", "parentControlId": 31507, "controlId": "T1574.004", "title": "T1574.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586076" }, { "id": 578600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7326310e-6849-5642-bfb6-2e95565fd008", "parentControlId": 31507, "controlId": "T1574.005", "title": "T1574.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586076" }, { "id": 578601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20977c5d-9319-5ae2-93ea-62faa1c8e213", "parentControlId": 31507, "controlId": "T1574.007", "title": "T1574.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586076" }, { "id": 578602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb93e685-16ed-511e-8117-79bcd1a356f9", "parentControlId": 31507, "controlId": "T1574.008", "title": "T1574.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586076" }, { "id": 578603, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c09c673e-e2eb-5c73-bb62-9ff73e51386d", "parentControlId": 31507, "controlId": "T1574.009", "title": "T1574.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586076" }, { "id": 578604, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7578b3be-792e-5410-8494-5329ef2f04a6", "parentControlId": 31507, "controlId": "T1574.010", "title": "T1574.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586076" }, { "id": 578605, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69662b36-c6cc-5d89-8bbb-d0a3d8a10963", "parentControlId": 31507, "controlId": "T1574.012", "title": "T1574.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586076" }, { "id": 578606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4fe6d73-2fed-53f6-8e81-580b2ee6254c", "parentControlId": 31507, "controlId": "T1578", "title": "T1578", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586076" }, { "id": 578607, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bf42e60-a6dc-52c2-bff8-e4133046c79d", "parentControlId": 31507, "controlId": "T1578.001", "title": "T1578.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586076" }, { "id": 578608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7dd44a5a-bb35-5c8b-bab3-122cb286815c", "parentControlId": 31507, "controlId": "T1578.002", "title": "T1578.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586076" }, { "id": 578609, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586077", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "698a82e2-0139-571c-bbb0-be293fbd6d9c", "parentControlId": 31507, "controlId": "T1578.003", "title": "T1578.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586077" }, { "id": 578610, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586077", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68345ce0-3a21-5ef1-a829-b5b94df78f60", "parentControlId": 31507, "controlId": "T1578.005", "title": "T1578.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586077" }, { "id": 578611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586077", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ef7127e-e4d8-55a1-bc16-cb14d3f29db0", "parentControlId": 31507, "controlId": "T1580", "title": "T1580", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586077" }, { "id": 578612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586077", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "043c15f1-2b16-5f22-ba2a-77d623e9dc06", "parentControlId": 31507, "controlId": "T1585", "title": "T1585", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586077" }, { "id": 578613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586077", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c02767c-e601-5dd7-976c-251507a0c544", "parentControlId": 31507, "controlId": "T1585.001", "title": "T1585.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586077" }, { "id": 578614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586077", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd948900-8ed4-5b1c-921b-aab5fdcb31e2", "parentControlId": 31507, "controlId": "T1585.002", "title": "T1585.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586077" }, { "id": 578615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586077", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c104e51-ac55-5400-8019-b58507777151", "parentControlId": 31507, "controlId": "T1585.003", "title": "T1585.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586077" }, { "id": 578616, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586078", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2d24dd5-2924-5513-9588-20857fb8476f", "parentControlId": 31507, "controlId": "T1586", "title": "T1586", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586078" }, { "id": 578617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586078", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e605169-2a37-56f9-984c-b4e17644afcf", "parentControlId": 31507, "controlId": "T1586.001", "title": "T1586.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586078" }, { "id": 578618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586078", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "197ffd90-2773-5495-9f42-b83a3e28d152", "parentControlId": 31507, "controlId": "T1586.002", "title": "T1586.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586078" }, { "id": 578619, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586078", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "739ea286-f907-56d8-a337-73635a907ac1", "parentControlId": 31507, "controlId": "T1586.003", "title": "T1586.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586078" }, { "id": 578620, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586078", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95f96b0b-d111-50c5-8a56-171b616e9587", "parentControlId": 31507, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586078" }, { "id": 578621, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586078", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6cd0cf2-b1e2-52e1-97dc-4721144b5eb5", "parentControlId": 31507, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586078" }, { "id": 578622, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586078", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60bf1f57-74f9-59ad-a4bc-701490181eed", "parentControlId": 31507, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586078" }, { "id": 578623, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586078", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78fef634-547c-5ea8-a73d-3a9eb6a76905", "parentControlId": 31507, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586079" }, { "id": 578624, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be8b7fd2-ad42-5fa4-9753-69a80d46c5b1", "parentControlId": 31507, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586079" }, { "id": 578625, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f719a8d-4639-5a44-80ee-2b65c1f17389", "parentControlId": 31507, "controlId": "T1606", "title": "T1606", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586079" }, { "id": 578626, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d95ed3e6-ab5a-5e14-9bec-3db6d911e8ff", "parentControlId": 31507, "controlId": "T1606.001", "title": "T1606.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586079" }, { "id": 578627, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00111173-6678-5489-af83-974453feb92f", "parentControlId": 31507, "controlId": "T1606.002", "title": "T1606.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586079" }, { "id": 578628, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dab4b873-d06b-5154-be0c-fe0f2a903289", "parentControlId": 31507, "controlId": "T1609", "title": "T1609", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586079" }, { "id": 578629, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c31f355a-ae80-5708-a62f-843287511399", "parentControlId": 31507, "controlId": "T1610", "title": "T1610", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586079" }, { "id": 578630, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "317a96b8-b292-5a08-a264-4c0f20fe4580", "parentControlId": 31507, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586079" }, { "id": 578631, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c15f95f-9fd4-5ab1-b1f3-8aabfa727461", "parentControlId": 31507, "controlId": "T1612", "title": "T1612", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586079" }, { "id": 578632, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2ab5384-a120-5b8f-a7f4-1c220178989c", "parentControlId": 31507, "controlId": "T1613", "title": "T1613", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586079" }, { "id": 578633, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "641df74f-8105-5481-9c92-ddde81af472f", "parentControlId": 31507, "controlId": "T1619", "title": "T1619", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58608" }, { "id": 578634, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "342aa048-a0ab-5979-b67b-7a9519c0be78", "parentControlId": 31507, "controlId": "T1621", "title": "T1621", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58608" }, { "id": 578635, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aff4db5e-cca3-50c0-8e13-4ec383b8d62f", "parentControlId": 31507, "controlId": "T1648", "title": "T1648", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58608" }, { "id": 578636, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51d13a9e-314e-5264-8ee0-661a8e7d90bc", "parentControlId": 31507, "controlId": "T1651", "title": "T1651", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58608" }, { "id": 578637, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6903a6a0-931f-5598-83af-de59082ea485", "parentControlId": 31507, "controlId": "T1654", "title": "T1654", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58608" }, { "id": 578638, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5fa0f20-03a5-5506-b3c9-3cba628553a6", "parentControlId": 31507, "controlId": "AC-2", "title": "AC-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58608" }, { "id": 578639, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "633f1b53-6491-576b-8b33-8962a3970a55", "parentControlId": 31507, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58608" }, { "id": 578641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586081", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8dd85ba-d4a3-5de5-9b57-f935c2d95c1e", "parentControlId": 31507, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586081" }, { "id": 578643, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586081", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea313db2-b830-59de-bb22-e8e86ea6b964", "parentControlId": 31507, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586081" }, { "id": 578644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586081", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f3ae1a5-b47c-53fd-860e-60f557a3e5a1", "parentControlId": 31507, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586081" }, { "id": 578645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586081", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3180bdf-30a8-555c-905e-31556263b641", "parentControlId": 31507, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586081" }, { "id": 578646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586081", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "691c6029-984a-536c-85c5-9c4934191f1c", "parentControlId": 31507, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586081" }, { "id": 578647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586081", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0fa868e9-86c9-5bd9-b0ad-279f08686841", "parentControlId": 31507, "controlId": "AC-2", "title": "AC-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586081" }, { "id": 578648, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0a5dcb3-05cd-5209-9f57-47c2895891d7", "parentControlId": 31507, "controlId": "AC-2", "title": "AC-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586082" }, { "id": 578649, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d51b8f9-a287-5868-b1fa-ebe887ed9271", "parentControlId": 31507, "controlId": "AC-2", "title": "AC-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586082" }, { "id": 578652, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b10f3663-3474-5fb1-aacc-a289ef7e9071", "parentControlId": 31507, "controlId": "3.1.2", "title": "3.1.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586082" }, { "id": 578653, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "846e2d9f-7355-57af-ac06-3abb91594987", "parentControlId": 31507, "controlId": "03.01.01.a", "title": "03.01.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586082" }, { "id": 578654, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3cb0be6-ae28-53ba-b6b7-02c82ccdac29", "parentControlId": 31507, "controlId": "03.01.01.b", "title": "03.01.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586082" }, { "id": 578655, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae6010f2-9267-52ca-a566-aa6c339569ef", "parentControlId": 31507, "controlId": "03.01.01.c.01", "title": "03.01.01.c.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586082" }, { "id": 578656, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc005698-98d4-5149-9ccf-93f19334ef8c", "parentControlId": 31507, "controlId": "03.01.01.c.02", "title": "03.01.01.c.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586082" }, { "id": 578657, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "367001b6-e307-59cd-9ce3-9eeab28cd50f", "parentControlId": 31507, "controlId": "03.01.01.d.01", "title": "03.01.01.d.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586083" }, { "id": 578658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de3590eb-f773-5ce3-9500-cbb8082df158", "parentControlId": 31507, "controlId": "03.01.01.d.02", "title": "03.01.01.d.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586083" }, { "id": 578659, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6808d67-ec63-57e1-88ea-b5476ad53747", "parentControlId": 31507, "controlId": "03.01.01.e", "title": "03.01.01.e", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586083" }, { "id": 578660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "beac38aa-4511-5d3d-93f4-d1c28f7d5fbb", "parentControlId": 31507, "controlId": "03.01.01.f.01", "title": "03.01.01.f.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586083" }, { "id": 578661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "815da3f5-33b1-5c29-80b8-a53fdb81529e", "parentControlId": 31507, "controlId": "03.01.01.f.03", "title": "03.01.01.f.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586083" }, { "id": 578662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47e606a6-7b6d-5ef1-b8d8-ce1b5be756e8", "parentControlId": 31507, "controlId": "03.01.01.f.04", "title": "03.01.01.f.04", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586083" }, { "id": 578663, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab1e4837-eeff-59b7-bf36-5d274d01b4db", "parentControlId": 31507, "controlId": "03.01.01.f.05", "title": "03.01.01.f.05", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586083" }, { "id": 578664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7818c503-05b0-57e8-afb0-c95142d6fb49", "parentControlId": 31507, "controlId": "03.01.01.g.01", "title": "03.01.01.g.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586083" }, { "id": 578665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08cd47d7-d0b5-5a73-957e-234f78b7df37", "parentControlId": 31507, "controlId": "03.01.01.g.02", "title": "03.01.01.g.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586083" }, { "id": 578666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "393ad59a-b175-5e84-a245-b75e8c3c4359", "parentControlId": 31507, "controlId": "03.01.01.g.03", "title": "03.01.01.g.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586084" }, { "id": 578667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8de07a04-3ca3-5b8f-a0fe-53bdee6df406", "parentControlId": 31507, "controlId": "03.01.02", "title": "03.01.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586084" }, { "id": 578668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32ab53fe-1afd-55ea-94b0-98bd8a03a071", "parentControlId": 31507, "controlId": "03.01.05.b", "title": "03.01.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586084" }, { "id": 578669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e72b402f-5844-54c5-a9ab-98df0c62dec5", "parentControlId": 31507, "controlId": "03.01.05.c", "title": "03.01.05.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586084" }, { "id": 578670, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d2d60cb-0b76-584a-80df-e80becaed7e1", "parentControlId": 31507, "controlId": "03.01.05.d", "title": "03.01.05.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586084" }, { "id": 578702, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12bbb75b-a622-5ddf-b1ab-748ac015b091", "parentControlId": 31507, "controlId": "ACCESS-2b", "title": "ACCESS-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586088" }, { "id": 578735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d1f067c-fec3-5d23-944b-661f60f986e5", "parentControlId": 31507, "controlId": "CIP-007-6 5.3", "title": "CIP-007-6 5.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586091" }, { "controlId": "B.1.2", "title": "B.1.2 — Account Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "72006d37-a7a2-5d01-b76a-5ea4b6db990a", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.2", "title": "NEI 08-09 App D.1.2 — Account Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "98d72b31-a5d6-577d-9429-53f74a7b3a56", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "e1804aa5-a355-5f2c-8d6d-27e78c929810", "isPublic": true }, { "controlId": "B.1.15", "title": "B.1.15 — Network Access Control", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-17, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "3e9be4c2-ac1d-5187-92ce-947dd5348159", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.15", "title": "NEI 08-09 App D.1.15 — Network Access Control", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.15", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "09b3daa7-2cd1-506a-a755-f1f17805cbb8", "isPublic": true }, { "controlId": "CIP-003-9-1.2.6", "title": "CIP-003-9-1.2.6", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "fda6936c-1efc-5604-9c8a-792e72597bc0", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec6", "title": "CIP-003-9-Attachment1-Sec6", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b6ffadb6-4cef-52c3-b0f7-e3d412886e86", "isPublic": true }, { "controlId": "CIP-004-7-R4", "title": "CIP-004-7-R4 — Access Management Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ecacc2fc-6a90-555d-9902-30a311f55f68", "isPublic": true }, { "controlId": "CIP-004-7-4.1", "title": "CIP-004-7-4.1 — Process to authorize based on need, as determined by the Responsible Entity, except for CIP Exceptional Circumstances", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ffd5bab3-07f2-545a-88f5-00a9aca95dbf", "isPublic": true }, { "controlId": "CIP-004-7-4.1.1", "title": "CIP-004-7-4.1.1 — Electronic access", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8ba435d0-5f90-58a5-9197-0c78a693ce72", "isPublic": true }, { "controlId": "CIP-004-7-4.1.2", "title": "CIP-004-7-4.1.2 — Unescorted physical access into a Physical Security Perimeter", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "bb3779f5-85f7-5a0a-ad07-dffb6c4ff60f", "isPublic": true }, { "controlId": "CIP-004-7-4.2", "title": "CIP-004-7-4.2 — Verify at least once each calendar quarter that individuals with active electronic access or unescorted physical acce...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6362e12b-200b-53ad-8377-ab1486d90077", "isPublic": true }, { "controlId": "CIP-004-7-4.3", "title": "CIP-004-7-4.3 — For electronic access, verify at least once every 15 calendar months that all user accounts, user account groups, or...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "97a48485-0335-59a3-aea9-8e00e1a30c77", "isPublic": true }, { "controlId": "CIP-005-7-R2", "title": "CIP-005-7-R2 — Interactive Remote Access Management", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4d44bf9c-07ce-5f3f-ae07-c533a88680fb", "isPublic": true }, { "controlId": "CIP-005-7-2.1", "title": "CIP-005-7-2.1 — For all Interactive Remote Access, utilize an Intermediate System such that the Cyber Asset initiating Interactive Re...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "33a82771-c8d0-59e7-8506-15b5d4e5ccbb", "isPublic": true }, { "controlId": "CIP-005-7-2.2", "title": "CIP-005-7-2.2 — For all Interactive Remote Access sessions, utilize encryption that terminates at an Intermediate System.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6f4ecce6-56ea-5b2f-b2d0-39dd23a1be5c", "isPublic": true }, { "controlId": "CIP-005-7-2.3", "title": "CIP-005-7-2.3 — Require multi-factor authentication for all Interactive Remote Access sessions.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b191ba65-4f7f-50d2-8e78-5f833d0cf5dd", "isPublic": true }, { "controlId": "CIP-005-7-2.4", "title": "CIP-005-7-2.4 — Have one or more methods for determining active vendor remote access sessions (including Interactive Remote Access an...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ce15c64b-b44f-52f9-9673-67cf619ea175", "isPublic": true }, { "controlId": "CIP-005-7-2.5", "title": "CIP-005-7-2.5 — Have one or more method(s) to disable active vendor remote access (including Interactive Remote Access and system- to...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ba0a9856-2dc1-56ac-9935-b566be1891aa", "isPublic": true }, { "controlId": "CIP-005-7-R3", "title": "CIP-005-7-R3 — Vendor Remote Access Management", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1433ebab-6f91-5948-b695-e3a48ccf2e77", "isPublic": true }, { "controlId": "CIP-005-7-3.1", "title": "CIP-005-7-3.1 — Have one or more method(s) to determine authenticated vendor- initiated remote connections.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "88e34f08-e1d7-5dec-a024-e924d6fd7d63", "isPublic": true }, { "controlId": "CIP-005-7-3.2", "title": "CIP-005-7-3.2 — Have one or more method(s) to terminate authenticated vendor-initiated remote connections and control the ability to...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1a32d978-2023-5680-a771-bfa42451bc6d", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "5eac1659-de42-5d5d-8f3e-80db280dd512", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "e3094037-4790-5fdd-9cfb-83f7f55ed15f", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "e3e19022-d59e-5fb0-9b76-9e2c7ef8608e", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "8981c711-3da5-5678-a536-f892de5a12d4", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "a78f214a-1bca-5c64-adeb-d03a63801d8d", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "f5c34b91-90f0-5c3f-8628-cf10b52badf2", "isPublic": true } ], "id": 31507, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731109", "catalogueId": 1062, "uuid": "4f192c70-f7d2-5422-a2b9-10041a46d9b2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization proactively govern account management of individual, group, system, service, application, guest and temporary accounts?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 10.0, "title": "Account Management", "description": "

Control Description

Mechanisms exist to proactively govern account management of individual, group, system, service, application, guest and temporary accounts.

Evidence Request List (ERL)

E-IAM-07\nE-IAM-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to proactively govern account management of individual, group, system, service, application, guest and temporary accounts.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.2, B.1.15
NERC-CIP (2026) Requirements: CIP-004-7-R4, CIP-005-7-R2, CIP-005-7-R3", "controlId": "IAC-15", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-15", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71880, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590626", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590626", "securityControlId": 31508, "ccis": [], "uuid": "e7163069-df16-5367-82fb-d0ca6f3cb2e7", "testId": "IAC-15.1_A01", "test": "automated mechanisms used to support the management of system accounts are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-02(01)_ODP", "defaultText": null }, { "id": 71881, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590626", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590626", "securityControlId": 31508, "ccis": [], "uuid": "b528730e-4b85-5be4-a0fa-38f4d2a29016", "testId": "IAC-15.1_A02", "test": "the management of system accounts is supported using organization-defined automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-02(01)", "defaultText": null } ], "externalMappings": [ { "id": 578801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4564d2ba-b4bd-59b9-aec0-5d125f108e0f", "parentControlId": 31508, "controlId": "USER 1.3", "title": "USER 1.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586099" }, { "id": 578802, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16dc67ba-10ba-5938-8445-e35f38227a26", "parentControlId": 31508, "controlId": "USER 1.4", "title": "USER 1.4", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586099" }, { "id": 578803, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85c22478-54a2-59d9-80b8-7a9d7a166f57", "parentControlId": 31508, "controlId": "USER 1.7", "title": "USER 1.7", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586099" }, { "id": 578804, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97ba10d5-9e57-5fa4-a6d3-9378e7e0f9c0", "parentControlId": 31508, "controlId": "USER 1.8", "title": "USER 1.8", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586099" }, { "id": 578805, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5861", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bdcf285-9c86-5e47-8600-39af97b0b0ac", "parentControlId": 31508, "controlId": "USER 1.8(a)", "title": "USER 1.8(a)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5861" }, { "id": 578806, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5861", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef2e34eb-f9cf-57ba-8328-f6cf6482da67", "parentControlId": 31508, "controlId": "USER 1.8(b)", "title": "USER 1.8(b)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5861" }, { "id": 578807, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5861", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "176d0aa4-ae4d-5341-a22e-064cb9f60173", "parentControlId": 31508, "controlId": "USER 1.8(c)", "title": "USER 1.8(c)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5861" }, { "id": 578808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5861", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6311aa56-d053-5c78-9977-d55360c34882", "parentControlId": 31508, "controlId": "SR 1.3", "title": "SR 1.3", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5861" }, { "id": 578809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5861", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "052faba0-fb1e-50bb-b150-26b85fb1a1ad", "parentControlId": 31508, "controlId": "SR 1.3 RE 1", "title": "SR 1.3 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5861" }, { "id": 578810, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5861", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af92deef-01fd-5790-af4e-b5ae54a47bb1", "parentControlId": 31508, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5861" }, { "id": 578812, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5861", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21117695-e293-588d-830d-a86876a04399", "parentControlId": 31508, "controlId": "AC-2(1)", "title": "AC-2(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5861" }, { "id": 578813, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c396e774-6680-5e4c-b4a1-dfb4afa2cfc0", "parentControlId": 31508, "controlId": "AC-02(01)", "title": "AC-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586101" }, { "id": 578814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5756925c-1c8f-5c4c-9a5d-1fcef93e4727", "parentControlId": 31508, "controlId": "AC-02(01)", "title": "AC-02(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586101" }, { "id": 578815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b08375f4-220f-58ce-96da-845422ddc238", "parentControlId": 31508, "controlId": "AC-02(01)", "title": "AC-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586101" }, { "id": 578816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f581ec70-c675-5ce4-b568-14b4a8e78ff0", "parentControlId": 31508, "controlId": "AC-02(01)", "title": "AC-02(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586101" }, { "id": 578817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "841b12b4-3816-51bc-aa5a-5ce8fb04afa4", "parentControlId": 31508, "controlId": "AC-02(01)", "title": "AC-02(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586101" }, { "id": 578818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3c7b6ab-e364-5a04-a568-efc720ce18f0", "parentControlId": 31508, "controlId": "3.1.1", "title": "3.1.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586101" }, { "id": 578819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8557556a-86ad-5c28-b97e-2e32561fa670", "parentControlId": 31508, "controlId": "3.5.1", "title": "3.5.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586101" }, { "id": 578820, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e1a5e3c-2531-5a81-bde4-854d65312565", "parentControlId": 31508, "controlId": "3.5.2", "title": "3.5.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586101" }, { "id": 578821, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586102", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6c31bd5-4bf2-5079-bbad-c2247a73e87c", "parentControlId": 31508, "controlId": "03.05.05.b", "title": "03.05.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586102" }, { "id": 578822, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586102", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34940a0a-f4f7-5391-a3ae-b2c8918ccd7d", "parentControlId": 31508, "controlId": "03.05.05.c", "title": "03.05.05.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586102" }, { "id": 578823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586102", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3ad3338-bafe-52e3-98f7-e9dbe7efc3eb", "parentControlId": 31508, "controlId": "03.05.05.d", "title": "03.05.05.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586102" }, { "id": 578824, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586102", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "512c9095-34e6-582b-9a65-593847e0a94f", "parentControlId": 31508, "controlId": "03.05.07.c", "title": "03.05.07.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586102" }, { "id": 578825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586102", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acdb327f-8968-5e62-96e8-82f70a7260f5", "parentControlId": 31508, "controlId": "03.05.07.d", "title": "03.05.07.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586102" }, { "id": 578826, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586102", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3aa977ef-c258-5f94-8cba-cb842905b426", "parentControlId": 31508, "controlId": "03.05.07.e", "title": "03.05.07.e", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586102" }, { "id": 578827, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586102", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "010cae60-1f95-5666-91ca-24ab88fe081c", "parentControlId": 31508, "controlId": "03.05.07.f", "title": "03.05.07.f", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586103" }, { "id": 578828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ee6e1d0-ce91-5ee5-8be8-5dc192241c47", "parentControlId": 31508, "controlId": "03.05.12.d", "title": "03.05.12.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586103" }, { "id": 578829, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c2e9e12-3e0d-5156-931a-49705de2f7b0", "parentControlId": 31508, "controlId": "03.05.12.e", "title": "03.05.12.e", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586103" }, { "id": 578830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37dce479-6090-5a16-95d2-c60a593beef8", "parentControlId": 31508, "controlId": "03.05.12.f", "title": "03.05.12.f", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586103" } ], "id": 31508, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73111", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73111", "catalogueId": 1062, "uuid": "87096c5b-e1bd-5625-bd8f-03b823e6f929", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to support the management of system accounts?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Automated System Account Management (Directory Services)", "description": "

Control Description

Automated mechanisms exist to support the management of system accounts (e.g., directory services).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically support the management of system accounts (e.g., directory services).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-15.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-15.1", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71882, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590627", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590627", "securityControlId": 31509, "ccis": [], "uuid": "752c1152-9451-5065-a1ad-447e3d51eb85", "testId": "IAC-15.2_A01", "test": "the time period after which to automatically remove or disable temporary or emergency accounts is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: disable temporary and emergency accounts after no more than 96 hours from last use.", "otherId": "53A_R5_AC-02(02)_ODP[01]\n53A_R5_AC-02(02)_ODP[02]", "defaultText": null }, { "id": 71883, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590627", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590627", "securityControlId": 31509, "ccis": [], "uuid": "28576a1f-67a9-5cb8-9390-f51f6c0ab308", "testId": "IAC-15.2_A02", "test": "temporary and emergency accounts are automatically disabled per an organization-defined time period.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: disable temporary and emergency accounts after no more than 96 hours from last use.", "otherId": "53A_R5_AC-02(02)", "defaultText": null } ], "externalMappings": [ { "id": 578870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76643906-aedf-565b-872b-9d830b8c034e", "parentControlId": 31509, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586107" }, { "id": 578872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586108", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ba24cdf-7888-54ac-a59b-0a043346de45", "parentControlId": 31509, "controlId": "AC-2(2)", "title": "AC-2(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586108" }, { "id": 578873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586108", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dec8e234-7bef-593f-a632-2b2a839751ad", "parentControlId": 31509, "controlId": "AC-02(02)", "title": "AC-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586108" }, { "id": 578874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586108", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38367c4e-7513-56cd-a52c-4a59228d2d14", "parentControlId": 31509, "controlId": "AC-02(02)", "title": "AC-02(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586108" }, { "id": 578876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586108", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e983bc5-f220-5341-b2dc-caf0e84ede6b", "parentControlId": 31509, "controlId": "AC-02(02)", "title": "AC-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586108" }, { "id": 578877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586108", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2687ce6c-ea15-5e6c-a52f-68b4c6110ce3", "parentControlId": 31509, "controlId": "AC-02(02)", "title": "AC-02(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586108" }, { "id": 578878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586108", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "244f5a32-d51f-5be1-8855-3177b1257c70", "parentControlId": 31509, "controlId": "AC-02(02)", "title": "AC-02(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586108" } ], "id": 31509, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73111", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73111", "catalogueId": 1062, "uuid": "fb28ad65-e7ad-5841-a67c-875173d66d13", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to disable or remove temporary and emergency accounts after an organization-defined time period for each type of account?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Removal of Temporary / Emergency Accounts", "description": "

Control Description

Automated mechanisms exist to disable or remove temporary and emergency accounts after an organization-defined time period for each type of account.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically disable or remove temporary and emergency accounts after an organization-defined time period for each type of account.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-15.2", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-15.2", "references": "

Micro-Small Business (<10 staff)

∙ Remove temporary/emergency accounts when no longer needed

Small Business (10-49 staff)

∙ Policy requiring prompt removal of temporary/emergency accounts

Medium Business (50-249 staff)

∙ Formal temporary account lifecycle policy\n∙ Automated expiry for temporary accounts

Large Business (250-999 staff)

∙ Enterprise IAM with automated temporary account expiration

Enterprise (>1,000 staff)

∙ Enterprise IGA platform with automated temporary account lifecycle management\n∙ Just-in-time access provisioning", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71884, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590627", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590627", "securityControlId": 31510, "ccis": [], "uuid": "a867bd21-b3e0-51c9-9b4e-eb51d390142b", "testId": "IAC-15.3_A01", "test": "a period of inactivity after which an account / identifier is disabled is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: thirty-five (35) days", "otherId": "171A_3.5.6[a]\n53A_R5_AC-02(03)_ODP[01]\n53A_R5_AC-02(03)_ODP[02]", "defaultText": null }, { "id": 71885, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590627", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590627", "securityControlId": 31510, "ccis": [], "uuid": "0c0de0fd-4ff0-5f9c-8548-b3bd0e09f7b0", "testId": "IAC-15.3_A02", "test": "accounts / identifiers are disabled after the defined period of inactivity.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: thirty-five (35) days", "otherId": "171A_3.5.6[b]\n53A_R5_AC-02(03)(d)", "defaultText": null }, { "id": 71886, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590628", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590628", "securityControlId": 31510, "ccis": [], "uuid": "18d6dae0-6b41-5e9a-a96f-ea7bd5bc3e8d", "testId": "IAC-15.3_A03", "test": "accounts / identifiers are disabled within an organization-defined time period when the accounts have expired.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: thirty-five (35) days", "otherId": "53A_R5_AC-02(03)(a)", "defaultText": null }, { "id": 71887, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590628", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590628", "securityControlId": 31510, "ccis": [], "uuid": "d12dde63-024c-50f2-8a88-e156480b26d1", "testId": "IAC-15.3_A04", "test": "accounts / identifiers are disabled within an organization-defined time period when the accounts are no longer associated with a user or individual.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: 24 hours for user accounts", "otherId": "53A_R5_AC-02(03)(b)", "defaultText": null }, { "id": 71888, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590628", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590628", "securityControlId": 31510, "ccis": [], "uuid": "04f60992-56f6-5f41-9c6c-0bf1fda093b0", "testId": "IAC-15.3_A05", "test": "accounts / identifiers are disabled within an organization-defined time period when the accounts are in violation of organizational policy.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: 24 hours for user accounts", "otherId": "53A_R5_AC-02(03)(c)", "defaultText": null }, { "id": 71889, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590628", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590628", "securityControlId": 31510, "ccis": [], "uuid": "686da4c4-2439-5695-96e9-71bc72c5bbd9", "testId": "IAC-15.3_A06", "test": "system accounts are disabled when the accounts have been inactive for .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at most 90 days", "otherId": "171A_R3_A.03.01.01.f.02", "defaultText": null } ], "externalMappings": [ { "id": 578897, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98949c7d-d295-5e3c-8eed-20bf8fadf4f6", "parentControlId": 31510, "controlId": "5.16", "title": "5.16", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58611" }, { "id": 578899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "770f9d1a-e83c-5d4c-b299-34cc47bb80a8", "parentControlId": 31510, "controlId": "AC-2(3)", "title": "AC-2(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586111" }, { "id": 578900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "426b5361-dda8-55fd-9b7f-6ad579c431fb", "parentControlId": 31510, "controlId": "AC-02(03)", "title": "AC-02(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586111" }, { "id": 578901, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b46e896-b8f2-5c35-901c-c8cbe4d97c27", "parentControlId": 31510, "controlId": "AC-02(03)", "title": "AC-02(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586111" }, { "id": 578902, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ccdd891f-bcca-5e26-8260-2ea5477c5e74", "parentControlId": 31510, "controlId": "AC-02(03)", "title": "AC-02(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586111" }, { "id": 578903, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e28c243-093f-55fb-b291-f768a1b79b69", "parentControlId": 31510, "controlId": "AC-02(03)", "title": "AC-02(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586111" }, { "id": 578904, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae7d9c5d-1442-5bf1-aca1-eae9322155e2", "parentControlId": 31510, "controlId": "AC-02(03)", "title": "AC-02(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586111" }, { "id": 578905, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36399208-6fa5-52e3-9414-590b57948b8b", "parentControlId": 31510, "controlId": "3.5.6", "title": "3.5.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586111" }, { "id": 578906, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cc72606-a02b-50c3-8c37-26d7653ca755", "parentControlId": 31510, "controlId": "03.01.01.f.02", "title": "03.01.01.f.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586111" }, { "id": 578916, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70bb3645-69b0-59f0-8dba-1474a2f78308", "parentControlId": 31510, "controlId": "ACCESS-1j", "title": "ACCESS-1j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586121" } ], "id": 31510, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73111", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73111", "catalogueId": 1062, "uuid": "52e2736c-6c6b-552c-aef1-a45c2231bad1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to disable inactive accounts after an organization-defined time period?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 10.0, "title": "Disable Inactive Accounts", "description": "

Control Description

Automated mechanisms exist to disable inactive accounts after an organization-defined time period.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically disable inactive accounts after an organization-defined time period.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-15.3", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-15.3", "references": "

Micro-Small Business (<10 staff)

∙ Disable accounts after extended inactivity (e.g., 90 days)

Small Business (10-49 staff)

∙ Policy for disabling inactive accounts\n∙ Regular review of inactive accounts

Medium Business (50-249 staff)

∙ Automated inactive account detection and disabling\n∙ Defined inactivity threshold

Large Business (250-999 staff)

∙ Enterprise IAM with automated inactive account detection and disabling

Enterprise (>1,000 staff)

∙ Enterprise IGA platform with automated account dormancy detection and disabling\n∙ SIEM integration for last login tracking", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71890, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590629", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590629", "securityControlId": 31511, "ccis": [], "uuid": "a57c4f5f-45f1-5493-b2df-61b6d2bc11fa", "testId": "IAC-15.4_A01", "test": "account creation is automatically audited.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-02(04)[01]", "defaultText": null }, { "id": 71891, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590629", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590629", "securityControlId": 31511, "ccis": [], "uuid": "e82aa6d3-ee2a-5188-97f2-ab759646b5a8", "testId": "IAC-15.4_A02", "test": "account modification is automatically audited.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-02(04)[02]", "defaultText": null }, { "id": 71892, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590629", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590629", "securityControlId": 31511, "ccis": [], "uuid": "12209a56-775c-5b0e-a47c-f527c533570a", "testId": "IAC-15.4_A03", "test": "account enabling is automatically audited.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-02(04)[03]", "defaultText": null }, { "id": 71893, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590629", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590629", "securityControlId": 31511, "ccis": [], "uuid": "eafb5273-5bfb-539d-a302-299eacc9a54f", "testId": "IAC-15.4_A04", "test": "account disabling is automatically audited.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-02(04)[04]", "defaultText": null }, { "id": 71894, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590629", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590629", "securityControlId": 31511, "ccis": [], "uuid": "aa3ac430-2f2f-5315-94fd-ff7342f9b1d1", "testId": "IAC-15.4_A05", "test": "account removal actions are automatically audited.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-02(04)[05]", "defaultText": null } ], "externalMappings": [ { "id": 578941, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586123", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b830673-001f-5fd2-8350-2b0183730329", "parentControlId": 31511, "controlId": "AC-2(4)", "title": "AC-2(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586123" }, { "id": 578942, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586124", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1099b5e3-00f9-5bfe-b802-b089eb352b16", "parentControlId": 31511, "controlId": "AC-02(04)", "title": "AC-02(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586124" }, { "id": 578943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586124", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7e31750-f837-5604-babb-b10338670ef0", "parentControlId": 31511, "controlId": "AC-02(04)", "title": "AC-02(04)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586124" }, { "id": 578944, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586124", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1552075-480a-5890-baa3-61f291c59f39", "parentControlId": 31511, "controlId": "AC-02(04)", "title": "AC-02(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586124" }, { "id": 578945, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586124", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "935329df-76b4-55cb-8768-d8b6183d47bc", "parentControlId": 31511, "controlId": "AC-02(04)", "title": "AC-02(04)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586124" }, { "id": 578946, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586124", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad3317f1-d097-5ed5-b663-b279de1bdd46", "parentControlId": 31511, "controlId": "AC-02(04)", "title": "AC-02(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586124" }, { "controlId": "B.1.11", "title": "B.1.11 — Supervision and Review — Access Control", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-2(4), AU-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "27b013bd-3f3a-5a37-a5dd-62704a48cc68", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.11", "title": "NEI 08-09 App D.1.11 — Supervision and Review — Access Control", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.11", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "c9c52af9-997f-5e2f-854c-498a72456f00", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.11", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "2e624cb0-83d0-596e-9904-fbbd7a017fba", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "53a0a562-1179-59ea-a64b-1b74f569365e", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "ba7e290f-e94b-5039-b99e-0e0aedf9781d", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "c880b498-66ff-58c6-862b-483bb0ee6079", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "a991e706-85b0-53ac-9ed9-9ba8c1d1b857", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "dd95d641-781f-534c-b250-21f3aebcab06", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "ee758f05-e3d8-5c33-ba36-87114d6b506c", "isPublic": true } ], "id": 31511, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731111", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731111", "catalogueId": 1062, "uuid": "4737336e-0552-59d2-8fe3-b9ead9177bcb", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to audit account creation, modification, enabling, disabling and removal actions and notify organization-defined personnel or roles?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Automated Audit Actions", "description": "

Control Description

Automated mechanisms exist to audit account creation, modification, enabling, disabling and removal actions and notify organization-defined personnel or roles.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically audit account creation, modification, enabling, disabling and removal actions and notify organization-defined personnel or roles.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.11", "controlId": "IAC-15.4", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-15.4", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71895, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59063", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59063", "securityControlId": 31512, "ccis": [], "uuid": "f4bd9f1d-35ae-5e8e-aaae-8a32dccfc48d", "testId": "IAC-15.5_A01", "test": "conditions for establishing shared and group accounts are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: organization-defined need with justification statement that explains why such accounts are necessary", "otherId": "53A_R5_AC-02(09)_ODP", "defaultText": null }, { "id": 71896, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59063", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59063", "securityControlId": 31512, "ccis": [], "uuid": "22902444-561d-51f8-bd1a-20d393c555d8", "testId": "IAC-15.5_A02", "test": "the use of shared and group accounts is only permitted if organization-defined conditions are met.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: organization-defined need with justification statement that explains why such accounts are necessary", "otherId": "53A_R5_AC-02(09)", "defaultText": null } ], "externalMappings": [ { "id": 578955, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586125", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "518aff1a-4e85-546e-a891-992faa34880c", "parentControlId": 31512, "controlId": "USER 1.12", "title": "USER 1.12", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586125" }, { "id": 578956, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586125", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af86c130-ffcc-5d1a-80a4-62f44a93b608", "parentControlId": 31512, "controlId": "5.16", "title": "5.16", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586125" }, { "id": 578958, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586125", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aba12c9e-c247-55ae-8c22-406686d01407", "parentControlId": 31512, "controlId": "AC-2(9)", "title": "AC-2(9)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586125" }, { "id": 578959, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586126", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9cd0fdd1-78fc-50eb-8608-e1d92170d811", "parentControlId": 31512, "controlId": "AC-02(09)", "title": "AC-02(09)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586126" }, { "id": 578960, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586126", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a4dae90-6e3f-5d00-b1fc-5271c4eeff13", "parentControlId": 31512, "controlId": "AC-02(09)", "title": "AC-02(09)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586126" }, { "id": 578961, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586126", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46e5f917-0367-54f3-8181-37723b260228", "parentControlId": 31512, "controlId": "03.01.01.c.01", "title": "03.01.01.c.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586126" }, { "id": 578974, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6aa5f019-0173-51fc-8db5-9b34fc059a14", "parentControlId": 31512, "controlId": "CIP-007-6 5.3", "title": "CIP-007-6 5.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586128" } ], "id": 31512, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731111", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731111", "catalogueId": 1062, "uuid": "c231af5f-7a2e-529a-a6e1-687d61a065d9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization authorize the use of shared/group accounts only under certain organization-defined conditions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Restrictions on Shared Groups / Accounts", "description": "

Control Description

Mechanisms exist to authorize the use of shared/group accounts only under certain organization-defined conditions.

Evidence Request List (ERL)

E-IAM-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to authorize the use of shared/group accounts only under certain organization-defined conditions.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "IAC-15.5", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-15.5", "references": "

Micro-Small Business (<10 staff)

∙ Avoid shared accounts; use individual accounts where possible

Small Business (10-49 staff)

∙ Policy restricting shared account usage\n∙ Individual accountability required

Medium Business (50-249 staff)

∙ Formal shared account policy\n∙ Technical controls limiting shared account use

Large Business (250-999 staff)

∙ PAM for shared account management with individual accountability (e.g., CyberArk)

Enterprise (>1,000 staff)

∙ Enterprise PAM platform (e.g., CyberArk, BeyondTrust)\n∙ Shared account vaulting with individual checkout\n∙ Full session recording", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71897, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59063", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59063", "securityControlId": 31513, "ccis": [], "uuid": "d0e23a31-2ae2-597f-a134-e1e86d6d0736", "testId": "IAC-15.6_A01", "test": "time period within which to disable accounts of individuals who are discovered to pose significant risk is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: one (1) hour", "otherId": "53A_R5_AC-02(13)_ODP[01]", "defaultText": null }, { "id": 71898, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59063", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59063", "securityControlId": 31513, "ccis": [], "uuid": "a9573a62-763e-5f8c-9076-c44017c4edb5", "testId": "IAC-15.6_A02", "test": "significant risks leading to disabling accounts are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-02(13)_ODP[02]", "defaultText": null }, { "id": 71899, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59063", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59063", "securityControlId": 31513, "ccis": [], "uuid": "2ba60a7d-fc9a-594c-8b08-6fa4353e5225", "testId": "IAC-15.6_A03", "test": "accounts of individuals are disabled within an organization-defined time period of discovery of significant risks.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: one (1) hour", "otherId": "53A_R5_AC-02(13)", "defaultText": null } ], "externalMappings": [ { "id": 578987, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6700002b-6bfb-5dc5-aedf-3d3d9d5f1e7c", "parentControlId": 31513, "controlId": "AC-2(13)", "title": "AC-2(13)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58613" }, { "id": 578988, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b64cc9a-d52b-5e71-90af-0eeffad32615", "parentControlId": 31513, "controlId": "AC-02(13)", "title": "AC-02(13)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58613" }, { "id": 578990, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbbba004-0341-58c8-8f96-4872ba8f8ac0", "parentControlId": 31513, "controlId": "AC-02(13)", "title": "AC-02(13)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58613" }, { "id": 578991, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be6eac2a-4eeb-5eea-ba65-1fcd7afe5b06", "parentControlId": 31513, "controlId": "AC-02(13)", "title": "AC-02(13)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58613" }, { "id": 578992, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e455fa2-1a14-5121-b577-6d6d695eb1bc", "parentControlId": 31513, "controlId": "AC-02(13)", "title": "AC-02(13)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58613" }, { "id": 578993, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1953d71-fc1a-54ec-a79e-95eec4b4730f", "parentControlId": 31513, "controlId": "AC-02(13)", "title": "AC-02(13)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58613" }, { "id": 578994, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586131", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d44a1986-9dfb-5f22-919a-22e5eae70b19", "parentControlId": 31513, "controlId": "03.01.01.f.04", "title": "03.01.01.f.04", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586131" }, { "id": 578995, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586131", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b1a8489-2098-513c-ad29-ee4e52d36584", "parentControlId": 31513, "controlId": "03.01.01.f.05", "title": "03.01.01.f.05", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586131" } ], "id": 31513, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731112", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731112", "catalogueId": 1062, "uuid": "e0eb797f-0471-5133-99e9-1b91e067f5e9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization disable accounts immediately upon notification for users posing a significant risk to the organization?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Account Disabling for High Risk Individuals", "description": "

Control Description

Mechanisms exist to disable accounts immediately upon notification for users posing a significant risk to the organization.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to disable accounts immediately upon notification for users posing a significant risk to the organization.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-15.6", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-15.6", "references": "

Micro-Small Business (<10 staff)

∙ Disable accounts of users identified as high-risk immediately

Small Business (10-49 staff)

∙ Procedure for immediate account disabling for high-risk individuals

Medium Business (50-249 staff)

∙ Formal high-risk account disabling procedure\n∙ Security team notification protocol

Large Business (250-999 staff)

∙ Enterprise IAM with ability to immediately disable accounts for high-risk individuals\n∙ SIEM/HR integration

Enterprise (>1,000 staff)

∙ Enterprise IAM/IGA with automated account disabling triggered by HR events or security alerts\n∙ SOAR integration", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71900, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590631", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590631", "securityControlId": 31514, "ccis": [], "uuid": "5d3c7dcc-d2bc-5eec-b5be-1d1a974657ee", "testId": "IAC-15.7_A01", "test": "system account types allowed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.01.01.a[01]", "defaultText": null }, { "id": 71901, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590631", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590631", "securityControlId": 31514, "ccis": [], "uuid": "e67bb2d3-405f-566c-96c0-f8951c1ab794", "testId": "IAC-15.7_A02", "test": "system account types prohibited are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.01.01.a[02]", "defaultText": null }, { "id": 71902, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590631", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590631", "securityControlId": 31514, "ccis": [], "uuid": "5f2677f5-6b91-5327-bf7f-2b5b4c3ebae4", "testId": "IAC-15.7_A03", "test": "system accounts that cannot be associated with a business process and owner are disabled.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71903, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590631", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590631", "securityControlId": 31514, "ccis": [], "uuid": "cfa16115-eb4e-5420-845b-2cf08795225c", "testId": "IAC-15.7_A04", "test": "system accounts are created in accordance with organizational policy, procedures, prerequisites, and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.b[01]", "defaultText": null }, { "id": 71904, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590631", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590631", "securityControlId": 31514, "ccis": [], "uuid": "e2fc24a6-9499-5e38-b3e5-06b1c782539e", "testId": "IAC-15.7_A05", "test": "system accounts are enabled in accordance with organizational policy, procedures, prerequisites, and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.b[02]", "defaultText": null }, { "id": 71905, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590632", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590632", "securityControlId": 31514, "ccis": [], "uuid": "3c9a236d-20c3-520c-b2f5-fadc59493404", "testId": "IAC-15.7_A06", "test": "system accounts are modified in accordance with organizational policy, procedures, prerequisites, and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.b[03]", "defaultText": null }, { "id": 71906, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590632", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590632", "securityControlId": 31514, "ccis": [], "uuid": "bb975cfa-5ef2-5833-bd6b-a2c435aa572c", "testId": "IAC-15.7_A07", "test": "system accounts are disabled in accordance with organizational policy, procedures, prerequisites, and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.b[04]", "defaultText": null }, { "id": 71907, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590632", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590632", "securityControlId": 31514, "ccis": [], "uuid": "30868976-48d2-5850-b78a-62b92e2523df", "testId": "IAC-15.7_A08", "test": "system accounts are removed in accordance with organizational policy, procedures, prerequisites, and criteria.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.b[05]", "defaultText": null }, { "id": 71908, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590632", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590632", "securityControlId": 31514, "ccis": [], "uuid": "3799ceba-7723-5934-8d44-067cd6e33df9", "testId": "IAC-15.7_A09", "test": "authorized users of the system are specified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.c.01", "defaultText": null } ], "externalMappings": [ { "id": 579008, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586132", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3bea0f6-1dbb-5018-ab19-a1ff8929c61f", "parentControlId": 31514, "controlId": "03.01.01.e", "title": "03.01.01.e", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586132" }, { "id": 579009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586132", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bdea08d-0391-58f0-91c8-de2312380052", "parentControlId": 31514, "controlId": "03.01.05.c", "title": "03.01.05.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586132" } ], "id": 31514, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731112", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731112", "catalogueId": 1062, "uuid": "0d04a71c-a192-5306-9a81-800153ed2d52", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization review all system accounts and disables any account that cannot be associated with a business process and owner?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "System Account Reviews", "description": "

Control Description

Mechanisms exist to review all system accounts and disable any account that cannot be associated with a business process and owner.

Evidence Request List (ERL)

E-IAM-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.\n▪ IAM proactively governs account management of individual, group, system, application, guest and temporary accounts.\n▪ IAM inventories all privileged accounts and validates that each person with elevated privileges is authorized by the appropriate level of organizational management.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to review all system accounts and disable any account that cannot be associated with a business process and owner.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "IAC-15.7", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-15.7", "references": "

Micro-Small Business (<10 staff)

∙ Periodic review of user accounts and access rights

Small Business (10-49 staff)

∙ Annual user account review\n∙ Remove unused accounts and excess access

Medium Business (50-249 staff)

∙ Formal periodic account review process\n∙ Quarterly access reviews

Large Business (250-999 staff)

∙ Enterprise access certification program\n∙ Automated access review campaigns

Enterprise (>1,000 staff)

∙ Enterprise IGA platform (e.g., SailPoint, Saviynt)\n∙ Automated access certification campaigns\n∙ Manager-driven access reviews\n∙ Role mining and optimization", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71909, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590632", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590632", "securityControlId": 31515, "ccis": [], "uuid": "a7c075f0-9499-5695-8d0b-5d600bab552f", "testId": "IAC-15.8_A01", "test": "circumstances and/or usage conditions to be enforced for system accounts are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-02(11)_ODP[01]", "defaultText": null }, { "id": 71910, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590632", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590632", "securityControlId": 31515, "ccis": [], "uuid": "766a32fa-3735-5006-ac46-c726cdbaa472", "testId": "IAC-15.8_A02", "test": "system accounts subject to enforcement of circumstances and/or usage conditions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-02(11)_ODP[02]", "defaultText": null }, { "id": 71911, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590633", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590633", "securityControlId": 31515, "ccis": [], "uuid": "a7dfd97d-9fe1-5bb9-be42-8b7f4a5ae596", "testId": "IAC-15.8_A03", "test": "organization-defined system accounts are enforced.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-02(11)", "defaultText": null } ], "externalMappings": [ { "id": 579033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8a73609-b0d0-58d1-889e-6b0edf6b1e49", "parentControlId": 31515, "controlId": "AC-2(11)", "title": "AC-2(11)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586135" }, { "id": 579034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8225a6bc-826b-51e5-b0a4-3888507f1801", "parentControlId": 31515, "controlId": "AC-02(11)", "title": "AC-02(11)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586135" }, { "id": 579035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef2fc403-21fe-595b-b2a8-d10147519040", "parentControlId": 31515, "controlId": "AC-02(11)", "title": "AC-02(11)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586135" }, { "id": 579036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c321cc4-e0da-57e0-8a40-18a897a486df", "parentControlId": 31515, "controlId": "AC-02(11)", "title": "AC-02(11)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586135" }, { "id": 579037, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96c0e502-df4d-5040-bdfd-bdaad9cb5408", "parentControlId": 31515, "controlId": "AC-02(11)", "title": "AC-02(11)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586135" } ], "id": 31515, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731112", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731112", "catalogueId": 1062, "uuid": "3e0b58aa-0fa1-50f3-b8ce-fe0f88e62fd4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to enforce usage conditions for users and/or roles?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Usage Conditions", "description": "

Control Description

Automated mechanisms exist to enforce usage conditions for users and/or roles.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically enforce usage conditions for users and/or roles.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "IAC-15.8", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-15.8", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71914, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590634", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590634", "securityControlId": 31517, "ccis": [], "uuid": "75e345a1-81d9-549e-896c-2beafa145294", "testId": "IAC-16_A01", "test": "privileged access rights for users and services are restricted based on roles.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71915, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590634", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590634", "securityControlId": 31517, "ccis": [], "uuid": "0a9ab2f1-57ce-545a-8d17-c42cd459e14b", "testId": "IAC-16_A02", "test": "privileged access rights for users and services are controlled.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 579068, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586139", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e51ab90a-53bd-5e87-810a-6e7f2f00b202", "parentControlId": 31517, "controlId": "5.15", "title": "5.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586139" }, { "id": 579069, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586139", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae46410a-d950-5938-af39-ceb4278a14e3", "parentControlId": 31517, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586139" }, { "id": 579070, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586139", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1bf5a11-75fb-5545-b47d-8b3d0f01f528", "parentControlId": 31517, "controlId": "8.2", "title": "8.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586139" }, { "id": 579074, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14f65e01-c109-55a2-8325-995987ec45ff", "parentControlId": 31517, "controlId": "3.1.5", "title": "3.1.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58614" }, { "id": 579075, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7459232-f0a1-5c56-825f-203fd45f8524", "parentControlId": 31517, "controlId": "03.01.06.a", "title": "03.01.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58614" }, { "id": 579076, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48e0d6da-d3a0-5aba-9533-aa8021f4f227", "parentControlId": 31517, "controlId": "03.01.07.a", "title": "03.01.07.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58614" }, { "id": 579077, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bbccf2e-e109-5f4f-a794-7b9d1bdf573d", "parentControlId": 31517, "controlId": "03.01.07.b", "title": "03.01.07.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58614" }, { "id": 579091, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586142", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65009eea-525a-5123-8fc6-90e33c73599e", "parentControlId": 31517, "controlId": "ACCESS-1g", "title": "ACCESS-1g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586142" }, { "id": 579092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586142", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe27ac32-5d3e-5fe6-90cf-187e48faab60", "parentControlId": 31517, "controlId": "ACCESS-1h", "title": "ACCESS-1h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586142" }, { "id": 579093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586142", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95bd3b7f-0c33-5ef6-8a16-b68bbee4dae5", "parentControlId": 31517, "controlId": "ACCESS-2b", "title": "ACCESS-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586142" }, { "id": 579114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586144", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c96ced73-895b-501a-83c1-50d428121a7f", "parentControlId": 31517, "controlId": "B2.c", "title": "B2.c", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586144" }, { "controlId": "B.1.21", "title": "B.1.21 — Third Party Products and Controls", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SA-9, AC-20", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "bdc78470-a687-5f93-b0e9-e08248457fbe", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.21", "title": "NEI 08-09 App D.1.21 — Third Party Products and Controls", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.21", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "7e3674b3-10d0-5a6b-97e3-ce371c5f1cd4", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.21", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "eba06f50-9e9d-5932-aae3-ba3d91c6bd94", "isPublic": true }, { "controlId": "B.1.22", "title": "B.1.22 — Use of External Systems", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-20", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "11ab29b8-2ec6-5a01-a7a6-0d4734f96c8a", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.22", "title": "NEI 08-09 App D.1.22 — Use of External Systems", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.22", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "714d4030-706c-517c-8734-a4c44499d9ec", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "fbce1775-133e-5c75-82ae-323afd1cb960", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "1b56d60c-6d65-5ff2-903e-6ff8f862780f", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "3543cf39-1436-5ca3-bbc9-e65d07efdb74", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "da9dc15e-1b07-5ecd-b8ae-ccd142077967", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "418219e7-187a-5a80-a7a8-1c8c39988481", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "1afb4719-66b3-551c-9fda-21c7ebc53427", "isPublic": true } ], "id": 31517, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731113", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731113", "catalogueId": 1062, "uuid": "80c8b67c-9dd7-56c6-8547-900eda1a1541", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict and control privileged access rights for users and Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 10.0, "title": "Privileged Account Management (PAM)", "description": "

Control Description

Mechanisms exist to restrict and control privileged access rights for users and Technology Assets, Applications and/or Services (TAAS).

Evidence Request List (ERL)

E-IAM-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.\n▪ IAM restricts the assignment of privileged accounts to entity-defined personnel and/or roles (privilege assignment requires management approval).\n▪ LAC and RBAC enforcements limit the ability of non-administrators from making unauthorized configuration changes to TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict and control privileged access rights for users and Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.21, B.1.22", "controlId": "IAC-16", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-16", "references": "

Micro-Small Business (<10 staff)

∙ Strong password policy\n∙ MFA for key accounts

Small Business (10-49 staff)

∙ Password manager\n∙ MFA on all accounts\n∙ Identity policy

Medium Business (50-249 staff)

∙ ManageEngine Enterprise Password Management (https://manageengine.com)\n∙ Securden (https://securden.com)\n∙ CyberArk (https://cyberark.com)

Large Business (250-999 staff)

∙ ManageEngine Enterprise Password Management (https://manageengine.com)\n∙ Securden (https://securden.com)\n∙ CyberArk (https://cyberark.com)

Enterprise (>1,000 staff)

∙ ManageEngine Enterprise Password Management (https://manageengine.com)\n∙ Securden (https://securden.com)\n∙ CyberArk (https://cyberark.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71916, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590634", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590634", "securityControlId": 31518, "ccis": [], "uuid": "ded273b5-e518-5af7-83f7-eb8d9109e201", "testId": "IAC-16.1_A01", "test": "all privileged accounts are inventoried.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71917, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590634", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590634", "securityControlId": 31518, "ccis": [], "uuid": "3e83f3da-7799-51e6-8bd0-e0306fb4ef3d", "testId": "IAC-16.1_A02", "test": "validation is performed for each person with elevated privileges for authorization by the appropriate level of organizational management.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 579187, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a15a5d0-e426-582c-9754-4ec360b76c58", "parentControlId": 31518, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586153" }, { "id": 579188, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "708a93d0-019e-5780-a014-aa3463c31c14", "parentControlId": 31518, "controlId": "8.2", "title": "8.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586153" }, { "id": 579192, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7ed7c98-69aa-5408-bfbf-e2a6dded8e47", "parentControlId": 31518, "controlId": "3.1.5", "title": "3.1.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586154" }, { "controlId": "B.1.22", "title": "B.1.22 — Use of External Systems", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-20", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "55275abe-509a-504e-9392-c2022e2b50ba", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.22", "title": "NEI 08-09 App D.1.22 — Use of External Systems", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.22", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d518698e-6491-53cc-b4c3-86e19d3d87b6", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.22", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "75955a97-7517-5e3a-b7fb-43246614613e", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "8cb7e306-a527-576e-9647-97f42e94c1a7", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "6fabbc79-c260-53ed-9242-16e8d095699b", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "5075c9de-2422-5c43-b51a-cdb6425d53d7", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "ac3b4086-c2c7-57d4-9595-2269eaee9c13", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "64f0d810-e138-553a-9496-22b113d79d59", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "76265b68-c6df-556a-81d2-e669e7c0f353", "isPublic": true } ], "id": 31518, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731113", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731113", "catalogueId": 1062, "uuid": "e36bdc5a-91d6-5cfb-b6d1-b95a5c4bcbba", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization inventory all privileged accounts and validate that each person with elevated privileges is authorized by the appropriate level of organizational management?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Privileged Account Inventories", "description": "

Control Description

Mechanisms exist to inventory all privileged accounts and validate that each person with elevated privileges is authorized by the appropriate level of organizational management.

Evidence Request List (ERL)

E-IAM-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to inventory all privileged accounts and validate that each person with elevated privileges is authorized by the appropriate level of organizational management.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.22", "controlId": "IAC-16.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-16.1", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71921, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590636", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590636", "securityControlId": 31522, "ccis": [], "uuid": "54065667-cc71-5f3b-9102-ff43bec00ac0", "testId": "IAC-16.5_A01", "test": "instances that require a manual override of the current account privileges to enable the timely response to unusual conditions without terminating the current session and establishing a new session as a higher-privileged user are identified.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71922, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590636", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590636", "securityControlId": 31522, "ccis": [], "uuid": "35bedef4-b12e-5505-bde2-cb7329b66e04", "testId": "IAC-16.5_A02", "test": "processes/technologies necessary to enable a manual override of the current account privileges to enable the timely response to unusual conditions without terminating the current session and establishing a new session as a higher-privileged user are identified.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71923, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590636", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590636", "securityControlId": 31522, "ccis": [], "uuid": "1f3e818e-b275-579b-9cf3-8d6caf173a77", "testId": "IAC-16.5_A03", "test": "a capability exists to manually override of the current account privileges to enable the timely response to unusual conditions without terminating the current session and establishing a new session as a higher-privileged user.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 579213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586156", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f8754bd-8ee7-54e0-9a8c-eddb7270b7ad", "parentControlId": 31522, "controlId": "SR 2.1 RE 3", "title": "SR 2.1 RE 3", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586156" }, { "id": 579214, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586157", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ea632f1-66a3-5362-a6e3-603ba86f636e", "parentControlId": 31522, "controlId": "CR 2.1(3)", "title": "CR 2.1(3)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586157" } ], "id": 31522, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731115", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731115", "catalogueId": 1062, "uuid": "63f61e46-55be-58f9-bc2b-15cfd04c04a7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enable a manual override of the current account privileges to enable the timely response to unusual conditions without terminating the current session and establishing a new session as a higher-privileged user?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Manual Override", "description": "

Control Description

Mechanisms exist to enable a manual override of the current account privileges to enable the timely response to unusual conditions without terminating the current session and establishing a new session as a higher-privileged user.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enable a manual override of the current account privileges to enable the timely response to unusual conditions without terminating the current session and establishing a new session as a higher-privileged user.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-16.5", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-16.5", "references": "

Micro-Small Business (<10 staff)

∙ Document manual override procedures for automated systems

Small Business (10-49 staff)

∙ Manual override policy and procedure for automated access controls

Medium Business (50-249 staff)

∙ Formal manual override process with approval and audit trail

Large Business (250-999 staff)

∙ Enterprise manual override process with dual authorization and logging

Enterprise (>1,000 staff)

∙ Enterprise PAM with manual override workflows\n∙ Dual control for override access\n∙ Automated audit trail for all overrides", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71924, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590636", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590636", "securityControlId": 31523, "ccis": [], "uuid": "824e8160-a19c-5c44-b184-c12af97c33f4", "testId": "IAC-17_A01", "test": "the frequency at which to review the privileges assigned to roles or classes of users is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at a minimum, annually", "otherId": "53A_R5_AC-06(07)_ODP[01]\n171A_R3_A.03.01.05.ODP[03]", "defaultText": null }, { "id": 71925, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590636", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590636", "securityControlId": 31523, "ccis": [], "uuid": "6567191a-b5d2-5cff-a8ed-1f2685c3365a", "testId": "IAC-17_A02", "test": "roles or classes of users to which privileges are assigned are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: all users with privileges", "otherId": "53A_R5_AC-06(07)_ODP[02]", "defaultText": null }, { "id": 71926, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590637", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590637", "securityControlId": 31523, "ccis": [], "uuid": "b7e4bd80-0bdf-557c-bb6c-9848caae15ab", "testId": "IAC-17_A03", "test": "the privileges assigned to roles or classes of users are reviewed to validate the need for such privileges.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months", "otherId": "53A_R5_AC-06(07)(a)\n171A_R3_A.03.01.05.c", "defaultText": null }, { "id": 71927, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590637", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590637", "securityControlId": 31523, "ccis": [], "uuid": "a64d6a9c-3a14-519c-a26e-650930a31726", "testId": "IAC-17_A04", "test": "privileges are reassigned or removed, as necessary.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at a minimum, annually", "otherId": "53A_R5_AC-06(07)(b)\n171A_R3_A.03.01.05.d", "defaultText": null } ], "externalMappings": [ { "id": 579226, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1febdb30-46a2-54c1-91b2-061db8115b91", "parentControlId": 31523, "controlId": "5.15", "title": "5.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586158" }, { "id": 579227, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f43d2b8-a508-56cb-9edb-f244ea6d6297", "parentControlId": 31523, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586158" }, { "id": 579228, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a13461cc-1e5e-5095-941d-668e452dd3c7", "parentControlId": 31523, "controlId": "8.2", "title": "8.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586158" }, { "id": 579237, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586159", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c5249e0-5ec9-548b-a2de-eb659f982a29", "parentControlId": 31523, "controlId": "AC-6(7)", "title": "AC-6(7)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586159" }, { "id": 579238, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586159", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a11fbeee-91a5-54a9-ba25-455c966356dc", "parentControlId": 31523, "controlId": "AC-06(07)", "title": "AC-06(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586159" }, { "id": 579239, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586159", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94a6330c-8309-529f-b26d-cba8c5710cb4", "parentControlId": 31523, "controlId": "AC-06(07)", "title": "AC-06(07)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586159" }, { "id": 579241, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf2fef7d-5e95-55b9-9a55-0cb9a8b69625", "parentControlId": 31523, "controlId": "AC-06(07)", "title": "AC-06(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586168" }, { "id": 579242, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2b1d310-9ff0-5779-87c7-d481a1486e8c", "parentControlId": 31523, "controlId": "AC-06(07)", "title": "AC-06(07)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586168" }, { "id": 579243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8d92044-41f4-5d54-8a42-4579cd2aa684", "parentControlId": 31523, "controlId": "AC-06(07)", "title": "AC-06(07)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586168" }, { "id": 579245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1e001fb-1075-579d-8e9e-fb79e038d032", "parentControlId": 31523, "controlId": "03.01.01.g.03", "title": "03.01.01.g.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586168" }, { "id": 579246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a047fc12-0009-5b81-b138-9a1156ee8131", "parentControlId": 31523, "controlId": "03.01.05.c", "title": "03.01.05.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586168" }, { "id": 579247, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21f39c82-2bc6-57f5-8e57-33350efdbaa8", "parentControlId": 31523, "controlId": "03.01.05.d", "title": "03.01.05.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586168" }, { "id": 579248, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3a5ef25-43d5-5c50-81d8-57a2144fa269", "parentControlId": 31523, "controlId": "03.10.01.c", "title": "03.10.01.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586169" }, { "id": 579249, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "761c58d5-92e8-5ad9-9d80-2a908c6a5995", "parentControlId": 31523, "controlId": "03.10.01.d", "title": "03.10.01.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586169" }, { "id": 579267, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "038b5836-25e6-55c3-888f-480b50841acb", "parentControlId": 31523, "controlId": "ACCESS-1e", "title": "ACCESS-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586171" }, { "id": 579268, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e80e745b-ec07-53b7-ae99-5d8bb002f3cd", "parentControlId": 31523, "controlId": "ACCESS-2b", "title": "ACCESS-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586171" }, { "id": 579269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef686d8c-4441-532e-bc74-5e7ffd851ff9", "parentControlId": 31523, "controlId": "ACCESS-2h", "title": "ACCESS-2h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586171" }, { "id": 579279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d49af2e-c9ff-5cb8-9bae-698f44c2057c", "parentControlId": 31523, "controlId": "CIP-004-7 4.3", "title": "CIP-004-7 4.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586172" }, { "id": 579280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "531b4be4-18f9-57d0-853a-b95313b0fcdf", "parentControlId": 31523, "controlId": "CIP-004-7 6.2", "title": "CIP-004-7 6.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586172" }, { "id": 579281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "537ffbec-9306-5cea-843a-54f537236a19", "parentControlId": 31523, "controlId": "CIP-004-7 6.2.1", "title": "CIP-004-7 6.2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586172" }, { "id": 579282, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf78cc48-2e16-5a64-a163-67072b97943b", "parentControlId": 31523, "controlId": "CIP-004-7 6.2.2", "title": "CIP-004-7 6.2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586172" }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "f6dcfe1e-52a1-56b1-8189-4a0bb40678c1", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "bbb51a60-39d2-5b4a-b725-f93c686d3057", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "d67d30bd-90ab-5dee-b59e-1433050f19e5", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "2399dd0c-57f3-5592-8d3f-7f31a2c55cc0", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "b7dc6f4b-72cb-53e6-86fd-c6453404ff16", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "e48cd679-15e7-5949-8f22-4450d535021c", "isPublic": true } ], "id": 31523, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731115", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731115", "catalogueId": 1062, "uuid": "e66b21c8-3b5a-5744-9132-c6a26baaf0c0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization periodically-review the privileges assigned to individuals and service accounts to validate the need for such privileges and reassign or remove unnecessary privileges, as necessary?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Periodic Review of Account Privileges", "description": "

Control Description

Mechanisms exist to periodically-review the privileges assigned to individuals and service accounts to validate the need for such privileges and reassign or remove unnecessary privileges, as necessary.

Evidence Request List (ERL)

E-HRS-12\nE-HRS-14\nE-IAM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.\n▪ IAM inventories all privileged accounts and validates that each person with elevated privileges is authorized by the appropriate level of organizational management.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to periodically-review the privileges assigned to individuals and service accounts to validate the need for such privileges and reassign or remove unnecessary privileges, as necessary.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-17", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-17", "references": "

Micro-Small Business (<10 staff)

∙ Annual review of user access rights

Small Business (10-49 staff)

∙ Periodic (at least annual) review of all user account privileges

Medium Business (50-249 staff)

∙ Formal quarterly/annual account privilege review process

Large Business (250-999 staff)

∙ Enterprise access certification program with automated review campaigns

Enterprise (>1,000 staff)

∙ Enterprise IGA platform (e.g., SailPoint, Saviynt, IBM Security Verify)\n∙ Automated access certification\n∙ Continuous access review", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71928, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590637", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590637", "securityControlId": 31524, "ccis": [], "uuid": "974f25f7-4fe6-5920-bdb6-c3f44950189c", "testId": "IAC-18_A01", "test": "authenticators are protected commensurate with the security category of the information to which use of the authenticator permits access.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-05(06)", "defaultText": null } ], "externalMappings": [ { "id": 579320, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586177", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "114cd284-ba52-5947-86f6-0d7098e6fd63", "parentControlId": 31524, "controlId": "5.17", "title": "5.17", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586177" }, { "id": 579324, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586177", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbb88864-851f-5aca-b1e7-55e83ce8db3c", "parentControlId": 31524, "controlId": "IA-5(6)", "title": "IA-5(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586177" }, { "id": 579325, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586178", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fad40222-1d89-556b-b037-d0590fb647d2", "parentControlId": 31524, "controlId": "IA-05(06)", "title": "IA-05(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586178" }, { "id": 579327, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586178", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5a7d975-c083-507a-ace5-d1c5527d9f81", "parentControlId": 31524, "controlId": "IA-05(06)", "title": "IA-05(06)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586178" }, { "id": 579328, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586178", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86f64dee-5749-5c55-8381-50bc2e9fbbe3", "parentControlId": 31524, "controlId": "IA-05(06)", "title": "IA-05(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586178" }, { "id": 579329, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586178", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a4c3134-7f88-5a33-8596-e0c1d0c5a3aa", "parentControlId": 31524, "controlId": "IA-05(06)", "title": "IA-05(06)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586178" }, { "id": 579330, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586178", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e624053f-4a11-5fa7-ab5e-ec432d4e7c8b", "parentControlId": 31524, "controlId": "IA-05(06)", "title": "IA-05(06)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586178" }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "2cf16640-fdfd-5dce-bff5-992a453ac654", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "0e4480a8-4511-533f-b168-566ead75b433", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "5dba3ab2-f150-5703-9616-725fc941bcd8", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "b4defe41-947d-5cb9-bd13-75261a34d1d2", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "d395bf63-5d7b-5df2-9435-66ead18fdb63", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "09375c23-83fa-5837-bdb0-fd70a44f23fe", "isPublic": true } ], "id": 31524, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731115", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731115", "catalogueId": 1062, "uuid": "a4f7806d-f044-5b94-a552-8de6a0cdcb9a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization compel users to follow accepted practices in the use of authentication mechanisms (e.g., passwords, passphrases, physical or logical security tokens, smart cards, certificates, etc.)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "User Responsibilities for Account Management", "description": "

Control Description

Mechanisms exist to compel users to follow accepted practices in the use of authentication mechanisms (e.g., passwords, passphrases, physical or logical security tokens, smart cards, certificates, etc.).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to compel users to follow accepted practices in the use of authentication mechanisms (e.g., passwords, passphrases, physical or logical security tokens, smart cards, certificates, etc.).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-18", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-18", "references": "

Micro-Small Business (<10 staff)

∙ Educate users about their responsibility for account security

Small Business (10-49 staff)

∙ User acceptable use policy covering account responsibilities

Medium Business (50-249 staff)

∙ Formal user account responsibility policy\n∙ Annual user acknowledgment

Large Business (250-999 staff)

∙ Enterprise acceptable use policy program\n∙ User training on account responsibilities

Enterprise (>1,000 staff)

∙ Enterprise security awareness program\n∙ User account responsibility training\n∙ Automated acknowledgment tracking", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71929, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590637", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590637", "securityControlId": 31525, "ccis": [], "uuid": "110f958d-38f4-5bce-a74c-7bc65051bd7d", "testId": "IAC-19_A01", "test": "the sharing of generic IDs, passwords or other generic authentication methods is prevented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 579346, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc68fded-0b63-5663-b456-03edb7e0bf7a", "parentControlId": 31525, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58618" }, { "controlId": "B.1.23", "title": "B.1.23 — Publicly Accessible Content", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-22", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "b4f8b8ee-3e52-59bb-a073-d864c2d13439", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.23", "title": "NEI 08-09 App D.1.23 — Publicly Accessible Content", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.23", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "8d1765f8-bef9-5ed3-a14b-0ac50522a41a", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.23", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "af7530f1-2951-58ab-aad9-251701e60c78", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "60516f13-02e8-56ef-9097-850a8ecbbddc", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "32412687-8764-595c-9d52-ba15df1a9bf2", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "06b08dd4-fe20-5ef2-b08b-2bafde90edae", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "a2c4050b-ad68-559e-b745-93c286a4c41b", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "73e85d09-9459-5cb4-856e-96f837bd6235", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "c3c20e2c-8691-507a-863d-61d3899cef7a", "isPublic": true } ], "id": 31525, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731115", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731115", "catalogueId": 1062, "uuid": "40727928-0249-5651-afe5-a256d148e8a9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prevent the sharing of generic IDs, passwords or other generic authentication methods?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Credential Sharing", "description": "

Control Description

Mechanisms exist to prevent the sharing of generic IDs, passwords or other generic authentication methods.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prevent the sharing of generic IDs, passwords or other generic authentication methods.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.23", "controlId": "IAC-19", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-19", "references": "

Micro-Small Business (<10 staff)

∙ Policy prohibiting sharing of credentials

Small Business (10-49 staff)

∙ Credential sharing prohibition policy\n∙ User training

Medium Business (50-249 staff)

∙ Formal credential sharing prohibition policy\n∙ Technical controls where possible

Large Business (250-999 staff)

∙ Enterprise policy and technical controls prohibiting credential sharing\n∙ PAM for shared account management

Enterprise (>1,000 staff)

∙ Enterprise IAM/PAM with technical enforcement against credential sharing\n∙ Shared account vaulting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71930, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590638", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590638", "securityControlId": 31526, "ccis": [], "uuid": "31598e22-4986-5a1a-b568-6e6a3220fba0", "testId": "IAC-20_A01", "test": "approved authorizations for logical access to information and system resources are enforced in accordance with applicable access control policies.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-03", "defaultText": null }, { "id": 71931, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590638", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590638", "securityControlId": 31526, "ccis": [], "uuid": "eb513cc8-1200-5a10-a86d-55c4ae31e1d9", "testId": "IAC-20_A02", "test": "the principle of least privilege is employed, allowing only authorized access for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-06", "defaultText": null }, { "id": 71932, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590638", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590638", "securityControlId": 31526, "ccis": [], "uuid": "30e51f80-a482-59c0-8e3a-318459c39396", "testId": "IAC-20_A03", "test": "authorized users are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.1[a]", "defaultText": null }, { "id": 71933, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590638", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590639", "securityControlId": 31526, "ccis": [], "uuid": "c62b926e-e271-5587-8fd7-691b2a3dfd14", "testId": "IAC-20_A04", "test": "processes acting on behalf of authorized users are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.1[b]", "defaultText": null }, { "id": 71934, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590639", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590639", "securityControlId": 31526, "ccis": [], "uuid": "fe4d954a-eed5-5403-b332-3a4f9a91c4c7", "testId": "IAC-20_A05", "test": "devices (including other systems) authorized to connect to the system are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.1[c]", "defaultText": null }, { "id": 71935, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590639", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590639", "securityControlId": 31526, "ccis": [], "uuid": "31fcf324-53fe-5895-9b52-b6e6a5246370", "testId": "IAC-20_A06", "test": "system access is limited to authorized users.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.1[d]", "defaultText": null }, { "id": 71936, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590639", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590639", "securityControlId": 31526, "ccis": [], "uuid": "c7460d12-6485-5090-b5f4-5c922a65116b", "testId": "IAC-20_A07", "test": "system access is limited to processes acting on behalf of authorized users.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.1[e]", "defaultText": null }, { "id": 71937, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590639", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590639", "securityControlId": 31526, "ccis": [], "uuid": "990551fb-d65e-553f-a303-d327e31999df", "testId": "IAC-20_A08", "test": "system access is limited to authorized devices (including other systems).
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.1[f]", "defaultText": null }, { "id": 71938, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590639", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590639", "securityControlId": 31526, "ccis": [], "uuid": "eb3ee29e-3783-5ae2-a8ac-877f6136109f", "testId": "IAC-20_A09", "test": "systems and system components included in the scope of the specified enhanced security requirements are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.3e_ODP[1]", "defaultText": null }, { "id": 71939, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590639", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590639", "securityControlId": 31526, "ccis": [], "uuid": "12fdeef6-afca-5167-aff7-e3e67bcae668", "testId": "IAC-20_A10", "test": "systems and system components are included in the scope of the specified enhanced security requirements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.3e[a]", "defaultText": null }, { "id": 71940, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59064", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59064", "securityControlId": 31526, "ccis": [], "uuid": "0c6d0bfe-d502-5b4f-b16d-399b14209318", "testId": "IAC-20_A11", "test": "systems and system components that are not included in systems and system components are segregated in purpose-specific networks.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.14.3e[b]", "defaultText": null } ], "externalMappings": [ { "id": 579377, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55a7fcdb-4ff7-5cea-9e54-53389682d9ff", "parentControlId": 31526, "controlId": "USER 2.1", "title": "USER 2.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586183" }, { "id": 579378, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d20aa8bb-0254-5cd2-9c21-86df35ba2365", "parentControlId": 31526, "controlId": "SR 2.1", "title": "SR 2.1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586184" }, { "id": 579379, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a7d18cc-a79f-5d20-a861-71e5ba9e9ecb", "parentControlId": 31526, "controlId": "SR 2.1 RE 1", "title": "SR 2.1 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586184" }, { "id": 579380, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "611838b3-d3a3-5919-89a3-64b6acde44c8", "parentControlId": 31526, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586184" }, { "id": 579383, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00e6456d-d8db-56a9-ae03-95ced04aaa6d", "parentControlId": 31526, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586184" }, { "id": 579384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90cc7e4f-3155-5889-ad48-da70793a01ff", "parentControlId": 31526, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586184" }, { "id": 579385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48d8f483-7371-5892-9884-5ea9a2918201", "parentControlId": 31526, "controlId": "T1003.002", "title": "T1003.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586184" }, { "id": 579386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e0abd80-7003-5f31-9161-14ff9d01c11e", "parentControlId": 31526, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586184" }, { "id": 579387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586185", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4468f65e-119b-5779-9b80-5c1ca14428b4", "parentControlId": 31526, "controlId": "T1003.004", "title": "T1003.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586185" }, { "id": 579388, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586185", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8e68c3d-83d3-56c3-91b9-25f59f99cbc2", "parentControlId": 31526, "controlId": "T1003.005", "title": "T1003.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586185" }, { "id": 579389, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586185", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "130f443e-fe0a-5b2b-82f9-08a116763070", "parentControlId": 31526, "controlId": "T1003.006", "title": "T1003.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586185" }, { "id": 579390, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586185", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e690519-5635-5714-8988-3cffdfb740ed", "parentControlId": 31526, "controlId": "T1003.007", "title": "T1003.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586185" }, { "id": 579391, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586185", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ae6364f-b146-5e75-b881-3e1b4afd68ba", "parentControlId": 31526, "controlId": "T1003.008", "title": "T1003.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586185" }, { "id": 579392, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586185", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67ec6b4d-cffc-5f10-a50b-bc203550da29", "parentControlId": 31526, "controlId": "T1005", "title": "T1005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586185" }, { "id": 579393, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586185", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f4aeb74-3c1b-5bfd-8a29-e91250893905", "parentControlId": 31526, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586185" }, { "id": 579394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586185", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0584b3a-3849-5564-8a04-362d2306cab8", "parentControlId": 31526, "controlId": "T1021", "title": "T1021", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586185" }, { "id": 579395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586186", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "710135d3-2481-5a9f-a012-f33c9bed3644", "parentControlId": 31526, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586186" }, { "id": 579396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586186", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4356aaee-1ef1-5689-8ead-a21fb38b3ea6", "parentControlId": 31526, "controlId": "T1021.002", "title": "T1021.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586186" }, { "id": 579397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586186", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "021488a9-3556-59dd-a9dc-d11e4fc6a48a", "parentControlId": 31526, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586186" }, { "id": 579398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586186", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8b953d6-4a2e-5dfb-a8ca-c866a6d193f2", "parentControlId": 31526, "controlId": "T1021.004", "title": "T1021.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586186" }, { "id": 579399, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586186", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "649d2d41-a309-599d-afe8-2378879229f3", "parentControlId": 31526, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586186" }, { "id": 579400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586186", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52530244-4e9c-5e91-95fa-613169b6dda3", "parentControlId": 31526, "controlId": "T1021.006", "title": "T1021.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586186" }, { "id": 579401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586186", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "557376ef-274a-59b9-be06-fa340b1a6627", "parentControlId": 31526, "controlId": "T1021.007", "title": "T1021.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586186" }, { "id": 579402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586186", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "012804a9-9746-5d40-8c7b-f1719b7bc843", "parentControlId": 31526, "controlId": "T1021.008", "title": "T1021.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586186" }, { "id": 579403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586186", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f9e6f89-0ead-5e86-b567-e77bb1ae1307", "parentControlId": 31526, "controlId": "T1025", "title": "T1025", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586186" }, { "id": 579404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586186", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c4422fa-1b90-5b17-adc4-75c0f834785e", "parentControlId": 31526, "controlId": "T1027", "title": "T1027", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586187" }, { "id": 579405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd35500b-ec9e-5a2c-9639-5a8552f43efe", "parentControlId": 31526, "controlId": "T1036", "title": "T1036", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586187" }, { "id": 579406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af9fea3b-b062-5ee1-b290-a2051012ef0d", "parentControlId": 31526, "controlId": "T1036.003", "title": "T1036.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586187" }, { "id": 579407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "402b464d-1a24-5bad-a65f-7498044d8256", "parentControlId": 31526, "controlId": "T1036.005", "title": "T1036.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586187" }, { "id": 579408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14db981d-d0a6-53ed-8333-e1c55a6c586e", "parentControlId": 31526, "controlId": "T1036.010", "title": "T1036.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586187" }, { "id": 579409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "316f5c92-c263-54db-a828-55b90a9993fb", "parentControlId": 31526, "controlId": "T1037", "title": "T1037", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586187" }, { "id": 579410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c11b43f-aafe-52d5-8f34-00848d58fa5e", "parentControlId": 31526, "controlId": "T1037.002", "title": "T1037.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586187" }, { "id": 579411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7cd3bec-7c09-5def-8419-74822b906a4a", "parentControlId": 31526, "controlId": "T1037.003", "title": "T1037.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586187" }, { "id": 579412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "224f25e6-95cd-52eb-b88f-27c3d3f56bfa", "parentControlId": 31526, "controlId": "T1037.004", "title": "T1037.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586187" }, { "id": 579413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29993717-c2a7-5154-9380-03af1a154942", "parentControlId": 31526, "controlId": "T1037.005", "title": "T1037.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586187" }, { "id": 579414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "145fdd06-289c-5fa9-8bfd-b3b96aa4aae8", "parentControlId": 31526, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586188" }, { "id": 579415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9886fe35-4758-55ba-9d53-5ed0fdb6a58c", "parentControlId": 31526, "controlId": "T1047", "title": "T1047", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586188" }, { "id": 579416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "083f51e7-68f2-5507-b355-3fb0492d967f", "parentControlId": 31526, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586188" }, { "id": 579417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93bbc5d4-e8cb-5cb3-bb6f-cac4d84b9aca", "parentControlId": 31526, "controlId": "T1048.001", "title": "T1048.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586188" }, { "id": 579418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01cd09ef-8b0e-5e69-b8c7-e91fc49fcaa0", "parentControlId": 31526, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586188" }, { "id": 579419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ec5475a-875c-548f-a8a4-5985e4528181", "parentControlId": 31526, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586188" }, { "id": 579420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586188", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae455631-51b5-5568-947d-16954d7ee17c", "parentControlId": 31526, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586188" }, { "id": 579421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dec41809-3dc6-5027-9808-5d58fbd1aef4", "parentControlId": 31526, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586189" }, { "id": 579422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7895432a-32f9-5e4f-a0b5-e4e83f8c9692", "parentControlId": 31526, "controlId": "T1053", "title": "T1053", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586189" }, { "id": 579423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "845b6497-f64d-581a-8f17-982a9a8f2079", "parentControlId": 31526, "controlId": "T1053.002", "title": "T1053.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586189" }, { "id": 579424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09d561c1-ef51-5a76-ab49-f295851dab3c", "parentControlId": 31526, "controlId": "T1053.003", "title": "T1053.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586189" }, { "id": 579425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3655e9b5-fcba-5c72-bcd2-1e982afb8781", "parentControlId": 31526, "controlId": "T1053.005", "title": "T1053.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586189" }, { "id": 579426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a17bcad8-5d7c-5fb4-82cb-f227622890b5", "parentControlId": 31526, "controlId": "T1053.006", "title": "T1053.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586189" }, { "id": 579427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1a77f43-c46b-562d-a6ea-3ddfa999588f", "parentControlId": 31526, "controlId": "T1053.007", "title": "T1053.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586189" }, { "id": 579428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "090c54f6-0e61-5664-ab08-b7a1f3359e86", "parentControlId": 31526, "controlId": "T1055", "title": "T1055", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586189" }, { "id": 579429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b49ed708-8787-5dc4-8ab9-b01809751724", "parentControlId": 31526, "controlId": "T1055.008", "title": "T1055.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586189" }, { "id": 579430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2eeed563-8815-5d38-8994-6c93306436c3", "parentControlId": 31526, "controlId": "T1055.009", "title": "T1055.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58619" }, { "id": 579431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "daf0cd5d-6bc0-55fe-b0fc-783b4c8b8837", "parentControlId": 31526, "controlId": "T1056.003", "title": "T1056.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58619" }, { "id": 579432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "570434a9-1586-5f8d-b795-904753e7039f", "parentControlId": 31526, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58619" }, { "id": 579433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd206bb0-4947-5e9e-a4f1-e254055dd919", "parentControlId": 31526, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58619" }, { "id": 579434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abf2ab06-f54e-5658-bad6-6a4aeec5ff5a", "parentControlId": 31526, "controlId": "T1059.002", "title": "T1059.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58619" }, { "id": 579435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07b6d1ee-67ea-51b3-bd80-8cfad21c78cf", "parentControlId": 31526, "controlId": "T1059.003", "title": "T1059.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58619" }, { "id": 579436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7b0cff0-60bb-5c46-98b8-9edde1fc75a1", "parentControlId": 31526, "controlId": "T1059.004", "title": "T1059.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58619" }, { "id": 579437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5534dcff-d5db-5cea-83fa-7e556ddb7ca5", "parentControlId": 31526, "controlId": "T1059.005", "title": "T1059.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58619" }, { "id": 579438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96dc94ea-dce9-581a-8552-b879cd533b34", "parentControlId": 31526, "controlId": "T1059.006", "title": "T1059.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58619" }, { "id": 579439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa2665f4-8078-5fe1-b013-c56e408ca58d", "parentControlId": 31526, "controlId": "T1059.007", "title": "T1059.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58619" }, { "id": 579440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b45f015f-6cb4-5678-82e0-be1dfbc6e401", "parentControlId": 31526, "controlId": "T1059.008", "title": "T1059.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586191" }, { "id": 579441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6db37c8f-8a1b-55da-87d6-9719e06be4d8", "parentControlId": 31526, "controlId": "T1059.009", "title": "T1059.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586191" }, { "id": 579442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07d7308c-0dbe-50fb-b449-f0e72c09b89d", "parentControlId": 31526, "controlId": "T1059.010", "title": "T1059.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586191" }, { "id": 579443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "936e2423-5a6f-51b0-9127-9943217e4cb4", "parentControlId": 31526, "controlId": "T1059.011", "title": "T1059.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586191" }, { "id": 579444, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe338a66-3eb1-5e27-90fa-0ea5bb4c10b5", "parentControlId": 31526, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586191" }, { "id": 579445, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a58e1b6-435f-5862-9667-7ae66db4d3cf", "parentControlId": 31526, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586191" }, { "id": 579446, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d083956a-1456-5a92-9c62-9d6ad013af52", "parentControlId": 31526, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586191" }, { "id": 579447, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f960d3c5-e471-54f8-b340-9f2ef8d349d0", "parentControlId": 31526, "controlId": "T1070.003", "title": "T1070.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586191" }, { "id": 579448, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0073863-e10e-55fe-985c-2d1afec27482", "parentControlId": 31526, "controlId": "T1070.007", "title": "T1070.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586192" }, { "id": 579449, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b90a192-4455-510d-9f13-4298a226be1f", "parentControlId": 31526, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586192" }, { "id": 579450, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b489d78b-6572-592b-990e-dc1035de8af2", "parentControlId": 31526, "controlId": "T1070.009", "title": "T1070.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586192" }, { "id": 579451, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3c01f5e-a7f8-5de8-a3b0-a32f02744444", "parentControlId": 31526, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586192" }, { "id": 579452, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4023e69b-88ca-5f37-99d1-c5cba9f96136", "parentControlId": 31526, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586192" }, { "id": 579453, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ca25025-d184-50fa-b1b0-c320ed192d06", "parentControlId": 31526, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586192" }, { "id": 579454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d16834c-d2e9-5440-b3ec-9fc9ff2ae68e", "parentControlId": 31526, "controlId": "T1078.002", "title": "T1078.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586192" }, { "id": 579455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9fe3580-5e04-5a09-b21c-c8c522c45407", "parentControlId": 31526, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586192" }, { "id": 579456, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "256f33e8-c44e-5bb1-bf15-215c3b62743b", "parentControlId": 31526, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586192" }, { "id": 579457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586192", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9713e04b-95b1-5905-8a8c-0222f1ff857a", "parentControlId": 31526, "controlId": "T1080", "title": "T1080", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586193" }, { "id": 579458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ea4db73-812a-5061-b64e-4050baaa0b80", "parentControlId": 31526, "controlId": "T1087.004", "title": "T1087.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586193" }, { "id": 579459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3ec9720-be96-5a75-9529-146a19375944", "parentControlId": 31526, "controlId": "T1090", "title": "T1090", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586193" }, { "id": 579460, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bc08c19-4731-5c50-8726-2d4411749c24", "parentControlId": 31526, "controlId": "T1090.003", "title": "T1090.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586193" }, { "id": 579461, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78e89753-3ca2-55c8-a039-353542397841", "parentControlId": 31526, "controlId": "T1091", "title": "T1091", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586193" }, { "id": 579462, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fe7ed36-bd27-572f-be70-4e747675035e", "parentControlId": 31526, "controlId": "T1095", "title": "T1095", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586193" }, { "id": 579463, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "269e9576-e073-5f9b-b8d8-cefded7ea038", "parentControlId": 31526, "controlId": "T1098", "title": "T1098", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586193" }, { "id": 579464, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b4b0a8d-1ca4-5d66-be76-a6152e0ad53e", "parentControlId": 31526, "controlId": "T1098.001", "title": "T1098.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586193" }, { "id": 579465, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de4e0235-9367-5e3f-9b6a-50f2d6d83ac4", "parentControlId": 31526, "controlId": "T1098.002", "title": "T1098.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586193" }, { "id": 579466, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3758e47-4631-5e31-b9bc-6db066d5fe1c", "parentControlId": 31526, "controlId": "T1098.003", "title": "T1098.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586194" }, { "id": 579467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5cb4455-2a62-5b18-ab0a-015a7385f47b", "parentControlId": 31526, "controlId": "T1098.004", "title": "T1098.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586194" }, { "id": 579468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "229ec9c2-5b14-5023-812c-41c8368d2035", "parentControlId": 31526, "controlId": "T1098.005", "title": "T1098.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586194" }, { "id": 579469, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25ed2bc1-90c2-5e8d-9d68-95394908a52a", "parentControlId": 31526, "controlId": "T1098.006", "title": "T1098.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586194" }, { "id": 579470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b94d159-926d-59e9-9fe2-f9f39d893883", "parentControlId": 31526, "controlId": "T1098.007", "title": "T1098.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586194" }, { "id": 579471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d1ffa8c-35a3-5ff3-acf5-2d6d1848d2a0", "parentControlId": 31526, "controlId": "T1110", "title": "T1110", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586194" }, { "id": 579472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f5f03bd-6c1f-5c7d-a71e-acc909acfff0", "parentControlId": 31526, "controlId": "T1110.001", "title": "T1110.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586194" }, { "id": 579473, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66d3d423-9a94-5dbd-b138-bfc14fe32f94", "parentControlId": 31526, "controlId": "T1110.002", "title": "T1110.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586194" }, { "id": 579474, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586194", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "125d983d-308d-5b15-b4b0-5a0f2c04c192", "parentControlId": 31526, "controlId": "T1110.003", "title": "T1110.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586194" }, { "id": 579475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac6fb365-36ff-5079-bc0d-6d362da76fcd", "parentControlId": 31526, "controlId": "T1110.004", "title": "T1110.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586195" }, { "id": 579476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32f6ed2a-1218-5f48-8412-db87d4e0bbe6", "parentControlId": 31526, "controlId": "T1114", "title": "T1114", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586195" }, { "id": 579477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac44131d-0a3e-5ecf-b044-8fd8ce455c8c", "parentControlId": 31526, "controlId": "T1114.002", "title": "T1114.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586195" }, { "id": 579478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02645fc6-360f-56a7-a1f8-ffc775e7221c", "parentControlId": 31526, "controlId": "T1133", "title": "T1133", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586195" }, { "id": 579479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fc7c322-7409-5e72-9287-b49e6f00af74", "parentControlId": 31526, "controlId": "T1134", "title": "T1134", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586195" }, { "id": 579480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc586cf0-41ec-5494-bfe4-c459b03177ba", "parentControlId": 31526, "controlId": "T1134.001", "title": "T1134.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586195" }, { "id": 579481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c5a3354-f0f8-534b-b184-dc80bb36df27", "parentControlId": 31526, "controlId": "T1134.002", "title": "T1134.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586195" }, { "id": 579482, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "530f1c96-1f2a-56ff-840d-a6a427e8234f", "parentControlId": 31526, "controlId": "T1134.003", "title": "T1134.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586195" }, { "id": 579483, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586195", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8031dbf7-e9f2-55b1-8f35-ee820b418603", "parentControlId": 31526, "controlId": "T1134.005", "title": "T1134.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586195" }, { "id": 579484, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9fff6aa-3ad7-5a39-a521-2a634f6ebe23", "parentControlId": 31526, "controlId": "T1136", "title": "T1136", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586196" }, { "id": 579485, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7086ad01-95d2-5c96-8da2-80e07541204a", "parentControlId": 31526, "controlId": "T1136.001", "title": "T1136.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586196" }, { "id": 579486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58b2fb49-f968-55c1-86fb-41e1b2bb4115", "parentControlId": 31526, "controlId": "T1136.002", "title": "T1136.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586196" }, { "id": 579487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ead38a92-5add-508d-93b5-bf03e832ed0c", "parentControlId": 31526, "controlId": "T1136.003", "title": "T1136.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586196" }, { "id": 579488, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28ef60e3-0826-519d-b559-7a5f2c3354ca", "parentControlId": 31526, "controlId": "T1185", "title": "T1185", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586196" }, { "id": 579489, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41a11cae-bc38-51b0-a8b1-1c745e57681b", "parentControlId": 31526, "controlId": "T1187", "title": "T1187", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586196" }, { "id": 579490, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9db7cef3-ae66-5c4c-84a2-47b3bc1aba87", "parentControlId": 31526, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586196" }, { "id": 579491, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40c9a617-3f33-5d13-a52a-ba069a9ffe80", "parentControlId": 31526, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586196" }, { "id": 579492, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586197", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1a19cb4-7918-55cd-9b7d-31918d88304e", "parentControlId": 31526, "controlId": "T1197", "title": "T1197", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586197" }, { "id": 579493, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586197", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8535968f-0a81-5340-b01e-727c5ad148f0", "parentControlId": 31526, "controlId": "T1199", "title": "T1199", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586197" }, { "id": 579494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586197", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a43f5bae-c90d-55bc-baeb-3888a251332c", "parentControlId": 31526, "controlId": "T1200", "title": "T1200", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586197" }, { "id": 579495, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586197", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f06fbf4c-9973-5183-ae39-faa396c5bca7", "parentControlId": 31526, "controlId": "T1205", "title": "T1205", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586197" }, { "id": 579496, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586197", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66fa9be5-6531-5492-a30a-b2099d72ae6b", "parentControlId": 31526, "controlId": "T1205.001", "title": "T1205.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586197" }, { "id": 579497, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586197", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee5e8502-a385-54cf-9783-f97ccd7dc053", "parentControlId": 31526, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586197" }, { "id": 579498, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586197", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9b2330c-bc8a-555f-bc0f-9b7fdfabea4e", "parentControlId": 31526, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586197" }, { "id": 579499, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586197", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a30ddea4-84bc-5f11-ad7d-48a38f3343bc", "parentControlId": 31526, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586197" }, { "id": 579500, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586197", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ed96293-2848-5454-8368-37fd521cde75", "parentControlId": 31526, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586197" }, { "id": 579501, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586197", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83ed8f6c-2983-5901-b3c4-0ede64f9f5be", "parentControlId": 31526, "controlId": "T1213.003", "title": "T1213.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586197" }, { "id": 579502, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586198", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "058cdbc0-6741-5c4e-b284-63cbadf16330", "parentControlId": 31526, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586198" }, { "id": 579503, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586198", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "241704ba-afee-5b09-a00e-664a5dd91e55", "parentControlId": 31526, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586198" }, { "id": 579504, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586198", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "425b1a60-763b-58ca-8368-56af4a5d6813", "parentControlId": 31526, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586198" }, { "id": 579505, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586198", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0c78dd4-423c-556c-87b2-05a2a68e751d", "parentControlId": 31526, "controlId": "T1218.002", "title": "T1218.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586198" }, { "id": 579506, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586198", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69fc9a5e-09ff-5578-934d-e58f09953773", "parentControlId": 31526, "controlId": "T1218.007", "title": "T1218.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586198" }, { "id": 579507, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586198", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "021ca262-b5a8-54b6-bea1-e3236c1500be", "parentControlId": 31526, "controlId": "T1218.012", "title": "T1218.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586198" }, { "id": 579508, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586198", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9cb70b90-d5e9-5c26-ab6e-0b975277c47d", "parentControlId": 31526, "controlId": "T1219", "title": "T1219", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586198" }, { "id": 579509, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586198", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34d45c51-f2df-5731-aa78-8d3550130294", "parentControlId": 31526, "controlId": "T1222", "title": "T1222", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586198" }, { "id": 579510, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586198", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "191d3163-e4bd-5a96-8274-f502fa48f203", "parentControlId": 31526, "controlId": "T1222.001", "title": "T1222.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586198" }, { "id": 579511, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586199", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b51ccc62-965a-5d02-87a8-7753452276bd", "parentControlId": 31526, "controlId": "T1222.002", "title": "T1222.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586199" }, { "id": 579512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586199", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a57b541f-168e-50d8-94eb-f57e50a901cb", "parentControlId": 31526, "controlId": "T1484", "title": "T1484", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586199" }, { "id": 579513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586199", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "434e1f3e-0112-5946-9ba6-2169e55315c9", "parentControlId": 31526, "controlId": "T1485", "title": "T1485", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586199" }, { "id": 579514, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586199", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5685198c-893e-5f7c-88f3-a1365c615596", "parentControlId": 31526, "controlId": "T1485.001", "title": "T1485.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586199" }, { "id": 579515, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586199", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1086697f-d616-5ebc-b2c1-61f50089bc43", "parentControlId": 31526, "controlId": "T1486", "title": "T1486", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586199" }, { "id": 579516, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586199", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aac23006-ba36-585b-a3bc-66d237c60fcc", "parentControlId": 31526, "controlId": "T1489", "title": "T1489", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586199" }, { "id": 579517, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586199", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e0f1acf-d4c2-55d2-815f-5d6a5d7b5461", "parentControlId": 31526, "controlId": "T1490", "title": "T1490", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586199" }, { "id": 579518, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5862", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "773aa7a0-6286-5855-8473-1f023c532159", "parentControlId": 31526, "controlId": "T1491", "title": "T1491", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5862" }, { "id": 579519, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5862", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e242e9f0-917a-5722-a03a-7284eef667cd", "parentControlId": 31526, "controlId": "T1491.001", "title": "T1491.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5862" }, { "id": 579520, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5862", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a7465f5-c74d-5d7e-a96b-6275457eab15", "parentControlId": 31526, "controlId": "T1491.002", "title": "T1491.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5862" }, { "id": 579521, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5862", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4abc4895-5601-5821-9183-4d3867c39f76", "parentControlId": 31526, "controlId": "T1495", "title": "T1495", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5862" }, { "id": 579522, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5862", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f989e725-db1e-5c7c-bece-81d05f90e7c2", "parentControlId": 31526, "controlId": "T1498", "title": "T1498", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5862" }, { "id": 579523, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5862", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a27a9a3-b745-5471-9d38-d2474836be6f", "parentControlId": 31526, "controlId": "T1498.001", "title": "T1498.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5862" }, { "id": 579524, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5862", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31435182-f86d-5913-8e45-3b6793e26c28", "parentControlId": 31526, "controlId": "T1498.002", "title": "T1498.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5862" }, { "id": 579525, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5862", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c9dac1d-c16d-58ce-bf92-85f500967252", "parentControlId": 31526, "controlId": "T1499", "title": "T1499", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5862" }, { "id": 579526, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5862", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "680f2171-4092-5726-a617-00cebd19ea70", "parentControlId": 31526, "controlId": "T1499.001", "title": "T1499.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5862" }, { "id": 579527, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a55ccf60-39d6-5625-9af8-d2632e0ad732", "parentControlId": 31526, "controlId": "T1499.002", "title": "T1499.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586201" }, { "id": 579528, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a3603c5-fcb7-5291-b1aa-a96fd55f889e", "parentControlId": 31526, "controlId": "T1499.003", "title": "T1499.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586201" }, { "id": 579529, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4407078b-fdd2-522b-9301-6490f74b7462", "parentControlId": 31526, "controlId": "T1499.004", "title": "T1499.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586201" }, { "id": 579530, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bc0b85c-bcf9-5012-a440-5ef9cad4d5d0", "parentControlId": 31526, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586201" }, { "id": 579531, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b1e1143-772b-5bf9-b0ca-9effe7fb862d", "parentControlId": 31526, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586201" }, { "id": 579532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fe1f94f-e4ee-5770-9cc4-0f24f3d9dc78", "parentControlId": 31526, "controlId": "T1505.003", "title": "T1505.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586201" }, { "id": 579533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bde4da6a-ed27-5279-a469-4b10e9207e45", "parentControlId": 31526, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586201" }, { "id": 579534, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcc99c06-b00e-5478-8092-1311d77d0470", "parentControlId": 31526, "controlId": "T1505.005", "title": "T1505.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586201" }, { "id": 579535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b84e0a28-758c-5e59-b031-2dd161999ea4", "parentControlId": 31526, "controlId": "T1525", "title": "T1525", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586201" }, { "id": 579536, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "862fb350-3c0f-530a-871c-333b2d26d085", "parentControlId": 31526, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586201" }, { "id": 579537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c4da58f-3e61-5458-9041-86f435298c45", "parentControlId": 31526, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586202" }, { "id": 579538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04eafdbb-b757-5933-9c4e-9644aaf3f627", "parentControlId": 31526, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586202" }, { "id": 579539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfc4ada3-9a0b-599e-8c60-a68e32ef400e", "parentControlId": 31526, "controlId": "T1538", "title": "T1538", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586202" }, { "id": 579540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6e01cc5-de2b-5b36-8f20-a1775e884a2d", "parentControlId": 31526, "controlId": "T1539", "title": "T1539", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586202" }, { "id": 579541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "744ddace-531c-514e-9753-9a7d7cce5c47", "parentControlId": 31526, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586202" }, { "id": 579542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d32ad7c-1b01-5452-ba76-0b25379d7706", "parentControlId": 31526, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586202" }, { "id": 579543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586202", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91494f7c-0ea1-5eab-866a-87c3aadaf4d2", "parentControlId": 31526, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586202" }, { "id": 579544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "181e0bf6-9b3c-5ac2-bf5c-7af238c48da9", "parentControlId": 31526, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586203" }, { "id": 579545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c2dc2c4-ce5d-5f8e-a74f-65760c3f1cdf", "parentControlId": 31526, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586203" }, { "id": 579546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0df4620-22a4-5370-b5e8-23207c273733", "parentControlId": 31526, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586203" }, { "id": 579547, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "032c0935-8f6c-5a35-89a2-cc39cf2ba4d8", "parentControlId": 31526, "controlId": "T1543.001", "title": "T1543.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586203" }, { "id": 579548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3382f2c9-71c4-58fd-a8df-2c34fa783e96", "parentControlId": 31526, "controlId": "T1543.002", "title": "T1543.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586203" }, { "id": 579549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfbc15f3-b58e-58b8-8db3-5c95c678600e", "parentControlId": 31526, "controlId": "T1543.003", "title": "T1543.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586203" }, { "id": 579550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5265923e-783f-5986-906b-8188575bc003", "parentControlId": 31526, "controlId": "T1543.004", "title": "T1543.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586203" }, { "id": 579551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "982fcfdf-f9cb-5fdc-98fd-afb245290914", "parentControlId": 31526, "controlId": "T1543.005", "title": "T1543.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586203" }, { "id": 579552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aaba3a8c-c994-5043-bd26-960e675b10ec", "parentControlId": 31526, "controlId": "T1546", "title": "T1546", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586203" }, { "id": 579553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "064c7464-61b3-538f-859e-0ae8bb16d8ad", "parentControlId": 31526, "controlId": "T1546.003", "title": "T1546.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586204" }, { "id": 579554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6910e0d-9190-583b-87ec-6c1e72ba5979", "parentControlId": 31526, "controlId": "T1546.004", "title": "T1546.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586204" }, { "id": 579555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cfaa7292-e722-5c23-a9f1-eb46f1cea8a1", "parentControlId": 31526, "controlId": "T1546.013", "title": "T1546.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586204" }, { "id": 579556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d8d87ec-2593-5f46-a888-af4023d7d5fc", "parentControlId": 31526, "controlId": "T1547.003", "title": "T1547.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586204" }, { "id": 579557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ddd1aba8-dd75-5bc8-b867-7ba7e5dd4661", "parentControlId": 31526, "controlId": "T1547.004", "title": "T1547.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586204" }, { "id": 579558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6650c841-050e-5375-9242-4f23cc2b902f", "parentControlId": 31526, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586204" }, { "id": 579559, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd84ba5b-a376-50df-a40e-6baef0e35869", "parentControlId": 31526, "controlId": "T1547.007", "title": "T1547.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586204" }, { "id": 579560, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f0776fc-0c4a-5a99-876b-8262fc614137", "parentControlId": 31526, "controlId": "T1547.009", "title": "T1547.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586204" }, { "id": 579561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15fdb4af-0df8-5634-85e9-cf47e88c3270", "parentControlId": 31526, "controlId": "T1547.012", "title": "T1547.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586204" }, { "id": 579562, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "504088c1-9cc8-5cf9-8d58-b55dcd07bc8c", "parentControlId": 31526, "controlId": "T1547.013", "title": "T1547.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586204" }, { "id": 579563, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586205", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95da3a39-8823-59a7-90fd-237e826a0d19", "parentControlId": 31526, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586205" }, { "id": 579564, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586205", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86112cad-dee0-5380-a06a-c1c1db270929", "parentControlId": 31526, "controlId": "T1548.002", "title": "T1548.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586205" }, { "id": 579565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586205", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a5c533d-8dd6-5d42-89a6-90b3e0d27adb", "parentControlId": 31526, "controlId": "T1548.003", "title": "T1548.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586205" }, { "id": 579566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586213", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03a91fb2-6c0b-5f3f-89f4-77d37fa99dbb", "parentControlId": 31526, "controlId": "T1548.005", "title": "T1548.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586213" }, { "id": 579567, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586213", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a76aec41-59f9-56da-ab6c-d81aa1fb5f66", "parentControlId": 31526, "controlId": "T1548.006", "title": "T1548.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586213" }, { "id": 579568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586213", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a418080-9715-56a3-a556-fd0a697533f4", "parentControlId": 31526, "controlId": "T1550", "title": "T1550", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586213" }, { "id": 579569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586214", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc2f854c-04f4-5746-b235-47d2027d8688", "parentControlId": 31526, "controlId": "T1550.002", "title": "T1550.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586214" }, { "id": 579570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586214", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "868a35f4-8c15-52d7-8cac-88069f604a37", "parentControlId": 31526, "controlId": "T1550.003", "title": "T1550.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586214" }, { "id": 579571, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586214", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a88d87f-f033-5106-ad46-81fef4a7b2ec", "parentControlId": 31526, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586214" }, { "id": 579572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586214", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ae3f7a8-25dc-58d9-9298-ec0d608a6e66", "parentControlId": 31526, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586214" }, { "id": 579573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586214", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b23a123-acca-567a-bafd-16766c6cc604", "parentControlId": 31526, "controlId": "T1552.005", "title": "T1552.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586214" }, { "id": 579574, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586214", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f14b9894-c17d-5bb6-8877-a77eb61240a7", "parentControlId": 31526, "controlId": "T1552.007", "title": "T1552.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586214" }, { "id": 579575, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586214", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2ae3c79-2ba5-5967-b7a4-06ff97c32860", "parentControlId": 31526, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586214" }, { "id": 579576, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586214", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "902d5efb-bff9-523d-b710-0552a362e5bd", "parentControlId": 31526, "controlId": "T1553.003", "title": "T1553.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586214" }, { "id": 579577, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ed9d177-131b-5eaa-9498-bd93e8dcccea", "parentControlId": 31526, "controlId": "T1555", "title": "T1555", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586215" }, { "id": 579578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "506693b4-e46d-5d50-b218-e0db277538e8", "parentControlId": 31526, "controlId": "T1555.002", "title": "T1555.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586215" }, { "id": 579579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8cc8159a-90c1-5cf9-8ee8-a071ea28521d", "parentControlId": 31526, "controlId": "T1555.005", "title": "T1555.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586215" }, { "id": 579580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c05666a-5a37-5fd0-bd86-807e7898b9ad", "parentControlId": 31526, "controlId": "T1555.006", "title": "T1555.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586215" }, { "id": 579581, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e435378c-89c4-5cd1-8e87-297f1e4f8d27", "parentControlId": 31526, "controlId": "T1556", "title": "T1556", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586215" }, { "id": 579582, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c44fa09-1e3e-56fb-b7f3-14f1c3f9409f", "parentControlId": 31526, "controlId": "T1556.001", "title": "T1556.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586215" }, { "id": 579583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2139699b-2829-5ef9-8cf8-4f9ef5e99ce8", "parentControlId": 31526, "controlId": "T1556.003", "title": "T1556.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586215" }, { "id": 579584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "871dd607-dbd1-52c4-9ce5-6094e6da9913", "parentControlId": 31526, "controlId": "T1556.004", "title": "T1556.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586215" }, { "id": 579585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33c7f665-14ea-5775-bc1d-39619ea059cb", "parentControlId": 31526, "controlId": "T1556.006", "title": "T1556.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586215" }, { "id": 579586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb4db474-b1ec-563e-8381-6cd65f63bf7b", "parentControlId": 31526, "controlId": "T1556.007", "title": "T1556.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586216" }, { "id": 579587, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586216", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa3f9067-3ecd-5f17-b15c-8587850c3db0", "parentControlId": 31526, "controlId": "T1556.008", "title": "T1556.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586216" }, { "id": 579588, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586216", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbc2f7c1-7ac0-56df-977b-6d0767d8c8d4", "parentControlId": 31526, "controlId": "T1556.009", "title": "T1556.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586216" }, { "id": 579589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586216", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66e4a241-9abe-5514-9d88-bb2089545291", "parentControlId": 31526, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586216" }, { "id": 579590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586216", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1811c924-cb91-5de1-9978-825070f696ca", "parentControlId": 31526, "controlId": "T1557.001", "title": "T1557.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586216" }, { "id": 579591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586216", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6005bb8-cc67-52cf-9f5f-86ecf1fbd185", "parentControlId": 31526, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586216" }, { "id": 579592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586216", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1770d41f-fb6f-5970-910c-fd5193e89abb", "parentControlId": 31526, "controlId": "T1557.003", "title": "T1557.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586216" }, { "id": 579593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586216", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "084e23eb-aaad-5240-b830-fecef23e1da4", "parentControlId": 31526, "controlId": "T1557.004", "title": "T1557.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586216" }, { "id": 579594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586216", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbaf41e4-4b7f-5d3a-a80a-69b58cb6c225", "parentControlId": 31526, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586217" }, { "id": 579595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abe3972e-4d2c-5fea-89a8-4caa90ed98b6", "parentControlId": 31526, "controlId": "T1558.001", "title": "T1558.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586217" }, { "id": 579596, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f27451bc-e1b3-5466-98a8-1aaa2d1f253e", "parentControlId": 31526, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586217" }, { "id": 579597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c37d56a0-19af-5dc4-b69c-916987ad3184", "parentControlId": 31526, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586217" }, { "id": 579598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1420a9a-1906-5001-8ef0-bfdd9cd7a008", "parentControlId": 31526, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586217" }, { "id": 579599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd8bf16b-8efa-511b-9a26-94ce9edbab7a", "parentControlId": 31526, "controlId": "T1558.005", "title": "T1558.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586217" }, { "id": 579600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "319cb57d-65b4-5d52-911c-d68ab5033dce", "parentControlId": 31526, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586217" }, { "id": 579601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66458aa8-48da-5508-939b-d2c7771f081c", "parentControlId": 31526, "controlId": "T1559.001", "title": "T1559.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586217" }, { "id": 579602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "394662b2-7ad8-5a20-9575-74c5bab01455", "parentControlId": 31526, "controlId": "T1561", "title": "T1561", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586217" }, { "id": 579603, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a37635e5-e31c-569f-afe9-457510e113b9", "parentControlId": 31526, "controlId": "T1561.001", "title": "T1561.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586217" }, { "id": 579604, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ccae7c7b-69f3-59a2-a6bb-d4a05c9287af", "parentControlId": 31526, "controlId": "T1561.002", "title": "T1561.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586218" }, { "id": 579605, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7209f5ce-2610-58c0-aca7-3ade3662c241", "parentControlId": 31526, "controlId": "T1562", "title": "T1562", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586218" }, { "id": 579606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58d7e87a-4395-5ce9-b990-20103e39a9b8", "parentControlId": 31526, "controlId": "T1562.001", "title": "T1562.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586218" }, { "id": 579607, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cbff900-9bd2-53a6-8db2-3ad52b21769e", "parentControlId": 31526, "controlId": "T1562.002", "title": "T1562.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586218" }, { "id": 579608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40d2017b-32df-5069-842c-dfae82451d97", "parentControlId": 31526, "controlId": "T1562.004", "title": "T1562.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586218" }, { "id": 579609, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50d5e3f0-2eff-5ea4-aea6-5128bb430073", "parentControlId": 31526, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586218" }, { "id": 579610, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "419dc0b9-dd6c-571c-abe8-8fb10b9ef979", "parentControlId": 31526, "controlId": "T1562.007", "title": "T1562.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586218" }, { "id": 579611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c5648f0-67a9-5bae-be7d-60d9606e71d6", "parentControlId": 31526, "controlId": "T1562.008", "title": "T1562.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586218" }, { "id": 579612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1f20042-76e1-5b69-98c6-62a74ad7eef8", "parentControlId": 31526, "controlId": "T1562.009", "title": "T1562.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586218" }, { "id": 579613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9e7843c-ef4f-52c7-9565-d824a237ef38", "parentControlId": 31526, "controlId": "T1562.012", "title": "T1562.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586218" }, { "id": 579614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586219", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7f6eca0-2793-5380-b70f-1dbec9fa8879", "parentControlId": 31526, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586219" }, { "id": 579615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586219", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b531b4b-b867-5403-b80c-66d75c806a34", "parentControlId": 31526, "controlId": "T1563.001", "title": "T1563.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586219" }, { "id": 579616, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586219", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8f5923d-8961-5613-ad7f-abfe38797a25", "parentControlId": 31526, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586219" }, { "id": 579617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586219", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9919e1aa-3205-5949-b353-2eb8310385e3", "parentControlId": 31526, "controlId": "T1564.004", "title": "T1564.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586219" }, { "id": 579618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586219", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3799e856-6c5e-5036-a3e3-cff0efc0d0d0", "parentControlId": 31526, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586219" }, { "id": 579619, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e01513aa-53b9-55a5-8030-95e46c6476e0", "parentControlId": 31526, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58622" }, { "id": 579620, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb9bac37-7900-5371-9b2d-bab34050f307", "parentControlId": 31526, "controlId": "T1565.003", "title": "T1565.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58622" }, { "id": 579621, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4f274b2-8975-584a-9ea3-fb0e87ac2101", "parentControlId": 31526, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58622" }, { "id": 579622, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e2aa4fc-6237-5be9-8a0c-10226a5c3303", "parentControlId": 31526, "controlId": "T1569", "title": "T1569", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58622" }, { "id": 579623, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f9424ae-38af-51ea-bf81-c109381dd45f", "parentControlId": 31526, "controlId": "T1569.001", "title": "T1569.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58622" }, { "id": 579624, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "474217b2-0ccf-5236-b186-2d6e5d969f11", "parentControlId": 31526, "controlId": "T1569.002", "title": "T1569.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58622" }, { "id": 579625, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a9d482e-14b4-5103-afaa-7b3f636c1f13", "parentControlId": 31526, "controlId": "T1570", "title": "T1570", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58622" }, { "id": 579626, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "306a4ca6-6088-50cb-882d-a73379646610", "parentControlId": 31526, "controlId": "T1572", "title": "T1572", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58622" }, { "id": 579627, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73bdcfd5-c476-5ab8-881a-9843a7e290ee", "parentControlId": 31526, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58622" }, { "id": 579628, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586221", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e0081ae-9dcf-54dc-8c12-8b8d3d0fcc4f", "parentControlId": 31526, "controlId": "T1574.004", "title": "T1574.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586221" }, { "id": 579629, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586221", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c00aa5b0-9ba0-5ed9-9892-8fb7bea32b06", "parentControlId": 31526, "controlId": "T1574.005", "title": "T1574.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586221" }, { "id": 579630, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586221", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10320869-8378-57f2-b064-fb7ac8fefd2f", "parentControlId": 31526, "controlId": "T1574.007", "title": "T1574.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586221" }, { "id": 579631, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586221", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d18985b5-241f-53c4-8349-702138de465d", "parentControlId": 31526, "controlId": "T1574.008", "title": "T1574.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586221" }, { "id": 579632, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586221", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1be881f-8878-5161-bf1e-004921f4c427", "parentControlId": 31526, "controlId": "T1574.009", "title": "T1574.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586221" }, { "id": 579633, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586221", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e920009b-87f3-5ba7-8137-e735f910c5dd", "parentControlId": 31526, "controlId": "T1574.010", "title": "T1574.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586221" }, { "id": 579634, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586221", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "250a5f9e-9060-50c6-9886-cd9e3c47e53c", "parentControlId": 31526, "controlId": "T1574.012", "title": "T1574.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586221" }, { "id": 579635, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586221", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3008446-5c62-5a02-a475-496961d5cbf8", "parentControlId": 31526, "controlId": "T1574.014", "title": "T1574.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586221" }, { "id": 579636, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586221", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36a54f70-03f4-5b83-8844-5eff7ccf441a", "parentControlId": 31526, "controlId": "T1578", "title": "T1578", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586221" }, { "id": 579637, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cada2fc0-fdb8-51b2-bdb4-fc48d1d48a93", "parentControlId": 31526, "controlId": "T1578.001", "title": "T1578.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586222" }, { "id": 579638, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "847c3f01-4fa5-5b43-ae67-0efb46debb82", "parentControlId": 31526, "controlId": "T1578.002", "title": "T1578.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586222" }, { "id": 579639, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38bcb797-2505-5ce7-9cf6-925d1fcce989", "parentControlId": 31526, "controlId": "T1578.003", "title": "T1578.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586222" }, { "id": 579640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "957f3f09-f03b-5092-8050-f4c0886bb99b", "parentControlId": 31526, "controlId": "T1578.005", "title": "T1578.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586222" }, { "id": 579641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "500b1045-4592-5f29-bf93-bc2334c96d0c", "parentControlId": 31526, "controlId": "T1580", "title": "T1580", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586222" }, { "id": 579642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4abd1882-bcb2-5072-9fdc-cda51528f626", "parentControlId": 31526, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586222" }, { "id": 579643, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42d08890-041a-5572-85d5-5575ce9d52e3", "parentControlId": 31526, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586222" }, { "id": 579644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c7ab7ee-d0d5-58ce-b2cf-3069cc351a4f", "parentControlId": 31526, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586222" }, { "id": 579645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f7d2f9c-c6bc-5c80-8d4a-31b0f460d688", "parentControlId": 31526, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586223" }, { "id": 579646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5bee2e6c-0f03-5070-9f40-db9f501ab013", "parentControlId": 31526, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586223" }, { "id": 579647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d357bccd-9186-5034-a9b6-71636b932a6b", "parentControlId": 31526, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586223" }, { "id": 579648, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd0309ec-86d1-5125-b2b9-c88bf295d298", "parentControlId": 31526, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586223" }, { "id": 579649, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89216fe9-db20-5e0e-95e4-9cff447d616e", "parentControlId": 31526, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586223" }, { "id": 579650, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41d411da-ea43-5f4e-8ddd-16db92f4d1eb", "parentControlId": 31526, "controlId": "T1606", "title": "T1606", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586223" }, { "id": 579651, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11142e79-9a1f-5633-a852-0a28ce0c1388", "parentControlId": 31526, "controlId": "T1606.001", "title": "T1606.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586223" }, { "id": 579652, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef1b9614-0555-5763-a597-b44dd52242d5", "parentControlId": 31526, "controlId": "T1606.002", "title": "T1606.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586223" }, { "id": 579653, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dff4135c-7661-59f4-84cb-016cadaab49c", "parentControlId": 31526, "controlId": "T1609", "title": "T1609", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586223" }, { "id": 579654, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586224", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "631d943a-a3ed-5d59-8484-cd179b98f21f", "parentControlId": 31526, "controlId": "T1610", "title": "T1610", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586224" }, { "id": 579655, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586224", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62dd23e7-baf1-567d-8efc-aa88ad9a575b", "parentControlId": 31526, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586224" }, { "id": 579656, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586224", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "419f383b-bb31-592b-af2b-e249f985f308", "parentControlId": 31526, "controlId": "T1612", "title": "T1612", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586224" }, { "id": 579657, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586224", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f7370e0-6a48-54bd-ae2a-fa98d888e3ba", "parentControlId": 31526, "controlId": "T1613", "title": "T1613", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586224" }, { "id": 579658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586224", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50a617eb-90ed-5c2a-a5ce-7a52bbc891e0", "parentControlId": 31526, "controlId": "T1619", "title": "T1619", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586224" }, { "id": 579659, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586224", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9abb709a-479c-565e-a219-381292ed9beb", "parentControlId": 31526, "controlId": "T1622", "title": "T1622", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586224" }, { "id": 579660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586224", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8627f913-c649-5289-b137-e0a0e7611cd2", "parentControlId": 31526, "controlId": "T1647", "title": "T1647", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586224" }, { "id": 579661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586224", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f2e0a99-bb66-58e6-9a14-341a3a895912", "parentControlId": 31526, "controlId": "T1648", "title": "T1648", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586224" }, { "id": 579662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586224", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50c1e3c2-ea17-5c33-a0b9-710e6783facf", "parentControlId": 31526, "controlId": "T1651", "title": "T1651", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586224" }, { "id": 579663, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586224", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b09b79e-a481-5187-821d-b18864ef4af9", "parentControlId": 31526, "controlId": "T1654", "title": "T1654", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586225" }, { "id": 579665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586225", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d18b288a-a9d8-50ce-886a-eccf2432e235", "parentControlId": 31526, "controlId": "AC-3", "title": "AC-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586225" }, { "id": 579666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586225", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac80f39e-0e33-53ff-b0c0-1c4384e99605", "parentControlId": 31526, "controlId": "AC-6", "title": "AC-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586225" }, { "id": 579667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586225", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b6c3366-e58d-55d2-96e9-fcf4a1af7193", "parentControlId": 31526, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586225" }, { "id": 579668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586225", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "719b5e64-4b95-52ce-ac14-42246e25f3c3", "parentControlId": 31526, "controlId": "AC-06", "title": "AC-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586225" }, { "id": 579671, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586225", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4707da33-2b11-55e0-81ca-1520124713e9", "parentControlId": 31526, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586225" }, { "id": 579672, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f788d10-c2c8-57e3-aad1-4e3a621571f2", "parentControlId": 31526, "controlId": "AC-06", "title": "AC-06", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586226" }, { "id": 579673, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3443dac-ca2f-5ee8-b03d-3b0c0d1d8f8b", "parentControlId": 31526, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586226" }, { "id": 579674, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7a0432b-011d-53b5-beb1-c1e75844baef", "parentControlId": 31526, "controlId": "AC-06", "title": "AC-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586226" }, { "id": 579675, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1767b862-5575-5b2c-8c95-89182ac16194", "parentControlId": 31526, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586226" }, { "id": 579676, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65a77f72-9c80-599e-8815-25fd7916e816", "parentControlId": 31526, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586226" }, { "id": 579677, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b28c1c6-831c-523c-8f38-17a8faa46748", "parentControlId": 31526, "controlId": "AC-06", "title": "AC-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586226" }, { "id": 579678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6c9cfe5-730e-5cf1-8ccf-206105116b57", "parentControlId": 31526, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586226" }, { "id": 579679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70686f13-a942-5491-9d9f-e0afa42bae9e", "parentControlId": 31526, "controlId": "AC-06", "title": "AC-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586226" }, { "id": 579681, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586227", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "882fb87b-a80c-5887-b38b-c40775db2444", "parentControlId": 31526, "controlId": "AC-3", "title": "AC-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586227" }, { "id": 579682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586227", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65ff7fd3-6394-5ef7-a5f1-f4170ad3d590", "parentControlId": 31526, "controlId": "AC-6", "title": "AC-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586227" }, { "id": 579683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586227", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "645d2ca4-b009-577a-bc19-e9b1436679a7", "parentControlId": 31526, "controlId": "AC-3", "title": "AC-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586227" }, { "id": 579684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586227", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff83326a-71ee-5c71-a6be-49d33593d3bf", "parentControlId": 31526, "controlId": "AC-3", "title": "AC-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586227" }, { "id": 579687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586227", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4717808-9bf6-5f12-a504-61a7502dcd7c", "parentControlId": 31526, "controlId": "3.1.1", "title": "3.1.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586227" }, { "id": 579688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586227", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9f8b67d-5cb1-5ef5-b8d3-8b083672dc55", "parentControlId": 31526, "controlId": "03.01.01.c.03", "title": "03.01.01.c.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586227" }, { "id": 579689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586227", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed106bb8-df9e-5bf8-8a24-3fcdb06e89fa", "parentControlId": 31526, "controlId": "03.01.01.d.01", "title": "03.01.01.d.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586227" }, { "id": 579690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586228", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8814865c-a4b5-50b2-92c5-afe5a4d3f563", "parentControlId": 31526, "controlId": "03.01.01.d.02", "title": "03.01.01.d.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586228" }, { "id": 579691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586228", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94846496-47fa-58a5-a14f-4356dbb0e9e5", "parentControlId": 31526, "controlId": "03.01.02", "title": "03.01.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586228" }, { "id": 579692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586228", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38a28693-95eb-5307-81b4-c2e63c2b8194", "parentControlId": 31526, "controlId": "03.01.03", "title": "03.01.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586228" }, { "id": 579693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586228", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a95b2f46-6e9a-53fd-a26e-ad14ccf7177f", "parentControlId": 31526, "controlId": "03.01.04.b", "title": "03.01.04.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586228" }, { "id": 579694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586228", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "285fe7e7-2f56-5933-940a-196558839a79", "parentControlId": 31526, "controlId": "03.01.05.a", "title": "03.01.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586228" }, { "id": 579695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586228", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "139d1c51-929e-536d-bb55-c1b6068108f3", "parentControlId": 31526, "controlId": "03.01.05.b", "title": "03.01.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586228" }, { "id": 579696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586228", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55d2bf69-5292-566c-8432-a2bb00b25108", "parentControlId": 31526, "controlId": "03.01.06.a", "title": "03.01.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586228" }, { "id": 579697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586228", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2486959d-788f-5b07-bea5-24f91ce489c0", "parentControlId": 31526, "controlId": "03.09.02.b.02", "title": "03.09.02.b.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586228" }, { "id": 579728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586232", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80362707-dcd8-5a74-9151-0b19795dd85c", "parentControlId": 31526, "controlId": "ACCESS-2d", "title": "ACCESS-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586232" }, { "controlId": "B.1.3", "title": "B.1.3 — Access Enforcement", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "bb35b2c3-b78d-52a6-901d-1478425e5976", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.3", "title": "NEI 08-09 App D.1.3 — Access Enforcement", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e0017962-28c2-5014-8b9c-4cc31121b575", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "04528d7e-9e1f-508d-9259-afcd8a4c291f", "isPublic": true }, { "controlId": "B.1.5", "title": "B.1.5 — Separation of Functions", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a63a34bb-8694-5c15-b757-c5c77d66ca10", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.5", "title": "NEI 08-09 App D.1.5 — Separation of Functions", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "05009034-000d-5838-ba1b-ca5ba33bba1a", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7fc06998-9db5-596f-8cc1-29ddefbacf79", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "bb132372-47f5-5d15-a84b-e60d330a4c11", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "ab548808-3c77-5500-986c-eb130a80cca6", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "61dc78c9-d324-527d-ba94-7c2b29181ce5", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "d75c1f11-08ab-5f9a-b37e-ec4fdc2f5ae2", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "02a50829-d3b1-5eea-9ad5-492b5462b034", "isPublic": true } ], "id": 31526, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731116", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731116", "catalogueId": 1062, "uuid": "e2114219-ff1c-5a27-b716-01c0a159d8ba", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege?\"

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Access Enforcement", "description": "

Control Description

Mechanisms exist to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enforce Logical Access Control (LAC) permissions that conform to the principle of \"least privilege.\"

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.3, B.1.5", "controlId": "IAC-20", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-20", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71941, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59064", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59064", "securityControlId": 31527, "ccis": [], "uuid": "f29ed82b-2016-58ee-8281-39eaf56a0478", "testId": "IAC-20.1_A01", "test": "access to sensitive / regulated data is restricted to only those individuals whose job requires such access.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 71942, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59064", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59064", "securityControlId": 31527, "ccis": [], "uuid": "7791bcb6-6087-5326-9dd8-5ed3eebb3e24", "testId": "IAC-20.1_A02", "test": "access to is authorized.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at a minimum and if applicable: establishing system accounts and assigning privileges, configuring access authorizations, configuring settings for events to be audited, establishing vulnerability scanning parameters, establishing intrusion detection parameters, and managing audit information", "otherId": "171A_R3_A.03.01.05.b[01]", "defaultText": null }, { "id": 71943, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59064", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59064", "securityControlId": 31527, "ccis": [], "uuid": "90024bf1-1c00-5b6b-88a8-452dade1e39c", "testId": "IAC-20.1_A03", "test": "access to is authorized.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at a minimum and if applicable: threat and vulnerability information, filtering rules for routers or firewalls, configuration parameters for security services, cryptographic key management information, security architecture, access control lists, and audit information", "otherId": "171A_R3_A.03.01.05.b[02]", "defaultText": null }, { "id": 71944, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590641", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590641", "securityControlId": 31527, "ccis": [], "uuid": "2eb3da3c-0ea8-559c-9eb4-7ab71222b263", "testId": "IAC-20.1_A04", "test": "the incident response plan is protected from unauthorized disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.06.05.d", "defaultText": null } ], "externalMappings": [ { "id": 579779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21390b90-afd2-5821-a170-a6c3261f2648", "parentControlId": 31527, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586238" }, { "id": 579781, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d37f3565-a5a8-5be9-b1b0-d0b8ce0ad2f7", "parentControlId": 31527, "controlId": "03.01.01.c.03", "title": "03.01.01.c.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586238" }, { "id": 579782, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "514a900a-a9be-5206-a707-5beef4ab50a9", "parentControlId": 31527, "controlId": "03.01.01.d.01", "title": "03.01.01.d.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586238" }, { "id": 579783, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0780d4dc-4f12-5fd5-85bf-4e09dbf4687f", "parentControlId": 31527, "controlId": "03.01.01.d.02", "title": "03.01.01.d.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586238" }, { "id": 579784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a9d5d3f-bbaa-5a0d-b5c2-0f09267d5941", "parentControlId": 31527, "controlId": "03.01.02", "title": "03.01.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586238" }, { "id": 579785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07916c8f-a694-5f3b-805a-d15e8e8f4190", "parentControlId": 31527, "controlId": "03.01.03", "title": "03.01.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586238" }, { "id": 579786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac4e8583-8735-5779-9285-47251f3d68bd", "parentControlId": 31527, "controlId": "03.01.04.b", "title": "03.01.04.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586238" }, { "id": 579787, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586238", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0e0073a-ef0f-553f-8a51-21000f9da948", "parentControlId": 31527, "controlId": "03.01.05.a", "title": "03.01.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586238" }, { "id": 579788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586239", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ccdd9c2-9018-59f6-bed2-50831bbe4811", "parentControlId": 31527, "controlId": "03.06.05.d", "title": "03.06.05.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586239" }, { "id": 579789, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586241", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70e78645-a3e3-5517-a577-75ff03f821e9", "parentControlId": 31527, "controlId": "03.10.01.a", "title": "03.10.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586241" } ], "id": 31527, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731116", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731116", "catalogueId": 1062, "uuid": "e13cde3c-8a6f-555b-9398-838982083f63", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization limit access to sensitive/regulated data to only those individuals whose job requires such access?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Access To Sensitive / Regulated Data", "description": "

Control Description

Mechanisms exist to limit access to sensitive/regulated data to only those individuals whose job requires such access.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to limit access to sensitive/regulated data to only those individuals whose job requires such access.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "IAC-20.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-20.1", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71945, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590641", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590641", "securityControlId": 31528, "ccis": [], "uuid": "1a53982b-d10a-5413-8321-b06d61e934cf", "testId": "IAC-20.2_A01", "test": "access to database containing sensitive / regulated data is restricted to only necessary services or those individuals whose job requires such access.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 579823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "474067f5-b05d-5cd9-b928-fadca5c43931", "parentControlId": 31528, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586245" } ], "id": 31528, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731116", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731116", "catalogueId": 1062, "uuid": "47d00ff5-1e26-555e-8896-da81ebb75dfa", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict access to databases containing sensitive/regulated data to only necessary Technology Assets, Applications and/or Services (TAAS) or those individuals whose job requires such access?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Database Access", "description": "

Control Description

Mechanisms exist to restrict access to databases containing sensitive/regulated data to only necessary Technology Assets, Applications and/or Services (TAAS) or those individuals whose job requires such access.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict access to databases containing sensitive/regulated data to only necessary Technology Assets, Applications and/or Services (TAAS) or those individuals whose job requires such access.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "IAC-20.2", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-20.2", "references": "

Micro-Small Business (<10 staff)

∙ Restrict database access to only authorized personnel

Small Business (10-49 staff)

∙ Database access control policy\n∙ Named accounts for database access

Medium Business (50-249 staff)

∙ Formal database access control policy\n∙ Least-privilege database accounts

Large Business (250-999 staff)

∙ Enterprise database access control (e.g., Oracle DB Security, SQL Server RBAC)\n∙ PAM for DBA accounts

Enterprise (>1,000 staff)

∙ Enterprise database security platform (e.g., Imperva Data Security, IBM Guardium)\n∙ PAM for database access\n∙ Database activity monitoring (DAM)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71946, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590641", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590641", "securityControlId": 31529, "ccis": [], "uuid": "11eae71d-b8c4-5eb2-8e04-3fa6dc1634d1", "testId": "IAC-20.3_A01", "test": "access to utility programs that are capable of overriding system and application controls is restricted.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 579831, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4096ab61-a09b-5c5a-8a05-85b217926436", "parentControlId": 31529, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586246" }, { "id": 579832, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3fcbdd4-9361-56b6-adc3-3055eea5a036", "parentControlId": 31529, "controlId": "8.18", "title": "8.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586246" } ], "id": 31529, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731117", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731117", "catalogueId": 1062, "uuid": "0413461d-c6ad-5e31-876e-52845815ef4c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict and tightly control utility programs that are capable of overriding system and application controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Use of Privileged Utility Programs", "description": "

Control Description

Mechanisms exist to restrict and tightly control utility programs that are capable of overriding system and application controls.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict and tightly control utility programs that are capable of overriding system and application controls.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-20.3", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-20.3", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71948, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590642", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590642", "securityControlId": 31531, "ccis": [], "uuid": "3b53fe19-332d-5772-8096-d4b68b48bf43", "testId": "IAC-20.5_A01", "test": "privileged commands and/or other actions requiring dual authorization are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-03(02)_ODP", "defaultText": null }, { "id": 71949, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590642", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590642", "securityControlId": 31531, "ccis": [], "uuid": "db3ce471-344e-5f4a-bfff-49e74e71b8fe", "testId": "IAC-20.5_A02", "test": "dual authorization is enforced for organization-defined privileged commands and/or other actions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-03(02)", "defaultText": null }, { "id": 71950, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590642", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590642", "securityControlId": 31531, "ccis": [], "uuid": "6ce8e9bc-e994-54e8-91da-ffe992c4c655", "testId": "IAC-20.5_A03", "test": "critical or sensitive system and organizational operations for which dual authorization is to be enforced are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.1.1e[a]\n53A_R5_CM-05(04)_ODP[01]", "defaultText": null }, { "id": 71951, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590643", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590643", "securityControlId": 31531, "ccis": [], "uuid": "e5cb2444-2af4-56e8-b2fe-a47de8ae9e4b", "testId": "IAC-20.5_A04", "test": "dual authorization is employed to execute critical or sensitive system and organizational operations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "172A_3.1.1e[b]\n53A_R5_CM-05(04)[01]\n53A_R5_CM-05(04)[02]", "defaultText": null } ], "externalMappings": [ { "id": 579868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "047837e0-15a3-5810-af66-2b7121cd194e", "parentControlId": 31531, "controlId": "USER 2.3", "title": "USER 2.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58625" }, { "id": 579869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83c56960-3ae2-59af-8e95-1038535b672c", "parentControlId": 31531, "controlId": "USER 2.4", "title": "USER 2.4", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586251" }, { "id": 579870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "caca4d16-6223-53af-ade4-0a2700fde28e", "parentControlId": 31531, "controlId": "SR 2.1 RE 4", "title": "SR 2.1 RE 4", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586251" }, { "id": 579871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13f7b7a3-a67e-5ae6-a960-51fa7ef72387", "parentControlId": 31531, "controlId": "AC-3(2)", "title": "AC-3(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586251" }, { "id": 579872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64164ee0-9ddf-56a3-a83f-bd3523008a37", "parentControlId": 31531, "controlId": "AC-03(02)", "title": "AC-03(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586251" }, { "id": 579874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23357430-1bdf-5ab9-bc68-316abf81aed0", "parentControlId": 31531, "controlId": "AC-03(02)", "title": "AC-03(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586251" } ], "id": 31531, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731117", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731117", "catalogueId": 1062, "uuid": "a3a7cdff-7111-511a-8136-3832e7687dbb", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to enforce dual authorization for privileged commands?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Dual Authorization for Privileged Commands", "description": "

Control Description

Automated mechanisms exist to enforce dual authorization for privileged commands.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically enforce dual authorization for privileged commands.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-20.5", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-20.5", "references": "

Micro-Small Business (<10 staff)

∙ Require manager approval before executing critical privileged commands

Small Business (10-49 staff)

∙ Dual authorization policy for high-risk privileged commands

Medium Business (50-249 staff)

∙ Formal dual authorization process for privileged commands\n∙ Approval workflow

Large Business (250-999 staff)

∙ Enterprise PAM with dual-authorization workflow for privileged commands

Enterprise (>1,000 staff)

∙ Enterprise PAM platform with two-person integrity (2PI) for critical commands (e.g., CyberArk)\n∙ Automated approval workflow", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71952, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590643", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590643", "securityControlId": 31532, "ccis": [], "uuid": "efd73576-cc4a-5d5f-9cb0-43ef8ad5eafa", "testId": "IAC-20.6_A01", "test": "rules governing the timing of revocations of access authorizations are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-03(08)_ODP", "defaultText": null }, { "id": 71953, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590643", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590643", "securityControlId": 31532, "ccis": [], "uuid": "b0cc3cdf-9e49-51aa-838d-5c8769b01e77", "testId": "IAC-20.6_A02", "test": "revocation of access authorizations is enforced, resulting from changes to the cybersecurity / data privacy attributes of subjects based on organization-defined rules.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-03(08)[01]", "defaultText": null }, { "id": 71954, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590643", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590643", "securityControlId": 31532, "ccis": [], "uuid": "340fa11b-1dc4-5b60-bee9-54a0d22deedf", "testId": "IAC-20.6_A03", "test": "revocation of access authorizations is enforced resulting from changes to the cybersecurity / data privacy attributes of objects based on organization-defined rules.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-03(08)[02]", "defaultText": null } ], "externalMappings": [ { "id": 579881, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf9f9660-a8b2-5f05-b24c-b443224ba3f7", "parentControlId": 31532, "controlId": "AC-03(08)", "title": "AC-03(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586252" }, { "id": 579882, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35660be7-b4b9-50fc-a755-fe2293012ac5", "parentControlId": 31532, "controlId": "AC-03(08)", "title": "AC-03(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586252" }, { "id": 579883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "398960ed-2eb8-5abc-98f3-8711567dd49d", "parentControlId": 31532, "controlId": "AC-3(8)", "title": "AC-3(8)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586252" }, { "id": 579893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586261", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "440f5c71-5ee9-567f-b168-d206cff27e98", "parentControlId": 31532, "controlId": "CIP-004-7 R5", "title": "CIP-004-7 R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586261" }, { "id": 579894, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586261", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75f47673-b2cc-527f-9c0f-63bb08dd1aa7", "parentControlId": 31532, "controlId": "CIP-004-7 5.1", "title": "CIP-004-7 5.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586261" }, { "id": 579895, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586261", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ecdad400-7316-5e3c-a2f5-636697025af7", "parentControlId": 31532, "controlId": "CIP-004-7 5.2", "title": "CIP-004-7 5.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586261" }, { "id": 579896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5dde2ba9-e905-538e-869b-7741c6987e2d", "parentControlId": 31532, "controlId": "CIP-004-7 5.3", "title": "CIP-004-7 5.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586262" }, { "id": 579897, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6b52ff7-1d2b-5a7b-95e4-def861812c44", "parentControlId": 31532, "controlId": "CIP-013-2 1.2.3", "title": "CIP-013-2 1.2.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586262" }, { "controlId": "CIP-004-7-R5", "title": "CIP-004-7-R5 — Access Revocation Process", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "23f68e3a-110b-518b-873e-ff6da450d960", "isPublic": true }, { "controlId": "CIP-004-7-5.1", "title": "CIP-004-7-5.1 — A process to initiate removal of an individual’s ability for unescorted physical access and Interactive Remote Access...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3de07109-21c7-5d45-b1fa-9c46f3e10c76", "isPublic": true }, { "controlId": "CIP-004-7-5.2", "title": "CIP-004-7-5.2 — For reassignments or transfers, revoke the individual’s authorized electronic access to individual accounts and autho...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "952b8b9d-faf4-5cbf-aaa5-e5c353c30bd5", "isPublic": true }, { "controlId": "CIP-004-7-5.3", "title": "CIP-004-7-5.3 — For termination actions, revoke the individual’s non-shared user accounts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4961aa4e-8bfa-528a-9901-e187a90d7c60", "isPublic": true }, { "controlId": "CIP-004-7-5.4", "title": "CIP-004-7-5.4 — For termination actions, change passwords for shared account(s) known to the user within 30 calendar days of the term...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "24802a1e-5808-5f0e-90b1-2318f488e70d", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d7196ba5-e6bd-5cf7-a83e-0c1b5b2e08fb", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "502e1f3e-5887-5f6c-97ed-f93855b8dd95", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "4dbbbb2c-65e1-5ba3-8ad0-9b24cee673f8", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "11a7d5ee-f56d-535b-8be7-9dcd2f85da6a", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "8af9ea6d-c81f-5ff1-b433-d06f3464544c", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "8429961b-c13f-5320-81f1-abcb8a20f560", "isPublic": true } ], "id": 31532, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731118", "catalogueId": 1062, "uuid": "52e6907d-f14f-5e5b-b3cc-9d6e1ef364b4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization revoke logical and physical access authorizations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Revocation of Access Authorizations", "description": "

Control Description

Mechanisms exist to revoke logical and physical access authorizations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.\n▪ IAM revokes user access rights in a timely manner, up on termination of employment or contract.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to revoke logical and physical access authorizations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

NERC-CIP (2026) Requirements: CIP-004-7-R5", "controlId": "IAC-20.6", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-20.6", "references": "

Micro-Small Business (<10 staff)

∙ Revoke access authorizations promptly when no longer needed

Small Business (10-49 staff)

∙ Access revocation procedure\n∙ Prompt removal when authorization changes

Medium Business (50-249 staff)

∙ Formal access revocation policy\n∙ Timely removal of authorizations

Large Business (250-999 staff)

∙ Enterprise IAM with automated access revocation workflows

Enterprise (>1,000 staff)

∙ Enterprise IGA platform with automated access revocation\n∙ Event-driven revocation (HR termination, role change)\n∙ Access certification for ongoing validation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71957, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590644", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590644", "securityControlId": 31534, "ccis": [], "uuid": "9086fc3a-d1e3-5134-a96f-67c9c71eafb1", "testId": "IAC-21_A01", "test": "organization-defined systems or system components implement the security design principle of least privilege.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SA-08(14)", "defaultText": null }, { "id": 71958, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590644", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590644", "securityControlId": 31534, "ccis": [], "uuid": "b6c48eaa-577e-5984-ba1b-783820cfd9ca", "testId": "IAC-21_A02", "test": "privileged accounts are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.5[a]", "defaultText": null }, { "id": 71959, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590645", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590645", "securityControlId": 31534, "ccis": [], "uuid": "fd72dc7a-fd22-5636-b728-9cc3edc3afe4", "testId": "IAC-21_A03", "test": "access to privileged accounts is authorized in accordance with the principle of least privilege.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.5[b]\n53A_R5_AC-06", "defaultText": null }, { "id": 71960, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590645", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590645", "securityControlId": 31534, "ccis": [], "uuid": "bc96a746-6906-56af-8e4a-417cc8709e18", "testId": "IAC-21_A04", "test": "systems or system components that implement the security design principle of least privilege are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08(14)_ODP", "defaultText": null }, { "id": 71961, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590645", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590645", "securityControlId": 31534, "ccis": [], "uuid": "3becab0c-f692-5072-b653-e7d373435583", "testId": "IAC-21_A05", "test": "approved authorizations for logical access to system resources are enforced in accordance with applicable access control policies.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.02[02]", "defaultText": null }, { "id": 71962, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590654", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590654", "securityControlId": 31534, "ccis": [], "uuid": "4477b29b-f800-53f9-ba2d-e239f45c22f2", "testId": "IAC-21_A06", "test": "system access for users (or processes acting on behalf of users) is authorized only when necessary to accomplish assigned organizational tasks.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.05.a", "defaultText": null }, { "id": 71963, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590654", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590654", "securityControlId": 31534, "ccis": [], "uuid": "8ea61c60-72f2-58ee-946f-a8c88243ba19", "testId": "IAC-21.1_A01", "test": "security functions are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.5[c]", "defaultText": null }, { "id": 71964, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590654", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590654", "securityControlId": 31534, "ccis": [], "uuid": "8dfd9859-f907-5314-8879-80e45b13c0ed", "testId": "IAC-21.1_A02", "test": "access to security functions is authorized in accordance with the principle of least privilege.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.5[d]", "defaultText": null } ], "externalMappings": [ { "id": 579919, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586264", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aaac15b6-cea6-5479-a261-7c51d2b96e3e", "parentControlId": 31534, "controlId": "5.15", "title": "5.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586264" }, { "id": 579920, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586264", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17417fb1-ad54-5565-8c7a-e2a340c87a27", "parentControlId": 31534, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586264" }, { "id": 579921, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "522f56af-d274-5b2d-a828-d1bd7855ccac", "parentControlId": 31534, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586265" }, { "id": 579922, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b603c245-0073-5acd-af29-8435358b6f97", "parentControlId": 31534, "controlId": "8.12", "title": "8.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586265" }, { "id": 579931, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586266", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a05db74-bc7c-5601-b7c2-b61baf380f13", "parentControlId": 31534, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586266" }, { "id": 579932, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586266", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5199d186-8457-5db1-9925-37ca3b346ce6", "parentControlId": 31534, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586266" }, { "id": 579933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586266", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3393e165-3ae8-5ce1-81b7-91a02f69d9f4", "parentControlId": 31534, "controlId": "T1003.002", "title": "T1003.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586266" }, { "id": 579934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586266", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d667860-41f2-5def-b81c-d63497311a3d", "parentControlId": 31534, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586266" }, { "id": 579935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586266", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3986893f-db7d-534c-bb14-74696645f7ae", "parentControlId": 31534, "controlId": "T1003.004", "title": "T1003.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586266" }, { "id": 579936, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586266", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fa2ddb1-290c-549b-9e5b-35a379e0de94", "parentControlId": 31534, "controlId": "T1003.005", "title": "T1003.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586266" }, { "id": 579937, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586266", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72bf9d65-47d2-53a6-a5d1-9e1a405c82c6", "parentControlId": 31534, "controlId": "T1003.006", "title": "T1003.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586266" }, { "id": 579938, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586266", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e029af31-1e2e-5301-bd9d-f16b1080a96b", "parentControlId": 31534, "controlId": "T1003.007", "title": "T1003.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586266" }, { "id": 579939, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586266", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb96670d-586b-5162-ba65-dd2d169ea63e", "parentControlId": 31534, "controlId": "T1003.008", "title": "T1003.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586267" }, { "id": 579940, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586267", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39b16be1-b1cf-5c1f-88a6-e179f0ef066d", "parentControlId": 31534, "controlId": "T1005", "title": "T1005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586267" }, { "id": 579941, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586267", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2790fdbf-bf1d-5422-9744-28ab2bc69ecd", "parentControlId": 31534, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586267" }, { "id": 579942, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586267", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb8ccecf-a083-519c-b2c7-1c478d5a99f0", "parentControlId": 31534, "controlId": "T1021", "title": "T1021", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586267" }, { "id": 579943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586267", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f873297-5aa4-537a-bb28-1434b685003b", "parentControlId": 31534, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586267" }, { "id": 579944, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586267", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64075a2e-da4f-5373-95d2-6e740253e91a", "parentControlId": 31534, "controlId": "T1021.002", "title": "T1021.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586267" }, { "id": 579945, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586267", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d800bd72-6c4e-569e-b1fb-2725c9ea4cbc", "parentControlId": 31534, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586267" }, { "id": 579946, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22855ef8-2982-512d-ba5d-cd38e0036ae9", "parentControlId": 31534, "controlId": "T1021.004", "title": "T1021.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586268" }, { "id": 579947, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a21f3a5-bb69-5941-bc33-0db308fbce79", "parentControlId": 31534, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586268" }, { "id": 579948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "907daf7c-12b7-51e6-ae3f-e2714328fe8c", "parentControlId": 31534, "controlId": "T1021.006", "title": "T1021.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586268" }, { "id": 579949, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d361d7b6-d4c3-5a86-8157-4a556042a970", "parentControlId": 31534, "controlId": "T1021.007", "title": "T1021.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586268" }, { "id": 579950, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a063cbd0-1eba-5c9b-86c2-cce5b5aaef84", "parentControlId": 31534, "controlId": "T1021.008", "title": "T1021.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586268" }, { "id": 579951, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0b9cb4f-5282-5805-973a-1fb05ab1881d", "parentControlId": 31534, "controlId": "T1025", "title": "T1025", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586268" }, { "id": 579952, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9aa0b39-64fb-5155-8cd2-557c7064bb6e", "parentControlId": 31534, "controlId": "T1036", "title": "T1036", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586268" }, { "id": 579953, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4867ec1-130b-59cf-a588-c3b253af8d1e", "parentControlId": 31534, "controlId": "T1036.003", "title": "T1036.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586268" }, { "id": 579954, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9efde166-2eae-59ec-8af2-1bd7128dd2a5", "parentControlId": 31534, "controlId": "T1036.005", "title": "T1036.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586268" }, { "id": 579955, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1673abf-19f5-53ec-a0bb-459bd7469e0d", "parentControlId": 31534, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586269" }, { "id": 579956, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6b57256-959f-5599-91c2-63bb5f525971", "parentControlId": 31534, "controlId": "T1047", "title": "T1047", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586269" }, { "id": 579957, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d905f10-014e-5132-8c1d-774955e82c62", "parentControlId": 31534, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586269" }, { "id": 579958, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9a20148-4979-5465-a6f3-bdfe070d3741", "parentControlId": 31534, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586269" }, { "id": 579959, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d4cdf36-2c69-5f64-8c35-5f963b4d193b", "parentControlId": 31534, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586269" }, { "id": 579960, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19e370da-181c-57c3-8d9a-e3eca0539934", "parentControlId": 31534, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586269" }, { "id": 579961, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b03fd36-e559-53d6-b567-a201e98327fb", "parentControlId": 31534, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586269" }, { "id": 579962, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1ae0a84-d1db-56ed-9530-d4f18130ea07", "parentControlId": 31534, "controlId": "T1053", "title": "T1053", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586269" }, { "id": 579963, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5dece8b-8d4b-500b-85a0-cebfb426e8a7", "parentControlId": 31534, "controlId": "T1053.002", "title": "T1053.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586269" }, { "id": 579964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b612b17-ea8d-584b-a04b-2d6ff76534a7", "parentControlId": 31534, "controlId": "T1053.003", "title": "T1053.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586269" }, { "id": 579965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f063430-eccf-507b-aa47-79eac97acbd1", "parentControlId": 31534, "controlId": "T1053.005", "title": "T1053.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58627" }, { "id": 579966, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6fce89f-13e9-539c-9156-19eb16afd7e6", "parentControlId": 31534, "controlId": "T1053.006", "title": "T1053.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58627" }, { "id": 579967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8147eefa-6610-5216-a9e3-c9e655678b5e", "parentControlId": 31534, "controlId": "T1053.007", "title": "T1053.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58627" }, { "id": 579968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "400d91c4-95ae-537f-a7c2-820c96a58859", "parentControlId": 31534, "controlId": "T1055", "title": "T1055", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58627" }, { "id": 579969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03188ebe-6bf6-58a5-b1de-960273f5c54a", "parentControlId": 31534, "controlId": "T1055.001", "title": "T1055.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58627" }, { "id": 579970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a104c1e2-05c5-5f33-8319-25c5c466f701", "parentControlId": 31534, "controlId": "T1055.002", "title": "T1055.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58627" }, { "id": 579971, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1619760e-5726-59fa-9767-aa57201d43b0", "parentControlId": 31534, "controlId": "T1055.003", "title": "T1055.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58627" }, { "id": 579972, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "183876a2-4530-538a-966f-cc0b15e82f7c", "parentControlId": 31534, "controlId": "T1055.004", "title": "T1055.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58627" }, { "id": 579973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91c53db6-65b1-5c25-88e7-68d2ac209dd2", "parentControlId": 31534, "controlId": "T1055.005", "title": "T1055.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586271" }, { "id": 579974, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04380bae-bfe4-5478-8cfa-9f4385f1f9c9", "parentControlId": 31534, "controlId": "T1055.008", "title": "T1055.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586271" }, { "id": 579975, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d5e2921-b5c9-571c-9da3-07d2720fed72", "parentControlId": 31534, "controlId": "T1055.009", "title": "T1055.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586271" }, { "id": 579976, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8cb061d8-5a7d-583e-a825-609b8697584a", "parentControlId": 31534, "controlId": "T1055.011", "title": "T1055.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586271" }, { "id": 579977, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abf846ec-ebd5-5a6d-98e2-4cc9493fa7c7", "parentControlId": 31534, "controlId": "T1055.012", "title": "T1055.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586271" }, { "id": 579978, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1b220c8-79f1-535b-98ab-04d275e88ebd", "parentControlId": 31534, "controlId": "T1055.013", "title": "T1055.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586271" }, { "id": 579979, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "416fb38a-ba65-5775-b966-b05a0f27499f", "parentControlId": 31534, "controlId": "T1055.014", "title": "T1055.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586271" }, { "id": 579980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75c12dc1-3332-5b09-95c1-4854d19ec1dc", "parentControlId": 31534, "controlId": "T1056.003", "title": "T1056.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586271" }, { "id": 579981, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0604a15-fec5-5bc2-a703-de59d2bb394f", "parentControlId": 31534, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586271" }, { "id": 579982, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "660545ca-fc5e-5331-b0bb-37db372f07cd", "parentControlId": 31534, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586272" }, { "id": 579983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7aba8997-c220-59ed-8ea5-06527fa74695", "parentControlId": 31534, "controlId": "T1059.002", "title": "T1059.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586272" }, { "id": 579984, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "476bba82-3868-5c23-aeb0-eaa8553c5cdf", "parentControlId": 31534, "controlId": "T1059.003", "title": "T1059.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586272" }, { "id": 579985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8e832ac-7c23-5155-910d-6392387f4534", "parentControlId": 31534, "controlId": "T1059.004", "title": "T1059.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586272" }, { "id": 579986, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c93d8789-cacc-56b8-a571-2a8760e48437", "parentControlId": 31534, "controlId": "T1059.005", "title": "T1059.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586272" }, { "id": 579987, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a629aff-169e-5f93-a4d6-e5ba5755bc12", "parentControlId": 31534, "controlId": "T1059.006", "title": "T1059.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586272" }, { "id": 579988, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41c2bf93-afce-5b52-9f9e-6c83644993ae", "parentControlId": 31534, "controlId": "T1059.007", "title": "T1059.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586272" }, { "id": 579989, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08fd9292-d0f8-562d-a795-567fbf9d9faa", "parentControlId": 31534, "controlId": "T1059.008", "title": "T1059.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586272" }, { "id": 579990, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a94047ba-8243-55ff-be5e-dadac6d304f2", "parentControlId": 31534, "controlId": "T1059.009", "title": "T1059.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586272" }, { "id": 579991, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92f0eb21-15ad-5d56-b98c-e6b6fec98896", "parentControlId": 31534, "controlId": "T1059.010", "title": "T1059.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586273" }, { "id": 579992, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c015ed6-19c9-5d0a-b83d-3e4480eff3e9", "parentControlId": 31534, "controlId": "T1059.011", "title": "T1059.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586273" }, { "id": 579993, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07394d70-99b5-518f-a22c-8d5f66233ab6", "parentControlId": 31534, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586273" }, { "id": 579994, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c596554-2f01-576b-b5e9-8481a6cd4f90", "parentControlId": 31534, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586273" }, { "id": 579995, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b7cab5e-66f8-5803-a4a1-032ced38a0a1", "parentControlId": 31534, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586273" }, { "id": 579996, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46a21169-bb02-5736-a387-affdf5bbd4b6", "parentControlId": 31534, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586273" }, { "id": 579997, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3356e39-a225-572b-91de-4db67b9d1cec", "parentControlId": 31534, "controlId": "T1070.003", "title": "T1070.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586273" }, { "id": 579998, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5bbe359-b50a-5931-a2a4-567a8878bc39", "parentControlId": 31534, "controlId": "T1070.007", "title": "T1070.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586273" }, { "id": 579999, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9e3540a-64a2-5053-b665-0ed5c77ce483", "parentControlId": 31534, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586273" }, { "id": 580000, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec180035-e5ee-521f-b8e1-3d604f7eaa26", "parentControlId": 31534, "controlId": "T1070.009", "title": "T1070.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586274" }, { "id": 580001, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "979a68aa-9ad5-5e3e-85fa-a50732d0d835", "parentControlId": 31534, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586274" }, { "id": 580002, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8e18910-4ef0-508b-bb26-bf81263fe711", "parentControlId": 31534, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586274" }, { "id": 580003, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd056a5f-a5de-50d6-ba56-e74012c36105", "parentControlId": 31534, "controlId": "T1078.001", "title": "T1078.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586274" }, { "id": 580004, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d79e26e6-71fb-5545-ad10-72975df42756", "parentControlId": 31534, "controlId": "T1078.002", "title": "T1078.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586274" }, { "id": 580005, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0522f493-629c-56a6-a2c7-c2de4ca6880e", "parentControlId": 31534, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586274" }, { "id": 580006, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a1932a1-ccb0-5c5c-8443-5be755ac0f64", "parentControlId": 31534, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586274" }, { "id": 580007, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92823b2b-36b9-5922-ab0a-687df8998de2", "parentControlId": 31534, "controlId": "T1087.004", "title": "T1087.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586274" }, { "id": 580008, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acbc8928-961c-577d-a801-c2548cf0a74b", "parentControlId": 31534, "controlId": "T1091", "title": "T1091", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586274" }, { "id": 580009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f79305be-67b2-50cd-a369-7abfaaab5fe9", "parentControlId": 31534, "controlId": "T1098", "title": "T1098", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586275" }, { "id": 580010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3784da3-6eb4-5fc8-acc8-155aee451424", "parentControlId": 31534, "controlId": "T1098.001", "title": "T1098.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586275" }, { "id": 580011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47d31079-ba62-5157-97cc-bdfd3769c5c7", "parentControlId": 31534, "controlId": "T1098.002", "title": "T1098.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586275" }, { "id": 580012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b730248-04bf-5f5e-b244-668321fc4d0f", "parentControlId": 31534, "controlId": "T1098.003", "title": "T1098.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586275" }, { "id": 580013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21a8c5b8-8c25-5aae-ad82-2a7f023d9e74", "parentControlId": 31534, "controlId": "T1098.004", "title": "T1098.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586275" }, { "id": 580014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3147b0e4-5edb-51c0-9a31-09fe8c1fae66", "parentControlId": 31534, "controlId": "T1098.005", "title": "T1098.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586275" }, { "id": 580015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea8c2fb7-4f30-5822-a983-e920258944fc", "parentControlId": 31534, "controlId": "T1098.006", "title": "T1098.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586275" }, { "id": 580016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f822a57e-be4f-553e-8c5d-ba7f512385e0", "parentControlId": 31534, "controlId": "T1098.007", "title": "T1098.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586275" }, { "id": 580017, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4189f924-e05f-5779-87d8-efe366723a82", "parentControlId": 31534, "controlId": "T1106", "title": "T1106", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586276" }, { "id": 580018, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5057703e-a574-53aa-8bdc-b6ccd3edf811", "parentControlId": 31534, "controlId": "T1110", "title": "T1110", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586276" }, { "id": 580019, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2e83e6d-41db-5988-9f9c-baae5be4608c", "parentControlId": 31534, "controlId": "T1110.001", "title": "T1110.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586276" }, { "id": 580020, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb52ec9c-34d4-559e-8738-6fb941ad9943", "parentControlId": 31534, "controlId": "T1110.002", "title": "T1110.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586276" }, { "id": 580021, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9d8a946-53aa-5f1d-abf0-e4e2b68de3e1", "parentControlId": 31534, "controlId": "T1110.003", "title": "T1110.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586276" }, { "id": 580022, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92696887-090f-5960-8c70-45ca24d95aea", "parentControlId": 31534, "controlId": "T1110.004", "title": "T1110.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586276" }, { "id": 580023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22fce116-aa55-5e65-8137-3897e46076ca", "parentControlId": 31534, "controlId": "T1112", "title": "T1112", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586276" }, { "id": 580024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a6f7faa-9ca8-5dcb-9e8e-f8752c619888", "parentControlId": 31534, "controlId": "T1133", "title": "T1133", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586276" }, { "id": 580025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be8b8364-aaf6-5464-8c94-c4e11ef21c24", "parentControlId": 31534, "controlId": "T1134", "title": "T1134", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586276" }, { "id": 580026, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57272a1d-ffc7-5860-b37d-2e9f6fc8bd5e", "parentControlId": 31534, "controlId": "T1134.001", "title": "T1134.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586277" }, { "id": 580027, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b43bf53-721c-5262-b65f-4c36c5817d5a", "parentControlId": 31534, "controlId": "T1134.002", "title": "T1134.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586277" }, { "id": 580028, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2a0bd51-c196-5db9-a0c5-5aadd485aec3", "parentControlId": 31534, "controlId": "T1134.003", "title": "T1134.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586277" }, { "id": 580029, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a351eec-8d7a-50fa-bfe4-abd528e4dc8e", "parentControlId": 31534, "controlId": "T1134.005", "title": "T1134.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586277" }, { "id": 580030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "908df1a1-de72-5cf1-b868-9bdcbe721e6a", "parentControlId": 31534, "controlId": "T1136", "title": "T1136", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586277" }, { "id": 580031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ac8f2c5-c622-593a-89e1-f55b4cdc9c56", "parentControlId": 31534, "controlId": "T1136.001", "title": "T1136.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586277" }, { "id": 580032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0cad7506-c35b-569c-9e4c-cbe941385754", "parentControlId": 31534, "controlId": "T1136.002", "title": "T1136.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586277" }, { "id": 580033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75b303f7-9b3f-5af8-9e66-662a459a4d12", "parentControlId": 31534, "controlId": "T1136.003", "title": "T1136.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586277" }, { "id": 580034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e40735eb-1af0-5590-bbb7-7ff17f187ea3", "parentControlId": 31534, "controlId": "T1137", "title": "T1137", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586277" }, { "id": 580035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e95bb83-c37f-50b3-9d58-9aed8047fefe", "parentControlId": 31534, "controlId": "T1137.001", "title": "T1137.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586278" }, { "id": 580036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4c3e273-c1fd-583d-81b5-49a313cc1302", "parentControlId": 31534, "controlId": "T1137.002", "title": "T1137.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586278" }, { "id": 580037, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0a5267b-e067-5da6-979c-ee5636f7d095", "parentControlId": 31534, "controlId": "T1137.003", "title": "T1137.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586278" }, { "id": 580038, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a7fd2c8-b617-55e2-bb5f-9324c6752f20", "parentControlId": 31534, "controlId": "T1137.004", "title": "T1137.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586278" }, { "id": 580039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e02f32f-6af6-57ee-acf5-e8ea7fa52100", "parentControlId": 31534, "controlId": "T1137.005", "title": "T1137.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586278" }, { "id": 580040, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51ac5c3f-e52b-5551-a9ea-8bd5b9d52226", "parentControlId": 31534, "controlId": "T1137.006", "title": "T1137.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586278" }, { "id": 580041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59873981-b80f-59ba-a559-216456a478f3", "parentControlId": 31534, "controlId": "T1176", "title": "T1176", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586278" }, { "id": 580042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f696bf2-3ddb-5418-a211-f911eb4c80e3", "parentControlId": 31534, "controlId": "T1185", "title": "T1185", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586278" }, { "id": 580043, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f02ef8d3-83b4-5f78-81a7-100209ea9f8a", "parentControlId": 31534, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586279" }, { "id": 580044, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e93c7eb-35ca-5967-beec-894d68222017", "parentControlId": 31534, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586279" }, { "id": 580045, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6adbcaff-4e6e-50b6-8e24-9be8e043882d", "parentControlId": 31534, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586279" }, { "id": 580046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6805e24e-4771-598c-81dd-737c651f6a07", "parentControlId": 31534, "controlId": "T1197", "title": "T1197", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586279" }, { "id": 580047, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa5a406c-da55-58d7-85c6-803b523077ea", "parentControlId": 31534, "controlId": "T1199", "title": "T1199", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586279" }, { "id": 580048, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ecccb49-e199-5c7b-a497-23eda20bca53", "parentControlId": 31534, "controlId": "T1200", "title": "T1200", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586279" }, { "id": 580049, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4aa29fd-8f62-5330-8b53-f251f2e1d359", "parentControlId": 31534, "controlId": "T1203", "title": "T1203", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586279" }, { "id": 580050, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8638b7fc-4198-5b0f-8029-99cdf3bc6727", "parentControlId": 31534, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586279" }, { "id": 580051, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18b0481e-b9b8-527c-a48d-edf25869cd4f", "parentControlId": 31534, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586279" }, { "id": 580052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82e8b98a-42f7-5ebf-a762-e85d5d796d5c", "parentControlId": 31534, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58628" }, { "id": 580053, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c48b2bbd-4e05-5e67-8a1c-3e0aefe4673e", "parentControlId": 31534, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58628" }, { "id": 580054, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a66b4eeb-aa8b-563b-83a6-17cbfda0c13b", "parentControlId": 31534, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58628" }, { "id": 580055, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7275e160-ca60-526c-909b-179fd87dc63e", "parentControlId": 31534, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58628" }, { "id": 580056, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "752991fb-2450-5615-83d6-502c5b356af7", "parentControlId": 31534, "controlId": "T1213.003", "title": "T1213.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58628" }, { "id": 580057, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc497140-72de-5c40-98ef-c4f6d90f7762", "parentControlId": 31534, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58628" }, { "id": 580058, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4a41acc-4d8d-57c2-a9a5-e6d25c863dbd", "parentControlId": 31534, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58628" }, { "id": 580059, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0431dcf4-e87c-55b0-8875-1129486ed61a", "parentControlId": 31534, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58628" }, { "id": 580060, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55343c95-d10c-5d71-a826-64b8780c2b0b", "parentControlId": 31534, "controlId": "T1218.007", "title": "T1218.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58628" }, { "id": 580061, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9bd9fbc-7a02-5e4a-8b4a-7413950f0e47", "parentControlId": 31534, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58628" }, { "id": 580062, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c40ab04a-6635-598d-a93b-05120a9c5fab", "parentControlId": 31534, "controlId": "T1222", "title": "T1222", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586281" }, { "id": 580063, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb12820f-bdfd-5b55-97cf-d2dd6477bfa1", "parentControlId": 31534, "controlId": "T1222.001", "title": "T1222.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586281" }, { "id": 580064, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebf9a8bf-ee13-58cf-9d49-1c84d3733130", "parentControlId": 31534, "controlId": "T1222.002", "title": "T1222.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586281" }, { "id": 580065, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fec1b907-1681-5b77-a535-96bb4e56f5d7", "parentControlId": 31534, "controlId": "T1484", "title": "T1484", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586281" }, { "id": 580066, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e1d9a5c-b706-5ca0-805d-75154e8fdf20", "parentControlId": 31534, "controlId": "T1485", "title": "T1485", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586281" }, { "id": 580067, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a07aa7e8-639e-580d-93cb-c2186d2138b6", "parentControlId": 31534, "controlId": "T1485.001", "title": "T1485.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586281" }, { "id": 580068, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ad2e786-b19d-5b4f-9fe2-fb0bf70e3072", "parentControlId": 31534, "controlId": "T1486", "title": "T1486", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586281" }, { "id": 580069, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d3f9204-4a58-5376-81ec-22d38d0835d8", "parentControlId": 31534, "controlId": "T1489", "title": "T1489", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586281" }, { "id": 580070, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "517dc94c-423c-56cf-8d37-2ee17de8213b", "parentControlId": 31534, "controlId": "T1490", "title": "T1490", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586282" }, { "id": 580071, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f73b5f5f-a997-5343-a0e2-8c2236c795c8", "parentControlId": 31534, "controlId": "T1491", "title": "T1491", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586282" }, { "id": 580072, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85dd691d-7a52-57e5-b6c8-32a36b0132e0", "parentControlId": 31534, "controlId": "T1491.001", "title": "T1491.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586282" }, { "id": 580073, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d52865fd-a46a-52e9-86ed-ab3e31ea17c1", "parentControlId": 31534, "controlId": "T1491.002", "title": "T1491.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586282" }, { "id": 580074, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f53c0a83-af16-57d4-8857-a3de0d1c5cf9", "parentControlId": 31534, "controlId": "T1495", "title": "T1495", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586282" }, { "id": 580075, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9de6cba3-98cd-5093-a9bb-9ee1c3f44022", "parentControlId": 31534, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586282" }, { "id": 580076, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82f945ac-8556-5e0a-b0a8-9551bba10087", "parentControlId": 31534, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586282" }, { "id": 580077, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a036a8d-2d51-5090-b2b0-0e47119d23bb", "parentControlId": 31534, "controlId": "T1505.003", "title": "T1505.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586282" }, { "id": 580078, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9d5674a-f862-530f-9c90-71cd82148626", "parentControlId": 31534, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586282" }, { "id": 580079, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "994ac8c1-6953-5174-8486-911fd3ba13d0", "parentControlId": 31534, "controlId": "T1505.005", "title": "T1505.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586283" }, { "id": 580080, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "177b47a6-edf3-5e44-997c-95f7849a0a93", "parentControlId": 31534, "controlId": "T1525", "title": "T1525", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586283" }, { "id": 580081, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d91c6d65-4955-50d0-8e29-37b56425ea2c", "parentControlId": 31534, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586283" }, { "id": 580082, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7441e965-608b-52e3-ba0c-bc36ad66600d", "parentControlId": 31534, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586283" }, { "id": 580083, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "618e8134-c34d-5c8c-a84f-8c43ea0497cb", "parentControlId": 31534, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586283" }, { "id": 580084, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87fe79f3-f1ef-5649-b4dd-2c3943566af6", "parentControlId": 31534, "controlId": "T1538", "title": "T1538", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586283" }, { "id": 580085, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1925724-fc1d-57e4-bbf5-5512114e22c2", "parentControlId": 31534, "controlId": "T1539", "title": "T1539", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586283" }, { "id": 580086, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94dc5a75-97f8-5d38-98f1-78f1a3d26bcb", "parentControlId": 31534, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586283" }, { "id": 580087, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1816ac66-e83d-56a5-a216-2df0ef11c5b9", "parentControlId": 31534, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586283" }, { "id": 580088, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c7986ab-a2cb-5472-a7f1-ccab1071ff72", "parentControlId": 31534, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586283" }, { "id": 580089, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "065d19ff-775c-52cf-8051-6a9b30879272", "parentControlId": 31534, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586284" }, { "id": 580090, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "756c2a33-ae4b-5846-a6e9-cc58b5436bcc", "parentControlId": 31534, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586284" }, { "id": 580091, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22be2115-dff9-549d-a269-e8a6034a9bf7", "parentControlId": 31534, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586284" }, { "id": 580092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7aba91c0-2617-5731-a591-830954c6bddb", "parentControlId": 31534, "controlId": "T1543.001", "title": "T1543.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586284" }, { "id": 580093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f199663-60b8-51b1-8933-d0ddd5ea335c", "parentControlId": 31534, "controlId": "T1543.002", "title": "T1543.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586284" }, { "id": 580094, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "465fc39a-eea7-53ec-ad28-1246a02919df", "parentControlId": 31534, "controlId": "T1543.003", "title": "T1543.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586284" }, { "id": 580095, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0558305a-0cf2-573b-aa9d-532dfc1eeb46", "parentControlId": 31534, "controlId": "T1543.004", "title": "T1543.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586284" }, { "id": 580096, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f140c09-0495-5e98-aa95-6e7560321392", "parentControlId": 31534, "controlId": "T1543.005", "title": "T1543.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586285" }, { "id": 580097, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "319d66ea-7897-5693-a5d8-f23c8b908a29", "parentControlId": 31534, "controlId": "T1546", "title": "T1546", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586285" }, { "id": 580098, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a900d89-deda-5af8-8020-708e156d5003", "parentControlId": 31534, "controlId": "T1546.003", "title": "T1546.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586285" }, { "id": 580099, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "742e72c9-9253-5d2d-b802-2fad40e1f4b4", "parentControlId": 31534, "controlId": "T1546.004", "title": "T1546.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586285" }, { "id": 580100, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "233f3f93-ea7c-5650-acc4-2f4b54e0a879", "parentControlId": 31534, "controlId": "T1546.011", "title": "T1546.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586285" }, { "id": 580101, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "872110c6-2a9c-5c4f-a2d2-8982e8310e82", "parentControlId": 31534, "controlId": "T1546.013", "title": "T1546.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586285" }, { "id": 580102, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a005bea4-2668-529d-a008-e18f278539b2", "parentControlId": 31534, "controlId": "T1546.016", "title": "T1546.016", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586285" }, { "id": 580103, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de1c597d-e270-5fa9-83ea-84cf34ef8a42", "parentControlId": 31534, "controlId": "T1547.003", "title": "T1547.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586285" }, { "id": 580104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7496a63-c6ab-50a3-8a73-4a1970e8b340", "parentControlId": 31534, "controlId": "T1547.004", "title": "T1547.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586285" }, { "id": 580105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41de4b78-a194-5d51-b2eb-010d51d52e16", "parentControlId": 31534, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586285" }, { "id": 580106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05541693-f451-5567-bcff-91062bf72caf", "parentControlId": 31534, "controlId": "T1547.009", "title": "T1547.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586286" }, { "id": 580107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbde4ab9-c0a4-52ac-a3a0-a65c3c7cc27b", "parentControlId": 31534, "controlId": "T1547.012", "title": "T1547.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586286" }, { "id": 580108, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58dbbdb3-843f-5a7f-9e86-c7d1256b8323", "parentControlId": 31534, "controlId": "T1547.013", "title": "T1547.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586286" }, { "id": 580109, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9cb5e50d-1785-54a8-9d3a-f554b4d26511", "parentControlId": 31534, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586286" }, { "id": 580110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53748b16-abd0-5ce0-a2af-3d24baf3d0bf", "parentControlId": 31534, "controlId": "T1548.002", "title": "T1548.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586286" }, { "id": 580111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5bed1a3-f3dc-5105-a462-f69f618d8b0f", "parentControlId": 31534, "controlId": "T1548.003", "title": "T1548.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586286" }, { "id": 580112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33a7a376-6244-5b52-8470-a6369e91c69c", "parentControlId": 31534, "controlId": "T1548.005", "title": "T1548.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586286" }, { "id": 580113, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b95cfd3f-5ac9-5b94-a852-4b937191c5d6", "parentControlId": 31534, "controlId": "T1548.006", "title": "T1548.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586286" }, { "id": 580114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586286", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1d7681a-907f-536a-9ed2-0c7e109a1fee", "parentControlId": 31534, "controlId": "T1550", "title": "T1550", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586286" }, { "id": 580115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27266a13-6cdb-5d67-a6d0-f580b0943ea6", "parentControlId": 31534, "controlId": "T1550.002", "title": "T1550.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586287" }, { "id": 580116, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5dab098e-1762-5139-9b26-44e70fe7f96f", "parentControlId": 31534, "controlId": "T1550.003", "title": "T1550.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586287" }, { "id": 580117, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05883641-deb9-5f8f-8eea-8311d4c05e03", "parentControlId": 31534, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586287" }, { "id": 580118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f38f165a-4e53-5ee9-8176-6e1d293091e8", "parentControlId": 31534, "controlId": "T1552.001", "title": "T1552.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586287" }, { "id": 580119, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "697ec6e2-c393-5970-aecd-6c213c938eb2", "parentControlId": 31534, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586287" }, { "id": 580120, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1dae88f4-ef3f-5af5-b442-fd956fe870aa", "parentControlId": 31534, "controlId": "T1552.006", "title": "T1552.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586287" }, { "id": 580121, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d39a5d4-0415-597b-b472-bcad6419c0bd", "parentControlId": 31534, "controlId": "T1552.007", "title": "T1552.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586287" }, { "id": 580122, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de71924d-4f07-5f11-8073-08c9c940dbea", "parentControlId": 31534, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586287" }, { "id": 580123, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c10566b-3b21-555a-96e6-47801cde2960", "parentControlId": 31534, "controlId": "T1553.003", "title": "T1553.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586288" }, { "id": 580124, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1761940e-2bd3-5c2d-ba49-d00f0c28e461", "parentControlId": 31534, "controlId": "T1553.006", "title": "T1553.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586288" }, { "id": 580125, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25f4fa45-ff52-5d3c-8d24-d26d32d6383d", "parentControlId": 31534, "controlId": "T1555", "title": "T1555", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586288" }, { "id": 580126, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97c149f7-de7a-59b7-9826-67a3779cf362", "parentControlId": 31534, "controlId": "T1555.002", "title": "T1555.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586288" }, { "id": 580127, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0002002b-e4d0-50ce-8aa7-f031005b7931", "parentControlId": 31534, "controlId": "T1555.006", "title": "T1555.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586288" }, { "id": 580128, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67967b39-4fe0-5aa3-baeb-0acf24912b61", "parentControlId": 31534, "controlId": "T1556", "title": "T1556", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586288" }, { "id": 580129, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b3f4fbe-5d1b-55c3-9eb9-ef4d09f75d18", "parentControlId": 31534, "controlId": "T1556.001", "title": "T1556.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586288" }, { "id": 580130, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47110fc9-350e-5b3d-bf56-49f5d0b68011", "parentControlId": 31534, "controlId": "T1556.003", "title": "T1556.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586288" }, { "id": 580131, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02892816-94fc-5b6d-92dc-378706b13dbb", "parentControlId": 31534, "controlId": "T1556.004", "title": "T1556.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586288" }, { "id": 580132, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c8d1eba-34ec-5a68-a54d-6eba8c5ae26a", "parentControlId": 31534, "controlId": "T1556.005", "title": "T1556.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586289" }, { "id": 580133, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef244612-31be-53d3-86c6-652a9a258d12", "parentControlId": 31534, "controlId": "T1556.006", "title": "T1556.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586289" }, { "id": 580134, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "229beedc-331b-52c0-99c7-c381c82404cf", "parentControlId": 31534, "controlId": "T1556.007", "title": "T1556.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586289" }, { "id": 580135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7345a71-5386-534e-8574-6542054ceb92", "parentControlId": 31534, "controlId": "T1556.008", "title": "T1556.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586289" }, { "id": 580136, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af4805cd-4e71-5977-9090-78f12aca2c1e", "parentControlId": 31534, "controlId": "T1556.009", "title": "T1556.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586289" }, { "id": 580137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "138bb992-f66d-590f-8515-5d882a7e52c8", "parentControlId": 31534, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586289" }, { "id": 580138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e697f9b0-2edf-5efc-8fa0-68f3b6805e28", "parentControlId": 31534, "controlId": "T1558.001", "title": "T1558.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586289" }, { "id": 580139, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f3343db-6df7-5978-b856-7324f15f1593", "parentControlId": 31534, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586289" }, { "id": 580140, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffee0f30-3f50-57a0-a2fc-86b640a95f9f", "parentControlId": 31534, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586289" }, { "id": 580141, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab3ede66-9041-550d-8ea8-9d721d25e4c8", "parentControlId": 31534, "controlId": "T1558.005", "title": "T1558.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58629" }, { "id": 580142, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2393df2c-c69b-5645-a4f8-4cf41a0d159b", "parentControlId": 31534, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58629" }, { "id": 580143, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da9860d1-e5f9-53ba-8c6b-abe29e001da4", "parentControlId": 31534, "controlId": "T1559.001", "title": "T1559.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58629" }, { "id": 580144, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78c6c33b-ff6a-5460-8324-9ff775cc1ccc", "parentControlId": 31534, "controlId": "T1559.002", "title": "T1559.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58629" }, { "id": 580145, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d2fbc51-28a7-571c-91b4-fd33515d0142", "parentControlId": 31534, "controlId": "T1561", "title": "T1561", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58629" }, { "id": 580146, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "291642cd-df3e-56d1-95f7-e5c46737b3f3", "parentControlId": 31534, "controlId": "T1561.001", "title": "T1561.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58629" }, { "id": 580147, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3dfad11-0753-559b-be2b-f33fcc57c941", "parentControlId": 31534, "controlId": "T1561.002", "title": "T1561.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58629" }, { "id": 580148, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb97deb9-c4db-5be8-90d1-e997b4f6f0b4", "parentControlId": 31534, "controlId": "T1562", "title": "T1562", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58629" }, { "id": 580149, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce1d32d4-0211-54c1-8ebe-a7b0448765f9", "parentControlId": 31534, "controlId": "T1562.001", "title": "T1562.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58629" }, { "id": 580150, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50ba32fd-96a6-507b-b30e-4edd3b2c8ed4", "parentControlId": 31534, "controlId": "T1562.002", "title": "T1562.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586291" }, { "id": 580151, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52e34613-043b-5d60-992c-43505833d270", "parentControlId": 31534, "controlId": "T1562.004", "title": "T1562.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586291" }, { "id": 580152, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a5666f4-db13-5124-a4b8-eb0a38fb11b5", "parentControlId": 31534, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586291" }, { "id": 580153, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fc867b6-0eea-58ca-b0e0-d103020fee8e", "parentControlId": 31534, "controlId": "T1562.007", "title": "T1562.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586291" }, { "id": 580154, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b3677ff-3cb2-5fd8-baf7-e3cdf44d330b", "parentControlId": 31534, "controlId": "T1562.008", "title": "T1562.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586291" }, { "id": 580155, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d476734-3ecb-58d1-bdcf-e0e3eed0e600", "parentControlId": 31534, "controlId": "T1562.009", "title": "T1562.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586291" }, { "id": 580156, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd057a0e-92b7-5f00-b936-6982bc630cb8", "parentControlId": 31534, "controlId": "T1562.012", "title": "T1562.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586291" }, { "id": 580157, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "247cfcf4-896f-5a87-8fab-513be4ac047c", "parentControlId": 31534, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586291" }, { "id": 580158, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586291", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e11db6c-e242-5c7e-9117-4eac39d69980", "parentControlId": 31534, "controlId": "T1563.001", "title": "T1563.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586291" }, { "id": 580159, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86b796bf-44d2-5e1d-94a4-c90c57083a4f", "parentControlId": 31534, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586292" }, { "id": 580160, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d546109-1b9f-54b7-a1db-b660516c5fca", "parentControlId": 31534, "controlId": "T1566.003", "title": "T1566.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586292" }, { "id": 580161, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee785602-a869-54b1-9576-311c9cd628d8", "parentControlId": 31534, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586292" }, { "id": 580162, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89795285-9e1a-5cd2-b6e9-66ffcd07ace8", "parentControlId": 31534, "controlId": "T1569", "title": "T1569", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586292" }, { "id": 580163, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b40e104-2959-5bc3-8e58-8f984cf4f9b8", "parentControlId": 31534, "controlId": "T1569.001", "title": "T1569.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586292" }, { "id": 580164, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e11aeea-a094-51d3-bc6e-928fc6d0c168", "parentControlId": 31534, "controlId": "T1569.002", "title": "T1569.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586292" }, { "id": 580165, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77bb4fb4-a72b-5544-931f-3ce82e1e277a", "parentControlId": 31534, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586292" }, { "id": 580166, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08165615-0717-5a5b-8614-4e25925d0763", "parentControlId": 31534, "controlId": "T1574.004", "title": "T1574.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586292" }, { "id": 580167, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586292", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b3ec338-4f09-59fa-b163-a13654091bc0", "parentControlId": 31534, "controlId": "T1574.005", "title": "T1574.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586293" }, { "id": 580168, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2704d010-1d0c-5984-8e7e-7527b72546e1", "parentControlId": 31534, "controlId": "T1574.007", "title": "T1574.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586293" }, { "id": 580169, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90c867cb-765c-50da-968f-05a702afc6e3", "parentControlId": 31534, "controlId": "T1574.008", "title": "T1574.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586293" }, { "id": 580170, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ace23a5-3442-555b-9267-16d13b3b3554", "parentControlId": 31534, "controlId": "T1574.009", "title": "T1574.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586293" }, { "id": 580171, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef428776-b75f-5e41-ae52-453a5d7fcb1c", "parentControlId": 31534, "controlId": "T1574.010", "title": "T1574.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586293" }, { "id": 580172, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0afd816c-ac9b-58bc-8ef6-0671240f4671", "parentControlId": 31534, "controlId": "T1574.011", "title": "T1574.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586293" }, { "id": 580173, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9920988e-0f3c-5ddb-bf64-c472e17336da", "parentControlId": 31534, "controlId": "T1574.012", "title": "T1574.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586293" }, { "id": 580174, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27581172-9ce1-5156-9038-03b7ad5eaf06", "parentControlId": 31534, "controlId": "T1574.014", "title": "T1574.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586293" }, { "id": 580175, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f587818-c712-53cf-a88d-c8608202206d", "parentControlId": 31534, "controlId": "T1578", "title": "T1578", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586293" }, { "id": 580176, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586293", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0cf34cfc-ff19-518f-91de-d6dc0900c267", "parentControlId": 31534, "controlId": "T1578.001", "title": "T1578.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586293" }, { "id": 580177, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db987fdd-06c1-5fd7-88d3-61bebc2913a5", "parentControlId": 31534, "controlId": "T1578.002", "title": "T1578.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586294" }, { "id": 580178, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42656748-0a2e-5652-a300-cfa9f75fcd40", "parentControlId": 31534, "controlId": "T1578.003", "title": "T1578.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586294" }, { "id": 580179, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5b7814e-a125-5788-a23b-8ad76034d3c3", "parentControlId": 31534, "controlId": "T1578.005", "title": "T1578.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586294" }, { "id": 580180, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02db3ead-8c90-5501-ad9a-92038c8856d2", "parentControlId": 31534, "controlId": "T1580", "title": "T1580", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586294" }, { "id": 580181, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c126e339-b1a8-5419-8ae7-4d86629a8a5d", "parentControlId": 31534, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586294" }, { "id": 580182, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f674c86-f0e2-5b17-b6bf-c0e95c0b4be2", "parentControlId": 31534, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586294" }, { "id": 580183, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3de81718-23b0-5e8a-907a-58e44f68dcd0", "parentControlId": 31534, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586294" }, { "id": 580184, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81e814d3-9260-5081-9ebc-a8f2ea38f6c7", "parentControlId": 31534, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586294" }, { "id": 580185, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f7bb2e1-532e-5155-b8a6-f3b7ba5def90", "parentControlId": 31534, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586294" }, { "id": 580186, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ccd6c32f-a401-5b42-815d-2a0e14be8828", "parentControlId": 31534, "controlId": "T1606", "title": "T1606", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586294" }, { "id": 580187, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de777e11-851b-5b5a-8c9f-c073387a5046", "parentControlId": 31534, "controlId": "T1606.001", "title": "T1606.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586295" }, { "id": 580188, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1f4d61a-0c5e-5aee-b7c0-aecd45483043", "parentControlId": 31534, "controlId": "T1606.002", "title": "T1606.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586295" }, { "id": 580189, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d6753fd-65a3-5db3-b264-797d201e3b74", "parentControlId": 31534, "controlId": "T1609", "title": "T1609", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586295" }, { "id": 580190, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a16d2a9-7511-519f-8b99-08a4fd3d67b6", "parentControlId": 31534, "controlId": "T1610", "title": "T1610", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586295" }, { "id": 580191, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "deed0ace-5145-5d6e-8024-c1b659dd9326", "parentControlId": 31534, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586295" }, { "id": 580192, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "baa1040a-85e2-5794-907d-bbc4e317edfe", "parentControlId": 31534, "controlId": "T1612", "title": "T1612", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586295" }, { "id": 580193, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ba8e9c0-b259-5cdb-a24c-498b8ae9eeb1", "parentControlId": 31534, "controlId": "T1613", "title": "T1613", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586295" }, { "id": 580194, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27d62a0b-2cea-543c-a09d-900bb9d2ff99", "parentControlId": 31534, "controlId": "T1619", "title": "T1619", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586295" }, { "id": 580195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8283a084-758d-500c-a815-818af73eb16f", "parentControlId": 31534, "controlId": "T1621", "title": "T1621", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586296" }, { "id": 580196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eff556b2-c001-546a-9c53-5b78ce9474cb", "parentControlId": 31534, "controlId": "T1647", "title": "T1647", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586296" }, { "id": 580197, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2741d2f3-f2aa-55f0-a4a4-d6a20be08090", "parentControlId": 31534, "controlId": "T1648", "title": "T1648", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586296" }, { "id": 580198, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6dbe058-d728-5f95-9aeb-c8cf24c3abec", "parentControlId": 31534, "controlId": "T1651", "title": "T1651", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586296" }, { "id": 580199, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1df7674-dfe6-5e51-b324-bc9c44c368ae", "parentControlId": 31534, "controlId": "T1654", "title": "T1654", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586296" }, { "id": 580200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aeb5f7bd-015c-58f0-9751-e0ac5ec21a1c", "parentControlId": 31534, "controlId": "T1657", "title": "T1657", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586296" }, { "id": 580203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a154ffd-5d67-527b-a712-5e950ed211c2", "parentControlId": 31534, "controlId": "AC-6", "title": "AC-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586296" }, { "id": 580204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9285be0c-c7b7-52ab-96b6-8586f9c84770", "parentControlId": 31534, "controlId": "AC-06", "title": "AC-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586296" }, { "id": 580205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "159856a0-9c45-572b-9539-a821608b9be7", "parentControlId": 31534, "controlId": "SA-08(14)", "title": "SA-08(14)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586297" }, { "id": 580207, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cb76a3b-fdcb-5436-b01d-50d91c1f4637", "parentControlId": 31534, "controlId": "AC-06", "title": "AC-06", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586297" }, { "id": 580210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "934fc52a-4471-51b1-9f72-d806e2126d4e", "parentControlId": 31534, "controlId": "AC-06", "title": "AC-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586297" }, { "id": 580211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e65962d-5133-587c-ac3c-70a258f348f2", "parentControlId": 31534, "controlId": "SA-08(14)", "title": "SA-08(14)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586297" }, { "id": 580212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "219f2d9c-4b13-5bc0-a4cc-316b16d81a30", "parentControlId": 31534, "controlId": "AC-06", "title": "AC-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586297" }, { "id": 580213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acb4d952-4efb-5106-9366-802ceb5f4114", "parentControlId": 31534, "controlId": "AC-06", "title": "AC-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586297" }, { "id": 580215, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "990321e9-b1b5-5bcb-a70c-35076fc44262", "parentControlId": 31534, "controlId": "AC-6", "title": "AC-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586298" }, { "id": 580216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c520b991-8fd3-5c4c-98e6-3fdd0628a0a5", "parentControlId": 31534, "controlId": "3.1.5", "title": "3.1.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586306" }, { "id": 580217, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13f602cf-71ce-51bd-b6ff-756ad0f8c620", "parentControlId": 31534, "controlId": "03.01.01.c.03", "title": "03.01.01.c.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586306" }, { "id": 580218, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "557992ea-f15f-5f60-b423-dd6e68df373d", "parentControlId": 31534, "controlId": "03.01.01.d.01", "title": "03.01.01.d.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586306" }, { "id": 580219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46701220-a322-59b2-923e-3d1ddf902cda", "parentControlId": 31534, "controlId": "03.01.01.d.02", "title": "03.01.01.d.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586306" }, { "id": 580220, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb1a9cdf-8b2c-51aa-ab78-2906a2c60ac2", "parentControlId": 31534, "controlId": "03.01.04.b", "title": "03.01.04.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586306" }, { "id": 580221, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd1a466b-ac26-510a-87bf-5c3b26a92293", "parentControlId": 31534, "controlId": "03.01.05.a", "title": "03.01.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586307" }, { "id": 580222, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c5d87bb-4b8e-59c0-8b2f-2a362beaa3be", "parentControlId": 31534, "controlId": "03.01.05.b", "title": "03.01.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586307" }, { "id": 580223, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e1edb34-8100-5323-8fc1-1d99677cea41", "parentControlId": 31534, "controlId": "03.01.06.a", "title": "03.01.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586307" }, { "id": 580224, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5030d0f8-a978-54ca-a2b5-6aa219599521", "parentControlId": 31534, "controlId": "03.01.07.a", "title": "03.01.07.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586307" }, { "id": 580225, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "563c8d48-f83f-5530-a1f5-07cb297f93d6", "parentControlId": 31534, "controlId": "03.03.08.a", "title": "03.03.08.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586307" }, { "id": 580226, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "780105d4-4a7f-5af9-a31d-f94e234cb0a3", "parentControlId": 31534, "controlId": "03.03.08.b", "title": "03.03.08.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586307" }, { "id": 580227, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d554284-16e8-5059-9654-9486e9e9c0ed", "parentControlId": 31534, "controlId": "03.04.05", "title": "03.04.05", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586307" }, { "id": 580234, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ec388a6-73a1-5462-a07a-d4e0a2f03f3a", "parentControlId": 31534, "controlId": "PR.AA-05", "title": "PR.AA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586308" }, { "id": 580235, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a89d844c-19bc-537b-bb31-c4332d1b76d6", "parentControlId": 31534, "controlId": "PR.DS-10", "title": "PR.DS-10", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586308" }, { "id": 580283, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55ed97fc-c776-5869-a3cf-4638aca894e0", "parentControlId": 31534, "controlId": "ACCESS-1g", "title": "ACCESS-1g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586314" }, { "id": 580284, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c3f44bb-10ae-5590-a8de-3cba86ce51c6", "parentControlId": 31534, "controlId": "ACCESS-2d", "title": "ACCESS-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586314" }, { "id": 580285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad72a8ba-5545-5659-b59c-1756d83a0daa", "parentControlId": 31534, "controlId": "ARCHITECTURE-3c", "title": "ARCHITECTURE-3c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586314" }, { "controlId": "B.1.6", "title": "B.1.6 — Least Privilege", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "611f80da-ceef-58ec-87a1-f4e8a7e5bd8c", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.6", "title": "NEI 08-09 App D.1.6 — Least Privilege", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "fc617cc6-3c1a-5aaa-b34a-55dbf8f0f764", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "80014bf1-1c20-5cf4-aea9-f50be5a79dd3", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "2d8b570c-6cd2-58ee-9a13-1f19c9e0a967", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "84a8cd62-bf66-5f8f-8d09-436c46768704", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "e23f3c92-b3f9-5845-a539-fadbdfc20eb0", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "6c8aa072-743b-50d2-9194-65d673e79d7c", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "eae3a8cf-9ede-5cac-aa80-7712b746c8a1", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "60e6410b-587e-5e5e-9ddf-3dae5e23250e", "isPublic": true } ], "id": 31534, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731118", "catalogueId": 1062, "uuid": "4d33d7db-7129-5109-9e55-7ee0b41370aa", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Least Privilege", "description": "

Control Description

Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.

Evidence Request List (ERL)

E-IAM-02\nE-IAM-05\nE-IAM-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.6", "controlId": "IAC-21", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-21", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71965, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590655", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590655", "securityControlId": 31535, "ccis": [], "uuid": "10ae3114-e756-5a84-af20-6ae2f90c12f4", "testId": "IAC-21.1_A03", "test": "individuals and roles with authorized access to security functions and security-relevant information are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-06(01)_ODP[01]", "defaultText": null }, { "id": 71966, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590655", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590655", "securityControlId": 31535, "ccis": [], "uuid": "3aeb1c70-a5e8-576f-96a3-2088a5d3ad69", "testId": "IAC-21.1_A04", "test": "security functions (deployed in hardware) for authorized access are defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: all functions not publicly accessible", "otherId": "53A_R5_AC-06(01)_ODP[02]", "defaultText": null }, { "id": 71967, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590655", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590655", "securityControlId": 31535, "ccis": [], "uuid": "fbb812d3-d065-5166-babc-6c28c4522c6b", "testId": "IAC-21.1_A05", "test": "security functions (deployed in software) for authorized access are defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: all functions not publicly accessible", "otherId": "53A_R5_AC-06(01)_ODP[03]", "defaultText": null }, { "id": 71968, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590655", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590655", "securityControlId": 31535, "ccis": [], "uuid": "36d9ba20-af59-5446-8e21-6ac00efa5977", "testId": "IAC-21.1_A06", "test": "security functions (deployed in firmware) for authorized access are defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: all functions not publicly accessible", "otherId": "53A_R5_AC-06(01)_ODP[04]", "defaultText": null }, { "id": 71969, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590655", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590655", "securityControlId": 31535, "ccis": [], "uuid": "e64d3259-9d2b-5086-834f-efbb55df052a", "testId": "IAC-21.1_A07", "test": "security-relevant information for authorized access is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: all security-relevant information not publicly available", "otherId": "53A_R5_AC-06(01)_ODP[05]", "defaultText": null }, { "id": 71970, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590656", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590656", "securityControlId": 31535, "ccis": [], "uuid": "74edbb82-f84b-5460-baf0-6ad4b1a206f3", "testId": "IAC-21.1_A08", "test": "access is authorized for organization-defined individuals and roles to organization-defined security functions (deployed in hardware).
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: all functions not publicly accessible", "otherId": "53A_R5_AC-06(01)(a)[01]", "defaultText": null }, { "id": 71971, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590656", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590656", "securityControlId": 31535, "ccis": [], "uuid": "3d06da29-3fda-58f2-aa6e-e5b21acd23a3", "testId": "IAC-21.1_A09", "test": "access is authorized for organization-defined individuals and roles to organization-defined security functions (deployed in software).
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: all functions not publicly accessible", "otherId": "53A_R5_AC-06(01)(a)[02]", "defaultText": null }, { "id": 71972, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590656", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590656", "securityControlId": 31535, "ccis": [], "uuid": "78216678-03ef-5f13-8c94-8e162f2267c9", "testId": "IAC-21.1_A10", "test": "access is authorized for organization-defined individuals and roles to organization-defined security functions (deployed in firmware).
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: all functions not publicly accessible", "otherId": "53A_R5_AC-06(01)(a)[03]", "defaultText": null }, { "id": 71973, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590656", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590656", "securityControlId": 31535, "ccis": [], "uuid": "b17b8141-05fb-503b-ac23-24f445c41ffa", "testId": "IAC-21.1_A11", "test": "access is authorized for organization-defined individuals and roles to organization-defined security-relevant information.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: all security-relevant information not publicly available", "otherId": "53A_R5_AC-06(01)(b)", "defaultText": null } ], "externalMappings": [ { "id": 580382, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586325", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36046eb3-7ffb-5ff2-8714-57a962644341", "parentControlId": 31535, "controlId": "AC-6(1)", "title": "AC-6(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586325" }, { "id": 580383, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586325", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60e7a461-de7c-556c-a969-0978fd52b724", "parentControlId": 31535, "controlId": "AC-06(01)", "title": "AC-06(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586325" }, { "id": 580384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586325", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0ed5060-ffbd-58d4-87b0-e49b2c913879", "parentControlId": 31535, "controlId": "AC-06(01)", "title": "AC-06(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586325" }, { "id": 580385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586325", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f001b678-553d-5d38-82c6-60dbb41cd388", "parentControlId": 31535, "controlId": "AC-06(01)", "title": "AC-06(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586325" }, { "id": 580386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586325", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "417a801e-3933-59f4-93f3-3ad4e9f18534", "parentControlId": 31535, "controlId": "AC-06(01)", "title": "AC-06(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586325" }, { "id": 580387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586325", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54b3fc2e-df3e-52fb-8da7-064ca2dafd1b", "parentControlId": 31535, "controlId": "AC-06(01)", "title": "AC-06(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586326" }, { "id": 580389, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586326", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bddc19a0-d552-593b-beda-ef02d28e5a5e", "parentControlId": 31535, "controlId": "3.1.5", "title": "3.1.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586326" }, { "controlId": "B.1.6", "title": "B.1.6 — Least Privilege", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "182297e8-0f74-52fc-a67b-6570d0591769", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.6", "title": "NEI 08-09 App D.1.6 — Least Privilege", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "a3145476-27f9-52a8-a900-8dc168ca3e9d", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "ed9950bd-02a3-5004-a3d1-39a6e89ad7c9", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "21ac684f-91f0-5081-8747-88b229f18598", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "3f178498-af74-5eae-88c9-838247c195e1", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "9d5d051e-7de0-5f06-bb5f-36bf394c0585", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "1cdec17e-f158-55b2-8874-45987099936c", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "570fa189-b73b-5c41-8ff6-692e6978c727", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "3fb2ba09-0dd8-5f68-925b-d65b7066fd15", "isPublic": true } ], "id": 31535, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731119", "catalogueId": 1062, "uuid": "83a03393-7b9e-5864-aa44-8249a3b61ec4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization limit access to security functions to explicitly-authorized privileged users?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Authorize Access to Security Functions", "description": "

Control Description

Mechanisms exist to limit access to security functions to explicitly-authorized privileged users.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to limit access to security functions to explicitly-authorized privileged users.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.6", "controlId": "IAC-21.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-21.1", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71974, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590657", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590657", "securityControlId": 31536, "ccis": [], "uuid": "a75ee030-daca-535e-86cf-bd468d419b59", "testId": "IAC-21.2_A01", "test": "non-security functions are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.6[a]", "defaultText": null }, { "id": 71975, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590657", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590657", "securityControlId": 31536, "ccis": [], "uuid": "a30bdb38-4ae0-5d48-8e73-ce2be9ab7e7c", "testId": "IAC-21.2_A02", "test": "users (or roles) with privileged accounts are required to use non-privileged accounts when accessing non-security functions or non-security information.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.6[b]\n53A_R5_AC-06(02)\n171A_R3_A.03.01.06.b", "defaultText": null }, { "id": 71976, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590657", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590657", "securityControlId": 31536, "ccis": [], "uuid": "cebfda02-02aa-5e2b-95b4-67cd546c8377", "testId": "IAC-21.2_A03", "test": "security functions or security-relevant information, the access to which requires users to use non-privileged accounts to access non-security functions, are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-06(02)_ODP", "defaultText": null } ], "externalMappings": [ { "id": 580415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586329", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b83803af-9d15-52b7-a20a-ed0ecb55ea85", "parentControlId": 31536, "controlId": "AC-6(2)", "title": "AC-6(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586329" }, { "id": 580416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586329", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be16313d-d2c1-5f1d-a768-a612fe733134", "parentControlId": 31536, "controlId": "AC-06(02)", "title": "AC-06(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586329" }, { "id": 580417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586329", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77962a3a-ff9b-58e3-b130-c46d6bb255be", "parentControlId": 31536, "controlId": "AC-06(02)", "title": "AC-06(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586329" }, { "id": 580418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586329", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80829903-1dc7-5355-9e50-31c346c8c74a", "parentControlId": 31536, "controlId": "AC-06(02)", "title": "AC-06(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586329" }, { "id": 580419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58633", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04fb88ac-e02d-5f23-ad3d-b81927807558", "parentControlId": 31536, "controlId": "AC-06(02)", "title": "AC-06(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58633" }, { "id": 580420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58633", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c264bbc-820b-552f-bb09-1061cf082402", "parentControlId": 31536, "controlId": "AC-06(02)", "title": "AC-06(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58633" }, { "id": 580422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58633", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d63a1c92-5732-5db4-bb95-2a5536eca55a", "parentControlId": 31536, "controlId": "3.1.6", "title": "3.1.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58633" }, { "id": 580423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58633", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95c1e361-f8fa-5aa2-b1a5-95d692dd6bb2", "parentControlId": 31536, "controlId": "03.01.06.b", "title": "03.01.06.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58633" } ], "id": 31536, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731119", "catalogueId": 1062, "uuid": "24986c53-ec26-54d7-9795-4b5d88ba3e9d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prohibit privileged users from using privileged accounts, while performing non-security functions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Non-Privileged Access for Non-Security Functions", "description": "

Control Description

Mechanisms exist to prohibit privileged users from using privileged accounts, while performing non-security functions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prohibit privileged users from using privileged accounts, while performing non-security functions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-21.2", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-21.2", "references": "

Micro-Small Business (<10 staff)

∙ Use standard (non-admin) accounts for daily work

Small Business (10-49 staff)

∙ Policy requiring non-privileged accounts for non-security functions

Medium Business (50-249 staff)

∙ Formal least-privilege access policy\n∙ Standard accounts for daily activities

Large Business (250-999 staff)

∙ Enterprise least-privilege enforcement\n∙ Automated detection of privilege misuse

Enterprise (>1,000 staff)

∙ Enterprise least-privilege access management\n∙ UEBA for privilege misuse detection\n∙ Just-in-time privilege elevation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71977, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590657", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590657", "securityControlId": 31537, "ccis": [], "uuid": "c663d97d-0109-500b-b913-ec4ece3f1d0b", "testId": "IAC-21.3_A01", "test": "personnel or roles to which privileged accounts on the system are to be restricted are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-06(05)_ODP\n171A_R3_A.03.01.06.ODP[01]", "defaultText": null }, { "id": 71978, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590658", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590658", "securityControlId": 31537, "ccis": [], "uuid": "891daa00-8b6a-5642-89ea-8536f50371e6", "testId": "IAC-21.3_A02", "test": "privileged accounts on the system are restricted to .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: only defined and authorized personnel or administrative roles", "otherId": "53A_R5_AC-06(05)\n171A_R3_A.03.01.06.a", "defaultText": null } ], "externalMappings": [ { "id": 580454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586333", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae0297ba-d19a-5e80-a0bd-240d98e8efde", "parentControlId": 31537, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586333" }, { "id": 580455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586334", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b936f0ce-268b-5312-b192-bfece721d5c9", "parentControlId": 31537, "controlId": "8.2", "title": "8.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586334" }, { "id": 580459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586334", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a247e204-505e-5923-8209-d57f0511c09c", "parentControlId": 31537, "controlId": "AC-6(5)", "title": "AC-6(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586334" }, { "id": 580460, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586334", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ccc58beb-0b6c-5dd8-8578-67be09a7e22a", "parentControlId": 31537, "controlId": "AC-06(05)", "title": "AC-06(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586334" }, { "id": 580461, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586334", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76382dbd-1993-5730-afda-5bf8d59cc06f", "parentControlId": 31537, "controlId": "AC-06(05)", "title": "AC-06(05)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586334" }, { "id": 580462, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586334", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa22908f-77dc-57d9-b600-224bd6e191c4", "parentControlId": 31537, "controlId": "AC-06(05)", "title": "AC-06(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586334" }, { "id": 580463, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586334", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59899e88-d913-5a3c-a3d3-130737b2411c", "parentControlId": 31537, "controlId": "AC-06(05)", "title": "AC-06(05)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586334" }, { "id": 580464, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586335", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "207dfe40-6e26-512c-8cbf-bc9acfee550c", "parentControlId": 31537, "controlId": "AC-06(05)", "title": "AC-06(05)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586335" }, { "id": 580466, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586335", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55b3c75b-78e8-5ac3-8336-5c552d2315d0", "parentControlId": 31537, "controlId": "3.1.5", "title": "3.1.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586335" }, { "id": 580467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586335", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fe6d2c2-22f8-5c6a-9fc0-75b4e0b7c50f", "parentControlId": 31537, "controlId": "03.01.06.a", "title": "03.01.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586335" }, { "id": 580468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586335", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6dd203d7-01d1-5696-97c6-a34d72b36352", "parentControlId": 31537, "controlId": "03.01.07.a", "title": "03.01.07.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586335" }, { "id": 580479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cde2909-a2fb-51e0-9e9a-d2c1f5ee0c7d", "parentControlId": 31537, "controlId": "ACCESS-2f", "title": "ACCESS-2f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586336" }, { "id": 580480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f6990d9-58a5-588c-af0f-72c2c578122f", "parentControlId": 31537, "controlId": "ACCESS-2g", "title": "ACCESS-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586336" } ], "id": 31537, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731119", "catalogueId": 1062, "uuid": "e7456c5a-1813-528e-bcc3-b472c97002f1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict the assignment of privileged accounts to management-approved personnel and/or roles?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Management Approval For Privileged Accounts", "description": "

Control Description

Mechanisms exist to restrict the assignment of privileged accounts to management-approved personnel and/or roles.

Evidence Request List (ERL)

E-IAM-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict the assignment of privileged accounts to management-approved personnel and/or roles.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-21.3", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-21.3", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71979, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590658", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590658", "securityControlId": 31538, "ccis": [], "uuid": "409e67d3-32ab-56da-a812-ac0402598d71", "testId": "IAC-21.4_A01", "test": "the execution of privileged functions is logged.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-06(09)", "defaultText": null } ], "externalMappings": [ { "id": 580498, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586339", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0c3187f-3c31-530d-99d2-b8f474ed139a", "parentControlId": 31538, "controlId": "AC-6(9)", "title": "AC-6(9)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586339" }, { "id": 580499, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586339", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5f00d02-b36b-5aa7-a10f-938bc58995b7", "parentControlId": 31538, "controlId": "AC-06(09)", "title": "AC-06(09)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586339" }, { "id": 580500, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586339", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5eefabd3-3b1b-5526-a26d-dc0a679c9a5f", "parentControlId": 31538, "controlId": "AC-06(09)", "title": "AC-06(09)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586339" }, { "id": 580501, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586339", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65eb7098-c423-571d-80fb-70622e73c278", "parentControlId": 31538, "controlId": "AC-06(09)", "title": "AC-06(09)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586339" }, { "id": 580502, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586339", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "353dc424-827b-5ead-bdd4-7ce4a2a0553a", "parentControlId": 31538, "controlId": "AC-06(09)", "title": "AC-06(09)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586339" }, { "id": 580503, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586339", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce331387-eef1-591e-a710-7f82a6caf814", "parentControlId": 31538, "controlId": "AC-06(09)", "title": "AC-06(09)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586339" }, { "id": 580504, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586339", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc0df2bc-b90d-5fea-bc60-5c41eddcb771", "parentControlId": 31538, "controlId": "3.1.7", "title": "3.1.7", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586339" }, { "id": 580505, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586339", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cde8a9c6-9c23-5e5d-94bd-97ce08caefc1", "parentControlId": 31538, "controlId": "03.01.07.b", "title": "03.01.07.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586339" } ], "id": 31538, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73112", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73112", "catalogueId": 1062, "uuid": "8bffa3bd-2aa7-54ae-bb03-6c2fa02ccb49", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization audit the execution of privileged functions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Auditing Use of Privileged Functions", "description": "

Control Description

Mechanisms exist to audit the execution of privileged functions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.\n▪ IAM revokes user access rights following changes in personnel roles and duties, if no longer necessary or permitted.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to audit the execution of privileged functions.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-21.4", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-21.4", "references": "

Micro-Small Business (<10 staff)

∙ Log and review privileged function usage periodically

Small Business (10-49 staff)

∙ Audit logging of privileged function use\n∙ Periodic review of privilege activity logs

Medium Business (50-249 staff)

∙ Formal privileged function audit logging policy\n∙ Regular audit log review

Large Business (250-999 staff)

∙ Enterprise SIEM with privileged activity monitoring\n∙ Automated alerting for anomalous privileged use

Enterprise (>1,000 staff)

∙ Enterprise SIEM/PAM with continuous privileged function auditing (e.g., CyberArk, Splunk)\n∙ Automated anomaly detection", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71980, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590658", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590658", "securityControlId": 31539, "ccis": [], "uuid": "df4fb14e-54a3-522e-9517-4f92a676c2a9", "testId": "IAC-21.5_A01", "test": "privileged functions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.7[a]", "defaultText": null }, { "id": 71981, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590659", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590659", "securityControlId": 31539, "ccis": [], "uuid": "c2a408a5-d9b5-529e-acf5-b332fc25f10f", "testId": "IAC-21.5_A02", "test": "non-privileged users are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.7[b]", "defaultText": null }, { "id": 71982, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590659", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590659", "securityControlId": 31539, "ccis": [], "uuid": "50bcb623-1aff-5a2e-b2a3-e01d357aa76f", "testId": "IAC-21.5_A03", "test": "non-privileged users are prevented from executing privileged functions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.7[c]\n171A_R3_A.03.01.07.a\n53A_R5_AC-06(10)", "defaultText": null }, { "id": 71983, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590659", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590659", "securityControlId": 31539, "ccis": [], "uuid": "e3b8666b-2fbc-58b3-8455-6f607cf32749", "testId": "IAC-21.5_A04", "test": "the execution of privileged functions is captured in event logs.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.1.7[d]", "defaultText": null } ], "externalMappings": [ { "id": 580526, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33dc3e6c-2991-5488-adc5-fa08d3933943", "parentControlId": 31539, "controlId": "AC-6(10)", "title": "AC-6(10)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586342" }, { "id": 580527, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "caab6108-d536-5e82-8ff4-4292a5b8837c", "parentControlId": 31539, "controlId": "AC-06(10)", "title": "AC-06(10)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586342" }, { "id": 580528, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b834a5f-834c-56b9-a212-594924fa4d9a", "parentControlId": 31539, "controlId": "AC-06(10)", "title": "AC-06(10)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586342" }, { "id": 580529, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f5813c0-05d3-53a8-ac95-557205cfab86", "parentControlId": 31539, "controlId": "AC-06(10)", "title": "AC-06(10)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586342" }, { "id": 580530, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d87026e0-9b2d-5bf4-af5d-f8f38f8ec52e", "parentControlId": 31539, "controlId": "AC-06(10)", "title": "AC-06(10)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586342" }, { "id": 580531, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b856c9aa-5e97-5663-b497-c131dacd80af", "parentControlId": 31539, "controlId": "AC-06(10)", "title": "AC-06(10)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586342" }, { "id": 580533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "258a7394-2b12-576e-a63f-97a622186c9e", "parentControlId": 31539, "controlId": "3.1.7", "title": "3.1.7", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586342" }, { "id": 580534, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a218c459-3746-5d26-9344-1dc95e451e4b", "parentControlId": 31539, "controlId": "03.01.07.a", "title": "03.01.07.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586343" } ], "id": 31539, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73112", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73112", "catalogueId": 1062, "uuid": "bc45e974-4fc6-5493-b50d-05827e11f2ef", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prevent non-privileged users from executing privileged functions to include disabling, circumventing or altering implemented security safeguards / countermeasures?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Prohibit Non-Privileged Users from Executing Privileged Functions", "description": "

Control Description

Mechanisms exist to prevent non-privileged users from executing privileged functions to include disabling, circumventing or altering implemented security safeguards / countermeasures.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prevent non-privileged users from executing privileged functions to include disabling, circumventing or altering implemented security safeguards / countermeasures.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-21.5", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-21.5", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)\n∙ Privileged Account Management (PAM)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71984, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590659", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590659", "securityControlId": 31540, "ccis": [], "uuid": "52898ba2-ca4b-50a4-a90d-5895927d0807", "testId": "IAC-21.6_A01", "test": "privileged commands to which network access is to be authorized only for compelling operational needs are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: all privileged commands", "otherId": "53A_R5_AC-06(03)_ODP[01]", "defaultText": null }, { "id": 71985, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590659", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590659", "securityControlId": 31540, "ccis": [], "uuid": "78eba2e0-88a4-57cf-8c41-739bd812ea85", "testId": "IAC-21.6_A02", "test": "network access to organization-defined privileged commands is authorized only for organization-defined compelling operational needs.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-06(03)[01]", "defaultText": null }, { "id": 71986, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590659", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59066", "securityControlId": 31540, "ccis": [], "uuid": "93df131a-537e-51bb-8b3a-cca69e77e140", "testId": "IAC-21.6_A03", "test": "compelling operational needs necessitating network access to privileged commands are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-06(03)_ODP[02]", "defaultText": null }, { "id": 71987, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59066", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59066", "securityControlId": 31540, "ccis": [], "uuid": "c784cbee-4e28-56ae-8f4f-012d069c41a6", "testId": "IAC-21.6_A04", "test": "the rationale for authorizing network access to privileged commands is documented in the security plan for the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-06(03)[02]", "defaultText": null } ], "externalMappings": [ { "id": 580555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586354", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32c5b436-33ad-57d7-b023-13d99db9dd93", "parentControlId": 31540, "controlId": "AC-6(3)", "title": "AC-6(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586354" }, { "id": 580556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586354", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ddd46495-5b3c-56ec-8a67-18c14ad4805e", "parentControlId": 31540, "controlId": "AC-06(03)", "title": "AC-06(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586354" }, { "id": 580557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586354", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2313f284-0104-5763-9551-cd2dbb79a843", "parentControlId": 31540, "controlId": "AC-06(03)", "title": "AC-06(03)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586354" }, { "id": 580558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c46a6a8a-f12a-5f8e-9887-23786cfd2cbd", "parentControlId": 31540, "controlId": "AC-06(03)", "title": "AC-06(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586355" } ], "id": 31540, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731121", "catalogueId": 1062, "uuid": "96b2ca07-c2cc-55cf-bf10-677dcb2c8046", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization authorize remote access to perform privileged commands on critical Technology Assets, Applications and/or Services (TAAS) or where sensitive/regulated data is stored, transmitted and/or processed only for compelling operational needs?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Network Access to Privileged Commands", "description": "

Control Description

Mechanisms exist to authorize remote access to perform privileged commands on critical Technology Assets, Applications and/or Services (TAAS) or where sensitive/regulated data is stored, transmitted and/or processed only for compelling operational needs.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to authorize remote access to perform privileged commands on critical Technology Assets, Applications and/or Services (TAAS) or where sensitive/regulated data is stored, transmitted and/or processed only for compelling operational needs.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-21.6", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-21.6", "references": "

Micro-Small Business (<10 staff)

∙ Restrict network access for privileged commands to admin network

Small Business (10-49 staff)

∙ Policy restricting privileged command execution over network to authorized paths

Medium Business (50-249 staff)

∙ Formal privileged network access policy\n∙ Dedicated admin network or jump server

Large Business (250-999 staff)

∙ Enterprise jump server/bastion host for privileged network access\n∙ PAM integration

Enterprise (>1,000 staff)

∙ Enterprise privileged remote access platform (e.g., BeyondTrust, CyberArk)\n∙ Just-in-time privileged network access\n∙ Session recording", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71988, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59066", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59066", "securityControlId": 31541, "ccis": [], "uuid": "4e5cb634-7092-590a-95a6-c1e0edbd0a5f", "testId": "IAC-21.7_A01", "test": "software to be prevented from executing at higher privilege levels than users executing the software is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: any software except software explicitly documented", "otherId": "53A_R5_AC-06(08)_ODP", "defaultText": null }, { "id": 71989, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59066", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59066", "securityControlId": 31541, "ccis": [], "uuid": "377a2274-7802-5f74-8fb5-0c5ca13a8917", "testId": "IAC-21.7_A02", "test": "organization-defined software is prevented from executing at higher privilege levels than users executing the software.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: any software except software explicitly documented", "otherId": "53A_R5_AC-06(08)", "defaultText": null } ], "externalMappings": [ { "id": 580563, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ae86bf9-b8b0-5e5a-8495-4f6c656275c7", "parentControlId": 31541, "controlId": "AC-6(8)", "title": "AC-6(8)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586355" }, { "id": 580564, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13c3fbcc-07cd-5f69-86b9-47b34525bc96", "parentControlId": 31541, "controlId": "AC-06(08)", "title": "AC-06(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586355" }, { "id": 580565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586356", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66c119b3-d2fd-555b-bf70-bcea529bb1e5", "parentControlId": 31541, "controlId": "AC-06(08)", "title": "AC-06(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586356" } ], "id": 31541, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731121", "catalogueId": 1062, "uuid": "f3c277dd-cc09-58e4-b0cb-c424c5f54aaa", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to prevent applications from executing at higher privilege levels than the user's privileges?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Privilege Levels for Code Execution", "description": "

Control Description

Automated mechanisms exist to prevent applications from executing at higher privilege levels than the user's privileges.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically prevent applications from executing at higher privilege levels than the user's privileges.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-21.7", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-21.7", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 71990, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590661", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590661", "securityControlId": 31542, "ccis": [], "uuid": "7e8552b9-2c7d-5ac9-9e76-b0bb68ce516c", "testId": "IAC-22_A01", "test": "the means of limiting unsuccessful logon attempts is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.8[a]", "defaultText": null }, { "id": 71991, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590661", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590661", "securityControlId": 31542, "ccis": [], "uuid": "4161f0c7-2529-57ba-8b39-fd9b910398dc", "testId": "IAC-22_A02", "test": "the defined means of limiting unsuccessful logon attempts is implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.8[b]", "defaultText": null }, { "id": 71992, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590661", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590661", "securityControlId": 31542, "ccis": [], "uuid": "23ef72b6-be6a-5341-a828-af945371c02d", "testId": "IAC-22_A03", "test": "the number of consecutive invalid logon attempts by a user allowed during a time period is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-07_ODP[01]\n171A_R3_A.03.01.08.ODP[01]", "defaultText": null }, { "id": 71993, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590661", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590661", "securityControlId": 31542, "ccis": [], "uuid": "47c03c17-c8fa-5271-8d2f-3665f0d466c2", "testId": "IAC-22_A04", "test": " when the maximum number of unsuccessful attempts is exceeded.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: Select one or more: \n- lock the account or node for an at least 15- minute time period; \n- lock the account or node until released by an administrator and notify a system administrator", "otherId": "53A_R5_AC-07b.\n171A_R3_A.03.01.08.b", "defaultText": null }, { "id": 71994, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590661", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590661", "securityControlId": 31542, "ccis": [], "uuid": "9f135e9e-78d8-5667-baf2-db055dbca182", "testId": "IAC-22_A05", "test": "the time period to which the number of consecutive invalid logon attempts by a user is limited is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_AC-07_ODP[02]\n171A_R3_A.03.01.08.ODP[02]", "defaultText": null }, { "id": 71995, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590662", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590662", "securityControlId": 31542, "ccis": [], "uuid": "af91c7e0-aa03-5713-9cac-3a7b212b62b6", "testId": "IAC-22_A06", "test": "the time period for an account or node to be locked is defined (if selected).
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_AC-07_ODP[04]\n171A_R3_A.03.01.08.ODP[04]", "defaultText": null }, { "id": 71996, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590662", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590662", "securityControlId": 31542, "ccis": [], "uuid": "76efb223-27ba-5ac0-9967-a1e09965349c", "testId": "IAC-22_A07", "test": "delay algorithm for the next logon prompt is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-07_ODP[05]", "defaultText": null }, { "id": 71997, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590662", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590662", "securityControlId": 31542, "ccis": [], "uuid": "a5d80240-ec50-5500-9554-7e48d93b435a", "testId": "IAC-22_A08", "test": "other action to be taken when the maximum number of unsuccessful attempts is exceeded is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-07_ODP[03]\n53A_R5_AC-07_ODP[06]", "defaultText": null }, { "id": 71998, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590662", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590662", "securityControlId": 31542, "ccis": [], "uuid": "b17b9614-7e70-50a6-ac90-66b3c89aa058", "testId": "IAC-22_A09", "test": "a limit of consecutive invalid logon attempts by a user during is enforced.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: SDP values:\n[01] - at most five (5)\n[02] - period of five (5) minutes", "otherId": "53A_R5_AC-07a.\n171A_R3_A.03.01.08.a", "defaultText": null }, { "id": 71999, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590663", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590663", "securityControlId": 31542, "ccis": [], "uuid": "92ad1dd5-44b3-5b3b-95da-66306e4d6259", "testId": "IAC-22_A10", "test": "one or more of the following PARAMETER VALUES are selected: {the account or node is locked automatically for ; the account or node is locked automatically until released by an administrator; the next logon prompt is delayed automatically; the system administrator is notified automatically; other action is taken automatically}.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least 15- minute time period", "otherId": "171A_R3_A.03.01.08.ODP[03]", "defaultText": null } ], "externalMappings": [ { "id": 580577, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586357", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d924f22-1614-5f87-8daf-df01de204647", "parentControlId": 31542, "controlId": "USER 1.15", "title": "USER 1.15", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586357" }, { "id": 580578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586357", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1bf04b2-1d2b-5c19-8481-f23d005932ef", "parentControlId": 31542, "controlId": "SR 1.11", "title": "SR 1.11", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586358" }, { "id": 580579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52618244-6db3-50cd-94c6-76fcf709eded", "parentControlId": 31542, "controlId": "CR 1.11", "title": "CR 1.11", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586358" }, { "id": 580580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fe32797-1059-5761-90f2-4cbc290b3e9c", "parentControlId": 31542, "controlId": "CR 1.11(a)", "title": "CR 1.11(a)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586358" }, { "id": 580581, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aebd0f34-38c4-5fd9-8ce7-f4c6d3a7f533", "parentControlId": 31542, "controlId": "CR 1.11(b)", "title": "CR 1.11(b)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586358" }, { "id": 580582, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6964798-971f-513a-a374-95bb36e8c4a8", "parentControlId": 31542, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586358" }, { "id": 580585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70b20a9c-2d31-5538-aedc-8ffea99a15f3", "parentControlId": 31542, "controlId": "T1021", "title": "T1021", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586358" }, { "id": 580586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d214ced-bd16-5bef-9874-01bd72405432", "parentControlId": 31542, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586358" }, { "id": 580587, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb32fadb-350d-572d-a3f0-b06cb2ee88e9", "parentControlId": 31542, "controlId": "T1021.004", "title": "T1021.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586358" }, { "id": 580588, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84d199e7-c8c1-53a6-abd0-9c37bb7d209e", "parentControlId": 31542, "controlId": "T1078.002", "title": "T1078.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586359" }, { "id": 580589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5b31708-0f91-51aa-9f37-2436a43f7b01", "parentControlId": 31542, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586359" }, { "id": 580590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "226afc9b-a84d-5f21-98cd-6e870635f029", "parentControlId": 31542, "controlId": "T1110", "title": "T1110", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586359" }, { "id": 580591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0a39f75-024b-5eef-bbfa-14fd99b287f5", "parentControlId": 31542, "controlId": "T1110.001", "title": "T1110.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586359" }, { "id": 580592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3749f6c8-db8e-57ad-8839-2a025daa3ab2", "parentControlId": 31542, "controlId": "T1110.002", "title": "T1110.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586359" }, { "id": 580593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47dcfe0f-6710-5953-9a9b-97aaeffd6110", "parentControlId": 31542, "controlId": "T1110.003", "title": "T1110.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586359" }, { "id": 580594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4ab9683-6b8d-5c29-9cc9-dd2e5a327068", "parentControlId": 31542, "controlId": "T1110.004", "title": "T1110.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58636" }, { "id": 580595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31fa6d72-5b43-53ee-ac22-2ab32291f9da", "parentControlId": 31542, "controlId": "T1133", "title": "T1133", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58636" }, { "id": 580596, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2da60f36-d26f-5d03-9508-ece90656b9e4", "parentControlId": 31542, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58636" }, { "id": 580597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39f2dd67-aaf4-5726-800f-cd0494d02496", "parentControlId": 31542, "controlId": "T1556", "title": "T1556", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58636" }, { "id": 580598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69953946-8bc0-59de-b160-3b833dbafde7", "parentControlId": 31542, "controlId": "T1556.001", "title": "T1556.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58636" }, { "id": 580599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b0bb1a5-ab5a-5687-93af-3fae28c0bfee", "parentControlId": 31542, "controlId": "T1556.003", "title": "T1556.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58636" }, { "id": 580600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e42332c6-fb13-5ab0-b8da-d3f9ecc12cf1", "parentControlId": 31542, "controlId": "T1556.004", "title": "T1556.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58636" }, { "id": 580601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bb8d5c5-4a41-51e0-8050-bac1a48451ad", "parentControlId": 31542, "controlId": "AC-7", "title": "AC-7", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58636" }, { "id": 580602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04788bcb-9c66-539b-a169-896d447e6af9", "parentControlId": 31542, "controlId": "AC-07", "title": "AC-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58636" }, { "id": 580603, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfd5f5fe-3ac9-5f9b-b2a1-e0dba4d6c0af", "parentControlId": 31542, "controlId": "AC-07", "title": "AC-07", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586361" }, { "id": 580604, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7266c032-270a-537f-8410-edcb178a9b5e", "parentControlId": 31542, "controlId": "AC-07", "title": "AC-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586361" }, { "id": 580605, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eabb27ef-824a-5e6b-9cc2-107e311ed683", "parentControlId": 31542, "controlId": "AC-07", "title": "AC-07", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586361" }, { "id": 580606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "469d5678-131d-547c-8cf9-523cce5bc8d1", "parentControlId": 31542, "controlId": "AC-07", "title": "AC-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586361" }, { "id": 580607, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "809f0161-3302-504b-a1f9-aa9fbc2e1132", "parentControlId": 31542, "controlId": "AC-07", "title": "AC-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586361" }, { "id": 580608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cec12a1-ad8a-521f-9e89-8e539cec0bdc", "parentControlId": 31542, "controlId": "3.1.8", "title": "3.1.8", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586361" }, { "id": 580609, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d56352dc-8122-5adf-b2bb-fd8edfcf3662", "parentControlId": 31542, "controlId": "03.01.08.a", "title": "03.01.08.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586361" }, { "id": 580610, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65fa8081-ea74-552f-a928-05705cea867f", "parentControlId": 31542, "controlId": "03.01.08.b", "title": "03.01.08.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586361" }, { "id": 580635, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586364", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a92392f-9955-5b9b-823a-68f6da382c10", "parentControlId": 31542, "controlId": "CIP-007-6 5.7", "title": "CIP-007-6 5.7", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586364" }, { "controlId": "B.1.7", "title": "B.1.7 — Unsuccessful Login Attempts", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "edd701d4-7912-5378-8c69-268f6f3c6610", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.7", "title": "NEI 08-09 App D.1.7 — Unsuccessful Login Attempts", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "5a138f5c-049b-551f-a30f-0abb8717c33e", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.7", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "7fce9f13-5bc4-520a-9d44-6d30ec5fe450", "isPublic": true }, { "controlId": "CIP-007-6-R5", "title": "CIP-007-6-R5 — System Access Control and Authentication", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4d5e94dd-d7fa-5084-a4be-38dff6b161a9", "isPublic": true }, { "controlId": "CIP-007-6-5.1", "title": "CIP-007-6-5.1 — Have a method(s) to enforce authentication of interactive user access, where technically feasible.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ff4ee48e-58ca-5148-b5ef-2151f508dc99", "isPublic": true }, { "controlId": "CIP-007-6-5.2", "title": "CIP-007-6-5.2 — Identify and inventory all known enabled default or other generic account types, either by system, by groups of syste...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5f2b0aac-7319-523e-9e9f-da37f7783a2c", "isPublic": true }, { "controlId": "CIP-007-6-5.3", "title": "CIP-007-6-5.3 — Identify individuals who have authorized access to shared accounts.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "39b4561e-cab8-5039-b282-dc233c553c4f", "isPublic": true }, { "controlId": "CIP-007-6-5.4", "title": "CIP-007-6-5.4 — Change known default passwords, per Cyber Asset capability", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "206fbabf-5dd4-5dd6-a3a9-75f8970970b3", "isPublic": true }, { "controlId": "CIP-007-6-5.5", "title": "CIP-007-6-5.5 — For password-only authentication for interactive user access, either technically or procedurally enforce the followin...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "91dc90f7-0a99-53b0-af8a-01934627ecff", "isPublic": true }, { "controlId": "CIP-007-6-5.5.1", "title": "CIP-007-6-5.5.1 — Password length that is, at least, the lesser of eight characters or the maximum length supported by the Cyber Asset", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4de33d6a-511d-553c-9472-e7480752deed", "isPublic": true }, { "controlId": "CIP-007-6-5.5.2", "title": "CIP-007-6-5.5.2 — Minimum password complexity that is the lesser of three or more different types of characters (e.g., uppercase alphab...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "510799a6-de52-59be-9df1-59b224db03f7", "isPublic": true }, { "controlId": "CIP-007-6-5.6", "title": "CIP-007-6-5.6 — Where technically feasible, for password-only authentication for interactive user access, either technically or proce...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "757ef43c-0e8a-520a-9127-fbabefccdb18", "isPublic": true }, { "controlId": "CIP-007-6-5.7", "title": "CIP-007-6-5.7 — Where technically feasible, either:  Limit the number of unsuccessful authentication attempts", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4c428a7e-c1bf-59d6-864e-1f946e062253", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b864514c-4c79-5289-8601-6743ae56e1bb", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "304ff029-d494-590f-9a1f-b3dc9e788f34", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "8276fe8a-369c-595e-8019-fa21809664bd", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "7db7fc53-5ca5-52c2-a8a9-5607c07a7300", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "a47eedcd-0791-5e01-abf2-20cc4a62134d", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "656f4625-45de-5813-af99-34b270b9f886", "isPublic": true } ], "id": 31542, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731121", "catalogueId": 1062, "uuid": "53bb94eb-8a89-5e05-a26f-ad9643c76f5b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Account Lockout", "description": "

Control Description

Mechanisms exist to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded.

Level 4 - Quantitatively Controlled: Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.7
NERC-CIP (2026) Requirements: CIP-007-6-R5", "controlId": "IAC-22", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-22", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Active Directory (https://microsoft.com)\n∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72000, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590663", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590663", "securityControlId": 31543, "ccis": [], "uuid": "6cf77411-1f42-5029-9cbd-fbcd0d5a2978", "testId": "IAC-23_A01", "test": "accounts and/or account types for which to limit the number of concurrent sessions is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: privileged and non-privileged", "otherId": "53A_R5_AC-10_ODP[01]", "defaultText": null }, { "id": 72001, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590663", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590663", "securityControlId": 31543, "ccis": [], "uuid": "59293c3b-b1f5-5ecb-809f-104a63f0d52f", "testId": "IAC-23_A02", "test": "the number of concurrent sessions to be allowed for each account and/or account type is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: three (3) sessions for privileged access and two (2) sessions for non-privileged access", "otherId": "53A_R5_AC-10_ODP[02]", "defaultText": null }, { "id": 72002, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590663", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590663", "securityControlId": 31543, "ccis": [], "uuid": "f46966df-6202-552f-bdfc-ce8c6aa4b1c6", "testId": "IAC-23_A03", "test": "the number of concurrent sessions for each organization-defined account and/or account types is limited to organization-defined number.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: three (3) sessions for privileged access and two (2) sessions for non-privileged access", "otherId": "53A_R5_AC-10", "defaultText": null } ], "externalMappings": [ { "id": 580658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1378b889-a1be-51af-94df-521fe496e0c6", "parentControlId": 31543, "controlId": "USER 1.17", "title": "USER 1.17", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586367" }, { "id": 580659, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41041a4a-62b3-5a63-a9e2-687c375be475", "parentControlId": 31543, "controlId": "SR 2.7", "title": "SR 2.7", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586367" }, { "id": 580660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c66eff7e-89c5-582d-b7c0-8086214dd6f7", "parentControlId": 31543, "controlId": "CR 2.7", "title": "CR 2.7", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586367" }, { "id": 580661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4bbcd70-2c47-5daa-b769-2101b4f0a3bd", "parentControlId": 31543, "controlId": "T1137", "title": "T1137", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586367" }, { "id": 580662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d71a0942-c9b7-529e-a8de-9c7f51e5107a", "parentControlId": 31543, "controlId": "T1137.002", "title": "T1137.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586367" }, { "id": 580663, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dabb974d-bce3-57a8-8994-580805bdbd60", "parentControlId": 31543, "controlId": "T1185", "title": "T1185", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586367" }, { "id": 580664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59a5726a-0cd6-578b-8f58-753f983f20eb", "parentControlId": 31543, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586368" }, { "id": 580665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09ce2151-6a53-5a7a-968b-bcc0d50723e8", "parentControlId": 31543, "controlId": "AC-10", "title": "AC-10", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586368" }, { "id": 580666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d0f4a94-4be9-5553-bbf6-709eaaa62eff", "parentControlId": 31543, "controlId": "AC-10", "title": "AC-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586368" }, { "id": 580667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dde1583b-246f-54ca-aa96-af2eb0df1b45", "parentControlId": 31543, "controlId": "AC-10", "title": "AC-10", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586368" }, { "id": 580668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87f12114-d887-586d-85fa-9b4778455ab2", "parentControlId": 31543, "controlId": "AC-10", "title": "AC-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586368" }, { "id": 580669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a144266b-85a8-5ff1-ab14-622d5d90e5ba", "parentControlId": 31543, "controlId": "AC-10", "title": "AC-10", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586368" }, { "controlId": "B.1.8", "title": "B.1.8 — System Use Notification", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a84c168b-efa1-5303-91dd-997e6dbf8be6", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.8", "title": "NEI 08-09 App D.1.8 — System Use Notification", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "296dd0d8-8446-5317-bb9a-ac61f5a73d0d", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "2719aa8c-84e8-5d64-8dff-d715ae6e7e3f", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "5d2b7403-c52c-5d1a-b51f-960e669efc32", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "588fe90c-5c23-5a08-8c82-455682daa471", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "263a37d3-47d7-5590-a7f9-3b7af8ec252d", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "e95597f7-13bb-5243-98e8-c26c5f025d12", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "5bc3370d-5998-51df-9a44-84a602204daa", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "8ddf6073-a755-567b-be92-97f78c52f0a7", "isPublic": true } ], "id": 31543, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731121", "catalogueId": 1062, "uuid": "c38130bc-7dee-5200-854b-5e8f13500ee3", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization limit the number of concurrent sessions for each system account?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Concurrent Session Control", "description": "

Control Description

Mechanisms exist to limit the number of concurrent sessions for each system account.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to limit the number of concurrent sessions for each system account.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.8", "controlId": "IAC-23", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-23", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72003, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590663", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590663", "securityControlId": 31544, "ccis": [], "uuid": "bb9ce534-6fb6-52c4-a658-46d75c68a0e0", "testId": "IAC-24_A01", "test": "the period of inactivity after which the system initiates a session lock is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.10[a]", "defaultText": null }, { "id": 72004, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590664", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590664", "securityControlId": 31544, "ccis": [], "uuid": "c188cb01-8b2e-5d31-a515-0a7d5da499cc", "testId": "IAC-24_A02", "test": "access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.10[b]", "defaultText": null }, { "id": 72005, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590664", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590664", "securityControlId": 31544, "ccis": [], "uuid": "f2a22a7c-1ad7-5eb5-90ae-a309236291af", "testId": "IAC-24_A03", "test": "previously visible information is concealed via a pattern-hiding display after the defined period of inactivity.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.10[c]", "defaultText": null }, { "id": 72006, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590664", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590664", "securityControlId": 31544, "ccis": [], "uuid": "725ca717-2194-5fbe-bedc-cfdccdf18e7b", "testId": "IAC-24_A04", "test": "the time period of expected inactivity or description of when to log out is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: When inactivity is anticipated to exceed Fifteen (15) minutes. For privileged users, it is also the end of a user's standard work period.", "otherId": "53A_R5_AC-02(05)_ODP", "defaultText": null }, { "id": 72007, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590664", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590664", "securityControlId": 31544, "ccis": [], "uuid": "26611cc8-564e-5d52-a3d5-04e615b04c87", "testId": "IAC-24_A05", "test": "users are required to log out when organization-defined time period of expected inactivity or description of when to log out.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: When inactivity is anticipated to exceed Fifteen (15) minutes. For privileged users, it is also the end of a user's standard work period.", "otherId": "53A_R5_AC-02(05)", "defaultText": null }, { "id": 72008, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590664", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590664", "securityControlId": 31544, "ccis": [], "uuid": "ae30ba6f-9a2c-53da-96b3-e03397bbda96", "testId": "IAC-24_A06", "test": "the time period of inactivity after which a device lock is initiated is defined (if selected).
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: fifteen (15) minutes", "otherId": "53A_R5_AC-11_ODP[01]\n53A_R5_AC-11_ODP[02]\n171A_R3_A.03.01.10.ODP[02]", "defaultText": null }, { "id": 72009, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590665", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590665", "securityControlId": 31544, "ccis": [], "uuid": "8b31c769-cb0a-5f8f-bcdb-c68d87aeebdb", "testId": "IAC-24_A07", "test": "access to the system is prevented by .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: initiating a device lock after “at most 15 minutes” of inactivity and requiring the user to initiate a device lock before leaving the system unattended", "otherId": "53A_R5_AC-11a.\n171A_R3_A.03.01.10.a", "defaultText": null }, { "id": 72010, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590665", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590665", "securityControlId": 31544, "ccis": [], "uuid": "fc5d3d27-332e-5cdd-a3cb-a5f2118855a4", "testId": "IAC-24_A08", "test": "the device lock is retained until the user reestablishes access using established identification and authentication procedures.
PPTDF Applicability: Data
Assessment Rigor: 2", "otherId": "53A_R5_AC-11b.\n171A_R3_A.03.01.10.b", "defaultText": null }, { "id": 72011, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590665", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590665", "securityControlId": 31544, "ccis": [], "uuid": "f7df8099-d94b-52aa-887d-04aca6e53bea", "testId": "IAC-24_A09", "test": "one or more of the following PARAMETER VALUES are selected: {a device lock is initiated after of inactivity; the user is required to initiate a device lock before leaving the system unattended}.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at most 15- minute time period", "otherId": "171A_R3_A.03.01.10.ODP[01]", "defaultText": null } ], "externalMappings": [ { "id": 580686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58637", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e9910a1-4d7f-58e1-b193-53f6fa5e0786", "parentControlId": 31544, "controlId": "USER 1.18", "title": "USER 1.18", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58637" }, { "id": 580687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58637", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88dc020d-0172-5848-b945-9d8efdfcb613", "parentControlId": 31544, "controlId": "SR 2.5", "title": "SR 2.5", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58637" }, { "id": 580688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58637", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84b24323-7c6a-5772-9fac-1e1537b67182", "parentControlId": 31544, "controlId": "CR 2.5", "title": "CR 2.5", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58637" }, { "id": 580689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58637", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "698215fd-a589-5313-be16-0e5ad2f71939", "parentControlId": 31544, "controlId": "CR 2.5(a)", "title": "CR 2.5(a)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58637" }, { "id": 580690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae027873-b357-579a-be68-ec833cfb8e37", "parentControlId": 31544, "controlId": "CR 2.5(b)", "title": "CR 2.5(b)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586371" }, { "id": 580691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34690172-fa3f-5659-b2f8-3482f4b689fe", "parentControlId": 31544, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586371" }, { "id": 580692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d328b96a-97e4-56bb-881b-022ed12a9b0b", "parentControlId": 31544, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586371" }, { "id": 580693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "182dfb08-ed8b-59f1-b29e-721f528eb9c4", "parentControlId": 31544, "controlId": "AC-2(5)", "title": "AC-2(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586371" }, { "id": 580694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53445f8b-3153-51a6-94e3-e1f45ce03769", "parentControlId": 31544, "controlId": "AC-11", "title": "AC-11", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586371" }, { "id": 580695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b8b578d-7bed-5211-89b8-34ec42fc1aee", "parentControlId": 31544, "controlId": "AC-02(05)", "title": "AC-02(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586371" }, { "id": 580696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "648d37b0-8600-5268-be23-2e86bf8e289d", "parentControlId": 31544, "controlId": "AC-11", "title": "AC-11", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586371" }, { "id": 580697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586371", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd823f49-9e6e-56dd-bd94-ac19b31ca03f", "parentControlId": 31544, "controlId": "AC-02(05)", "title": "AC-02(05)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586371" }, { "id": 580698, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d288b22-104e-51d9-aadc-a6d918296e68", "parentControlId": 31544, "controlId": "AC-11", "title": "AC-11", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586372" }, { "id": 580699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b9b80e6-e290-5753-9c14-ac0027746cc5", "parentControlId": 31544, "controlId": "AC-02(05)", "title": "AC-02(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586372" }, { "id": 580700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ff1542e-52a6-555f-b67a-76fd90f43924", "parentControlId": 31544, "controlId": "AC-11", "title": "AC-11", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586372" }, { "id": 580701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e92aaff-3a70-59ae-8276-a8364d2cc2f9", "parentControlId": 31544, "controlId": "AC-02(05)", "title": "AC-02(05)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586372" }, { "id": 580702, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc73b75c-60e0-5510-b107-c76f3b380576", "parentControlId": 31544, "controlId": "AC-11", "title": "AC-11", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586372" }, { "id": 580703, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d23a7632-50b5-5635-9a02-a189ca71c8a3", "parentControlId": 31544, "controlId": "AC-02(05)", "title": "AC-02(05)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586372" }, { "id": 580704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bfa17b7-3ce8-5784-a166-0a58d4b9664b", "parentControlId": 31544, "controlId": "AC-11", "title": "AC-11", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586372" }, { "id": 580705, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2180864d-a098-5349-b1b0-810c9e7f8d3d", "parentControlId": 31544, "controlId": "3.1.10", "title": "3.1.10", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586372" }, { "id": 580706, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586372", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e6ab139-6bd3-54c4-a204-ac68b1252ae8", "parentControlId": 31544, "controlId": "03.01.10.a", "title": "03.01.10.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586372" }, { "id": 580707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586373", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c4a3715-d217-5877-af4c-ab5f23a81d65", "parentControlId": 31544, "controlId": "03.01.10.b", "title": "03.01.10.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586373" }, { "controlId": "B.1.9", "title": "B.1.9 — Previous Logon Notification", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-9", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "9ef23fc1-d4e9-5781-a914-4afa2a02dba0", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.9", "title": "NEI 08-09 App D.1.9 — Previous Logon Notification", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.9", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "efdbb8e9-15b1-529a-b7ab-41a434bd692f", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.9", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "2b56d0c6-4390-5eb6-a559-da3a5454177f", "isPublic": true }, { "controlId": "B.1.10", "title": "B.1.10 — Session Lock", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "5370c950-6b8d-5ef1-b961-5d42bae426b4", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.10", "title": "NEI 08-09 App D.1.10 — Session Lock", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.10", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "eb8dfc8d-90ba-5cb3-a6fb-446583234ee0", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "8580eb75-8b55-594b-aba0-ae040843fd9d", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "d1141dee-3827-5a57-8a61-d5240d4225f5", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "26b0cd56-8e11-51a3-b5b0-85edef25fca6", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "e56d393e-a5a1-5e1c-99d2-92a6b57a5838", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "8aee16ad-3d75-5d53-a170-7628b392c5b4", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "f6963b00-543c-54b8-a5b4-0f1c5ff3c073", "isPublic": true } ], "id": 31544, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731122", "catalogueId": 1062, "uuid": "c0e3f0d0-0a8c-572b-9313-4c28a3618461", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization initiate a session lock after an organization-defined time period of inactivity, or upon receiving a request from a user and retain the session lock until the user reestablishes access using established identification and authentication methods?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Session Lock", "description": "

Control Description

Mechanisms exist to initiate a session lock after an organization-defined time period of inactivity, or upon receiving a request from a user and retain the session lock until the user reestablishes access using established identification and authentication methods.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to initiate a session lock after an organization-defined time period of inactivity, or upon receiving a request from a user and retain the session lock until the user reestablishes access using established identification and authentication methods.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.9, B.1.10", "controlId": "IAC-24", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-24", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72012, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590666", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590666", "securityControlId": 31545, "ccis": [], "uuid": "e2c7cc37-c168-5ba8-b61c-5a8234b28e2c", "testId": "IAC-24.1_A01", "test": "information previously visible on the display is concealed via device lock with a publicly viewable image.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: requiring the user to initiate a device lock before leaving the system unattended.", "otherId": "53A_R5_AC-11(01)\n171A_R3_A.03.01.10.c", "defaultText": null } ], "externalMappings": [ { "id": 580751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586378", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "728b7e1a-7141-582a-850b-ebbbaaa50993", "parentControlId": 31545, "controlId": "AC-11(1)", "title": "AC-11(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586378" }, { "id": 580752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586379", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c13ce9c6-1098-5907-a1dd-232bc651999c", "parentControlId": 31545, "controlId": "AC-11(01)", "title": "AC-11(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586379" }, { "id": 580753, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586379", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb4fa2a4-eb20-56b4-b262-f5d500e89b58", "parentControlId": 31545, "controlId": "AC-11(01)", "title": "AC-11(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586379" }, { "id": 580754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586379", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4fa6ad7-5e55-56c1-9c5a-815feef961a6", "parentControlId": 31545, "controlId": "AC-11(01)", "title": "AC-11(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586379" }, { "id": 580755, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586379", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f08bb2f1-1dd5-5108-91cf-6dcf38600a58", "parentControlId": 31545, "controlId": "AC-11(01)", "title": "AC-11(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586379" }, { "id": 580756, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586379", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d662913-d917-5111-80e4-c88a3029716e", "parentControlId": 31545, "controlId": "AC-11(01)", "title": "AC-11(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586379" }, { "id": 580757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586379", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ef9865a-85a1-525f-86d4-4b18b6daff5b", "parentControlId": 31545, "controlId": "3.1.10", "title": "3.1.10", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586379" }, { "id": 580758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586379", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7769ba9-7dd8-5722-ab84-3b274d829b8c", "parentControlId": 31545, "controlId": "03.01.10.c", "title": "03.01.10.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586379" } ], "id": 31545, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731122", "catalogueId": 1062, "uuid": "b44b1a1e-e7d9-5c03-b203-f6844525d5e6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement pattern-hiding displays to conceal information previously visible on the display during the session lock?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Pattern-Hiding Displays", "description": "

Control Description

Mechanisms exist to implement pattern-hiding displays to conceal information previously visible on the display during the session lock.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement pattern-hiding displays to conceal information previously visible on the display during the session lock.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-24.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-24.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72013, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590666", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590666", "securityControlId": 31546, "ccis": [], "uuid": "ba54bd51-8c98-5c78-b739-bc834b6147bd", "testId": "IAC-25_A01", "test": "conditions requiring a user session to terminate are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.11[a]", "defaultText": null }, { "id": 72014, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590666", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590666", "securityControlId": 31546, "ccis": [], "uuid": "926ae699-3690-5642-a9b8-1b1eb89ee09f", "testId": "IAC-25_A02", "test": "conditions or trigger events that require session disconnect are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.11[b]\n171A_R3_A.03.01.11.ODP[01]\n53A_R5_AC-12_ODP", "defaultText": null }, { "id": 72015, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590666", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590666", "securityControlId": 31546, "ccis": [], "uuid": "ee35e651-9831-50c0-9b59-5dea9aea4fc3", "testId": "IAC-25_A03", "test": "a user session is automatically terminated after any of the defined conditions occur.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-12\n171A_3.1.11[b]", "defaultText": null }, { "id": 72016, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590666", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590666", "securityControlId": 31546, "ccis": [], "uuid": "691d3d4e-0176-55a8-8b25-ebce84441c7e", "testId": "IAC-25_A04", "test": "the time period of expected inactivity requiring users to log out of the system is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.ODP[05]", "defaultText": null }, { "id": 72017, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590666", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590666", "securityControlId": 31546, "ccis": [], "uuid": "7dab1ac1-ec9b-57c7-939f-76dfbfd18372", "testId": "IAC-25_A05", "test": "circumstances requiring users to log out of the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.01.ODP[06]", "defaultText": null }, { "id": 72018, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590667", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590667", "securityControlId": 31546, "ccis": [], "uuid": "7031ba24-a6ce-5a52-a398-d91b9fe7d1bb", "testId": "IAC-25_A06", "test": "users are required to log out of the system after of expected inactivity or when the following circumstances occur: .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: SDP values:\n[05] - at most 24 hours\n[06] - the work period ends, for privileged users at a minimum", "otherId": "171A_R3_A.03.01.01.h", "defaultText": null }, { "id": 72019, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590667", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590667", "securityControlId": 31546, "ccis": [], "uuid": "ce778cce-63f1-5fa9-8bd1-a8c7c3ffc192", "testId": "IAC-25_A07", "test": "session connections are terminated when nonlocal maintenance is completed.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.07.05.c[01]", "defaultText": null }, { "id": 72020, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590667", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590667", "securityControlId": 31546, "ccis": [], "uuid": "4a76a198-fa99-567d-ab4d-fe0bc9d544db", "testId": "IAC-25_A08", "test": "a user session is terminated automatically after .
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: a specified duration (maximum of 24 hours) of inactivity, misbehavior (end the session due to an attempted policy violation), and maintenance (terminate sessions to prevent issues with an upgrade or service outage)", "otherId": "171A_R3_A.03.01.11", "defaultText": null } ], "externalMappings": [ { "id": 580773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586381", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da16dcc5-7311-59ee-bc4d-e7e893677e39", "parentControlId": 31546, "controlId": "SR 2.6", "title": "SR 2.6", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586381" }, { "id": 580774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586381", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c880dcb3-0a26-58e6-9b4d-bbf21c458082", "parentControlId": 31546, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586381" }, { "id": 580775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586381", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "898f2361-92e9-5790-92be-0aa9d007fae6", "parentControlId": 31546, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586381" }, { "id": 580776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586381", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5493a00b-a1e9-53ae-bbe8-b4ad8a282369", "parentControlId": 31546, "controlId": "T1185", "title": "T1185", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586381" }, { "id": 580777, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bf987e9-8742-5246-880f-ae6c56bbd680", "parentControlId": 31546, "controlId": "T1505.005", "title": "T1505.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586382" }, { "id": 580778, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17327b50-9d6d-50c1-a202-25b10fb5b025", "parentControlId": 31546, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586382" }, { "id": 580779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d8c43fc-e681-5b28-978f-d89f872d2a82", "parentControlId": 31546, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586382" }, { "id": 580780, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "571cbeb8-8ff0-562f-b126-79e373de9d5a", "parentControlId": 31546, "controlId": "AC-12", "title": "AC-12", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586382" }, { "id": 580781, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "890aaeab-0a86-5f08-952c-7ba04a52dc0f", "parentControlId": 31546, "controlId": "AC-12", "title": "AC-12", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586382" }, { "id": 580782, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c013b53-2afa-51d5-9d29-10ac318ff51e", "parentControlId": 31546, "controlId": "AC-12", "title": "AC-12", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586382" }, { "id": 580784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "add4fe8a-f19d-58f0-bca7-9ebf527c0b2f", "parentControlId": 31546, "controlId": "AC-12", "title": "AC-12", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586382" }, { "id": 580785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a9af36d-7ea9-502b-b9cd-9af43cd8903a", "parentControlId": 31546, "controlId": "AC-12", "title": "AC-12", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586382" }, { "id": 580786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06e155d0-58cd-545c-aa66-cf0223abb87b", "parentControlId": 31546, "controlId": "AC-12", "title": "AC-12", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586382" }, { "id": 580788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586383", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "052b6781-2311-5ff5-969c-bf333fa60729", "parentControlId": 31546, "controlId": "3.1.11", "title": "3.1.11", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586383" }, { "id": 580789, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586383", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed1464ba-3ea8-57af-aa9d-29ecf963d481", "parentControlId": 31546, "controlId": "03.01.01.h", "title": "03.01.01.h", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586383" }, { "id": 580790, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586383", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c044cd59-05fa-5fa1-8fcb-1d9e00c3ac03", "parentControlId": 31546, "controlId": "03.01.11", "title": "03.01.11", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586383" }, { "id": 580791, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586391", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfb5d946-a470-527f-b77d-48e19abdb9a6", "parentControlId": 31546, "controlId": "03.07.05.c", "title": "03.07.05.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586391" }, { "id": 580816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d17bc3ae-4488-5ad9-b586-890308ef290b", "parentControlId": 31546, "controlId": "CIP-005-7 2.5", "title": "CIP-005-7 2.5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586394" }, { "id": 580817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d537d2e0-f956-5ab3-8a0a-1a9fd9e3c4ef", "parentControlId": 31546, "controlId": "CIP-005-7 3.2", "title": "CIP-005-7 3.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586394" }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "4e522fd0-1707-5235-996d-f4d04e0620f6", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "62d08941-ad7a-5b79-951f-950197d697c4", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "18b719e3-b8f9-5d29-81a5-0bdd26182ce4", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "efd2180d-3f6a-5c96-8fed-b7f3e3e511ea", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "54c18da3-8d2a-55c0-912c-1f857da87fd6", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "f5b8ac85-c634-55b1-9c18-fafa54c29b01", "isPublic": true } ], "id": 31546, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731122", "catalogueId": 1062, "uuid": "441448dc-a7b5-51fc-9169-4b876921b34b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to log out users, both locally on the network and for remote sessions, at the end of the session or after an organization-defined period of inactivity?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Session Termination", "description": "

Control Description

Automated mechanisms exist to log out users, both locally on the network and for remote sessions, at the end of the session or after an organization-defined period of inactivity.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions.\n▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically log out users, both locally on the network and for remote sessions, at the end of the session or after an organization-defined period of inactivity.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-25", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-25", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72021, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590667", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590667", "securityControlId": 31547, "ccis": [], "uuid": "bac3fc2f-02f3-53cc-9ddc-3eaf4c126a33", "testId": "IAC-25.1_A01", "test": "information resources for which a logout capability for user-initiated communications sessions is required are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-12(01)_ODP", "defaultText": null }, { "id": 72022, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590667", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590668", "securityControlId": 31547, "ccis": [], "uuid": "c27059b8-06e5-57e1-b1ca-8daa9acd30a1", "testId": "IAC-25.1_A02", "test": "a logout capability is provided for user-initiated communications sessions whenever authentication is used to gain access to organization-defined information resources.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-12(01)", "defaultText": null } ], "externalMappings": [ { "id": 580828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e8e5a94-542b-5b07-a8e9-23ba5bfda624", "parentControlId": 31547, "controlId": "AC-12(1)", "title": "AC-12(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586396" }, { "id": 580829, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63bb5358-59c8-50e2-9fbd-a27dd0846434", "parentControlId": 31547, "controlId": "AC-12(01)", "title": "AC-12(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586396" }, { "id": 580830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "520e06f2-7f83-5b20-936d-271d225d0723", "parentControlId": 31547, "controlId": "AC-12(01)", "title": "AC-12(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586396" } ], "id": 31547, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731123", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731123", "catalogueId": 1062, "uuid": "d0e07232-9efb-5057-a1ec-3faa94301ba9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide a logout capability and display an explicit logout message to users indicating the reliable termination of the session?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "User-Initiated Logouts / Message Displays", "description": "

Control Description

Mechanisms exist to provide a logout capability and display an explicit logout message to users indicating the reliable termination of the session.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide a logout capability and display an explicit logout message to users indicating the reliable termination of the session.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-25.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-25.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72023, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590668", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590668", "securityControlId": 31548, "ccis": [], "uuid": "1d87335d-caa1-537b-b589-14ae1c4fb822", "testId": "IAC-26_A01", "test": "user actions that can be performed on the system without identification or authentication are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-14_ODP", "defaultText": null }, { "id": 72024, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590668", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590668", "securityControlId": 31548, "ccis": [], "uuid": "1844f712-eee3-59bc-a61f-88f881e3628e", "testId": "IAC-26_A02", "test": "organization-defined user actions that can be performed on the system without identification or authentication consistent with organizational mission and business functions are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-14a.", "defaultText": null }, { "id": 72025, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590668", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590668", "securityControlId": 31548, "ccis": [], "uuid": "fd881228-413f-5bfa-a18c-d9cb79c2ae3a", "testId": "IAC-26_A03", "test": "user actions not requiring identification or authentication are documented in the security plan for the system.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-14b.[01]", "defaultText": null }, { "id": 72026, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590668", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590668", "securityControlId": 31548, "ccis": [], "uuid": "7c692ec7-0f3c-5e76-8dfd-322576c33e88", "testId": "IAC-26_A04", "test": "a rationale for user actions not requiring identification or authentication is provided in the security plan for the system.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-14b.[02]", "defaultText": null } ], "externalMappings": [ { "id": 580837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3cfea721-e2ff-557f-a36d-69c76e6e3470", "parentControlId": 31548, "controlId": "T1137.002", "title": "T1137.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586397" }, { "id": 580838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4805ba21-eaf2-5b92-a254-6d2698c77f04", "parentControlId": 31548, "controlId": "AC-14", "title": "AC-14", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586397" }, { "id": 580839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9af3887-5802-5bd0-a916-7198f6a4b9dc", "parentControlId": 31548, "controlId": "AC-14", "title": "AC-14", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586397" }, { "id": 580840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a222bb96-366f-5554-926f-1aa484dfc33b", "parentControlId": 31548, "controlId": "AC-14", "title": "AC-14", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586397" }, { "id": 580841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3057eb8-24a7-55db-ae06-7b56cd6b0d38", "parentControlId": 31548, "controlId": "AC-14", "title": "AC-14", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586398" }, { "id": 580842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8f89f78-65c7-5e46-85bd-d96160289d2f", "parentControlId": 31548, "controlId": "AC-14", "title": "AC-14", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586398" }, { "id": 580843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a355d855-4301-583d-a033-2453ff59b06f", "parentControlId": 31548, "controlId": "AC-14", "title": "AC-14", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586398" }, { "id": 580844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f2594fd-6fb5-54d9-9031-500bfb0058a7", "parentControlId": 31548, "controlId": "AC-14", "title": "AC-14", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586398" }, { "controlId": "B.1.10", "title": "B.1.10 — Session Lock", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "b2798f8c-a101-54b5-8074-de2f33ffc70c", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.10", "title": "NEI 08-09 App D.1.10 — Session Lock", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.10", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "fc612632-fb68-5007-b2e3-dedeef572d79", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.10", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "a5f6bbf7-9af7-54bf-8a6c-5aa69783fb8e", "isPublic": true }, { "controlId": "B.1.12", "title": "B.1.12 — Permitted Actions without Identification or Authentication", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-14", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "51a741f6-eb8d-513e-8427-864697977bb8", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.12", "title": "NEI 08-09 App D.1.12 — Permitted Actions without Identification or Authentication", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.12", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "dcc320ef-f9f4-5eb3-b98b-fe096bc1372b", "isPublic": true }, { "controlId": "B.4.4", "title": "B.4.4 — Non-Authenticated Human Machine Interaction Security", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-14, IA-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "c29b409a-afb0-56b4-bc7c-65c0c1da083e", "isPublic": true }, { "controlId": "NEI 08-09 App D.4.4", "title": "NEI 08-09 App D.4.4 — Non-Authenticated Human Machine Interaction Security", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.4.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "2ba0b623-43c9-5607-bc73-5c6a4dc2af8c", "isPublic": true }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "51a5b98b-b99a-5fc7-a7b3-14b96243f030", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "c2670651-b85c-5546-9a4f-3fbdc978eb95", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "3e6a6db7-f9d9-5cd8-861a-9d0b19a88bb4", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "2257ef26-0b46-52cf-a683-fbc365065a43", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "d9112c2e-d71f-5061-912f-474adabe13a6", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "c1557d5e-aba2-5bd0-b625-0e86717542dc", "isPublic": true } ], "id": 31548, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731123", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731123", "catalogueId": 1062, "uuid": "7296e34b-44d8-5902-a61d-dfbf2c2bae08", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify and document the supporting rationale for specific user actions that can be performed on a system without identification or authentication?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Permitted Actions Without Identification or Authorization", "description": "

Control Description

Mechanisms exist to identify and document the supporting rationale for specific user actions that can be performed on a system without identification or authentication.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify and document the supporting rationale for specific user actions that can be performed on a system without identification or authentication.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.10, B.1.12, B.4.4", "controlId": "IAC-26", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-26", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72027, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590668", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590668", "securityControlId": 31549, "ccis": [], "uuid": "50241b93-067b-5c2d-9b88-5a55ffbc39cd", "testId": "IAC-27_A01", "test": "access control policies for which a reference monitor is implemented are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-25_ODP", "defaultText": null }, { "id": 72028, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590669", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590669", "securityControlId": 31549, "ccis": [], "uuid": "3689cc96-0b5d-5151-85bb-445f10830713", "testId": "IAC-27_A02", "test": "a reference monitor is implemented for organization-defined access control policies that is tamper-proof, always invoked and small enough to be subject to analysis and testing, the completeness of which can be assured.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-25", "defaultText": null } ], "externalMappings": [ { "id": 580858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6032d15-300a-5b2d-9c87-0409ed6d1c0c", "parentControlId": 31549, "controlId": "AC-25", "title": "AC-25", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5864" }, { "id": 580859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8404c23-01ef-547f-a04c-28ed0ce69e7a", "parentControlId": 31549, "controlId": "AC-25", "title": "AC-25", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5864" }, { "id": 580860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55bf17d1-ff2a-58b4-9b57-d4832c5a43eb", "parentControlId": 31549, "controlId": "AC-25", "title": "AC-25", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5864" }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "418f829c-6a72-5b36-bf69-78c72e1e806f", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "1c1eef2e-7294-55bd-8751-a64d26f5a0c0", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "f97ee9d8-b80e-5f31-94c7-e37cb8136a20", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "aac4c3b7-05e2-5893-9818-89fc0f52ab71", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "0d039631-2bea-5583-9def-b8fde93bad21", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "95fe672b-92b2-53fa-a5bd-98337534f683", "isPublic": true } ], "id": 31549, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731123", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731123", "catalogueId": 1062, "uuid": "6c32c0ef-43e5-51d2-81b1-a13a5ecfd7b0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement a reference monitor that is tamperproof, always-invoked, small enough to be subject to analysis / testing and the completeness of which can be assured?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Reference Monitor", "description": "

Control Description

Mechanisms exist to implement a reference monitor that is tamperproof, always-invoked, small enough to be subject to analysis / testing and the completeness of which can be assured.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement a reference monitor that is tamperproof, always-invoked, small enough to be subject to analysis / testing and the completeness of which can be assured.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-27", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-27", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72029, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590669", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590669", "securityControlId": 31550, "ccis": [], "uuid": "f8e9d9ef-ed2b-51c7-b127-f1899771ac5b", "testId": "IAC-28_A01", "test": "users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity proofed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-12a.", "defaultText": null }, { "id": 72030, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590669", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590669", "securityControlId": 31550, "ccis": [], "uuid": "e255471b-a151-5fe9-8cc7-2e3654dd1182", "testId": "IAC-28_A02", "test": "user identities are resolved to a unique individual.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IA-12b.", "defaultText": null }, { "id": 72031, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590669", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590669", "securityControlId": 31550, "ccis": [], "uuid": "c49ec7f0-5c74-5ab4-9cf4-bb522a12ad78", "testId": "IAC-28_A03", "test": "identity evidence is collected.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-12c.[01]", "defaultText": null }, { "id": 72032, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590669", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590669", "securityControlId": 31550, "ccis": [], "uuid": "6831e607-4b47-5c00-aaff-2754ab48aaa2", "testId": "IAC-28_A04", "test": "identity evidence is validated.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-12c.[02]", "defaultText": null }, { "id": 72033, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590669", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59067", "securityControlId": 31550, "ccis": [], "uuid": "dab17a13-29ec-595e-b9b7-cb39929e954e", "testId": "IAC-28_A05", "test": "identity evidence is verified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IA-12c.[03]", "defaultText": null } ], "externalMappings": [ { "id": 580861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b132c2e4-8033-583d-9a1b-d6bc53a1f3b4", "parentControlId": 31550, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5864" }, { "id": 580862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8916995-4735-55d0-b5c1-cc5a803ca650", "parentControlId": 31550, "controlId": "T1078.002", "title": "T1078.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5864" }, { "id": 580863, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35c55a2a-c26c-502b-bba0-d0d5e7c67163", "parentControlId": 31550, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5864" }, { "id": 580864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1ec956e-8b5d-5a6e-8bdb-1e4b66e5af37", "parentControlId": 31550, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5864" }, { "id": 580865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90f55649-7546-503a-8086-9745e2ddcf32", "parentControlId": 31550, "controlId": "IA-12", "title": "IA-12", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5864" }, { "id": 580866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e3358a0-a1bb-5955-bd3d-cdeef639ba80", "parentControlId": 31550, "controlId": "IA-12", "title": "IA-12", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586401" }, { "id": 580868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f9882a0-f977-5aed-825f-b64529582008", "parentControlId": 31550, "controlId": "IA-12", "title": "IA-12", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586401" }, { "id": 580869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "261fef95-c1ae-5737-b94a-82eff700dec3", "parentControlId": 31550, "controlId": "IA-12", "title": "IA-12", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586401" }, { "id": 580870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a361cda-bdc0-5e21-9902-e4117b909800", "parentControlId": 31550, "controlId": "IA-12", "title": "IA-12", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586401" }, { "id": 580871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08ae2b09-a3d8-5cc4-ad4e-d04024aebfb8", "parentControlId": 31550, "controlId": "03.05.12.a", "title": "03.05.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586401" }, { "id": 580872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a72335c9-b59a-5b03-b11e-269355f11bee", "parentControlId": 31550, "controlId": "03.05.12.c", "title": "03.05.12.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586401" }, { "id": 580873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3d1d052-2980-54c9-99b8-a88757d93d53", "parentControlId": 31550, "controlId": "PR.AA-02", "title": "PR.AA-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586401" }, { "id": 580880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586402", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "313273dc-a803-5011-9856-b44ae7ca8470", "parentControlId": 31550, "controlId": "WORKFORCE-1f", "title": "WORKFORCE-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586402" }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "6b041555-cee8-596c-b8ae-394dfe4d7b01", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "2bf18db5-a240-54a2-a6e3-86e4b5ed8048", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "adc920bb-a085-51a0-be19-4f96807a1bce", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "f9018c86-beea-5ecd-8f00-c5f679068571", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "eca44825-32f9-57cb-87e4-022babe32db8", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "59eeeb09-69d1-557a-8ace-faad06577785", "isPublic": true } ], "id": 31550, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731124", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731124", "catalogueId": 1062, "uuid": "68105bea-f010-539e-8d79-fd7d866e7656", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization verify the identity of a user before issuing authenticators or modifying access permissions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Identity Proofing (Identity Verification)", "description": "

Control Description

Mechanisms exist to verify the identity of a user before issuing authenticators or modifying access permissions.

Evidence Request List (ERL)

E-IAM-02\nE-IAM-05\nE-IAM-06\nE-HRS-18

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to verify the identity of a user before issuing authenticators or modifying access permissions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-28", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-28", "references": "

Micro-Small Business (<10 staff)

∙ Driver's license\n∙ Passport

Small Business (10-49 staff)

∙ Driver's license\n∙ Passport

Medium Business (50-249 staff)

∙ Driver's license\n∙ Passport

Large Business (250-999 staff)

∙ Driver's license\n∙ Passport

Enterprise (>1,000 staff)

∙ Driver's license\n∙ Passport", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72034, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59067", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59067", "securityControlId": 31551, "ccis": [], "uuid": "9c03df05-7387-530c-bef0-6d0e238d14a2", "testId": "IAC-28.1_A01", "test": "the registration process to receive an account for logical access includes supervisor or sponsor authorization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-12(01)", "defaultText": null }, { "id": 72035, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59067", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59067", "securityControlId": 31551, "ccis": [], "uuid": "931910cf-c44e-5d09-a5d6-103c6538e348", "testId": "IAC-28.1_A02", "test": "access control decisions applied to each access request prior to access enforcement are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-24_ODP[01]\n53A_R5_AC-24_ODP[02]", "defaultText": null }, { "id": 72036, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59067", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59067", "securityControlId": 31551, "ccis": [], "uuid": "f6f91b62-b693-5789-b1ed-e3a763a16816", "testId": "IAC-28.1_A03", "test": "organization-defined criteria are taken into account to ensure that access control decisions are applied to each access request prior to access enforcement.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-24", "defaultText": null } ], "externalMappings": [ { "id": 580893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f57fd50a-9eb3-5b4e-97a4-d750ccc50228", "parentControlId": 31551, "controlId": "AC-24", "title": "AC-24", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586404" }, { "id": 580894, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25422c26-536f-584e-bf5d-0abcc1c598c3", "parentControlId": 31551, "controlId": "IA-4(2)", "title": "IA-4(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586404" }, { "id": 580895, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4528f819-27c2-5c62-9144-de4b8cb4e279", "parentControlId": 31551, "controlId": "AC-24", "title": "AC-24", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586404" }, { "id": 580896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68762f9b-2fb9-5fb0-aa7e-d76db1aa2905", "parentControlId": 31551, "controlId": "IA-12(01)", "title": "IA-12(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586404" }, { "id": 580898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5bb84153-a696-5a6a-9f73-33dd96c85fce", "parentControlId": 31551, "controlId": "AC-24", "title": "AC-24", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586404" }, { "id": 580899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f1a9f19-5db5-5498-8971-9fb44eb79194", "parentControlId": 31551, "controlId": "IA-12(01)", "title": "IA-12(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586405" }, { "id": 580900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c92bb43a-ac72-5ae5-8a36-22b1c0a4dff3", "parentControlId": 31551, "controlId": "IA-12(01)", "title": "IA-12(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586405" }, { "id": 580901, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfdf6856-9776-5c37-bdbc-3e274ee6367a", "parentControlId": 31551, "controlId": "AC-24", "title": "AC-24", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586405" }, { "id": 580902, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eaf6781c-54d7-58fd-a463-01631d929a3a", "parentControlId": 31551, "controlId": "AC-24", "title": "AC-24", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586405" }, { "id": 580906, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72cc0057-8e17-5e1a-b396-61028f7e5869", "parentControlId": 31551, "controlId": "03.01.01.b", "title": "03.01.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586405" }, { "id": 580907, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e6ff72c-f804-50f3-9cd2-40a36d8e41ac", "parentControlId": 31551, "controlId": "03.05.05.a", "title": "03.05.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586405" }, { "id": 580910, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5cffb63-117f-565f-9936-1eda71dcd267", "parentControlId": 31551, "controlId": "ACCESS-2f", "title": "ACCESS-2f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586406" }, { "id": 580911, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f679ca46-80a0-5a6a-8eeb-51c06e7122f1", "parentControlId": 31551, "controlId": "ACCESS-2g", "title": "ACCESS-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586406" }, { "id": 580915, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ccccc2e5-2466-5206-a60e-f30f18415a2f", "parentControlId": 31551, "controlId": "CIP-004-7 6.1", "title": "CIP-004-7 6.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586406" } ], "id": 31551, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731156", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731156", "catalogueId": 1062, "uuid": "dd36ab1f-1965-52f5-bcf1-8d076a767e3a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure management approvals are required for new accounts or changes in permissions to existing accounts?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Management Approval For New or Changed Accounts", "description": "

Control Description

Mechanisms exist to ensure management approvals are required for new accounts or changes in permissions to existing accounts.

Evidence Request List (ERL)

E-IAM-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure management approvals are required for new accounts or changes in permissions to existing accounts.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-28.1", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-28.1", "references": "

Micro-Small Business (<10 staff)

∙ Require manager approval before creating new user accounts

Small Business (10-49 staff)

∙ Management approval process for new/changed accounts

Medium Business (50-249 staff)

∙ Formal account management approval policy\n∙ Approval workflow for all account changes

Large Business (250-999 staff)

∙ Enterprise IAM with management approval workflows for account creation

Enterprise (>1,000 staff)

∙ Enterprise IGA platform with approval workflow automation (e.g., SailPoint, Saviynt)\n∙ Role-based approval routing", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72037, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590671", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590671", "securityControlId": 31552, "ccis": [], "uuid": "a4f7a373-cf8b-5cb3-9f2d-d5c3e8227500", "testId": "IAC-28.2_A01", "test": "evidence of individual identification is presented to the registration authority.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-12(02)", "defaultText": null } ], "externalMappings": [ { "id": 580924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60941f1e-a90b-53e5-bce8-09cb1bcb60f0", "parentControlId": 31552, "controlId": "IA-12(02)", "title": "IA-12(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586407" }, { "id": 580925, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0c11707-d677-5303-89b8-3e551de38ea3", "parentControlId": 31552, "controlId": "IA-12(02)", "title": "IA-12(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586408" }, { "id": 580927, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91230294-29bd-5456-a516-b5d0e2f01b78", "parentControlId": 31552, "controlId": "IA-12(02)", "title": "IA-12(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586408" }, { "id": 580928, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5dc21cbc-94ac-5af9-b840-1c5aef8c7a4b", "parentControlId": 31552, "controlId": "IA-12(02)", "title": "IA-12(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586408" }, { "id": 580929, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04b5515d-b034-5a1c-b86b-abdaef54e210", "parentControlId": 31552, "controlId": "IA-12(02)", "title": "IA-12(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586408" } ], "id": 31552, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731156", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731156", "catalogueId": 1062, "uuid": "ecf7b174-ec85-5cd8-a8b2-d8068b829646", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require evidence of individual identification to be presented to the registration authority?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Identity Evidence", "description": "

Control Description

Mechanisms exist to require evidence of individual identification to be presented to the registration authority.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.\n▪ IAM proactively governs account management of individual, group, system, application, guest and temporary accounts.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require evidence of individual identification to be presented to the registration authority.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-28.2", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-28.2", "references": "

Micro-Small Business (<10 staff)

∙ Driver's license\n∙ Passport

Small Business (10-49 staff)

∙ Driver's license\n∙ Passport

Medium Business (50-249 staff)

∙ Driver's license\n∙ Passport

Large Business (250-999 staff)

∙ Driver's license\n∙ Passport

Enterprise (>1,000 staff)

∙ Driver's license\n∙ Passport", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72038, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590671", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590671", "securityControlId": 31553, "ccis": [], "uuid": "fed528df-364c-542f-ac3f-9b1847d78944", "testId": "IAC-28.3_A01", "test": "methods of validation and verification of identity evidence are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-12(03)_ODP", "defaultText": null }, { "id": 72039, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590671", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590671", "securityControlId": 31553, "ccis": [], "uuid": "083a7c8e-e65d-5bc2-9727-fc57f830cc4b", "testId": "IAC-28.3_A02", "test": "the presented identity evidence is validated and verified through organization-defined methods of validation and verification.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-12(03)", "defaultText": null } ], "externalMappings": [ { "id": 580936, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee30f50a-83eb-519e-82c3-745e71fe2f27", "parentControlId": 31553, "controlId": "IA-12(03)", "title": "IA-12(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586409" }, { "id": 580937, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea9ebd0f-3910-5e3f-9fec-bc4b74cf6c80", "parentControlId": 31553, "controlId": "IA-12(03)", "title": "IA-12(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586409" }, { "id": 580939, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e52c7c91-8402-583f-98a4-274ee96a53c7", "parentControlId": 31553, "controlId": "IA-12(03)", "title": "IA-12(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586409" }, { "id": 580940, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdbacda7-7291-5509-8d9a-940247a339f8", "parentControlId": 31553, "controlId": "IA-12(03)", "title": "IA-12(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586409" }, { "id": 580941, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09b22ba2-b9d5-55df-b59a-4764a5b06b7c", "parentControlId": 31553, "controlId": "IA-12(03)", "title": "IA-12(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586409" } ], "id": 31553, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731157", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731157", "catalogueId": 1062, "uuid": "be7d0576-6522-5863-a774-3bf13392c6c4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require that the presented identity evidence be validated and verified through organizational-defined methods of validation and verification?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Identity Evidence Validation & Verification", "description": "

Control Description

Mechanisms exist to require that the presented identity evidence be validated and verified through organizational-defined methods of validation and verification.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require that the presented identity evidence be validated and verified through organizational-defined methods of validation and verification.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-28.3", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-28.3", "references": "

Micro-Small Business (<10 staff)

∙ Employment verification\n∙ Credit check\n∙ Criminal history check\n∙ Education verification

Small Business (10-49 staff)

∙ Employment verification\n∙ Credit check\n∙ Criminal history check\n∙ Education verification

Medium Business (50-249 staff)

∙ Employment verification\n∙ Credit check\n∙ Criminal history check\n∙ Education verification

Large Business (250-999 staff)

∙ Employment verification\n∙ Credit check\n∙ Criminal history check\n∙ Education verification

Enterprise (>1,000 staff)

∙ Employment verification\n∙ Credit check\n∙ Criminal history check\n∙ Education verification", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72040, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590672", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590672", "securityControlId": 31554, "ccis": [], "uuid": "eb76a564-07ba-51b0-ab3f-45b6132ca456", "testId": "IAC-28.4_A01", "test": "the validation and verification of identity evidence is conducted in person before a designated registration authority.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-12(04)", "defaultText": null } ], "externalMappings": [ { "id": 580948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58641", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05efc55b-0add-501e-8303-da5b1ea1986a", "parentControlId": 31554, "controlId": "IA-5(3)", "title": "IA-5(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58641" }, { "id": 580949, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58641", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d03ec6bb-bbc8-58bb-9218-dfb71a42af66", "parentControlId": 31554, "controlId": "IA-12(04)", "title": "IA-12(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58641" }, { "id": 580951, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ee4904f-283d-54c5-bbcf-953d1e104bbc", "parentControlId": 31554, "controlId": "IA-12(04)", "title": "IA-12(04)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586411" }, { "id": 580952, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96ffb19f-aa70-510c-a8d2-3659a5c84435", "parentControlId": 31554, "controlId": "IA-12(04)", "title": "IA-12(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586411" }, { "id": 580953, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3eb21e01-b170-52fb-a167-4054b0282922", "parentControlId": 31554, "controlId": "IA-12(04)", "title": "IA-12(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586411" } ], "id": 31554, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731157", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731157", "catalogueId": 1062, "uuid": "e92ffbc5-2452-5ac6-9d8f-c34e34418a74", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require that the validation and verification of identity evidence be conducted in person before a designated registration authority?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "In-Person Validation & Verification", "description": "

Control Description

Mechanisms exist to require that the validation and verification of identity evidence be conducted in person before a designated registration authority.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.\n▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require that the validation and verification of identity evidence be conducted in person before a designated registration authority.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-28.4", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-28.4", "references": "

Micro-Small Business (<10 staff)

∙ In-person validation of government-issued photograph identification

Small Business (10-49 staff)

∙ In-person validation of government-issued photograph identification

Medium Business (50-249 staff)

∙ In-person validation of government-issued photograph identification

Large Business (250-999 staff)

∙ In-person validation of government-issued photograph identification

Enterprise (>1,000 staff)

∙ In-person validation of government-issued photograph identification", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72041, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590672", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590672", "securityControlId": 31555, "ccis": [], "uuid": "d3df3673-e281-5227-910b-5ef9a3d1c01c", "testId": "IAC-28.5_A01", "test": "organization-defined criteria are delivered through an out-of-band channel to verify the user’s address (physical or digital) of record.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IA-12(05)_ODP\n53A_R5_IA-12(05)", "defaultText": null } ], "externalMappings": [ { "id": 580958, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "340f1dc6-2fb3-5392-979d-97f5fef40bc7", "parentControlId": 31555, "controlId": "IA-12(05)", "title": "IA-12(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586411" }, { "id": 580959, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d152efad-e5fd-5ec7-8e65-04a8190a3d6e", "parentControlId": 31555, "controlId": "IA-12(05)", "title": "IA-12(05)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586412" }, { "id": 580960, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98419fa8-2089-5689-9daf-8575465855e7", "parentControlId": 31555, "controlId": "IA-12(05)", "title": "IA-12(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586412" }, { "id": 580961, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b94a3c57-7618-5c38-8058-6cc5ddd6e491", "parentControlId": 31555, "controlId": "IA-12(05)", "title": "IA-12(05)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586412" }, { "id": 580962, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586412", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4b433a7-ae00-578c-8010-3f55199d626e", "parentControlId": 31555, "controlId": "IA-12(05)", "title": "IA-12(05)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586412" } ], "id": 31555, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731157", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731157", "catalogueId": 1062, "uuid": "53e6a23e-1f12-5498-83f3-3c0e50ce18ba", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require that a notice of proofing be delivered through an out-of-band channel to verify the user's address (physical or digital)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Address Confirmation", "description": "

Control Description

Mechanisms exist to require that a notice of proofing be delivered through an out-of-band channel to verify the user's address (physical or digital).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require that a notice of proofing be delivered through an out-of-band channel to verify the user's address (physical or digital).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-28.5", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-28.5", "references": "

Micro-Small Business (<10 staff)

∙ Verify user address before sending confirmation communications

Small Business (10-49 staff)

∙ Address confirmation procedure for account communications

Medium Business (50-249 staff)

∙ Formal address confirmation policy for account-related communications

Large Business (250-999 staff)

∙ Enterprise identity verification process for address confirmation

Enterprise (>1,000 staff)

∙ Enterprise identity proofing platform with address confirmation (e.g., Experian, LexisNexis)\n∙ Automated address verification", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72045, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590673", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590673", "securityControlId": 31559, "ccis": [], "uuid": "33458773-8104-5695-81b9-1c95677dbe64", "testId": "IAC-30_A01", "test": "instances that require Mutual Authentication (MA) are identified, where both sides of a communications channel verify the identity of the other party through certificate exchange.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72046, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590673", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590673", "securityControlId": 31559, "ccis": [], "uuid": "e578328c-08b3-50c8-885e-c3ab4945a0f7", "testId": "IAC-30_A02", "test": "technologies to implement MA are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72047, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590673", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590673", "securityControlId": 31559, "ccis": [], "uuid": "c3470ea6-251f-5a8e-8d1c-3be05b990062", "testId": "IAC-30_A03", "test": "technologies enforce MA, where required.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 580991, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586415", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17647648-88d0-521f-bc94-7931856564ad", "parentControlId": 31559, "controlId": "USER 1.10", "title": "USER 1.10", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586415" }, { "controlId": "NSS-17T-Sec6.3", "title": "NSS-17T-Sec6.3 — Access Control & Two-Person Rule for Critical Digital Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "00c088c1-7055-5c2f-ba6e-153f98199817", "isPublic": true }, { "controlId": "IEC-62645-7.3.2", "title": "IEC-62645-7.3.2 — Identification, Authentication, and Access Control for I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "dd64e960-52d9-520b-b4ff-af702e3973ad", "isPublic": true }, { "controlId": "IEC-63096-9.1", "title": "IEC-63096-9.1 — Access Control Policy & Privileged Access Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "7ba67316-d2c2-5741-8e5e-f6861d95979b", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.5.4", "title": "IEEE-7-4.3.2-5.5.4 — Control of Physical and Logical Access to Safety System Equipment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "c6796755-bae8-593f-9b61-8842ad3c6fcc", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec6.1", "title": "REGDOC-2.12.1-Sec6.1 — Logical and Remote Access Control", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "c87e6362-8eaf-5cbb-847d-9c2a5281f576", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-IAM", "title": "ONR-SyAP-FSyP7-IAM — Identity and Access Control for Nuclear OT/IT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAC Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "f762cac3-3c09-5396-a991-c1c3ca26c713", "isPublic": true } ], "id": 31559, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731159", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731159", "catalogueId": 1062, "uuid": "3aa1dbad-9bd4-5ae1-9f05-12609c9e2c23", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce Mutual Authentication (MA) where both sides of a communications channel verify the identity of the other party through certificate exchange?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Mutual Authentication (MA)", "description": "

Control Description

Mechanisms exist to enforce Mutual Authentication (MA) where both sides of a communications channel verify the identity of the other party through certificate exchange.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines) to enforce Logical Access Control (LAC).\n▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts.\n▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services.

Level 3 - Well Defined: Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners.\n▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enforce Mutual Authentication (MA) where both sides of a communications channel verify the identity of the other party through certificate exchange.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAC-30", "family": "Identification & Authentication", "enhancements": "", "sortId": "IAC-30", "references": "

Micro-Small Business (<10 staff)

∙ Use mutual TLS (mTLS) for critical system-to-system communications

Small Business (10-49 staff)

∙ Mutual authentication policy for sensitive system communications

Medium Business (50-249 staff)

∙ Formal mutual authentication standard\n∙ mTLS for critical services

Large Business (250-999 staff)

∙ Enterprise mTLS implementation for service-to-service communication\n∙ Certificate management

Enterprise (>1,000 staff)

∙ Enterprise mTLS with PKI (e.g., Venafi, HashiCorp Vault)\n∙ Service mesh with mutual auth (e.g., Istio)\n∙ Automated certificate lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72048, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590674", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590674", "securityControlId": 31560, "ccis": [], "uuid": "ab57b35f-e400-5549-ad36-38070e34ff7a", "testId": "IRO-01_A01", "test": "the rigor of incident handling activities is comparable and predictable across the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04d.[01]", "defaultText": null }, { "id": 72049, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590674", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590674", "securityControlId": 31560, "ccis": [], "uuid": "c710c302-17e5-5b0c-9559-0c9a47dac5d5", "testId": "IRO-01_A02", "test": "the intensity of incident handling activities is comparable and predictable across the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04d.[02]", "defaultText": null }, { "id": 72050, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590674", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590674", "securityControlId": 31560, "ccis": [], "uuid": "a6569d0c-ca72-54df-9bd4-d07e165268d4", "testId": "IRO-01_A03", "test": "the scope of incident handling activities is comparable and predictable across the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04d.[03]", "defaultText": null }, { "id": 72051, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590674", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590674", "securityControlId": 31560, "ccis": [], "uuid": "fe12d546-1f16-52a0-9292-ea6fa106aeef", "testId": "IRO-01_A04", "test": "the results of incident handling activities are comparable and predictable across the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04d.[04]", "defaultText": null }, { "id": 72052, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590674", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590674", "securityControlId": 31560, "ccis": [], "uuid": "568cbcac-726c-5b76-bb53-be961ecacfe7", "testId": "IRO-01_A05", "test": "incident handling activities are coordinated with contingency planning activities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04b.", "defaultText": null }, { "id": 72053, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590674", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590674", "securityControlId": 31560, "ccis": [], "uuid": "37c53e9c-35e6-58d5-8307-b5f704a7692b", "testId": "IRO-01_A06", "test": "an operational incident-handling capability is established.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_IR-04a.[01]\n171A_3.6.1[a]", "defaultText": null }, { "id": 72054, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590674", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590674", "securityControlId": 31560, "ccis": [], "uuid": "a1faf661-3033-54b7-99fe-227613d9293f", "testId": "IRO-01_A07", "test": "the operational incident-handling capability includes preparation.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_IR-04a.[02]\n171A_3.6.1[b]", "defaultText": null }, { "id": 72055, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590675", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590675", "securityControlId": 31560, "ccis": [], "uuid": "fc19fd73-ea43-5e10-941d-f1f4c68f0204", "testId": "IRO-01_A08", "test": "the operational incident-handling capability includes detection and analysis.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_IR-04a.[03]\n171A_3.6.1[c]\n171A_3.6.1[d]", "defaultText": null }, { "id": 72056, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590675", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590675", "securityControlId": 31560, "ccis": [], "uuid": "09651ee2-8165-5aa1-84ce-e2a3ef3ba432", "testId": "IRO-01_A09", "test": "the operational incident-handling capability includes containment.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_IR-04a.[04]\n171A_3.6.1[e]", "defaultText": null }, { "id": 72057, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590675", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590675", "securityControlId": 31560, "ccis": [], "uuid": "d0488603-82af-5525-8a72-355979606aba", "testId": "IRO-01_A10", "test": "the operational incident-handling capability includes eradication.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-04a.[05]", "defaultText": null }, { "id": 72058, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590675", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590675", "securityControlId": 31560, "ccis": [], "uuid": "d5b43e7a-81bb-566a-a766-fc54a07e280f", "testId": "IRO-01_A11", "test": "the operational incident-handling capability includes recovery.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_IR-04a.[06]\n171A_3.6.1[f]", "defaultText": null }, { "id": 72059, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590675", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590675", "securityControlId": 31560, "ccis": [], "uuid": "e39c155a-2484-5ad0-95dd-ebd466cf627b", "testId": "IRO-01_A12", "test": "lessons learned from ongoing incident handling activities are incorporated into incident response procedures, training, and testing.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-04c.[01]", "defaultText": null }, { "id": 72060, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590675", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590675", "securityControlId": 31560, "ccis": [], "uuid": "6402044c-49b9-517b-8454-49412093a119", "testId": "IRO-01_A13", "test": "the changes resulting from the incorporated lessons learned are implemented accordingly.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-04c.[02]", "defaultText": null }, { "id": 72061, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590675", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590675", "securityControlId": 31560, "ccis": [], "uuid": "da69c824-5d7c-529c-a923-306800ec597d", "testId": "IRO-01_A14", "test": "an incident-handling capability that is consistent with the incident response plan is implemented.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.06.01[01]", "defaultText": null }, { "id": 72062, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590676", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590676", "securityControlId": 31560, "ccis": [], "uuid": "64b9779d-52f9-50b3-b4fd-dc5e978a2564", "testId": "IRO-01_A15", "test": "incident response management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72063, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590676", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590676", "securityControlId": 31560, "ccis": [], "uuid": "8b277f1d-6f70-5f55-9581-beec2643b514", "testId": "IRO-01_A16", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support incident response management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72064, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590676", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590676", "securityControlId": 31560, "ccis": [], "uuid": "547244a9-de4f-5a09-9b21-51d3820ab97d", "testId": "IRO-01_A17", "test": "responsibility and authority for the performance of incident response management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72065, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590676", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590676", "securityControlId": 31560, "ccis": [], "uuid": "5081a21e-ffb4-5e99-bf57-504706cc9c8f", "testId": "IRO-01_A18", "test": "personnel performing incident response management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 581025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58642", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5405f9b7-1d95-5f97-ab36-af8e2275e7f3", "parentControlId": 31560, "controlId": "EVENT 1.8", "title": "EVENT 1.8", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58642" }, { "id": 581035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586421", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f075ee8-4a0b-57a6-927e-c658db8e1427", "parentControlId": 31560, "controlId": "5.24", "title": "5.24", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586421" }, { "id": 581043, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586422", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d86da0b2-44cd-507e-b32c-133d24e2a982", "parentControlId": 31560, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586422" }, { "id": 581044, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586422", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2335a415-2433-5dc5-bbce-bba5e4d8ab9f", "parentControlId": 31560, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586422" }, { "id": 581046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586422", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c53a7a1d-1890-52b8-83f2-9ab379afd9bd", "parentControlId": 31560, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586422" }, { "id": 581050, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586422", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d541bab-81b3-506f-bd37-7fc4c12d51bb", "parentControlId": 31560, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586422" }, { "id": 581051, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586422", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6160135-4677-5c37-af13-3b6c6efd67a5", "parentControlId": 31560, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586422" }, { "id": 581052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586423", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0272659d-9993-532b-8dd2-055177b9cb6b", "parentControlId": 31560, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586423" }, { "id": 581053, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586423", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "333ff7ca-ad92-583f-b141-e13ce9adf176", "parentControlId": 31560, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586423" }, { "id": 581054, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586423", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d55a0f43-5151-5bd0-bf06-a2996c83b438", "parentControlId": 31560, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586423" }, { "id": 581055, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586423", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65cc17e3-cd37-5d9f-ad21-b15d216f1fa1", "parentControlId": 31560, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586423" }, { "id": 581056, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586423", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80cbf321-1de1-56e8-b885-1f66771bbca8", "parentControlId": 31560, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586423" }, { "id": 581060, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586423", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2168a360-c3ff-5115-a2a4-0e47bc9fb849", "parentControlId": 31560, "controlId": "NFO - IR-1", "title": "NFO - IR-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586423" }, { "id": 581061, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586424", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86de915e-1381-5ed1-9820-02651a2363bf", "parentControlId": 31560, "controlId": "03.06.01", "title": "03.06.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586424" }, { "id": 581069, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586425", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eadfa33b-a1fd-5307-b45b-c2543d2a7d6b", "parentControlId": 31560, "controlId": "GV.SC-08", "title": "GV.SC-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586425" }, { "id": 581070, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586425", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2d4a035-8c8e-5cd0-a583-60a7ab2f3ea5", "parentControlId": 31560, "controlId": "DE.AE", "title": "DE.AE", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586425" }, { "id": 581071, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586425", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41088b8b-cdf2-5849-b64a-340750f371da", "parentControlId": 31560, "controlId": "RS", "title": "RS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586425" }, { "id": 581072, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586425", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fbba5a7-c939-5189-90ec-6cb1f16f6103", "parentControlId": 31560, "controlId": "RS.MI", "title": "RS.MI", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586425" }, { "id": 581102, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586428", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32026567-42ca-52ee-b6c0-eef07cec0fa0", "parentControlId": 31560, "controlId": "RESPONSE-1a", "title": "RESPONSE-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586428" }, { "id": 581127, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92a3a234-378c-5fec-9920-9b8ec8b8fd3f", "parentControlId": 31560, "controlId": "CIP-003-8 1.1.5", "title": "CIP-003-8 1.1.5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586439" }, { "id": 581128, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48b36162-f32a-514e-a657-5ade6f3c1d18", "parentControlId": 31560, "controlId": "CIP-003-8 1.2.4", "title": "CIP-003-8 1.2.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586439" }, { "id": 581129, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586439", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86728120-8efe-599a-8396-7006cad9f8da", "parentControlId": 31560, "controlId": "CIP-008-6 1.1", "title": "CIP-008-6 1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586439" }, { "id": 581130, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a37ea1a0-b46c-5ccb-9200-d5b77afd8cdd", "parentControlId": 31560, "controlId": "CIP-008-6 3.2", "title": "CIP-008-6 3.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58644" }, { "id": 581131, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "caf39fbb-1f99-5b3b-b18f-c11667aef399", "parentControlId": 31560, "controlId": "§117.18(b)(2)", "title": "§117.18(b)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58644" }, { "id": 581206, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1935678-d817-5ec5-8506-9034593c53fb", "parentControlId": 31560, "controlId": "D1", "title": "D1", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586449" }, { "controlId": "A.3.2", "title": "A.3.2 — Incorporating the Cyber Security Program into the Physical Protection Program", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-1, PM-1, IR-4, CP-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "6a585bf5-112b-557a-b446-a0431d35a50d", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.2", "title": "NEI 08-09 Sec 3.2 — Incorporating the Cyber Security Program into the Physical Protection Program", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "1b8e320a-b6da-5312-b5f6-0f90700e6fa4", "isPublic": true }, { "controlId": "10 CFR 73.54(b)(3), 73.55(c)(6)", "title": "10 CFR 73.54(b)(3), 73.55(c)(6) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "d7567dc7-c763-5a59-a48d-823541cf9133", "isPublic": true }, { "controlId": "C.8", "title": "C.8 — Incident Response", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-1, IR-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "48e259f5-bac9-5953-b401-503bc0efac47", "isPublic": true }, { "controlId": "NEI 08-09 App E.8", "title": "NEI 08-09 App E.8 — Incident Response", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "4ecf1e69-5213-5930-b7b6-50b8e78a3409", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3), 73.77", "title": "10 CFR 73.54(d)(3), 73.77 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "adbb9287-e910-555b-b6c5-88ebd5c89780", "isPublic": true }, { "controlId": "C.8.1", "title": "C.8.1 — Incident Response Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "2c8a59e8-d247-58c7-87e2-60e341f5cfd2", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.1", "title": "NEI 08-09 App E.8.1 — Incident Response Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d6eb2f25-3991-5240-ac2e-e91503afcc03", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3)", "title": "10 CFR 73.54(d)(3) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "041bc29e-1990-5826-8efa-18d432469b21", "isPublic": true }, { "controlId": "C.8.8", "title": "C.8.8 — Cyber Incident Response Plan", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "4265bee6-2edf-58ec-8fdb-c4d9d907f7ad", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.8", "title": "NEI 08-09 App E.8.8 — Cyber Incident Response Plan", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "28a2152b-713e-58e7-b2bc-a2f015f9392d", "isPublic": true }, { "controlId": "CIP-003-8-R2", "title": "CIP-003-8-R2 — Cyber Security Plan Implementation for Low Impact BES Cyber Systems", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8cf78fdb-99fe-5a8c-87fe-e7f7f2501ee0", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec1", "title": "CIP-003-9-Attachment1-Sec1 — Low Impact Cyber Security Awareness", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e38c2847-f1d9-5e40-b2b1-a1ced5b08373", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec2", "title": "CIP-003-9-Attachment1-Sec2 — Low Impact Physical Security Controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "207bdb45-80bb-5345-a914-4b89b9d1513d", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec3", "title": "CIP-003-9-Attachment1-Sec3 — Low Impact Electronic Access Controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e54fcc1b-5abd-5718-9bf6-a64d3156b49f", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec4", "title": "CIP-003-9-Attachment1-Sec4 — Low Impact Cyber Security Incident Response", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e70496d3-6003-5821-bedf-6a0a36d4ccbf", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec5", "title": "CIP-003-9-Attachment1-Sec5 — Low Impact Transient Cyber Asset and Removable Media Malicious Code Risk Mitigation", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1dfdd9a6-7fab-521d-83ca-2f662f0ef102", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec6", "title": "CIP-003-9-Attachment1-Sec6 — Low Impact Vendor Electronic Remote Access Security Controls (CIP-003-9)", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5640fe1b-ce01-573e-9efc-73825835eacb", "isPublic": true }, { "controlId": "CIP-008-6-R1", "title": "CIP-008-6-R1 — Cyber Security Incident Response Plan", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9b6ad4f6-7e3d-51fb-93ed-3c9159a3c09a", "isPublic": true }, { "controlId": "CIP-008-6-1.1", "title": "CIP-008-6-1.1 — One or more processes to identify, classify, and respond to Cyber Security Incidents.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "35695c45-95b6-5b14-904a-813a50db25f9", "isPublic": true }, { "controlId": "CIP-008-6-1.2", "title": "CIP-008-6-1.2 — One or more processes: 1.2.1 That include criteria to evaluate and define attempts to compromise", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "453b2b34-d507-5280-8b7d-3c59f25c6281", "isPublic": true }, { "controlId": "CIP-008-6-1.2.1", "title": "CIP-008-6-1.2.1 — That include criteria to evaluate and define attempts to compromise", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c4e04815-66c4-5983-b8ec-79ee47d01c3a", "isPublic": true }, { "controlId": "CIP-008-6-1.2.2", "title": "CIP-008-6-1.2.2 — To determine if an identified Cyber Security Incident is: • A Reportable Cyber Security Incident", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "70f96287-b77b-5862-af5d-d24355107398", "isPublic": true }, { "controlId": "CIP-008-6-1.2.3", "title": "CIP-008-6-1.2.3 — To provide notification per Requirement R4.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e1553bd2-94ad-54c3-a37f-9584caf2ee17", "isPublic": true }, { "controlId": "CIP-008-6-1.3", "title": "CIP-008-6-1.3 — The roles and responsibilities of Cyber Security Incident response groups or individuals.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "69431928-c172-5940-ad76-d63721f425a6", "isPublic": true }, { "controlId": "CIP-008-6-1.4", "title": "CIP-008-6-1.4 — Incident handling procedures for Cyber Security Incidents.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "80daba73-69af-59dc-af62-097dec38cf08", "isPublic": true }, { "controlId": "CIP-008-6-R3", "title": "CIP-008-6-R3 — Cyber Security Incident Response Plan Review and Maintenance", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5ecac58d-ae06-5437-b3c4-3c2c181a64c7", "isPublic": true }, { "controlId": "CIP-008-6-3.1", "title": "CIP-008-6-3.1 — No later than 90 calendar days after completion of a Cyber Security Incident response plan(s) test or actual Reportab...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "463020c1-d903-5820-85ef-e8ac0f1cfdd4", "isPublic": true }, { "controlId": "CIP-008-6-3.1.1", "title": "CIP-008-6-3.1.1 — Document any lessons learned or document the absence of any lessons learned", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7841ce42-e88c-5134-8ae2-6075dd49685e", "isPublic": true }, { "controlId": "CIP-008-6-3.1.2", "title": "CIP-008-6-3.1.2 — Update the Cyber Security Incident response plan based on any documented lessons learned associated with the plan", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ca06335a-41f4-525f-947c-f6e9f7c33bfb", "isPublic": true }, { "controlId": "CIP-008-6-3.1.3", "title": "CIP-008-6-3.1.3 — Notify each person or group with a defined role in the Cyber Security Incident response plan of the updates to the Cy...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e826be45-3bc1-5ff0-b137-174b70d3148d", "isPublic": true }, { "controlId": "CIP-008-6-3.2", "title": "CIP-008-6-3.2 — No later than 60 calendar days after a change to the roles or responsibilities, Cyber Security Incident response grou...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6d558539-e5e9-5adf-b174-15615c6b9560", "isPublic": true }, { "controlId": "CIP-008-6-3.2.1", "title": "CIP-008-6-3.2.1 — Update the Cyber Security Incident response plan(s)", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0f3352a0-ce62-58fc-9b26-68f251eaee88", "isPublic": true }, { "controlId": "CIP-008-6-3.2.2", "title": "CIP-008-6-3.2.2 — Notify each person or group with a defined role in the Cyber Security Incident response plan of the updates.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0ebd14f4-e733-5451-8026-e53defa61140", "isPublic": true }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d6d6952e-8b46-53f1-8747-86a93446c878", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "7a0731bb-03df-506f-9730-9808336387d9", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "9f260cad-be08-55ba-98e7-ee3f5d7f1fe5", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "2894dbb8-86c4-567d-88fe-1c9cf9006529", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "b44a63aa-5a56-5e4c-b4fd-a026ce8d6de7", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "b73c71e3-3884-579f-ba8d-de7ccf801d3a", "isPublic": true } ], "id": 31560, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731159", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731159", "catalogueId": 1062, "uuid": "7917316f-681b-518c-a157-4f19d77055b2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement and govern processes and documentation to facilitate an organization-wide response capability for cybersecurity and data protection-related incidents?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Incident Response Operations", "description": "

Control Description

Mechanisms exist to implement and govern processes and documentation to facilitate an organization-wide response capability for cybersecurity and data protection-related incidents.

Evidence Request List (ERL)

E-IRO-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Incident Response (IRO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IRO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Incident response-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ IT and/or cybersecurity personnel facilitate prompt response to suspected or confirmed security incidents, including timely notification to affected stakeholders.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement and govern processes and documentation to facilitate an organization-wide response capability for cybersecurity and data protection-related incidents.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.2, C.8, C.8.1, C.8.8
NERC-CIP (2026) Requirements: CIP-003-8-R2, CIP-008-6-R1, CIP-008-6-R3", "controlId": "IRO-01", "family": "Incident Response", "enhancements": "", "sortId": "IRO-01", "references": "

Micro-Small Business (<10 staff)

∙ Incident Response Plan (IRP)

Small Business (10-49 staff)

∙ Incident Response Plan (IRP)

Medium Business (50-249 staff)

∙ Integrated Incident Response Program (IIRP)

Large Business (250-999 staff)

∙ Integrated Incident Response Program (IIRP)

Enterprise (>1,000 staff)

∙ Integrated Incident Response Program (IIRP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72066, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590677", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590677", "securityControlId": 31561, "ccis": [], "uuid": "bcc04432-1c95-5c13-b6bf-655def211a2a", "testId": "IRO-02_A01", "test": "an incident handling capability for incidents is implemented that is consistent with the incident response plan.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04a.[01]\n171A_3.6.1[a]", "defaultText": null }, { "id": 72067, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590677", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590677", "securityControlId": 31561, "ccis": [], "uuid": "a0b5edc2-9d92-5822-a0ef-238da532ace6", "testId": "IRO-02_A02", "test": "the incident handling capability includes preparation.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04a.[02]\n171A_3.6.1[b]\n171A_R3_A.03.06.01[02]", "defaultText": null }, { "id": 72068, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590677", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590677", "securityControlId": 31561, "ccis": [], "uuid": "6b0cd376-3c64-5989-9893-d6e77a48857d", "testId": "IRO-02_A03", "test": "the incident handling capability includes detection and analysis.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04a.[03]\n171A_3.6.1[c]\n171A_3.6.1[d]\n171A_R3_A.03.06.01[03]", "defaultText": null }, { "id": 72069, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590677", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590677", "securityControlId": 31561, "ccis": [], "uuid": "ac9ac573-284d-55cd-b25a-9b7ceb80475d", "testId": "IRO-02_A04", "test": "the incident handling capability includes containment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04a.[04]\n171A_3.6.1[e]\n171A_R3_A.03.06.01[04]", "defaultText": null }, { "id": 72070, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590677", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590677", "securityControlId": 31561, "ccis": [], "uuid": "04d6254d-feb3-5acc-a62a-c77f3b7063af", "testId": "IRO-02_A05", "test": "the incident handling capability includes eradication.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04a.[05]\n171A_R3_A.03.06.01[05]", "defaultText": null }, { "id": 72071, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590678", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590678", "securityControlId": 31561, "ccis": [], "uuid": "e62bc406-cf46-59f8-b9af-4d2b81a04cf9", "testId": "IRO-02_A06", "test": "the incident handling capability includes recovery.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04a.[06]\n171A_3.6.1[f]\n171A_R3_A.03.06.01[06]", "defaultText": null }, { "id": 72072, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590678", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590678", "securityControlId": 31561, "ccis": [], "uuid": "7cf555a3-1642-5100-bea9-3a46bf7c0ce5", "testId": "IRO-02_A07", "test": "incident handling activities are coordinated with contingency planning activities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04b.", "defaultText": null }, { "id": 72073, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590678", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590678", "securityControlId": 31561, "ccis": [], "uuid": "ede63839-41c1-5608-ab9e-46c5265e7761", "testId": "IRO-02_A08", "test": "the operational incident-handling capability includes user response activities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.6.1[g]", "defaultText": null }, { "id": 72074, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590678", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590678", "securityControlId": 31561, "ccis": [], "uuid": "96ea3705-5dae-5c10-ab8a-8c6ca5e8c6b1", "testId": "IRO-02_A09", "test": "authorities to whom incidents are to be reported are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.6.2[c]", "defaultText": null }, { "id": 72075, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590678", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590678", "securityControlId": 31561, "ccis": [], "uuid": "da102cf7-979f-5867-87ce-d975a2c1b32e", "testId": "IRO-02_A10", "test": "organizational officials to whom incidents are to be reported are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.6.2[d]", "defaultText": null }, { "id": 72076, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590678", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590678", "securityControlId": 31561, "ccis": [], "uuid": "180f2051-8516-514b-bcad-fe1165421059", "testId": "IRO-02_A11", "test": "identified authorities are notified of incidents.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.6.2[e]", "defaultText": null }, { "id": 72077, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590679", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590679", "securityControlId": 31561, "ccis": [], "uuid": "19dc835e-a8cf-5335-b56b-a22139d3d1d8", "testId": "IRO-02_A12", "test": "identified organizational officials are notified of incidents.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.6.2[f]", "defaultText": null }, { "id": 72078, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590679", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590679", "securityControlId": 31561, "ccis": [], "uuid": "6a345ab1-fd99-52f2-a559-8e0b5a841b13", "testId": "IRO-02_A13", "test": "incidents are tracked.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.6.2[a]", "defaultText": null }, { "id": 72079, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590679", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590679", "securityControlId": 31561, "ccis": [], "uuid": "eb752961-94d2-5250-8325-2fd94d62fd62", "testId": "IRO-02_A14", "test": "incidents are documented.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.6.2[b]", "defaultText": null }, { "id": 72080, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590679", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590679", "securityControlId": 31561, "ccis": [], "uuid": "8d4b9502-c0e1-59d5-b239-81f9fee290ba", "testId": "IRO-02_A15", "test": "lessons learned from ongoing incident handling activities are incorporated into incident response procedures, training and testing.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-04c.[01]", "defaultText": null }, { "id": 72081, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590679", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590679", "securityControlId": 31561, "ccis": [], "uuid": "ed4b8d49-77a7-5431-99dd-439bb233e6ff", "testId": "IRO-02_A16", "test": "the changes resulting from the incorporated lessons learned are implemented accordingly.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-04c.[02]", "defaultText": null }, { "id": 72082, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590679", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590679", "securityControlId": 31561, "ccis": [], "uuid": "422f54f7-2c95-508e-8c73-90ca9a3d1c63", "testId": "IRO-02_A17", "test": "the rigor of incident handling activities is comparable and predictable across the organization.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-04d.[01]", "defaultText": null }, { "id": 72083, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590679", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590679", "securityControlId": 31561, "ccis": [], "uuid": "c56fcc2a-2e1a-5aee-a671-324d59dc39f2", "testId": "IRO-02_A18", "test": "the intensity of incident handling activities is comparable and predictable across the organization.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-04d.[02]", "defaultText": null }, { "id": 72084, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590679", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590679", "securityControlId": 31561, "ccis": [], "uuid": "037288fd-ee1f-5bbf-8e5c-f8639c38daaa", "testId": "IRO-02_A19", "test": "the scope of incident handling activities is comparable and predictable across the organization.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-04d.[03]", "defaultText": null }, { "id": 72085, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59068", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59068", "securityControlId": 31561, "ccis": [], "uuid": "e2df11f8-3aa9-50e9-a45b-b1d668a3357c", "testId": "IRO-02_A20", "test": "the results of incident handling activities are comparable and predictable across the organization.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-04d.[04]", "defaultText": null }, { "id": 72086, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59068", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59068", "securityControlId": 31561, "ccis": [], "uuid": "951c5504-6c98-5559-918c-6cc323dc31c0", "testId": "IRO-02_A21", "test": "suspected incidents are reported to the organizational incident response capability within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 72087, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59068", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59068", "securityControlId": 31561, "ccis": [], "uuid": "c29f926a-ca33-5295-aff6-b50eecf027ee", "testId": "IRO-02_A22", "test": "suspected incidents are reported to the organizational incident response capability within .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: near real time or as soon as practicable upon discovery", "otherId": "171A_R3_A.03.06.02.b", "defaultText": null } ], "externalMappings": [ { "id": 581335, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbfb98c1-4d0c-5887-b2dc-1406a521539d", "parentControlId": 31561, "controlId": "EVENT 1.8", "title": "EVENT 1.8", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586464" }, { "id": 581337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "057dca52-daf9-50a0-bf29-2469605dea1e", "parentControlId": 31561, "controlId": "5.24", "title": "5.24", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586464" }, { "id": 581338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a85697b-e332-5959-abc0-0fabf9cac854", "parentControlId": 31561, "controlId": "5.25", "title": "5.25", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586464" }, { "id": 581339, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f08c9096-3786-51a7-8b00-262503ddecd3", "parentControlId": 31561, "controlId": "5.26", "title": "5.26", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586464" }, { "id": 581340, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7bb5819e-e20c-5d15-87cc-d2907382dd0d", "parentControlId": 31561, "controlId": "6.8", "title": "6.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586464" }, { "id": 581364, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586467", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "415c03cc-025d-5005-a6eb-2b976cb998d0", "parentControlId": 31561, "controlId": "IR-4", "title": "IR-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586467" }, { "id": 581365, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586467", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "221ea0a2-6869-50de-92d2-80790affdb2c", "parentControlId": 31561, "controlId": "IR-04", "title": "IR-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586467" }, { "id": 581367, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586468", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aec34735-8cf9-5519-810b-ccd42df6d41d", "parentControlId": 31561, "controlId": "IR-04", "title": "IR-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586468" }, { "id": 581369, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586468", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "058264e5-2c56-5aea-adcc-358256357f74", "parentControlId": 31561, "controlId": "IR-04", "title": "IR-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586468" }, { "id": 581370, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586468", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7d1716b-df4e-5778-b346-b11891c8c66e", "parentControlId": 31561, "controlId": "IR-04", "title": "IR-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586468" }, { "id": 581371, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586468", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff735840-ee07-55f5-8eb4-a7ef8ef57186", "parentControlId": 31561, "controlId": "IR-04", "title": "IR-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586468" }, { "id": 581372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586468", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0dae32ad-4f72-52c8-9051-8241e17fec09", "parentControlId": 31561, "controlId": "IR-04", "title": "IR-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586468" }, { "id": 581373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586468", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3dc0ef19-e480-5ea1-bfdf-27a42c81c739", "parentControlId": 31561, "controlId": "IR-4", "title": "IR-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586468" }, { "id": 581374, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586468", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb8cf466-6f8a-507a-ac49-0fdcf8e1cc18", "parentControlId": 31561, "controlId": "3.6.1", "title": "3.6.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586468" }, { "id": 581375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586468", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9b36e58-97e7-59a4-b828-18f8095de76f", "parentControlId": 31561, "controlId": "3.6.2", "title": "3.6.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586468" }, { "id": 581376, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586469", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09e190bb-43c3-5a1d-bf44-968a06c2f07d", "parentControlId": 31561, "controlId": "03.03.04.b", "title": "03.03.04.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586469" }, { "id": 581377, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586469", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fcacc61b-21fe-579e-85b3-f044781275a7", "parentControlId": 31561, "controlId": "03.06.01", "title": "03.06.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586469" }, { "id": 581378, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586469", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b50474e8-2009-5c09-a4ba-0a8904a0659b", "parentControlId": 31561, "controlId": "03.06.02.a", "title": "03.06.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586469" }, { "id": 581379, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586469", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d89ab78-6723-57e2-8d16-75cb42e64b0d", "parentControlId": 31561, "controlId": "03.06.02.b", "title": "03.06.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586469" }, { "id": 581380, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586469", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2340c2aa-87dc-543f-bd72-8fbda681caf8", "parentControlId": 31561, "controlId": "03.06.02.c", "title": "03.06.02.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586469" }, { "id": 581381, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586469", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fa92657-2e5b-569f-9379-bea973ae1404", "parentControlId": 31561, "controlId": "03.06.02.d", "title": "03.06.02.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586469" }, { "id": 581401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586471", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e3dd6e9-1646-5cd8-9abf-9db826468f77", "parentControlId": 31561, "controlId": "GV.SC-08", "title": "GV.SC-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586471" }, { "id": 581402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586472", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d882139-972d-555b-aede-03b8a0ccb21e", "parentControlId": 31561, "controlId": "DE.AE", "title": "DE.AE", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586472" }, { "id": 581403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586472", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d224bb3f-9641-5113-87a6-13a2f15d2e8c", "parentControlId": 31561, "controlId": "DE.AE-02", "title": "DE.AE-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586472" }, { "id": 581404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586472", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31dc3228-83ed-56c9-b727-8f4c47e5f09e", "parentControlId": 31561, "controlId": "DE.AE-03", "title": "DE.AE-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586472" }, { "id": 581405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586472", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22e10d21-a660-5963-bdbc-d568ff3529f6", "parentControlId": 31561, "controlId": "DE.AE-04", "title": "DE.AE-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586472" }, { "id": 581406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586472", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb376742-44af-5e53-b570-c84e021565a3", "parentControlId": 31561, "controlId": "DE.AE-06", "title": "DE.AE-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586472" }, { "id": 581407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586472", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d3b2523-0c4b-5dc6-b9c3-47cef0143e35", "parentControlId": 31561, "controlId": "DE.AE-08", "title": "DE.AE-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586472" }, { "id": 581408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586472", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d7bb618-ecf2-573a-a538-ffb07e7fbe52", "parentControlId": 31561, "controlId": "RS", "title": "RS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586472" }, { "id": 581409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586472", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34ec6e8e-b6d4-5913-8331-4397d72ba9c7", "parentControlId": 31561, "controlId": "RS.MA", "title": "RS.MA", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586472" }, { "id": 581410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f94044a4-b5c5-50b3-99c5-0171c68e1529", "parentControlId": 31561, "controlId": "RS.MA-01", "title": "RS.MA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586473" }, { "id": 581411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "803b3612-8974-55ad-8dff-27a8d6198b75", "parentControlId": 31561, "controlId": "RS.MA-02", "title": "RS.MA-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586473" }, { "id": 581412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b703293d-89d4-5a15-8fd3-ed50454fcb00", "parentControlId": 31561, "controlId": "RS.MA-04", "title": "RS.MA-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586473" }, { "id": 581413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66f9ffc5-2e22-5aeb-8448-3a9992dfd950", "parentControlId": 31561, "controlId": "RS.AN", "title": "RS.AN", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586473" }, { "id": 581414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "491e9c99-81fb-5953-b965-cf8ac37ccec3", "parentControlId": 31561, "controlId": "RS.AN-06", "title": "RS.AN-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586473" }, { "id": 581415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "675fc414-69ab-5e2a-a591-704bd40d3987", "parentControlId": 31561, "controlId": "RS.CO", "title": "RS.CO", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586473" }, { "id": 581416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf6ffb59-914f-5254-bb89-78d1f688a268", "parentControlId": 31561, "controlId": "RS.CO-02", "title": "RS.CO-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586473" }, { "id": 581417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586474", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2920a79-4381-5526-9db3-cfa34f0ffa6c", "parentControlId": 31561, "controlId": "RS.CO-03", "title": "RS.CO-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586474" }, { "id": 581418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586474", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b95f6a57-83fb-528f-83c3-90c80082811b", "parentControlId": 31561, "controlId": "RS.MI", "title": "RS.MI", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586474" }, { "id": 581419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586474", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f09c812-0cea-50ee-a70f-26ef3907c7bd", "parentControlId": 31561, "controlId": "RS.MI-01", "title": "RS.MI-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586474" }, { "id": 581420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586474", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "159c0ae2-af50-52aa-9032-0efb3d24dc0a", "parentControlId": 31561, "controlId": "RS.MI-02", "title": "RS.MI-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586474" }, { "id": 581421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586474", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83473217-c3c0-56ad-95d5-79ef2bc666c3", "parentControlId": 31561, "controlId": "RC.RP-06", "title": "RC.RP-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586474" }, { "id": 581450, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586485", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52fa0b5f-ab9a-56ad-87a1-5a10bca93a8b", "parentControlId": 31561, "controlId": "RESPONSE-1a", "title": "RESPONSE-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586485" }, { "id": 581451, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586485", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da3bd654-700c-5b2b-a7e7-9806667e7ff3", "parentControlId": 31561, "controlId": "RESPONSE-1b", "title": "RESPONSE-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586485" }, { "id": 581452, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586485", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf2cf940-0235-52a4-822e-c5f0a8a0dc9e", "parentControlId": 31561, "controlId": "RESPONSE-1f", "title": "RESPONSE-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586485" }, { "id": 581453, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586486", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d539fb84-43ef-5b23-b22f-837e88c017aa", "parentControlId": 31561, "controlId": "RESPONSE-2a", "title": "RESPONSE-2a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586486" }, { "id": 581454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586486", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70543d9d-5876-5c02-b61d-1ed263db395f", "parentControlId": 31561, "controlId": "RESPONSE-2b", "title": "RESPONSE-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586486" }, { "id": 581455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586486", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "082cdb0f-7a68-5b5e-90d9-8fa2c9053e14", "parentControlId": 31561, "controlId": "RESPONSE-3b", "title": "RESPONSE-3b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586486" }, { "id": 581456, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586486", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd398868-2696-5d99-8272-d98126fa6e12", "parentControlId": 31561, "controlId": "RESPONSE-3c", "title": "RESPONSE-3c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586486" }, { "id": 581457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586486", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "728c16eb-f3df-5b14-86ea-9788f1829d85", "parentControlId": 31561, "controlId": "RESPONSE-3e", "title": "RESPONSE-3e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586486" }, { "id": 581458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586486", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "635f67e2-fa60-588e-8753-a09e3796a33c", "parentControlId": 31561, "controlId": "RESPONSE-3l", "title": "RESPONSE-3l", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586486" }, { "id": 581503, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2164b206-aedb-5c03-a859-491d0f7c3a21", "parentControlId": 31561, "controlId": "CIP-008-6 1.1", "title": "CIP-008-6 1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586491" }, { "id": 581504, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586492", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0bd31bf5-0214-5049-bdf8-2301cc679d87", "parentControlId": 31561, "controlId": "CIP-008-6 1.2.1", "title": "CIP-008-6 1.2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586492" }, { "id": 581505, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586492", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f4584be-c451-5fa9-8246-1b85f8603118", "parentControlId": 31561, "controlId": "CIP-008-6 1.4", "title": "CIP-008-6 1.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586492" }, { "id": 581575, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5865", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1be6095f-e886-5e0c-9d29-d3b4bcb45a70", "parentControlId": 31561, "controlId": "D1.b", "title": "D1.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5865" }, { "controlId": "C.8.4", "title": "C.8.4 — Incident Handling", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "c2b6da4c-8ac7-5b82-9ba3-1aa688a74ab4", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.4", "title": "NEI 08-09 App E.8.4 — Incident Handling", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "be8ccbe0-8f87-5bd7-b1a6-267e68dda535", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3)", "title": "10 CFR 73.54(d)(3) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "37b1a5b2-0a14-5ec8-ac3d-6ad78bd6680d", "isPublic": true }, { "controlId": "C.13.3", "title": "C.13.3 — Corrective Action Program", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-5, IR-4, PM-14", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "6cd3cf31-ad52-5a4f-b202-e4e32c26daa7", "isPublic": true }, { "controlId": "NEI 08-09 App E.13.3 (CAP)", "title": "NEI 08-09 App E.13.3 (CAP) — Corrective Action Program", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.13.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "0ec0c897-9fdf-5ee0-bbe0-478fdfeac12e", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3), 73.55(b)(10)", "title": "10 CFR 73.54(d)(3), 73.55(b)(10) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.13.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "798a70e3-b3e8-5257-bf06-a2d09e783001", "isPublic": true }, { "controlId": "CIP-008-6-R1", "title": "CIP-008-6-R1 — Cyber Security Incident Response Plan", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f734cdea-a587-5066-9762-8c368a56f2bb", "isPublic": true }, { "controlId": "CIP-008-6-1.1", "title": "CIP-008-6-1.1 — One or more processes to identify, classify, and respond to Cyber Security Incidents.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "325d7c57-ff4f-5eae-b4d0-aab166cbbd56", "isPublic": true }, { "controlId": "CIP-008-6-1.2", "title": "CIP-008-6-1.2 — One or more processes: 1.2.1 That include criteria to evaluate and define attempts to compromise", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7aa651fb-1413-5f32-bbfa-fac15d1fe7b8", "isPublic": true }, { "controlId": "CIP-008-6-1.2.1", "title": "CIP-008-6-1.2.1 — That include criteria to evaluate and define attempts to compromise", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "74d1140e-29ec-51e2-b673-b46f84072f09", "isPublic": true }, { "controlId": "CIP-008-6-1.2.2", "title": "CIP-008-6-1.2.2 — To determine if an identified Cyber Security Incident is: • A Reportable Cyber Security Incident", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a9f89514-ee0f-538f-a49d-2e3544d15e2e", "isPublic": true }, { "controlId": "CIP-008-6-1.2.3", "title": "CIP-008-6-1.2.3 — To provide notification per Requirement R4.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9cf6cf32-4858-56fd-92ba-7a548f95e4ed", "isPublic": true }, { "controlId": "CIP-008-6-1.3", "title": "CIP-008-6-1.3 — The roles and responsibilities of Cyber Security Incident response groups or individuals.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6303167e-338f-56bd-9e76-73d253cec63e", "isPublic": true }, { "controlId": "CIP-008-6-1.4", "title": "CIP-008-6-1.4 — Incident handling procedures for Cyber Security Incidents.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0c57ca7b-1a40-5450-bd72-9cd5d70bddcb", "isPublic": true }, { "controlId": "CIP-008-6-R2", "title": "CIP-008-6-R2 — Cyber Security Incident Response Plan Implementation and Testing", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "789dc101-c142-5aa3-a74e-beb287cad750", "isPublic": true }, { "controlId": "CIP-008-6-2.1", "title": "CIP-008-6-2.1 — Test each Cyber Security Incident response plan(s) at least once every 15 calendar months", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3dec4f40-4fcf-5c75-bb19-931754c6d066", "isPublic": true }, { "controlId": "CIP-008-6-2.2", "title": "CIP-008-6-2.2 — Use the Cyber Security Incident response plan(s) under Requirement R1 when responding to a Reportable Cyber Security...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f1408bff-dd10-59e8-91eb-d67a46c39978", "isPublic": true }, { "controlId": "CIP-008-6-2.3", "title": "CIP-008-6-2.3 — Retain records related to Reportable Cyber Security Incidents and Cyber Security Incidents that attempted to compromi...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2a6809f9-a736-5b48-a9b2-67108e4d23f6", "isPublic": true }, { "controlId": "CIP-015-1-R3", "title": "CIP-015-1-R3 — INSM Anomalous Activity Evaluation and Response", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0ef7645f-50dd-542f-b721-6e71bf1e490a", "isPublic": true }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "9d7eff01-fd9e-5db1-a581-3652ef49033a", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "840668fc-845e-5d41-ae7e-42bdab84b784", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "9338d456-84ff-5308-8cd3-c951a35f4950", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "0def76a0-ba60-59e0-99a9-bf87d71e71a9", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "fb6a297a-499d-537c-9617-be8e3b5f903d", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "66621437-b565-58a7-82aa-77360e48f108", "isPublic": true } ], "id": 31561, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731159", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731159", "catalogueId": 1062, "uuid": "de3c7b4c-0170-5c26-82b4-96d8effe217d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization cover:\n (1) Preparation;\n (2) Automated event detection or manual incident report intake;\n (3) Analysis;\n (4) Containment;\n (5) Eradication; and\n (6) Recovery?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Incident Handling", "description": "

Control Description

Mechanisms exist to cover:\n(1) Preparation;\n(2) Automated event detection or manual incident report intake;\n(3) Analysis;\n(4) Containment;\n(5) Eradication; and\n(6) Recovery.

Evidence Request List (ERL)

E-IRO-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ IT and/or cybersecurity personnel facilitate prompt response to suspected or confirmed security incidents, including timely notification to affected stakeholders.\n▪ IT and/or cybersecurity personnel operate facilitate basic forensic investigations in the event of a suspected or confirmed security incident.\n▪ The IRP contains eDiscovery processes to support Federal Rules of Civil Procedure (FRCP) requirements for eDiscovery practices.\n▪ IT personnel support incident response operations by provisioning and deprovisioning incident responders with temporary emergency accounts.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to cover:\n(1) Preparation;\n(2) Automated event detection or manual incident report intake;\n(3) Analysis;\n(4) Containment;\n(5) Eradication; and\n(6) Recovery.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.8.4, C.13.3
NERC-CIP (2026) Requirements: CIP-008-6-R1, CIP-008-6-R2, CIP-015-1-R3", "controlId": "IRO-02", "family": "Incident Response", "enhancements": "", "sortId": "IRO-02", "references": "

Micro-Small Business (<10 staff)

∙ Incident Response Plan (IRP)

Small Business (10-49 staff)

∙ Incident Response Plan (IRP)

Medium Business (50-249 staff)

∙ Integrated Incident Response Program (IIRP)\n∙ ITIL 4 (https://axelos.com) ∙ Incident and problem management

Large Business (250-999 staff)

∙ Integrated Incident Response Program (IIRP)\n∙ ITIL 4 (https://axelos.com) ∙ Incident and problem management

Enterprise (>1,000 staff)

∙ Integrated Incident Response Program (IIRP)\n∙ ITIL 4 (https://axelos.com) ∙ Incident and problem management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72088, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590681", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590681", "securityControlId": 31562, "ccis": [], "uuid": "0f789724-677e-5af4-8cc5-f9294e58854f", "testId": "IRO-02.1_A01", "test": "anomalous or suspicious behavior is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.2e[a]", "defaultText": null }, { "id": 72089, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590681", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590681", "securityControlId": 31562, "ccis": [], "uuid": "0362244b-9fa8-5028-82b9-b27d467f4f1c", "testId": "IRO-02.1_A02", "test": "organizational systems and system components are monitored on an ongoing basis for anomalous or suspicious behavior.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.2e[b]", "defaultText": null }, { "id": 72090, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590681", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590681", "securityControlId": 31562, "ccis": [], "uuid": "47c1d029-d8be-5d6e-b320-dfad5f955531", "testId": "IRO-02.1_A03", "test": "automated mechanisms used to support the incident handling process are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(01)_ODP", "defaultText": null }, { "id": 72091, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590681", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590681", "securityControlId": 31562, "ccis": [], "uuid": "59bf8c22-d2c9-5a97-afc0-eb0bf2e27104", "testId": "IRO-02.1_A04", "test": "the incident handling process is supported using automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(01)", "defaultText": null }, { "id": 72092, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590681", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590681", "securityControlId": 31562, "ccis": [], "uuid": "58d7def9-f934-55e9-8043-1b7275971f9f", "testId": "IRO-02.1_A05", "test": "incident response personnel (identified by name and/or by role) to be notified of detected suspicious events is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(07)_ODP[01]", "defaultText": null }, { "id": 72093, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590681", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590681", "securityControlId": 31562, "ccis": [], "uuid": "e48485d8-799d-5920-a306-dca5bf00424c", "testId": "IRO-02.1_A06", "test": "least-disruptive actions to terminate suspicious events are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(07)_ODP[02]", "defaultText": null }, { "id": 72094, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590682", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590682", "securityControlId": 31562, "ccis": [], "uuid": "0765ab3e-e91d-5c23-b670-6fa4ba82a3d6", "testId": "IRO-02.1_A07", "test": "incident response personnel are notified of detected suspicious events.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(07)(a)", "defaultText": null }, { "id": 72095, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590682", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590682", "securityControlId": 31562, "ccis": [], "uuid": "8c18948d-53e7-57fe-b1ff-6e12db3834ef", "testId": "IRO-02.1_A08", "test": "least-disruptive actions are taken upon the detection of suspicious events.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(07)(b)", "defaultText": null } ], "externalMappings": [ { "id": 581658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586509", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41eae49c-05ab-5ef4-b823-da6b71e82dbf", "parentControlId": 31562, "controlId": "IR-4(1)", "title": "IR-4(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586509" }, { "id": 581659, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586509", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "daf03f04-2933-5d29-9731-e8f9e5c86ecb", "parentControlId": 31562, "controlId": "SI-4(7)", "title": "SI-4(7)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586509" }, { "id": 581660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586509", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "162cdbb7-ba9d-592d-9c7b-4d6ae0a9a722", "parentControlId": 31562, "controlId": "IR-04(01)", "title": "IR-04(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586509" }, { "id": 581661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586509", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f980ed2-c8e9-55e5-9a56-406284ec2fa2", "parentControlId": 31562, "controlId": "SI-04(07)", "title": "SI-04(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586509" }, { "id": 581663, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58651", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13e7762c-19c6-5207-9c56-c9fc00ce806e", "parentControlId": 31562, "controlId": "IR-04(01)", "title": "IR-04(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58651" }, { "id": 581664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58651", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a715b64-a83a-5c67-8a73-8b97c640063d", "parentControlId": 31562, "controlId": "IR-04(01)", "title": "IR-04(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58651" }, { "id": 581665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58651", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12661be9-9d9c-5516-9491-dc22b1f36128", "parentControlId": 31562, "controlId": "SI-04(07)", "title": "SI-04(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58651" }, { "id": 581666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58651", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e2a2b97-61c3-576d-a608-9caf8544b3a9", "parentControlId": 31562, "controlId": "IR-04(01)", "title": "IR-04(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58651" }, { "id": 581667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58651", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "963340b5-6db3-590e-8191-c523fd2bc6c6", "parentControlId": 31562, "controlId": "IR-04(01)", "title": "IR-04(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58651" } ], "id": 31562, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73116", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73116", "catalogueId": 1062, "uuid": "76f1cf2b-9aac-5f15-9193-64d3ca75c2bb", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to support the incident handling process?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 1.0, "title": "Automated Incident Handling Processes", "description": "

Control Description

Automated mechanisms exist to support the incident handling process.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically support the incident handling process.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-02.1", "family": "Incident Response", "enhancements": "", "sortId": "IRO-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Large Business (250-999 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Enterprise (>1,000 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72096, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590682", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590682", "securityControlId": 31563, "ccis": [], "uuid": "51c9beb7-d304-5918-a7cb-d136f257b249", "testId": "IRO-02.2_A01", "test": "an incident handling capability is implemented for incidents involving insider threats.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(06)", "defaultText": null } ], "externalMappings": [ { "id": 581682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586512", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "adb60bb3-879d-5b48-86e3-6dba6d082128", "parentControlId": 31563, "controlId": "IR-4(6)", "title": "IR-4(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586512" }, { "id": 581683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586512", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c0735ce-f51c-500a-aa30-301adffc1546", "parentControlId": 31563, "controlId": "IR-04(06)", "title": "IR-04(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586512" }, { "id": 581684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586512", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef935cc7-9238-5782-bc25-22668f508dfd", "parentControlId": 31563, "controlId": "IR-04(07)", "title": "IR-04(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586512" }, { "id": 581685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586512", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8cf8bc1e-efa9-5c76-8e33-debaa77c09da", "parentControlId": 31563, "controlId": "IR-04(06)", "title": "IR-04(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586512" }, { "id": 581686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586512", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d87122b-4f04-582a-82dd-680aa35f735b", "parentControlId": 31563, "controlId": "IR-04(07)", "title": "IR-04(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586512" }, { "id": 581687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586512", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "000863cd-8563-5dd6-8ada-a0ae2a103baa", "parentControlId": 31563, "controlId": "IR-4(6)", "title": "IR-4(6)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586512" }, { "id": 581688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586512", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c8752af-4f37-5e6b-8b63-e6dee32216e4", "parentControlId": 31563, "controlId": "IR-4(7)", "title": "IR-4(7)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586512" } ], "id": 31563, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73116", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73116", "catalogueId": 1062, "uuid": "85038f26-4701-5432-9c73-a65c72ada15d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement and govern an insider threat program?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Insider Threat Response Capability", "description": "

Control Description

Mechanisms exist to implement and govern an insider threat program.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement and govern an insider threat program.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-02.2", "family": "Incident Response", "enhancements": "", "sortId": "IRO-02.2", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72097, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590682", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590682", "securityControlId": 31564, "ccis": [], "uuid": "176fc08b-ee00-5b0a-9905-19136538f930", "testId": "IRO-02.3_A01", "test": "types of dynamic reconfiguration for system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(02)_ODP[01]", "defaultText": null }, { "id": 72098, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590683", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590683", "securityControlId": 31564, "ccis": [], "uuid": "43b18aab-2981-54d5-a63a-4b6d287e89ba", "testId": "IRO-02.3_A02", "test": "system components that require dynamic reconfiguration are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(02)_ODP[02]", "defaultText": null }, { "id": 72099, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590683", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590683", "securityControlId": 31564, "ccis": [], "uuid": "0d41d311-1732-585e-83f4-717957de61c0", "testId": "IRO-02.3_A03", "test": "types of dynamic reconfiguration for system components are included as part of the incident response capability.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(02)", "defaultText": null } ], "externalMappings": [ { "id": 581709, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42ad651f-b215-5e37-8277-fcd9a27eaffa", "parentControlId": 31564, "controlId": "IR-4(2)", "title": "IR-4(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586515" }, { "id": 581710, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c13ff0fd-f1e7-55a1-9b24-ae1e2a237333", "parentControlId": 31564, "controlId": "IR-04(02)", "title": "IR-04(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586515" }, { "id": 581711, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "815924a2-b7ff-539e-a4ae-746e9c5244c5", "parentControlId": 31564, "controlId": "IR-04(02)", "title": "IR-04(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586515" } ], "id": 31564, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73116", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73116", "catalogueId": 1062, "uuid": "c3b71587-6539-5395-9659-ffd728deb2da", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to dynamically reconfigure system components as part of the incident response capability?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Dynamic Reconfiguration", "description": "

Control Description

Automated mechanisms exist to dynamically reconfigure system components as part of the incident response capability.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Incident Response (IRO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IRO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Incident response-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically dynamically reconfigure system components as part of the incident response capability.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-02.3", "family": "Incident Response", "enhancements": "", "sortId": "IRO-02.3", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Large Business (250-999 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)

Enterprise (>1,000 staff)

∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72100, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590683", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590683", "securityControlId": 31565, "ccis": [], "uuid": "41e6b473-7f24-5e1b-b52d-eff4ab2b79e6", "testId": "IRO-02.4_A01", "test": "classes of incidents requiring an organization-defined action to be taken are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(03)_ODP[01]", "defaultText": null }, { "id": 72101, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590683", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590683", "securityControlId": 31565, "ccis": [], "uuid": "feb8c90d-84c5-59b0-ba72-a2cba2b22bd5", "testId": "IRO-02.4_A02", "test": "classes of incidents are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(03)[01]", "defaultText": null }, { "id": 72102, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590683", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590683", "securityControlId": 31565, "ccis": [], "uuid": "d7714d69-fe3f-58d7-8b64-2d131ba7da99", "testId": "IRO-02.4_A03", "test": "actions to be taken in response to organization-defined classes of incidents are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(03)_ODP[02]", "defaultText": null }, { "id": 72103, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590683", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590683", "securityControlId": 31565, "ccis": [], "uuid": "4f598ab4-f4e6-526f-8fd4-3f76acd87146", "testId": "IRO-02.4_A04", "test": "actions are taken in response to those incidents to ensure the continuation of organizational mission and business functions.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-04(03)[02]", "defaultText": null } ], "externalMappings": [ { "id": 581721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e387fc0a-b18f-565c-ac1c-1f8557c4833b", "parentControlId": 31565, "controlId": "IR-4(3)", "title": "IR-4(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586516" }, { "id": 581722, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27b7c448-d703-504f-a72f-5def3f62d2c5", "parentControlId": 31565, "controlId": "IR-04(03)", "title": "IR-04(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586517" }, { "id": 581724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c59fcfb-3013-51fb-aac9-19ca1bdd1092", "parentControlId": 31565, "controlId": "IR-04(03)", "title": "IR-04(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586517" }, { "id": 581726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "178d12b3-1e04-53c9-8f12-a199745b6ca8", "parentControlId": 31565, "controlId": "DE.AE", "title": "DE.AE", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586517" }, { "id": 581727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f77d86b-4510-5952-80d0-214fcf44f2d7", "parentControlId": 31565, "controlId": "DE.AE-02", "title": "DE.AE-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586517" }, { "id": 581728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6b53e0f-ac4f-5869-ba24-fbd57d4889f3", "parentControlId": 31565, "controlId": "DE.AE-04", "title": "DE.AE-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586517" }, { "id": 581729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "616c250f-1a92-5021-bce4-b851ced38721", "parentControlId": 31565, "controlId": "DE.AE-06", "title": "DE.AE-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586517" }, { "id": 581730, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "700e5843-2e1c-552e-91fa-9f6989a5747e", "parentControlId": 31565, "controlId": "DE.AE-08", "title": "DE.AE-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586517" }, { "id": 581731, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9a11498-3890-5c21-85db-ee22258e871f", "parentControlId": 31565, "controlId": "RS.MA-03", "title": "RS.MA-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586517" }, { "id": 581732, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586518", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ecf76c9-6d19-5176-9c72-9af9b4d82607", "parentControlId": 31565, "controlId": "RS.AN-08", "title": "RS.AN-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586518" }, { "id": 581735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586518", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3cb124c0-16a3-5e01-aea5-dc3996f1a394", "parentControlId": 31565, "controlId": "RESPONSE-1b", "title": "RESPONSE-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586518" }, { "id": 581736, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586518", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6461513-80c5-55a7-b196-a0c3ca0c36e1", "parentControlId": 31565, "controlId": "RESPONSE-2a", "title": "RESPONSE-2a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586518" }, { "id": 581737, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586518", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1fdfd83-14e2-5e1a-b8f0-8f1570d6dbab", "parentControlId": 31565, "controlId": "RESPONSE-2b", "title": "RESPONSE-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586518" }, { "id": 581738, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586518", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28c7eac9-6b69-5adb-9a78-d7a526a64958", "parentControlId": 31565, "controlId": "RESPONSE-2c", "title": "RESPONSE-2c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586518" }, { "id": 581739, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586518", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "399fe3b4-95f9-5b10-bc32-91cfb0fdea2e", "parentControlId": 31565, "controlId": "RESPONSE-2d", "title": "RESPONSE-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586518" }, { "id": 581740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586518", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57174315-fd77-57d5-8838-db9c5f2fa98a", "parentControlId": 31565, "controlId": "RESPONSE-2e", "title": "RESPONSE-2e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586519" }, { "id": 581741, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586519", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef0b41c4-b9da-55e4-b1d7-1aef7ac8586f", "parentControlId": 31565, "controlId": "RESPONSE-2h", "title": "RESPONSE-2h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586519" }, { "id": 581748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586519", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b232f8e-60d9-55b8-b596-528cf8e69e2a", "parentControlId": 31565, "controlId": "CIP-008-6 1.1", "title": "CIP-008-6 1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586519" }, { "id": 581749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58652", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fcd85b6-dd61-55e4-b99b-a72bb1481d69", "parentControlId": 31565, "controlId": "CIP-008-6 1.2.1", "title": "CIP-008-6 1.2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58652" }, { "id": 581750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58652", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2855f606-4af0-51b1-95db-9dc384faa380", "parentControlId": 31565, "controlId": "CIP-008-6 1.2.2", "title": "CIP-008-6 1.2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58652" } ], "id": 31565, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731161", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731161", "catalogueId": 1062, "uuid": "7d6a4d89-546f-5ae8-b87a-ff5fdb670c1b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify classes of incidents and actions to take to ensure the continuation of organizational missions and business functions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Incident Classification & Prioritization", "description": "

Control Description

Mechanisms exist to identify classes of incidents and actions to take to ensure the continuation of organizational missions and business functions.

Evidence Request List (ERL)

E-IRO-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ IT and/or cybersecurity personnel facilitate prompt response to suspected or confirmed security incidents, including timely notification to affected stakeholders.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify classes of incidents and actions to take to ensure the continuation of organizational missions and business functions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-02.4", "family": "Incident Response", "enhancements": "", "sortId": "IRO-02.4", "references": "

Micro-Small Business (<10 staff)

∙ National Cyber Incident Scoring\nSystem (NCISS) (https://cisa.gov)

Small Business (10-49 staff)

∙ National Cyber Incident Scoring\nSystem (NCISS) (https://cisa.gov)

Medium Business (50-249 staff)

∙ National Cyber Incident Scoring\nSystem (NCISS) (https://cisa.gov)

Large Business (250-999 staff)

∙ National Cyber Incident Scoring\nSystem (NCISS) (https://cisa.gov)

Enterprise (>1,000 staff)

∙ National Cyber Incident Scoring\nSystem (NCISS) (https://cisa.gov)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72104, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590684", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590684", "securityControlId": 31566, "ccis": [], "uuid": "8fc439c2-7e29-555a-8452-451731eaefff", "testId": "IRO-02.5_A01", "test": "external organizations with whom organizational incident information is to be coordinated and shared are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(08)_ODP[01]", "defaultText": null }, { "id": 72105, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590684", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590684", "securityControlId": 31566, "ccis": [], "uuid": "fc793e14-97ea-59d2-882a-16f3f143ac2b", "testId": "IRO-02.5_A02", "test": "incident information to be correlated and shared with organization-defined external organizations are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(08)_ODP[02]", "defaultText": null }, { "id": 72106, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590684", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590684", "securityControlId": 31566, "ccis": [], "uuid": "b28fc7c3-35e6-5b1f-ad78-5d5493b42a4d", "testId": "IRO-02.5_A03", "test": "there is coordination with external organizations to correlate and share incident information to achieve a cross-organization perspective on incident awareness and more effective incident responses.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(08)", "defaultText": null } ], "externalMappings": [ { "id": 581770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3333647d-b316-5703-9075-f7a1e86ff579", "parentControlId": 31566, "controlId": "IR-4(8)", "title": "IR-4(8)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58653" }, { "id": 581771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26d7cdac-555a-5572-a30d-42fb9bdaff8d", "parentControlId": 31566, "controlId": "IR-04(08)", "title": "IR-04(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58653" }, { "id": 581772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee0d9e87-edce-5a52-920a-6b53d1b4c4cf", "parentControlId": 31566, "controlId": "IR-04(08)", "title": "IR-04(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58653" }, { "id": 581773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c1b9cbc-4bd2-535b-8055-2e5ccfea6372", "parentControlId": 31566, "controlId": "IR-1(1)", "title": "IR-1(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58653" }, { "id": 581774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586531", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2965fdc6-883b-5aa1-8b74-f6e53d393b4b", "parentControlId": 31566, "controlId": "GV.SC-08", "title": "GV.SC-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586531" }, { "id": 581775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586531", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac30e80e-17d6-59d4-985d-ea252057a7f6", "parentControlId": 31566, "controlId": "DE.AE-03", "title": "DE.AE-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586531" }, { "id": 581776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586531", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0032b43-621d-594e-9834-122b2090c201", "parentControlId": 31566, "controlId": "RS.MA-01", "title": "RS.MA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586531" }, { "id": 581777, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586531", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2d79a5c-88e7-508e-bae1-e04c30929362", "parentControlId": 31566, "controlId": "RS.CO", "title": "RS.CO", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586531" } ], "id": 31566, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731161", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731161", "catalogueId": 1062, "uuid": "143a2b3f-5102-5d41-88c1-9344843f6f5c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization coordinate with approved third-parties to achieve a cross-organization perspective on incident awareness and more effective incident responses?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Correlation with External Organizations", "description": "

Control Description

Mechanisms exist to coordinate with approved third-parties to achieve a cross-organization perspective on incident awareness and more effective incident responses.

Evidence Request List (ERL)

E-IRO-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to coordinate with approved third-parties to achieve a cross-organization perspective on incident awareness and more effective incident responses.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-02.5", "family": "Incident Response", "enhancements": "", "sortId": "IRO-02.5", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72107, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590684", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590684", "securityControlId": 31567, "ccis": [], "uuid": "276e3e6b-ec98-55cc-a515-d6c6e490ff1e", "testId": "IRO-02.6_A01", "test": "a configurable capability is implemented to automatically disable the system if security violations are detected.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(05)", "defaultText": null } ], "externalMappings": [ { "id": 581786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64429139-f0fe-5ef8-a48a-0deab8870b68", "parentControlId": 31567, "controlId": "IR-04(05)", "title": "IR-04(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586532" }, { "id": 581788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a29bc8f-3f5a-5675-85c7-29c0c5718ea2", "parentControlId": 31567, "controlId": "IR-04(05)", "title": "IR-04(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586532" } ], "id": 31567, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731161", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731161", "catalogueId": 1062, "uuid": "1eb365fb-2e6e-5ac8-9011-3f81c673c2f4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization automatically disable Technology Assets, Applications and/or Services (TAAS), upon detection of a possible incident that meets organizational criteria, which allows for forensic analysis to be performed?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Automatic Disabling of Technology Assets, Applications and/or Services (TAAS)", "description": "

Control Description

Mechanisms exist to automatically disable Technology Assets, Applications and/or Services (TAAS), upon detection of a possible incident that meets organizational criteria, which allows for forensic analysis to be performed.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Incident Response (IRO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IRO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Incident response-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically disable Technology Assets, Applications and/or Services (TAAS), upon detection of a possible incident that meets organizational criteria, which allows for forensic analysis to be performed.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-02.6", "family": "Incident Response", "enhancements": "", "sortId": "IRO-02.6", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72108, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590685", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590685", "securityControlId": 31568, "ccis": [], "uuid": "88630abf-08b7-52b6-bc78-b166a00e652b", "testId": "IRO-03_A01", "test": "anomalous or suspicious behavior is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.2e[a]", "defaultText": null }, { "id": 72109, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590685", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590685", "securityControlId": 31568, "ccis": [], "uuid": "6a78888d-9480-5cf1-a264-912b1e9c706a", "testId": "IRO-03_A02", "test": "environments or resources which may contain or may be related to anomalous or suspected adversarial behavior are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(13)_ODP", "defaultText": null }, { "id": 72110, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590685", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590685", "securityControlId": 31568, "ccis": [], "uuid": "eca252c1-0038-5218-bb57-0293c7b3726d", "testId": "IRO-03_A03", "test": "anomalous or suspected adversarial behavior in or related to organization-defined environments or resources are analyzed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(13)", "defaultText": null }, { "id": 72111, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590685", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590685", "securityControlId": 31568, "ccis": [], "uuid": "7ea57ac8-4050-56bb-ad92-c8848e1231bb", "testId": "IRO-03_A04", "test": "organizational systems and system components are monitored on an ongoing basis for anomalous or suspicious behavior.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "172A_3.14.2e[b]", "defaultText": null } ], "externalMappings": [ { "id": 581802, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586534", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e36b4b93-38fa-554e-be08-af9136993a93", "parentControlId": 31568, "controlId": "3.14.7", "title": "3.14.7", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586534" }, { "id": 581803, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586534", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0712f023-cfb3-5b2c-9535-a1c320e77e73", "parentControlId": 31568, "controlId": "DE.CM", "title": "DE.CM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586534" }, { "id": 581810, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586535", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db0ee0d9-bc90-5fb1-9cfa-666c5fc88d05", "parentControlId": 31568, "controlId": "SITUATION-2d", "title": "SITUATION-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586535" }, { "id": 581811, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586535", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eac23d4b-6e1d-5747-9bcf-0bff0e544490", "parentControlId": 31568, "controlId": "SITUATION-2h", "title": "SITUATION-2h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586535" }, { "id": 581812, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586535", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0077f53-851f-5e0b-9984-07ce8d8335fe", "parentControlId": 31568, "controlId": "SITUATION-2i", "title": "SITUATION-2i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586535" }, { "id": 581814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586535", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6eff982f-dc91-523a-a2a9-f7910c0af3ce", "parentControlId": 31568, "controlId": "CIP-008-6 1.2.1", "title": "CIP-008-6 1.2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586535" }, { "id": 581815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586535", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bf36781-aa77-5626-b655-dbc0fb3912c8", "parentControlId": 31568, "controlId": "CIP-008-6 1.2.2", "title": "CIP-008-6 1.2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586535" }, { "id": 581818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586536", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "819585cd-de39-51ab-98c4-69db086bbdbc", "parentControlId": 31568, "controlId": "C1.f", "title": "C1.f", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586536" }, { "controlId": "C.8.2", "title": "C.8.2 — Incident Response Training", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "fe8deec7-251e-5703-8088-58a905008f99", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.2", "title": "NEI 08-09 App E.8.2 — Incident Response Training", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "0d1d450b-e2a2-5030-815d-2fdfedd03bd2", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(2)", "title": "10 CFR 73.54(d)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "da2ce3dc-c201-576e-950f-b68eb2346be7", "isPublic": true }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "0906708a-b8e7-5245-99aa-98f0ae702c9d", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "375ff22a-4d7f-5e73-b667-c1205c88dc8c", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "2ecf8202-e533-53d2-a240-f6d822f679a2", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "e994f2cb-a65b-566e-8126-f5b1f5e455c7", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "72a658d3-ca4a-572f-bff0-850328a9e15a", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "f2581b1a-44f7-561c-8769-b5aa7f7fbf8b", "isPublic": true } ], "id": 31568, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731162", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731162", "catalogueId": 1062, "uuid": "f1b3d1a3-6d78-5da6-8fc9-c842e6865180", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define specific Indicators of Compromise (IOC) to identify the signs of potential cybersecurity events?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 8.0, "title": "Indicators of Compromise (IOC)", "description": "

Control Description

Mechanisms exist to define specific Indicators of Compromise (IOC) to identify the signs of potential cybersecurity events.

Evidence Request List (ERL)

E-IRO-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to define specific Indicators of Compromise (IOC) to identify the signs of potential cybersecurity events.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.8.2", "controlId": "IRO-03", "family": "Incident Response", "enhancements": "", "sortId": "IRO-03", "references": "

Micro-Small Business (<10 staff)

∙ Indicators of Compromise (IoC)

Small Business (10-49 staff)

∙ Indicators of Compromise (IoC)

Medium Business (50-249 staff)

∙ Indicators of Compromise (IoC)

Large Business (250-999 staff)

∙ Indicators of Compromise (IoC)

Enterprise (>1,000 staff)

∙ Indicators of Compromise (IoC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72112, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590686", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590686", "securityControlId": 31569, "ccis": [], "uuid": "514f470b-c94a-54b1-b3d7-0a7503d59441", "testId": "IRO-04_A01", "test": "personnel or roles that review and approve the incident response plan is/are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-08_ODP[01]", "defaultText": null }, { "id": 72113, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590686", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590686", "securityControlId": 31569, "ccis": [], "uuid": "5e430838-228a-539f-93ae-70502b404d26", "testId": "IRO-04_A02", "test": "entities, personnel or roles with designated responsibility for incident response are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-08_ODP[03]", "defaultText": null }, { "id": 72114, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590686", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590686", "securityControlId": 31569, "ccis": [], "uuid": "0269a308-cbe9-5fc4-918e-f845104becd9", "testId": "IRO-04_A03", "test": "an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-08a.01\n171A_R3_A.03.06.05.a.01", "defaultText": null }, { "id": 72115, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590686", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590686", "securityControlId": 31569, "ccis": [], "uuid": "4c07ab14-b0a3-5873-a9f4-3c1f3822262e", "testId": "IRO-04_A04", "test": "an incident response plan is developed that describes the structure and organization of the incident response capability.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-08a.02\n171A_R3_A.03.06.05.a.02", "defaultText": null }, { "id": 72116, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590686", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590686", "securityControlId": 31569, "ccis": [], "uuid": "1622a6f6-5f1f-5c92-bf60-b954f6788014", "testId": "IRO-04_A05", "test": "an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-08a.03\n171A_R3_A.03.06.05.a.03", "defaultText": null }, { "id": 72117, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590686", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590686", "securityControlId": 31569, "ccis": [], "uuid": "5c4986af-f5b6-562d-8a56-9d4938afe07f", "testId": "IRO-04_A06", "test": "an incident response plan is developed that meets the unique requirements of the organization with regard to mission, size, structure and functions.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-08a.04", "defaultText": null }, { "id": 72118, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590687", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590687", "securityControlId": 31569, "ccis": [], "uuid": "a385733a-6605-50c2-af01-33138bf4488f", "testId": "IRO-04_A07", "test": "an incident response plan is developed that defines reportable incidents.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-08a.05\n171A_R3_A.03.06.05.a.04", "defaultText": null }, { "id": 72119, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590687", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590687", "securityControlId": 31569, "ccis": [], "uuid": "51a195cb-71b4-596e-9ff8-6f509cbab1b3", "testId": "IRO-04_A08", "test": "an incident response plan is developed that provides metrics for measuring the incident response capability within the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-08a.06", "defaultText": null }, { "id": 72120, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590687", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590687", "securityControlId": 31569, "ccis": [], "uuid": "bc7e44e7-f6d8-5bf6-b591-6b15683deacf", "testId": "IRO-04_A09", "test": "an incident response plan is developed that defines the resources and management support needed to effectively maintain and mature an incident response capability.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-08a.07", "defaultText": null }, { "id": 72121, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590687", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590687", "securityControlId": 31569, "ccis": [], "uuid": "4420ee95-87dc-53c8-a6d5-d7acf0974cd5", "testId": "IRO-04_A10", "test": "an incident response plan is developed that addresses the sharing of incident information.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-08a.08\n171A_R3_A.03.06.05.a.05", "defaultText": null }, { "id": 72122, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590687", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590687", "securityControlId": 31569, "ccis": [], "uuid": "dd3168a1-bc16-5291-be61-d3abd75103a7", "testId": "IRO-04_A11", "test": "an incident response plan is developed that is reviewed and approved by personnel or roles frequency.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_IR-08a.09", "defaultText": null }, { "id": 72123, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590688", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590688", "securityControlId": 31569, "ccis": [], "uuid": "cdcea3f4-445c-5664-a908-751a1e0ff851", "testId": "IRO-04_A12", "test": "an incident response plan is developed that designates responsibilities to organizational entities, personnel, or roles.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-08a.10\n171A_R3_A.03.06.05.a.06", "defaultText": null }, { "id": 72124, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590688", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590688", "securityControlId": 31569, "ccis": [], "uuid": "02ac1a4c-17c8-5f51-bbfa-ce8b886f278c", "testId": "IRO-04_A13", "test": "copies of the incident response plan are distributed to designated incident response personnel (identified by name or by role).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-08b.[01]\n171A_R3_A.03.06.05.b[01]", "defaultText": null }, { "id": 72125, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590688", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590688", "securityControlId": 31569, "ccis": [], "uuid": "013705a8-c6bf-5b1d-8f09-43c2209ec8db", "testId": "IRO-04_A14", "test": "incident response personnel (identified by name and/or by role) to whom copies of the incident response plan are to be distributed is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-08_ODP[04]", "defaultText": null }, { "id": 72126, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590688", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590688", "securityControlId": 31569, "ccis": [], "uuid": "2304f822-aa9b-54dc-81b8-2ed9adab7624", "testId": "IRO-04_A15", "test": "organizational elements to which copies of the incident response plan are to be distributed are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-08_ODP[05]", "defaultText": null }, { "id": 72127, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590688", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590688", "securityControlId": 31569, "ccis": [], "uuid": "0a460312-fbde-5fc5-b82c-ef39042c4a93", "testId": "IRO-04_A16", "test": "incident response personnel (identified by name and/or by role) to whom changes to the incident response plan is/are communicated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-08_ODP[06]", "defaultText": null }, { "id": 72128, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590688", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590688", "securityControlId": 31569, "ccis": [], "uuid": "6262d250-d1e7-5551-8526-f6f4484b8b5c", "testId": "IRO-04_A17", "test": "organizational elements to which changes to the incident response plan are communicated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-08_ODP[07]", "defaultText": null }, { "id": 72129, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590688", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590689", "securityControlId": 31569, "ccis": [], "uuid": "357710e1-d9b7-5b3e-bdb7-4cc491559bdd", "testId": "IRO-04_A18", "test": "copies of the incident response plan are distributed to organizational elements.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_IR-08b.[02]\n171A_R3_A.03.06.05.b[02]", "defaultText": null }, { "id": 72130, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590689", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590689", "securityControlId": 31569, "ccis": [], "uuid": "5128acdd-5cc3-52ff-af8d-fa92070d45fd", "testId": "IRO-04_A19", "test": "the frequency at which to review and approve the incident response plan is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_IR-08_ODP[02]", "defaultText": null }, { "id": 72131, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590689", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590689", "securityControlId": 31569, "ccis": [], "uuid": "c961de58-100d-5c50-81b6-67ac4dca7e9e", "testId": "IRO-04_A20", "test": "the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution or testing.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-08c.", "defaultText": null }, { "id": 72132, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590689", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590689", "securityControlId": 31569, "ccis": [], "uuid": "4226d868-a789-50db-a74e-1e8b0d3fd1da", "testId": "IRO-04_A21", "test": "incident response plan changes are communicated to incident response personnel.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-08d.[01]", "defaultText": null }, { "id": 72133, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590689", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590689", "securityControlId": 31569, "ccis": [], "uuid": "cb691320-c475-5e4e-b820-533722a55ee8", "testId": "IRO-04_A22", "test": "incident response plan changes are communicated to organizational elements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-08d.[02]", "defaultText": null }, { "id": 72134, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590689", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590689", "securityControlId": 31569, "ccis": [], "uuid": "f2b519e0-7e18-5dce-a3d7-e6a0561c2af3", "testId": "IRO-04_A23", "test": "the incident response plan is protected from unauthorized disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_IR-08e.[01]\n171A_R3_A.03.06.05.d", "defaultText": null }, { "id": 72135, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59069", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59069", "securityControlId": 31569, "ccis": [], "uuid": "0a28ea59-03c9-5757-ad06-959bcd3d284d", "testId": "IRO-04_A24", "test": "the incident response plan is protected from unauthorized modification.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_IR-08e.[02]", "defaultText": null }, { "id": 72136, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59069", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59069", "securityControlId": 31569, "ccis": [], "uuid": "eb1762ce-16e5-5ebd-9bc9-3b03af298fda", "testId": "IRO-04_A25", "test": "the time period to report suspected incidents to the organizational incident response capability is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.06.02.ODP[01]", "defaultText": null }, { "id": 72137, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59069", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59069", "securityControlId": 31569, "ccis": [], "uuid": "c35678b4-94b0-5b8f-a44e-09961b55f1b0", "testId": "IRO-04_A26", "test": "authorities to whom incident information is to be reported are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.06.02.ODP[02]", "defaultText": null } ], "externalMappings": [ { "id": 581874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0549f66-944a-581e-8c35-94505123624e", "parentControlId": 31569, "controlId": "5.24", "title": "5.24", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586542" }, { "id": 581875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5fa06682-0ff6-5946-a3f1-036ca66ef268", "parentControlId": 31569, "controlId": "5.26", "title": "5.26", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586542" }, { "id": 581896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586545", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64894add-2a7e-5662-bcd5-d5da87bca226", "parentControlId": 31569, "controlId": "IR-8", "title": "IR-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586545" }, { "id": 581897, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586545", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "074bbb38-2169-5b71-9164-f025d0f1b45a", "parentControlId": 31569, "controlId": "IR-08", "title": "IR-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586545" }, { "id": 581899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586545", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8146e03e-d745-5837-98f7-47de6960c7b3", "parentControlId": 31569, "controlId": "IR-08", "title": "IR-08", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586545" }, { "id": 581900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586545", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81b025db-33ab-545e-b7a6-18cd18e3c311", "parentControlId": 31569, "controlId": "IR-08", "title": "IR-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586545" }, { "id": 581901, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586545", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee56ed6e-c236-5aea-8299-479c9d51d7ac", "parentControlId": 31569, "controlId": "IR-08", "title": "IR-08", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586545" }, { "id": 581902, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586545", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4f469d5-e281-554f-ae58-869459e7ca85", "parentControlId": 31569, "controlId": "IR-08", "title": "IR-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586545" }, { "id": 581903, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0fefddf-1d8a-52b6-bcb4-5f25d1e0147d", "parentControlId": 31569, "controlId": "IR-08", "title": "IR-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586546" }, { "id": 581904, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5239b975-d382-51be-bc84-1c6af16ac958", "parentControlId": 31569, "controlId": "IR-8", "title": "IR-8", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586546" }, { "id": 581905, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89477dd5-68e8-530c-b3bd-bb771569773e", "parentControlId": 31569, "controlId": "IR-8", "title": "IR-8", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586546" }, { "id": 581906, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3bd4e48-ec9e-5614-a174-4d5d41e10f92", "parentControlId": 31569, "controlId": "IR-8", "title": "IR-8", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586546" }, { "id": 581909, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5698a219-d2e0-5b9e-9667-86e7b9ec6be8", "parentControlId": 31569, "controlId": "NFO - IR-8", "title": "NFO - IR-8", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586546" }, { "id": 581910, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9003b89c-4bdb-52d2-9806-34c1c885bb3d", "parentControlId": 31569, "controlId": "03.06.01", "title": "03.06.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586546" }, { "id": 581911, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdc6e862-677b-5f94-b498-790a02f5362d", "parentControlId": 31569, "controlId": "03.06.05.a", "title": "03.06.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586547" }, { "id": 581912, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d006a95b-3357-59f0-aa90-c2046538b282", "parentControlId": 31569, "controlId": "03.06.05.a.01", "title": "03.06.05.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586547" }, { "id": 581913, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "417d5cb3-7bbd-59ba-907c-d7f1955fed08", "parentControlId": 31569, "controlId": "03.06.05.a.02", "title": "03.06.05.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586547" }, { "id": 581914, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "728b41f4-6cda-5f25-a8e6-398d282fdc68", "parentControlId": 31569, "controlId": "03.06.05.a.03", "title": "03.06.05.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586547" }, { "id": 581915, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d656e195-4b63-5c37-8dd4-62807e602fdd", "parentControlId": 31569, "controlId": "03.06.05.a.04", "title": "03.06.05.a.04", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586547" }, { "id": 581916, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2536cc69-a166-512a-a351-0ecd4c673b36", "parentControlId": 31569, "controlId": "03.06.05.a.05", "title": "03.06.05.a.05", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586547" }, { "id": 581917, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea137c8f-1c49-5b58-95f7-07803f811b45", "parentControlId": 31569, "controlId": "03.06.05.a.06", "title": "03.06.05.a.06", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586547" }, { "id": 581918, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5bee4d3b-9e03-50a2-b653-092b5280bc13", "parentControlId": 31569, "controlId": "03.06.05.b", "title": "03.06.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586548" }, { "id": 581930, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586549", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7925db8a-d4cd-5281-9411-746403e3ec69", "parentControlId": 31569, "controlId": "ID.IM-04", "title": "ID.IM-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586549" }, { "id": 581931, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586549", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2619d431-cd69-5a64-9629-6d21ba7fd56d", "parentControlId": 31569, "controlId": "DE.AE-06", "title": "DE.AE-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586549" }, { "id": 581932, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586549", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99e7569d-fdf1-590b-b39b-59babd3a55da", "parentControlId": 31569, "controlId": "RS", "title": "RS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586549" }, { "id": 581933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586549", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e345323-5a6e-520b-92b2-8762199f009b", "parentControlId": 31569, "controlId": "RS.MA", "title": "RS.MA", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586549" }, { "id": 581934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586549", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4ec91e0-1337-59a2-9853-bb84e58f09f8", "parentControlId": 31569, "controlId": "RS.MA-01", "title": "RS.MA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586549" }, { "id": 581935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586549", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e83a295-f36a-54a9-b753-9f9573c83db5", "parentControlId": 31569, "controlId": "RS.MA-02", "title": "RS.MA-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586549" }, { "id": 581936, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586549", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "145497af-a94d-57bf-9ae1-fbe68cd0ef13", "parentControlId": 31569, "controlId": "RS.MA-04", "title": "RS.MA-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586549" }, { "id": 581937, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586549", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "272fffac-b4e5-57b7-866a-9856d5279a8f", "parentControlId": 31569, "controlId": "RS.MI", "title": "RS.MI", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586549" }, { "id": 581962, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586552", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "935546e1-8a1d-5843-8b26-11fb302cdc66", "parentControlId": 31569, "controlId": "RESPONSE-1a", "title": "RESPONSE-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586552" }, { "id": 581963, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586552", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5fce9a06-19a4-5b64-b404-47ed3ad7c7a7", "parentControlId": 31569, "controlId": "RESPONSE-3b", "title": "RESPONSE-3b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586552" }, { "id": 581964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586552", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0954ae8a-eaf0-5f03-9fce-722683d6992c", "parentControlId": 31569, "controlId": "RESPONSE-3d", "title": "RESPONSE-3d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586552" }, { "id": 581965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "263f0c9a-c091-5433-87b8-f351c6986960", "parentControlId": 31569, "controlId": "RESPONSE-3e", "title": "RESPONSE-3e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586553" }, { "id": 581966, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "684d7cb1-4256-58a9-929a-68b3969bc9ee", "parentControlId": 31569, "controlId": "RESPONSE-3f", "title": "RESPONSE-3f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586553" }, { "id": 581967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19151f0a-2bcb-5370-80af-3e75994589c5", "parentControlId": 31569, "controlId": "RESPONSE-3l", "title": "RESPONSE-3l", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586553" }, { "id": 582010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83b2a2fb-06cc-5ddc-bf9d-f74291d8ec75", "parentControlId": 31569, "controlId": "CIP-008-6 R1", "title": "CIP-008-6 R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586558" }, { "id": 582011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f05e3db-f240-538d-8f2a-d7115836514d", "parentControlId": 31569, "controlId": "CIP-008-6 1.1", "title": "CIP-008-6 1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586558" }, { "id": 582012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84f9f3fe-6256-5081-b77a-2bfb41b0cfa1", "parentControlId": 31569, "controlId": "CIP-008-6 1.4", "title": "CIP-008-6 1.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586558" }, { "id": 582013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b8d07cd-e654-574c-a210-7727b9d904e1", "parentControlId": 31569, "controlId": "CIP-008-6 R2", "title": "CIP-008-6 R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586558" }, { "id": 582014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0d9fa17-68f4-5aa6-9bcb-842c2b01f194", "parentControlId": 31569, "controlId": "CIP-008-6 2.2", "title": "CIP-008-6 2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586558" }, { "id": 582015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90233d60-ab07-50a6-a982-97d72d8d5897", "parentControlId": 31569, "controlId": "CIP-008-6 R3", "title": "CIP-008-6 R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586558" }, { "id": 582076, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586565", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d998c2a6-2fb7-56c8-b075-655a0e13b7b8", "parentControlId": 31569, "controlId": "D1.a", "title": "D1.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586565" }, { "controlId": "C.8.3", "title": "C.8.3 — Incident Response Testing and Drills", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "9687c6af-0967-5efa-98cc-00ec08e467d7", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.3", "title": "NEI 08-09 App E.8.3 — Incident Response Testing and Drills", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "56ebaa28-e4f6-5d6a-a813-c09be89a121c", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3)", "title": "10 CFR 73.54(d)(3) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "eb4e20cb-5512-5d63-b23f-bb2a95d30975", "isPublic": true }, { "controlId": "C.8.8", "title": "C.8.8 — Cyber Incident Response Plan", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "60f77cf0-40d2-59e9-962f-f669ca74dcca", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.8", "title": "NEI 08-09 App E.8.8 — Cyber Incident Response Plan", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e3dcad81-0947-5762-a1db-7e64c7b16395", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3), 73.77", "title": "10 CFR 73.54(d)(3), 73.77 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "570dc7da-265e-5e13-859c-851f7c7636f2", "isPublic": true }, { "controlId": "CIP-008-6-R1", "title": "CIP-008-6-R1 — Cyber Security Incident Response Plan", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "598af936-e2f8-5164-9d42-2b8438d70995", "isPublic": true }, { "controlId": "CIP-008-6-1.1", "title": "CIP-008-6-1.1 — One or more processes to identify, classify, and respond to Cyber Security Incidents.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ca43dabb-fdad-5b69-bb34-8c30275cf5b6", "isPublic": true }, { "controlId": "CIP-008-6-1.2", "title": "CIP-008-6-1.2 — One or more processes: 1.2.1 That include criteria to evaluate and define attempts to compromise", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "66a4fb4d-721a-58d5-bfaf-9eb1fad074b6", "isPublic": true }, { "controlId": "CIP-008-6-1.2.1", "title": "CIP-008-6-1.2.1 — That include criteria to evaluate and define attempts to compromise", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1e7115e1-160f-5bee-a12a-56fda72b6331", "isPublic": true }, { "controlId": "CIP-008-6-1.2.2", "title": "CIP-008-6-1.2.2 — To determine if an identified Cyber Security Incident is: • A Reportable Cyber Security Incident", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9b4ce5c5-57b4-5c96-9ed7-93dba6dd8bca", "isPublic": true }, { "controlId": "CIP-008-6-1.2.3", "title": "CIP-008-6-1.2.3 — To provide notification per Requirement R4.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "183671bc-b850-5ae9-8def-09db84f2960e", "isPublic": true }, { "controlId": "CIP-008-6-1.3", "title": "CIP-008-6-1.3 — The roles and responsibilities of Cyber Security Incident response groups or individuals.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "cc74d8dc-6a58-56fd-84b9-aa4f27b146b8", "isPublic": true }, { "controlId": "CIP-008-6-1.4", "title": "CIP-008-6-1.4 — Incident handling procedures for Cyber Security Incidents.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "fdb24855-1690-5881-a54b-0c23e3d8e450", "isPublic": true }, { "controlId": "CIP-008-6-R2", "title": "CIP-008-6-R2 — Cyber Security Incident Response Plan Implementation and Testing", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f8912924-1542-5b73-a61f-a1d9f726e069", "isPublic": true }, { "controlId": "CIP-008-6-2.1", "title": "CIP-008-6-2.1 — Test each Cyber Security Incident response plan(s) at least once every 15 calendar months", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3193bd0d-b0fc-5baf-b249-3779c0eaa25d", "isPublic": true }, { "controlId": "CIP-008-6-2.2", "title": "CIP-008-6-2.2 — Use the Cyber Security Incident response plan(s) under Requirement R1 when responding to a Reportable Cyber Security...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9401d3db-8818-5a63-abb0-24828c550b8f", "isPublic": true }, { "controlId": "CIP-008-6-2.3", "title": "CIP-008-6-2.3 — Retain records related to Reportable Cyber Security Incidents and Cyber Security Incidents that attempted to compromi...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1fa0b633-a115-511c-a973-f05bc2883163", "isPublic": true }, { "controlId": "CIP-008-6-R3", "title": "CIP-008-6-R3 — Cyber Security Incident Response Plan Review and Maintenance", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "32631c1c-c2ce-5a83-b243-0c4ea81e4b5a", "isPublic": true }, { "controlId": "CIP-008-6-3.1", "title": "CIP-008-6-3.1 — No later than 90 calendar days after completion of a Cyber Security Incident response plan(s) test or actual Reportab...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c241c92a-b266-55ef-9597-b6ff3902369b", "isPublic": true }, { "controlId": "CIP-008-6-3.1.1", "title": "CIP-008-6-3.1.1 — Document any lessons learned or document the absence of any lessons learned", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f44cadc8-5a57-5b57-8c7f-d8666759dfcf", "isPublic": true }, { "controlId": "CIP-008-6-3.1.2", "title": "CIP-008-6-3.1.2 — Update the Cyber Security Incident response plan based on any documented lessons learned associated with the plan", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a058ba90-d091-5283-b14d-d8fff83ce7e9", "isPublic": true }, { "controlId": "CIP-008-6-3.1.3", "title": "CIP-008-6-3.1.3 — Notify each person or group with a defined role in the Cyber Security Incident response plan of the updates to the Cy...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "20e0f5a2-4abd-576b-93a0-f3f3a2624692", "isPublic": true }, { "controlId": "CIP-008-6-3.2", "title": "CIP-008-6-3.2 — No later than 60 calendar days after a change to the roles or responsibilities, Cyber Security Incident response grou...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "113f7637-7eb2-5b6c-8348-03e0791cbf68", "isPublic": true }, { "controlId": "CIP-008-6-3.2.1", "title": "CIP-008-6-3.2.1 — Update the Cyber Security Incident response plan(s)", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7566078b-b140-5f12-8c12-23cd678bbb28", "isPublic": true }, { "controlId": "CIP-008-6-3.2.2", "title": "CIP-008-6-3.2.2 — Notify each person or group with a defined role in the Cyber Security Incident response plan of the updates.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4d52c2e3-47bb-51d2-a371-81d95acfae43", "isPublic": true }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "a1282726-de8f-5a08-bc77-8595d44ee15c", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "614999aa-7e26-5a24-a6c6-c1cd171c4064", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "e5c59062-3b7c-5cae-bed4-3560f435d52d", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "50dbe9dc-bef5-57ae-b063-cf0341c129c7", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "70026242-ec20-505d-9bea-e6b60e592b3a", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "e97f3233-9289-5b64-ad02-8fe3d55ac67a", "isPublic": true } ], "id": 31569, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731162", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731162", "catalogueId": 1062, "uuid": "a8cdc487-9a57-55ac-a2c3-db8a388529c9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Incident Response Plan (IRP)", "description": "

Control Description

Mechanisms exist to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.

Evidence Request List (ERL)

E-IRO-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain and make available a current and viable Incident Response Plan (IRP) to all stakeholders.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.8.3, C.8.8
NERC-CIP (2026) Requirements: CIP-008-6-R1, CIP-008-6-R2, CIP-008-6-R3", "controlId": "IRO-04", "family": "Incident Response", "enhancements": "", "sortId": "IRO-04", "references": "

Micro-Small Business (<10 staff)

∙ Incident Response Plan (IRP)

Small Business (10-49 staff)

∙ Incident Response Plan (IRP)

Medium Business (50-249 staff)

∙ Integrated Incident Response Program (IIRP)

Large Business (250-999 staff)

∙ Integrated Incident Response Program (IIRP)

Enterprise (>1,000 staff)

∙ Integrated Incident Response Program (IIRP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72138, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59069", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59069", "securityControlId": 31570, "ccis": [], "uuid": "a4f82a92-b419-5cb5-b3e9-8e5cb1584b9d", "testId": "IRO-04.1_A01", "test": "the incident response plan for breaches involving Personal Data (PD) includes a process to determine if notice to individuals or other organizations, including oversight organizations, is needed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-08(01)(a)", "defaultText": null }, { "id": 72139, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590691", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590691", "securityControlId": 31570, "ccis": [], "uuid": "3a155f11-1010-5a65-93cf-9ce7d5676a97", "testId": "IRO-04.1_A02", "test": "the incident response plan for breaches involving Personal Data (PD) includes an assessment process to determine the extent of the harm, embarrassment, inconvenience or unfairness to affected individuals and any mechanisms to mitigate such harms.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-08(01)(b)", "defaultText": null }, { "id": 72140, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590691", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590691", "securityControlId": 31570, "ccis": [], "uuid": "1470b91f-0771-5405-89c3-ff5f31139c3b", "testId": "IRO-04.1_A03", "test": "the incident response plan for breaches involving Personal Data (PD) includes the identification of applicable privacy requirements.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-08(01)(c)", "defaultText": null } ], "externalMappings": [ { "id": 582161, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fdfabd5-51b3-5706-b3e1-f5410b8ad519", "parentControlId": 31570, "controlId": "5.25", "title": "5.25", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586583" }, { "id": 582166, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a63136a-08e2-5f59-841f-6674d434634a", "parentControlId": 31570, "controlId": "SE-2", "title": "SE-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586584" }, { "id": 582167, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b5b9e3d-c298-5f71-8fb5-4fe339eda979", "parentControlId": 31570, "controlId": "IR-08(01)", "title": "IR-08(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586584" }, { "id": 582169, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0924eec5-7880-532f-a001-a9f696222a4b", "parentControlId": 31570, "controlId": "IR-08(01)", "title": "IR-08(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586584" } ], "id": 31570, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731163", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731163", "catalogueId": 1062, "uuid": "6c9305d2-8e11-541a-ba89-62a65d11a8d1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization address data breaches, or other incidents involving the unauthorized disclosure of sensitive or regulated data, according to applicable laws, regulations and contractual obligations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Data Breach", "description": "

Control Description

Mechanisms exist to address data breaches, or other incidents involving the unauthorized disclosure of sensitive or regulated data, according to applicable laws, regulations and contractual obligations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to address data breaches, or other incidents involving the unauthorized disclosure of sensitive or regulated data, according to applicable laws, regulations and contractual obligations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-04.1", "family": "Incident Response", "enhancements": "", "sortId": "IRO-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Incident Response Plan (IRP)

Small Business (10-49 staff)

∙ Incident Response Plan (IRP)

Medium Business (50-249 staff)

∙ Integrated Incident Response Program (IIRP)

Large Business (250-999 staff)

∙ Integrated Incident Response Program (IIRP)

Enterprise (>1,000 staff)

∙ Integrated Incident Response Program (IIRP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72141, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590691", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590691", "securityControlId": 31571, "ccis": [], "uuid": "9c5ddb37-a4d9-503a-b257-1a0c51630e45", "testId": "IRO-04.2_A01", "test": "an official to manage the incident response policy / procedures is defined.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_IR-01_ODP[03]\n53A_R5_IR-01_ODP[04]", "defaultText": null }, { "id": 72142, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590691", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590691", "securityControlId": 31571, "ccis": [], "uuid": "08e4f7ab-a16a-598c-8e93-85c44e2b5ddc", "testId": "IRO-04.2_A02", "test": "the frequency at which the current incident response policy / procedures is reviewed / updated is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_IR-01_ODP[05]\n53A_R5_IR-01_ODP[07]", "defaultText": null }, { "id": 72143, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590691", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590691", "securityControlId": 31571, "ccis": [], "uuid": "833c2145-2200-581e-a168-700fb0928828", "testId": "IRO-04.2_A03", "test": "events that would require the current incident response policy / procedures to be reviewed / updated are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-01_ODP[06]\n53A_R5_IR-01_ODP[08]", "defaultText": null }, { "id": 72144, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590692", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590692", "securityControlId": 31571, "ccis": [], "uuid": "2c6cc71e-7cbe-542b-b94b-95c0bed05471", "testId": "IRO-04.2_A04", "test": "the current incident response policy / procedures are reviewed / updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_IR-01c.01[01]\n53A_R5_IR-01c.02[01]", "defaultText": null }, { "id": 72145, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590692", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590692", "securityControlId": 31571, "ccis": [], "uuid": "e612c39b-5ac7-5958-9917-66ae685327f3", "testId": "IRO-04.2_A05", "test": "the current incident response policy / procedures are reviewed / updated following organization-defined events.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-01c.01[02]\n53A_R5_IR-01c.02[02]", "defaultText": null }, { "id": 72146, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590692", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590692", "securityControlId": 31571, "ccis": [], "uuid": "2b5ac457-62f9-5931-a337-c3bf0e2df401", "testId": "IRO-04.2_A06", "test": "the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "171A_R3_A.03.06.05.c", "defaultText": null }, { "id": 72147, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590692", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590692", "securityControlId": 31571, "ccis": [], "uuid": "3e2d63a3-1b6b-5e50-a4bd-511685ce22a6", "testId": "IRO-04.2_A07", "test": "personnel or roles to whom the incident response policy / procedures is to be disseminated are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-01_ODP[01]\n53A_R5_IR-01_ODP[02]", "defaultText": null }, { "id": 72148, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590692", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590692", "securityControlId": 31571, "ccis": [], "uuid": "33a37b95-9b19-53d0-8b9a-b73f0a827c23", "testId": "IRO-04.2_A08", "test": "an incident response policy is developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-01a.[01]", "defaultText": null }, { "id": 72149, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590693", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590693", "securityControlId": 31571, "ccis": [], "uuid": "012932f3-7e32-5e9a-aadc-5895a267ba82", "testId": "IRO-04.2_A09", "test": "the incident response policy is disseminated to organization-defined personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-01a.[02]", "defaultText": null }, { "id": 72150, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590693", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590693", "securityControlId": 31571, "ccis": [], "uuid": "fde9cf84-1440-5124-9d23-d36559c82c96", "testId": "IRO-04.2_A10", "test": "incident response procedures to facilitate the implementation of the incident response policy and associated incident response controls are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-01a.[03]", "defaultText": null }, { "id": 72151, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590693", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590693", "securityControlId": 31571, "ccis": [], "uuid": "c46259a1-205a-5c4d-95c0-95e62b28ade7", "testId": "IRO-04.2_A11", "test": "the incident response procedures are disseminated to organization-defined personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-01a.[04]", "defaultText": null }, { "id": 72152, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590693", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590693", "securityControlId": 31571, "ccis": [], "uuid": "33c47221-811d-5c71-960e-e7f3d4870025", "testId": "IRO-04.2_A12", "test": "the organization's incident response policy addresses purpose.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-01a.01(a)[01]", "defaultText": null }, { "id": 72153, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590693", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590693", "securityControlId": 31571, "ccis": [], "uuid": "cb16da42-d8f4-590c-b563-100bd33eb450", "testId": "IRO-04.2_A13", "test": "the organization's incident response policy addresses scope.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-01a.01(a)[02]", "defaultText": null }, { "id": 72154, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590693", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590693", "securityControlId": 31571, "ccis": [], "uuid": "5b913fd0-8e06-5495-8919-98318d3a6f92", "testId": "IRO-04.2_A14", "test": "the organization's incident response policy addresses roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-01a.01(a)[03]", "defaultText": null }, { "id": 72155, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590693", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590693", "securityControlId": 31571, "ccis": [], "uuid": "ddb5a004-562b-51f9-9980-722a572d307a", "testId": "IRO-04.2_A15", "test": "the organization's incident response policy addresses responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-01a.01(a)[04]", "defaultText": null }, { "id": 72156, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590694", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590694", "securityControlId": 31571, "ccis": [], "uuid": "bb71001f-4759-57c6-ab03-825c8502e6c9", "testId": "IRO-04.2_A16", "test": "the organization's incident response policy addresses management commitment.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-01a.01(a)[05]", "defaultText": null }, { "id": 72157, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590694", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590694", "securityControlId": 31571, "ccis": [], "uuid": "f70bb161-405b-5bd3-85e2-b03d336b63d4", "testId": "IRO-04.2_A17", "test": "the organization's incident response policy addresses coordination among organizational entities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-01a.01(a)[06]", "defaultText": null }, { "id": 72158, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590694", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590694", "securityControlId": 31571, "ccis": [], "uuid": "8c837b0f-e7f6-5ba1-9e60-8de7f68cef50", "testId": "IRO-04.2_A18", "test": "the organization's incident response policy addresses compliance.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-01a.01(a)[07]", "defaultText": null }, { "id": 72159, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590694", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590694", "securityControlId": 31571, "ccis": [], "uuid": "263d8311-cc7d-59f8-b63e-c11856747465", "testId": "IRO-04.2_A19", "test": "the organization's incident response policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-01a.01(b)", "defaultText": null }, { "id": 72160, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590694", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590694", "securityControlId": 31571, "ccis": [], "uuid": "6b61b456-89f7-5739-8607-65deb7317af9", "testId": "IRO-04.2_A20", "test": "the organization-defined official is designated to manage the development, documentation, and dissemination of the incident response policy and procedures.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_IR-01b.", "defaultText": null } ], "externalMappings": [ { "id": 582242, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d0eb4df-0971-55ed-83fb-9e26dc143931", "parentControlId": 31571, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586593" }, { "id": 582243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91ebc53a-b10e-5cea-9284-dd22036db5fb", "parentControlId": 31571, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586593" }, { "id": 582245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fdfd489-e6e9-5122-a966-b808f9a23e3d", "parentControlId": 31571, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586593" }, { "id": 582246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68c48087-002a-5ab6-8f43-dd2fd84b130b", "parentControlId": 31571, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586593" }, { "id": 582247, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "329c2236-24d5-5abf-912b-70a51a752eeb", "parentControlId": 31571, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586593" }, { "id": 582248, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29f49129-a8a0-575e-ae5a-e1828e93524d", "parentControlId": 31571, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586593" }, { "id": 582249, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24ae5d72-6813-5cb7-bea0-16e36d82ce11", "parentControlId": 31571, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586593" }, { "id": 582250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31a35634-04ed-5afd-8584-c38389d468c0", "parentControlId": 31571, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586593" }, { "id": 582251, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586593", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bc5ff8c-7215-5045-8a01-edfce8fa5c33", "parentControlId": 31571, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586593" }, { "id": 582252, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586594", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1249e477-2d93-57a7-aa47-468c79135e27", "parentControlId": 31571, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586594" }, { "id": 582256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586594", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d060f9f-82fe-5cb3-ad9e-b657a1ddd570", "parentControlId": 31571, "controlId": "NFO - IR-1", "title": "NFO - IR-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586594" }, { "id": 582257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586594", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a2a0b69-d593-5cd8-ac13-0eed75ce36ae", "parentControlId": 31571, "controlId": "03.06.04.b", "title": "03.06.04.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586594" }, { "id": 582258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586594", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0594ddf6-5918-5803-b63b-f9b168c0fc35", "parentControlId": 31571, "controlId": "03.06.05.c", "title": "03.06.05.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586594" }, { "id": 582260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586594", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f90d4f6a-71e4-5795-9bf2-5ab18c810526", "parentControlId": 31571, "controlId": "ID.IM-04", "title": "ID.IM-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586594" }, { "id": 582277, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "371a2da2-3a6b-5be9-a300-8608e533743f", "parentControlId": 31571, "controlId": "CIP-008-6 3.1.2", "title": "CIP-008-6 3.1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586596" }, { "id": 582278, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "840d3ce1-567c-5b90-bd90-831172655d41", "parentControlId": 31571, "controlId": "CIP-008-6 3.1.3", "title": "CIP-008-6 3.1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586596" }, { "id": 582279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65873307-c42e-5708-9e9d-cfe14d786905", "parentControlId": 31571, "controlId": "CIP-008-6 3.2.1", "title": "CIP-008-6 3.2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586597" }, { "id": 582280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586597", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc6efdb5-c27e-52c2-a1c9-e611745f0186", "parentControlId": 31571, "controlId": "CIP-008-6 3.2.2", "title": "CIP-008-6 3.2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586597" } ], "id": 31571, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731163", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731163", "catalogueId": 1062, "uuid": "0dff5f0d-1c22-50f4-a5ec-ab77b34f7e1c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization regularly review and modify incident response practices to incorporate lessons learned, business process changes and industry developments, as necessary?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 8.0, "title": "IRP Update", "description": "

Control Description

Mechanisms exist to regularly review and modify incident response practices to incorporate lessons learned, business process changes and industry developments, as necessary.

Evidence Request List (ERL)

E-IRO-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ On at least an annual basis, IT and/or cybersecurity personnel update incident response strategies to keep current with business needs, technology changes and regulatory requirements.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to regularly review and modify incident response practices to incorporate lessons learned, business process changes and industry developments, as necessary.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-04.2", "family": "Incident Response", "enhancements": "", "sortId": "IRO-04.2", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72161, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590695", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590695", "securityControlId": 31572, "ccis": [], "uuid": "affb04ce-a07c-5968-b751-0e62171b0454", "testId": "IRO-04.3_A01", "test": "qualitative / quantitative data from testing are used to determine the effectiveness of incident response processes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-03(03)(a)[01]\n53A_R5_IR-03(03)(a)[02]", "defaultText": null }, { "id": 72162, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590695", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590695", "securityControlId": 31572, "ccis": [], "uuid": "636eba29-a46f-553b-882c-5a7bd2849029", "testId": "IRO-04.3_A02", "test": "qualitative / quantitative data from testing are used to continuously improve incident response processes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-03(03)(b)[01]\n53A_R5_IR-03(03)(b)[02]", "defaultText": null }, { "id": 72163, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590695", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590695", "securityControlId": 31572, "ccis": [], "uuid": "c147be2a-9ddd-5080-8904-8148457fb3fd", "testId": "IRO-04.3_A03", "test": "qualitative / quantitative data from testing are used to provide incident response measures and metrics that are accurate.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-03(03)(c)[01]\n53A_R5_IR-03(03)(c)[02]", "defaultText": null }, { "id": 72164, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590695", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590695", "securityControlId": 31572, "ccis": [], "uuid": "a840e4e2-b354-5d8b-9f4e-211c7de4b47a", "testId": "IRO-04.3_A04", "test": "qualitative / quantitative data from testing are used to provide incident response measures and metrics that are consistent.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-03(03)(c)[03]\n53A_R5_IR-03(03)(c)[04]", "defaultText": null }, { "id": 72165, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590695", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590695", "securityControlId": 31572, "ccis": [], "uuid": "eb29fe82-53c7-5454-a02e-6a685b309675", "testId": "IRO-04.3_A05", "test": "qualitative / quantitative data from testing are used to provide incident response measures and metrics in a reproducible format.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-03(03)(c)[05]\n53A_R5_IR-03(03)(c)[06]", "defaultText": null } ], "externalMappings": [ { "id": 582294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2cfc1a2-73fb-5f58-91b8-a5fd14665400", "parentControlId": 31572, "controlId": "IR-03(03)", "title": "IR-03(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586598" }, { "id": 582295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586599", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9367cc04-4398-51a9-9d72-06c7da3461d9", "parentControlId": 31572, "controlId": "IR-03(03)", "title": "IR-03(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586599" }, { "id": 582296, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586599", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ca26e94-731d-5455-88ee-3e60f0d5eda0", "parentControlId": 31572, "controlId": "03.06.04.b", "title": "03.06.04.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586599" } ], "id": 31572, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731163", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731163", "catalogueId": 1062, "uuid": "68ab0d7f-141d-505b-a70e-05a8152e0453", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use qualitative and quantitative data from incident response testing to: \n (1) Determine the effectiveness of incident response processes;\n (2) Continuously improve incident response processes; and\n (3) Provide incident response measures and metrics that are accurate, consistent, and in a reproducible format?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Continuous Incident Response Improvements", "description": "

Control Description

Mechanisms exist to use qualitative and quantitative data from incident response testing to: \n(1) Determine the effectiveness of incident response processes;\n(2) Continuously improve incident response processes; and\n(3) Provide incident response measures and metrics that are accurate, consistent and in a reproducible format.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Incident Response (IRO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IRO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Incident response-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to use qualitative and quantitative data from incident response testing to: \n(1) Determine the effectiveness of incident response processes;\n(2) Continuously improve incident response processes; and\n(3) Provide incident response measures and metrics that are accurate, consistent and in a reproducible format.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-04.3", "family": "Incident Response", "enhancements": "", "sortId": "IRO-04.3", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ ITIL 4 (https://axelos.com) ∙ Incident and problem management

Large Business (250-999 staff)

∙ ITIL 4 (https://axelos.com) ∙ Incident and problem management

Enterprise (>1,000 staff)

∙ ITIL 4 (https://axelos.com) ∙ Incident and problem management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72166, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590696", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590696", "securityControlId": 31573, "ccis": [], "uuid": "d5e3f075-e75f-5c6f-aa66-426666fef015", "testId": "IRO-05_A01", "test": "incident response training for system users consistent with assigned roles and responsibilities is provided within an organization-defined time period of assuming an incident response role or responsibility or acquiring system access.
PPTDF Applicability: People
Assessment Rigor: 1
SCF Defined Parameters: Ten (10) days for privileged users, thirty (30) days for Incident Response roles", "otherId": "53A_R5_IR-02a.01", "defaultText": null }, { "id": 72167, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590696", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590696", "securityControlId": 31573, "ccis": [], "uuid": "1565aa53-97d4-5000-8ab9-9c6bb8d3cdf2", "testId": "IRO-05_A02", "test": "events that initiate a review of the incident response training content are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-02_ODP[04]\n171A_R3_A.03.06.04.ODP[04]", "defaultText": null }, { "id": 72168, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590696", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590696", "securityControlId": 31573, "ccis": [], "uuid": "449ddcfe-4535-5941-9e5a-04bb8690fd75", "testId": "IRO-05_A03", "test": "incident response training content is updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "SCF Created", "defaultText": null }, { "id": 72169, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590696", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590696", "securityControlId": 31573, "ccis": [], "uuid": "5e5682d9-7021-5072-9187-33d505acdbb8", "testId": "IRO-05_A04", "test": "incident response training content is reviewed / updated following organization-defined events.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72170, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590696", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590696", "securityControlId": 31573, "ccis": [], "uuid": "87325fbe-6b54-5369-aa8b-a8c4fb19da3a", "testId": "IRO-05_A05", "test": "the time period within which incident response training is to be provided to system users is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_IR-02_ODP[01]\n171A_R3_A.03.06.04.ODP[01]", "defaultText": null }, { "id": 72171, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590697", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590697", "securityControlId": 31573, "ccis": [], "uuid": "81350e0e-1347-5970-b346-a8b8bf5d8ce8", "testId": "IRO-05_A06", "test": "the frequency at which to provide incident response training to users after initial training is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least annually", "otherId": "53A_R5_IR-02_ODP[02]\n171A_R3_A.03.06.04.ODP[02]", "defaultText": null }, { "id": 72172, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590697", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590697", "securityControlId": 31573, "ccis": [], "uuid": "cd70a861-00dd-5571-98ff-a069c3afd63b", "testId": "IRO-05_A07", "test": "the frequency at which to review and update incident response training content is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least annually", "otherId": "53A_R5_IR-02_ODP[03]\n171A_R3_A.03.06.04.ODP[03]", "defaultText": null }, { "id": 72173, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590697", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590697", "securityControlId": 31573, "ccis": [], "uuid": "09feeee7-176a-5fba-a132-c929cde8b6d1", "testId": "IRO-05_A08", "test": "incident response training is provided to system users consistent with assigned roles and responsibilities when required by system changes.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_IR-02a.02", "defaultText": null }, { "id": 72174, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590697", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590697", "securityControlId": 31573, "ccis": [], "uuid": "a2345607-1e6b-50b0-9774-9124be6bd248", "testId": "IRO-05_A09", "test": "incident response training is provided to system users consistent with assigned roles and responsibilities upon role assignment and per an organization-defined frequency thereafter.
PPTDF Applicability: People
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_IR-02a.03", "defaultText": null }, { "id": 72175, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590698", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590698", "securityControlId": 31573, "ccis": [], "uuid": "4f22d999-4bba-5867-95d2-872e22178c17", "testId": "IRO-05_A10", "test": "incident response training content is reviewed per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_IR-02b.[01]", "defaultText": null }, { "id": 72176, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590698", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590698", "securityControlId": 31573, "ccis": [], "uuid": "d5994994-e65a-5316-8445-c5d42237939a", "testId": "IRO-05_A11", "test": "incident response training content is reviewed / updated following events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-02b.[02]", "defaultText": null }, { "id": 72177, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590698", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590698", "securityControlId": 31573, "ccis": [], "uuid": "6b1e7af4-0557-5fee-94fe-cb0232a1c329", "testId": "IRO-05_A12", "test": "incident response training on how to identify and respond to a breach is provided.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-02(03)[01]", "defaultText": null }, { "id": 72178, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590698", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590698", "securityControlId": 31573, "ccis": [], "uuid": "c9dfc82b-ffac-56d2-9fe7-88e0a85ccc96", "testId": "IRO-05_A13", "test": "incident response training on the organization's process for reporting a breach is provided.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_IR-02(03)[02]", "defaultText": null }, { "id": 72179, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590698", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590698", "securityControlId": 31573, "ccis": [], "uuid": "0ee29a82-5622-50ea-84a0-864dd44f799b", "testId": "IRO-05_A14", "test": "incident response training for system users consistent with assigned roles and responsibilities is provided within of assuming an incident response role or responsibility or acquiring system access.
PPTDF Applicability: People
Assessment Rigor: NIST 800-171
SCF Defined Parameters: ten (10) days for privileged users, thirty (30) days for all other roles", "otherId": "171A_R3_A.03.06.04.a.01", "defaultText": null }, { "id": 72180, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590698", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590698", "securityControlId": 31573, "ccis": [], "uuid": "0053add0-f3fe-57d3-a624-c7b9d07c6b2a", "testId": "IRO-05_A15", "test": "incident response training content is reviewed .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months", "otherId": "171A_R3_A.03.06.04.b[01]", "defaultText": null }, { "id": 72181, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590699", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590699", "securityControlId": 31573, "ccis": [], "uuid": "83297c19-eaa1-53af-93d1-863705f62252", "testId": "IRO-05_A16", "test": "incident response training content is updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months", "otherId": "171A_R3_A.03.06.04.b[02]", "defaultText": null }, { "id": 72182, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590699", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590699", "securityControlId": 31573, "ccis": [], "uuid": "43085f3b-46df-5fe0-a003-3be2aec5754f", "testId": "IRO-05_A17", "test": "incident response training content is reviewed following .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: SDP values:\n(1) at least every 12 months\n(2) significant, novel incidents, or significant changes to risks", "otherId": "171A_R3_A.03.06.04.b[03]", "defaultText": null }, { "id": 72183, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590699", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590699", "securityControlId": 31573, "ccis": [], "uuid": "b038fcbd-6457-58d1-9474-4178e5de3456", "testId": "IRO-05_A18", "test": "incident response training content is updated following .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: SDP values:\n(1) at least every 12 months\n(2) significant, novel incidents, or significant changes to risks", "otherId": "171A_R3_A.03.06.04.b[04]", "defaultText": null } ], "externalMappings": [ { "id": 582309, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5866", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01f9fcdf-4f34-5f84-97f5-0aaa7852e215", "parentControlId": 31573, "controlId": "5.29", "title": "5.29", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5866" }, { "id": 582311, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5866", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd6ce1fe-abb0-50b0-b0a6-d5effeddc2bf", "parentControlId": 31573, "controlId": "IR-2", "title": "IR-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5866" }, { "id": 582312, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5866", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4ed0a9b-3dff-54ae-b945-8cf739f480ca", "parentControlId": 31573, "controlId": "IR-02", "title": "IR-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5866" }, { "id": 582313, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59286c97-b8f2-5d52-97aa-5ba6379138a0", "parentControlId": 31573, "controlId": "IR-02(03)", "title": "IR-02(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586601" }, { "id": 582316, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ece31c63-4eab-5da2-a75f-a82a39e759b9", "parentControlId": 31573, "controlId": "IR-02", "title": "IR-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586601" }, { "id": 582317, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "585352f9-f201-5530-9183-937c2a3af12f", "parentControlId": 31573, "controlId": "IR-02", "title": "IR-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586601" }, { "id": 582318, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09707aea-03f3-572a-a3d6-dbf9db50bc1e", "parentControlId": 31573, "controlId": "IR-02(03)", "title": "IR-02(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586601" }, { "id": 582319, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f90ebd46-8d27-5fa5-ae2c-5065bb2c6687", "parentControlId": 31573, "controlId": "IR-02", "title": "IR-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586601" }, { "id": 582320, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e1f9ea5-1cf4-5c7e-9633-a175a6b955e8", "parentControlId": 31573, "controlId": "IR-02", "title": "IR-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586602" }, { "id": 582321, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c971a7ce-f14f-53bd-aecc-94c327690b32", "parentControlId": 31573, "controlId": "IR-02", "title": "IR-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586602" }, { "id": 582322, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f284524-6751-59da-a9c2-639b9c952425", "parentControlId": 31573, "controlId": "IR-2", "title": "IR-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586602" }, { "id": 582323, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c35f896-e01f-5336-898f-ab0552846595", "parentControlId": 31573, "controlId": "IR-2", "title": "IR-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586602" }, { "id": 582324, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf76619a-ae26-540a-b12f-33bb5447ce2e", "parentControlId": 31573, "controlId": "IR-2", "title": "IR-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586602" }, { "id": 582327, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3cf9bb5-8545-55ab-96da-1b7b96f20ded", "parentControlId": 31573, "controlId": "3.6.1", "title": "3.6.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586602" }, { "id": 582328, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94f2dd9c-586a-5795-93db-8d4afb96d520", "parentControlId": 31573, "controlId": "03.06.04.a", "title": "03.06.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586602" }, { "id": 582329, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d777579-389e-55c1-9306-29475be9e8e4", "parentControlId": 31573, "controlId": "03.06.04.a.03", "title": "03.06.04.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586602" }, { "id": 582364, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "daee82b6-d819-5eb1-b148-980f721c3a79", "parentControlId": 31573, "controlId": "CIP-008-6 3.1.3", "title": "CIP-008-6 3.1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586606" }, { "id": 582365, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc5d4d16-a5a7-54c2-9fd3-5646419afb0d", "parentControlId": 31573, "controlId": "CIP-008-6 3.2.2", "title": "CIP-008-6 3.2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586606" }, { "controlId": "C.8.2", "title": "C.8.2 — Incident Response Training", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "0a2a844c-c080-51ff-b959-bc969a22addf", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.2", "title": "NEI 08-09 App E.8.2 — Incident Response Training", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "b6638553-7e5d-569f-ba2d-9697ce311632", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(2)", "title": "10 CFR 73.54(d)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "b0867a35-eadc-5463-8a76-661a8d6767ea", "isPublic": true }, { "controlId": "C.8.5", "title": "C.8.5 — Incident Monitoring", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "6505a322-25a0-5577-86f9-e25d3eccb91a", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.5", "title": "NEI 08-09 App E.8.5 — Incident Monitoring", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "333b5be0-cfb0-5416-8740-227f7a0eeb0a", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3)", "title": "10 CFR 73.54(d)(3) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "979015e0-9d6d-5acd-820e-13a387e3cf57", "isPublic": true }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "3b8a74d9-735c-5915-aad8-fc7716fa8b52", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "b3116e5b-1e1b-5471-b9ea-542c79b04c9a", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "349f177e-c13a-58d5-ae2c-3d172e8fc5be", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "9a05a0e3-f046-52a1-ab2b-72201d29ef42", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "557083d8-4041-5ea0-8308-e78f4f21b3c4", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "79ef69c7-a665-5834-a48a-435c4110b11f", "isPublic": true } ], "id": 31573, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731164", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731164", "catalogueId": 1062, "uuid": "8715120d-cdca-5aeb-8d35-a8e4fbe2c635", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization train personnel in their incident response roles and responsibilities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Incident Response Training", "description": "

Control Description

Mechanisms exist to train personnel in their incident response roles and responsibilities.

Evidence Request List (ERL)

E-IRO-05\nE-IRO-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ Incident responders are proficient on their specific IRP role(s) and responsibilities through recurring training events (e.g., annual rock drill).

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to train personnel in their incident response roles and responsibilities.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.8.2, C.8.5", "controlId": "IRO-05", "family": "Incident Response", "enhancements": "", "sortId": "IRO-05", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ ITIL 4 (https://axelos.com) ∙ Incident and problem management

Large Business (250-999 staff)

∙ ITIL 4 (https://axelos.com) ∙ Incident and problem management

Enterprise (>1,000 staff)

∙ ITIL 4 (https://axelos.com) ∙ Incident and problem management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72184, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590699", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590699", "securityControlId": 31574, "ccis": [], "uuid": "1aec5cef-bee6-5d74-86f1-a5e977bf8228", "testId": "IRO-05.1_A01", "test": "simulated events are incorporated into incident response training to facilitate the required response by personnel in crisis situations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-02(01)", "defaultText": null } ], "externalMappings": [ { "id": 582381, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e5efed6-896c-533f-bf0e-1d34c93776f4", "parentControlId": 31574, "controlId": "IR-2(1)", "title": "IR-2(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586608" }, { "id": 582382, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08688307-23cd-5af3-addc-4826ebad066a", "parentControlId": 31574, "controlId": "IR-02(01)", "title": "IR-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586609" }, { "id": 582383, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53d7f634-6b31-5d69-b894-4eef8e333d03", "parentControlId": 31574, "controlId": "IR-02(01)", "title": "IR-02(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586609" }, { "id": 582384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16a55fde-fcae-55d4-978e-56bb689cc44c", "parentControlId": 31574, "controlId": "IR-02(01)", "title": "IR-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586609" }, { "id": 582385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63cd4c7f-5e9f-5b98-8840-045c00416464", "parentControlId": 31574, "controlId": "IR-02(01)", "title": "IR-02(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586609" } ], "id": 31574, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731164", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731164", "catalogueId": 1062, "uuid": "9be8f1bd-68a5-5c33-b4c6-dfd8eb3a1227", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization incorporate simulated events into incident response training to facilitate effective response by personnel in crisis situations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Simulated Incidents", "description": "

Control Description

Mechanisms exist to incorporate simulated events into incident response training to facilitate effective response by personnel in crisis situations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to incorporate simulated events into incident response training to facilitate effective response by personnel in crisis situations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-05.1", "family": "Incident Response", "enhancements": "", "sortId": "IRO-05.1", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72185, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5907", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5907", "securityControlId": 31575, "ccis": [], "uuid": "f23f0e32-5600-5fea-b267-155e8f198cce", "testId": "IRO-05.2_A01", "test": "automated mechanisms used in an incident response training environment are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-02(02)_ODP", "defaultText": null }, { "id": 72186, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5907", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5907", "securityControlId": 31575, "ccis": [], "uuid": "c1ee328a-5f53-5964-ae18-b64c080431d9", "testId": "IRO-05.2_A02", "test": "an incident response training environment is provided using automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IR-02(02)", "defaultText": null } ], "externalMappings": [ { "id": 582392, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58661", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c5ebcf6-c84f-5195-81bc-6b01e992aa62", "parentControlId": 31575, "controlId": "IR-2(2)", "title": "IR-2(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58661" }, { "id": 582393, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58661", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db9092dd-9ed5-56c9-a712-334f82747a2b", "parentControlId": 31575, "controlId": "IR-02(02)", "title": "IR-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58661" }, { "id": 582394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58661", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60276ba7-a554-5e61-a393-e83cb3a2e2ad", "parentControlId": 31575, "controlId": "IR-02(02)", "title": "IR-02(02)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58661" }, { "id": 582395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58661", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f67f036-0446-5a0c-85ec-e998fadb5da6", "parentControlId": 31575, "controlId": "IR-02(02)", "title": "IR-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58661" }, { "id": 582396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58661", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81c4c641-865b-5223-b131-27baf7fdcc12", "parentControlId": 31575, "controlId": "IR-02(02)", "title": "IR-02(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58661" } ], "id": 31575, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731165", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731165", "catalogueId": 1062, "uuid": "c528ea08-95f1-51bf-8b21-4335676a1e63", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to provide a more thorough and realistic incident response training environment?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Automated Incident Response Training Environments", "description": "

Control Description

Automated mechanisms exist to provide a more thorough and realistic incident response training environment.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Incident Response (IRO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IRO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Incident response-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically provide a more thorough and realistic incident response training environment.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-05.2", "family": "Incident Response", "enhancements": "", "sortId": "IRO-05.2", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72187, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5907", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5907", "securityControlId": 31576, "ccis": [], "uuid": "c3bef226-3cc3-5922-8237-1ed1cdf5a36c", "testId": "IRO-06_A01", "test": "the frequency at which to test the effectiveness of the incident response capability for the system is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_IR-03_ODP[01]\n171A_R3_A.03.06.03.ODP[01]", "defaultText": null }, { "id": 72188, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5907", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5907", "securityControlId": 31576, "ccis": [], "uuid": "b4e7b526-8eb1-5493-a290-05195cc09a34", "testId": "IRO-06_A02", "test": "tests used to test the effectiveness of the incident response capability for the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: functional", "otherId": "53A_R5_IR-03_ODP[02]", "defaultText": null }, { "id": 72189, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590701", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590701", "securityControlId": 31576, "ccis": [], "uuid": "35e0e173-48e0-5990-88fc-55199f6ecf6c", "testId": "IRO-06_A03", "test": "the incident response capability is tested.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.6.3", "defaultText": null }, { "id": 72190, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590701", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590701", "securityControlId": 31576, "ccis": [], "uuid": "818d0f1f-14e0-574c-8b20-bfa993a971b3", "testId": "IRO-06_A04", "test": "the effectiveness of the incident response capability is tested per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_IR-03", "defaultText": null }, { "id": 72191, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590701", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590701", "securityControlId": 31576, "ccis": [], "uuid": "a51b385c-7b7b-5614-b129-94c486caa593", "testId": "IRO-06_A05", "test": "a frequency at which to test intrusion-monitoring tools and mechanisms is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-04(09)_ODP", "defaultText": null }, { "id": 72192, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590701", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590701", "securityControlId": 31576, "ccis": [], "uuid": "6b9fc8b1-5993-5bad-a89c-e0420ab6ceea", "testId": "IRO-06_A06", "test": "intrusion-monitoring tools and mechanisms are tested frequently.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-04(09)", "defaultText": null }, { "id": 72193, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590702", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590702", "securityControlId": 31576, "ccis": [], "uuid": "f533de92-3f4d-5ed2-b708-472a8e2102f7", "testId": "IRO-06_A07", "test": "the effectiveness of the incident response capability is tested .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months", "otherId": "171A_R3_A.03.06.03", "defaultText": null } ], "externalMappings": [ { "id": 582410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18f8173b-9b7b-522d-8050-c7fa5ceafc86", "parentControlId": 31576, "controlId": "5.3", "title": "5.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586612" }, { "id": 582414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b037c66-96ab-508a-b725-e8cdd271b04a", "parentControlId": 31576, "controlId": "IR-3", "title": "IR-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586612" }, { "id": 582415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a37b9ec3-ab60-5768-9e7a-0c5ec22298dc", "parentControlId": 31576, "controlId": "SI-4(9)", "title": "SI-4(9)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586612" }, { "id": 582416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58662", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "757b37bb-1ab7-52e7-96f1-4ad98299a00d", "parentControlId": 31576, "controlId": "IR-03", "title": "IR-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58662" }, { "id": 582417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e69329be-45c9-5b43-98a5-6abb70fda5ca", "parentControlId": 31576, "controlId": "SI-04(09)", "title": "SI-04(09)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586621" }, { "id": 582419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2203a2b1-094c-50fc-b346-3f77ba9a8a4c", "parentControlId": 31576, "controlId": "IR-03", "title": "IR-03", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586621" }, { "id": 582420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "646bc91e-d93f-5d37-8d25-6246f6b59d84", "parentControlId": 31576, "controlId": "IR-03", "title": "IR-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586621" }, { "id": 582421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46aac84a-b76d-5b93-8ae0-473fe4cd1184", "parentControlId": 31576, "controlId": "SI-04(09)", "title": "SI-04(09)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586621" }, { "id": 582422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c3e0571-48d2-52b1-9cfa-790fd067571c", "parentControlId": 31576, "controlId": "IR-03", "title": "IR-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586621" }, { "id": 582423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0cd3111d-3d16-519a-a3c9-3e83b2bacbdb", "parentControlId": 31576, "controlId": "IR-03", "title": "IR-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586621" }, { "id": 582424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c486818-c314-5f45-b31d-5ca4a8c3bbd8", "parentControlId": 31576, "controlId": "IR-3", "title": "IR-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586621" }, { "id": 582427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb9983d1-db38-5f9d-a263-6b0c072730f7", "parentControlId": 31576, "controlId": "3.6.3", "title": "3.6.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586622" }, { "id": 582428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ecafcba-8abb-5d8d-9a82-dccee3439d87", "parentControlId": 31576, "controlId": "03.06.03", "title": "03.06.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586622" }, { "id": 582440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07f7772c-8817-5678-9e27-edecf7741681", "parentControlId": 31576, "controlId": "RESPONSE-3g", "title": "RESPONSE-3g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586623" }, { "id": 582450, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db600af3-8e7e-5f7b-9034-8143d7bd4796", "parentControlId": 31576, "controlId": "CIP-008-6 2.1", "title": "CIP-008-6 2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586624" }, { "id": 582451, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb814922-9e47-5111-a3b7-bafbc264355c", "parentControlId": 31576, "controlId": "CIP-008-6 3.1", "title": "CIP-008-6 3.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586625" }, { "id": 582461, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "437c7fc9-d495-52f0-80ad-3c5cd2b0cd1d", "parentControlId": 31576, "controlId": "D1.c", "title": "D1.c", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586626" }, { "controlId": "C.8.3", "title": "C.8.3 — Incident Response Testing and Drills", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a9c26248-994f-52c3-9ef5-b63dc985ee15", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.3", "title": "NEI 08-09 App E.8.3 — Incident Response Testing and Drills", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "36e9d7b4-a9ae-57f4-990c-db01e5985c61", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3)", "title": "10 CFR 73.54(d)(3) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "348698d3-7560-5e8f-bd8c-2bbe1953ae0c", "isPublic": true }, { "controlId": "C.8.6", "title": "C.8.6 — Incident Reporting", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "86a485ce-c731-5dfa-afcf-55f4b9e947c6", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.6 / RG 5.83 Rev 1", "title": "NEI 08-09 App E.8.6 / RG 5.83 Rev 1 — Incident Reporting", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "3f3719b9-5a1f-507c-9fc9-811376ebe099", "isPublic": true }, { "controlId": "10 CFR 73.77 (1/4/8-hr Reporting)", "title": "10 CFR 73.77 (1/4/8-hr Reporting) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "e4afb00c-355d-51fc-9118-d5d5611ae95c", "isPublic": true }, { "controlId": "CIP-008-6-R2", "title": "CIP-008-6-R2 — Cyber Security Incident Response Plan Implementation and Testing", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6cc62b22-15c4-5387-8713-45d1f737278a", "isPublic": true }, { "controlId": "CIP-008-6-2.1", "title": "CIP-008-6-2.1 — Test each Cyber Security Incident response plan(s) at least once every 15 calendar months", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ff4b647e-9cab-51da-937f-bea3db0649e0", "isPublic": true }, { "controlId": "CIP-008-6-2.2", "title": "CIP-008-6-2.2 — Use the Cyber Security Incident response plan(s) under Requirement R1 when responding to a Reportable Cyber Security...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e48fca19-b98c-54d2-9aad-547c48d055c8", "isPublic": true }, { "controlId": "CIP-008-6-2.3", "title": "CIP-008-6-2.3 — Retain records related to Reportable Cyber Security Incidents and Cyber Security Incidents that attempted to compromi...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e708477f-1a8b-5043-9fdd-b800e5c9c7cc", "isPublic": true }, { "controlId": "CIP-008-6-R4", "title": "CIP-008-6-R4 — Incident Response Notification and Reporting", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a295fcfd-5639-580e-90a7-6e92fec9a149", "isPublic": true }, { "controlId": "CIP-008-6-4.1", "title": "CIP-008-6-4.1 — Initial notifications and updates shall include the following attributes, at a minimum, to the extent known", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7bb28269-b10e-5032-a76b-16108ab1b892", "isPublic": true }, { "controlId": "CIP-008-6-4.1.1", "title": "CIP-008-6-4.1.1 — The functional impact", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8fe717cc-da0f-5533-8299-82cb384b8295", "isPublic": true }, { "controlId": "CIP-008-6-4.1.2", "title": "CIP-008-6-4.1.2 — The attack vector used", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ea677507-0429-52fc-9732-41c38564ef2d", "isPublic": true }, { "controlId": "CIP-008-6-4.1.3", "title": "CIP-008-6-4.1.3 — The level of intrusion that was achieved or attempted.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "aa063f03-01f1-5ac3-bd3c-c816b87421dd", "isPublic": true }, { "controlId": "CIP-008-6-4.2", "title": "CIP-008-6-4.2 — After the Responsible Entity’s determination made pursuant to documented process(es) in Requirement R1, Part 1.2, pro...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2ee2e172-c3c9-57ae-baa6-a9ab31b7d83a", "isPublic": true }, { "controlId": "CIP-008-6-4.3", "title": "CIP-008-6-4.3 — Provide updates, if any, within 7 calendar days of determination of new or changed attribute information required in...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "40e41a6d-d91f-5bc6-aca7-823b7c3d1fd9", "isPublic": true }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "bca0a648-fb10-537a-9e5b-92898bbbe2a4", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "ae19094a-78e4-5c81-adcd-152eed269173", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "3c9c16ca-23e4-5969-b519-1f5f9f1efae4", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "a959adca-a203-545f-bf19-6eb20a9455c1", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "b32bb5c1-4e09-51b3-b54d-8faeded8b48b", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "d8a42720-c623-57a7-9fb1-304bdc0d53c3", "isPublic": true } ], "id": 31576, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731165", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731165", "catalogueId": 1062, "uuid": "94561943-b0a3-527c-acc4-3048acf6c3b8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization formally test incident response capabilities through realistic exercises to determine the operational effectiveness of those capabilities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Incident Response Testing", "description": "

Control Description

Mechanisms exist to formally test incident response capabilities through realistic exercises to determine the operational effectiveness of those capabilities.

Evidence Request List (ERL)

E-IRO-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ Incident responders are proficient on their specific IRP role(s) and responsibilities through recurring training events (e.g., annual rock drill).\n▪ On at least an annual basis, IT and/or cybersecurity personnel conduct tabletop exercises to validate disaster recovery and contingency plans, in conjunction with stakeholders and any required vendors.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to formally test incident response capabilities through realistic exercises to determine the operational effectiveness of those capabilities.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.8.3, C.8.6
NERC-CIP (2026) Requirements: CIP-008-6-R2, CIP-008-6-R4", "controlId": "IRO-06", "family": "Incident Response", "enhancements": "", "sortId": "IRO-06", "references": "

Micro-Small Business (<10 staff)

∙ \"Table Top\" incident response exercises (rock drills)

Small Business (10-49 staff)

∙ \"Table Top\" incident response exercises (rock drills)

Medium Business (50-249 staff)

∙ \"Table Top\" incident response exercises (rock drills)\n∙ \"Red team vs blue team\" exercises\n∙ EICAR test file antimalware detection and response exercises

Large Business (250-999 staff)

∙ \"Table Top\" incident response exercises (rock drills)\n∙ \"Red team vs blue team\" exercises\n∙ EICAR test file antimalware detection and response exercises

Enterprise (>1,000 staff)

∙ \"Table Top\" incident response exercises (rock drills)\n∙ \"Red team vs blue team\" exercises\n∙ EICAR test file antimalware detection and response exercises", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72194, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590702", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590702", "securityControlId": 31577, "ccis": [], "uuid": "0d9222c9-608d-5c92-81b4-a983fe4691db", "testId": "IRO-06.1_A01", "test": "incident response testing is coordinated with organizational elements responsible for related plans.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-03(02)", "defaultText": null } ], "externalMappings": [ { "id": 582477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cca16d87-e653-5614-8803-e10ac93130b2", "parentControlId": 31577, "controlId": "5.29", "title": "5.29", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586628" }, { "id": 582479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e707cb80-8de5-5dd7-be15-036adb30e56e", "parentControlId": 31577, "controlId": "IR-3(2)", "title": "IR-3(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586628" }, { "id": 582480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f592098c-e2b1-5d90-9fd8-99c6b4b8c436", "parentControlId": 31577, "controlId": "IR-03(02)", "title": "IR-03(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586628" }, { "id": 582481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e5a92d9-4229-5823-923f-4d9fe8e27562", "parentControlId": 31577, "controlId": "IR-03(02)", "title": "IR-03(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586628" }, { "id": 582482, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04279c95-e2a6-586f-bee9-a7fa81193809", "parentControlId": 31577, "controlId": "IR-03(02)", "title": "IR-03(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586629" }, { "id": 582483, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0ae7838-34be-554c-b073-28d1b96675c3", "parentControlId": 31577, "controlId": "IR-03(02)", "title": "IR-03(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586629" }, { "id": 582484, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68ef4313-3074-5a37-b519-945b8430fb22", "parentControlId": 31577, "controlId": "IR-03(02)", "title": "IR-03(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586629" }, { "id": 582485, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a46aff22-3a6e-5956-9112-42936f61c0d8", "parentControlId": 31577, "controlId": "RS.CO", "title": "RS.CO", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586629" }, { "id": 582487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1c6fe58-de87-5bd9-830a-1776ffaf1afa", "parentControlId": 31577, "controlId": "RESPONSE-3j", "title": "RESPONSE-3j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586629" }, { "controlId": "C.8.6", "title": "C.8.6 — Incident Reporting", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "73498f54-c7e7-5d61-8583-d49a49c8cb87", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.6 / RG 5.83 Rev 1", "title": "NEI 08-09 App E.8.6 / RG 5.83 Rev 1 — Incident Reporting", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "48fd2058-2aa9-585c-a5a8-5eb0bf5877c6", "isPublic": true }, { "controlId": "10 CFR 73.77 (1/4/8-hr Reporting)", "title": "10 CFR 73.77 (1/4/8-hr Reporting) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "9e7d7116-3273-5e98-8764-b74b819a9a63", "isPublic": true }, { "controlId": "CIP-008-6-R4", "title": "CIP-008-6-R4 — Incident Response Notification and Reporting", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e0f2f2bf-aedd-5414-85ab-206527063870", "isPublic": true }, { "controlId": "CIP-008-6-4.1", "title": "CIP-008-6-4.1 — Initial notifications and updates shall include the following attributes, at a minimum, to the extent known", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "679c0e5b-c135-52ed-80d1-29782d3a7d4c", "isPublic": true }, { "controlId": "CIP-008-6-4.1.1", "title": "CIP-008-6-4.1.1 — The functional impact", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b725639c-b863-5130-a8f7-cf58950f7289", "isPublic": true }, { "controlId": "CIP-008-6-4.1.2", "title": "CIP-008-6-4.1.2 — The attack vector used", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0cd07eec-b113-59b8-9c2b-1921a5b861e1", "isPublic": true }, { "controlId": "CIP-008-6-4.1.3", "title": "CIP-008-6-4.1.3 — The level of intrusion that was achieved or attempted.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e1f24d40-ea9a-563e-bd93-d3ff8be8475d", "isPublic": true }, { "controlId": "CIP-008-6-4.2", "title": "CIP-008-6-4.2 — After the Responsible Entity’s determination made pursuant to documented process(es) in Requirement R1, Part 1.2, pro...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ef2fc077-e240-583a-adba-41070f75877a", "isPublic": true }, { "controlId": "CIP-008-6-4.3", "title": "CIP-008-6-4.3 — Provide updates, if any, within 7 calendar days of determination of new or changed attribute information required in...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "66aecc0a-abea-5a3a-ad52-0f1663dc2be2", "isPublic": true }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "772b5a2a-4baa-503b-9631-90342dbaaba9", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "a9b9064e-676a-55e2-8270-5031e038abeb", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "70512802-73dc-5740-85b1-a21aeb6d95ca", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "fff60e71-56e4-58ff-ba9d-4192c55c536d", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "439902b4-e156-5511-8d27-2af1077d2840", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "b956a58a-1344-5b67-b1c1-7ff483f9dd2d", "isPublic": true } ], "id": 31577, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731165", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731165", "catalogueId": 1062, "uuid": "781786d5-3643-58b9-a699-6d84b8deba95", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization coordinate incident response testing with organizational elements responsible for related plans?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Coordination with Related Plans", "description": "

Control Description

Mechanisms exist to coordinate incident response testing with organizational elements responsible for related plans.

Evidence Request List (ERL)

E-IRO-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ On at least an annual basis, IT and/or cybersecurity personnel conduct tabletop exercises to validate disaster recovery and contingency plans, in conjunction with stakeholders and any required vendors.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to coordinate incident response testing with organizational elements responsible for related plans.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.8.6
NERC-CIP (2026) Requirements: CIP-008-6-R4", "controlId": "IRO-06.1", "family": "Incident Response", "enhancements": "", "sortId": "IRO-06.1", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72195, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590702", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590702", "securityControlId": 31578, "ccis": [], "uuid": "667fcf12-38cc-5b01-9c9a-34c996ed9a50", "testId": "IRO-07_A01", "test": "an integrated incident response team is established and maintained.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(11)[01]\n172A_3.6.2e[a]\n172A_3.6.2e[c]", "defaultText": null }, { "id": 72196, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590703", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590703", "securityControlId": 31578, "ccis": [], "uuid": "a83d0cc3-1017-5a44-b066-3319c83bde8f", "testId": "IRO-07_A02", "test": "the time period within which an integrated incident response team can be deployed is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(11)_ODP\n172A_3.6.2e_ODP[1]", "defaultText": null }, { "id": 72197, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590703", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590703", "securityControlId": 31578, "ccis": [], "uuid": "2e5531da-a8eb-5ebd-b9f2-c23de57b8c47", "testId": "IRO-07_A03", "test": "the cyber incident response team can be deployed by the organization within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(11)[02]\n172A_3.6.2e[b]", "defaultText": null }, { "id": 72198, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590703", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590703", "securityControlId": 31578, "ccis": [], "uuid": "45d24061-6e36-5a3f-a41c-f599e98ce7da", "testId": "IRO-07_A04", "test": "suspected incidents are reported to the organizational incident response capability within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 72199, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590703", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590703", "securityControlId": 31578, "ccis": [], "uuid": "7ef658fb-1c7c-5851-af12-8ef7de4a62c9", "testId": "IRO-07_A05", "test": "an incident response support resource that offers advice and assistance to system users on handling and reporting incidents is provided.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.06.02.d", "defaultText": null }, { "id": 72200, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590703", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590703", "securityControlId": 31578, "ccis": [], "uuid": "18dd7bb0-588b-5039-8c50-81df57409c60", "testId": "IRO-07_A06", "test": "a time period for deploying a cyber incident response team is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.6.2e_ODP[1]", "defaultText": null }, { "id": 72201, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590703", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590703", "securityControlId": 31578, "ccis": [], "uuid": "5e0ac5c2-90c9-5038-9360-6cac953237cd", "testId": "IRO-07_A07", "test": "the cyber incident response team can be deployed by the organization within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.6.2e[b]", "defaultText": null }, { "id": 72202, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590704", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590704", "securityControlId": 31578, "ccis": [], "uuid": "6f7a4fb6-56b2-535d-bf61-6fc69b2f52a4", "testId": "IRO-07_A08", "test": "the cyber incident response team is maintained.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.6.2e[c]", "defaultText": null }, { "id": 72203, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590704", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590704", "securityControlId": 31578, "ccis": [], "uuid": "c0167c7a-ef58-5585-8f49-601e8c32be62", "testId": "IRO-07_A09", "test": "suspected incidents are reported to the organizational incident response capability within .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: near real time or as soon as practicable upon discovery", "otherId": "171A_R3_A.03.06.02.b", "defaultText": null } ], "externalMappings": [ { "id": 582514, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586632", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a751655-9e58-568a-be3c-6aae6e1defb9", "parentControlId": 31578, "controlId": "5.25", "title": "5.25", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586632" }, { "id": 582515, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586632", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "442e2890-a110-5f2d-9939-4377fc3b897a", "parentControlId": 31578, "controlId": "5.26", "title": "5.26", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586632" }, { "id": 582519, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586633", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8c47b15-9d67-5914-8abd-7e8545acba4e", "parentControlId": 31578, "controlId": "IR-10", "title": "IR-10", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586633" }, { "id": 582520, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586633", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08bb2210-3702-5b9a-b44b-64316baf75a8", "parentControlId": 31578, "controlId": "IR-04(11)", "title": "IR-04(11)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586633" }, { "id": 582521, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586633", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f93ea1b-3dd5-5e47-82e9-b6a598aebba1", "parentControlId": 31578, "controlId": "IR-04(11)", "title": "IR-04(11)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586633" }, { "id": 582522, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586633", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3730946-d20e-5e39-a7d1-5a298bd9df72", "parentControlId": 31578, "controlId": "IR-04(11)", "title": "IR-04(11)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586633" }, { "id": 582523, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586633", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8050c63d-d86e-59f5-92fb-a3020866a181", "parentControlId": 31578, "controlId": "IR-04(11)", "title": "IR-04(11)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586633" }, { "id": 582525, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7beed1d6-f7d6-5f93-826b-a50dd6f249d5", "parentControlId": 31578, "controlId": "IR-4(11)", "title": "IR-4(11)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586634" }, { "id": 582530, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d6ab444-b997-5399-acb0-6bdc6ef07b6c", "parentControlId": 31578, "controlId": "DE.AE-06", "title": "DE.AE-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586634" }, { "id": 582531, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e4b767b-36c7-58c7-b49c-106e0856a1e6", "parentControlId": 31578, "controlId": "RS", "title": "RS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586634" }, { "id": 582532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4398d45-0b29-5469-a94a-079ebe2de221", "parentControlId": 31578, "controlId": "RS.MA", "title": "RS.MA", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586634" }, { "id": 582533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a91bf3d-04ca-5f1a-b04c-4c2b1d4a74d8", "parentControlId": 31578, "controlId": "RS.MA-01", "title": "RS.MA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586634" }, { "id": 582534, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586635", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7632a4f-5035-5265-87d5-799a86ce2596", "parentControlId": 31578, "controlId": "RS.MA-04", "title": "RS.MA-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586635" }, { "id": 582542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03eeca4e-c61e-5a02-9b4a-3d0fa38c4ca2", "parentControlId": 31578, "controlId": "RESPONSE-3a", "title": "RESPONSE-3a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586636" }, { "id": 582546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ada37bf-b181-5f7e-8ea7-f5b96dc8612c", "parentControlId": 31578, "controlId": "CIP-008-6 1.3", "title": "CIP-008-6 1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586636" }, { "controlId": "C.8.7", "title": "C.8.7 — Incident Response Assistance", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "e10aeaf5-bcd3-51b8-b300-8027c7baa8e5", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.7", "title": "NEI 08-09 App E.8.7 — Incident Response Assistance", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "169e49b6-95ca-53d0-bc19-ef18c61619c9", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3)", "title": "10 CFR 73.54(d)(3) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.7", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "8f698708-6076-5279-84ae-962a770556b2", "isPublic": true }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "72454449-e3dc-5328-9baf-f2bc9469960e", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "415317c5-7922-5ac6-ac96-4202a0da68ec", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "569c2b32-b67c-56fb-9b9b-fa588ed6f1f5", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "44c249ad-ca9a-5e4f-8dd1-bc649ac62b85", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "6687d4b9-c6e2-576c-ad5c-4b7ff5159f9d", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "09793e36-a371-5437-bfc1-fd4befe801bf", "isPublic": true } ], "id": 31578, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731166", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731166", "catalogueId": 1062, "uuid": "70f99af4-d578-5ada-b6c7-149dac3e8b3a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish an integrated team of cybersecurity, IT and business function representatives that are capable of addressing cybersecurity and data protection incident response operations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Integrated Security Incident Response Team (ISIRT)", "description": "

Control Description

Mechanisms exist to establish an integrated team of cybersecurity, IT and business function representatives that are capable of addressing cybersecurity and data protection incident response operations.

Evidence Request List (ERL)

E-IRO-01\nE-IRO-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ IT and/or cybersecurity personnel facilitate prompt response to suspected or confirmed security incidents, including timely notification to affected stakeholders.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to establish an integrated team of cybersecurity, IT and business function representatives that are capable of addressing cybersecurity and data protection incident response operations.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.8.7", "controlId": "IRO-07", "family": "Incident Response", "enhancements": "", "sortId": "IRO-07", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Integrated Security Incident Response Team (ISIRT)

Large Business (250-999 staff)

∙ Integrated Security Incident Response Team (ISIRT)

Enterprise (>1,000 staff)

∙ Integrated Security Incident Response Team (ISIRT)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72204, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590704", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590704", "securityControlId": 31579, "ccis": [], "uuid": "4f2df817-bf58-5fa9-b64d-89c7e6dab389", "testId": "IRO-08_A01", "test": "reviewer or releaser credentials are maintained within the established chain of custody for information reviewed or released.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AU-10(03)", "defaultText": null } ], "externalMappings": [ { "id": 582583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586643", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be54bed1-c789-5181-a958-15f7a9d25cb4", "parentControlId": 31579, "controlId": "5.26", "title": "5.26", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586643" }, { "id": 582584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9df4142b-e32d-59bf-996c-870240e38479", "parentControlId": 31579, "controlId": "5.28", "title": "5.28", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586644" }, { "id": 582589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d00118f-7205-5f33-8ef2-750343fc9433", "parentControlId": 31579, "controlId": "AU-10(3)", "title": "AU-10(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586644" }, { "id": 582590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99cd73e4-658b-569f-b8d5-bb00a0fda440", "parentControlId": 31579, "controlId": "AU-10(03)", "title": "AU-10(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586644" }, { "id": 582591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c768a66-70c0-5a96-ba9c-eebbf751920c", "parentControlId": 31579, "controlId": "IR-04(12)", "title": "IR-04(12)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586644" }, { "id": 582593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586645", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a347487-1827-5e3d-96fe-e6978848d347", "parentControlId": 31579, "controlId": "AU-10(03)", "title": "AU-10(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586645" }, { "id": 582594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586645", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dccf1ef3-1933-535d-a4a2-524ce35b4753", "parentControlId": 31579, "controlId": "IR-04(12)", "title": "IR-04(12)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586645" }, { "id": 582596, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586645", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1df69b58-d498-502f-be13-8b5b56c5e519", "parentControlId": 31579, "controlId": "AU-10(3)", "title": "AU-10(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586645" }, { "id": 582599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586645", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6443b01c-4fc5-5fc3-b36d-05b8ec8a9a9a", "parentControlId": 31579, "controlId": "RS.AN", "title": "RS.AN", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586645" }, { "id": 582600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586645", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b692422e-c7f2-5fdf-8c04-1f9345b13613", "parentControlId": 31579, "controlId": "RS.AN-06", "title": "RS.AN-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586645" }, { "id": 582601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586646", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b853bcab-12ca-5800-b265-4ed1089ef701", "parentControlId": 31579, "controlId": "RS.AN-07", "title": "RS.AN-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586646" }, { "id": 582608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586646", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d4c946f-e3eb-5134-8082-47ab4ae0089f", "parentControlId": 31579, "controlId": "CIP-008-6 2.3", "title": "CIP-008-6 2.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586646" }, { "id": 582609, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586646", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "260c46a6-8a63-5b48-acc5-2bfdb98eca96", "parentControlId": 31579, "controlId": "CIP-009-6 1.5", "title": "CIP-009-6 1.5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586646" }, { "controlId": "C.8.8", "title": "C.8.8 — Cyber Incident Response Plan", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "7fde57b7-9207-55c6-8755-2003825a33a3", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.8", "title": "NEI 08-09 App E.8.8 — Cyber Incident Response Plan", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "3beb7c5f-41f8-5c02-a10b-c7c8e1f2b52a", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3), 73.77", "title": "10 CFR 73.54(d)(3), 73.77 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "41bcaf25-ca79-5783-a081-7f20584959dc", "isPublic": true }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "326d2e8f-abc0-5a53-b098-48402591d004", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "8eee33e7-ad4f-5101-a42c-172822c4f6b0", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "cd409d3b-c549-5d7a-a2d1-a8bfe5a7aceb", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "efc043fe-c43d-509a-bf67-13cdefda94d7", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "78361a70-2749-50a5-8ad2-0a1eb03fd89b", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "7c41235c-7362-5483-a5c6-de0545628415", "isPublic": true } ], "id": 31579, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731166", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731166", "catalogueId": 1062, "uuid": "ebdaf2c1-b96e-5393-a4a8-b864c5b0c6a0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization perform digital forensics and maintain the integrity of the chain of custody, in accordance with applicable laws, regulations and industry-recognized secure practices?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Chain of Custody & Forensics", "description": "

Control Description

Mechanisms exist to perform digital forensics and maintain the integrity of the chain of custody, in accordance with applicable laws, regulations and industry-recognized secure practices.

Evidence Request List (ERL)

E-IRO-01\nE-IRO-10

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to perform digital forensics and maintain the integrity of the chain of custody, in accordance with applicable laws, regulations and industry-recognized secure practices.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.8.8", "controlId": "IRO-08", "family": "Incident Response", "enhancements": "", "sortId": "IRO-08", "references": "

Micro-Small Business (<10 staff)

∙ Third-party advisors (e.g., virtual CISO, Managed Security Services Provider (MSSP), etc.)

Small Business (10-49 staff)

∙ Third-party advisors (e.g., virtual CISO, Managed Security Services Provider (MSSP), etc.)

Medium Business (50-249 staff)

∙ Chain of custody procedures\n∙ OpenText Encase (https://opentext.com)\n∙ AccessData Forensic Toolkit (FTK) (https://pluralsight.com)\n∙ Extero (https://exterro.com)

Large Business (250-999 staff)

∙ Chain of custody procedures\n∙ OpenText Encase (https://opentext.com)\n∙ AccessData Forensic Toolkit (FTK) (https://pluralsight.com)\n∙ Extero (https://exterro.com)

Enterprise (>1,000 staff)

∙ Chain of custody procedures\n∙ OpenText Encase (https://opentext.com)\n∙ AccessData Forensic Toolkit (FTK) (https://pluralsight.com)\n∙ Extero (https://exterro.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72207, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590705", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590705", "securityControlId": 31581, "ccis": [], "uuid": "7d447c59-26da-5e95-a4c1-05804f82349d", "testId": "IRO-09_A01", "test": "suspected incidents are reported to the organizational incident response capability within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72208, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590705", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590705", "securityControlId": 31581, "ccis": [], "uuid": "4bd1d1eb-58d0-5ff8-ab07-876ab647af47", "testId": "IRO-09_A02", "test": "system security incidents are tracked / reported to internal stakeholders.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created\n53A_R5_IR-05[01]", "defaultText": null }, { "id": 72209, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590705", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590705", "securityControlId": 31581, "ccis": [], "uuid": "d2d08142-f5a4-5f4b-b85f-8f2da5d5bbea", "testId": "IRO-09_A03", "test": "system security incidents are documented.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_IR-05[02]\n171A_R3_A.03.06.02.a[02]", "defaultText": null }, { "id": 72210, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590705", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590705", "securityControlId": 31581, "ccis": [], "uuid": "4ff69869-636f-5924-809d-b545ba6b4014", "testId": "IRO-09_A04", "test": "system security incidents are tracked.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.06.02.a[01]", "defaultText": null } ], "externalMappings": [ { "id": 582662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586652", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2871a75-f533-540a-9c01-d507ed6e2a4d", "parentControlId": 31581, "controlId": "5.25", "title": "5.25", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586652" }, { "id": 582665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a219e317-1a8c-5c98-b413-cd89e39e0631", "parentControlId": 31581, "controlId": "IR-5", "title": "IR-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586653" }, { "id": 582666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b40ac2d-19be-58dd-8974-622ea0aef5f3", "parentControlId": 31581, "controlId": "IR-05", "title": "IR-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586653" }, { "id": 582668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fadb0261-95c4-545c-8fb8-4dce042215ac", "parentControlId": 31581, "controlId": "IR-05", "title": "IR-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586653" }, { "id": 582670, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23681ef1-c9ed-5cc9-b32d-823a3f851c9a", "parentControlId": 31581, "controlId": "IR-05", "title": "IR-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586653" }, { "id": 582671, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba7bb8eb-85fa-547c-8813-ce8bf7c228d7", "parentControlId": 31581, "controlId": "IR-05", "title": "IR-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586654" }, { "id": 582672, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586654", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a7b5acd-1e25-5486-8809-d5305052cfe2", "parentControlId": 31581, "controlId": "IR-05", "title": "IR-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586654" }, { "id": 582673, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586654", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8543de8-73d0-5c87-b05c-c740f9275e17", "parentControlId": 31581, "controlId": "IR-05", "title": "IR-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586654" }, { "id": 582675, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586654", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a98dc0a-e589-5798-8988-5f2ce7012d58", "parentControlId": 31581, "controlId": "IR-5", "title": "IR-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586654" }, { "id": 582676, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586654", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "867c65d1-8cce-510d-8681-6b91ea76c0b0", "parentControlId": 31581, "controlId": "IR-5", "title": "IR-5", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586654" }, { "id": 582679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586654", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c62dc7b2-0df9-55be-a9c2-57ee3720c82e", "parentControlId": 31581, "controlId": "03.06.02.a", "title": "03.06.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586654" }, { "id": 582680, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586654", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04eb4ff7-b2b8-5a93-a75d-632baf602e21", "parentControlId": 31581, "controlId": "03.06.02.b", "title": "03.06.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586654" }, { "id": 582683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586655", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a83c0af-2b19-55a9-b877-7788d784e02f", "parentControlId": 31581, "controlId": "DE.AE-06", "title": "DE.AE-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586655" }, { "id": 582684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586655", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2397fcae-c36a-52f4-8573-7ba8dbf63d9c", "parentControlId": 31581, "controlId": "RS", "title": "RS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586655" }, { "id": 582685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586655", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "470ed83d-e972-5e97-b5d0-74447f01ec59", "parentControlId": 31581, "controlId": "RS.AN-06", "title": "RS.AN-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586655" }, { "id": 582686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586655", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "785b56fe-e068-5c62-86a4-b3f9a308fa37", "parentControlId": 31581, "controlId": "RS.CO", "title": "RS.CO", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586655" }, { "id": 582687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586655", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "876f504b-f232-51f8-a40e-a06777db323c", "parentControlId": 31581, "controlId": "RC.RP-06", "title": "RC.RP-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586655" }, { "id": 582692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fd2c8ba-3a75-5499-a475-90116b104daf", "parentControlId": 31581, "controlId": "RESPONSE-1c", "title": "RESPONSE-1c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586656" }, { "id": 582693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3622d12b-3846-5c96-a919-8846f0e1e489", "parentControlId": 31581, "controlId": "RESPONSE-2f", "title": "RESPONSE-2f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586656" }, { "id": 582704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586657", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "791614e7-6c24-54d4-9272-c6b6b35c8523", "parentControlId": 31581, "controlId": "CIP-008-6 2.3", "title": "CIP-008-6 2.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586657" }, { "controlId": "C.8.5", "title": "C.8.5 — Incident Monitoring", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "47288c8b-326f-5fe2-b466-f875bf886fea", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.5", "title": "NEI 08-09 App E.8.5 — Incident Monitoring", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "5c9d3ed7-28cb-50c5-b327-add41c7c1126", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3)", "title": "10 CFR 73.54(d)(3) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "2141fe53-8412-5703-b367-6715e32c3ae5", "isPublic": true }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "efde13c0-8e8d-585f-9ab2-54fdeb5bd80d", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "19ed22c0-342e-5f52-a7b3-b681113e343f", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "c3525a96-72a1-5963-b18e-8e0e1db64716", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "99ddee56-2c52-5a20-96d4-ff3b028299e8", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "0362b56d-13a7-5a2b-93bb-e2056b35b273", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "c9b22c93-5777-5c4c-9fc6-eb8d59a1c480", "isPublic": true } ], "id": 31581, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731167", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731167", "catalogueId": 1062, "uuid": "ddd18fb2-4cbb-5fc6-a612-f00e2cf974f3", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization document, monitor and report the status of cybersecurity and data protection incidents to internal stakeholders all the way through the resolution of the incident?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Situational Awareness For Incidents", "description": "

Control Description

Mechanisms exist to document, monitor and report the status of cybersecurity and data protection incidents to internal stakeholders all the way through the resolution of the incident.

Evidence Request List (ERL)

E-IRO-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ IT and/or cybersecurity personnel facilitate prompt response to suspected or confirmed security incidents, including timely notification to affected stakeholders.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to document, monitor and report the status of cybersecurity and data protection incidents to internal stakeholders all the way through the resolution of the incident.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.8.5", "controlId": "IRO-09", "family": "Incident Response", "enhancements": "", "sortId": "IRO-09", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72211, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590705", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590705", "securityControlId": 31582, "ccis": [], "uuid": "4e5f687a-1e4e-5aa5-8ef9-a55de0c4e55a", "testId": "IRO-09.1_A01", "test": "automated mechanisms used to track incidents are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-05(01)_ODP[01]", "defaultText": null }, { "id": 72212, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590706", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590706", "securityControlId": 31582, "ccis": [], "uuid": "2b9f8a3a-099d-53a4-9810-b8f7737710ca", "testId": "IRO-09.1_A02", "test": "automated mechanisms used to collect incident information are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-05(01)_ODP[02]", "defaultText": null }, { "id": 72213, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590706", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590706", "securityControlId": 31582, "ccis": [], "uuid": "8729c5f6-ee76-5a14-8df8-aa60992e5b46", "testId": "IRO-09.1_A03", "test": "automated mechanisms used to analyze incident information are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-05(01)_ODP[03]", "defaultText": null }, { "id": 72214, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590706", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590706", "securityControlId": 31582, "ccis": [], "uuid": "9e4ce661-151b-55cd-9814-9c874883cde7", "testId": "IRO-09.1_A04", "test": "incidents are tracked using automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IR-05(01)[01]", "defaultText": null }, { "id": 72215, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590706", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590706", "securityControlId": 31582, "ccis": [], "uuid": "2e03991b-c247-59a7-ada0-7a2005a9d62f", "testId": "IRO-09.1_A05", "test": "incident information is collected using automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IR-05(01)[02]", "defaultText": null }, { "id": 72216, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590706", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590706", "securityControlId": 31582, "ccis": [], "uuid": "7e6bf253-5781-532a-b8d0-845eabceb26f", "testId": "IRO-09.1_A06", "test": "incident information is analyzed using automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IR-05(01)[03]", "defaultText": null } ], "externalMappings": [ { "id": 582738, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586662", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00bc36a7-68b9-5591-bac2-1cc192ae6c82", "parentControlId": 31582, "controlId": "IR-5(1)", "title": "IR-5(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586662" }, { "id": 582739, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586662", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "326a72c6-4c3c-53be-9209-019836c9fd5a", "parentControlId": 31582, "controlId": "IR-05(01)", "title": "IR-05(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586662" }, { "id": 582740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586662", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0b0a02f-c73f-573b-8a93-1e2c5edb070d", "parentControlId": 31582, "controlId": "IR-05(01)", "title": "IR-05(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586662" }, { "id": 582741, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58667", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2d4ad0c-3cff-5bf7-8731-997a9f24a8e6", "parentControlId": 31582, "controlId": "IR-05(01)", "title": "IR-05(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58667" }, { "id": 582742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58667", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "317756a8-0408-51b1-8743-8c844908ae9b", "parentControlId": 31582, "controlId": "IR-05(01)", "title": "IR-05(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58667" } ], "id": 31582, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731167", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731167", "catalogueId": 1062, "uuid": "bb2b3818-39fd-59a4-8e7f-50b54591521b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to assist in the tracking, collection and analysis of information from actual and potential cybersecurity and data protection incidents?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 1.0, "title": "Automated Tracking, Data Collection & Analysis", "description": "

Control Description

Automated mechanisms exist to assist in the tracking, collection and analysis of information from actual and potential cybersecurity and data protection incidents.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically assist in the tracking, collection and analysis of information from actual and potential cybersecurity and data protection incidents.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "IRO-09.1", "family": "Incident Response", "enhancements": "", "sortId": "IRO-09.1", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72218, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590707", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590707", "securityControlId": 31584, "ccis": [], "uuid": "8cee44ed-dd81-5729-bd48-14997e58695f", "testId": "IRO-09.3_A01", "test": "a repository to document cybersecurity events and incidents is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72219, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590707", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590707", "securityControlId": 31584, "ccis": [], "uuid": "5b457100-9d7a-5901-8c12-e35a3c8a4a5f", "testId": "IRO-09.3_A02", "test": "details of the incident (e.g., category, severity, affected parties, etc.) are documented in the repository.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72220, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590707", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590707", "securityControlId": 31584, "ccis": [], "uuid": "9f5f0795-4e12-5543-b5ca-f1a72f93791f", "testId": "IRO-09.3_A03", "test": "remediation actions taken through incident closure are documented in the repository.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72221, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590707", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590707", "securityControlId": 31584, "ccis": [], "uuid": "c819a9b2-c3f9-50d0-bee6-2644e354fdfc", "testId": "IRO-09.3_A04", "test": "a summary from the Root Cause Analysis (RCA) are documented in the repository, if applicable.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 582747, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586671", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d582184-5e9e-5146-9ed4-0ecec9ad17b8", "parentControlId": 31584, "controlId": "RESPONSE-2f", "title": "RESPONSE-2f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586671" } ], "id": 31584, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731168", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731168", "catalogueId": 1062, "uuid": "883d5665-8f20-55d6-b455-645330841f73", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain a repository of cybersecurity events and incidents that documents:\n(1) Details of the incident (e.g., category, severity, affected parties, etc.);\n(2) Remediation actions taken through incident closure; and\n(3) A summary from the Root Cause Analysis (RCA), if applicable?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 7.0, "title": "Incident Tracking Repository", "description": "

Control Description

Mechanisms exist to maintain a repository of cybersecurity events and incidents that documents:\n(1) Details of the incident (e.g., category, severity, affected parties, etc.);\n(2) Remediation actions taken through incident closure; and\n(3) A summary from the Root Cause Analysis (RCA), if applicable.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain a repository of cybersecurity events and incidents that documents:\n(1) Details of the incident (e.g., category, severity, affected parties, etc.);\n(2) Remediation actions taken through incident closure; and\n(3) A summary from the Root Cause Analysis (RCA), if applicable.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-09.3", "family": "Incident Response", "enhancements": "", "sortId": "IRO-09.3", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72222, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590708", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590708", "securityControlId": 31585, "ccis": [], "uuid": "9fb8c8b1-046c-53e3-9b66-33bf4f701b26", "testId": "IRO-09.4_A01", "test": "a method to analyze historical incidents in aggregate is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72223, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590708", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590708", "securityControlId": 31585, "ccis": [], "uuid": "dba4668a-a501-5ed3-8b76-39ce337ec760", "testId": "IRO-09.4_A02", "test": "historical incidents are analyzed in aggregate to identify patterns.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72224, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590708", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590708", "securityControlId": 31585, "ccis": [], "uuid": "a4abf7d7-4436-55cd-84fd-5f7335d27cba", "testId": "IRO-09.4_A03", "test": "historical incidents are analyzed in aggregate to identify trends.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72225, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590708", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590708", "securityControlId": 31585, "ccis": [], "uuid": "63e7893c-d7a0-5922-9397-aa084c951f44", "testId": "IRO-09.4_A04", "test": "historical incidents are analyzed in aggregate to identify other common root causes in order to address the vulnerability and risk.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 582750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586671", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79c69191-9f8e-5112-a9f1-674a13b03be6", "parentControlId": 31585, "controlId": "RESPONSE-2i", "title": "RESPONSE-2i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586671" } ], "id": 31585, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731168", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731168", "catalogueId": 1062, "uuid": "bd3ac5ac-025e-5cd9-8147-c5b90e113ed8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization analyze historical incidents in aggregate to identify:\n(1) Patterns;\n(2) Trends; and \n(3) Other common root causes in order to address the vulnerability and risk?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Incident Pattern Analysis", "description": "

Control Description

Mechanisms exist to analyze historical incidents in aggregate to identify:\n(1) Patterns;\n(2) Trends; and \n(3) Other common root causes in order to address the vulnerability and risk.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to analyze historical incidents in aggregate to identify:\n(1) Patterns;\n(2) Trends; and \n(3) Other common root causes in order to address the vulnerability and risk.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-09.4", "family": "Incident Response", "enhancements": "", "sortId": "IRO-09.4", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72226, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590708", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590708", "securityControlId": 31586, "ccis": [], "uuid": "108d89fa-0d9d-509e-add4-2c91db4bcba3", "testId": "IRO-10_A01", "test": "the time period to report suspected incidents to the organizational incident response capability is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-06_ODP[01]\n171A_R3_A.03.06.02.ODP[01]", "defaultText": null }, { "id": 72227, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590709", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590709", "securityControlId": 31586, "ccis": [], "uuid": "c6d57cfb-925c-5b89-9ab3-3a1be71fcaaf", "testId": "IRO-10_A02", "test": "authorities to whom incident information is to be reported are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-06_ODP[02]", "defaultText": null }, { "id": 72228, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590709", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590709", "securityControlId": 31586, "ccis": [], "uuid": "fd762655-b65f-57ef-8ee7-7874b11304a8", "testId": "IRO-10_A03", "test": "personnel are required to report suspected incidents to the organizational incident response capability within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: without delay", "otherId": "53A_R5_IR-06a.", "defaultText": null }, { "id": 72229, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590709", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590709", "securityControlId": 31586, "ccis": [], "uuid": "904806ae-f983-5425-badb-b0a434cdc6de", "testId": "IRO-10_A04", "test": "incident information is reported to organization-defined authorities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-06b.", "defaultText": null }, { "id": 72230, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590709", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590709", "securityControlId": 31586, "ccis": [], "uuid": "f65e74a4-c7d4-5f5f-b17f-396d222297ce", "testId": "IRO-10_A05", "test": "suspected incidents are reported to the organizational incident response capability within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72231, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590709", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590709", "securityControlId": 31586, "ccis": [], "uuid": "b0f1d1a8-a96b-5b96-ad13-cc8ad7e00582", "testId": "IRO-10_A06", "test": "an incident response support resource that offers advice and assistance to system users on handling and reporting incidents is provided.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.06.02.d", "defaultText": null }, { "id": 72232, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590709", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590709", "securityControlId": 31586, "ccis": [], "uuid": "beeaae90-7214-5a3b-8ceb-38ef0bb4e322", "testId": "IRO-10_A07", "test": "suspected incidents are reported to the organizational incident response capability within .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: near real time or as soon as practicable upon discovery", "otherId": "171A_R3_A.03.06.02.b", "defaultText": null }, { "id": 72233, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590709", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590709", "securityControlId": 31586, "ccis": [], "uuid": "5f998a5a-a06b-563e-9a53-dd395464dfed", "testId": "IRO-10_A08", "test": "incident information is reported to .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: all applicable personnel and entities as specified by the contract, and in accordance with any incident response plan notification procedures", "otherId": "171A_R3_A.03.06.02.c", "defaultText": null } ], "externalMappings": [ { "id": 582779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586675", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efe6fe2b-8bab-50bd-a11e-e3be0b15aae5", "parentControlId": 31586, "controlId": "6.8", "title": "6.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586675" }, { "id": 582791, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586676", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04f453f5-e106-5a29-93e8-9b173736224b", "parentControlId": 31586, "controlId": "IR-6", "title": "IR-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586676" }, { "id": 582792, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586676", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cde67cd1-0a96-598d-b2a7-4dad3d480e06", "parentControlId": 31586, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586676" }, { "id": 582794, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586676", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d77b28b-a777-5884-94fe-6c406f80ea94", "parentControlId": 31586, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586676" }, { "id": 582795, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20675338-f0a1-5eb6-b6d5-c4932643e42f", "parentControlId": 31586, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586677" }, { "id": 582796, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01adba38-12b8-5770-a672-47648e67792f", "parentControlId": 31586, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586677" }, { "id": 582797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c33d9ea-58dc-5060-8b08-8176955d7ced", "parentControlId": 31586, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586677" }, { "id": 582798, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee07fb5c-7c4e-5927-aa37-c70099f9c405", "parentControlId": 31586, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586677" }, { "id": 582799, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "390f8ae5-75ec-5abd-a669-e80e7d4756b7", "parentControlId": 31586, "controlId": "IR-6", "title": "IR-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586677" }, { "id": 582800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5bbf7537-6867-5cc4-90c7-4082f243cc6e", "parentControlId": 31586, "controlId": "03.06.02.b", "title": "03.06.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586677" }, { "id": 582801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57fd3dde-c8d5-5b08-826c-ec8a093788b7", "parentControlId": 31586, "controlId": "03.06.02.c", "title": "03.06.02.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586677" }, { "id": 582806, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "019e177b-7645-5c05-90bc-aa8b0e82c6ff", "parentControlId": 31586, "controlId": "DE.AE-06", "title": "DE.AE-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586678" }, { "id": 582807, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2091735-f090-5e90-9283-15149606a145", "parentControlId": 31586, "controlId": "RS", "title": "RS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586678" }, { "id": 582808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d685739-442c-5fa3-8f18-a0d445206a06", "parentControlId": 31586, "controlId": "RS.MA-01", "title": "RS.MA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586678" }, { "id": 582809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c506e0a-195d-51a1-8bd3-545b69a8fbdb", "parentControlId": 31586, "controlId": "RS.CO", "title": "RS.CO", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586678" }, { "id": 582810, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8dd14f8e-be5d-524d-a976-62355a77d1af", "parentControlId": 31586, "controlId": "RS.CO-02", "title": "RS.CO-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586678" }, { "id": 582811, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46b400a8-fb4f-5c97-82e1-acdc03229c47", "parentControlId": 31586, "controlId": "RS.CO-03", "title": "RS.CO-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586678" }, { "id": 582832, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586681", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5f6eb30-bd87-50de-8e7c-26e22f5f2994", "parentControlId": 31586, "controlId": "RESPONSE-2g", "title": "RESPONSE-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586681" }, { "id": 582833, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586681", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c6b1f66-51e0-53ad-b492-6de7999ec036", "parentControlId": 31586, "controlId": "RESPONSE-3c", "title": "RESPONSE-3c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586681" }, { "id": 582865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a84e9e2f-f807-5bf1-baf4-af25398bc8e3", "parentControlId": 31586, "controlId": "CIP-008-6 4.2", "title": "CIP-008-6 4.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586684" }, { "id": 582866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59213711-c6f2-51e0-a838-c4866f8a1335", "parentControlId": 31586, "controlId": "CIP-008-6 4.3", "title": "CIP-008-6 4.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586685" }, { "controlId": "C.8.6", "title": "C.8.6 — Incident Reporting", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "3ffdd82c-3c15-54e1-b4f0-1c84337bfc03", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.6 / RG 5.83 Rev 1", "title": "NEI 08-09 App E.8.6 / RG 5.83 Rev 1 — Incident Reporting", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "65ca2a7d-b348-5071-9f0e-a4d390919cac", "isPublic": true }, { "controlId": "10 CFR 73.77 (1/4/8-hr Reporting)", "title": "10 CFR 73.77 (1/4/8-hr Reporting) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "7c096993-a0bf-583b-8e44-36fe5210bef4", "isPublic": true }, { "controlId": "CIP-008-6-R4", "title": "CIP-008-6-R4 — Incident Response Notification and Reporting", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "089fa520-9dbd-5d07-abf8-600709d54427", "isPublic": true }, { "controlId": "CIP-008-6-4.1", "title": "CIP-008-6-4.1 — Initial notifications and updates shall include the following attributes, at a minimum, to the extent known", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "af2c74ff-815f-574f-b930-9ef6826f0e00", "isPublic": true }, { "controlId": "CIP-008-6-4.1.1", "title": "CIP-008-6-4.1.1 — The functional impact", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0fffc8bd-ca7c-53f8-8973-29c5a127a90c", "isPublic": true }, { "controlId": "CIP-008-6-4.1.2", "title": "CIP-008-6-4.1.2 — The attack vector used", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "53839576-6a81-5b8f-8df4-99cc84f6b102", "isPublic": true }, { "controlId": "CIP-008-6-4.1.3", "title": "CIP-008-6-4.1.3 — The level of intrusion that was achieved or attempted.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3bece8dd-be39-5088-bca4-447246590400", "isPublic": true }, { "controlId": "CIP-008-6-4.2", "title": "CIP-008-6-4.2 — After the Responsible Entity’s determination made pursuant to documented process(es) in Requirement R1, Part 1.2, pro...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2d3c59c7-c59f-571a-a1d6-185bb2f17204", "isPublic": true }, { "controlId": "CIP-008-6-4.3", "title": "CIP-008-6-4.3 — Provide updates, if any, within 7 calendar days of determination of new or changed attribute information required in...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "48dafd85-2449-55ed-aeda-24cef5b886b3", "isPublic": true }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "86c701c7-632c-5da7-ae14-d8a8bdf5ad19", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "9021ebc6-5b9b-583a-9703-c557e6ab4395", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "9484f754-de09-554e-8681-c636d5b47a93", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "9400fe15-d45c-5877-83ec-f5955e025491", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "c57c726b-44f5-5c20-9176-e03946938ade", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "94f5dac9-b650-56c2-b763-10ac95662f94", "isPublic": true } ], "id": 31586, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731168", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731168", "catalogueId": 1062, "uuid": "6183db49-d213-567d-a647-9d109cee562c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization timely-report incidents to applicable:\n (1) Internal stakeholders; \n (2) Affected clients & third-parties; and\n (3) Regulatory authorities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Incident Stakeholder Reporting", "description": "

Control Description

Mechanisms exist to timely-report incidents to applicable:\n(1) Internal stakeholders; \n(2) Affected clients & third-parties; and\n(3) Regulatory authorities.

Evidence Request List (ERL)

E-IRO-01\nE-IRO-11\nE-IRO-13

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ IT and/or cybersecurity personnel facilitate prompt response to suspected or confirmed security incidents, including timely notification to affected stakeholders.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to timely-report incidents to applicable:\n(1) Internal stakeholders; \n(2) Affected clients & third-parties; and\n(3) Regulatory authorities.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.8.6
NERC-CIP (2026) Requirements: CIP-008-6-R4", "controlId": "IRO-10", "family": "Incident Response", "enhancements": "", "sortId": "IRO-10", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72234, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59071", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59071", "securityControlId": 31587, "ccis": [], "uuid": "0203d29d-70dd-5b31-94d4-eccaacdbf723", "testId": "IRO-10.1_A01", "test": "automated mechanisms used for reporting incidents are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-06(01)_ODP", "defaultText": null }, { "id": 72235, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59071", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59071", "securityControlId": 31587, "ccis": [], "uuid": "6f80545b-a12b-5b45-825b-c5de26aed1f1", "testId": "IRO-10.1_A02", "test": "incidents are reported using automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IR-06(01)", "defaultText": null } ], "externalMappings": [ { "id": 583070, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e429075-752e-5ea4-b1a1-7a6cd0d77244", "parentControlId": 31587, "controlId": "IR-6(1)", "title": "IR-6(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586716" }, { "id": 583071, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30ba7c2d-8398-5b26-8696-ba79d1eef795", "parentControlId": 31587, "controlId": "IR-06(01)", "title": "IR-06(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586716" }, { "id": 583072, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79be4730-fe8c-5006-aaf0-08c6259ec865", "parentControlId": 31587, "controlId": "IR-06(01)", "title": "IR-06(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586716" }, { "id": 583073, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98e51e10-1c77-5321-bc32-5e33d1f58880", "parentControlId": 31587, "controlId": "IR-06(01)", "title": "IR-06(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586716" }, { "id": 583074, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "838e2256-a9b6-5300-818a-ef5d9b93b343", "parentControlId": 31587, "controlId": "IR-06(01)", "title": "IR-06(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586717" }, { "id": 583075, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586717", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "576e0015-ee12-510c-83bd-c2dd348427f1", "parentControlId": 31587, "controlId": "IR-06(01)", "title": "IR-06(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586717" } ], "id": 31587, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731169", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731169", "catalogueId": 1062, "uuid": "89c7e341-436a-5769-94be-cadb2fc1b0b1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to assist in the reporting of cybersecurity and data protection incidents?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Automated Reporting", "description": "

Control Description

Automated mechanisms exist to assist in the reporting of cybersecurity and data protection incidents.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically assist in the reporting of cybersecurity and data protection incidents.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-10.1", "family": "Incident Response", "enhancements": "", "sortId": "IRO-10.1", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72236, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59071", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59071", "securityControlId": 31588, "ccis": [], "uuid": "269f6de9-899f-5701-9bbd-3d874a7a5af5", "testId": "IRO-10.2_A01", "test": "sensitive / regulated data incidents are reported in a timely manner.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72237, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590711", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590711", "securityControlId": 31588, "ccis": [], "uuid": "c386b69e-b4a6-5927-b019-52e5f6094e3e", "testId": "IRO-10.2_A02", "test": "authorities to whom incident information is to be reported are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.06.02.ODP[02]", "defaultText": null } ], "externalMappings": [ { "id": 583124, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586722", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e5350c0-7563-501c-83bd-3c7b21e83aa5", "parentControlId": 31588, "controlId": "03.06.02.b", "title": "03.06.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586722" }, { "id": 583125, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586723", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ecfa6299-5169-533b-bec0-c561ea331579", "parentControlId": 31588, "controlId": "03.06.02.c", "title": "03.06.02.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586723" }, { "id": 583127, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586723", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68d8554e-e489-5781-abfd-1aa5723570f6", "parentControlId": 31588, "controlId": "RS.CO", "title": "RS.CO", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586723" }, { "id": 583128, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586723", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d04a6bbb-e1a5-5126-94d2-feebd26c1881", "parentControlId": 31588, "controlId": "RS.CO-02", "title": "RS.CO-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586723" }, { "id": 583129, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586723", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8454f258-6b2f-5a44-8f6b-54596bee30d7", "parentControlId": 31588, "controlId": "RS.CO-03", "title": "RS.CO-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586723" }, { "id": 583131, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586723", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "257ab9d5-62a8-56d1-94ae-04fa16573573", "parentControlId": 31588, "controlId": "RESPONSE-2g", "title": "RESPONSE-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586723" }, { "id": 583132, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586723", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b99c4dd-2b2a-50e2-8757-44aa4c7d71b0", "parentControlId": 31588, "controlId": "RESPONSE-3c", "title": "RESPONSE-3c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586723" }, { "id": 583139, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586724", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "095e0568-f861-5106-a6d0-b3b9e190ed38", "parentControlId": 31588, "controlId": "CIP-008-6 4.2", "title": "CIP-008-6 4.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586724" } ], "id": 31588, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731169", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731169", "catalogueId": 1062, "uuid": "a3aeb426-ac80-5aba-8481-1d3aa761d274", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization report sensitive/regulated data incidents in a timely manner?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Cyber Incident Reporting for Sensitive / Regulated Data", "description": "

Control Description

Mechanisms exist to report sensitive/regulated data incidents in a timely manner.

Evidence Request List (ERL)

E-IRO-01\nE-IRO-11

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Incident Response (IRO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IRO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Incident response-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to report sensitive/regulated data incidents in a timely manner.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-10.2", "family": "Incident Response", "enhancements": "", "sortId": "IRO-10.2", "references": "

Micro-Small Business (<10 staff)

∙ Incident Response Plan (IRP)

Small Business (10-49 staff)

∙ Incident Response Plan (IRP)

Medium Business (50-249 staff)

∙ Integrated Incident Response Program (IIRP)\n∙ Integrated Security Incident Response Team (ISIRT)

Large Business (250-999 staff)

∙ Integrated Incident Response Program (IIRP)\n∙ Integrated Security Incident Response Team (ISIRT)

Enterprise (>1,000 staff)

∙ Integrated Incident Response Program (IIRP)\n∙ Integrated Security Incident Response Team (ISIRT)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72238, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590711", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590711", "securityControlId": 31589, "ccis": [], "uuid": "b3d173be-edc2-5edc-b673-97ca49bbefa5", "testId": "IRO-10.3_A01", "test": "personnel or roles to whom system vulnerabilities associated with reported incidents are reported to is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-06(02)_ODP", "defaultText": null }, { "id": 72239, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590711", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590711", "securityControlId": 31589, "ccis": [], "uuid": "da22b898-bfe3-542e-9145-320a08fe76ae", "testId": "IRO-10.3_A02", "test": "system vulnerabilities associated with reported incidents are reported to personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-06(02)", "defaultText": null } ], "externalMappings": [ { "id": 583182, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586729", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4445d4ad-3855-51fe-9406-84eaca1ae6fc", "parentControlId": 31589, "controlId": "8.8", "title": "8.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586729" }, { "id": 583184, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586729", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "173e7f2b-3cf9-5eee-b93b-dc54f2aed8e4", "parentControlId": 31589, "controlId": "IR-6(2)", "title": "IR-6(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586729" }, { "id": 583185, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586729", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "188e76fb-1c06-5506-b001-49ac62092b10", "parentControlId": 31589, "controlId": "IR-06(02)", "title": "IR-06(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586729" }, { "id": 583187, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9b8042c-fc1e-552a-a156-8c6d9c1363dc", "parentControlId": 31589, "controlId": "IR-06(02)", "title": "IR-06(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58673" } ], "id": 31589, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73117", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73117", "catalogueId": 1062, "uuid": "357c8ae0-38d3-555c-95c4-4d0d5f044a48", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization report system vulnerabilities associated with reported cybersecurity and data protection incidents to organization-defined personnel or roles?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Vulnerabilities Related To Incidents", "description": "

Control Description

Mechanisms exist to report system vulnerabilities associated with reported cybersecurity and data protection incidents to organization-defined personnel or roles.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to report system vulnerabilities associated with reported cybersecurity and data protection incidents to organization-defined personnel or roles.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-10.3", "family": "Incident Response", "enhancements": "", "sortId": "IRO-10.3", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72240, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590712", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590712", "securityControlId": 31590, "ccis": [], "uuid": "f6f2f003-f051-5429-9c5a-6e28ddaa7b26", "testId": "IRO-10.4_A01", "test": "incident handling activities involving supply chain events are coordinated with other organizations involved in the supply chain.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(10)", "defaultText": null }, { "id": 72241, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590712", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590712", "securityControlId": 31590, "ccis": [], "uuid": "cec58d7e-c780-5fc0-9aec-4a5f8f96b0b1", "testId": "IRO-10.4_A02", "test": "incident information is provided to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-06(03)", "defaultText": null } ], "externalMappings": [ { "id": 583200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d340623-c2ed-5c69-b549-0c7c945b7180", "parentControlId": 31590, "controlId": "5.2", "title": "5.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586731" }, { "id": 583202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61f92ce2-5544-5def-a798-d0f1c435ab08", "parentControlId": 31590, "controlId": "IR-6(3)", "title": "IR-6(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586731" }, { "id": 583203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa9e235e-8750-506c-8d21-f34f4984ede4", "parentControlId": 31590, "controlId": "IR-04(10)", "title": "IR-04(10)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586731" }, { "id": 583204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8c91674-72a6-5ffd-bb6a-8ead9e1e6b3f", "parentControlId": 31590, "controlId": "IR-06(03)", "title": "IR-06(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586732" }, { "id": 583206, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586732", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5378e412-a02b-5d22-a36a-587f1b67b790", "parentControlId": 31590, "controlId": "IR-06(03)", "title": "IR-06(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586732" }, { "id": 583207, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586732", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c9eb790-3f97-5f5c-9207-a10354f9247d", "parentControlId": 31590, "controlId": "IR-04(10)", "title": "IR-04(10)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586732" }, { "id": 583208, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586732", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59779315-06c2-53e7-bcf2-c661e37b3c6a", "parentControlId": 31590, "controlId": "IR-06(03)", "title": "IR-06(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586732" }, { "id": 583209, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586732", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed39156a-ab70-5b72-a46d-c6d05f5760b3", "parentControlId": 31590, "controlId": "IR-06(03)", "title": "IR-06(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586732" }, { "id": 583210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586732", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc95d4d7-175e-5402-b0ed-4eec69c0e12e", "parentControlId": 31590, "controlId": "IR-06(03)", "title": "IR-06(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586732" }, { "id": 583212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586732", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fba2788-ce01-5b0d-aa88-09778e480f29", "parentControlId": 31590, "controlId": "IR-1(1)", "title": "IR-1(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586732" }, { "id": 583213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586732", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae560aae-b1ab-5014-aa66-fc8757b151e2", "parentControlId": 31590, "controlId": "IR-4(10)", "title": "IR-4(10)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586732" }, { "id": 583214, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586733", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b2064ad-3131-5866-b340-35ba77311136", "parentControlId": 31590, "controlId": "IR-6(3)", "title": "IR-6(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586733" }, { "id": 583215, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586733", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb9b0184-caf8-5fc7-a514-42c1e59389d2", "parentControlId": 31590, "controlId": "IR-4(10)", "title": "IR-4(10)", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586733" }, { "id": 583216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586733", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26de33bb-44c7-5c5c-804e-b6177b449237", "parentControlId": 31590, "controlId": "IR-6(3)", "title": "IR-6(3)", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586733" }, { "id": 583219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586733", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7a0119c-3c7d-5bfd-84f2-a2f1d6357da9", "parentControlId": 31590, "controlId": "RS.CO", "title": "RS.CO", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586733" }, { "id": 583220, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586733", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c4f1822-093e-5582-8aa4-f688a753b08f", "parentControlId": 31590, "controlId": "RS.CO-02", "title": "RS.CO-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586733" }, { "id": 583221, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f564253-3a4d-5381-a891-48f14fe8756e", "parentControlId": 31590, "controlId": "RS.CO-03", "title": "RS.CO-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586734" }, { "id": 583230, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2dd0d935-51c9-5b21-aab2-1174be78bc73", "parentControlId": 31590, "controlId": "CIP-013-2 1.2.2", "title": "CIP-013-2 1.2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586734" } ], "id": 31590, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73117", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73117", "catalogueId": 1062, "uuid": "799cc40a-9428-558d-8180-89a7b443db30", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide cybersecurity and data protection incident information to the provider of the Technology Assets, Applications and/or Services (TAAS) and other organizations involved in the supply chain for TAAS related to the incident?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Supply Chain Coordination", "description": "

Control Description

Mechanisms exist to provide cybersecurity and data protection incident information to the provider of the Technology Assets, Applications and/or Services (TAAS) and other organizations involved in the supply chain for TAAS related to the incident.

Evidence Request List (ERL)

E-RSK-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide cybersecurity and data protection incident information to the provider of the Technology Assets, Applications and/or Services (TAAS) and other organizations involved in the supply chain for TAAS related to the incident.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-10.4", "family": "Incident Response", "enhancements": "", "sortId": "IRO-10.4", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72242, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590712", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590712", "securityControlId": 31591, "ccis": [], "uuid": "8490de7e-101a-5c96-95ac-3bde82e4c4e8", "testId": "IRO-10.5_A01", "test": "serious incident involving the organization's systems, applications and/or services are reported to relevant authorities in the locality where the incident occurred, in accordance with legal requirements.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 583237, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ddb8a038-900e-51fb-9496-b14db813bf81", "parentControlId": 31591, "controlId": "CIP-008-6 R4", "title": "CIP-008-6 R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586735" }, { "id": 583238, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86a25881-0308-53cc-b585-cb3b26e7b71c", "parentControlId": 31591, "controlId": "CIP-008-6 4.1", "title": "CIP-008-6 4.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586735" }, { "id": 583239, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "238c2f36-baf4-5460-b85c-3ec000bd27e0", "parentControlId": 31591, "controlId": "CIP-008-6 4.1.1", "title": "CIP-008-6 4.1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586735" }, { "id": 583240, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63c67af9-275a-54af-a072-39d939dccbcb", "parentControlId": 31591, "controlId": "CIP-008-6 4.1.2", "title": "CIP-008-6 4.1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586736" }, { "id": 583241, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4abc7174-7f00-58c5-bd0c-6d9cfb5f06fa", "parentControlId": 31591, "controlId": "CIP-008-6 4.1.3", "title": "CIP-008-6 4.1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586736" }, { "id": 583242, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0538b11b-4408-5c63-9a86-8145be7cae64", "parentControlId": 31591, "controlId": "CIP-008-6 4.2", "title": "CIP-008-6 4.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586736" }, { "controlId": "CIP-008-6-R4", "title": "CIP-008-6-R4 — Incident Response Notification and Reporting", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3a565364-8643-503d-b3fa-1a22e9e67a44", "isPublic": true }, { "controlId": "CIP-008-6-4.1", "title": "CIP-008-6-4.1 — Initial notifications and updates shall include the following attributes, at a minimum, to the extent known", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c90bbade-296b-5425-8221-f47e23f2e258", "isPublic": true }, { "controlId": "CIP-008-6-4.1.1", "title": "CIP-008-6-4.1.1 — The functional impact", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "25a7957b-77c1-517b-bc9a-e82980756803", "isPublic": true }, { "controlId": "CIP-008-6-4.1.2", "title": "CIP-008-6-4.1.2 — The attack vector used", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c8f430c3-93ec-5764-81e8-8f2cbd832ebc", "isPublic": true }, { "controlId": "CIP-008-6-4.1.3", "title": "CIP-008-6-4.1.3 — The level of intrusion that was achieved or attempted.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "aa62dcfd-5857-5088-8fba-c310b4a5dc96", "isPublic": true }, { "controlId": "CIP-008-6-4.2", "title": "CIP-008-6-4.2 — After the Responsible Entity’s determination made pursuant to documented process(es) in Requirement R1, Part 1.2, pro...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "03b583c9-71e8-57c6-a46b-2f64dd222f0a", "isPublic": true }, { "controlId": "CIP-008-6-4.3", "title": "CIP-008-6-4.3 — Provide updates, if any, within 7 calendar days of determination of new or changed attribute information required in...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-008-6-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "692f2ab5-f4c8-5b50-97f4-d6054a27fb4c", "isPublic": true }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "be29fd19-ff3a-5896-93b7-3c69f3541133", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "2ce1f5ac-0553-5cfd-a8ae-9ebbdce3a65b", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "893f6978-c7d4-5101-b5b7-51253ab46d36", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "9c67be13-91e4-5fdd-b468-c731a4fa9668", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "bd9cdd15-717a-5ce5-84d4-03cc03e05585", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "40abff5c-a728-59aa-ac55-993da688e8b6", "isPublic": true } ], "id": 31591, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731171", "catalogueId": 1062, "uuid": "ff2cbe37-13b1-50cd-8eb5-19410afed146", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization report any serious incident involving the organization's Technology Assets, Applications and/or Services (TAAS) to relevant authorities in the locality where the incident occurred, in accordance with mandatory reporting:\n(1) Requirements; and\n(2) Timelines?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Serious Incident Reporting", "description": "

Control Description

Mechanisms exist to report any serious incident involving the organization's Technology Assets, Applications, Services and/or Data (TAASD) to relevant authorities in the locality where the incident occurred, in accordance with mandatory reporting:\n(1) Requirements; and\n(2) Timelines.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to report any serious incident involving the organization's TAASD to relevant authorities in the locality where the incident occurred, in accordance with mandatory reporting:\n(1) Requirements; and\n(2) Timelines.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

NERC-CIP (2026) Requirements: CIP-008-6-R4", "controlId": "IRO-10.5", "family": "Incident Response", "enhancements": "", "sortId": "IRO-10.5", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72243, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590712", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590712", "securityControlId": 31592, "ccis": [], "uuid": "bae1f556-b1bd-54eb-8fd4-7e046aa40cca", "testId": "IRO-11_A01", "test": "an incident response support resource that offers advice and assistance to system users on handling and reporting incidents is provided.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-07[01]\n171A_R3_A.03.06.02.d", "defaultText": null }, { "id": 72244, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590713", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590713", "securityControlId": 31592, "ccis": [], "uuid": "b35bb02e-98d8-5669-97c0-417b961dd6e5", "testId": "IRO-11_A02", "test": "the incident response support resource offers advice and assistance to users of the system for the response and reporting of incidents.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-07[02]", "defaultText": null } ], "externalMappings": [ { "id": 583250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02b2e731-c5bc-5d57-bc36-ae864775a605", "parentControlId": 31592, "controlId": "IR-7", "title": "IR-7", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586737" }, { "id": 583251, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a266b212-81de-5a81-b8ce-498576452d95", "parentControlId": 31592, "controlId": "IR-07", "title": "IR-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586737" }, { "id": 583253, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73aef3d8-4c8f-5c4a-810d-e3560164e32d", "parentControlId": 31592, "controlId": "IR-07", "title": "IR-07", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586737" }, { "id": 583254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "416178d8-f238-5dca-bb82-c2de400ba56d", "parentControlId": 31592, "controlId": "IR-07", "title": "IR-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586737" }, { "id": 583255, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30bb3e51-6574-54ff-81cc-cfaed1e1893b", "parentControlId": 31592, "controlId": "IR-07", "title": "IR-07", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586737" }, { "id": 583256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c89c57b-ea18-5d63-8248-17e3c20407fe", "parentControlId": 31592, "controlId": "IR-07", "title": "IR-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586737" }, { "id": 583257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69f66097-9b21-5a5e-863e-7924b6dcff1a", "parentControlId": 31592, "controlId": "IR-07", "title": "IR-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586738" }, { "id": 583258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586738", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e2671cf-840f-597d-9581-1f83c2d4f59b", "parentControlId": 31592, "controlId": "IR-7", "title": "IR-7", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586738" }, { "id": 583259, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586738", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2471b0c-8bbe-5f14-8bfb-1910464adde0", "parentControlId": 31592, "controlId": "03.06.02.d", "title": "03.06.02.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586738" }, { "controlId": "C.8.7", "title": "C.8.7 — Incident Response Assistance", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "e005e037-5589-578a-b09c-98e6010130e9", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.7", "title": "NEI 08-09 App E.8.7 — Incident Response Assistance", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "93e8828f-3cdc-5a33-8ebc-e973497ea887", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3)", "title": "10 CFR 73.54(d)(3) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.7", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "ed35c0c9-5ad3-579a-bdf9-aacc45edf00e", "isPublic": true }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d62023c5-c071-5770-a698-dfba9453b57b", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "4c7f99d0-2e65-5f61-9a5a-99ce23db2f61", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "649efda1-102e-5f0e-8491-4baa733544da", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "26a88770-154d-5432-b288-18af02b01e78", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "beadddf3-f0c9-5466-a9d7-1f58deefef25", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "2383e9c4-4003-526a-ba93-fadcd5b27eb6", "isPublic": true } ], "id": 31592, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731171", "catalogueId": 1062, "uuid": "84eb0ed2-a6b8-5117-9781-71cdda93c373", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide incident response advice and assistance to users of Technology Assets, Applications and/or Services (TAAS) for the handling and reporting of actual and potential cybersecurity and data protection incidents?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Incident Reporting Assistance", "description": "

Control Description

Mechanisms exist to provide incident response advice and assistance to users of Technology Assets, Applications and/or Services (TAAS) for the handling and reporting of actual and potential cybersecurity and data protection incidents.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide incident response advice and assistance to users of Technology Assets, Applications and/or Services (TAAS) for the handling and reporting of actual and potential cybersecurity and data protection incidents.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.8.7", "controlId": "IRO-11", "family": "Incident Response", "enhancements": "", "sortId": "IRO-11", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72245, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590713", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590713", "securityControlId": 31593, "ccis": [], "uuid": "43936a3a-cfbb-56be-a114-e0fbc5e0fc3f", "testId": "IRO-11.1_A01", "test": "automated mechanisms used to increase the availability of incident response information and support are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-07(01)_ODP", "defaultText": null }, { "id": 72246, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590713", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590713", "securityControlId": 31593, "ccis": [], "uuid": "17b163aa-2afb-5deb-b3f3-c616c5a0a468", "testId": "IRO-11.1_A02", "test": "the availability of incident response information and support is increased using automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IR-07(01)", "defaultText": null } ], "externalMappings": [ { "id": 583280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58674", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbb02755-d31b-535b-b863-c73fd8e37ff3", "parentControlId": 31593, "controlId": "IR-7(1)", "title": "IR-7(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58674" }, { "id": 583281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58674", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d545c04-76c1-58ca-acf6-afcf3d39dc13", "parentControlId": 31593, "controlId": "IR-07(01)", "title": "IR-07(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58674" }, { "id": 583282, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58674", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ddfaae1-7ab5-50a3-8204-01d3be3f732f", "parentControlId": 31593, "controlId": "IR-07(01)", "title": "IR-07(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58674" }, { "id": 583283, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58674", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67e42eb6-9579-56a9-9d95-0047be38b866", "parentControlId": 31593, "controlId": "IR-07(01)", "title": "IR-07(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58674" }, { "id": 583284, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f0dc7e4-4861-548c-b643-5de16fea9e1b", "parentControlId": 31593, "controlId": "IR-07(01)", "title": "IR-07(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586741" }, { "id": 583285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40c49c3b-d0d7-5cad-8498-b04395f3481b", "parentControlId": 31593, "controlId": "IR-07(01)", "title": "IR-07(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586741" } ], "id": 31593, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731171", "catalogueId": 1062, "uuid": "365bfa89-134b-5046-899d-71f455a0de23", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to increase the availability of incident response-related information and support?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 1.0, "title": "Automation Support of Availability of Information / Support", "description": "

Control Description

Automated mechanisms exist to increase the availability of incident response-related information and support.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Incident Response (IRO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IRO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Incident response-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically increase the availability of incident response-related information and support.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-11.1", "family": "Incident Response", "enhancements": "", "sortId": "IRO-11.1", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72247, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590713", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590713", "securityControlId": 31594, "ccis": [], "uuid": "dfa0ac1c-1816-517c-8b16-ebb5a04c926f", "testId": "IRO-11.2_A01", "test": "a direct, cooperative relationship is established between its incident response capability and external providers of the system protection capability.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-07(02)(a)", "defaultText": null }, { "id": 72248, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590714", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590714", "securityControlId": 31594, "ccis": [], "uuid": "00ac9017-a4df-5c64-a6e5-1dbce805dc73", "testId": "IRO-11.2_A02", "test": "organizational incident response team members are identified to the external providers.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-07(02)(b)", "defaultText": null } ], "externalMappings": [ { "id": 583298, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41810dda-23dd-50df-a2c4-1571c08cde09", "parentControlId": 31594, "controlId": "5.29", "title": "5.29", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586742" }, { "id": 583300, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b247e082-c7e9-5656-8358-b1e069980aff", "parentControlId": 31594, "controlId": "IR-7(2)", "title": "IR-7(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586742" }, { "id": 583301, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586743", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed0376ff-629e-5dd6-bc2c-feb0a0de884e", "parentControlId": 31594, "controlId": "IR-07(02)", "title": "IR-07(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586743" }, { "id": 583302, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586743", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b827af8b-5cd9-508f-b1e3-853d298baa5b", "parentControlId": 31594, "controlId": "IR-07(02)", "title": "IR-07(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586743" }, { "id": 583303, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586743", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fdb4c10-7f05-5f30-9ddd-3db22422e73f", "parentControlId": 31594, "controlId": "IR-7(2)", "title": "IR-7(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586743" }, { "id": 583304, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586743", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cf2a9b9-bc50-5807-92f6-bc5ea98cdf63", "parentControlId": 31594, "controlId": "IR-7(2)", "title": "IR-7(2)", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586743" }, { "id": 583307, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586743", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "396dc268-3315-5adf-918b-c485f9fb7d98", "parentControlId": 31594, "controlId": "RESPONSE-3j", "title": "RESPONSE-3j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586743" }, { "id": 583308, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586743", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ed3978a-0942-52ed-98c6-900966bb7dc8", "parentControlId": 31594, "controlId": "RESPONSE-3k", "title": "RESPONSE-3k", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586743" } ], "id": 31594, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731172", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731172", "catalogueId": 1062, "uuid": "5239c1cd-66bf-5683-a0bb-786c1aec9038", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish a direct, cooperative relationship between its incident response capability and external service providers?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Coordination With External Providers", "description": "

Control Description

Mechanisms exist to establish a direct, cooperative relationship between the organization's incident response capability and external service providers.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to establish a direct, cooperative relationship between the organization's incident response capability and external service providers.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-11.2", "family": "Incident Response", "enhancements": "", "sortId": "IRO-11.2", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72249, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590714", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590714", "securityControlId": 31595, "ccis": [], "uuid": "4e730ede-4e1b-5982-9367-dc05685075c4", "testId": "IRO-12_A01", "test": "actions to be performed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-09_ODP[03]", "defaultText": null }, { "id": 72250, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590714", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590714", "securityControlId": 31595, "ccis": [], "uuid": "7ce6ba8b-edf8-56e7-9f4c-9c63ee9b960f", "testId": "IRO-12_A02", "test": "the specific information involved in the system contamination is identified in response to information spills.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-09b.", "defaultText": null }, { "id": 72251, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590714", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590714", "securityControlId": 31595, "ccis": [], "uuid": "d24ea7be-85c7-56c9-bade-05ca1465fef5", "testId": "IRO-12_A03", "test": "personnel or roles is/are alerted of the information spill using a method of communication not associated with the spill.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-09c.", "defaultText": null }, { "id": 72252, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590715", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590715", "securityControlId": 31595, "ccis": [], "uuid": "9c005ba8-665a-51eb-ad74-f62026eac140", "testId": "IRO-12_A04", "test": "the contaminated system or system component is isolated in response to information spills.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-09d.", "defaultText": null }, { "id": 72253, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590715", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590715", "securityControlId": 31595, "ccis": [], "uuid": "f26e0b29-1e2d-50d6-bc0c-62ceaffff8ac", "testId": "IRO-12_A05", "test": "the information is eradicated from the contaminated system or component in response to information spills.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-09e.", "defaultText": null }, { "id": 72254, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590715", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590715", "securityControlId": 31595, "ccis": [], "uuid": "4a195e2a-d382-503a-bb31-85f859d9700e", "testId": "IRO-12_A06", "test": "other systems or system components that may have been subsequently contaminated are identified in response to information spills.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-09f.", "defaultText": null }, { "id": 72255, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590715", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590715", "securityControlId": 31595, "ccis": [], "uuid": "51d7690d-58ba-5189-bf64-24c7baaf9523", "testId": "IRO-12_A07", "test": "actions are performed in response to information spills.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-09g.", "defaultText": null }, { "id": 72256, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590716", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590716", "securityControlId": 31595, "ccis": [], "uuid": "b5626d33-ee2f-5a72-92b9-75d66f8094bf", "testId": "IRO-12_A08", "test": "sensitive / regulated data is removed from publicly accessible systems, if discovered.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72257, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590716", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590716", "securityControlId": 31595, "ccis": [], "uuid": "15f035ad-03b7-557f-b89f-98a458c12842", "testId": "IRO-12_A09", "test": "CUI is removed from publicly accessible systems, if discovered.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.01.22.b[02]", "defaultText": null } ], "externalMappings": [ { "id": 583324, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586745", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35f4ea41-4c7a-5220-93bf-139fb954880f", "parentControlId": 31595, "controlId": "IR-9", "title": "IR-9", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586745" }, { "id": 583325, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586745", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc739865-b0a7-5fcb-a553-caa22f549a9c", "parentControlId": 31595, "controlId": "IR-09", "title": "IR-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586745" }, { "id": 583327, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586745", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45f22727-4a97-524e-a45e-27e9256fccce", "parentControlId": 31595, "controlId": "IR-09", "title": "IR-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586746" }, { "id": 583328, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586746", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78d59e1c-881f-5123-91cb-3c0ccaa089c5", "parentControlId": 31595, "controlId": "IR-9", "title": "IR-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586746" }, { "id": 583329, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586746", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13635e39-8deb-57a8-9cf8-03fcc0257f7e", "parentControlId": 31595, "controlId": "IR-9", "title": "IR-9", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586746" }, { "id": 583331, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586746", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1d76ddb-9356-559e-9239-8ff0cfdc659d", "parentControlId": 31595, "controlId": "03.06.01", "title": "03.06.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586746" }, { "id": 583348, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d46dc93-08bf-5c13-ac06-ca7c34052619", "parentControlId": 31595, "controlId": "9-3.e", "title": "9-3.e", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586748" }, { "id": 583349, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "530aa24a-48bf-5753-9b44-b83e8a00e356", "parentControlId": 31595, "controlId": "9-4", "title": "9-4", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586748" }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "212b5ee4-7612-5b9b-97d7-079723abca6e", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "c2d28a58-066e-5eaa-a56d-8c32b6c849b5", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "1d3ec4b8-0618-5c02-819d-20177c3fcf4f", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "108cd8ea-c1e8-56ff-a9c1-78bf8fe03124", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "c54b91b1-9711-57f3-a85a-6440677f506a", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "48749d7f-64c3-5eb6-90a6-fa1fa5b533b6", "isPublic": true } ], "id": 31595, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731172", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731172", "catalogueId": 1062, "uuid": "bdef34e4-8bc0-5144-a00e-a7518f9c3c75", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization respond to sensitive/regulated data spills?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 8.0, "title": "Sensitive / Regulated Data Spill Response", "description": "

Control Description

Mechanisms exist to respond to sensitive/regulated data spills.

Evidence Request List (ERL)

E-IRO-12

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to respond to sensitive/regulated data spills.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-12", "family": "Incident Response", "enhancements": "", "sortId": "IRO-12", "references": "

Micro-Small Business (<10 staff)

∙ Incident Response Plan (IRP)

Small Business (10-49 staff)

∙ Incident Response Plan (IRP)

Medium Business (50-249 staff)

∙ Integrated Incident Response Program (IIRP)\n∙ Integrated Security Incident Response Team (ISIRT)

Large Business (250-999 staff)

∙ Integrated Incident Response Program (IIRP)\n∙ Integrated Security Incident Response Team (ISIRT)

Enterprise (>1,000 staff)

∙ Integrated Incident Response Program (IIRP)\n∙ Integrated Security Incident Response Team (ISIRT)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72258, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590716", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590716", "securityControlId": 31596, "ccis": [], "uuid": "12339c89-cd25-51a2-a44e-12494e0a4151", "testId": "IRO-12.1_A01", "test": "personnel or roles assigned the responsibility for responding to information spills is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-09_ODP[01]", "defaultText": null }, { "id": 72259, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590716", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590716", "securityControlId": 31596, "ccis": [], "uuid": "48877593-22ef-577a-a47b-138b72dfb1b7", "testId": "IRO-12.1_A02", "test": "personnel or roles to be alerted of the information spill using a method of communication not associated with the spill is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-09_ODP[02]", "defaultText": null }, { "id": 72260, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590716", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590716", "securityControlId": 31596, "ccis": [], "uuid": "642a6601-b76b-5e16-8a2e-cb9a68521deb", "testId": "IRO-12.1_A03", "test": "personnel or roles is/are assigned the responsibility to respond to information spills.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_IR-09a.", "defaultText": null } ], "externalMappings": [ { "id": 583367, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58675", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab1b6f5b-4745-599f-b02a-47e54655e1f1", "parentControlId": 31596, "controlId": "IR-9(1)", "title": "IR-9(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58675" }, { "id": 583368, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58675", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eabfec34-456c-5a85-9e16-7034b79d00d5", "parentControlId": 31596, "controlId": "IR-09", "title": "IR-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58675" }, { "id": 583370, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58675", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "094c5bfc-1929-5458-bd56-173fb815836b", "parentControlId": 31596, "controlId": "IR-09", "title": "IR-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58675" }, { "id": 583371, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58675", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d745041d-d315-5a78-8c9a-4d751e793b5c", "parentControlId": 31596, "controlId": "IR-9", "title": "IR-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58675" }, { "id": 583372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a82dc66-0ecb-5e65-a2b7-f1cc4c6d9df7", "parentControlId": 31596, "controlId": "IR-9", "title": "IR-9", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586751" } ], "id": 31596, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731172", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731172", "catalogueId": 1062, "uuid": "c99b1e4f-6907-55d1-ad0a-69f480fc52a1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization formally assign personnel or roles with responsibility for responding to sensitive/regulated data spills?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 8.0, "title": "Sensitive / Regulated Data Spill Responsible Personnel", "description": "

Control Description

Mechanisms exist to formally assign personnel or roles with responsibility for responding to sensitive/regulated data spills.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to formally assign personnel or roles with responsibility for responding to sensitive/regulated data spills.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-12.1", "family": "Incident Response", "enhancements": "", "sortId": "IRO-12.1", "references": "

Micro-Small Business (<10 staff)

∙ Incident Response Plan (IRP)

Small Business (10-49 staff)

∙ Incident Response Plan (IRP)

Medium Business (50-249 staff)

∙ Integrated Incident Response Program (IIRP)\n∙ Integrated Security Incident Response Team (ISIRT)

Large Business (250-999 staff)

∙ Integrated Incident Response Program (IIRP)\n∙ Integrated Security Incident Response Team (ISIRT)

Enterprise (>1,000 staff)

∙ Integrated Incident Response Program (IIRP)\n∙ Integrated Security Incident Response Team (ISIRT)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72261, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590717", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590717", "securityControlId": 31597, "ccis": [], "uuid": "eab84a52-a6e4-5df2-9992-4186076a7cff", "testId": "IRO-12.2_A01", "test": "the frequency at which to provide information spillage response training is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_IR-09(02)_ODP", "defaultText": null }, { "id": 72262, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590717", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590717", "securityControlId": 31597, "ccis": [], "uuid": "26ae42fc-4648-51f5-89d2-b52f84002b26", "testId": "IRO-12.2_A02", "test": "information spillage response training is provided frequently.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_IR-09(02)", "defaultText": null } ], "externalMappings": [ { "id": 583384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc985696-043c-5520-bb74-19405dd694bd", "parentControlId": 31597, "controlId": "IR-9(2)", "title": "IR-9(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586752" }, { "id": 583385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "817bfba6-295a-5bcf-b2e6-5dd4a5cbc5b1", "parentControlId": 31597, "controlId": "IR-09(02)", "title": "IR-09(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586752" }, { "id": 583386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c56fb17-b294-5a5c-988c-23235e433ada", "parentControlId": 31597, "controlId": "IR-09(02)", "title": "IR-09(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586752" } ], "id": 31597, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731173", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731173", "catalogueId": 1062, "uuid": "a8185194-129c-5767-8c8c-770b962f5836", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure incident response training material provides coverage for sensitive/regulated data spillage response?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Sensitive / Regulated Data Spill Training", "description": "

Control Description

Mechanisms exist to ensure incident response training material provides coverage for sensitive/regulated data spillage response.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure incident response training material provides coverage for sensitive/regulated data spillage response.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-12.2", "family": "Incident Response", "enhancements": "", "sortId": "IRO-12.2", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72263, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590717", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590717", "securityControlId": 31598, "ccis": [], "uuid": "3bfa8af1-09ee-5b09-86d1-010c2aca6747", "testId": "IRO-12.3_A01", "test": "procedures to be implemented to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems undergo corrective actions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-09(03)_ODP", "defaultText": null }, { "id": 72264, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590717", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590717", "securityControlId": 31598, "ccis": [], "uuid": "cbc1c6e7-cff7-5149-b3c4-215168d57198", "testId": "IRO-12.3_A02", "test": "procedures are implemented to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_IR-09(03)", "defaultText": null } ], "externalMappings": [ { "id": 583392, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586761", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39ff2e24-c7b6-5fa5-9ec4-c656e856d4ce", "parentControlId": 31598, "controlId": "IR-9(3)", "title": "IR-9(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586761" }, { "id": 583393, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586761", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fd14108-a4e0-5913-88ae-7ad1bba6d55c", "parentControlId": 31598, "controlId": "IR-09(03)", "title": "IR-09(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586761" }, { "id": 583394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586761", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "205c6bb1-6f75-5de7-9588-341458ddce20", "parentControlId": 31598, "controlId": "IR-09(03)", "title": "IR-09(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586761" } ], "id": 31598, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731173", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731173", "catalogueId": 1062, "uuid": "89716f6d-48f9-5838-8a6f-dd6bebc97e5c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure that organizational personnel impacted by sensitive/regulated data spills can continue to carry out assigned tasks while contaminated Technology Assets, Applications and/or Services (TAAS) are undergoing corrective actions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Post-Sensitive / Regulated Data Spill Operations", "description": "

Control Description

Mechanisms exist to ensure that organizational personnel impacted by sensitive/regulated data spills can continue to carry out assigned tasks while contaminated Technology Assets, Applications and/or Services (TAAS) are undergoing corrective actions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure that organizational personnel impacted by sensitive/regulated data spills can continue to carry out assigned tasks while contaminated Technology Assets, Applications and/or Services (TAAS) are undergoing corrective actions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-12.3", "family": "Incident Response", "enhancements": "", "sortId": "IRO-12.3", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72265, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590718", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590718", "securityControlId": 31599, "ccis": [], "uuid": "5f07bc01-1571-5f04-b26d-6d6987a11089", "testId": "IRO-12.4_A01", "test": "controls employed for personnel exposed to information not within assigned access authorizations are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-09(04)_ODP", "defaultText": null }, { "id": 72266, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590718", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590718", "securityControlId": 31599, "ccis": [], "uuid": "959bf873-f1db-5de0-911e-bb258f2bc4d8", "testId": "IRO-12.4_A02", "test": "controls are employed for personnel exposed to information not within assigned access authorizations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-09(04)", "defaultText": null }, { "id": 72267, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590718", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590718", "securityControlId": 31599, "ccis": [], "uuid": "3a60ba31-2d5e-53fb-a334-3a51741afdb0", "testId": "IRO-12.4_A03", "test": "malicious code remaining in the system is analyzed after the incident.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(12)[01]", "defaultText": null }, { "id": 72268, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590718", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590718", "securityControlId": 31599, "ccis": [], "uuid": "aacb5a91-1255-5bf8-8ba7-321f588ff4eb", "testId": "IRO-12.4_A04", "test": "other residual artifacts remaining in the system (if any) are analyzed after the incident.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(12)[02]", "defaultText": null } ], "externalMappings": [ { "id": 583407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586763", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b1fdefe-f6a7-567b-a313-d211a0b5b173", "parentControlId": 31599, "controlId": "IR-9(4)", "title": "IR-9(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586763" }, { "id": 583408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586763", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b799754e-1371-5957-8473-998010713b65", "parentControlId": 31599, "controlId": "IR-09(04)", "title": "IR-09(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586763" }, { "id": 583409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586763", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "006e21f4-9b88-5450-82e7-288180f9b812", "parentControlId": 31599, "controlId": "IR-09(04)", "title": "IR-09(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586763" } ], "id": 31599, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731173", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731173", "catalogueId": 1062, "uuid": "bff9ab81-bbf0-5e9a-8cd2-eeb060f46f1c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization address security safeguards for personnel exposed to sensitive/regulated data that is not within their assigned access authorizations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Sensitive / Regulated Data Exposure to Unauthorized Personnel", "description": "

Control Description

Mechanisms exist to address security safeguards for personnel exposed to sensitive/regulated data that is not within their assigned access authorizations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to address security safeguards for personnel exposed to sensitive/regulated data that is not within their assigned access authorizations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-12.4", "family": "Incident Response", "enhancements": "", "sortId": "IRO-12.4", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72269, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590718", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590718", "securityControlId": 31600, "ccis": [], "uuid": "ae3fa4ba-4aae-5488-a541-e9a93fc72de4", "testId": "IRO-13_A01", "test": "an After Action Reviews (AARs), or a similar process, is conducted following incidents that require escalation to an Integrated Security Incident Response Team (ISIRT), or similar integrated team of cybersecurity, IT and business function representatives, are established to address a cybersecurity and/or data privacy incident response operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72270, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590719", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590719", "securityControlId": 31600, "ccis": [], "uuid": "21db6868-7457-50fd-bc8c-9c7d37190e04", "testId": "IRO-13_A02", "test": "events that would require the current incident response policy / procedures to be reviewed / updated are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-01_ODP[06]\n53A_R5_IR-01_ODP[08]", "defaultText": null }, { "id": 72271, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590719", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590719", "securityControlId": 31600, "ccis": [], "uuid": "6782fb6e-c888-5321-9a64-7a81c5582c2c", "testId": "IRO-13_A03", "test": "incident response documentation is updated to address necessary changes to enable the timely and effective response to incidents.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72272, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590719", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590719", "securityControlId": 31600, "ccis": [], "uuid": "d6ac38c5-2e9b-5055-a90d-f607ee136a50", "testId": "IRO-13_A04", "test": "events that initiate a review of the incident response training content are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-02_ODP[04]\n171A_R3_A.03.06.04.ODP[04]", "defaultText": null } ], "externalMappings": [ { "id": 583429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2480ac46-9581-5276-a52a-06a13e922db9", "parentControlId": 31600, "controlId": "5.24", "title": "5.24", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586767" }, { "id": 583430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05fb97c3-1743-54d3-8477-921751915221", "parentControlId": 31600, "controlId": "5.27", "title": "5.27", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586767" }, { "id": 583438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb11b77b-b48e-50ec-b1d6-237ad2ca7bd7", "parentControlId": 31600, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586768" }, { "id": 583439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9b9874a-bac1-52b4-a741-94b61a344134", "parentControlId": 31600, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586768" }, { "id": 583440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d385d91-82ab-51d8-b0d4-473b9f1e3d7f", "parentControlId": 31600, "controlId": "IR-04(12)", "title": "IR-04(12)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586768" }, { "id": 583441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dec7bed8-45ba-5d72-9bb1-1c63f10eaed2", "parentControlId": 31600, "controlId": "IR-06(02)", "title": "IR-06(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586768" }, { "id": 583445, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bd46b5b-ab2d-5a10-8bcc-6041389772b6", "parentControlId": 31600, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586769" }, { "id": 583446, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1b6f463-48dd-5292-9959-8c1fe5e17986", "parentControlId": 31600, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586769" }, { "id": 583447, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9f62961-c5ef-5f43-a830-728dbfc2d413", "parentControlId": 31600, "controlId": "IR-04(12)", "title": "IR-04(12)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586769" }, { "id": 583448, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c446e7a-f1bf-5bfb-9931-e57193cb0b20", "parentControlId": 31600, "controlId": "IR-06(02)", "title": "IR-06(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586769" }, { "id": 583449, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "599ae143-4907-578e-889c-20a85bb21f91", "parentControlId": 31600, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586769" }, { "id": 583450, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2db072b4-9ed1-540f-9d55-ebb861f75017", "parentControlId": 31600, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586769" }, { "id": 583451, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b080c67-8833-530a-b605-aab5f2db9353", "parentControlId": 31600, "controlId": "IR-01", "title": "IR-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586769" }, { "id": 583453, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b9e0f53-2fc2-54fe-b6e8-1645959dc733", "parentControlId": 31600, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58677" }, { "id": 583454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb1e37d9-05e2-5191-aaa0-b68f20c8086a", "parentControlId": 31600, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58677" }, { "id": 583455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bcc1d5df-ae52-59d5-8c83-47fcc2076166", "parentControlId": 31600, "controlId": "IR-1", "title": "IR-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58677" }, { "id": 583459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7002df1-d8aa-5f29-84e2-4e5ef337d33e", "parentControlId": 31600, "controlId": "NFO - IR-1", "title": "NFO - IR-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58677" }, { "id": 583460, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d7e63c7-5209-55dc-a3fe-35ab60a37163", "parentControlId": 31600, "controlId": "03.06.04.b", "title": "03.06.04.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58677" }, { "id": 583463, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae233f36-cc09-5da6-a41c-936cbb357443", "parentControlId": 31600, "controlId": "ID.IM-02", "title": "ID.IM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586771" }, { "id": 583464, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc5b7af2-1975-5dfd-a533-fb12c4b3ab0e", "parentControlId": 31600, "controlId": "ID.IM-03", "title": "ID.IM-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586771" }, { "id": 583465, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5784b0da-7730-5a6c-b0ec-87d4c3e5538f", "parentControlId": 31600, "controlId": "RS.AN-03", "title": "RS.AN-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586771" }, { "id": 583476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586774", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15960abd-ab0b-5cef-bf3b-5cc49f054f2c", "parentControlId": 31600, "controlId": "RESPONSE-3h", "title": "RESPONSE-3h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586774" }, { "id": 583477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586774", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47faa2c8-e0bc-5cab-8992-ba05b7a2c095", "parentControlId": 31600, "controlId": "RESPONSE-3i", "title": "RESPONSE-3i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586774" }, { "id": 583494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0646f765-522e-5f59-accc-ec0769a4a176", "parentControlId": 31600, "controlId": "CIP-008-6 3.1.1", "title": "CIP-008-6 3.1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586776" }, { "id": 583495, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58f883b9-9244-56c9-ab6c-fddd167bb6f5", "parentControlId": 31600, "controlId": "CIP-008-6 3.1.2", "title": "CIP-008-6 3.1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586776" }, { "id": 583516, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586779", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "556e6c47-6e79-52a4-91ee-245e620e5b49", "parentControlId": 31600, "controlId": "D2", "title": "D2", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586779" }, { "id": 583517, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586779", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84ab207a-1007-5160-82e3-93e55b0bfa36", "parentControlId": 31600, "controlId": "D2.a", "title": "D2.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586779" }, { "id": 583518, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "392bbc85-9781-546d-a131-407913d9cd43", "parentControlId": 31600, "controlId": "D2.b", "title": "D2.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58678" }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "71f2f6bc-5514-541a-9f60-79c4f7c03754", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "0fbc2a4d-d5fb-5f98-b64a-94b09906d690", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "e95b5d57-e436-5d56-812e-0e86d5a95512", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "b2415474-b837-566a-b684-cae22813724f", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "fbdbf305-6175-5a5c-95b6-2baeaae54e64", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "42c8f6b7-b080-542e-93a3-6bc47fde3fcc", "isPublic": true } ], "id": 31600, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731174", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731174", "catalogueId": 1062, "uuid": "c7eba700-1aa7-5413-976d-cff827bd2ae4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization incorporate lessons learned from analyzing and resolving cybersecurity and data protection incidents to reduce the likelihood or impact of future incidents?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Root Cause Analysis (RCA) & Lessons Learned", "description": "

Control Description

Mechanisms exist to incorporate lessons learned from analyzing and resolving cybersecurity and data protection incidents to reduce the likelihood or impact of future incidents.

Evidence Request List (ERL)

E-IRO-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ Incident responders provide After Action Review (AAR) feedback on what worked, what did not work and ways to improve future responses to similar incidents.\n▪ A formal Root Cause Analysis (RCA) is performed that documents the findings in a report for both technical and business leadership management.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to incorporate lessons learned from analyzing and resolving cybersecurity and data protection incidents to reduce the likelihood or impact of future incidents.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-13", "family": "Incident Response", "enhancements": "", "sortId": "IRO-13", "references": "

Micro-Small Business (<10 staff)

∙ Root Cause Analysis (RCA)

Small Business (10-49 staff)

∙ Root Cause Analysis (RCA)

Medium Business (50-249 staff)

∙ Root Cause Analysis (RCA)

Large Business (250-999 staff)

∙ Root Cause Analysis (RCA)

Enterprise (>1,000 staff)

∙ Root Cause Analysis (RCA)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72273, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59072", "securityControlId": 31601, "ccis": [], "uuid": "cce939ca-176b-5d83-ad0e-c01e293d3f1d", "testId": "IRO-14_A01", "test": "time period for personnel to report suspected incidents to the organizational incident response capability is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-06_ODP[01]", "defaultText": null }, { "id": 72274, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59072", "securityControlId": 31601, "ccis": [], "uuid": "e3183f13-368c-527d-a8f7-566c3a78f239", "testId": "IRO-14_A02", "test": "authorities to whom incident information is to be reported are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-06_ODP[02]\n171A_R3_A.03.06.02.ODP[02]", "defaultText": null }, { "id": 72275, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59072", "securityControlId": 31601, "ccis": [], "uuid": "0efdcc0a-5d79-55ba-aab9-f6dde0aec57f", "testId": "IRO-14_A03", "test": "personnel are required to report suspected incidents to the organizational incident response capability within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: without delay", "otherId": "53A_R5_IR-06a.", "defaultText": null }, { "id": 72276, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59072", "securityControlId": 31601, "ccis": [], "uuid": "44082c46-8759-582b-901c-9f3c286b2436", "testId": "IRO-14_A04", "test": "incident information is reported to authorities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-06b.", "defaultText": null } ], "externalMappings": [ { "id": 583557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c03e34e4-d594-5211-b342-013a07b30c26", "parentControlId": 31601, "controlId": "IR-6", "title": "IR-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586784" }, { "id": 583558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dad6b8d4-fe37-5725-9984-354d047d938a", "parentControlId": 31601, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586784" }, { "id": 583560, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afcd3909-22b8-5398-a4ad-184feb6c0e0a", "parentControlId": 31601, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586784" }, { "id": 583561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc67da69-04e8-518e-b392-ce21fc9302f8", "parentControlId": 31601, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586784" }, { "id": 583562, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc5f7f64-0d0b-5571-89b7-dfbbc030d60a", "parentControlId": 31601, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586784" }, { "id": 583563, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586785", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "799077a1-be12-5200-92e1-97546ba80937", "parentControlId": 31601, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586785" }, { "id": 583564, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586785", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb5382b6-d5f2-5391-a427-2ad19706b1f5", "parentControlId": 31601, "controlId": "IR-06", "title": "IR-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586785" }, { "id": 583565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586785", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d8c7099-8a69-560b-9ee7-4ddae9074de6", "parentControlId": 31601, "controlId": "IR-6", "title": "IR-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586785" }, { "id": 583566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586785", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1188b03c-8d14-5f26-92d2-861c6c1f2c36", "parentControlId": 31601, "controlId": "03.06.02.c", "title": "03.06.02.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586785" }, { "controlId": "C.8.6", "title": "C.8.6 — Incident Reporting", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "8b19d256-329d-58eb-aabb-019dcfe956c4", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.6 / RG 5.83 Rev 1", "title": "NEI 08-09 App E.8.6 / RG 5.83 Rev 1 — Incident Reporting", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "350082a4-cf4e-51e7-b764-30d206d5b327", "isPublic": true }, { "controlId": "10 CFR 73.77 (1/4/8-hr Reporting)", "title": "10 CFR 73.77 (1/4/8-hr Reporting) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "df4ba896-1da3-5d6a-8784-c49994a94b36", "isPublic": true }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "3fb23c0c-46ba-582c-aae1-adcb28bcfa7c", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "44d1cddf-17f2-522d-9e74-0d045bcacd74", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "c883932d-82ac-5d83-82e1-b2816708dbca", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "5bc81311-4282-541f-9e10-94d0a4682c1c", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "c5de1426-c711-5f24-b307-8522c280bfcb", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "a9753c58-e637-550b-b5af-f1372fc6992f", "isPublic": true } ], "id": 31601, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731174", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731174", "catalogueId": 1062, "uuid": "188bdbf0-1aa2-59be-89e3-e5bdfc1b6742", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain incident response contacts with applicable regulatory and law enforcement agencies?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Regulatory & Law Enforcement Contacts", "description": "

Control Description

Mechanisms exist to maintain incident response contacts with applicable regulatory and law enforcement agencies.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain incident response contacts with applicable regulatory and law enforcement agencies.

Level 4 - Quantitatively Controlled: Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.8.6", "controlId": "IRO-14", "family": "Incident Response", "enhancements": "", "sortId": "IRO-14", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72277, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590721", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590721", "securityControlId": 31602, "ccis": [], "uuid": "00406ebf-27e3-5fe5-b554-6661df13178d", "testId": "IRO-15_A01", "test": "the system, system component or location where a detonation chamber capability is to be employed is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-44_ODP", "defaultText": null }, { "id": 72278, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590721", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590721", "securityControlId": 31602, "ccis": [], "uuid": "7e0302ad-cc36-5551-9dcb-58690e2d92bc", "testId": "IRO-15_A02", "test": "a detonation chamber capability is employed within the organization-defined system, system component or location.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-44", "defaultText": null } ], "externalMappings": [ { "id": 583593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586788", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9983562-7b67-561c-8848-66343262d6e0", "parentControlId": 31602, "controlId": "T1137", "title": "T1137", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586788" }, { "id": 583594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586788", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6fc8c64-db42-549e-9a92-2d48bc94238f", "parentControlId": 31602, "controlId": "T1137.001", "title": "T1137.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586788" }, { "id": 583595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586788", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb5b6ec6-30b7-5bbc-a12c-abad3e37c83c", "parentControlId": 31602, "controlId": "T1137.002", "title": "T1137.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586788" }, { "id": 583596, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586788", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b6c7d5f-8b91-55d8-a7ad-fe5b59e55a56", "parentControlId": 31602, "controlId": "T1137.003", "title": "T1137.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586788" }, { "id": 583597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586788", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a0ab2fe-2a30-5f4f-8869-7eaa2084fb30", "parentControlId": 31602, "controlId": "T1137.004", "title": "T1137.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586788" }, { "id": 583598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586789", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "618ae2b5-1def-5c6a-80a9-ff76ddb326d2", "parentControlId": 31602, "controlId": "T1137.005", "title": "T1137.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586789" }, { "id": 583599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586789", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be03a925-366c-515c-b2bc-20949b45451b", "parentControlId": 31602, "controlId": "T1137.006", "title": "T1137.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586789" }, { "id": 583600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586789", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7009ed15-d3ff-54ed-83cc-a0d323421336", "parentControlId": 31602, "controlId": "T1203", "title": "T1203", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586789" }, { "id": 583601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586789", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86b85775-ed1c-5131-b274-70158135854d", "parentControlId": 31602, "controlId": "T1204", "title": "T1204", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586789" }, { "id": 583602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586789", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6eea29c6-12b3-5c1e-87cf-9028479ac0ed", "parentControlId": 31602, "controlId": "T1204.001", "title": "T1204.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586789" }, { "id": 583603, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586789", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd995ad0-dc88-5c4f-828d-615e4d53baba", "parentControlId": 31602, "controlId": "T1204.002", "title": "T1204.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586789" }, { "id": 583604, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586789", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af66854c-d124-595d-9a3e-14761ef2d16d", "parentControlId": 31602, "controlId": "T1204.003", "title": "T1204.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586789" }, { "id": 583605, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586789", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d203ccf-84b2-5a0d-b614-0a41b295bdd2", "parentControlId": 31602, "controlId": "T1221", "title": "T1221", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586789" }, { "id": 583606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586789", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e222735-8995-50fe-8e4b-7fe31123b3d0", "parentControlId": 31602, "controlId": "T1564.009", "title": "T1564.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586789" }, { "id": 583607, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586789", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8773e452-08c7-549f-9866-8b818124299d", "parentControlId": 31602, "controlId": "T1566", "title": "T1566", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58679" }, { "id": 583608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a7670be-1a3f-5fc6-80c4-54ea4203d633", "parentControlId": 31602, "controlId": "T1566.001", "title": "T1566.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58679" }, { "id": 583609, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa187a6c-8123-5b99-8ed5-27facbbf70b0", "parentControlId": 31602, "controlId": "T1566.002", "title": "T1566.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58679" }, { "id": 583610, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c30e29a-9dbb-5574-be4e-c8f8be2c7d99", "parentControlId": 31602, "controlId": "T1566.003", "title": "T1566.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58679" }, { "id": 583611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "840266d7-4b97-5697-89be-7fc01c6ac0d1", "parentControlId": 31602, "controlId": "T1598", "title": "T1598", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58679" }, { "id": 583612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb0a68cd-8f7e-5964-9af1-4cfe9dd3b029", "parentControlId": 31602, "controlId": "T1598.001", "title": "T1598.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58679" }, { "id": 583613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c989845-c2c0-507c-a13a-cbacd2778598", "parentControlId": 31602, "controlId": "T1598.002", "title": "T1598.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58679" }, { "id": 583614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8e785c2-9e5d-5f90-adb5-28179f0ce801", "parentControlId": 31602, "controlId": "T1598.003", "title": "T1598.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58679" }, { "id": 583615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e92ac1a-01ea-5586-adf0-afb74659d98c", "parentControlId": 31602, "controlId": "SC-44", "title": "SC-44", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58679" }, { "id": 583616, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b6ed45a-b9be-5500-bd20-73869f5b6f73", "parentControlId": 31602, "controlId": "SC-44", "title": "SC-44", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586791" }, { "id": 583617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39c705fc-8fb5-5822-8064-f4868a83f8b3", "parentControlId": 31602, "controlId": "SC-44", "title": "SC-44", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586791" }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "463708aa-4771-5f75-b70b-3e41353d6cc2", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "2de9d84f-365d-5b28-9777-a4b01c230ffd", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "facc3f3a-8f6d-54d5-a2ff-16f83d3a70ad", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "e0a588e2-f401-5243-8a82-dbdc8c8fcec0", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "85f3a7d8-60d5-5707-92a3-988648330fd1", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "31f93afa-363b-58b0-a85f-d2e018d42723", "isPublic": true } ], "id": 31602, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731174", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731174", "catalogueId": 1062, "uuid": "56f8b7a6-9936-5622-8369-90e4613a3236", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize a detonation chamber capability to detect and/or block potentially-malicious files and email attachments?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Detonation Chambers (Sandboxes)", "description": "

Control Description

Mechanisms exist to utilize a detonation chamber capability to detect and/or block potentially-malicious files and email attachments.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize a detonation chamber capability to detect and/or block potentially-malicious files and email attachments.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-15", "family": "Incident Response", "enhancements": "", "sortId": "IRO-15", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72279, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590721", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590721", "securityControlId": 31603, "ccis": [], "uuid": "63b27b76-c6f8-55ed-bac1-3677a8bd5c4a", "testId": "IRO-16_A01", "test": "public relations associated with an incident are managed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(15)(a)", "defaultText": null }, { "id": 72280, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590721", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590721", "securityControlId": 31603, "ccis": [], "uuid": "404526c5-3ec7-5285-8189-ea1736661d76", "testId": "IRO-16_A02", "test": "measures are employed to repair the reputation of the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(15)(b)", "defaultText": null } ], "externalMappings": [ { "id": 583634, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586793", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb30af91-7fd3-525b-8e2c-3cf68b2b69d8", "parentControlId": 31603, "controlId": "IR-04(15)", "title": "IR-04(15)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586793" }, { "id": 583635, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586793", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "302266f0-5a38-5a00-97cd-cc1c7fb732f2", "parentControlId": 31603, "controlId": "IR-04(15)", "title": "IR-04(15)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586793" }, { "id": 583636, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586793", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b26fb3a4-78a5-5087-908c-c92625312837", "parentControlId": 31603, "controlId": "RC.CO-04", "title": "RC.CO-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586793" }, { "controlId": "NSS-17T-Sec4.7", "title": "NSS-17T-Sec4.7 — Computer Security Incident Response & Nuclear Emergency Coordination", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "c8468396-1bd6-596a-b123-fa86ff93be6c", "isPublic": true }, { "controlId": "IEC-62645-8.4", "title": "IEC-62645-8.4 — Incident Handling and Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "8b962d45-7f97-5460-87f7-2183ca138c9b", "isPublic": true }, { "controlId": "IEC-63096-16.1", "title": "IEC-63096-16.1 — Management of Computer Security Incidents & Improvements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "73fac01e-f366-5451-b9f6-1b7f8d4e2a82", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.d", "title": "DOE-O-205.1D-4.d — Incident Management and Cyber Event Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "94b4a1e4-0ff8-521e-b981-47296765f2f1", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "853fe74d-6abb-5a59-8143-7a582be5c6a3", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP10", "title": "ONR-SyAP-FSyP10 — Emergency Preparedness and Incident Response", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IRO Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "e384f4f5-df3c-5043-a09a-bf2a9ee9051d", "isPublic": true } ], "id": 31603, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731175", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731175", "catalogueId": 1062, "uuid": "89170721-d83a-5495-accd-14ebb351e674", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization proactively manage public relations associated with incidents and employ appropriate measures to prevent further reputational damage and develop plans to repair any damage to its reputation?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 6.0, "title": "Public Relations & Reputation Repair", "description": "

Control Description

Mechanisms exist to proactively manage public relations associated with incidents and employ appropriate measures to prevent further reputational damage and develop plans to repair any damage to the organization's reputation.

Evidence Request List (ERL)

E-IRO-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Incident Response (IRO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IRO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Incident response-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 2 - Planned & Tracked: Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 - Well Defined: Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.\n▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to proactively manage public relations associated with incidents and employ appropriate measures to prevent further reputational damage and develop plans to repair any damage to the organization's reputation.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IRO-16", "family": "Incident Response", "enhancements": "", "sortId": "IRO-16", "references": "

Micro-Small Business (<10 staff)

∙ Basic incident response plan\n∙ Designate incident response contact

Small Business (10-49 staff)

∙ Documented incident response plan\n∙ Incident log\n∙ Designated IR team

Medium Business (50-249 staff)

∙ Formal incident response program\n∙ IR playbooks\n∙ Tabletop exercises

Large Business (250-999 staff)

∙ Enterprise incident response program\n∙ 24/7 SOC monitoring\n∙ SOAR platform

Enterprise (>1,000 staff)

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)\n∙ IR retainer\n∙ Threat hunting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72281, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590722", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590722", "securityControlId": 31604, "ccis": [], "uuid": "ac94dfc2-1374-50a6-b528-a067f2a8ecf9", "testId": "IAO-01_A01", "test": "an Information Assurance (IA) process is implemented for conducting cybersecurity / data privacy testing, training and monitoring activities associated with systems, applications and services.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created\n53A_R5_PM-14a.01[01]\n53A_R5_PM-14a.01[02]\n53A_R5_PM-14a.01[03]\n53A_R5_PM-14a.01[04]\n53A_R5_PM-14a.02[01]\n53A_R5_PM-14a.02[02]", "defaultText": null }, { "id": 72282, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590722", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590722", "securityControlId": 31604, "ccis": [], "uuid": "55d31b9d-2596-5a81-b5dc-07c3b2238871", "testId": "IAO-01_A02", "test": "the Information Assurance (IA) program is organization-wide.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-01_ODP[03]", "defaultText": null }, { "id": 72283, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590722", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590722", "securityControlId": 31604, "ccis": [], "uuid": "650a1857-fe71-5a77-99b2-25d850395218", "testId": "IAO-01_A03", "test": "the authorization processes are integrated into an organization-wide Risk Management Program (RMP).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-10c.", "defaultText": null }, { "id": 72284, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590723", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590723", "securityControlId": 31604, "ccis": [], "uuid": "99b670d5-783d-55e3-bbb5-b9dcfa4edbfa", "testId": "IAO-01_A04", "test": "the cybersecurity / data privacy security state of organizational systems and the environments in which those systems operate are managed through authorization processes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-10a.[01]\n53A_R5_PM-10a.[02]", "defaultText": null }, { "id": 72285, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590723", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590723", "securityControlId": 31604, "ccis": [], "uuid": "dc5d6dff-ec31-59e3-bbe5-e4897595d65e", "testId": "IAO-01_A05", "test": "individuals are designated to fulfill specific roles and responsibilities within the organizational risk management process.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-10b.", "defaultText": null }, { "id": 72286, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590723", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590723", "securityControlId": 31604, "ccis": [], "uuid": "1424469d-2cd3-50e7-95ff-efc056b9746e", "testId": "IAO-01_A06", "test": "information assurance management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72287, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590731", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590731", "securityControlId": 31604, "ccis": [], "uuid": "d071c563-233f-5eed-ac4f-d16c7acd249f", "testId": "IAO-01_A07", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support information assurance management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72288, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590732", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590732", "securityControlId": 31604, "ccis": [], "uuid": "e8a45ab7-3e60-536c-9587-3b4d613273de", "testId": "IAO-01_A08", "test": "responsibility and authority for the performance of information assurance management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72289, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590732", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590732", "securityControlId": 31604, "ccis": [], "uuid": "5cba2f14-a856-58c7-a6ba-6f34dc8a2187", "testId": "IAO-01_A09", "test": "personnel performing information assurance management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 583658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586796", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59cddce6-b57e-577c-9c25-2298e4ec324b", "parentControlId": 31604, "controlId": "ORG 2.4", "title": "ORG 2.4", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586796" }, { "id": 583668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86d895a8-7e90-5431-92b6-320f150849e6", "parentControlId": 31604, "controlId": "5.21", "title": "5.21", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586798" }, { "id": 583676, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c72cd03-81c5-5cb7-a485-20f222d2aebe", "parentControlId": 31604, "controlId": "CA-1", "title": "CA-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586799" }, { "id": 583677, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60966871-d167-5d5c-a42b-b82017b10e3d", "parentControlId": 31604, "controlId": "PM-10", "title": "PM-10", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586799" }, { "id": 583678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a17904b-e9af-568d-a71a-a449c3565f2d", "parentControlId": 31604, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586799" }, { "id": 583679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa2cd4a8-f8ec-5a8c-87ba-c863841bc783", "parentControlId": 31604, "controlId": "PM-10", "title": "PM-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5868" }, { "id": 583682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56da20f5-88ae-53e9-b14e-ee4476d3432a", "parentControlId": 31604, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5868" }, { "id": 583683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2182df43-0b08-5180-bde6-7c5d489cb571", "parentControlId": 31604, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5868" }, { "id": 583684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f5dbdf0-f528-570f-b3ec-a431ba4caab4", "parentControlId": 31604, "controlId": "PM-10", "title": "PM-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5868" }, { "id": 583685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35513fb6-6113-5f91-ab42-deb859635858", "parentControlId": 31604, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5868" }, { "id": 583686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e0b7773-b0e4-57de-a2b4-86e9b77e1b21", "parentControlId": 31604, "controlId": "PM-10", "title": "PM-10", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5868" }, { "id": 583687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b676e8c6-232f-5fb6-893a-573d6fa8ebae", "parentControlId": 31604, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5868" }, { "id": 583688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3a2c14a-b722-57d8-8b9c-04a90d77b9fb", "parentControlId": 31604, "controlId": "PM-10", "title": "PM-10", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5868" }, { "id": 583689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a876ea08-7a63-5a38-9d76-57611175f744", "parentControlId": 31604, "controlId": "CA-01", "title": "CA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586801" }, { "id": 583690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da8f7cc7-66c6-53b9-af40-4deb815f1e78", "parentControlId": 31604, "controlId": "PM-10", "title": "PM-10", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586801" }, { "id": 583691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d4a03a6-dfe8-5cb5-ba15-dd1badb56647", "parentControlId": 31604, "controlId": "CA-1", "title": "CA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586801" }, { "id": 583692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bff4a62c-d2ea-511e-9bee-3fcf82051371", "parentControlId": 31604, "controlId": "PM-10", "title": "PM-10", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586801" }, { "id": 583693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0947e661-0df7-55b0-bcd2-7f7930afcb67", "parentControlId": 31604, "controlId": "CA-1", "title": "CA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586801" }, { "id": 583699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b63763e1-7ffb-5423-9b86-e5beeb8b4bb7", "parentControlId": 31604, "controlId": "NFO - CA-1", "title": "NFO - CA-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586802" }, { "id": 583700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07e2d3f1-72da-5023-b8c8-8b681fe276ef", "parentControlId": 31604, "controlId": "03.12.01", "title": "03.12.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586802" }, { "id": 583701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9f71a61-cd61-5e27-bd17-c88533967a88", "parentControlId": 31604, "controlId": "ID.RA-01", "title": "ID.RA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586802" }, { "id": 583710, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "856c81e5-722b-5039-990a-76ad38b503dc", "parentControlId": 31604, "controlId": "RISK-4c", "title": "RISK-4c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586804" }, { "id": 583731, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba440e63-36b4-533c-a111-bed3ce41b199", "parentControlId": 31604, "controlId": "11-3.a(4)(a)", "title": "11-3.a(4)(a)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586815" }, { "controlId": "A.3.1.1", "title": "A.3.1.1 — Security Assessment and Authorization", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-1, PL-1, PM-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "d7fb1d1a-d1c1-5d73-ac5b-604687b41c8b", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.1", "title": "NEI 08-09 Sec 3.1.1 — Security Assessment and Authorization", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e1adbc40-9842-5520-830e-66a74f3eef24", "isPublic": true }, { "controlId": "10 CFR 73.54(b)(2)", "title": "10 CFR 73.54(b)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "e1af0405-389f-567e-ae58-1e4652f26ac4", "isPublic": true }, { "controlId": "NSS-17T-Sec4.9", "title": "NSS-17T-Sec4.9 — Periodic Computer Security Review, Walkdowns & Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "578576bc-f4c2-5c50-bdca-e52861583c80", "isPublic": true }, { "controlId": "IEC-62645-5.4", "title": "IEC-62645-5.4 — Independent Computer Security Assessment and Audit", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "672fa7be-74ed-5c8e-863f-8a36bb587f6c", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.f", "title": "DOE-O-205.1D-4.f — Authorization to Operate (ATO) and Continuous Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "f0179460-ca68-5059-ba33-7f31f98f6eec", "isPublic": true } ], "id": 31604, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731175", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731175", "catalogueId": 1062, "uuid": "cdca5912-eef4-57b8-858e-4f9fe234d598", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of security, compliance and resilience assessment and authorization controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Information Assurance (IA) Operations", "description": "

Control Description

Mechanisms exist to facilitate the implementation of security, compliance and resilience assessment and authorization controls.

Evidence Request List (ERL)

E-IAO-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Information Assurance (IAO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Pre-production security testing-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain an informal process to conduct limited control testing of High Value Assets (HVAs) to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.

Level 2 - Planned & Tracked: Information Assurance (IAO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Information Assurance (IA)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ IA management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.\n▪ IAP operations focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel coordinate IAP activities with affected stakeholders before conducting such activities in order to reduce the potential impact on operations.

Level 3 - Well Defined: Information Assurance (IAO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are well-documented and kept current by process owners.\n▪ An information assurance team, or similar function, is appropriately staffed and supported to implement and maintain IAO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of information assurance operations (e.g., assessment scheduling software, risk assessment software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of security, compliance and resilience assessment and authorization controls.

Level 4 - Quantitatively Controlled: Information Assurance (IAO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.1", "controlId": "IAO-01", "family": "Information Assurance", "enhancements": "", "sortId": "IAO-01", "references": "

Micro-Small Business (<10 staff)

∙ Controls Validation Testing (CVT)

Small Business (10-49 staff)

∙ Controls Validation Testing (CVT)

Medium Business (50-249 staff)

∙ Controls Validation Testing (CVT)\n∙ Information Assurance (IA) program\n∙ VisibleOps security management

Large Business (250-999 staff)

∙ Controls Validation Testing (CVT)\n∙ Information Assurance (IA) program\n∙ VisibleOps security management

Enterprise (>1,000 staff)

∙ Controls Validation Testing (CVT)\n∙ Information Assurance (IA) program\n∙ VisibleOps security management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72290, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590732", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590732", "securityControlId": 31605, "ccis": [], "uuid": "dfeed438-6227-5b62-b9d0-bce35b8550f9", "testId": "IAO-01.1_A01", "test": "assessments are defined as (1) organization-level, (2) mission/business process-level, or (3) system/application/service-level.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-01_ODP[03]\n53A_R5_AT-01_ODP[03]\n53A_R5_AU-01_ODP[03]\n53A_R5_CA-01_ODP[03]\n53A_R5_CM-01_ODP[03]\n53A_R5_CP-01_ODP[03]\n53A_R5_IA-01_ODP[03]\n53A_R5_IR-01_ODP[03]\n53A_R5_MA-01_ODP[03]\n53A_R5_MP-01_ODP[03]\n53A_R5_PE-01_ODP[03]\n53A_R5_PL-01_ODP[03]\n53A_R5_PS-01_ODP[03]\n53A_R5_PT-01_ODP[03]\n53A_R5_RA-01_ODP[03]\n53A_R5_SA-01_ODP[03]\n53A_R5_SC-01_ODP[03]\n53A_R5_SI-01_ODP[03]\n53A_R5_SR-01_ODP[03]", "defaultText": null }, { "id": 72291, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590732", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590733", "securityControlId": 31605, "ccis": [], "uuid": "58eab91f-a0ed-5a78-8902-7ad592090a5b", "testId": "IAO-01.1_A02", "test": "the scope of assessments is established by defining the assessment boundary, according to people, processes and technology that directly or indirectly impact the confidentiality, integrity, availability and safety of the data and systems under review.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.3e_ODP[1]", "defaultText": null } ], "externalMappings": [ { "id": 583835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f93c5c8-52be-50a0-9795-cb17a8fea8fa", "parentControlId": 31605, "controlId": "03.12.01", "title": "03.12.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586833" } ], "id": 31605, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731176", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731176", "catalogueId": 1062, "uuid": "72c02451-706e-5dc9-8ebf-8dfb80c69fd1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish the scope of assessments by defining the assessment boundary, according to people, processes and technology that directly or indirectly impact the confidentiality, integrity, availability and safety of the Technology Assets, Applications, Services and/or Data (TAASD) under review?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Assessment Boundaries", "description": "

Control Description

Mechanisms exist to establish the scope of assessments by defining the assessment boundary, according to people, processes and technology that directly or indirectly impact the confidentiality, integrity, availability and safety of the Technology Assets, Applications, Services and/or Data (TAASD) under review.

Evidence Request List (ERL)

E-AST-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Information Assurance (IAO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Pre-production security testing-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain an informal process to conduct limited control testing of High Value Assets (HVAs) to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.

Level 2 - Planned & Tracked: Information Assurance (IAO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Information Assurance (IA)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ IA management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.\n▪ IAP operations focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Information Assurance (IAO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are well-documented and kept current by process owners.\n▪ An information assurance team, or similar function, is appropriately staffed and supported to implement and maintain IAO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of information assurance operations (e.g., assessment scheduling software, risk assessment software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to establish the scope of assessments by defining the assessment boundary, according to people, processes and technology that directly or indirectly impact the confidentiality, integrity, availability and safety of the TAASD under review.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAO-01.1", "family": "Information Assurance", "enhancements": "", "sortId": "IAO-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Document security assurance requirements for critical systems

Small Business (10-49 staff)

∙ Security assurance checklist for critical systems

Medium Business (50-249 staff)

∙ Formal information assurance program\n∙ Security testing and validation

Large Business (250-999 staff)

∙ Enterprise information assurance program\n∙ Independent security testing

Enterprise (>1,000 staff)

∙ Enterprise IA program\n∙ Formal evaluation (e.g., Common Criteria, FedRAMP)\n∙ Continuous assurance monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72292, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590733", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590733", "securityControlId": 31606, "ccis": [], "uuid": "8da34d7b-eb6e-5e92-a4c6-3b06b9ee17d1", "testId": "IAO-02_A01", "test": "the frequency at which to assess controls in the system and its environment of operation is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-02_ODP[01]", "defaultText": null }, { "id": 72293, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590733", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590733", "securityControlId": 31606, "ccis": [], "uuid": "db7a7693-109f-58ff-acf2-0ccc5890a0b2", "testId": "IAO-02_A02", "test": "individuals or roles to whom control assessment results are to be provided are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02_ODP[02]", "defaultText": null }, { "id": 72294, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590733", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590733", "securityControlId": 31606, "ccis": [], "uuid": "6e6e3de3-9399-5f72-91a3-f287569f8a8e", "testId": "IAO-02_A03", "test": "an appropriate assessor or assessment team is selected for the type of assessment to be conducted.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02a.", "defaultText": null }, { "id": 72295, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590734", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590734", "securityControlId": 31606, "ccis": [], "uuid": "fba7bf41-d9af-508a-9a3e-92d7e2026b26", "testId": "IAO-02_A04", "test": "a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02b.01", "defaultText": null }, { "id": 72296, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590734", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590734", "securityControlId": 31606, "ccis": [], "uuid": "833c40b2-e9b8-5af5-9a7e-4de5a2006c19", "testId": "IAO-02_A05", "test": "a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02b.02", "defaultText": null }, { "id": 72297, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590734", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590734", "securityControlId": 31606, "ccis": [], "uuid": "6eb52820-a356-5d72-ac29-7922229250f5", "testId": "IAO-02_A06", "test": "a control assessment plan is developed that describes the scope of the assessment, including the assessment environment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02b.03[01]", "defaultText": null }, { "id": 72298, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590734", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590734", "securityControlId": 31606, "ccis": [], "uuid": "cbe65dc0-757e-5248-9557-323733d05d0a", "testId": "IAO-02_A07", "test": "a control assessment plan is developed that describes the scope of the assessment, including the assessment team.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02b.03[02]", "defaultText": null }, { "id": 72299, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590734", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590734", "securityControlId": 31606, "ccis": [], "uuid": "abdbb458-ef59-5bfd-9a11-a15df0bcef7a", "testId": "IAO-02_A08", "test": "a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02b.03[03]", "defaultText": null }, { "id": 72300, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590734", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590734", "securityControlId": 31606, "ccis": [], "uuid": "8330a691-bd3c-5f51-a15b-39dd9ff6aa8d", "testId": "IAO-02_A09", "test": "the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02c.", "defaultText": null }, { "id": 72301, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590734", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590734", "securityControlId": 31606, "ccis": [], "uuid": "b2cd7885-5146-54cc-afad-f1b1215a24f7", "testId": "IAO-02_A10", "test": "security critical or essential software, firmware and hardware components for which to verify correctness are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.7e_ODP[1]\n172A_3.14.7e_ODP[2]\n172A_3.14.7e_ODP[3]", "defaultText": null }, { "id": 72302, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590734", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590734", "securityControlId": 31606, "ccis": [], "uuid": "1a647dcf-13fc-53ba-9bd7-c35bd2ce2c96", "testId": "IAO-02_A11", "test": "verification methods or techniques are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.7e_ODP[4]", "defaultText": null }, { "id": 72303, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590735", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590735", "securityControlId": 31606, "ccis": [], "uuid": "3c26e92f-4a79-58fd-935a-8a361f2ee864", "testId": "IAO-02_A12", "test": "the correctness of security critical or essential software, firmware and hardware components is verified using verification methods or techniques.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.7e[a]\n172A_3.14.7e[b]\n172A_3.14.7e[c]", "defaultText": null }, { "id": 72304, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590735", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590735", "securityControlId": 31606, "ccis": [], "uuid": "b9d8df67-329a-5f34-84e6-03a9fc5edf9b", "testId": "IAO-02_A13", "test": "controls are assessed in the system and its environment of operation per an assessment frequency to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting established security requirements.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-02d.[01]", "defaultText": null }, { "id": 72305, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590735", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590735", "securityControlId": 31606, "ccis": [], "uuid": "1b4e3945-44ea-581b-aaa1-51f02f00ddc4", "testId": "IAO-02_A14", "test": "controls are assessed in the system and its environment of operation per an assessment frequency to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting established privacy requirements.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-02d.[02]", "defaultText": null }, { "id": 72306, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590735", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590735", "securityControlId": 31606, "ccis": [], "uuid": "db12add4-59ba-5db3-ba0a-8a9d5af3b0ac", "testId": "IAO-02_A15", "test": "a control assessment report is produced that documents the results of the assessment.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02e.", "defaultText": null }, { "id": 72307, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590735", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590735", "securityControlId": 31606, "ccis": [], "uuid": "508ea539-d149-5d90-a9dd-b380288ef20e", "testId": "IAO-02_A16", "test": "the results of the control assessment are provided to individuals or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02f.", "defaultText": null } ], "externalMappings": [ { "id": 583867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ae491d8-8bbc-5817-8b5f-9a864f10a3db", "parentControlId": 31606, "controlId": "ORG 2.4(a)", "title": "ORG 2.4(a)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586839" }, { "id": 583897, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da11014a-2d82-560d-be8c-9d9bf534492d", "parentControlId": 31606, "controlId": "5.21", "title": "5.21", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586842" }, { "id": 583898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb9bf008-d0b7-5a17-8643-71b268565d75", "parentControlId": 31606, "controlId": "5.23", "title": "5.23", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586842" }, { "id": 583899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63ed8201-8a87-550a-bfb0-159b1b070fc4", "parentControlId": 31606, "controlId": "8.29", "title": "8.29", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586842" }, { "id": 583906, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "127f7bf5-22b5-5bd0-8215-4286285e2e4a", "parentControlId": 31606, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586843" }, { "id": 583907, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74b52c0e-3e8e-54eb-900e-2379ec919094", "parentControlId": 31606, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586843" }, { "id": 583908, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8be0c7bc-e3d0-5841-83ae-0afa44f4c695", "parentControlId": 31606, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586843" }, { "id": 583909, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586845", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "228be0fb-873f-589f-9460-477804c4e276", "parentControlId": 31606, "controlId": "T1195.002", "title": "T1195.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586845" }, { "id": 583910, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586845", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70986def-8d18-5e72-8306-0aedbbe4d275", "parentControlId": 31606, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586845" }, { "id": 583916, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ea110c3-2dac-5e09-8cf7-89b08eb8744d", "parentControlId": 31606, "controlId": "CA-2", "title": "CA-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586846" }, { "id": 583917, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "114ec3a0-d94e-5d14-b339-20c72d435c28", "parentControlId": 31606, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586846" }, { "id": 583919, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "072d18d4-f91f-57eb-a720-14e2961b11d6", "parentControlId": 31606, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586846" }, { "id": 583921, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02af367c-4cf7-5bdc-8a36-ec6eead1ba06", "parentControlId": 31606, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586846" }, { "id": 583922, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "457b1323-5c0d-5464-b013-a2ab1da34a01", "parentControlId": 31606, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586846" }, { "id": 583923, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586846", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5b7894f-7b84-532d-87d1-5439f3cdb868", "parentControlId": 31606, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586846" }, { "id": 583924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5dd54bf2-af95-50fe-8a88-89424444ddb6", "parentControlId": 31606, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586847" }, { "id": 583925, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "426b31d6-117b-502d-8817-66deb10428ad", "parentControlId": 31606, "controlId": "CA-2", "title": "CA-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586847" }, { "id": 583926, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f70bc857-b33f-53e9-a073-d10b107d737d", "parentControlId": 31606, "controlId": "CA-2", "title": "CA-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586847" }, { "id": 583929, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a19f1f7-7796-5287-a4e5-16652637caa9", "parentControlId": 31606, "controlId": "3.12.1", "title": "3.12.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586847" }, { "id": 583930, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10811258-8cb3-5ff3-b745-b0cc2cd6f42a", "parentControlId": 31606, "controlId": "03.12.01", "title": "03.12.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586847" }, { "id": 583931, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45b6bf45-f1a3-5727-958d-80360a3e8d05", "parentControlId": 31606, "controlId": "ID.RA-01", "title": "ID.RA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586847" }, { "id": 583932, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586847", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac12f482-97c6-54b7-b7d2-3a2c34a3407c", "parentControlId": 31606, "controlId": "ID.IM-01", "title": "ID.IM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586847" }, { "id": 583933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586848", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c82a78b-cf74-564c-9f7e-305361605cb0", "parentControlId": 31606, "controlId": "ID.IM-02", "title": "ID.IM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586848" }, { "id": 583940, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586848", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfafecba-16d5-5ae0-820f-63431129f20f", "parentControlId": 31606, "controlId": "RISK-4d", "title": "RISK-4d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586848" }, { "id": 583962, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586852", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "598096b0-c271-5db9-ab6f-738367abcbb3", "parentControlId": 31606, "controlId": "11-3.a(4)(b)", "title": "11-3.a(4)(b)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586852" }, { "id": 583963, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586852", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ff9a45b-4b0e-5401-9a21-6421dbcb1cd9", "parentControlId": 31606, "controlId": "11-3.a(4)(c)", "title": "11-3.a(4)(c)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586852" }, { "controlId": "A.3.1.4", "title": "A.3.1.4 — Reviews and Validation Testing", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, CA-7, RA-5, SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "03c34f2c-bce3-5ed7-a28e-ec96f52e473d", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.4", "title": "NEI 08-09 Sec 3.1.4 — Reviews and Validation Testing", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "b86ed278-2693-570b-b6c9-4600f62f73a6", "isPublic": true }, { "controlId": "10 CFR 73.54(b)(1), (c)(2)", "title": "10 CFR 73.54(b)(1), (c)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "42b0efa1-39ee-5f17-9843-59a70b5fb9d7", "isPublic": true }, { "controlId": "A.3.1.6", "title": "A.3.1.6 — Application of Security Controls", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PL-2, CA-2, RA-3, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1baa3b6c-09f6-5563-9f27-6c362d27e44f", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.6", "title": "NEI 08-09 Sec 3.1.6 — Application of Security Controls", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "7796a221-e6ae-53f7-879b-bfece83844df", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1), (a)(2)", "title": "10 CFR 73.54(c)(1), (a)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "64f025b5-ea6b-5689-abac-9484a3b8c187", "isPublic": true }, { "controlId": "A.4.1.1", "title": "A.4.1.1 — Periodic Assessment of Security Controls", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, CA-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "e3c6d449-c4d4-5569-b6bc-945e3020aa06", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.1.1", "title": "NEI 08-09 Sec 4.1.1 — Periodic Assessment of Security Controls", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.1.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "016439c7-f752-5e73-ac41-6371fd26ac57", "isPublic": true }, { "controlId": "10 CFR 73.54(g)", "title": "10 CFR 73.54(g) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.1.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "694512cd-f69b-520e-a752-311e4e9c733f", "isPublic": true }, { "controlId": "A.4.1.2", "title": "A.4.1.2 — Effectiveness Analysis", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, CA-7, RA-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "64ec215f-f0a6-5a54-9b4e-b27080eb5bdf", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.1.2", "title": "NEI 08-09 Sec 4.1.2 — Effectiveness Analysis", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.1.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "5580aa5f-2d15-538b-915b-85a5be571b69", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.1.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "ac0d8a61-c8a5-5dec-b783-badfe2851f88", "isPublic": true }, { "controlId": "A.4.2.3", "title": "A.4.2.3 — Security Reassessment and Authorization", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-6, CA-2, CM-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "78f3424f-c3f4-5162-b569-d70194a940d6", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.3", "title": "NEI 08-09 Sec 4.2.3 — Security Reassessment and Authorization", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "b70dd06e-8578-5b10-8a60-4945eee40f64", "isPublic": true }, { "controlId": "10 CFR 73.54(e)", "title": "10 CFR 73.54(e) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "8191e45f-3894-5506-b6ae-fdbadab25867", "isPublic": true }, { "controlId": "A.4.2.5", "title": "A.4.2.5 — Review and Validation Testing of a Modification or Addition of a Critical Digital Asset", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, CM-3, SA-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "db08636e-3692-53ca-9bfc-038f408cf744", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.5", "title": "NEI 08-09 Sec 4.2.5 — Review and Validation Testing of a Modification or Addition of a Critical Digital Asset", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "a87b1859-5ab8-54ce-912d-9cd1902dbd39", "isPublic": true }, { "controlId": "A.4.3", "title": "A.4.3 — Cyber Security Program Review", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-1, CA-2, CA-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "10fd3b36-c7d1-53ac-b01d-24b3ba4ad101", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.3", "title": "NEI 08-09 Sec 4.3 — Cyber Security Program Review", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "f13f6f9a-7277-5ba2-b1c7-71953e745b32", "isPublic": true }, { "controlId": "10 CFR 73.54(g), 73.55(m)", "title": "10 CFR 73.54(g), 73.55(m) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "8b80cebe-6369-5dfd-820d-ca4a8c5b735f", "isPublic": true }, { "controlId": "C.12.6", "title": "C.12.6 — Licensee/Applicant testing", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, SA-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "fafefe6e-e874-5dbe-8d66-1fded0a70f37", "isPublic": true }, { "controlId": "NEI 08-09 App E.12.6", "title": "NEI 08-09 App E.12.6 — Licensee/Applicant testing", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.12.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "1930477d-a730-5703-92ab-c12e5e6707b4", "isPublic": true }, { "controlId": "CIP-014-3-R2", "title": "CIP-014-3-R2 — Third-Party Verification of Risk Assessment", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "99b91c4a-f279-537f-ba90-9a22d6317c44", "isPublic": true }, { "controlId": "CIP-014-3-2.1", "title": "CIP-014-3-2.1 — Each Transmission Owner shall select an unaffiliated verifying entity that is either", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "09e47b33-6429-5f7d-9776-cdbb2abe73dd", "isPublic": true }, { "controlId": "CIP-014-3-2.2", "title": "CIP-014-3-2.2 — The unaffiliated third party verification shall verify the Transmission Owner’s risk assessment performed under Requi...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0d27e432-1d8c-5672-8c64-ac074351d724", "isPublic": true }, { "controlId": "CIP-014-3-2.3", "title": "CIP-014-3-2.3 — If the unaffiliated verifying entity recommends that the Transmission Owner add a Transmission station(s) or Transmis...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f1180749-0636-56ce-9f4e-a825739a5b04", "isPublic": true }, { "controlId": "CIP-014-3-2.4", "title": "CIP-014-3-2.4 — Each Transmission Owner shall implement procedures, such as the use of non- disclosure agreements, for protecting sen...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c5cd1655-d480-5995-bee4-ae90e7f812d4", "isPublic": true }, { "controlId": "NSS-17T-Sec4.9", "title": "NSS-17T-Sec4.9 — Periodic Computer Security Review, Walkdowns & Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "94773a3c-f8e0-5e24-9e3a-8704fe455cc1", "isPublic": true }, { "controlId": "IEC-62645-5.4", "title": "IEC-62645-5.4 — Independent Computer Security Assessment and Audit", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "471150e5-fbf8-5b02-9682-a08ccc583eb5", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.f", "title": "DOE-O-205.1D-4.f — Authorization to Operate (ATO) and Continuous Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "20bdf933-235b-5c16-a54f-61838823c19e", "isPublic": true } ], "id": 31606, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731176", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731176", "catalogueId": 1062, "uuid": "49818e58-4a83-5bb5-9495-743f72b87061", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 10.0, "title": "Assessments", "description": "

Control Description

Mechanisms exist to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.

Evidence Request List (ERL)

E-IAO-03\nE-IAO-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Information Assurance (IAO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Pre-production security testing-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain an informal process to conduct limited control testing of High Value Assets (HVAs) to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.

Level 2 - Planned & Tracked: Information Assurance (IAO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Information Assurance (IA)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ IA management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.\n▪ IAP operations focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel coordinate IAP activities with affected stakeholders before conducting such activities in order to reduce the potential impact on operations.\n▪ IAP testing results in a formal risk assessment where Business process owners (BPOs) are required to make a decision to (1) reduce, (2) avoid, (3) transfer and/or (4) accept risk(s) on behalf of the organization.

Level 3 - Well Defined: Information Assurance (IAO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are well-documented and kept current by process owners.\n▪ An information assurance team, or similar function, is appropriately staffed and supported to implement and maintain IAO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of information assurance operations (e.g., assessment scheduling software, risk assessment software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to formally assess the security, compliance and resilience controls in Technology Assets, Applications and/or Services (TAAS) through Information Assurance Program (IAP) activities to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.

Level 4 - Quantitatively Controlled: Information Assurance (IAO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.4, A.3.1.6, A.4.1.1, A.4.1.2, A.4.2.3, A.4.2.5, A.4.3, C.12.6
NERC-CIP (2026) Requirements: CIP-014-3-R2", "controlId": "IAO-02", "family": "Information Assurance", "enhancements": "", "sortId": "IAO-02", "references": "

Micro-Small Business (<10 staff)

∙ Controls Validation Testing (CVT)

Small Business (10-49 staff)

∙ Controls Validation Testing (CVT)

Medium Business (50-249 staff)

∙ Controls Validation Testing (CVT)\n∙ Information Assurance (IA) program\n∙ VisibleOps security management

Large Business (250-999 staff)

∙ Controls Validation Testing (CVT)\n∙ Information Assurance (IA) program\n∙ VisibleOps security management

Enterprise (>1,000 staff)

∙ Controls Validation Testing (CVT)\n∙ Information Assurance (IA) program\n∙ VisibleOps security management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72308, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590736", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590736", "securityControlId": 31607, "ccis": [], "uuid": "0d0927ce-179c-5301-a84d-7703ef60f050", "testId": "IAO-02.1_A01", "test": "independent assessors or assessment teams are employed to conduct control assessments.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02(01)", "defaultText": null } ], "externalMappings": [ { "id": 584032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55c912f6-c100-58d6-9fa3-520be9c3ae16", "parentControlId": 31607, "controlId": "CA-2(1)", "title": "CA-2(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58687" }, { "id": 584033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1754807-e89d-55e9-adf1-ff167d8cc315", "parentControlId": 31607, "controlId": "CA-02(01)", "title": "CA-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58687" }, { "id": 584034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6fba750-15f8-53fe-aed6-d5449a9733dd", "parentControlId": 31607, "controlId": "CA-02(01)", "title": "CA-02(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58687" }, { "id": 584035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9210dec-e236-588d-9612-0bb0e83d0518", "parentControlId": 31607, "controlId": "CA-02(01)", "title": "CA-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58687" }, { "id": 584036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1ef7f96-d0d1-5a72-8e6e-fa1a23beab86", "parentControlId": 31607, "controlId": "CA-02(01)", "title": "CA-02(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58687" }, { "id": 584037, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf2dd567-2b33-5d01-86c7-f8916934476e", "parentControlId": 31607, "controlId": "CA-02(01)", "title": "CA-02(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586871" }, { "id": 584038, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586871", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b8ee8cc-a61f-5684-aa26-227960414a86", "parentControlId": 31607, "controlId": "NFO - CA-2(1)", "title": "NFO - CA-2(1)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586871" }, { "controlId": "CIP-014-3-R2", "title": "CIP-014-3-R2 — Third-Party Verification of Risk Assessment", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0a0102a6-c2ea-51ca-920e-571f2fc28826", "isPublic": true }, { "controlId": "CIP-014-3-2.1", "title": "CIP-014-3-2.1 — Each Transmission Owner shall select an unaffiliated verifying entity that is either", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8e871e55-68a1-5e9b-a1bd-a9f37749489a", "isPublic": true }, { "controlId": "CIP-014-3-2.2", "title": "CIP-014-3-2.2 — The unaffiliated third party verification shall verify the Transmission Owner’s risk assessment performed under Requi...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "33d4e187-9779-5b20-a34e-3111fde95536", "isPublic": true }, { "controlId": "CIP-014-3-2.3", "title": "CIP-014-3-2.3 — If the unaffiliated verifying entity recommends that the Transmission Owner add a Transmission station(s) or Transmis...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c63d85d1-ee18-572c-b013-79fc0eba171c", "isPublic": true }, { "controlId": "CIP-014-3-2.4", "title": "CIP-014-3-2.4 — Each Transmission Owner shall implement procedures, such as the use of non- disclosure agreements, for protecting sen...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0354e9de-baa8-5d9e-b537-bb0d9f52c4f6", "isPublic": true }, { "controlId": "CIP-014-3-R6", "title": "CIP-014-3-R6 — Third-Party Review of Physical Security Evaluation and Plan", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5c892f94-bcf8-5a5b-a809-afe83c8f7188", "isPublic": true }, { "controlId": "CIP-014-3-6.1", "title": "CIP-014-3-6.1 — Each Transmission Owner and Transmission Operator shall select an unaffiliated third party reviewer from the following", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6432a8f7-0a53-58cb-8992-e69ba9b86c89", "isPublic": true }, { "controlId": "CIP-014-3-6.2", "title": "CIP-014-3-6.2 — The Transmission Owner or Transmission Operator, respectively, shall ensure that the unaffiliated third party review...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "883bd9a7-563b-5fc9-9e2d-ee81f576011a", "isPublic": true }, { "controlId": "CIP-014-3-6.3", "title": "CIP-014-3-6.3 — If the unaffiliated third party reviewer recommends changes to the evaluation performed under Requirement R4 or secur...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a153b0be-6f92-5a83-b2d8-342c6c24bd70", "isPublic": true }, { "controlId": "CIP-014-3-6.4", "title": "CIP-014-3-6.4 — Each Transmission Owner and Transmission Operator shall implement procedures, such as the use of non-disclosure agree...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5e707e67-e7b5-5901-9dcf-26ca670f6b33", "isPublic": true }, { "controlId": "NSS-17T-Sec4.9", "title": "NSS-17T-Sec4.9 — Periodic Computer Security Review, Walkdowns & Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d8c15b88-0e2d-53e0-a321-cad234066f03", "isPublic": true }, { "controlId": "IEC-62645-5.4", "title": "IEC-62645-5.4 — Independent Computer Security Assessment and Audit", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "f507278b-568b-5a42-a501-d0b2655f23be", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.f", "title": "DOE-O-205.1D-4.f — Authorization to Operate (ATO) and Continuous Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "6df6245b-01b4-5cbb-9b95-e9717b734878", "isPublic": true } ], "id": 31607, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731176", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731176", "catalogueId": 1062, "uuid": "8ab52802-7e66-5260-ae0d-f939335bcf06", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure assessors or assessment teams have the appropriate independence to conduct security, compliance and/or resilience control assessments?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Assessor Independence", "description": "

Control Description

Mechanisms exist to ensure assessors or assessment teams have the appropriate independence to conduct security, compliance and/or resilience control assessments.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Information Assurance (IAO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Pre-production security testing-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain an informal process to conduct limited control testing of High Value Assets (HVAs) to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.

Level 2 - Planned & Tracked: Information Assurance (IAO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Information Assurance (IA)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ IA management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.

Level 3 - Well Defined: Information Assurance (IAO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are well-documented and kept current by process owners.\n▪ An information assurance team, or similar function, is appropriately staffed and supported to implement and maintain IAO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of information assurance operations (e.g., assessment scheduling software, risk assessment software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure assessors or assessment teams have the appropriate independence to conduct security, compliance and/or resilience control assessments.

Level 4 - Quantitatively Controlled: Information Assurance (IAO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

NERC-CIP (2026) Requirements: CIP-014-3-R2, CIP-014-3-R6", "controlId": "IAO-02.1", "family": "Information Assurance", "enhancements": "", "sortId": "IAO-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Document security assurance requirements for critical systems

Small Business (10-49 staff)

∙ Security assurance checklist for critical systems

Medium Business (50-249 staff)

∙ Formal information assurance program\n∙ Security testing and validation

Large Business (250-999 staff)

∙ Enterprise information assurance program\n∙ Independent security testing

Enterprise (>1,000 staff)

∙ Enterprise IA program\n∙ Formal evaluation (e.g., Common Criteria, FedRAMP)\n∙ Continuous assurance monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72309, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590736", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590736", "securityControlId": 31608, "ccis": [], "uuid": "1cfdd744-3175-5a93-9372-8658359f687f", "testId": "IAO-02.2_A01", "test": "the frequency at which to include specialized assessments as part of the control assessment is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02(02)_ODP[01]", "defaultText": null }, { "id": 72310, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590736", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590736", "securityControlId": 31608, "ccis": [], "uuid": "0c49ba2e-081d-57f0-9660-4f0999f287bc", "testId": "IAO-02.2_A02", "test": "other forms of announced or unannounced assessment are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02(02)_ODP[02]\n53A_R5_CA-02(02)_ODP[03]\n53A_R5_CA-02(02)_ODP[04]", "defaultText": null }, { "id": 72311, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590736", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590736", "securityControlId": 31608, "ccis": [], "uuid": "b54ba3fd-522d-504a-8062-9abeaa1ab306", "testId": "IAO-02.2_A03", "test": "organization-defined specialized assessment frequencies are included as part of control assessments.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02(02)", "defaultText": null } ], "externalMappings": [ { "id": 584059, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "410feb2e-c755-5ed7-b687-60b9a053c3e9", "parentControlId": 31608, "controlId": "5.21", "title": "5.21", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586873" }, { "id": 584060, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e182a83-fafd-535d-a986-6581fd985ea0", "parentControlId": 31608, "controlId": "5.23", "title": "5.23", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586873" }, { "id": 584061, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9663a5fd-4015-5ee9-b83f-d95a3e075404", "parentControlId": 31608, "controlId": "8.29", "title": "8.29", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586873" }, { "id": 584070, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586875", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0de27ed-893b-58b1-af74-eb3b7bf086d2", "parentControlId": 31608, "controlId": "CA-2(2)", "title": "CA-2(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586875" }, { "id": 584071, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586875", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0689f5a7-9500-58da-b8ae-ada10d611a05", "parentControlId": 31608, "controlId": "CA-02(02)", "title": "CA-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586875" }, { "id": 584072, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586876", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7517181-02f8-5e24-855f-59c089348a7a", "parentControlId": 31608, "controlId": "SA-11(05)", "title": "SA-11(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586876" }, { "id": 584074, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586876", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ada05e79-1d7f-595e-9f57-7cfeecb73d1d", "parentControlId": 31608, "controlId": "CA-02(02)", "title": "CA-02(02)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586876" }, { "id": 584075, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586876", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1979bf4-c0c2-5236-aa6d-562279447826", "parentControlId": 31608, "controlId": "CA-02(02)", "title": "CA-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586876" }, { "id": 584076, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586876", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7196d078-7a1a-55a6-93a6-ec43184f8f9b", "parentControlId": 31608, "controlId": "SA-11(05)", "title": "SA-11(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586876" }, { "id": 584077, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586876", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "218b58a0-be96-5c0e-bd3a-e436abd435cd", "parentControlId": 31608, "controlId": "CA-02(02)", "title": "CA-02(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586876" }, { "id": 584079, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586876", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d85153d0-4d8d-538a-999e-bb6f2be4f5e6", "parentControlId": 31608, "controlId": "CA-2(2)", "title": "CA-2(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586876" } ], "id": 31608, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731176", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731176", "catalogueId": 1062, "uuid": "7a7c85e4-884e-5bcf-9c1e-3f5b157259b5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct specialized assessments for: \n (1) Statutory, regulatory and contractual compliance obligations;\n (2) Monitoring capabilities; \n (3) Mobile devices;\n (4) Databases;\n (5) Application security;\n (6) Embedded technologies (e.g., IoT, OT, etc.);\n (7) Vulnerability management; \n (8) Malicious code; \n (9) Insider threats;\n (10) Performance/load testing; and/or\n (11) Artificial Intelligence and Autonomous Technologies (AAT) testing?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Specialized Assessments", "description": "

Control Description

Mechanisms exist to conduct specialized assessments for: \n(1) Statutory, regulatory and contractual compliance obligations;\n(2) Monitoring capabilities; \n(3) Mobile devices;\n(4) Databases;\n(5) Application security;\n(6) Embedded technologies (e.g., IoT, OT, etc.);\n(7) Vulnerability management; \n(8) Malicious code; \n(9) Insider threats;\n(10) Performance/load testing; and/or\n(11) Artificial Intelligence and Autonomous Technologies (AAT).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Information Assurance (IAO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Pre-production security testing-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain an informal process to conduct limited control testing of High Value Assets (HVAs) to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.

Level 2 - Planned & Tracked: Information Assurance (IAO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Information Assurance (IA)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ IA management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.\n▪ IAP operations focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Information Assurance (IAO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are well-documented and kept current by process owners.\n▪ An information assurance team, or similar function, is appropriately staffed and supported to implement and maintain IAO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of information assurance operations (e.g., assessment scheduling software, risk assessment software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conduct specialized assessments for: \n(1) Statutory, regulatory and contractual compliance obligations;\n(2) Monitoring capabilities; \n(3) Mobile devices;\n(4) Databases;\n(5) Application security;\n(6) Embedded technologies (e.g., IoT, OT, etc.);\n(7) Vulnerability management; \n(8) Malicious code; \n(9) Insider threats;\n(10) Performance/load testing; and/or\n(11) Artificial Intelligence and Autonomous Technologies (AAT).

Level 4 - Quantitatively Controlled: Information Assurance (IAO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAO-02.2", "family": "Information Assurance", "enhancements": "", "sortId": "IAO-02.2", "references": "

Micro-Small Business (<10 staff)

∙ Controls Validation Testing (CVT)

Small Business (10-49 staff)

∙ Controls Validation Testing (CVT)

Medium Business (50-249 staff)

∙ Controls Validation Testing (CVT)

Large Business (250-999 staff)

∙ Controls Validation Testing (CVT)

Enterprise (>1,000 staff)

∙ Controls Validation Testing (CVT)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72312, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590737", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590737", "securityControlId": 31609, "ccis": [], "uuid": "6e9b8499-25cd-5a41-b337-e18d21c2947f", "testId": "IAO-02.3_A01", "test": "external organizations from which the results of control assessments are leveraged are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02(03)_ODP[01]", "defaultText": null }, { "id": 72313, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590737", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590737", "securityControlId": 31609, "ccis": [], "uuid": "5d586a4d-51ab-5926-bfe9-acf30741e86e", "testId": "IAO-02.3_A02", "test": "systems, applications and/or services on which a control assessment to be performed by an external organization are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02(03)_ODP[02]", "defaultText": null }, { "id": 72314, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590737", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590737", "securityControlId": 31609, "ccis": [], "uuid": "30283935-e054-5f17-9aa7-d525d64224a2", "testId": "IAO-02.3_A03", "test": "requirements to be met by the control assessment performed by an external organization on systems, applications and/or services are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02(03)_ODP[03]", "defaultText": null }, { "id": 72315, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590737", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590737", "securityControlId": 31609, "ccis": [], "uuid": "5097bac9-4dd6-5bcf-9449-46d310ce7e37", "testId": "IAO-02.3_A04", "test": "the results of control assessments performed by organization-defined external organizations on systems, applications and/or services are leveraged when the assessment meets organization-defined requirements.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02(03)", "defaultText": null } ], "externalMappings": [ { "id": 584111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13a92732-e6e4-54a3-9d35-f7dfe03d40fe", "parentControlId": 31609, "controlId": "CA-2(3)", "title": "CA-2(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58688" }, { "id": 584112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2105ad2-fa12-5c35-8d71-6c94af46c796", "parentControlId": 31609, "controlId": "CA-02(03)", "title": "CA-02(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58688" }, { "id": 584113, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea5f942b-777a-570d-840e-9afb20c9b2ba", "parentControlId": 31609, "controlId": "CA-02(03)", "title": "CA-02(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58688" }, { "id": 584114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6ff71a1-28bb-588a-9039-cc4107d24ce6", "parentControlId": 31609, "controlId": "CA-2(3)", "title": "CA-2(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58688" } ], "id": 31609, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731177", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731177", "catalogueId": 1062, "uuid": "3dc91adf-d943-5e51-86fe-ef9cbca30a27", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization accept and respond to the results of external assessments that are performed by impartial, external organizations?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Third-Party Assessment Reciprocity", "description": "

Control Description

Mechanisms exist to accept and respond to the results of external assessments that are performed by impartial, external organizations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Information Assurance (IAO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Information Assurance (IA)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ IA management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.\n▪ IAP operations focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Information Assurance (IAO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are well-documented and kept current by process owners.\n▪ An information assurance team, or similar function, is appropriately staffed and supported to implement and maintain IAO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of information assurance operations (e.g., assessment scheduling software, risk assessment software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to accept and respond to the results of external assessments that are performed by impartial, external organizations.

Level 4 - Quantitatively Controlled: Information Assurance (IAO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAO-02.3", "family": "Information Assurance", "enhancements": "", "sortId": "IAO-02.3", "references": "

Micro-Small Business (<10 staff)

∙ Controls Validation Testing (CVT)

Small Business (10-49 staff)

∙ Controls Validation Testing (CVT)

Medium Business (50-249 staff)

∙ Controls Validation Testing (CVT)\n∙ Audit steering committee\n∙ Information Assurance (IA) program

Large Business (250-999 staff)

∙ Controls Validation Testing (CVT)\n∙ Audit steering committee\n∙ Information Assurance (IA) program

Enterprise (>1,000 staff)

∙ Controls Validation Testing (CVT)\n∙ Audit steering committee\n∙ Information Assurance (IA) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72316, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590737", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590737", "securityControlId": 31610, "ccis": [], "uuid": "59f8bd6d-8e87-519e-ae0b-588288b19100", "testId": "IAO-02.4_A01", "test": "produce a Security Assessment Report (SAR) at the conclusion of a security assessment to certify the results of the assessment and assist with any remediation actions.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 584127, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586882", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1e6e9ef-29c3-541e-b4ae-8391d62768dd", "parentControlId": 31610, "controlId": "ORG 2.4(d)", "title": "ORG 2.4(d)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586882" }, { "id": 584133, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586882", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad49e3db-e48e-5102-b835-8851824ac1fe", "parentControlId": 31610, "controlId": "ID.IM-01", "title": "ID.IM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586882" }, { "id": 584134, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586883", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1dcfd89f-d4a5-520b-9dde-7fac557adb0f", "parentControlId": 31610, "controlId": "ID.IM-02", "title": "ID.IM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586883" } ], "id": 31610, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731177", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731177", "catalogueId": 1062, "uuid": "cc6538d2-27b0-5150-9850-305efb07c347", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization produce a Security Assessment Report (SAR) at the conclusion of a security assessment to certify the results of the assessment and assist with any remediation actions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Security Assessment Report (SAR)", "description": "

Control Description

Mechanisms exist to produce a Security Assessment Report (SAR) at the conclusion of a security assessment to certify the results of the assessment and assist with any remediation actions.

Evidence Request List (ERL)

E-IAO-01\nE-IAO-03\nE-IAO-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Information Assurance (IAO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Information Assurance (IA)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ IA management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.\n▪ IAP testing results in a formal risk assessment where Business process owners (BPOs) are required to make a decision to (1) reduce, (2) avoid, (3) transfer and/or (4) accept risk(s) on behalf of the organization.

Level 3 - Well Defined: Information Assurance (IAO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are well-documented and kept current by process owners.\n▪ An information assurance team, or similar function, is appropriately staffed and supported to implement and maintain IAO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of information assurance operations (e.g., assessment scheduling software, risk assessment software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to produce a Security Assessment Report (SAR) at the conclusion of a security assessment to certify the results of the assessment and assist with any remediation actions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAO-02.4", "family": "Information Assurance", "enhancements": "", "sortId": "IAO-02.4", "references": "

Micro-Small Business (<10 staff)

∙ Controls Validation Testing (CVT)\n∙ Security Assessment Report (SAR)

Small Business (10-49 staff)

∙ Controls Validation Testing (CVT)\n∙ Security Assessment Report (SAR)

Medium Business (50-249 staff)

∙ Controls Validation Testing (CVT)\n∙ Security Assessment Report (SAR)

Large Business (250-999 staff)

∙ Controls Validation Testing (CVT)\n∙ Security Assessment Report (SAR)

Enterprise (>1,000 staff)

∙ Controls Validation Testing (CVT)\n∙ Security Assessment Report (SAR)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72317, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590738", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590738", "securityControlId": 31611, "ccis": [], "uuid": "814d1dc0-a36e-53bb-877a-a9dfa087c0c7", "testId": "IAO-03_A01", "test": "the system boundary is described and documented in the system security plan.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.12.4[b]", "defaultText": null }, { "id": 72318, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590738", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590738", "securityControlId": 31611, "ccis": [], "uuid": "58282e6e-8620-5e39-875b-3556845c1998", "testId": "IAO-03_A02", "test": "the system components on which sensitive / regulated data is processed are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72319, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590738", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590738", "securityControlId": 31611, "ccis": [], "uuid": "67e37141-e373-5f24-b0bb-24a5c7506a43", "testId": "IAO-03_A03", "test": "the system components on which sensitive / regulated data is stored are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72320, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590738", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590738", "securityControlId": 31611, "ccis": [], "uuid": "6757f5a4-6ea2-51ad-8a9e-e010f53dae6c", "testId": "IAO-03_A04", "test": "changes to the system or system component location where sensitive / regulated data is processed are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72321, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590738", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590738", "securityControlId": 31611, "ccis": [], "uuid": "6414a7b6-a55b-56cb-a17c-2c5bd91b8f34", "testId": "IAO-03_A05", "test": "changes to the system or system component location where sensitive / regulated data is stored are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72322, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590739", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590739", "securityControlId": 31611, "ccis": [], "uuid": "c9b438e3-a973-54c2-a642-3e5c8798243b", "testId": "IAO-03_A06", "test": "a system security plan that describes specific threats to the system that are of concern to the organization is developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.15.02.a.03", "defaultText": null }, { "id": 72323, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590739", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590739", "securityControlId": 31611, "ccis": [], "uuid": "ab973232-73aa-5fe8-9df5-b661716b994e", "testId": "IAO-03_A07", "test": "a system security plan that describes the safeguards in place or planned for meeting the security requirements is developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.15.02.a.06", "defaultText": null }, { "id": 72324, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590739", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590739", "securityControlId": 31611, "ccis": [], "uuid": "9d8effef-cf68-54ca-a0d2-05378924349a", "testId": "IAO-03_A08", "test": "a system security plan that identifies individuals that fulfill system roles and responsibilities is developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.15.02.a.07", "defaultText": null }, { "id": 72325, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590739", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590739", "securityControlId": 31611, "ccis": [], "uuid": "828f2238-4c86-560a-bd38-313517b061d8", "testId": "IAO-03_A09", "test": "a system security plan that includes other relevant information necessary for the protection of sensitive / regulated data is developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72326, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590739", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590739", "securityControlId": 31611, "ccis": [], "uuid": "846da6de-2bae-5799-84f7-c252ab657cf5", "testId": "IAO-03_A10", "test": "the system security plan is reviewed per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least every 12 months, or when there are significant incidents or significant changes to risks", "otherId": "SCF Created", "defaultText": null }, { "id": 72327, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59074", "securityControlId": 31611, "ccis": [], "uuid": "4d4c5f2d-9e19-5aac-b397-5f701fbbc0bc", "testId": "IAO-03_A11", "test": "the system security plan is protected from unauthorized disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.15.02.c", "defaultText": null }, { "id": 72328, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59074", "securityControlId": 31611, "ccis": [], "uuid": "27b97e75-e6eb-503b-be74-39c9fd80ee9a", "testId": "IAO-03_A12", "test": "the security requirements identified and approved by the designated authority as non-applicable are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.12.4[d]", "defaultText": null }, { "id": 72329, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59074", "securityControlId": 31611, "ccis": [], "uuid": "ebb58fd2-1877-5f48-ae12-4869769256be", "testId": "IAO-03_A13", "test": "the method of security requirement implementation is described and documented in the system security plan.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.12.4[e]", "defaultText": null }, { "id": 72330, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59074", "securityControlId": 31611, "ccis": [], "uuid": "fa031c50-aa10-5348-8098-d79bb48c429c", "testId": "IAO-03_A14", "test": "the relationship with or connection to other systems is described and documented in the system security plan.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.12.4[f]", "defaultText": null }, { "id": 72331, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59074", "securityControlId": 31611, "ccis": [], "uuid": "8937f469-e181-537d-9a49-41ec11e7eca5", "testId": "IAO-03_A15", "test": "the system security plan documents or references the security solution selected.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.11.4e[a]", "defaultText": null }, { "id": 72332, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59074", "securityControlId": 31611, "ccis": [], "uuid": "f06447a0-a149-54cf-9ad4-b6b2796d45b8", "testId": "IAO-03_A16", "test": "the system security plan documents or references the rationale for the security solution.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.11.4e[b]", "defaultText": null }, { "id": 72333, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590741", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590741", "securityControlId": 31611, "ccis": [], "uuid": "6fcca179-1e01-5d7f-99d0-9d395e688356", "testId": "IAO-03_A17", "test": "the system security plan documents or references the risk determination.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.11.4e[c]", "defaultText": null }, { "id": 72334, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590741", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590741", "securityControlId": 31611, "ccis": [], "uuid": "a092672f-cad3-5594-8920-8b652774a247", "testId": "IAO-03_A18", "test": "individuals or groups with whom cybersecurity / data privacy-related activities affecting the system that require planning and coordination is/are assigned.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_PL-02_ODP[01]", "defaultText": null }, { "id": 72335, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590741", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590741", "securityControlId": 31611, "ccis": [], "uuid": "d29d7db5-13c8-5ea3-8b8c-adb44754680e", "testId": "IAO-03_A19", "test": "personnel or roles to receive distributed copies of the system cybersecurity / data privacy plans is/are assigned.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_PL-02_ODP[02]", "defaultText": null }, { "id": 72336, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590741", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590741", "securityControlId": 31611, "ccis": [], "uuid": "06c79038-b49d-56d3-b434-98e039ffc7b7", "testId": "IAO-03_A20", "test": "the frequency at which the system security plan is reviewed and updated is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least every 12 months, or when there are significant incidents or significant changes to risks", "otherId": "53A_R5_PL-02_ODP[03]\n171A_3.12.4[g]\n171A_R3_A.03.15.02.ODP[01]", "defaultText": null }, { "id": 72337, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590742", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590742", "securityControlId": 31611, "ccis": [], "uuid": "19ac6672-2e67-5a3a-9376-ef0b6e2c5a49", "testId": "IAO-03_A21", "test": "the system security plan is updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least every 12 months, or when there are significant incidents or significant changes to risks", "otherId": "171A_3.12.4[h]", "defaultText": null }, { "id": 72338, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590742", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590742", "securityControlId": 31611, "ccis": [], "uuid": "107b4b3e-4806-5af2-af8b-e5e7dae0910f", "testId": "IAO-03_A22", "test": "a security plan for the system is developed that is consistent with the organization's enterprise architecture.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.01[01]", "defaultText": null }, { "id": 72339, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590742", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590742", "securityControlId": 31611, "ccis": [], "uuid": "4b80a98b-a5b5-5982-ace0-47257493ee39", "testId": "IAO-03_A23", "test": "a privacy plan for the system is developed that is consistent with the organization's enterprise architecture.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.01[02]", "defaultText": null }, { "id": 72340, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590742", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590742", "securityControlId": 31611, "ccis": [], "uuid": "bae96b85-72f8-5f3e-90e7-8a63b945c073", "testId": "IAO-03_A24", "test": "a system security plan that defines the constituent system components is developed.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PL-02a.02[01]\n171A_R3_A.03.15.02.a.01", "defaultText": null }, { "id": 72341, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590742", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590742", "securityControlId": 31611, "ccis": [], "uuid": "eb130247-9e7f-5fe6-a6e1-b9fd0c5e4f5f", "testId": "IAO-03_A25", "test": "a privacy plan for the system is developed that explicitly defines the constituent system components.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.02[02]", "defaultText": null }, { "id": 72342, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590742", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590742", "securityControlId": 31611, "ccis": [], "uuid": "c665e76b-2b81-51ef-9e76-cf1f660fecda", "testId": "IAO-03_A26", "test": "a security plan for the system is developed that describes the operational context of the system in terms of mission and business processes.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.03[01]", "defaultText": null }, { "id": 72343, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590742", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590743", "securityControlId": 31611, "ccis": [], "uuid": "238cc8a1-2f98-5b55-b43a-f4f3e502cb70", "testId": "IAO-03_A27", "test": "a privacy plan for the system is developed that describes the operational context of the system in terms of mission and business processes.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.03[02]", "defaultText": null }, { "id": 72344, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590743", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590743", "securityControlId": 31611, "ccis": [], "uuid": "b802b007-a1ac-5799-a66b-8d2bf9549be3", "testId": "IAO-03_A28", "test": "a security plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.04[01]", "defaultText": null }, { "id": 72345, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590743", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590743", "securityControlId": 31611, "ccis": [], "uuid": "adeb7102-b8dd-57c0-a648-c48f35cd552b", "testId": "IAO-03_A29", "test": "a privacy plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.04[02]", "defaultText": null }, { "id": 72346, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590743", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590743", "securityControlId": 31611, "ccis": [], "uuid": "d6966d93-c4e2-5099-9fb6-cd5c1c24e363", "testId": "IAO-03_A30", "test": "a system security plan that identifies the information types processed, stored, and transmitted by the system is developed.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PL-02a.05[01]\n171A_R3_A.03.15.02.a.02", "defaultText": null }, { "id": 72347, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590743", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590743", "securityControlId": 31611, "ccis": [], "uuid": "8d77e670-c86b-5add-8db8-5a92c1f0acba", "testId": "IAO-03_A31", "test": "a privacy plan for the system is developed that identifies the information types processed, stored and transmitted by the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.05[02]", "defaultText": null }, { "id": 72348, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590743", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590743", "securityControlId": 31611, "ccis": [], "uuid": "5f1b01ff-9e1c-5222-8c9f-dcc1ddac978e", "testId": "IAO-03_A32", "test": "a security plan for the system is developed that provides the security categorization of the system, including supporting rationale.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.06[01]", "defaultText": null }, { "id": 72349, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590743", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590743", "securityControlId": 31611, "ccis": [], "uuid": "76474061-4c57-5733-a562-9271634c86f2", "testId": "IAO-03_A33", "test": "a privacy plan for the system is developed that provides the security categorization of the system, including supporting rationale.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.06[02]", "defaultText": null }, { "id": 72350, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590744", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590744", "securityControlId": 31611, "ccis": [], "uuid": "434a5346-57cc-56a8-97af-2dd9d8480b7c", "testId": "IAO-03_A34", "test": "a security plan for the system is developed that describes any specific threats to the system that are of concern to the organization.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.07[01]", "defaultText": null }, { "id": 72351, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590744", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590744", "securityControlId": 31611, "ccis": [], "uuid": "455072bf-c172-5721-bd83-23aba75a683e", "testId": "IAO-03_A35", "test": "a privacy plan for the system is developed that describes any specific threats to the system that are of concern to the organization.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.07[02]", "defaultText": null }, { "id": 72352, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590744", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590744", "securityControlId": 31611, "ccis": [], "uuid": "95508130-4562-51f6-903a-4231e4d836e5", "testId": "IAO-03_A36", "test": "a security plan for the system is developed that provides the results of a privacy risk assessment for systems processing Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.08[01]", "defaultText": null }, { "id": 72353, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590744", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590744", "securityControlId": 31611, "ccis": [], "uuid": "186c1bf6-b467-5432-a94f-951fd01e670f", "testId": "IAO-03_A37", "test": "a privacy plan for the system is developed that provides the results of a privacy risk assessment for systems processing Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.08[02]", "defaultText": null }, { "id": 72354, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590744", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590744", "securityControlId": 31611, "ccis": [], "uuid": "05876ecf-60e9-5357-ad1d-5e90003ef8c2", "testId": "IAO-03_A38", "test": "a system security plan that describes the operational environment for the system and any dependencies on or connections to other systems or system components is developed.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PL-02a.09[01]\n53A_R5_PL-02a.09[02]\n171A_3.12.4[c]\n171A_R3_A.03.15.02.a.04", "defaultText": null }, { "id": 72355, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590745", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590745", "securityControlId": 31611, "ccis": [], "uuid": "3afa65ad-88dc-5d5b-b105-712939498ebb", "testId": "IAO-03_A39", "test": "a system security plan that provides an overview of the security requirements for the system is developed.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PL-02a.10[01]\n171A_3.12.4[a]\n171A_R3_A.03.15.02.a.05", "defaultText": null }, { "id": 72356, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590745", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590745", "securityControlId": 31611, "ccis": [], "uuid": "1d72ac77-b9a2-524f-bfba-e21c6461c4dc", "testId": "IAO-03_A40", "test": "a privacy plan for the system is developed that provides an overview of the privacy requirements for the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.10[02]", "defaultText": null }, { "id": 72357, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590745", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590745", "securityControlId": 31611, "ccis": [], "uuid": "600c5dc8-3792-578e-bdf2-a3b1b02a0b13", "testId": "IAO-03_A41", "test": "a security plan for the system is developed that identifies any relevant control baselines or overlays, if applicable.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.11[01]", "defaultText": null }, { "id": 72358, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590745", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590745", "securityControlId": 31611, "ccis": [], "uuid": "535aab69-4c4e-5873-b01f-720766c403c8", "testId": "IAO-03_A42", "test": "a privacy plan for the system is developed that identifies any relevant control baselines or overlays, if applicable.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.11[02]", "defaultText": null }, { "id": 72359, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590745", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590745", "securityControlId": 31611, "ccis": [], "uuid": "c0845028-8570-5f5c-a9e5-51ca50dc59f3", "testId": "IAO-03_A43", "test": "a security plan for the system is developed that describes the controls in place or planned for meeting the security requirements, including rationale for any tailoring decisions.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.12[01]", "defaultText": null }, { "id": 72360, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590745", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590745", "securityControlId": 31611, "ccis": [], "uuid": "ab32349a-3e69-5318-9d19-984b49049736", "testId": "IAO-03_A44", "test": "a privacy plan for the system is developed that describes the controls in place or planned for meeting the privacy requirements, including rationale for any tailoring decisions.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.12[02]", "defaultText": null }, { "id": 72361, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590746", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590746", "securityControlId": 31611, "ccis": [], "uuid": "2852c7a0-1d0e-5f42-9d75-8c456d23dba1", "testId": "IAO-03_A45", "test": "a security plan for the system is developed that includes risk determinations for security architecture and design decisions.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.13[01]", "defaultText": null }, { "id": 72362, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590746", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590746", "securityControlId": 31611, "ccis": [], "uuid": "db8571f1-e00c-59d7-b0e7-eeca3b473520", "testId": "IAO-03_A46", "test": "a privacy plan for the system is developed that includes risk determinations for privacy architecture and design decisions.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.13[02]", "defaultText": null }, { "id": 72363, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590746", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590746", "securityControlId": 31611, "ccis": [], "uuid": "f99af205-4aa9-525d-bcee-e4b00c1a12a6", "testId": "IAO-03_A47", "test": "a security plan for the system is developed that includes security-related activities affecting the system that require planning and coordination with individuals or groups.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.14[01]", "defaultText": null }, { "id": 72364, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590746", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590746", "securityControlId": 31611, "ccis": [], "uuid": "64482e63-8d04-5509-b337-77fe15d79aa4", "testId": "IAO-03_A48", "test": "a privacy plan for the system is developed that includes privacy-related activities affecting the system that require planning and coordination with individuals or groups.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.14[02]", "defaultText": null }, { "id": 72365, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590746", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590746", "securityControlId": 31611, "ccis": [], "uuid": "146f955c-baca-5106-823b-4542c5e1ee78", "testId": "IAO-03_A49", "test": "a security plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.15[01]", "defaultText": null }, { "id": 72366, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590746", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590747", "securityControlId": 31611, "ccis": [], "uuid": "550f1367-fdf6-5a4f-a2b2-a78eb4800877", "testId": "IAO-03_A50", "test": "a privacy plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02a.15[02]", "defaultText": null }, { "id": 72367, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590747", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590747", "securityControlId": 31611, "ccis": [], "uuid": "80ce2bb9-6aeb-5e7c-97ab-5378b0652330", "testId": "IAO-03_A51", "test": "copies of the plans are distributed to personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02b.[01]", "defaultText": null }, { "id": 72368, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590747", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590747", "securityControlId": 31611, "ccis": [], "uuid": "5479cb5d-9b2f-55e2-a40f-e8d3b7583ebf", "testId": "IAO-03_A52", "test": "subsequent changes to the plans are communicated to personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02b.[02]", "defaultText": null }, { "id": 72369, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590747", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590747", "securityControlId": 31611, "ccis": [], "uuid": "d38340fd-fb10-5675-ab6b-69cb5106f170", "testId": "IAO-03_A53", "test": "plans are reviewed frequently.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PL-02c.", "defaultText": null }, { "id": 72370, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590747", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590747", "securityControlId": 31611, "ccis": [], "uuid": "785f580f-3bbe-5b0b-aefa-0f57f7e19765", "testId": "IAO-03_A54", "test": "plans are updated to address changes to the system and environment of operations.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02d.[01]", "defaultText": null }, { "id": 72371, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590747", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590747", "securityControlId": 31611, "ccis": [], "uuid": "b2eb6b6c-421c-54e7-9993-031777bf1407", "testId": "IAO-03_A55", "test": "plans are updated to address problems identified during the plan implementation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02d.[02]", "defaultText": null }, { "id": 72372, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590748", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590748", "securityControlId": 31611, "ccis": [], "uuid": "2b4f8310-e524-5d95-814f-80f9bff57231", "testId": "IAO-03_A56", "test": "plans are updated to address problems identified during control assessments.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-02d.[03]", "defaultText": null }, { "id": 72373, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590748", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590748", "securityControlId": 31611, "ccis": [], "uuid": "f28b2eb3-103f-591f-b880-b0e48e12e1f0", "testId": "IAO-03_A57", "test": "plans are protected from unauthorized disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PL-02e.[01]", "defaultText": null }, { "id": 72374, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590748", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590748", "securityControlId": 31611, "ccis": [], "uuid": "f47be6b5-1ffb-5dc1-876f-f8ae01e23166", "testId": "IAO-03_A58", "test": "plans are protected from unauthorized modification.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PL-02e.[02]", "defaultText": null }, { "id": 72375, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590748", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590748", "securityControlId": 31611, "ccis": [], "uuid": "82863796-3102-5f28-b13d-aee781d55956", "testId": "IAO-03_A59", "test": "the system components on which CUI is stored are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.04.11.a[02]", "defaultText": null }, { "id": 72376, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590748", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590748", "securityControlId": 31611, "ccis": [], "uuid": "34a7f651-b1b2-5f5d-b0aa-7439d9dd215a", "testId": "IAO-03_A60", "test": "the system components on which CUI is stored are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.04.11.a[03]", "defaultText": null }, { "id": 72377, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590748", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590748", "securityControlId": 31611, "ccis": [], "uuid": "8683474a-71ab-523b-9113-c8957b2dc281", "testId": "IAO-03_A61", "test": "changes to the system or system component location where CUI is processed are documented.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.04.11.b[01]", "defaultText": null }, { "id": 72378, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590748", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590748", "securityControlId": 31611, "ccis": [], "uuid": "77b48343-74f0-575a-aecb-adf308d9d4e7", "testId": "IAO-03_A62", "test": "changes to the system or system component location where CUI is stored are documented.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.04.11.b[02]", "defaultText": null }, { "id": 72379, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590749", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590749", "securityControlId": 31611, "ccis": [], "uuid": "cc7b9bc7-1c07-5a3e-acd2-7cd9249fb1a8", "testId": "IAO-03_A63", "test": "a system security plan that includes other relevant information necessary for the protection of CUI is developed.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.15.02.a.08", "defaultText": null }, { "id": 72380, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590749", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590749", "securityControlId": 31611, "ccis": [], "uuid": "f868dccf-d720-5dde-963e-cfcbf951189f", "testId": "IAO-03_A64", "test": "the system security plan is reviewed .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months, or when there are significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.15.02.b[01]", "defaultText": null }, { "id": 72381, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590749", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590749", "securityControlId": 31611, "ccis": [], "uuid": "fb11a58a-4107-5e8e-b581-f66283e2c01d", "testId": "IAO-03_A65", "test": "the system security plan is updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months, or when there are significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.15.02.b[02]", "defaultText": null } ], "externalMappings": [ { "id": 584188, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41727a0a-4efc-56ab-b8f4-1eede2856856", "parentControlId": 31611, "controlId": "PL-2", "title": "PL-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58689" }, { "id": 584189, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3c0cd39-05e0-55e6-8e5b-653fb9b8bc10", "parentControlId": 31611, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58689" }, { "id": 584191, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e402fc25-8b33-51ad-9499-6245773e9c8d", "parentControlId": 31611, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58689" }, { "id": 584192, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ba02277-c331-5682-8b1c-cea5b467e24e", "parentControlId": 31611, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58689" }, { "id": 584193, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3315365a-9213-5bc0-a51e-18add006b00c", "parentControlId": 31611, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58689" }, { "id": 584194, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e283e5a2-5dcf-5ca2-869b-9e1a4d1bd28c", "parentControlId": 31611, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586891" }, { "id": 584195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "720798f7-013f-51df-93db-fad7058ab172", "parentControlId": 31611, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586891" }, { "id": 584196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b28142c-1de3-56e1-8396-e374f9172005", "parentControlId": 31611, "controlId": "PL-2", "title": "PL-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586891" }, { "id": 584197, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc1fdd0c-036f-5f24-bfe5-c396351d3793", "parentControlId": 31611, "controlId": "PL-2", "title": "PL-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586891" }, { "id": 584198, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4305718a-dd1b-5cc1-993b-1a0f89dbdc29", "parentControlId": 31611, "controlId": "PL-2", "title": "PL-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586892" }, { "id": 584200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8267f4df-27e6-5b9b-b113-c0d88c099837", "parentControlId": 31611, "controlId": "3.12.4", "title": "3.12.4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586892" }, { "id": 584201, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65593b1f-9e5f-5703-9065-a9f5ec54f1ef", "parentControlId": 31611, "controlId": "03.04.11.b", "title": "03.04.11.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586892" }, { "id": 584202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12640df5-dce9-53f3-b0e8-6f424b160491", "parentControlId": 31611, "controlId": "03.15.02.a", "title": "03.15.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586892" }, { "id": 584203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7cce5c5-8c20-5848-8016-9133dfe87d54", "parentControlId": 31611, "controlId": "03.15.02.a.01", "title": "03.15.02.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586893" }, { "id": 584204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38e3a705-1615-5d2d-8885-74ad7468b270", "parentControlId": 31611, "controlId": "03.15.02.a.02", "title": "03.15.02.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586893" }, { "id": 584205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f6bc2f4-1363-565f-949e-8359bbfbda1a", "parentControlId": 31611, "controlId": "03.15.02.a.03", "title": "03.15.02.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586893" }, { "id": 584206, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a93bb7b3-a9e1-5c2c-8d7f-043f8c4cd5be", "parentControlId": 31611, "controlId": "03.15.02.a.04", "title": "03.15.02.a.04", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586893" }, { "id": 584207, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79d72f3e-8fb6-5bfb-a360-cbbabd4634ff", "parentControlId": 31611, "controlId": "03.15.02.a.05", "title": "03.15.02.a.05", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586893" }, { "id": 584208, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a563456e-4f29-5dc4-b4f0-8c0e732cbbac", "parentControlId": 31611, "controlId": "03.15.02.a.06", "title": "03.15.02.a.06", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586893" }, { "id": 584209, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35490f13-3b1b-5b91-b786-d1ced79ac9aa", "parentControlId": 31611, "controlId": "03.15.02.a.07", "title": "03.15.02.a.07", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586893" }, { "id": 584210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0df90177-7e51-5bf3-8d68-8786cb14a97e", "parentControlId": 31611, "controlId": "03.15.02.a.08", "title": "03.15.02.a.08", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586893" }, { "id": 584211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2cc04c56-20e5-5df0-8776-d62df3928d3a", "parentControlId": 31611, "controlId": "03.15.02.b", "title": "03.15.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586893" }, { "id": 584284, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9842f286-7afb-5495-b94c-958353c45bf8", "parentControlId": 31611, "controlId": "11-3.a(2)(b)3", "title": "11-3.a(2)(b)3", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586904" }, { "id": 584285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586904", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5a52536-f885-5a17-84c5-ab7b252fc111", "parentControlId": 31611, "controlId": "11-3.b(3)", "title": "11-3.b(3)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586904" }, { "controlId": "C.13.3", "title": "C.13.3 — Corrective Action Program", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-5, IR-4, PM-14", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "31df1832-e106-5bc1-9aa4-1cf34ddca072", "isPublic": true }, { "controlId": "NEI 08-09 App E.13.3 (CAP)", "title": "NEI 08-09 App E.13.3 (CAP) — Corrective Action Program", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.13.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "2bbb45c3-44d1-588f-b672-289ec8bf7bf7", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3), 73.55(b)(10)", "title": "10 CFR 73.54(d)(3), 73.55(b)(10) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.13.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "72b5db0b-6cea-5b38-99b9-1569c2e46548", "isPublic": true }, { "controlId": "NSS-17T-Sec4.9", "title": "NSS-17T-Sec4.9 — Periodic Computer Security Review, Walkdowns & Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b2e7592f-f189-51a2-a13c-039b8a61e363", "isPublic": true }, { "controlId": "IEC-62645-5.4", "title": "IEC-62645-5.4 — Independent Computer Security Assessment and Audit", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "0c90ef9a-a3cc-5c06-9bdd-0f4e15a07f7f", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.f", "title": "DOE-O-205.1D-4.f — Authorization to Operate (ATO) and Continuous Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "397ea7f3-7578-5a12-8294-f2355887a858", "isPublic": true } ], "id": 31611, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731177", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731177", "catalogueId": 1062, "uuid": "406ad29d-4f6b-53d1-ac47-d0a4747dd1ac", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization generate authoritative documentation (e.g., System Security Plan (SSP)) that:\n(1) Identifies key architectural and implementation information on in-scope Technology Assets, Applications and/or Services (TAAS);\n(2) Reflects the current state of applied security, compliance and resilience controls on applicable People, Processes, Technologies, Data and/or Facilities (PPTDF) that are contained within the system boundary; and\n(3) Provides a historical record of applied security controls, including changes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Applied Security, Compliance and Resilience Controls Documentation", "description": "

Control Description

Mechanisms exist to generate authoritative documentation (e.g., System Security Plan (SSP)) that:\n(1) Identifies key architectural and implementation information on in-scope Technology Assets, Applications and/or Services (TAAS);\n(2) Reflects the current state of applied security, compliance and resilience controls on applicable People, Processes, Technologies, Data and/or Facilities (PPTDF) that are contained within the system boundary; and\n(3) Provides a historical record of applied security controls, including changes.

Evidence Request List (ERL)

E-TDA-14

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Information Assurance (IAO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Information Assurance (IA)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ IA management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to develop and maintain System Security Plans (SSPs) or similar documentation, to identify and maintain key architectural information for each business-critical Technology Assets, Applications and/or Services (TAAS).

Level 3 - Well Defined: Information Assurance (IAO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are well-documented and kept current by process owners.\n▪ An information assurance team, or similar function, is appropriately staffed and supported to implement and maintain IAO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of information assurance operations (e.g., assessment scheduling software, risk assessment software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to generate authoritative documentation (e.g., System Security Plan (SSP)) that:\n(1) Identifies key architectural and implementation information on in-scope Technology Assets, Applications and/or Services (TAAS);\n(2) Reflects the current state of applied security, compliance and resilience controls on applicable People, Processes, Technologies, Data and/or Facilities (PPTDF) that are contained within the system boundary; and\n(3) Provides a historical record of applied security controls, including changes.

Level 4 - Quantitatively Controlled: Information Assurance (IAO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.13.3", "controlId": "IAO-03", "family": "Information Assurance", "enhancements": "", "sortId": "IAO-03", "references": "

Micro-Small Business (<10 staff)

∙ System Security Plan (SSP)\n∙ System Security & Privacy Plan (SSPP)

Small Business (10-49 staff)

∙ System Security Plan (SSP)\n∙ System Security & Privacy Plan (SSPP)

Medium Business (50-249 staff)

∙ System Security Plan (SSP)\n∙ System Security & Privacy Plan (SSPP)

Large Business (250-999 staff)

∙ System Security Plan (SSP)\n∙ System Security & Privacy Plan (SSPP)

Enterprise (>1,000 staff)

∙ System Security Plan (SSP)\n∙ System Security & Privacy Plan (SSPP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72382, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590749", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590749", "securityControlId": 31612, "ccis": [], "uuid": "5b4da3b2-fc0c-5f65-8e0c-70506b2671f1", "testId": "IAO-03.1_A01", "test": "a cybersecurity / data privacy plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-02a.09[01]\n53A_R5_PL-02a.09[02]", "defaultText": null } ], "externalMappings": [ { "id": 584333, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f1f7950-527a-5804-9050-fa0fe569beee", "parentControlId": 31612, "controlId": "PL-2(3)", "title": "PL-2(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58692" }, { "id": 584334, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70f977b8-647d-5f13-87fb-40335709541d", "parentControlId": 31612, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58692" }, { "id": 584336, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0760b27-aef7-5f08-87a5-d1b5cdabaaa1", "parentControlId": 31612, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58692" }, { "id": 584337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48805fe2-9bd9-55ee-9081-e6214e1f085e", "parentControlId": 31612, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58692" }, { "id": 584338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f79babe-fb15-5ccb-b7f8-840c3e750a59", "parentControlId": 31612, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58692" }, { "id": 584339, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b598c557-adea-5403-a413-092f704420f2", "parentControlId": 31612, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58692" }, { "id": 584340, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c640a06c-5ada-5607-be07-81f7ce9f062c", "parentControlId": 31612, "controlId": "PL-02", "title": "PL-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58692" }, { "id": 584341, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df801e41-5038-5aef-ae2c-28d75f805932", "parentControlId": 31612, "controlId": "PL-2", "title": "PL-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586921" }, { "id": 584342, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad4433fd-2534-530c-8caa-d913bf7b454b", "parentControlId": 31612, "controlId": "PL-2", "title": "PL-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586921" }, { "id": 584343, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27f149e0-278c-5277-8a2d-a60146c0605a", "parentControlId": 31612, "controlId": "PL-2", "title": "PL-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586921" }, { "id": 584345, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9db988b-78d5-5fd2-99c2-c640803eab4b", "parentControlId": 31612, "controlId": "NFO - PL-2(3)", "title": "NFO - PL-2(3)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586921" } ], "id": 31612, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731178", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731178", "catalogueId": 1062, "uuid": "ffa11762-6fc3-55ad-969f-18b6cb0de6b4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization plan and coordinate Information Assurance Program (IAP) activities with affected stakeholders before conducting such activities in order to reduce the potential impact on operations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Plan / Coordinate with Other Organizational Entities", "description": "

Control Description

Mechanisms exist to plan and coordinate Information Assurance Program (IAP) activities with affected stakeholders before conducting such activities in order to reduce the potential impact on operations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Information Assurance (IAO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Information Assurance (IA)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ IA management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.

Level 3 - Well Defined: Information Assurance (IAO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are well-documented and kept current by process owners.\n▪ An information assurance team, or similar function, is appropriately staffed and supported to implement and maintain IAO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of information assurance operations (e.g., assessment scheduling software, risk assessment software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to plan and coordinate Information Assurance Program (IAP) activities with affected stakeholders before conducting such activities in order to reduce the potential impact on operations.

Level 4 - Quantitatively Controlled: Information Assurance (IAO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAO-03.1", "family": "Information Assurance", "enhancements": "", "sortId": "IAO-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Document security assurance requirements for critical systems

Small Business (10-49 staff)

∙ Security assurance checklist for critical systems

Medium Business (50-249 staff)

∙ Audit steering committee\n∙ Information Assurance (IA) program\n∙ VisibleOps security management

Large Business (250-999 staff)

∙ Audit steering committee\n∙ Information Assurance (IA) program\n∙ VisibleOps security management

Enterprise (>1,000 staff)

∙ Audit steering committee\n∙ Information Assurance (IA) program\n∙ VisibleOps security management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72383, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59075", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59075", "securityControlId": 31613, "ccis": [], "uuid": "466f48ed-189a-5877-923e-39032a778f77", "testId": "IAO-03.2_A01", "test": "sensitive / regulated data that is collected, developed, received, transmitted, used or stored in support of the performance of a contract is protected.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 584364, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586925", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a2816bd-7975-52f8-acd6-9fd93b8662b7", "parentControlId": 31613, "controlId": "3.12.4", "title": "3.12.4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586925" }, { "id": 584365, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586925", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad5a5c00-d92d-52f1-93bd-ccf7801c4243", "parentControlId": 31613, "controlId": "GV.SC-05", "title": "GV.SC-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586925" } ], "id": 31613, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731178", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731178", "catalogueId": 1062, "uuid": "cee23dda-1d46-5898-9728-2f31d72b787c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect sensitive/regulated data that is collected, developed, received, transmitted, used or stored in support of the performance of a contract?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Adequate Security for Sensitive / Regulated Data In Support of Contracts", "description": "

Control Description

Mechanisms exist to protect sensitive/regulated data that is collected, developed, received, transmitted, used or stored in support of the performance of a contract.

Evidence Request List (ERL)

E-IAO-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Information Assurance (IAO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Information Assurance (IA)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ IA management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.

Level 3 - Well Defined: Information Assurance (IAO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are well-documented and kept current by process owners.\n▪ An information assurance team, or similar function, is appropriately staffed and supported to implement and maintain IAO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of information assurance operations (e.g., assessment scheduling software, risk assessment software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to protect sensitive/regulated data that is collected, developed, received, transmitted, used or stored in support of the performance of a contract.

Level 4 - Quantitatively Controlled: Information Assurance (IAO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAO-03.2", "family": "Information Assurance", "enhancements": "", "sortId": "IAO-03.2", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Contract flow-down requirements

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Contract flow-down requirements

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Contract flow-down requirements

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Contract flow-down requirements

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Contract flow-down requirements", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72384, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59075", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59075", "securityControlId": 31614, "ccis": [], "uuid": "d624b2a1-033f-50cd-ae0f-004685efef97", "testId": "IAO-04_A01", "test": "the breadth of penetration testing is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(05)_ODP[01]", "defaultText": null }, { "id": 72385, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59075", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59075", "securityControlId": 31614, "ccis": [], "uuid": "0cbc0998-f67e-54a3-96f6-745b913b55f3", "testId": "IAO-04_A02", "test": "the depth of penetration testing is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(05)_ODP[02]", "defaultText": null }, { "id": 72386, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59075", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59075", "securityControlId": 31614, "ccis": [], "uuid": "00e7f0d6-3506-562b-bfdf-bbf014ec0e33", "testId": "IAO-04_A03", "test": "constraints of penetration testing are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(05)_ODP[03]", "defaultText": null }, { "id": 72387, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590751", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590751", "securityControlId": 31614, "ccis": [], "uuid": "b21833cc-0307-5068-acb9-33f513dfc176", "testId": "IAO-04_A04", "test": "the developer of the system, system component, or system service is required to perform penetration testing at an organization-defined breadth.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(05)(a)[01]", "defaultText": null }, { "id": 72388, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590751", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590751", "securityControlId": 31614, "ccis": [], "uuid": "9fc6ddf5-4d71-5646-bcc1-ef53f16ed163", "testId": "IAO-04_A05", "test": "the developer of the system, system component, or system service is required to perform penetration testing at an organization-defined level of rigor.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(05)(a)[02]", "defaultText": null }, { "id": 72389, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590751", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590751", "securityControlId": 31614, "ccis": [], "uuid": "521b2fab-b545-5a93-9b4a-859e61c4e3f3", "testId": "IAO-04_A06", "test": "the developer of the system, system component, or system service is required to perform penetration testing under organization-defined constraints.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(05)(b)", "defaultText": null } ], "externalMappings": [ { "id": 584413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586931", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b93572b8-a7dd-508d-9e27-3f1e9d2f8bc5", "parentControlId": 31614, "controlId": "ORG 2.4(c)", "title": "ORG 2.4(c)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586931" }, { "id": 584421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586932", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0ec3e1b-ea29-5c95-8f8d-1c41156000e0", "parentControlId": 31614, "controlId": "8.25", "title": "8.25", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586932" }, { "id": 584436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586933", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09d34e7d-82aa-5334-b07c-11ea97581ec5", "parentControlId": 31614, "controlId": "SA-11(05)", "title": "SA-11(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586933" }, { "id": 584438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586933", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06941b42-3026-5723-a656-046a5b03627c", "parentControlId": 31614, "controlId": "SA-11(05)", "title": "SA-11(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586933" }, { "controlId": "A.4.2.3", "title": "A.4.2.3 — Security Reassessment and Authorization", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-6, CA-2, CM-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "9b93ac7c-1543-5852-8ee8-9a0b095618ac", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.3", "title": "NEI 08-09 Sec 4.2.3 — Security Reassessment and Authorization", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "9ccd345b-627d-55f2-8dd8-346b886678e9", "isPublic": true }, { "controlId": "10 CFR 73.54(e)", "title": "10 CFR 73.54(e) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "8b4be6ed-2eff-57ad-ab9d-0829490ec018", "isPublic": true }, { "controlId": "NSS-17T-Sec4.9", "title": "NSS-17T-Sec4.9 — Periodic Computer Security Review, Walkdowns & Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "de1bc861-b841-500d-91b0-1197302d7445", "isPublic": true }, { "controlId": "IEC-62645-5.4", "title": "IEC-62645-5.4 — Independent Computer Security Assessment and Audit", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "b44a34e4-280a-5438-a681-003e3d2ceefb", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.f", "title": "DOE-O-205.1D-4.f — Authorization to Operate (ATO) and Continuous Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "84784af4-4aac-5624-a14d-6c2c4a1dacc3", "isPublic": true } ], "id": 31614, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731178", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731178", "catalogueId": 1062, "uuid": "f28dc7d0-fab0-50b8-a9e0-a686ab0cd04d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require system developers and integrators to create and execute a Security Testing and Evaluation (ST&E) plan to identify and remediate flaws during development?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Threat Analysis & Flaw Remediation During Development", "description": "

Control Description

Mechanisms exist to require system developers and integrators to create and execute a Security Testing and Evaluation (ST&E) plan, or similar process, to identify and remediate flaws during development.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Information Assurance (IAO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Information Assurance (IA)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ IA management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.

Level 3 - Well Defined: Information Assurance (IAO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are well-documented and kept current by process owners.\n▪ An information assurance team, or similar function, is appropriately staffed and supported to implement and maintain IAO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of information assurance operations (e.g., assessment scheduling software, risk assessment software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require system developers and integrators to create and execute a Security Testing and Evaluation (ST&E) plan, or similar process, to identify and remediate flaws during development.

Level 4 - Quantitatively Controlled: Information Assurance (IAO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.2.3", "controlId": "IAO-04", "family": "Information Assurance", "enhancements": "", "sortId": "IAO-04", "references": "

Micro-Small Business (<10 staff)

∙ Pre-production Control Validation Testing (CVT)

Small Business (10-49 staff)

∙ Pre-production Control Validation Testing (CVT)

Medium Business (50-249 staff)

∙ Pre-production Control Validation Testing (CVT)

Large Business (250-999 staff)

∙ Pre-production Control Validation Testing (CVT)

Enterprise (>1,000 staff)

∙ Pre-production Control Validation Testing (CVT)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72390, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590752", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590752", "securityControlId": 31615, "ccis": [], "uuid": "84d9b773-d183-5965-aa73-8ef2a7625fb7", "testId": "IAO-05_A01", "test": "deficiencies and vulnerabilities to be addressed by the plan of action are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.12.2[a]", "defaultText": null }, { "id": 72391, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590752", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590752", "securityControlId": 31615, "ccis": [], "uuid": "d5634221-98dc-56e7-8c77-8c9c6af672bb", "testId": "IAO-05_A02", "test": "a plan of action is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-05a.\n171A_3.12.2[b]", "defaultText": null }, { "id": 72392, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590752", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590752", "securityControlId": 31615, "ccis": [], "uuid": "cc980e26-a3f7-5cf0-8d23-8b800d75f8ba", "testId": "IAO-05_A03", "test": "the frequency at which to update an existing plan of action based on the findings from control assessments, independent audits or reviews and continuous monitoring activities is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-05_ODP", "defaultText": null }, { "id": 72393, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590752", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590752", "securityControlId": 31615, "ccis": [], "uuid": "eb51ea56-5e6e-564a-8c47-b057122ee916", "testId": "IAO-05_A04", "test": "existing plan of action is updated organization-defined frequency based on the findings from control assessments, independent audits or reviews and continuous monitoring activities.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least monthly", "otherId": "53A_R5_CA-05b.", "defaultText": null }, { "id": 72394, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590752", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590752", "securityControlId": 31615, "ccis": [], "uuid": "9ee2525b-ca77-5523-a69a-3111ea19f39c", "testId": "IAO-05_A05", "test": "a process to ensure the plan of action for the cybersecurity program and associated organizational systems is developed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-04a.01[01]", "defaultText": null }, { "id": 72395, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590753", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590753", "securityControlId": 31615, "ccis": [], "uuid": "41557630-28ce-51e1-b081-465c17c2be3c", "testId": "IAO-05_A06", "test": "a process to ensure the plan of action for the cybersecurity program and associated organizational systems is maintained.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-04a.01[02]", "defaultText": null }, { "id": 72396, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590753", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590753", "securityControlId": 31615, "ccis": [], "uuid": "2e86c644-165a-57b2-99eb-ec775a6834af", "testId": "IAO-05_A07", "test": "a process to ensure the plan of action for the privacy program and associated organizational systems is developed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-04a.01[03]", "defaultText": null }, { "id": 72397, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590753", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590753", "securityControlId": 31615, "ccis": [], "uuid": "d716eea2-de49-552b-8a1e-3edbbb01fb44", "testId": "IAO-05_A08", "test": "a process to ensure the plan of action for the privacy program and associated organizational systems is maintained.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-04a.01[04]", "defaultText": null }, { "id": 72398, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590753", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590753", "securityControlId": 31615, "ccis": [], "uuid": "932cfd03-33e9-5757-b87f-c4b6db7680a7", "testId": "IAO-05_A09", "test": "a process to ensure the plan of action for the supply chain risk management program and associated organizational systems is developed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-04a.01[05]", "defaultText": null }, { "id": 72399, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590754", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590754", "securityControlId": 31615, "ccis": [], "uuid": "96487332-b4a9-560a-9b76-2fc8f7d3ec35", "testId": "IAO-05_A10", "test": "a process to ensure the plan of action for the supply chain risk management program and associated organizational systems is maintained.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-04a.01[06]", "defaultText": null }, { "id": 72400, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590754", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590754", "securityControlId": 31615, "ccis": [], "uuid": "ec214cf3-c010-51a7-95a5-b6187aee5328", "testId": "IAO-05_A11", "test": "a process to ensure the plan of action for the cybersecurity program and associated organizational systems documents remedial cybersecurity risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations and the Nation.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PM-04a.02[01]", "defaultText": null }, { "id": 72401, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590754", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590754", "securityControlId": 31615, "ccis": [], "uuid": "51534797-bca7-5fe5-b906-cb62e85ce47e", "testId": "IAO-05_A12", "test": "a process to ensure the plan of action for the privacy program and associated organizational systems documents remedial privacy risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations and the Nation.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PM-04a.02[02]", "defaultText": null }, { "id": 72402, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590754", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590754", "securityControlId": 31615, "ccis": [], "uuid": "dcb52796-a123-53fc-8996-03fa357be8f7", "testId": "IAO-05_A13", "test": "a process to ensure the plan of action for the supply chain risk management program and associated organizational systems documents remedial supply chain risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations and the Nation.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PM-04a.02[03]", "defaultText": null }, { "id": 72403, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590755", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590755", "securityControlId": 31615, "ccis": [], "uuid": "6ce3bc21-d791-562b-8892-5f677988f1a1", "testId": "IAO-05_A14", "test": "a process to ensure the plan of action for the cybersecurity risk management programs and associated organizational systems is reported in accordance with established reporting requirements.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PM-04a.03[01]", "defaultText": null }, { "id": 72404, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590755", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590755", "securityControlId": 31615, "ccis": [], "uuid": "38d55cd0-df7a-5a58-ab36-ad27679ea009", "testId": "IAO-05_A15", "test": "a process to ensure the plan of action for the privacy risk management programs and associated organizational systems is reported in accordance with established reporting requirements.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PM-04a.03[02]", "defaultText": null }, { "id": 72405, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590755", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590755", "securityControlId": 31615, "ccis": [], "uuid": "bccc98f1-1d81-5111-a49a-9ad2d775df62", "testId": "IAO-05_A16", "test": "a process to ensure the plan of action for the supply chain risk management programs and associated organizational systems is reported in accordance with established reporting requirements.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PM-04a.03[03]", "defaultText": null }, { "id": 72406, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590755", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590755", "securityControlId": 31615, "ccis": [], "uuid": "79a5a124-9f65-5983-8e70-89f4a8e44abe", "testId": "IAO-05_A17", "test": "plan of action is reviewed for consistency with the organizational risk management strategy.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-04b.[01]", "defaultText": null }, { "id": 72407, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590756", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590756", "securityControlId": 31615, "ccis": [], "uuid": "f699cdaf-98da-5482-a708-6dcd829681c4", "testId": "IAO-05_A18", "test": "plan of action is reviewed for consistency with organization-wide priorities for risk response actions.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-04b.[02]", "defaultText": null }, { "id": 72408, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590756", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590756", "securityControlId": 31615, "ccis": [], "uuid": "49343a65-8b49-5054-bccb-ea810c9c622f", "testId": "IAO-05_A19", "test": "the developer of the system, system component or system service is required to select and employ security tracking tools for use during the development process.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-15(02)[01]", "defaultText": null }, { "id": 72409, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590756", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590756", "securityControlId": 31615, "ccis": [], "uuid": "e3c2bfda-11a9-5e11-aad6-c58b62a4d44c", "testId": "IAO-05_A20", "test": "the developer of the system, system component or system service is required to select and employ privacy tracking tools for use during the development process.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-15(02)[02]", "defaultText": null }, { "id": 72410, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590756", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590756", "securityControlId": 31615, "ccis": [], "uuid": "e53d3633-f884-59fc-a175-56cd31d6dcf1", "testId": "IAO-05_A21", "test": "the frequency at which to update an existing plan of action based on the findings from control assessments, independent audits or reviews and continuous monitoring activities is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-05_ODP", "defaultText": null }, { "id": 72411, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590756", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590756", "securityControlId": 31615, "ccis": [], "uuid": "323ff8ee-76b1-5ac1-a9aa-e34d25f76175", "testId": "IAO-05_A22", "test": "a plan of action is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-05a.", "defaultText": null }, { "id": 72412, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590757", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590757", "securityControlId": 31615, "ccis": [], "uuid": "d17057b7-8432-5049-8a60-9474272a6b11", "testId": "IAO-05_A23", "test": "existing plan of action is updated per an organization-defined frequency based on the findings from control assessments, independent audits or reviews and continuous monitoring activities.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least monthly", "otherId": "53A_R5_CA-05b.", "defaultText": null }, { "id": 72413, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590757", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590757", "securityControlId": 31615, "ccis": [], "uuid": "ba591c3f-5870-5fa4-8525-b9072e700797", "testId": "IAO-05_A24", "test": "a plan of action is developed to document the planned remediation actions for correcting weaknesses or deficiencies noted during security assessments.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.12.02.a.01", "defaultText": null }, { "id": 72414, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590757", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590757", "securityControlId": 31615, "ccis": [], "uuid": "7b26f7d7-ecba-5342-8a72-a33df895fd8d", "testId": "IAO-05_A25", "test": "a plan of action is developed to reduce or eliminate known system vulnerabilities.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.12.02.a.02", "defaultText": null }, { "id": 72415, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590757", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590757", "securityControlId": 31615, "ccis": [], "uuid": "67071dde-37ae-5d43-a121-87abee750dd7", "testId": "IAO-05_A26", "test": "the existing plan of action is updated based on the findings from security assessments.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.12.02.b.01", "defaultText": null }, { "id": 72416, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590757", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590757", "securityControlId": 31615, "ccis": [], "uuid": "69d3ce57-4799-577a-bde5-aaeeb720b63f", "testId": "IAO-05_A27", "test": "the existing plan of action is updated based on the findings from audits or reviews.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.12.02.b.02", "defaultText": null }, { "id": 72417, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590757", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590758", "securityControlId": 31615, "ccis": [], "uuid": "26fbb227-a044-5012-8d41-9c6654cfdb8b", "testId": "IAO-05_A28", "test": "the existing plan of action is updated based on the findings from continuous monitoring activities.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.12.02.b.03", "defaultText": null }, { "id": 72418, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590758", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590758", "securityControlId": 31615, "ccis": [], "uuid": "92b146cb-0c9c-5b66-845f-f428f5c6d9f6", "testId": "IAO-05_A29", "test": "the plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.12.2[c]", "defaultText": null } ], "externalMappings": [ { "id": 584556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c68a79ea-653c-54d4-affc-45aa2fc078bb", "parentControlId": 31615, "controlId": "CA-5", "title": "CA-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586948" }, { "id": 584557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed9d78ac-b85d-5a44-9f98-e965ca5d6420", "parentControlId": 31615, "controlId": "PM-4", "title": "PM-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586948" }, { "id": 584558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28b58388-30de-53b9-b9ec-b5ca7152a468", "parentControlId": 31615, "controlId": "CA-05", "title": "CA-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586948" }, { "id": 584559, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f87fcab-9d79-50e6-bece-c55b96687473", "parentControlId": 31615, "controlId": "PM-04", "title": "PM-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586948" }, { "id": 584560, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586948", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "366a45b0-a362-5664-85d3-1e933dce1a8a", "parentControlId": 31615, "controlId": "SA-15(02)", "title": "SA-15(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586948" }, { "id": 584563, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3311f768-a377-5acd-bd9b-140cbd12ee8b", "parentControlId": 31615, "controlId": "CA-05", "title": "CA-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586949" }, { "id": 584564, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a896a19-d0c2-5ea7-9921-f3cd4269f924", "parentControlId": 31615, "controlId": "CA-05", "title": "CA-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586949" }, { "id": 584565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2465514-6923-5ef0-8c08-1f7f0f543dda", "parentControlId": 31615, "controlId": "PM-04", "title": "PM-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586949" }, { "id": 584566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad69b2cf-9da4-522e-8583-9f15ad609107", "parentControlId": 31615, "controlId": "SA-15(02)", "title": "SA-15(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586949" }, { "id": 584567, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32ab49c6-aa1a-54d7-bdb4-cbcec745002c", "parentControlId": 31615, "controlId": "CA-05", "title": "CA-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586949" }, { "id": 584568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58695", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4b29dc1-5ec8-5f26-9184-cf22171c4294", "parentControlId": 31615, "controlId": "PM-04", "title": "PM-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58695" }, { "id": 584569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58695", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa9e7cd1-f4b4-5543-a873-87f70003667d", "parentControlId": 31615, "controlId": "CA-05", "title": "CA-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58695" }, { "id": 584570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58695", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bc5357f-d91f-5381-9d04-ae817b2a462b", "parentControlId": 31615, "controlId": "PM-04", "title": "PM-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58695" }, { "id": 584571, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58695", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f23b939d-5684-5f4c-9a12-41f80efc7775", "parentControlId": 31615, "controlId": "CA-05", "title": "CA-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58695" }, { "id": 584572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58695", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d02b018-c060-5e48-ab11-34886c0e34b4", "parentControlId": 31615, "controlId": "PM-04", "title": "PM-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58695" }, { "id": 584573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58695", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b889ec7e-02aa-5caf-8b98-5a58a8ab5abb", "parentControlId": 31615, "controlId": "CA-5", "title": "CA-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58695" }, { "id": 584574, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58695", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "225d3aa1-a7c4-577e-8dad-7a9c0bd2b671", "parentControlId": 31615, "controlId": "PM-4", "title": "PM-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58695" }, { "id": 584575, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58695", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce5fcd12-4fd8-5442-aaec-824e1e4d5da5", "parentControlId": 31615, "controlId": "CA-5", "title": "CA-5", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586951" }, { "id": 584580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586951", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bacf1549-c691-5721-86c9-334fa51ab98f", "parentControlId": 31615, "controlId": "3.12.2", "title": "3.12.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586951" }, { "id": 584581, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586951", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ac17a71-c597-538b-b721-4606a653d12f", "parentControlId": 31615, "controlId": "03.04.11.b", "title": "03.04.11.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586951" }, { "id": 584582, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586951", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "109ae524-7020-5faa-813e-0013bebe9108", "parentControlId": 31615, "controlId": "03.12.02.a", "title": "03.12.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586951" }, { "id": 584583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586952", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a618f144-3c41-5e6c-8723-66f72f02476e", "parentControlId": 31615, "controlId": "03.12.02.a.01", "title": "03.12.02.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586952" }, { "id": 584584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586952", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7874e2c2-f95c-5f4d-9307-916a4da077f5", "parentControlId": 31615, "controlId": "03.12.02.a.02", "title": "03.12.02.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586952" }, { "id": 584585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586952", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab386479-4a1b-5041-91be-5b48dddaee8b", "parentControlId": 31615, "controlId": "03.12.02.b", "title": "03.12.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586952" }, { "id": 584586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586952", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94744211-e2b9-57b0-9c12-4c995b64f3ac", "parentControlId": 31615, "controlId": "03.12.02.b.01", "title": "03.12.02.b.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586952" }, { "id": 584587, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586952", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c1f51b8-f56d-5f0c-8f8a-04311f814d19", "parentControlId": 31615, "controlId": "03.12.02.b.02", "title": "03.12.02.b.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586952" }, { "id": 584588, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586952", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6311991-ae9d-591b-bdd6-7bd9ad6e8807", "parentControlId": 31615, "controlId": "03.12.02.b.03", "title": "03.12.02.b.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586952" }, { "id": 584589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586952", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f24eadf4-7574-5ee5-9cd7-7105d37ac60a", "parentControlId": 31615, "controlId": "03.14.01.a", "title": "03.14.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586952" }, { "id": 584598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586954", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa0c8a33-b229-5c3c-b09d-95131232a05a", "parentControlId": 31615, "controlId": "ID.RA-01", "title": "ID.RA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586954" }, { "id": 584599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586954", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb4bca48-51d3-5819-acf7-d66c6b0f7751", "parentControlId": 31615, "controlId": "ID.IM-01", "title": "ID.IM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586954" }, { "id": 584600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586954", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6e08bc9-94c5-5cd4-866d-518fef997d5b", "parentControlId": 31615, "controlId": "ID.IM-02", "title": "ID.IM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586954" }, { "id": 584608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586955", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a341094-1611-508b-ab4e-bf89e515cea6", "parentControlId": 31615, "controlId": "RISK-3f", "title": "RISK-3f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586955" }, { "id": 584609, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586955", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae760f38-a0cb-509b-9d4a-d297ac3676e9", "parentControlId": 31615, "controlId": "RISK-3g", "title": "RISK-3g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586955" }, { "id": 584640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586968", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3eb3006e-3ac8-5a64-9562-6e9ef357e7b2", "parentControlId": 31615, "controlId": "CIP-007-6 2.4", "title": "CIP-007-6 2.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586968" }, { "controlId": "A.4", "title": "A.4 — Maintaining the Cyber Security Program", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-7, PM-6, SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "95834965-7773-59e3-8a82-0001544511e7", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.0", "title": "NEI 08-09 Sec 4.0 — Maintaining the Cyber Security Program", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "8b6f5754-5076-5c86-aa19-fa0e4deba07c", "isPublic": true }, { "controlId": "10 CFR 73.54(g)", "title": "10 CFR 73.54(g) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "a4732e6e-0880-5646-b3f6-35c3a68681d7", "isPublic": true }, { "controlId": "A.4.1", "title": "A.4.1 — Continuous Monitoring and Assessment", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-7, SI-4, RA-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "2cfb15c8-7622-52b2-8478-c248ca59f611", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.1", "title": "NEI 08-09 Sec 4.1 — Continuous Monitoring and Assessment", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "4ffa6d2c-f708-5cdb-bf5b-5986171ec0ef", "isPublic": true }, { "controlId": "A.4.1.1", "title": "A.4.1.1 — Periodic Assessment of Security Controls", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, CA-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "e34ace6b-5eab-5c1f-88fb-31d4e79a3efd", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.1.1", "title": "NEI 08-09 Sec 4.1.1 — Periodic Assessment of Security Controls", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.1.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "88ab8575-1e74-5289-9a2d-b95c1837e980", "isPublic": true }, { "controlId": "C.13.3", "title": "C.13.3 — Corrective Action Program", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-5, IR-4, PM-14", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "14dfe55f-bd19-5f2e-a861-7ead700c632e", "isPublic": true }, { "controlId": "NEI 08-09 App E.13.3 (CAP)", "title": "NEI 08-09 App E.13.3 (CAP) — Corrective Action Program", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.13.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "107fedad-c7d7-5035-961c-da343c925ec4", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3), 73.55(b)(10)", "title": "10 CFR 73.54(d)(3), 73.55(b)(10) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.13.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "37a552df-75f5-5f8c-b4ce-47cb0876561e", "isPublic": true }, { "controlId": "NSS-17T-Sec4.9", "title": "NSS-17T-Sec4.9 — Periodic Computer Security Review, Walkdowns & Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b70fc1b2-cb44-52e4-82fc-3071be9c3180", "isPublic": true }, { "controlId": "IEC-62645-5.4", "title": "IEC-62645-5.4 — Independent Computer Security Assessment and Audit", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "28ff437a-ec4c-59e1-b618-5e5e7dddfbae", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.f", "title": "DOE-O-205.1D-4.f — Authorization to Operate (ATO) and Continuous Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "dc2dc5d0-2996-5d44-99b9-bdaa31a3ff82", "isPublic": true } ], "id": 31615, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731179", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731179", "catalogueId": 1062, "uuid": "665acbd4-fc9c-5146-b304-651359597d69", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization govern identified deficiencies (e.g., Plan of Action and Milestones (POA&M) or similar methodology) that formally documents, at a minimum:\n(1) Deficiency tracking number;\n(2) Applicable security, compliance and/or resilience control;\n(3) Description of the deficiency(ies);\n(4) Risk associated with the deficiency(ies);\n(5) Source deficiency identification/detection;\n(6) Temporary compensating controls, if applicable;\n(7) Point of Contact (POC) (e.g., asset/process owner);\n(8) Resources required to conduct remediation actions;\n(9) Planned remedial actions to the deficiency(ies);\n(10) Proposed remediation timeline; and\n(11) Disposition statement (e.g., closeout summary)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Capabilities Deficiency Tracking", "description": "

Control Description

Mechanisms exist to govern identified deficiencies (e.g., Plan of Action and Milestones (POA&M) or similar methodology) that formally documents, at a minimum:\n(1) Deficiency tracking number;\n(2) Applicable security, compliance and/or resilience control;\n(3) Description of the deficiency(ies);\n(4) Risk associated with the deficiency(ies);\n(5) Source deficiency identification/detection;\n(6) Temporary compensating controls, if applicable;\n(7) Point of Contact (POC) (e.g., asset/process owner);\n(8) Resources required to conduct remediation actions;\n(9) Planned remedial actions to the deficiency(ies);\n(10) Proposed remediation timeline; and\n(11) Disposition statement (e.g., closeout summary).

Evidence Request List (ERL)

E-RSK-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Information Assurance (IAO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Information Assurance (IA)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ IA management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.

Level 3 - Well Defined: Information Assurance (IAO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are well-documented and kept current by process owners.\n▪ An information assurance team, or similar function, is appropriately staffed and supported to implement and maintain IAO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of information assurance operations (e.g., assessment scheduling software, risk assessment software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to govern identified deficiencies (e.g., Plan of Action and Milestones (POA&M) or similar methodology) that formally documents, at a minimum:\n(1) Deficiency tracking number;\n(2) Applicable security, compliance and/or resilience control;\n(3) Description of the deficiency(ies);\n(4) Risk associated with the deficiency(ies);\n(5) Source deficiency identification/detection;\n(6) Temporary compensating controls, if applicable;\n(7) Point of Contact (POC) (e.g., asset/process owner);\n(8) Resources required to conduct remediation actions;\n(9) Planned remedial actions to the deficiency(ies);\n(10) Proposed remediation timeline; and\n(11) Disposition statement (e.g., closeout summary).

Level 4 - Quantitatively Controlled: Information Assurance (IAO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4, A.4.1, A.4.1.1, C.13.3", "controlId": "IAO-05", "family": "Information Assurance", "enhancements": "", "sortId": "IAO-05", "references": "

Micro-Small Business (<10 staff)

∙ Plan of Action and Milestones (POA&M)\n∙ Risk register

Small Business (10-49 staff)

∙ Plan of Action and Milestones (POA&M)\n∙ Risk register

Medium Business (50-249 staff)

∙ Plan of Action and Milestones (POA&M)\n∙ Risk register

Large Business (250-999 staff)

∙ Plan of Action and Milestones (POA&M)\n∙ Risk register

Enterprise (>1,000 staff)

∙ Plan of Action and Milestones (POA&M)\n∙ Risk register", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72419, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590758", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590758", "securityControlId": 31616, "ccis": [], "uuid": "d9055644-6248-58ac-8826-97d60b9e2616", "testId": "IAO-05.1_A01", "test": "automated mechanisms used to ensure the accuracy, currency, and availability of the plan of action for the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-05(01)_ODP", "defaultText": null }, { "id": 72420, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590758", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590758", "securityControlId": 31616, "ccis": [], "uuid": "b8b7c598-dfdb-55d9-8a72-f8cacda977fe", "testId": "IAO-05.1_A02", "test": "organization-defined automated mechanisms are used to ensure the accuracy, currency, and availability of the plan of action for the system.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CA-05(01)", "defaultText": null } ], "externalMappings": [ { "id": 584669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9cd17787-a1a5-5b76-aa6f-33f3dca68caa", "parentControlId": 31616, "controlId": "CA-5(1)", "title": "CA-5(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586973" }, { "id": 584670, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d32cdcff-e2ad-5042-bd50-0f7f405f0043", "parentControlId": 31616, "controlId": "CA-05(01)", "title": "CA-05(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586973" }, { "id": 584671, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01a4bcf6-eef0-5792-ab56-3edbec9ad738", "parentControlId": 31616, "controlId": "CA-05(01)", "title": "CA-05(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586973" } ], "id": 31616, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731179", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731179", "catalogueId": 1062, "uuid": "5ab77f1d-7621-52a7-a923-cc478dacedd7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to help ensure tracked deficiencies are: \n(1) Accurate;\n(2) Up-to-date; and \n(3) Readily-available?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 2.0, "title": "Deficiency Tracking Automation", "description": "

Control Description

Automated mechanisms exist to help ensure tracked deficiencies are: \n(1) Accurate;\n(2) Up-to-date; and \n(3) Readily-available.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Information Assurance (IAO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Pre-production security testing-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain an informal process to conduct limited control testing of High Value Assets (HVAs) to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Information Assurance (IAO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are well-documented and kept current by process owners.\n▪ An information assurance team, or similar function, is appropriately staffed and supported to implement and maintain IAO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of information assurance operations (e.g., assessment scheduling software, risk assessment software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automate deficiency tracking to ensure records are: \n(1) Accurate;\n(2) Up-to-date; and \n(3) Readily-available.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAO-05.1", "family": "Information Assurance", "enhancements": "", "sortId": "IAO-05.1", "references": "

Micro-Small Business (<10 staff)

∙ Document security assurance requirements for critical systems

Small Business (10-49 staff)

∙ Security assurance checklist for critical systems

Medium Business (50-249 staff)

∙ Formal information assurance program\n∙ Security testing and validation

Large Business (250-999 staff)

∙ Enterprise information assurance program\n∙ Independent security testing

Enterprise (>1,000 staff)

∙ Enterprise IA program\n∙ Formal evaluation (e.g., Common Criteria, FedRAMP)\n∙ Continuous assurance monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72421, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590759", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590759", "securityControlId": 31617, "ccis": [], "uuid": "8d5a3f2f-e871-5045-913a-9638fbceaa1b", "testId": "IAO-06_A01", "test": "the frequency at which to assess controls in the system and its environment of operation is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-02_ODP[01]", "defaultText": null }, { "id": 72422, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590759", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590759", "securityControlId": 31617, "ccis": [], "uuid": "5fa0b95c-4e81-511a-b5da-1ffbe9ee428d", "testId": "IAO-06_A02", "test": "individuals or roles to whom control assessment results are to be provided are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02_ODP[02]", "defaultText": null }, { "id": 72423, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590759", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590759", "securityControlId": 31617, "ccis": [], "uuid": "644dd0d3-0eb9-5429-b8da-a2b063b812e8", "testId": "IAO-06_A03", "test": "an appropriate assessor or assessment team is selected for the type of assessment to be conducted.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02a.", "defaultText": null }, { "id": 72424, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590759", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590759", "securityControlId": 31617, "ccis": [], "uuid": "ec526ecf-2752-5181-a05d-ee0fab38c0b8", "testId": "IAO-06_A04", "test": "a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02b.01", "defaultText": null }, { "id": 72425, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590759", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590759", "securityControlId": 31617, "ccis": [], "uuid": "589e3429-91fa-52fc-95ec-4e0ddfbfad7a", "testId": "IAO-06_A05", "test": "the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02c.", "defaultText": null }, { "id": 72426, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59076", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59076", "securityControlId": 31617, "ccis": [], "uuid": "042cc424-daf9-5dd8-9bbb-8127a162ed45", "testId": "IAO-06_A06", "test": "controls are assessed in the system and its environment of operation per an organization-defined assessment frequency to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting established cybersecurity / data privacy requirements.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-02d.[01]\n53A_R5_CA-02d.[02]", "defaultText": null }, { "id": 72427, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59076", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59076", "securityControlId": 31617, "ccis": [], "uuid": "f576de6f-ad08-5a6c-b0d7-2e86fda7202b", "testId": "IAO-06_A07", "test": "a control assessment report is produced that documents the results of the assessment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02e.", "defaultText": null }, { "id": 72428, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59076", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59076", "securityControlId": 31617, "ccis": [], "uuid": "513c827e-a7c4-5726-b252-8e80e35c15e3", "testId": "IAO-06_A08", "test": "the results of the control assessment are provided to individuals or roles.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02f.", "defaultText": null }, { "id": 72429, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59076", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59076", "securityControlId": 31617, "ccis": [], "uuid": "83b4c66b-1a8d-5c2f-b111-12713528af8d", "testId": "IAO-06_A09", "test": "the impacted controls are implemented correctly with regard to meeting the cybersecurity / data privacy requirements for the system after system changes.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-04(02)[01]\n53A_R5_CM-04(02)[02]", "defaultText": null }, { "id": 72430, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59076", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59076", "securityControlId": 31617, "ccis": [], "uuid": "bb49ea2c-86e3-5032-b621-30fa4e43bb94", "testId": "IAO-06_A10", "test": "the impacted controls are operating as intended with regard to meeting the cybersecurity / data privacy requirements for the system after system changes.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-04(02)[03]\n53A_R5_CM-04(02)[04]", "defaultText": null }, { "id": 72431, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59076", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59076", "securityControlId": 31617, "ccis": [], "uuid": "507ba444-8a84-5ebb-8e7f-30a005af5acb", "testId": "IAO-06_A11", "test": "the impacted controls are producing the desired outcome with regard to meeting the cybersecurity / data privacy requirements for the system after system changes.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CM-04(02)[05]\n53A_R5_CM-04(02)[06]", "defaultText": null }, { "id": 72432, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590761", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590761", "securityControlId": 31617, "ccis": [], "uuid": "46d72059-a914-52ba-b162-babe1bea63b2", "testId": "IAO-06_A12", "test": "a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02b.02", "defaultText": null }, { "id": 72433, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590761", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590761", "securityControlId": 31617, "ccis": [], "uuid": "1b263efa-0a5d-56ea-9f9c-a53ebd5929ed", "testId": "IAO-06_A13", "test": "a control assessment plan is developed that describes the scope of the assessment, including the assessment environment.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02b.03[01]", "defaultText": null }, { "id": 72434, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590761", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590761", "securityControlId": 31617, "ccis": [], "uuid": "79c9e66b-d283-5d61-90f3-5e8fa9e8085c", "testId": "IAO-06_A14", "test": "a control assessment plan is developed that describes the scope of the assessment, including the assessment team.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02b.03[02]", "defaultText": null }, { "id": 72435, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590761", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590761", "securityControlId": 31617, "ccis": [], "uuid": "71509d48-91de-5d6c-b120-d855acae7b12", "testId": "IAO-06_A15", "test": "a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02b.03[03]", "defaultText": null } ], "externalMappings": [ { "id": 584681, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586974", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19308420-8f9a-55e5-90a9-edca133a2dc6", "parentControlId": 31617, "controlId": "ORG 2.4(b)", "title": "ORG 2.4(b)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586974" }, { "id": 584685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77fca33c-20ea-5e55-b846-3a289a122f20", "parentControlId": 31617, "controlId": "CA-2", "title": "CA-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586975" }, { "id": 584686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "057ea7a5-de22-5f1e-a091-9a2b537d2cd8", "parentControlId": 31617, "controlId": "CM-4(2)", "title": "CM-4(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586975" }, { "id": 584687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39288c16-3045-5774-b1c4-be4edffec55e", "parentControlId": 31617, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586975" }, { "id": 584688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57384c74-b313-56d8-9d7d-062d163edb7a", "parentControlId": 31617, "controlId": "CM-04(02)", "title": "CM-04(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586975" }, { "id": 584690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd69fa08-ee25-5569-8aff-0248ec6cea09", "parentControlId": 31617, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586975" }, { "id": 584691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc6ed53f-de76-50f0-9adb-26e7e605fdc5", "parentControlId": 31617, "controlId": "CM-04(02)", "title": "CM-04(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586976" }, { "id": 584692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55dfc7fd-1b62-5ed1-96b8-8a000d1c0b6e", "parentControlId": 31617, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586976" }, { "id": 584693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb244e5b-e6ed-5199-bfe1-130735876c7e", "parentControlId": 31617, "controlId": "CM-04(02)", "title": "CM-04(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586976" }, { "id": 584694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f40c6a2b-fc9a-5251-8b81-e5dcafead6ca", "parentControlId": 31617, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586976" }, { "id": 584695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0fc937b7-0fb6-5f34-87b6-86606e1cefdd", "parentControlId": 31617, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586976" }, { "id": 584696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d52f4ab-7955-589a-80b1-e9310dcb8e25", "parentControlId": 31617, "controlId": "CM-04(02)", "title": "CM-04(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586976" }, { "id": 584697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fad20fda-486b-54d2-9f17-657d8d68ad70", "parentControlId": 31617, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586976" }, { "id": 584698, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586976", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fd18613-a0bf-56bf-88e6-25097f9f6bce", "parentControlId": 31617, "controlId": "CM-04(02)", "title": "CM-04(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586977" }, { "id": 584699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586977", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17e787eb-b9c6-5983-8c56-b5a4663dca08", "parentControlId": 31617, "controlId": "CA-2", "title": "CA-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586977" }, { "id": 584700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586977", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb2b1d95-e088-589c-9197-f0e090dfc5ef", "parentControlId": 31617, "controlId": "CA-2", "title": "CA-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586977" }, { "controlId": "NSS-17T-Sec4.9", "title": "NSS-17T-Sec4.9 — Periodic Computer Security Review, Walkdowns & Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "ac602e30-7d87-59b3-b4ec-befa57e73e49", "isPublic": true }, { "controlId": "IEC-62645-5.4", "title": "IEC-62645-5.4 — Independent Computer Security Assessment and Audit", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "a907e4ee-f07b-5b9f-a8d8-2f061eb41477", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.f", "title": "DOE-O-205.1D-4.f — Authorization to Operate (ATO) and Continuous Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "c6ff354d-6bfe-5ab2-8a89-0f855179cba0", "isPublic": true } ], "id": 31617, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731179", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731179", "catalogueId": 1062, "uuid": "728a668c-6554-5464-855a-83c6314ffc1f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization perform Information Assurance Program (IAP) activities to evaluate the design, implementation and effectiveness of technical security, compliance and resilience controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Technical Verification", "description": "

Control Description

Mechanisms exist to perform Information Assurance Program (IAP) activities to evaluate the design, implementation and effectiveness of technical security, compliance and resilience controls.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Information Assurance (IAO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Information Assurance (IA)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ IA management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.\n▪ IAP operations focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Information Assurance (IAO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are well-documented and kept current by process owners.\n▪ An information assurance team, or similar function, is appropriately staffed and supported to implement and maintain IAO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of information assurance operations (e.g., assessment scheduling software, risk assessment software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to perform Information Assurance Program (IAP) activities to evaluate the design, implementation and effectiveness of technical security, compliance and resilience controls.

Level 4 - Quantitatively Controlled: Information Assurance (IAO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAO-06", "family": "Information Assurance", "enhancements": "", "sortId": "IAO-06", "references": "

Micro-Small Business (<10 staff)

∙ Controls Validation Testing (CVT)

Small Business (10-49 staff)

∙ Controls Validation Testing (CVT)

Medium Business (50-249 staff)

∙ Controls Validation Testing (CVT)

Large Business (250-999 staff)

∙ Controls Validation Testing (CVT)

Enterprise (>1,000 staff)

∙ Controls Validation Testing (CVT)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72436, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590761", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590761", "securityControlId": 31618, "ccis": [], "uuid": "eccfa7e3-99d3-58c3-b1b7-2692272a6def", "testId": "IAO-07_A01", "test": "the frequency at which to update the authorizations is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-06_ODP", "defaultText": null }, { "id": 72437, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590762", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590762", "securityControlId": 31618, "ccis": [], "uuid": "5720a941-9bd0-597c-9b05-bfb18438a467", "testId": "IAO-07_A02", "test": "a senior official is assigned as the authorizing official for the system.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_CA-06a.", "defaultText": null }, { "id": 72438, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590762", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590762", "securityControlId": 31618, "ccis": [], "uuid": "2acf2344-eb60-5fcf-88ad-afb4d98fc111", "testId": "IAO-07_A03", "test": "the authorizations are updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-06e.", "defaultText": null }, { "id": 72439, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590762", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590762", "securityControlId": 31618, "ccis": [], "uuid": "310e689a-5063-526b-8c43-d2d545549c5a", "testId": "IAO-07_A04", "test": "a senior official is assigned as the authorizing official for common controls available for inheritance by organizational systems.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_CA-06b.", "defaultText": null }, { "id": 72440, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590762", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590762", "securityControlId": 31618, "ccis": [], "uuid": "085c91ab-cbec-5242-92a0-e62df5afbd62", "testId": "IAO-07_A05", "test": "before commencing operations, the authorizing official for the system accepts the use of common controls inherited by the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-06c.01", "defaultText": null }, { "id": 72441, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590762", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590762", "securityControlId": 31618, "ccis": [], "uuid": "bf99a869-0934-5725-9bc5-19026c1e8061", "testId": "IAO-07_A06", "test": "before commencing operations, the authorizing official for the system authorizes the system to operate.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-06c.02", "defaultText": null }, { "id": 72442, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590763", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590763", "securityControlId": 31618, "ccis": [], "uuid": "b6f678f9-8977-5582-966e-5996a539992c", "testId": "IAO-07_A07", "test": "the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-06d.", "defaultText": null } ], "externalMappings": [ { "id": 584745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586982", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a118dff6-1a4b-5600-a0ab-ec42ab4de63c", "parentControlId": 31618, "controlId": "CA-6", "title": "CA-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586982" }, { "id": 584746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586982", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8c3c426-29d7-5c14-9d0e-643967517347", "parentControlId": 31618, "controlId": "CA-06", "title": "CA-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586982" }, { "id": 584748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586982", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79a245a7-868d-558b-98df-6129a77d6d1b", "parentControlId": 31618, "controlId": "CA-06", "title": "CA-06", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586982" }, { "id": 584749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586983", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6225fd6-27b8-5254-912b-8473c3208ae3", "parentControlId": 31618, "controlId": "CA-06", "title": "CA-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586983" }, { "id": 584750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586983", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9766ce80-8744-524f-b4fe-f5355e01d2e3", "parentControlId": 31618, "controlId": "CA-06", "title": "CA-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586983" }, { "id": 584751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586983", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7b225ed-71be-571a-aa17-48bf3898fb22", "parentControlId": 31618, "controlId": "CA-06", "title": "CA-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586983" }, { "id": 584752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586983", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa9fe481-4080-599d-aa07-39f25dacd5cb", "parentControlId": 31618, "controlId": "CA-06", "title": "CA-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586983" }, { "id": 584753, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586983", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "521626a1-78b5-56d3-b43c-8d444fc13a0e", "parentControlId": 31618, "controlId": "CA-6", "title": "CA-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586983" }, { "id": 584754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586983", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cefd2067-7595-557e-b832-55626e8b41ef", "parentControlId": 31618, "controlId": "CA-6", "title": "CA-6", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586983" }, { "id": 584782, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9edf7069-37fb-5904-8db0-d3e1b6d0f975", "parentControlId": 31618, "controlId": "11-3.a(3)(c)", "title": "11-3.a(3)(c)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586987" }, { "controlId": "NSS-17T-Sec4.9", "title": "NSS-17T-Sec4.9 — Periodic Computer Security Review, Walkdowns & Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "c40193a7-570c-5903-9520-90c20d119ea1", "isPublic": true }, { "controlId": "IEC-62645-5.4", "title": "IEC-62645-5.4 — Independent Computer Security Assessment and Audit", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "e5fee47f-31aa-5497-8f2a-aa28b81a1b2a", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.f", "title": "DOE-O-205.1D-4.f — Authorization to Operate (ATO) and Continuous Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (IAO Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "4100af03-b558-56d1-b352-55983f0520c8", "isPublic": true } ], "id": 31618, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73118", "catalogueId": 1062, "uuid": "afcfee4e-5c6d-50da-afdc-1949209a80d2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure Technology Assets, Applications and/or Services (TAAS) are officially authorized prior to \"go live\" in a production environment?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Security Authorization", "description": "

Control Description

Mechanisms exist to ensure Technology Assets, Applications and/or Services (TAAS) are officially authorized prior to \"go live\" in a production environment.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Information Assurance (IAO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with IAO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Pre-production security testing-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain an informal process to conduct limited control testing of High Value Assets (HVAs) to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.

Level 2 - Planned & Tracked: Information Assurance (IAO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Information Assurance (IA)-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ IA management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel implement and maintain a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing.\n▪ IAP testing results in a formal risk assessment where Business process owners (BPOs) are required to make a decision to (1) reduce, (2) avoid, (3) transfer and/or (4) accept risk(s) on behalf of the organization.

Level 3 - Well Defined: Information Assurance (IAO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are well-documented and kept current by process owners.\n▪ An information assurance team, or similar function, is appropriately staffed and supported to implement and maintain IAO domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of information assurance operations (e.g., assessment scheduling software, risk assessment software, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure Technology Assets, Applications and/or Services (TAAS) are officially authorized prior to \"go live\" in a production environment.

Level 4 - Quantitatively Controlled: Information Assurance (IAO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "IAO-07", "family": "Information Assurance", "enhancements": "", "sortId": "IAO-07", "references": "

Micro-Small Business (<10 staff)

∙ Document security assurance requirements for critical systems

Small Business (10-49 staff)

∙ Security assurance checklist for critical systems

Medium Business (50-249 staff)

∙ Formal information assurance program\n∙ Security testing and validation

Large Business (250-999 staff)

∙ Enterprise information assurance program\n∙ Independent security testing

Enterprise (>1,000 staff)

∙ Enterprise IA program\n∙ Formal evaluation (e.g., Common Criteria, FedRAMP)\n∙ Continuous assurance monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72443, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590763", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590763", "securityControlId": 31619, "ccis": [], "uuid": "a3852557-c338-523a-bd13-4b51b1c1bd61", "testId": "MNT-01_A01", "test": "a maintenance policy is developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-01a.[01]", "defaultText": null }, { "id": 72444, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590763", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590763", "securityControlId": 31619, "ccis": [], "uuid": "a2b0b7a0-49b0-57e8-ac1e-a5a6e4c5e8ee", "testId": "MNT-01_A02", "test": "the maintenance policy is disseminated to organization-defined personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-01a.[02]", "defaultText": null }, { "id": 72445, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590763", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590763", "securityControlId": 31619, "ccis": [], "uuid": "cd1e0df0-99b6-5b92-b144-0afa2de294f7", "testId": "MNT-01_A03", "test": "maintenance procedures to facilitate the implementation of the maintenance policy and associated maintenance controls are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-01a.[03]", "defaultText": null }, { "id": 72446, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590763", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590763", "securityControlId": 31619, "ccis": [], "uuid": "05f5b397-e5c2-50b0-b152-01e3a56158c0", "testId": "MNT-01_A04", "test": "the maintenance procedures are disseminated to organization-defined personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-01a.[04]", "defaultText": null }, { "id": 72447, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590764", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590764", "securityControlId": 31619, "ccis": [], "uuid": "433c3c45-aa17-5dfd-b5c1-9d00ebd3c14c", "testId": "MNT-01_A05", "test": "personnel or roles to whom the maintenance policy is to be disseminated is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-01_ODP[01]", "defaultText": null }, { "id": 72448, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590764", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590764", "securityControlId": 31619, "ccis": [], "uuid": "d82a5bf4-f908-59bf-b53b-6161c80234c1", "testId": "MNT-01_A06", "test": "personnel or roles to whom the maintenance procedures are to be disseminated is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-01_ODP[02]", "defaultText": null }, { "id": 72449, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590764", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590764", "securityControlId": 31619, "ccis": [], "uuid": "cb9a3875-e0a2-5674-b053-5bb8cf6eaef2", "testId": "MNT-01_A07", "test": "one or more of the following organization-defined criteria is/are selected: {organization-level. mission/business process-level. system-level}.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-01_ODP[03]", "defaultText": null }, { "id": 72450, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590764", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590764", "securityControlId": 31619, "ccis": [], "uuid": "502c5472-86a1-53cd-ac9e-43612ff0c85c", "testId": "MNT-01_A08", "test": "an official to manage the maintenance policy and procedures is defined.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_MA-01_ODP[04]", "defaultText": null }, { "id": 72451, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590764", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590764", "securityControlId": 31619, "ccis": [], "uuid": "57a9e6e7-6b5f-5208-a276-e3b89fa297a1", "testId": "MNT-01_A09", "test": "the frequency with which the current maintenance policy is reviewed / updated is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_MA-01_ODP[05]", "defaultText": null }, { "id": 72452, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590764", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590764", "securityControlId": 31619, "ccis": [], "uuid": "bfdc4d32-93e6-5705-bd88-672a735e5042", "testId": "MNT-01_A10", "test": "events that would require the current maintenance policy to be reviewed / updated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-01_ODP[06]", "defaultText": null }, { "id": 72453, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590764", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590764", "securityControlId": 31619, "ccis": [], "uuid": "5375584e-df60-577c-a443-d10a1a4f7211", "testId": "MNT-01_A11", "test": "the frequency with which the current maintenance procedures are reviewed / updated is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_MA-01_ODP[07]", "defaultText": null }, { "id": 72454, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590764", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590764", "securityControlId": 31619, "ccis": [], "uuid": "7faf7e26-5355-5763-9d7f-6081a3ab5ba3", "testId": "MNT-01_A12", "test": "events that would require the maintenance procedures to be reviewed / updated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-01_ODP[08]", "defaultText": null }, { "id": 72455, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590765", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590765", "securityControlId": 31619, "ccis": [], "uuid": "4b7f93df-a593-55aa-a2c5-d712b3d15995", "testId": "MNT-01_A13", "test": "the organization's maintenance policy addresses purpose.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-01a.01(a)[01]", "defaultText": null }, { "id": 72456, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590765", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590765", "securityControlId": 31619, "ccis": [], "uuid": "778c563f-ea45-5a6e-95bb-912c0fce5000", "testId": "MNT-01_A14", "test": "the organization's maintenance policy addresses scope.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-01a.01(a)[02]", "defaultText": null }, { "id": 72457, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590765", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590765", "securityControlId": 31619, "ccis": [], "uuid": "6b0aca8b-28b5-5dfb-8cf7-29611aca405d", "testId": "MNT-01_A15", "test": "the organization's maintenance policy addresses roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-01a.01(a)[03]", "defaultText": null }, { "id": 72458, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590765", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590765", "securityControlId": 31619, "ccis": [], "uuid": "cffe5051-701b-577e-9540-cc55a5c47ad6", "testId": "MNT-01_A16", "test": "the organization's maintenance policy addresses responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-01a.01(a)[04]", "defaultText": null }, { "id": 72459, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590765", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590765", "securityControlId": 31619, "ccis": [], "uuid": "54d0d588-d360-506d-825c-749828719d22", "testId": "MNT-01_A17", "test": "the organization's maintenance policy addresses management commitment.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-01a.01(a)[05]", "defaultText": null }, { "id": 72460, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590766", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590766", "securityControlId": 31619, "ccis": [], "uuid": "9363a0af-8f37-5325-8a44-2f6e8046fc9d", "testId": "MNT-01_A18", "test": "the organization's maintenance policy addresses coordination among organizational entities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-01a.01(a)[06]", "defaultText": null }, { "id": 72461, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590766", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590766", "securityControlId": 31619, "ccis": [], "uuid": "25fe8928-2298-5342-a2cb-9fe8d71969dc", "testId": "MNT-01_A19", "test": "the organization's maintenance policy addresses compliance.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-01a.01(a)[07]", "defaultText": null }, { "id": 72462, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590766", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590766", "securityControlId": 31619, "ccis": [], "uuid": "2ea1ba58-b678-52a4-bb31-2ba7db0b3437", "testId": "MNT-01_A20", "test": "the organization's maintenance policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-01a.01(b)", "defaultText": null }, { "id": 72463, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590766", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590766", "securityControlId": 31619, "ccis": [], "uuid": "e3843b6c-e827-56b4-9e65-7564cdcf9e0e", "testId": "MNT-01_A21", "test": "the organization-defined official is designated to manage the development, documentation, and dissemination of the maintenance policy and procedures.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-01b.", "defaultText": null }, { "id": 72464, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590766", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590766", "securityControlId": 31619, "ccis": [], "uuid": "abc814ce-2703-5020-b9d5-521cf14405dc", "testId": "MNT-01_A22", "test": "the current maintenance policy is reviewed / updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_MA-01c.01[01]", "defaultText": null }, { "id": 72465, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590766", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590767", "securityControlId": 31619, "ccis": [], "uuid": "2b3a1b01-31ba-5f64-b511-eb20d4398e51", "testId": "MNT-01_A23", "test": "the current maintenance policy is reviewed / updated following organization-defined events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-01c.01[02]", "defaultText": null }, { "id": 72466, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590767", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590767", "securityControlId": 31619, "ccis": [], "uuid": "a50f5221-fee9-57c9-81bd-3b02e5c98c1a", "testId": "MNT-01_A24", "test": "the current maintenance procedures are reviewed / updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_MA-01c.02[01]", "defaultText": null }, { "id": 72467, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590767", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590767", "securityControlId": 31619, "ccis": [], "uuid": "c38575fc-3990-5f72-ad10-5c1d344b4d36", "testId": "MNT-01_A25", "test": "the current maintenance procedures are reviewed / updated following organization-defined events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-01c.02[02]", "defaultText": null }, { "id": 72468, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590767", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590767", "securityControlId": 31619, "ccis": [], "uuid": "38c79f13-f6ce-51cb-93c1-b79b97009f9a", "testId": "MNT-01_A26", "test": "maintenance management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72469, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590767", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590767", "securityControlId": 31619, "ccis": [], "uuid": "4e7e288c-2326-5431-930d-df8a2c4c3180", "testId": "MNT-01_A27", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support maintenance management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72470, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590767", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590767", "securityControlId": 31619, "ccis": [], "uuid": "634386ab-d703-5fed-9af1-9c5d3fd7dfbd", "testId": "MNT-01_A28", "test": "responsibility and authority for the performance of maintenance management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72471, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590767", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590768", "securityControlId": 31619, "ccis": [], "uuid": "a0993fd4-a9ea-576b-b9a4-a4a87d2607d7", "testId": "MNT-01_A29", "test": "personnel performing maintenance management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 584809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c1e84c0-6233-5f0f-8948-36ac4b542e56", "parentControlId": 31619, "controlId": "7.13", "title": "7.13", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58699" }, { "id": 584814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a579678-8a72-5eff-9329-9dc463cae8a2", "parentControlId": 31619, "controlId": "MA-1", "title": "MA-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58699" }, { "id": 584815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b928addf-4587-5e1e-8773-5658ff7fd490", "parentControlId": 31619, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586991" }, { "id": 584817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a86d7110-3bab-547b-88a0-dee263c4d977", "parentControlId": 31619, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586991" }, { "id": 584820, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c54044eb-28a5-5a2c-82f5-75d770ddabb3", "parentControlId": 31619, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586991" }, { "id": 584821, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3149652b-3e44-565d-a86d-c7cd6021b5a5", "parentControlId": 31619, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586991" }, { "id": 584822, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586992", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6400c0f1-dfe2-5a49-a1d8-94e5fd8ff89f", "parentControlId": 31619, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586992" }, { "id": 584823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586992", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4c77dfb-13ee-5d03-a42d-04102e698aeb", "parentControlId": 31619, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586992" }, { "id": 584824, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586992", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdd2731f-d074-5a70-962a-3752565f4728", "parentControlId": 31619, "controlId": "MA-1", "title": "MA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586992" }, { "id": 584825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586992", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "545662fa-aec2-5227-8908-b646094609b4", "parentControlId": 31619, "controlId": "MA-1", "title": "MA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586992" }, { "id": 584826, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586992", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af3e4dbf-aeee-5fa3-bbfe-a5a181d1f12c", "parentControlId": 31619, "controlId": "MA-1", "title": "MA-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586992" }, { "id": 584830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586992", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "828cf2af-2d58-5578-894f-cc3b7beeeb9d", "parentControlId": 31619, "controlId": "NFO - MA-1", "title": "NFO - MA-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586992" }, { "id": 584831, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586992", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cdf65875-196b-524b-9952-ad3e671f88c2", "parentControlId": 31619, "controlId": "03.04.03.c", "title": "03.04.03.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586992" }, { "id": 584832, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586993", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1141da65-58e4-55b5-8a5b-419235ea884d", "parentControlId": 31619, "controlId": "03.07.04.a", "title": "03.07.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586993" }, { "id": 584833, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586993", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c1b8665-ac39-581c-bdea-a064aa7b0f03", "parentControlId": 31619, "controlId": "03.07.06.a", "title": "03.07.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586993" }, { "id": 584834, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586993", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0493f68-c4d5-5c24-9626-3f11be3b4bc1", "parentControlId": 31619, "controlId": "PR.PS", "title": "PR.PS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586993" }, { "id": 584835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586993", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b1b8f8b-76b6-5735-b5df-ca137880800a", "parentControlId": 31619, "controlId": "PR.PS-02", "title": "PR.PS-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586993" }, { "id": 584836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586993", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7589157c-2eca-567d-ae73-cfba7bf4818d", "parentControlId": 31619, "controlId": "PR.PS-03", "title": "PR.PS-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586993" }, { "id": 584839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586993", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0658f7ad-f354-55dd-a720-e72e6f0381e0", "parentControlId": 31619, "controlId": "ARCHITECTURE-3i", "title": "ARCHITECTURE-3i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586993" }, { "controlId": "C.4.1", "title": "C.4.1 — System Maintenance Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MA-1, MA-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "944a44e0-19cf-537d-8654-d9f793c1fa54", "isPublic": true }, { "controlId": "NEI 08-09 App E.4.1", "title": "NEI 08-09 App E.4.1 — System Maintenance Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.4.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "7784bb24-befe-5273-88fd-e4e81a09daa2", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.4.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "875d7aee-5049-5943-9c06-78f0d13145bd", "isPublic": true }, { "controlId": "NSS-17T-Sec6.7", "title": "NSS-17T-Sec6.7 — Maintenance Tools, Outage Controls & Portable Media Sanitation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "84ae552c-d4a7-5156-b256-604d972f1ea7", "isPublic": true }, { "controlId": "IEC-62645-8.1", "title": "IEC-62645-8.1 — Secure Maintenance & Diagnostic Test Equipment Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "39d0c94d-ee38-57ad-ba99-08139d6a487a", "isPublic": true } ], "id": 31619, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73118", "catalogueId": 1062, "uuid": "e3a532a7-6e62-5d9f-8315-a10335f0007a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization develop, disseminate, review & update procedures to facilitate the implementation of maintenance controls across the enterprise?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Maintenance Operations", "description": "

Control Description

Mechanisms exist to develop, disseminate, review & update procedures to facilitate the implementation of maintenance controls across the enterprise.

Evidence Request List (ERL)

E-MNT-02\nE-MNT-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Maintenance (MNT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MNT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Maintenance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Maintenance controls are primarily administrative in nature (e.g., policies & standards) to manage change control processes associated with maintenance operations.\n▪ IT and/or cybersecurity personnel use an informal process to implement secure and timely technology asset-specific maintenance operations, including preventative and reactive maintenance operations.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to develop, disseminate, review & update procedures to facilitate the implementation of maintenance controls across the enterprise.

Level 4 - Quantitatively Controlled: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.4.1", "controlId": "MNT-01", "family": "Maintenance", "enhancements": "", "sortId": "MNT-01", "references": "

Micro-Small Business (<10 staff)

∙ IT maintenance program

Small Business (10-49 staff)

∙ IT maintenance program

Medium Business (50-249 staff)

∙ IT maintenance program

Large Business (250-999 staff)

∙ IT maintenance program

Enterprise (>1,000 staff)

∙ IT maintenance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72472, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590768", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590768", "securityControlId": 31620, "ccis": [], "uuid": "4f56bc6a-9f54-5643-aef2-fe1ce9082e79", "testId": "MNT-02_A01", "test": "maintenance, repair and replacement of systems, applications and/or services are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-02a.[01]", "defaultText": null }, { "id": 72473, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590768", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590768", "securityControlId": 31620, "ccis": [], "uuid": "41d3bb5c-0b76-56f0-96b5-ed08724cb633", "testId": "MNT-02_A02", "test": "approved configuration-controlled changes to the system are implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.04.03.c[01]", "defaultText": null }, { "id": 72474, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590768", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590768", "securityControlId": 31620, "ccis": [], "uuid": "b877669a-6bbb-5ecf-9582-ca8680d3fe4d", "testId": "MNT-02_A03", "test": "system maintenance is performed.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.7.1", "defaultText": null }, { "id": 72475, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590768", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590768", "securityControlId": 31620, "ccis": [], "uuid": "6bb11fc2-8429-5aee-af5d-4df8363bc596", "testId": "MNT-02_A04", "test": "personnel or roles required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance or repairs is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-02_ODP[01]", "defaultText": null }, { "id": 72476, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590768", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590768", "securityControlId": 31620, "ccis": [], "uuid": "41890629-1cfa-5c56-8b17-bfe170d6cbe7", "testId": "MNT-02_A05", "test": "information to be removed from associated media prior to removal from organizational facilities for off-site maintenance, repair or replacement is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-02_ODP[02]", "defaultText": null }, { "id": 72477, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590769", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590769", "securityControlId": 31620, "ccis": [], "uuid": "fd0d6496-7c0a-58fa-8d3d-9874a286c596", "testId": "MNT-02_A06", "test": "information to be included in organizational maintenance records is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-02_ODP[03]", "defaultText": null }, { "id": 72478, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590769", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590769", "securityControlId": 31620, "ccis": [], "uuid": "bfd5faf7-8a83-5745-9af5-6923bfaae788", "testId": "MNT-02_A07", "test": "maintenance, repair and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-02a.[02]", "defaultText": null }, { "id": 72479, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590769", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590769", "securityControlId": 31620, "ccis": [], "uuid": "3eb1c4de-e257-5825-8e0f-4e4431aa2bd1", "testId": "MNT-02_A08", "test": "records of maintenance, repair and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-02a.[03]", "defaultText": null }, { "id": 72480, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590769", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590769", "securityControlId": 31620, "ccis": [], "uuid": "fbe9cbeb-c28a-5cb6-8378-b8892015b7a1", "testId": "MNT-02_A09", "test": "all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are approved.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-02b.[01]", "defaultText": null }, { "id": 72481, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590769", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590769", "securityControlId": 31620, "ccis": [], "uuid": "b06536ae-05de-5163-8b83-031bc4cafb91", "testId": "MNT-02_A10", "test": "all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are monitored.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-02b.[02]", "defaultText": null }, { "id": 72482, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59077", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59077", "securityControlId": 31620, "ccis": [], "uuid": "b76dd6d9-c8d6-52ec-9737-5a5ad74dad88", "testId": "MNT-02_A11", "test": "personnel or roles is/are required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair or replacement.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-02c.", "defaultText": null }, { "id": 72483, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59077", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59077", "securityControlId": 31620, "ccis": [], "uuid": "913579b3-b0a7-5ff7-8344-b2a5b04e2817", "testId": "MNT-02_A12", "test": "equipment is sanitized to remove information from associated media prior to removal from organizational facilities for off-site maintenance, repair or replacement.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-02d.", "defaultText": null }, { "id": 72484, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59077", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59077", "securityControlId": 31620, "ccis": [], "uuid": "bf67885c-5137-59bb-b018-ccf30cc0fd3c", "testId": "MNT-02_A13", "test": "all potentially impacted controls are checked to verify that the controls are still functioning properly following maintenance, repair or replacement actions.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-02e.", "defaultText": null }, { "id": 72485, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59077", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59077", "securityControlId": 31620, "ccis": [], "uuid": "f7c402df-f33e-5ecc-9c29-b25cefe5398c", "testId": "MNT-02_A14", "test": "information is included in organizational maintenance records.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-02f.", "defaultText": null } ], "externalMappings": [ { "id": 584885, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.586999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce2377b6-a89e-5561-98f4-9231b413e217", "parentControlId": 31620, "controlId": "7.13", "title": "7.13", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.586999" }, { "id": 584888, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72a22117-118b-50d1-b9cc-c85bb1ac180d", "parentControlId": 31620, "controlId": "MA-2", "title": "MA-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587" }, { "id": 584889, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f859c11c-b87d-5de3-98d5-76ce56903dbd", "parentControlId": 31620, "controlId": "MA-02", "title": "MA-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587" }, { "id": 584890, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48893f20-3520-546d-a21a-e075e22d71e5", "parentControlId": 31620, "controlId": "MA-02", "title": "MA-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587" }, { "id": 584892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97761389-6cc9-5a34-be16-03a953740eb7", "parentControlId": 31620, "controlId": "MA-02", "title": "MA-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587" }, { "id": 584893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5601ed6-86e1-5459-8716-0e6a863b4079", "parentControlId": 31620, "controlId": "MA-02", "title": "MA-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587001" }, { "id": 584894, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6599935b-3d7c-521c-b2e4-41dd48372ab9", "parentControlId": 31620, "controlId": "MA-02", "title": "MA-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587001" }, { "id": 584895, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf3a87ad-9213-5153-aedc-c22593830264", "parentControlId": 31620, "controlId": "MA-02", "title": "MA-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587001" }, { "id": 584896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "693dbc4f-9be9-5cad-a971-5ee3a7f78a4c", "parentControlId": 31620, "controlId": "MA-2", "title": "MA-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587001" }, { "id": 584897, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c23bf196-60dd-53dc-991e-2b36117280c5", "parentControlId": 31620, "controlId": "3.7.1", "title": "3.7.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587001" }, { "id": 584898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46ff17de-ecb3-5d44-add3-198aa4d8e7fb", "parentControlId": 31620, "controlId": "03.04.03.c", "title": "03.04.03.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587001" }, { "id": 584899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83fa7c55-fed4-5907-9a15-1eab162b4bfb", "parentControlId": 31620, "controlId": "03.07.04.a", "title": "03.07.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587001" }, { "id": 584900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f35419b-c23b-52fc-b1f8-d3758ef2ace8", "parentControlId": 31620, "controlId": "03.07.05.a", "title": "03.07.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587001" }, { "id": 584903, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fdb2d99-d489-5311-93d0-6701899c6822", "parentControlId": 31620, "controlId": "PR.PS", "title": "PR.PS", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587002" }, { "id": 584904, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "620872b5-b5e7-52b3-810a-57c8f5a558cd", "parentControlId": 31620, "controlId": "PR.PS-02", "title": "PR.PS-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587002" }, { "id": 584905, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41568c81-b6be-51ae-a90e-447c34b5ed43", "parentControlId": 31620, "controlId": "PR.PS-03", "title": "PR.PS-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587002" }, { "controlId": "C.4.1", "title": "C.4.1 — System Maintenance Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MA-1, MA-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a9acbd2e-53a4-5039-b21f-f920a9448e9b", "isPublic": true }, { "controlId": "NEI 08-09 App E.4.1", "title": "NEI 08-09 App E.4.1 — System Maintenance Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.4.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "b658275c-3130-5054-b105-b740d19475c9", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.4.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "d12988ac-7ff6-55a2-9386-b48c99f2cb1e", "isPublic": true }, { "controlId": "CIP-006-6-R3", "title": "CIP-006-6-R3 — Physical Access Control System Maintenance and Testing", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "cfc3cf5f-11c2-53f0-a435-ef563ead3911", "isPublic": true }, { "controlId": "NSS-17T-Sec6.7", "title": "NSS-17T-Sec6.7 — Maintenance Tools, Outage Controls & Portable Media Sanitation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d736569b-efc5-523b-a6ee-ced4276b95d2", "isPublic": true }, { "controlId": "IEC-62645-8.1", "title": "IEC-62645-8.1 — Secure Maintenance & Diagnostic Test Equipment Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "846028df-8ac4-5e1b-b67d-b34dea244526", "isPublic": true } ], "id": 31620, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73118", "catalogueId": 1062, "uuid": "306d860e-ac83-55d2-bfc9-9a4651912d57", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct controlled maintenance activities throughout the lifecycle of theTechnology Asset, Application and/or Service (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Controlled Maintenance", "description": "

Control Description

Mechanisms exist to conduct controlled maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).

Evidence Request List (ERL)

E-MNT-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.\n▪ Asset custodians track maintenance activities and component failure rates.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conduct controlled maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).

Level 4 - Quantitatively Controlled: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.4.1
NERC-CIP (2026) Requirements: CIP-006-6-R3", "controlId": "MNT-02", "family": "Maintenance", "enhancements": "", "sortId": "MNT-02", "references": "

Micro-Small Business (<10 staff)

∙ IT maintenance program

Small Business (10-49 staff)

∙ IT maintenance program

Medium Business (50-249 staff)

∙ IT maintenance program\n∙ VisibleOps security management

Large Business (250-999 staff)

∙ IT maintenance program\n∙ VisibleOps security management

Enterprise (>1,000 staff)

∙ IT maintenance program\n∙ VisibleOps security management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72486, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59077", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59077", "securityControlId": 31621, "ccis": [], "uuid": "c89ffe27-be24-5485-89fc-32d3e2b55c7f", "testId": "MNT-02.1_A01", "test": "automated mechanisms used to schedule maintenance, repair and replacement actions for the system, application and/or service are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-02(02)_ODP[01]", "defaultText": null }, { "id": 72487, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590771", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590771", "securityControlId": 31621, "ccis": [], "uuid": "ae65545a-fe36-541d-a657-d39d0f33f00b", "testId": "MNT-02.1_A02", "test": "automated mechanisms used to conduct maintenance, repair and replacement actions for the system, application and/or service are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-02(02)_ODP[02]", "defaultText": null }, { "id": 72488, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590771", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590771", "securityControlId": 31621, "ccis": [], "uuid": "51eb6b0e-0c60-56ed-a114-703657bc3a8e", "testId": "MNT-02.1_A03", "test": "automated mechanisms used to document maintenance, repair and replacement actions for the system, application and/or service are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-02(02)_ODP[03]", "defaultText": null }, { "id": 72489, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590772", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590772", "securityControlId": 31621, "ccis": [], "uuid": "52c33ead-b33d-5414-8477-db039505f6b2", "testId": "MNT-02.1_A04", "test": "automated mechanisms are used to schedule maintenance, repair and replacement actions for the system, application and/or service.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MA-02(02)(a)[01]", "defaultText": null }, { "id": 72490, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590772", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590772", "securityControlId": 31621, "ccis": [], "uuid": "7a5f7401-dc26-59f6-aeeb-e9dea2c94a02", "testId": "MNT-02.1_A05", "test": "automated mechanisms are used to conduct maintenance, repair and replacement actions for the system, application and/or service.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MA-02(02)(a)[02]", "defaultText": null }, { "id": 72491, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590772", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590772", "securityControlId": 31621, "ccis": [], "uuid": "f57c4cbf-a3a3-575f-95a0-38e6b1c049d3", "testId": "MNT-02.1_A06", "test": "automated mechanisms are used to document maintenance, repair and replacement actions for the system, application and/or service.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MA-02(02)(a)[03]", "defaultText": null }, { "id": 72492, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590772", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590772", "securityControlId": 31621, "ccis": [], "uuid": "86a64a4b-e9de-5b14-9aa3-e63f40af96f9", "testId": "MNT-02.1_A07", "test": "up-to-date, accurate and complete records of all maintenance actions requested, scheduled, in process and completed are produced.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-02(02)(b)[01]", "defaultText": null }, { "id": 72493, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590772", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590772", "securityControlId": 31621, "ccis": [], "uuid": "2d533ece-f8c2-5b48-bb04-986891c79177", "testId": "MNT-02.1_A08", "test": "up-to-date, accurate and complete records of all repair actions requested, scheduled, in process and completed are produced.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-02(02)(b)[02]", "defaultText": null }, { "id": 72494, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590773", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590773", "securityControlId": 31621, "ccis": [], "uuid": "9e78f5f9-b2cf-53b0-b9ef-d718e6cbc39d", "testId": "MNT-02.1_A09", "test": "up-to-date, accurate and complete records of all replacement actions requested, scheduled, in process and completed are produced.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-02(02)(b)[03]", "defaultText": null } ], "externalMappings": [ { "id": 584943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e144b7f-66e4-5aaa-894b-5fb9ecdc5a95", "parentControlId": 31621, "controlId": "MA-2(2)", "title": "MA-2(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587018" }, { "id": 584944, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8243e723-7664-534e-bd88-149b5d0a122f", "parentControlId": 31621, "controlId": "MA-02(02)", "title": "MA-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587018" }, { "id": 584945, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff9c8784-0ac2-5052-97bd-781750b4e510", "parentControlId": 31621, "controlId": "MA-02(02)", "title": "MA-02(02)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587018" }, { "id": 584946, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eae750eb-b1f6-5e0f-a3d2-361324c0261e", "parentControlId": 31621, "controlId": "MA-02(02)", "title": "MA-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587018" }, { "id": 584947, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0833f70a-2510-5aa1-abd2-44365fdd4b16", "parentControlId": 31621, "controlId": "MA-02(02)", "title": "MA-02(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587018" }, { "id": 584948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587019", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54c6ad85-daca-5d9c-9058-0450ad4789b8", "parentControlId": 31621, "controlId": "MA-2(2)", "title": "MA-2(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587019" } ], "id": 31621, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731181", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731181", "catalogueId": 1062, "uuid": "d821545c-be63-5b73-9aee-9d4f4f51dfa0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to schedule, conduct and document maintenance and repairs?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Automated Maintenance Activities", "description": "

Control Description

Automated mechanisms exist to schedule, conduct and document maintenance and repairs.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Maintenance (MNT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MNT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Maintenance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Maintenance controls are primarily administrative in nature (e.g., policies & standards) to manage change control processes associated with maintenance operations.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically schedule, conduct and document maintenance and repairs.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-02.1", "family": "Maintenance", "enhancements": "", "sortId": "MNT-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72495, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590773", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590773", "securityControlId": 31622, "ccis": [], "uuid": "13126e1d-415b-5ad0-9979-92e28f4f3e6d", "testId": "MNT-03_A01", "test": "system components for which maintenance support and/or spare parts are obtained are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-06_ODP[01]", "defaultText": null }, { "id": 72496, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590773", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590773", "securityControlId": 31622, "ccis": [], "uuid": "5c7c5a7e-b39c-5f7c-a981-87df58b7284f", "testId": "MNT-03_A02", "test": "time period within which maintenance support and/or spare parts are to be obtained after a failure are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-06_ODP[02]", "defaultText": null }, { "id": 72497, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590773", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590773", "securityControlId": 31622, "ccis": [], "uuid": "246538be-368b-5bde-b286-a05721fc0d14", "testId": "MNT-03_A03", "test": "maintenance support and/or spare parts are obtained for system components within an organization-defined time period of failure.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-06", "defaultText": null } ], "externalMappings": [ { "id": 584956, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58702", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "191cd6e5-1f14-5bcd-bb69-b482e8c30779", "parentControlId": 31622, "controlId": "7.13", "title": "7.13", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58702" }, { "id": 584959, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587021", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c83c6e2-ed18-532d-8ebf-3b921e0320f4", "parentControlId": 31622, "controlId": "MA-6", "title": "MA-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587021" }, { "id": 584960, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587021", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "965f6922-0f0e-599b-9af3-745043a19c05", "parentControlId": 31622, "controlId": "MA-06", "title": "MA-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587021" }, { "id": 584961, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587021", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39a908da-3b31-5d04-abe0-5f269c4a67eb", "parentControlId": 31622, "controlId": "MA-06", "title": "MA-06", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587021" }, { "id": 584962, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587021", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17743ef6-f534-54b4-9efe-2d5e7efe5f8a", "parentControlId": 31622, "controlId": "MA-06", "title": "MA-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587021" }, { "id": 584963, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587021", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f9dd66c-34d0-5446-9ac5-b261d89d4593", "parentControlId": 31622, "controlId": "MA-06", "title": "MA-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587021" }, { "id": 584964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587021", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7af49d7-a38d-5b94-aca9-7428622aec7f", "parentControlId": 31622, "controlId": "MA-06", "title": "MA-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587021" }, { "id": 584965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e76b18fe-da3f-59dd-b709-75ab25fd1cf8", "parentControlId": 31622, "controlId": "MA-6", "title": "MA-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587022" }, { "id": 584967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2afc7a18-e8fc-56af-befb-956d2ec259c8", "parentControlId": 31622, "controlId": "03.07.04.a", "title": "03.07.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587022" }, { "id": 584968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6c8512c-a337-5bc2-9635-d1e769982278", "parentControlId": 31622, "controlId": "PR.PS-02", "title": "PR.PS-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587022" }, { "id": 584969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4f0928b-ee82-54e0-916b-2df071569f52", "parentControlId": 31622, "controlId": "PR.PS-03", "title": "PR.PS-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587022" }, { "controlId": "CIP-006-6-R3", "title": "CIP-006-6-R3 — Physical Access Control System Maintenance and Testing", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "725e82fd-3dc1-5297-ba19-e9a3b52ba696", "isPublic": true }, { "controlId": "NSS-17T-Sec6.7", "title": "NSS-17T-Sec6.7 — Maintenance Tools, Outage Controls & Portable Media Sanitation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "95562fb2-fe02-54c9-9b32-d186b0f630e9", "isPublic": true }, { "controlId": "IEC-62645-8.1", "title": "IEC-62645-8.1 — Secure Maintenance & Diagnostic Test Equipment Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "a7a86da4-e416-5c04-b030-a82631c15755", "isPublic": true } ], "id": 31622, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731181", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731181", "catalogueId": 1062, "uuid": "af8c2f1c-5262-5c86-990c-9a830e8e39d8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization obtain maintenance support and/or spare parts for Technology Assets, Applications and/or Services (TAAS) within a defined Recovery Time Objective (RTO)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Timely Maintenance", "description": "

Control Description

Mechanisms exist to obtain maintenance support and/or spare parts for Technology Assets, Applications and/or Services (TAAS) within a defined Recovery Time Objective (RTO).

Evidence Request List (ERL)

E-MNT-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to obtain maintenance support and/or spare parts for Technology Assets, Applications and/or Services (TAAS) within a defined Recovery Time Objective (RTO).

Level 4 - Quantitatively Controlled: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

NERC-CIP (2026) Requirements: CIP-006-6-R3", "controlId": "MNT-03", "family": "Maintenance", "enhancements": "", "sortId": "MNT-03", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72498, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590773", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590773", "securityControlId": 31623, "ccis": [], "uuid": "cdc60851-7d3e-5abf-9dfa-033f2407869a", "testId": "MNT-03.1_A01", "test": "system components on which preventive maintenance is to be performed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-06(01)_ODP[01]", "defaultText": null }, { "id": 72499, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590774", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590774", "securityControlId": 31623, "ccis": [], "uuid": "db570a43-d616-5187-a030-bc7589ea5bc9", "testId": "MNT-03.1_A02", "test": "time intervals within which preventive maintenance is to be performed on system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-06(01)_ODP[02]", "defaultText": null }, { "id": 72500, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590774", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590774", "securityControlId": 31623, "ccis": [], "uuid": "0de4f07e-9798-5ad3-9e24-fc8d582d79fc", "testId": "MNT-03.1_A03", "test": "preventive maintenance is performed on system components at organization-defined time intervals.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-06(01)", "defaultText": null } ], "externalMappings": [ { "id": 584984, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587024", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba863833-107d-559c-8b94-480aa29ceb4a", "parentControlId": 31623, "controlId": "MA-6(1)", "title": "MA-6(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587024" }, { "id": 584985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587024", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe0f599a-a42e-5464-a787-1c478cd4da0c", "parentControlId": 31623, "controlId": "MA-06(01)", "title": "MA-06(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587025" }, { "id": 584986, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8615046c-4890-5989-b451-9a4e883b7822", "parentControlId": 31623, "controlId": "MA-06(01)", "title": "MA-06(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587025" }, { "id": 584987, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52aad879-2f02-5d66-a3a1-f79d9d9cc5cf", "parentControlId": 31623, "controlId": "03.07.04.a", "title": "03.07.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587025" }, { "id": 584988, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d30ba9a8-858a-549a-afa9-ac992ee9127b", "parentControlId": 31623, "controlId": "PR.PS-02", "title": "PR.PS-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587025" }, { "id": 584989, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ea853b5-6fbd-5365-9ae2-7b41b243367d", "parentControlId": 31623, "controlId": "PR.PS-03", "title": "PR.PS-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587025" } ], "id": 31623, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731181", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731181", "catalogueId": 1062, "uuid": "cb8bc1ac-c9d6-525f-adaa-6a3cb95ad76f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization perform preventive maintenance on critical Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Preventative Maintenance", "description": "

Control Description

Mechanisms exist to perform preventive maintenance on critical Technology Assets, Applications and/or Services (TAAS).

Evidence Request List (ERL)

E-MNT-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.\n▪ Asset custodians track maintenance activities and component failure rates.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to perform preventive maintenance on critical Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "MNT-03.1", "family": "Maintenance", "enhancements": "", "sortId": "MNT-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72501, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590774", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590774", "securityControlId": 31624, "ccis": [], "uuid": "745dd455-0a00-59c5-b106-ffd74a5f927b", "testId": "MNT-03.2_A01", "test": "system components on which predictive maintenance is to be performed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-06(02)_ODP[01]", "defaultText": null }, { "id": 72502, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590774", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590774", "securityControlId": 31624, "ccis": [], "uuid": "c1a01cf7-eb2a-523b-80ee-65bd1ad3db14", "testId": "MNT-03.2_A02", "test": "time intervals within which predictive maintenance is to be performed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: a timeframe to support advertised uptime and availability", "otherId": "53A_R5_MA-06(02)_ODP[02]", "defaultText": null }, { "id": 72503, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590774", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590774", "securityControlId": 31624, "ccis": [], "uuid": "1f840a6c-511f-50df-ac5b-32b8c488c9ed", "testId": "MNT-03.2_A03", "test": "predictive maintenance is performed on system components at organization-defined time intervals.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-06(02)", "defaultText": null } ], "externalMappings": [ { "id": 584991, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587026", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee658da3-21a3-5603-a9b9-6aae422841ed", "parentControlId": 31624, "controlId": "MA-6(2)", "title": "MA-6(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587026" }, { "id": 584992, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587026", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ef65042-3f5a-5d69-a6ff-3ac24a2bb00c", "parentControlId": 31624, "controlId": "MA-06(02)", "title": "MA-06(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587026" }, { "id": 584993, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587026", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fd1703b-3966-5bd1-a114-c30c901735fd", "parentControlId": 31624, "controlId": "MA-06(02)", "title": "MA-06(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587026" } ], "id": 31624, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731182", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731182", "catalogueId": 1062, "uuid": "4195144b-6901-5d62-95e7-0611a1a344ef", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization perform predictive maintenance on critical Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Predictive Maintenance", "description": "

Control Description

Mechanisms exist to perform predictive maintenance on critical Technology Assets, Applications and/or Services (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to perform predictive maintenance on critical Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "MNT-03.2", "family": "Maintenance", "enhancements": "", "sortId": "MNT-03.2", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72504, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590775", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590775", "securityControlId": 31625, "ccis": [], "uuid": "7f811f28-6e5e-5023-a681-4a7b91613bdb", "testId": "MNT-03.3_A01", "test": "automated mechanisms used to transfer predictive maintenance data to a maintenance management system are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-06(03)_ODP", "defaultText": null }, { "id": 72505, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590775", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590775", "securityControlId": 31625, "ccis": [], "uuid": "658b0ae0-0bcc-5cf2-b75f-dcdb3f46e8c6", "testId": "MNT-03.3_A02", "test": "predictive maintenance data is transferred to a maintenance management system using automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MA-06(03)", "defaultText": null } ], "externalMappings": [ { "id": 584995, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587026", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4869399d-59a3-5f1c-b2e0-af54744c62c6", "parentControlId": 31625, "controlId": "MA-6(3)", "title": "MA-6(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587026" }, { "id": 584996, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587026", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b177369a-4908-5481-a6c7-b9f91db7dad3", "parentControlId": 31625, "controlId": "MA-06(03)", "title": "MA-06(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587026" }, { "id": 584997, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587026", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e66b36b-c0bb-59d3-9481-0b5386843983", "parentControlId": 31625, "controlId": "MA-06(03)", "title": "MA-06(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587027" } ], "id": 31625, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731182", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731182", "catalogueId": 1062, "uuid": "af301068-7695-5b00-8d9e-27c9d98cd2a2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to transfer predictive maintenance data to a computerized maintenance management system?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Automated Support For Predictive Maintenance", "description": "

Control Description

Automated mechanisms exist to transfer predictive maintenance data to a computerized maintenance management system.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically transfer predictive maintenance data to a computerized maintenance management system.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-03.3", "family": "Maintenance", "enhancements": "", "sortId": "MNT-03.3", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72506, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590775", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590775", "securityControlId": 31626, "ccis": [], "uuid": "012a63ff-df22-57b0-abc0-b60225df6ede", "testId": "MNT-04_A01", "test": "tools used to conduct system maintenance are controlled.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.7.2[a]\n53A_R5_MA-03a.[02]", "defaultText": null }, { "id": 72507, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590775", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590775", "securityControlId": 31626, "ccis": [], "uuid": "e9cacb12-8b70-59bb-9f86-9f35bdd89a89", "testId": "MNT-04_A02", "test": "techniques used to conduct system maintenance are controlled.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.7.2[b]", "defaultText": null }, { "id": 72508, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590776", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590776", "securityControlId": 31626, "ccis": [], "uuid": "f31ec3b6-ce70-5575-8e97-65277dbf6f7f", "testId": "MNT-04_A03", "test": "mechanisms used to conduct system maintenance are controlled.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.7.2[c]", "defaultText": null }, { "id": 72509, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590776", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590776", "securityControlId": 31626, "ccis": [], "uuid": "0e0ca5d1-5982-5065-89d8-4cc0f9f4c1bf", "testId": "MNT-04_A04", "test": "personnel used to conduct system maintenance are controlled.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.7.2[d]", "defaultText": null }, { "id": 72510, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590776", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590776", "securityControlId": 31626, "ccis": [], "uuid": "0ac9ba99-b87a-5dbf-9b84-29a8df02f898", "testId": "MNT-04_A05", "test": "the use of maintenance tools that execute with increased privilege is monitored.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MA-03(05)", "defaultText": null }, { "id": 72511, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590776", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590776", "securityControlId": 31626, "ccis": [], "uuid": "6f5faa97-d8b5-5093-9668-0ddb2c008293", "testId": "MNT-04_A06", "test": "the frequency at which to review previously approved system maintenance tools is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_MA-03_ODP", "defaultText": null }, { "id": 72512, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590776", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590776", "securityControlId": 31626, "ccis": [], "uuid": "6ccbf11d-77de-56ee-8dc9-871946ac24d3", "testId": "MNT-04_A07", "test": "the use of system maintenance tools is approved.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_MA-03a.[01]\n171A_R3_A.03.07.04.a[01]", "defaultText": null }, { "id": 72513, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590777", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590777", "securityControlId": 31626, "ccis": [], "uuid": "b0d9c147-66df-565a-b154-3e8832a7b01f", "testId": "MNT-04_A08", "test": "the use of system maintenance tools is controlled.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.07.04.a[02]", "defaultText": null }, { "id": 72514, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590777", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590777", "securityControlId": 31626, "ccis": [], "uuid": "e55689ea-4866-5490-863b-70634db68410", "testId": "MNT-04_A09", "test": "the use of system maintenance tools is monitored.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_MA-03a.[03]\n171A_R3_A.03.07.04.a[03]", "defaultText": null }, { "id": 72515, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590777", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590777", "securityControlId": 31626, "ccis": [], "uuid": "fc09c2d5-6850-5af4-9f06-258ebf1cb0fc", "testId": "MNT-04_A10", "test": "previously approved system maintenance tools are reviewed per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_MA-03b.", "defaultText": null }, { "id": 72516, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590777", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590777", "securityControlId": 31626, "ccis": [], "uuid": "b3084244-beb3-5fe0-a89e-e9e736c50fae", "testId": "MNT-04_A11", "test": "maintenance tools are inspected to ensure that the latest software updates and patches are installed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-03(06)", "defaultText": null } ], "externalMappings": [ { "id": 585006, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587028", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa3a8a52-669e-5a9a-a03a-3da7345f20a6", "parentControlId": 31626, "controlId": "MA-3", "title": "MA-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587028" }, { "id": 585007, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587028", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a36776b3-2b85-5100-8f46-f77a1fe1f753", "parentControlId": 31626, "controlId": "MA-03", "title": "MA-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587028" }, { "id": 585008, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587028", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d50112fd-eb71-5e54-9049-a08f93510aaf", "parentControlId": 31626, "controlId": "MA-03(05)", "title": "MA-03(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587028" }, { "id": 585009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587028", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7709f33-aaca-58b6-b263-afd4a88333ee", "parentControlId": 31626, "controlId": "MA-03(06)", "title": "MA-03(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587028" }, { "id": 585010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587028", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c87de11-cc71-5822-ac64-894322a5eb7d", "parentControlId": 31626, "controlId": "MA-03", "title": "MA-03", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587028" }, { "id": 585011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8581aae5-39f1-5b00-9cb6-a8e056ab87f2", "parentControlId": 31626, "controlId": "MA-03", "title": "MA-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587029" }, { "id": 585012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce599336-4555-5e37-92ab-45280dab046d", "parentControlId": 31626, "controlId": "MA-03(05)", "title": "MA-03(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587029" }, { "id": 585013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdb39117-b435-5e24-944a-2f8e7a455a8d", "parentControlId": 31626, "controlId": "MA-03(06)", "title": "MA-03(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587029" }, { "id": 585014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9aba3bf6-1e43-56ed-90f5-b28077a4477b", "parentControlId": 31626, "controlId": "MA-03", "title": "MA-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587029" }, { "id": 585015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "928c4d45-3fc0-50ce-851a-fa88066b6a69", "parentControlId": 31626, "controlId": "MA-03", "title": "MA-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587029" }, { "id": 585016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "565f998a-a458-5edf-8c4c-b25dc1291728", "parentControlId": 31626, "controlId": "MA-3", "title": "MA-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58703" }, { "id": 585019, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f58e283b-6782-51c6-ad31-931ba1889224", "parentControlId": 31626, "controlId": "3.7.2", "title": "3.7.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58703" }, { "id": 585020, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fb01046-a13f-5e4f-b5f8-f795d9ec097d", "parentControlId": 31626, "controlId": "03.07.04.a", "title": "03.07.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58703" }, { "controlId": "C.4.2", "title": "C.4.2 — Maintenance Tools", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MA-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "3f22833f-e6d5-5879-a3eb-ba6df7826588", "isPublic": true }, { "controlId": "NEI 08-09 App E.4.2", "title": "NEI 08-09 App E.4.2 — Maintenance Tools", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.4.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "bffc9562-a740-5d1c-9a8e-6fa4c4dd1840", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.4.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "bf763e34-6e4f-557f-aeef-1ef00404508c", "isPublic": true }, { "controlId": "NSS-17T-Sec6.7", "title": "NSS-17T-Sec6.7 — Maintenance Tools, Outage Controls & Portable Media Sanitation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "8317b328-6a60-59b1-923a-1bb85893fff7", "isPublic": true }, { "controlId": "IEC-62645-8.1", "title": "IEC-62645-8.1 — Secure Maintenance & Diagnostic Test Equipment Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "b0925020-2150-55a9-8c4b-b638c5323e11", "isPublic": true } ], "id": 31626, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731182", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731182", "catalogueId": 1062, "uuid": "7d8a8662-31d6-53e4-9164-1e7b023dcaae", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization control and monitor the use of system maintenance tools?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Maintenance Tools", "description": "

Control Description

Mechanisms exist to control and monitor the use of system maintenance tools.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.\n▪ IT and/or cybersecurity personnel control and monitor the use of system maintenance tools.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to control and monitor the use of system maintenance tools.

Level 4 - Quantitatively Controlled: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.4.2", "controlId": "MNT-04", "family": "Maintenance", "enhancements": "", "sortId": "MNT-04", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72517, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590777", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590777", "securityControlId": 31627, "ccis": [], "uuid": "3a1a9926-d58b-56bc-a205-ea87bd6d9e15", "testId": "MNT-04.1_A01", "test": "maintenance tools used by maintenance personnel are inspected for improper or unauthorized modifications.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-03(01)", "defaultText": null } ], "externalMappings": [ { "id": 585041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587033", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b8cbad5-408b-5e3e-8224-fa478f24acd2", "parentControlId": 31627, "controlId": "MA-3(1)", "title": "MA-3(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587033" }, { "id": 585042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a92ab163-a2aa-5c6d-a582-a396e967be63", "parentControlId": 31627, "controlId": "MA-03(01)", "title": "MA-03(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587034" }, { "id": 585043, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8592053-c55b-5439-a923-1a80db8cf48b", "parentControlId": 31627, "controlId": "MA-03(01)", "title": "MA-03(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587034" }, { "id": 585044, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9370aeb-6b6e-5d48-9779-8c2d243f25a1", "parentControlId": 31627, "controlId": "MA-03(01)", "title": "MA-03(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587034" }, { "id": 585045, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fda5360b-cbd8-56a4-b410-70da4184c88d", "parentControlId": 31627, "controlId": "MA-03(01)", "title": "MA-03(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587034" }, { "id": 585046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a7e7fe0-f647-5f75-ad9a-f99a51798768", "parentControlId": 31627, "controlId": "MA-03(01)", "title": "MA-03(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587034" }, { "id": 585047, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9e545c5-7dcf-5f00-9ec0-308cfb5da2bb", "parentControlId": 31627, "controlId": "MA-3(1)", "title": "MA-3(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587034" }, { "id": 585049, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eef54e85-fad4-506f-b25f-1b3616b3d450", "parentControlId": 31627, "controlId": "03.07.04.b", "title": "03.07.04.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587035" }, { "controlId": "C.4.2", "title": "C.4.2 — Maintenance Tools", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MA-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "2efc6dd6-0bfd-5755-984d-841fe734a7bd", "isPublic": true }, { "controlId": "NEI 08-09 App E.4.2", "title": "NEI 08-09 App E.4.2 — Maintenance Tools", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.4.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "b476f955-1fb7-522c-8b7e-294dc8356baf", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.4.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "819c4e37-7317-5c18-991c-e7b01372a07a", "isPublic": true }, { "controlId": "NSS-17T-Sec6.7", "title": "NSS-17T-Sec6.7 — Maintenance Tools, Outage Controls & Portable Media Sanitation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "2056ee29-705a-5c9a-bf28-cc119c7c863b", "isPublic": true }, { "controlId": "IEC-62645-8.1", "title": "IEC-62645-8.1 — Secure Maintenance & Diagnostic Test Equipment Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "477983b4-303c-5ae7-a5ee-8e1e9df18c8e", "isPublic": true } ], "id": 31627, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731183", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731183", "catalogueId": 1062, "uuid": "656ec24d-262e-5613-8986-6e26e4b33a5f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization inspect maintenance tools carried into a facility by maintenance personnel for improper or unauthorized modifications?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Inspect Tools", "description": "

Control Description

Mechanisms exist to inspect maintenance tools carried into a facility by maintenance personnel for improper or unauthorized modifications.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.\n▪ IT and/or cybersecurity personnel control and monitor the use of system maintenance tools.\n▪ IT and/or cybersecurity personnel inspect maintenance tools carried into a facility by maintenance personnel for improper or unauthorized modifications.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to inspect maintenance tools carried into a facility by maintenance personnel for improper or unauthorized modifications.

Level 4 - Quantitatively Controlled: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.4.2", "controlId": "MNT-04.1", "family": "Maintenance", "enhancements": "", "sortId": "MNT-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72518, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590777", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590777", "securityControlId": 31628, "ccis": [], "uuid": "56f0ef8b-eb9b-5f41-84f7-f40610b8f4c4", "testId": "MNT-04.2_A01", "test": "media with diagnostic and test programs are checked for malicious code before the media are used in the system.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MA-03(02)\n171A_3.7.4\n171A_R3_A.03.07.04.b", "defaultText": null } ], "externalMappings": [ { "id": 585060, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "724483e9-d703-5067-96e7-0a22b2232743", "parentControlId": 31628, "controlId": "MA-3(2)", "title": "MA-3(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587036" }, { "id": 585061, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9123f9a8-d367-5f28-9db0-e1fea1ab3927", "parentControlId": 31628, "controlId": "MA-03(02)", "title": "MA-03(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587036" }, { "id": 585062, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d716d17c-43fd-5dbc-8fa5-06587b62650d", "parentControlId": 31628, "controlId": "MA-03(02)", "title": "MA-03(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587036" }, { "id": 585063, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ba4f0e5-f4a0-5670-b603-7c375769d1ef", "parentControlId": 31628, "controlId": "MA-03(02)", "title": "MA-03(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587036" }, { "id": 585064, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4243caa-ab5f-56f3-a965-37b32e40e62d", "parentControlId": 31628, "controlId": "MA-03(02)", "title": "MA-03(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587036" }, { "id": 585065, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c53a247e-6473-5532-8578-11c5c0bb2346", "parentControlId": 31628, "controlId": "MA-03(02)", "title": "MA-03(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587037" }, { "id": 585066, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3b80b49-3833-566b-b40c-d102b674d75d", "parentControlId": 31628, "controlId": "MA-3(2)", "title": "MA-3(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587037" }, { "id": 585068, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76d1a3f6-98de-546b-8f26-d032695a8aa0", "parentControlId": 31628, "controlId": "3.7.4", "title": "3.7.4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587037" } ], "id": 31628, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731183", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731183", "catalogueId": 1062, "uuid": "34cb95b1-bfa5-52cc-90dc-28fc43e6f59a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization check media containing diagnostic and test programs for malicious code before the media are used?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Inspect Media", "description": "

Control Description

Mechanisms exist to check media containing diagnostic and test programs for malicious code before the media are used.

Evidence Request List (ERL)

E-MNT-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.\n▪ IT and/or cybersecurity personnel control and monitor the use of system maintenance tools.\n▪ IT and/or cybersecurity personnel inspect maintenance tools carried into a facility by maintenance personnel for improper or unauthorized modifications.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to check media containing diagnostic and test programs for malicious code before the media are used.

Level 4 - Quantitatively Controlled: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-04.2", "family": "Maintenance", "enhancements": "", "sortId": "MNT-04.2", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72519, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590778", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590778", "securityControlId": 31629, "ccis": [], "uuid": "70c0b3cc-e919-5117-b953-f1d357f2eeea", "testId": "MNT-04.3_A01", "test": "personnel or roles who can authorize removal of equipment from the facility is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: the information owner", "otherId": "53A_R5_MA-03(03)_ODP", "defaultText": null }, { "id": 72520, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590778", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590778", "securityControlId": 31629, "ccis": [], "uuid": "43c98f16-5a2b-56f8-b9e9-be4bc10466da", "testId": "MNT-04.3_A02", "test": "the removal of system maintenance equipment containing sensitive / regulated data is prevented by verifying that there is no sensitive / regulated data on the equipment, sanitizing or destroying the equipment, or retaining the equipment within the facility.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "53A_R5_MA-03(03)(a)", "defaultText": null }, { "id": 72521, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590778", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590778", "securityControlId": 31629, "ccis": [], "uuid": "d87bc0da-6b5e-5fc1-8d2c-e4f8813f0739", "testId": "MNT-04.3_A03", "test": "the removal of maintenance equipment containing organizational information is prevented by sanitizing or destroying the equipment.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "53A_R5_MA-03(03)(b)", "defaultText": null }, { "id": 72522, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590778", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590778", "securityControlId": 31629, "ccis": [], "uuid": "fb03dec0-91c0-5ec0-94d5-ce4389d18a90", "testId": "MNT-04.3_A04", "test": "the removal of maintenance equipment containing organizational information is prevented by retaining the equipment within the facility.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "53A_R5_MA-03(03)(c)", "defaultText": null }, { "id": 72523, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590779", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590779", "securityControlId": 31629, "ccis": [], "uuid": "a3cf8ac4-8e36-5aa4-891f-48d1009d9416", "testId": "MNT-04.3_A05", "test": "the removal of maintenance equipment containing organizational information is prevented by obtaining an exemption from personnel or roles explicitly authorizing removal of the equipment from the facility.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "53A_R5_MA-03(03)(d)", "defaultText": null }, { "id": 72524, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590779", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590779", "securityControlId": 31629, "ccis": [], "uuid": "62da45fe-56d4-5a18-b8a0-9f6c8707a7bf", "testId": "MNT-04.3_A06", "test": "the removal of system maintenance equipment containing CUI is prevented by verifying that there is no CUI on the equipment, sanitizing or destroying the equipment, or retaining the equipment within the facility.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.07.04.c", "defaultText": null } ], "externalMappings": [ { "id": 585085, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73d220e8-3648-5546-aa4c-0f80898213c0", "parentControlId": 31629, "controlId": "MA-3(3)", "title": "MA-3(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587039" }, { "id": 585086, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc68e868-34d7-5501-a7e1-644815d3c107", "parentControlId": 31629, "controlId": "MA-03(03)", "title": "MA-03(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587039" }, { "id": 585087, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "422f1a9f-c752-5a24-98db-f8d6c97d7f7e", "parentControlId": 31629, "controlId": "MA-03(03)", "title": "MA-03(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587039" }, { "id": 585089, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31756277-07db-5956-b76a-83a409a1cc5f", "parentControlId": 31629, "controlId": "MA-03(03)", "title": "MA-03(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587039" }, { "id": 585090, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ad8290e-dd43-59db-a309-5cc0b49de8d2", "parentControlId": 31629, "controlId": "MA-03(03)", "title": "MA-03(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587039" }, { "id": 585091, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "759e2a2b-86b8-56b3-b1ac-62d462fe20b0", "parentControlId": 31629, "controlId": "MA-03(03)", "title": "MA-03(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58704" }, { "id": 585092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24324aed-421b-5674-b054-157ce5f85034", "parentControlId": 31629, "controlId": "MA-3(3)", "title": "MA-3(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58704" }, { "id": 585094, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b5857a4-4843-59e9-9cda-f39a67551d94", "parentControlId": 31629, "controlId": "03.07.04.c", "title": "03.07.04.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58704" } ], "id": 31629, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731183", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731183", "catalogueId": 1062, "uuid": "a4258619-41ef-5a91-843e-77f08316616f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prevent or control the removal of equipment undergoing maintenance that contains organizational information?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Prevent Unauthorized Removal", "description": "

Control Description

Mechanisms exist to prevent or control the removal of equipment undergoing maintenance that contains organizational information.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.\n▪ Asset / process owners prevent or control the removal of equipment undergoing maintenance that contains organizational information.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prevent or control the removal of equipment undergoing maintenance that contains organizational information.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-04.3", "family": "Maintenance", "enhancements": "", "sortId": "MNT-04.3", "references": "

Micro-Small Business (<10 staff)

∙ Physical Access Control (PAC)

Small Business (10-49 staff)

∙ Physical Access Control (PAC)

Medium Business (50-249 staff)

∙ Physical Access Control (PAC)

Large Business (250-999 staff)

∙ Physical Access Control (PAC)

Enterprise (>1,000 staff)

∙ Physical Access Control (PAC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72525, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590779", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590779", "securityControlId": 31630, "ccis": [], "uuid": "987f081c-4d21-5dd0-a52f-0a8b164223b2", "testId": "MNT-04.4_A01", "test": "the use of maintenance tools is restricted to authorized personnel only.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-03(04)", "defaultText": null } ], "externalMappings": [ { "id": 585122, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83cf9036-1068-58a3-9415-d17f25ebbd9e", "parentControlId": 31630, "controlId": "MA-3(4)", "title": "MA-3(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587043" }, { "id": 585123, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6aae42b5-8d21-5c28-bfde-2c9d98b0a3d2", "parentControlId": 31630, "controlId": "MA-03(04)", "title": "MA-03(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587043" }, { "id": 585124, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bad9ae7d-d76c-5bd9-bf64-a22d3be851de", "parentControlId": 31630, "controlId": "MA-03(04)", "title": "MA-03(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587043" } ], "id": 31630, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731184", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731184", "catalogueId": 1062, "uuid": "708191ee-b3e9-549b-820d-3225611b88c4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to restrict the use of maintenance tools to authorized maintenance personnel and/or roles?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Restrict Tool Usage", "description": "

Control Description

Automated mechanisms exist to restrict the use of maintenance tools to authorized maintenance personnel and/or roles.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Maintenance (MNT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MNT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Maintenance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Maintenance controls are primarily administrative in nature (e.g., policies & standards) to manage change control processes associated with maintenance operations.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.\n▪ IT and/or cybersecurity personnel control and monitor the use of system maintenance tools.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically restrict the use of maintenance tools to authorized maintenance personnel and/or roles.

Level 4 - Quantitatively Controlled: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "MNT-04.4", "family": "Maintenance", "enhancements": "", "sortId": "MNT-04.4", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72526, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590779", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590779", "securityControlId": 31631, "ccis": [], "uuid": "10e03173-1247-5a3d-b7ac-b328b5b0c7a4", "testId": "MNT-05_A01", "test": "nonlocal maintenance and diagnostic activities are approved.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-04a.[01]\n171A_R3_A.03.07.05.a[01]", "defaultText": null }, { "id": 72527, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59078", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59078", "securityControlId": 31631, "ccis": [], "uuid": "8c4f1e78-945d-5ac1-a21b-55a798e484f9", "testId": "MNT-05_A02", "test": "nonlocal maintenance and diagnostic activities are monitored.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MA-04a.[02]\n171A_R3_A.03.07.05.a[02]", "defaultText": null }, { "id": 72528, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59078", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59078", "securityControlId": 31631, "ccis": [], "uuid": "57108b16-fa76-5704-96c0-0b77b349c0db", "testId": "MNT-05_A03", "test": "the use of nonlocal maintenance and diagnostic tools are allowed only as consistent with organizational policy.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MA-04b.[01]", "defaultText": null }, { "id": 72529, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59078", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59078", "securityControlId": 31631, "ccis": [], "uuid": "d337b6a7-a6d6-5fa4-8048-8be128c9ad35", "testId": "MNT-05_A04", "test": "the use of nonlocal maintenance and diagnostic tools are documented in the security plan for the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-04b.[02]", "defaultText": null }, { "id": 72530, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59078", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59078", "securityControlId": 31631, "ccis": [], "uuid": "6e4f89d5-7f35-53a2-9ed3-ccd3396fa88f", "testId": "MNT-05_A05", "test": "strong authentication is employed in the establishment of nonlocal maintenance and diagnostic sessions.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_MA-04c.", "defaultText": null }, { "id": 72531, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59078", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59078", "securityControlId": 31631, "ccis": [], "uuid": "e4907a47-c713-5432-8780-9b44c1ffedc4", "testId": "MNT-05_A06", "test": "records for nonlocal maintenance and diagnostic activities are maintained.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-04d.", "defaultText": null }, { "id": 72532, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59078", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59078", "securityControlId": 31631, "ccis": [], "uuid": "145cdb84-dc56-5382-8d82-9351b925a36d", "testId": "MNT-05_A07", "test": "session connections are terminated when nonlocal maintenance is completed.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_MA-04e.[01]", "defaultText": null }, { "id": 72533, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59078", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59078", "securityControlId": 31631, "ccis": [], "uuid": "494bd56a-7ccf-51fb-99f1-ae5b7b1b9cea", "testId": "MNT-05_A08", "test": "network connections are terminated when nonlocal maintenance is completed.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_MA-04e.[02]", "defaultText": null }, { "id": 72534, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59078", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59078", "securityControlId": 31631, "ccis": [], "uuid": "c33dd17f-ce92-53fa-a5b9-157ede483ea1", "testId": "MNT-05_A09", "test": "multifactor authentication is used to establish nonlocal maintenance sessions via external network connections.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.7.5[a]", "defaultText": null }, { "id": 72535, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590781", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590781", "securityControlId": 31631, "ccis": [], "uuid": "07d98c1e-fd92-5d7e-baad-8d30c467b2eb", "testId": "MNT-05_A10", "test": "nonlocal maintenance sessions established via external network connections are terminated when nonlocal maintenance is complete.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.7.5[b]", "defaultText": null } ], "externalMappings": [ { "id": 585136, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "199a71ae-2676-5890-96ac-61091645c485", "parentControlId": 31631, "controlId": "MA-4", "title": "MA-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587045" }, { "id": 585137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eaccccd6-1213-55e0-a035-cd7a77b37909", "parentControlId": 31631, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587045" }, { "id": 585139, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28d62eae-b7bc-5341-be8a-497c80b716ee", "parentControlId": 31631, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587045" }, { "id": 585140, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f64868d-1123-56e0-ad65-888e1b6c311e", "parentControlId": 31631, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587045" }, { "id": 585141, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ff43b85-8da2-5e31-b785-8e37c597be00", "parentControlId": 31631, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587045" }, { "id": 585142, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6dd9bd56-a4d7-5521-bbcb-b66b2588a44b", "parentControlId": 31631, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587045" }, { "id": 585143, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5e2c251-976e-5bc1-86ee-5799c0f1eea0", "parentControlId": 31631, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587046" }, { "id": 585144, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf6bda3c-aab1-5724-b81f-f5551ee977e8", "parentControlId": 31631, "controlId": "MA-4", "title": "MA-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587046" }, { "id": 585145, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9eee8ce-b18f-5d61-b6ae-ae2c9d29ec18", "parentControlId": 31631, "controlId": "MA-4", "title": "MA-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587046" }, { "id": 585146, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e050b486-0df4-535b-8150-7e5c5652adbb", "parentControlId": 31631, "controlId": "MA-4", "title": "MA-4", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587046" }, { "id": 585149, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "657c92ff-3dd8-5cea-880a-b7591df2731f", "parentControlId": 31631, "controlId": "3.7.5", "title": "3.7.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587046" }, { "id": 585150, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ca73f44-da93-5722-b908-27cb85a0b979", "parentControlId": 31631, "controlId": "03.01.12.d", "title": "03.01.12.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587046" }, { "id": 585151, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f68207ef-6854-573b-8ee0-8942c97cd192", "parentControlId": 31631, "controlId": "03.07.05.a", "title": "03.07.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587046" }, { "id": 585152, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6614ca88-3003-54f9-b966-aff1bd0f5aba", "parentControlId": 31631, "controlId": "03.07.05.b", "title": "03.07.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587047" }, { "id": 585153, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d86367b5-5db1-5487-bbcb-0a5212b18566", "parentControlId": 31631, "controlId": "03.07.05.c", "title": "03.07.05.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587047" }, { "controlId": "NSS-17T-Sec6.7", "title": "NSS-17T-Sec6.7 — Maintenance Tools, Outage Controls & Portable Media Sanitation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "1444c350-8179-57cb-ab8f-a6a566decc11", "isPublic": true }, { "controlId": "IEC-62645-8.1", "title": "IEC-62645-8.1 — Secure Maintenance & Diagnostic Test Equipment Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "34fb3f63-206f-51a9-8f7a-ffd8540dcb25", "isPublic": true } ], "id": 31631, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731184", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731184", "catalogueId": 1062, "uuid": "c6eda0a1-56ad-58c5-b21b-8487c66e300b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization authorize, monitor and control remote, non-local maintenance and diagnostic activities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Remote Maintenance", "description": "

Control Description

Mechanisms exist to authorize, monitor and control remote, non-local maintenance and diagnostic activities.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.\n▪ Instances of non-console administrative access use cryptographic mechanisms to protect the confidentiality and integrity of the data being transmitted.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to authorize, monitor and control remote, non-local maintenance and diagnostic activities.

Level 4 - Quantitatively Controlled: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "MNT-05", "family": "Maintenance", "enhancements": "", "sortId": "MNT-05", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72536, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590781", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590781", "securityControlId": 31632, "ccis": [], "uuid": "029bec47-5d3c-514f-9a84-2f36790c167a", "testId": "MNT-05.1_A01", "test": "nonlocal maintenance and diagnostic activities are monitored.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MA-04a.[02]", "defaultText": null }, { "id": 72537, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590781", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590781", "securityControlId": 31632, "ccis": [], "uuid": "0f3a8691-fb08-5f55-88af-68af9103729b", "testId": "MNT-05.1_A02", "test": "audit events to be logged for nonlocal maintenance are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-04(01)_ODP[01]", "defaultText": null }, { "id": 72538, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590781", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590781", "securityControlId": 31632, "ccis": [], "uuid": "d9d8bccd-6054-5db3-8af5-486a5c4ccb7b", "testId": "MNT-05.1_A03", "test": "audit events to be logged for diagnostic sessions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-04(01)_ODP[02]", "defaultText": null }, { "id": 72539, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590781", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590781", "securityControlId": 31632, "ccis": [], "uuid": "daec6dc6-b4e8-5b06-87fd-4967649af4b9", "testId": "MNT-05.1_A04", "test": "audit events are logged for nonlocal maintenance sessions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MA-04(01)(a)[01]", "defaultText": null }, { "id": 72540, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590782", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590782", "securityControlId": 31632, "ccis": [], "uuid": "d8107cc4-4bb3-573e-af35-d9355cdeda5b", "testId": "MNT-05.1_A05", "test": "audit events are logged for nonlocal diagnostic sessions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MA-04(01)(a)[02]", "defaultText": null }, { "id": 72541, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590782", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590782", "securityControlId": 31632, "ccis": [], "uuid": "cfb3ccdc-1da8-5ddb-b36c-b15094121355", "testId": "MNT-05.1_A06", "test": "the audit records of the maintenance sessions are reviewed to detect anomalous behavior.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-04(01)(b)[01]", "defaultText": null }, { "id": 72542, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590782", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590782", "securityControlId": 31632, "ccis": [], "uuid": "a00f8154-d42b-5730-908a-916513287b69", "testId": "MNT-05.1_A07", "test": "the audit records of the diagnostic sessions are reviewed to detect anomalous behavior.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-04(01)(b)[02]", "defaultText": null } ], "externalMappings": [ { "id": 585207, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e83cc3b-ce64-527d-b6ed-3e0127b027dc", "parentControlId": 31632, "controlId": "MA-4(1)", "title": "MA-4(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587053" }, { "id": 585208, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffec7de0-ec5d-55a2-bc35-3a8ebe465a9d", "parentControlId": 31632, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587053" }, { "id": 585209, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "134e0897-ffa3-5d01-a534-e372c7252e58", "parentControlId": 31632, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587053" }, { "id": 585210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5bf73f5a-cffb-5a0b-9068-51c101ad19cf", "parentControlId": 31632, "controlId": "MA-04(01)", "title": "MA-04(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587053" }, { "id": 585213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd4baac3-d4c2-5640-941a-ce279c63adb6", "parentControlId": 31632, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587053" }, { "id": 585214, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6720ba7c-b018-5a52-be0f-efccc1ae67bb", "parentControlId": 31632, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587053" }, { "id": 585215, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afdb7172-a565-59c0-a963-09378f122723", "parentControlId": 31632, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587054" }, { "id": 585216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86ead58a-be1c-5349-a2a6-f36bb9e8899a", "parentControlId": 31632, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587054" }, { "id": 585217, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fe5aa85-9ebb-5d44-8fdf-c7882c72d7d7", "parentControlId": 31632, "controlId": "MA-04(01)", "title": "MA-04(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587054" }, { "id": 585218, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d50dccd-09e1-524c-b192-fbc9ed0b1a0b", "parentControlId": 31632, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587054" }, { "id": 585219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a558bdd3-2697-554d-96ee-061ecdfe55e8", "parentControlId": 31632, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587054" }, { "id": 585220, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2bedb49-885e-57d9-89a5-bce57c9d5662", "parentControlId": 31632, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587055" }, { "id": 585221, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3be389b3-7fde-5beb-a24d-4f6275de84d7", "parentControlId": 31632, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587055" }, { "id": 585222, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b392048b-2824-547c-a8c5-0f0f0f09a561", "parentControlId": 31632, "controlId": "MA-04(01)", "title": "MA-04(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587055" }, { "id": 585223, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3249e8b9-a8b7-55d4-9635-01330b13bc22", "parentControlId": 31632, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587055" }, { "id": 585224, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c19a690-7970-5833-a6d6-14b402c7b220", "parentControlId": 31632, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587055" }, { "id": 585225, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5eafb5ae-3428-5374-8b66-b37bff423989", "parentControlId": 31632, "controlId": "MA-04(01)", "title": "MA-04(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587055" }, { "id": 585226, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c0fe41e-f608-5dd9-b327-81caadd3a8cc", "parentControlId": 31632, "controlId": "MA-1", "title": "MA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587055" }, { "id": 585227, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "535e232e-8ad6-5472-a12d-94e6200fcccf", "parentControlId": 31632, "controlId": "MA-4", "title": "MA-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587056" }, { "id": 585228, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43dfcd84-29c3-5fdc-a31c-cd0b97774403", "parentControlId": 31632, "controlId": "MA-1", "title": "MA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587056" }, { "id": 585229, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df7be433-7ae6-5b87-99ec-9dbe020a355d", "parentControlId": 31632, "controlId": "MA-4", "title": "MA-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587056" }, { "id": 585230, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76ad6134-eb20-55d2-ba86-ed97db67ea58", "parentControlId": 31632, "controlId": "MA-1", "title": "MA-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587056" }, { "id": 585231, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d825a380-16f5-5e76-8ad8-68b323fe72b1", "parentControlId": 31632, "controlId": "MA-4", "title": "MA-4", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587056" }, { "id": 585237, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2278045-64f2-5f70-afd5-0d1cf84d2f73", "parentControlId": 31632, "controlId": "03.07.05.a", "title": "03.07.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587057" } ], "id": 31632, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731184", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731184", "catalogueId": 1062, "uuid": "6de01105-bdf2-5c7b-9d58-0c37660538ae", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization audit remote, non-local maintenance and diagnostic sessions, as well as review the maintenance action performed during remote maintenance sessions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Auditing Remote Maintenance", "description": "

Control Description

Mechanisms exist to audit remote, non-local maintenance and diagnostic sessions, as well as review the maintenance action performed during remote maintenance sessions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to audit remote, non-local maintenance and diagnostic sessions, as well as review the maintenance action performed during remote maintenance sessions.

Level 4 - Quantitatively Controlled: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-05.1", "family": "Maintenance", "enhancements": "", "sortId": "MNT-05.1", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72543, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590782", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590782", "securityControlId": 31633, "ccis": [], "uuid": "7600e910-66e7-553f-88a9-fa2f9e2b7d18", "testId": "MNT-05.2_A01", "test": "personnel and roles to be notified of the date and time of planned nonlocal maintenance is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-04(05)_ODP[02]", "defaultText": null }, { "id": 72544, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590782", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590782", "securityControlId": 31633, "ccis": [], "uuid": "f5f1a6a5-c49c-561c-9fdb-4cc9f4151839", "testId": "MNT-05.2_A02", "test": "personnel and roles are notified of the date and time of planned nonlocal maintenance.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-04(05)(b)", "defaultText": null } ], "externalMappings": [ { "id": 585283, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587074", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "591d6612-d3ad-5571-9b44-79fa28b68511", "parentControlId": 31633, "controlId": "MA-4(2)", "title": "MA-4(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587074" }, { "id": 585284, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587074", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a557320-3118-5977-b2b3-3bca687779a3", "parentControlId": 31633, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587074" }, { "id": 585285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587074", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d44d21d-3f04-5a76-9c51-2423897ec806", "parentControlId": 31633, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587074" }, { "id": 585288, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587074", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5b07674-56f3-5cc4-ac87-f4b35a5d9780", "parentControlId": 31633, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587074" }, { "id": 585289, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b21e58e9-c129-5064-84bf-55a7412d9d9e", "parentControlId": 31633, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587075" }, { "id": 585290, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42a0648f-6df2-5ab3-bcb5-5e5bc96f6980", "parentControlId": 31633, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587075" }, { "id": 585291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9da83e24-0588-5ac4-a08f-d6de95391117", "parentControlId": 31633, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587075" }, { "id": 585292, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "137779f7-0404-5cc9-ac32-9db439fba4ad", "parentControlId": 31633, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587075" }, { "id": 585293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f703ab15-fbf1-59b2-bc56-8821698daa0c", "parentControlId": 31633, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587075" }, { "id": 585294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "adf5b81e-0997-5113-b2e0-5b5dafb5bb40", "parentControlId": 31633, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587075" }, { "id": 585295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "456e7113-3c74-5f5d-95f2-d2650c5a2998", "parentControlId": 31633, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587075" }, { "id": 585296, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1460369a-6ce9-50b6-bf82-f3af88a2daa2", "parentControlId": 31633, "controlId": "MA-01", "title": "MA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587075" }, { "id": 585297, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd6d14c3-3e76-5ba7-8416-9d71c92909cd", "parentControlId": 31633, "controlId": "MA-04", "title": "MA-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587076" }, { "id": 585298, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8f87e2b-f47c-5da7-8407-7cdd96ca3aea", "parentControlId": 31633, "controlId": "MA-1", "title": "MA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587076" }, { "id": 585299, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ccc297f-ef02-5c80-8d42-8c0f25408fb5", "parentControlId": 31633, "controlId": "MA-4", "title": "MA-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587076" }, { "id": 585300, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "839063c0-5b79-52c6-b4fb-f0c9fb4f8f35", "parentControlId": 31633, "controlId": "MA-1", "title": "MA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587076" }, { "id": 585301, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "533897ac-e71f-58b8-989a-ada93222f07e", "parentControlId": 31633, "controlId": "MA-4", "title": "MA-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587076" }, { "id": 585302, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "008a0be7-6f13-5394-8331-87dc1729f0e5", "parentControlId": 31633, "controlId": "MA-1", "title": "MA-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587076" }, { "id": 585303, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37f5ca6e-abe6-56d6-8814-f197c95149d4", "parentControlId": 31633, "controlId": "MA-4", "title": "MA-4", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587076" }, { "id": 585309, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587077", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff9b18fe-6e1b-5443-ba45-d8bc35caf9a3", "parentControlId": 31633, "controlId": "NFO - MA-4(2)", "title": "NFO - MA-4(2)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587077" } ], "id": 31633, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731185", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731185", "catalogueId": 1062, "uuid": "4861d48e-b518-552b-bfb8-822dc82257b0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require maintenance personnel to notify affected stakeholders when remote, non-local maintenance is planned (e.g., date/time)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Remote Maintenance Notifications", "description": "

Control Description

Mechanisms exist to require maintenance personnel to notify affected stakeholders when remote, non-local maintenance is planned (e.g., date/time).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.\n▪ Asset / process owners require maintenance personnel to notify entity-defined personnel when non-local maintenance is planned (e.g., date/time).

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require maintenance personnel to notify affected stakeholders when remote, non-local maintenance is planned (e.g., date/time).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-05.2", "family": "Maintenance", "enhancements": "", "sortId": "MNT-05.2", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72545, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590783", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590783", "securityControlId": 31634, "ccis": [], "uuid": "d6729a4c-e279-53c3-b2e3-acf9161fc79e", "testId": "MNT-05.3_A01", "test": "cryptographic mechanisms to be implemented to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-04(06)_ODP", "defaultText": null }, { "id": 72546, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590783", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590783", "securityControlId": 31634, "ccis": [], "uuid": "895a3ba5-e63a-5739-8f79-59672ebaa55a", "testId": "MNT-05.3_A02", "test": "cryptographic mechanisms are implemented to protect the integrity of nonlocal maintenance and diagnostic communications.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MA-04(06)[01]", "defaultText": null }, { "id": 72547, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590783", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590783", "securityControlId": 31634, "ccis": [], "uuid": "e5f6555d-d915-5e27-a664-b9578fe131ed", "testId": "MNT-05.3_A03", "test": "cryptographic mechanisms are implemented to protect the confidentiality of nonlocal maintenance and diagnostic communications.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MA-04(06)[02]", "defaultText": null }, { "id": 72548, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590783", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590783", "securityControlId": 31634, "ccis": [], "uuid": "327fcd62-0ab0-5e2d-9831-e18b09068b7f", "testId": "MNT-05.3_A04", "test": "replay resistance is implemented in the establishment of nonlocal maintenance and diagnostic sessions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.07.05.b[02]", "defaultText": null } ], "externalMappings": [ { "id": 585336, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58708", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b3c7a5c-0050-54cb-ae78-78d22c98b004", "parentControlId": 31634, "controlId": "MA-4(6)", "title": "MA-4(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58708" }, { "id": 585337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58708", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bcf965aa-b812-5542-a485-74e57c42328d", "parentControlId": 31634, "controlId": "MA-04(06)", "title": "MA-04(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58708" }, { "id": 585338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587081", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c70dda55-0afc-56a3-a19e-efe00530b56a", "parentControlId": 31634, "controlId": "MA-04(06)", "title": "MA-04(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587081" }, { "id": 585339, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587081", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29ecc928-f6bd-5b3a-878f-6cd31b467ac1", "parentControlId": 31634, "controlId": "03.07.05.b", "title": "03.07.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587081" } ], "id": 31634, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731185", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731185", "catalogueId": 1062, "uuid": "ebcf27bc-451c-5a42-91e4-20e1de1add91", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Are cryptographic mechanisms utilized to protect the integrity and confidentiality of remote, non-local maintenance and diagnostic communications?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Remote Maintenance Cryptographic Protection", "description": "

Control Description

Cryptographic mechanisms exist to protect the integrity and confidentiality of remote, non-local maintenance and diagnostic communications.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational cryptographic capability exists to protect the integrity and confidentiality of remote, non-local maintenance and diagnostic communications.

Level 4 - Quantitatively Controlled: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-05.3", "family": "Maintenance", "enhancements": "", "sortId": "MNT-05.3", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72549, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590783", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590783", "securityControlId": 31635, "ccis": [], "uuid": "ea1fe775-c76e-5732-8b29-d03f38221b6b", "testId": "MNT-05.4_A01", "test": "session connections are terminated when nonlocal maintenance is completed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.07.05.c[01]", "defaultText": null }, { "id": 72550, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590783", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590783", "securityControlId": 31635, "ccis": [], "uuid": "65c83b30-195a-5e5a-b680-27389ccce126", "testId": "MNT-05.4_A02", "test": "session connection termination is verified after the completion of nonlocal maintenance and diagnostic sessions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MA-04(07)[01]", "defaultText": null }, { "id": 72551, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590783", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590783", "securityControlId": 31635, "ccis": [], "uuid": "93d5a00b-92a7-50cd-9a50-70a073a3c9f8", "testId": "MNT-05.4_A03", "test": "network connection termination is verified after the completion of nonlocal maintenance and diagnostic sessions.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_MA-04(07)[02]", "defaultText": null } ], "externalMappings": [ { "id": 585353, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0c8e038-ac2e-52a9-b19a-f446f85ab543", "parentControlId": 31635, "controlId": "MA-4(7)", "title": "MA-4(7)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587082" }, { "id": 585354, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eea4c71d-a8ea-50f1-8741-64ec9deb6365", "parentControlId": 31635, "controlId": "MA-04(07)", "title": "MA-04(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587083" }, { "id": 585355, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57420712-61ac-53b9-a470-a147111147ec", "parentControlId": 31635, "controlId": "MA-04(07)", "title": "MA-04(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587083" }, { "id": 585356, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f6d8704-bab8-52e9-b284-71fe06df7322", "parentControlId": 31635, "controlId": "3.7.5", "title": "3.7.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587083" }, { "id": 585357, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8332efe6-4b00-5e4a-8d23-1bcf6851ea4f", "parentControlId": 31635, "controlId": "03.07.05.c", "title": "03.07.05.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587083" } ], "id": 31635, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731185", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731185", "catalogueId": 1062, "uuid": "ff7686d8-ba9a-53b5-9f9f-79976d18af18", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide remote disconnect verification to ensure remote, non-local maintenance and diagnostic sessions are properly terminated?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Remote Maintenance Disconnect Verification", "description": "

Control Description

Mechanisms exist to provide remote disconnect verification to ensure remote, non-local maintenance and diagnostic sessions are properly terminated.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.\n▪ IT and/or cybersecurity personnel provide remote disconnect verification to ensure non-local maintenance and diagnostic sessions are properly terminated.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide remote disconnect verification to ensure remote, non-local maintenance and diagnostic sessions are properly terminated.

Level 4 - Quantitatively Controlled: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-05.4", "family": "Maintenance", "enhancements": "", "sortId": "MNT-05.4", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72552, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590784", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590784", "securityControlId": 31636, "ccis": [], "uuid": "b9191617-1eff-520e-b8f0-3fccc37ba2cb", "testId": "MNT-05.5_A01", "test": "personnel or roles required to approve each nonlocal maintenance session is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-04(05)_ODP[01]", "defaultText": null }, { "id": 72553, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590784", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590784", "securityControlId": 31636, "ccis": [], "uuid": "4c59e486-f265-58a3-bd98-c7e82792b1fb", "testId": "MNT-05.5_A02", "test": "the approval of each nonlocal maintenance session is required by personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-04(05)(a)", "defaultText": null } ], "externalMappings": [ { "id": 585372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23d68399-9597-53d6-94a3-07767ccc9d07", "parentControlId": 31636, "controlId": "MA-4(5)", "title": "MA-4(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587085" }, { "id": 585373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e77a22a5-cdeb-5a8f-9126-171f6f437cea", "parentControlId": 31636, "controlId": "MA-04(05)", "title": "MA-04(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587085" }, { "id": 585374, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53db33e4-9100-56a5-9400-b9ec123d420b", "parentControlId": 31636, "controlId": "MA-04(05)", "title": "MA-04(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587085" }, { "id": 585375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e0b5c43-21a3-552d-9021-471fd807148b", "parentControlId": 31636, "controlId": "03.07.05.a", "title": "03.07.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587085" }, { "id": 585376, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17ed3959-b247-5af5-bd88-a247111163a8", "parentControlId": 31636, "controlId": "CIP-005-7 3.1", "title": "CIP-005-7 3.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587085" } ], "id": 31636, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731186", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731186", "catalogueId": 1062, "uuid": "2ca636ba-7303-5f00-87db-02459c2eb21e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require maintenance personnel to obtain pre-approval and scheduling for remote, non-local maintenance sessions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Remote Maintenance Pre-Approval", "description": "

Control Description

Mechanisms exist to require maintenance personnel to obtain pre-approval and scheduling for remote, non-local maintenance sessions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require maintenance personnel to obtain pre-approval and scheduling for remote, non-local maintenance sessions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-05.5", "family": "Maintenance", "enhancements": "", "sortId": "MNT-05.5", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72554, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590784", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590784", "securityControlId": 31637, "ccis": [], "uuid": "0fd001bf-fc2b-5709-b070-5a6ca6daf14a", "testId": "MNT-05.6_A01", "test": "nonlocal maintenance / diagnostic services are required to be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MA-04(03)(a)[01]\n53A_R5_MA-04(03)(a)[02]", "defaultText": null }, { "id": 72555, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590784", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590784", "securityControlId": 31637, "ccis": [], "uuid": "ce60b6eb-f8d3-5a55-b3e7-92d8a20b53c9", "testId": "MNT-05.6_A02", "test": "alternate controls to be developed and implemented in the event that a system component cannot be sanitized, removed or disconnected from the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-05(01)_ODP", "defaultText": null }, { "id": 72556, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590784", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590784", "securityControlId": 31637, "ccis": [], "uuid": "35a6d399-0b62-5553-9c2d-d815c333a056", "testId": "MNT-05.6_A03", "test": "the component to be serviced is removed from the system prior to nonlocal maintenance or diagnostic services.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-04(03)(b)[01]", "defaultText": null }, { "id": 72557, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590785", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590785", "securityControlId": 31637, "ccis": [], "uuid": "b5dc6fc3-0449-5f53-8fec-ab47805d5543", "testId": "MNT-05.6_A04", "test": "the component to be serviced is sanitized (for organizational information).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-04(03)(b)[02]", "defaultText": null }, { "id": 72558, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590785", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590785", "securityControlId": 31637, "ccis": [], "uuid": "828f0d3b-0749-59ab-a575-f6ff48883436", "testId": "MNT-05.6_A05", "test": "the component is inspected and sanitized (for potentially malicious software) after the service is performed and before reconnecting the component to the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-04(03)(b)[03]", "defaultText": null } ], "externalMappings": [ { "id": 585383, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5f1f4ae-9857-50aa-a45e-fe2ae8121945", "parentControlId": 31637, "controlId": "MA-4(3)", "title": "MA-4(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587086" }, { "id": 585384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd75e208-d830-5a50-906d-20da9413b217", "parentControlId": 31637, "controlId": "MA-04(03)", "title": "MA-04(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587086" }, { "id": 585385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91e2b48c-f00d-5dd6-8a89-72554ff64ceb", "parentControlId": 31637, "controlId": "MA-04(03)", "title": "MA-04(03)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587086" }, { "id": 585386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da89f5fe-a99e-5afb-bf75-6e93bcaa5344", "parentControlId": 31637, "controlId": "MA-04(03)", "title": "MA-04(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587086" }, { "id": 585387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d30a1b6d-cd11-5fc3-98bf-712db00a4082", "parentControlId": 31637, "controlId": "MA-04(03)", "title": "MA-04(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587087" }, { "id": 585388, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60a2bc2c-274d-5dea-95dd-8bb05dd01a63", "parentControlId": 31637, "controlId": "MA-4(3)", "title": "MA-4(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587087" } ], "id": 31637, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731186", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731186", "catalogueId": 1062, "uuid": "73a4e1fe-12de-56aa-a7d5-c6d9a0088831", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require Technology Assets, Applications and/or Services (TAAS) performing remote, non-local maintenance and/or diagnostic services implement a security capability comparable to the capability implemented on the system being serviced?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Remote Maintenance Comparable Security & Sanitization", "description": "

Control Description

Mechanisms exist to require Technology Assets, Applications and/or Services (TAAS) performing remote, non-local maintenance and/or diagnostic services implement a security capability comparable to the capability implemented on the system being serviced.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require Technology Assets, Applications and/or Services (TAAS) performing remote, non-local maintenance and/or diagnostic services implement a security capability comparable to the capability implemented on the system being serviced.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-05.6", "family": "Maintenance", "enhancements": "", "sortId": "MNT-05.6", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72559, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590785", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590785", "securityControlId": 31638, "ccis": [], "uuid": "f14ba3de-48b3-51d7-b0f6-b03debafc6de", "testId": "MNT-05.7_A01", "test": "authenticators that are replay resistant are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-04(04)_ODP", "defaultText": null }, { "id": 72560, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590785", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590785", "securityControlId": 31638, "ccis": [], "uuid": "661ba324-e15b-5e87-800f-57fb4ffc6940", "testId": "MNT-05.7_A02", "test": "nonlocal maintenance sessions are protected by employing organization-defined authenticators that are replay resistant.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_MA-04(04)(a)", "defaultText": null }, { "id": 72561, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590785", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590785", "securityControlId": 31638, "ccis": [], "uuid": "baeb6636-3def-5a25-af46-67d4e82b88db", "testId": "MNT-05.7_A03", "test": "nonlocal maintenance sessions are protected by separating maintenance sessions from other network sessions with the system by physically separated communication paths.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_MA-04(04)(b)(01)", "defaultText": null }, { "id": 72562, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590785", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590785", "securityControlId": 31638, "ccis": [], "uuid": "2ffa3951-1905-54ef-9e93-31bec1c0b8b1", "testId": "MNT-05.7_A04", "test": "nonlocal maintenance sessions are protected by logically separated communication paths.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_MA-04(04)(b)(02)", "defaultText": null } ], "externalMappings": [ { "id": 585395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2692060b-1674-56c5-b1d7-fb236cf4afe6", "parentControlId": 31638, "controlId": "MA-4(4)", "title": "MA-4(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587088" }, { "id": 585396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c20cbb0-47b7-580b-8c12-3f2d349418fa", "parentControlId": 31638, "controlId": "MA-04(04)", "title": "MA-04(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587088" }, { "id": 585397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d0d362c-bd8f-59e6-a8c9-2c52f05ff651", "parentControlId": 31638, "controlId": "MA-04(04)", "title": "MA-04(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587088" } ], "id": 31638, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731186", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731186", "catalogueId": 1062, "uuid": "e9365cc2-3c8c-5e76-9a92-4c17cd6f833c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect maintenance sessions through replay-resistant sessions that are physically or logically separated communications paths from other network sessions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Separation of Maintenance Sessions", "description": "

Control Description

Mechanisms exist to protect maintenance sessions through replay-resistant sessions that are physically or logically separated communications paths from other network sessions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Maintenance (MNT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MNT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Maintenance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Maintenance controls are primarily administrative in nature (e.g., policies & standards) to manage change control processes associated with maintenance operations.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to protect maintenance sessions through replay-resistant sessions that are physically or logically separated communications paths from other network sessions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-05.7", "family": "Maintenance", "enhancements": "", "sortId": "MNT-05.7", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72563, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590786", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590786", "securityControlId": 31639, "ccis": [], "uuid": "b78dbb42-7be6-582e-94d8-a8ee81cd74fd", "testId": "MNT-06_A01", "test": "a process for maintenance personnel authorization is established.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_MA-05a.[01]\n171A_R3_A.03.07.06.a", "defaultText": null }, { "id": 72564, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590786", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590786", "securityControlId": 31639, "ccis": [], "uuid": "975c44d7-b2f5-5d2e-8349-f6eb4a993120", "testId": "MNT-06_A02", "test": "a list of authorized maintenance organizations or personnel is maintained.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_MA-05a.[02]\n171A_R3_A.03.07.06.b", "defaultText": null }, { "id": 72565, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590786", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590786", "securityControlId": 31639, "ccis": [], "uuid": "06008fb7-129e-56f9-b849-a55b7a432029", "testId": "MNT-06_A03", "test": "non-escorted personnel who perform maintenance on the system possess the required access authorizations.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_MA-05b.\n171A_R3_A.03.07.06.c", "defaultText": null } ], "externalMappings": [ { "id": 585409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acbd14cc-8e0c-5a0a-99c2-5c87d96ad2f6", "parentControlId": 31639, "controlId": "MA-5", "title": "MA-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587089" }, { "id": 585410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b3a3f12-a8aa-5827-917e-91f8b3d823c1", "parentControlId": 31639, "controlId": "MA-05", "title": "MA-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587089" }, { "id": 585411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4114391-71c7-502b-b012-f45187a9aa61", "parentControlId": 31639, "controlId": "MA-05", "title": "MA-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587089" }, { "id": 585412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58709", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99517c8a-fde1-59ee-9e03-606378df4c15", "parentControlId": 31639, "controlId": "MA-05", "title": "MA-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58709" }, { "id": 585413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58709", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "849d7058-dabf-5d3f-aeb1-902942e1361b", "parentControlId": 31639, "controlId": "MA-05", "title": "MA-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58709" }, { "id": 585414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58709", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e712a599-df91-54ca-baea-d5b97a04a56b", "parentControlId": 31639, "controlId": "MA-05", "title": "MA-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58709" }, { "id": 585415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58709", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26298f2e-819a-5668-916e-f08c81ea9e73", "parentControlId": 31639, "controlId": "MA-05", "title": "MA-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58709" }, { "id": 585416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58709", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0248eb0-eedb-5ddc-a3be-82bc4df55c1c", "parentControlId": 31639, "controlId": "MA-5", "title": "MA-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58709" }, { "id": 585417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58709", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2ec194d-8845-566b-8ff2-1147bc23031d", "parentControlId": 31639, "controlId": "MA-5", "title": "MA-5", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58709" }, { "id": 585420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eab86f74-e1ed-515d-bd77-f6aced7cb7c4", "parentControlId": 31639, "controlId": "3.7.6", "title": "3.7.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587091" }, { "id": 585421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33c21db4-60f1-5467-8f7d-f884ee5b12c3", "parentControlId": 31639, "controlId": "03.07.06.a", "title": "03.07.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587091" }, { "id": 585422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "850ed0df-4a12-5769-b763-b29b5ef898a8", "parentControlId": 31639, "controlId": "03.07.06.b", "title": "03.07.06.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587091" }, { "id": 585423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8cc35906-7bfc-59fb-9680-326a53518fae", "parentControlId": 31639, "controlId": "03.07.06.c", "title": "03.07.06.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587091" }, { "id": 585424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a07ce076-14e0-512a-bcbc-58a745d60a0d", "parentControlId": 31639, "controlId": "03.07.06.d", "title": "03.07.06.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587091" }, { "controlId": "C.4.3", "title": "C.4.3 — Personnel Performing Maintenance and Testing Activities", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: MA-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "f9bf5f83-4254-5089-a648-4f0bd52aefd2", "isPublic": true }, { "controlId": "NEI 08-09 App E.4.3", "title": "NEI 08-09 App E.4.3 — Personnel Performing Maintenance and Testing Activities", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.4.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "8a1a3660-ecb4-52e3-9fbb-d4345ced1d69", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.4.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "b6b09a5f-ea27-5921-b616-c36d73e60cfe", "isPublic": true }, { "controlId": "NSS-17T-Sec6.7", "title": "NSS-17T-Sec6.7 — Maintenance Tools, Outage Controls & Portable Media Sanitation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "e309db64-8e41-50a6-adce-d23db652611f", "isPublic": true }, { "controlId": "IEC-62645-8.1", "title": "IEC-62645-8.1 — Secure Maintenance & Diagnostic Test Equipment Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "72bdd2a5-c16e-5406-95f0-617cc49d4870", "isPublic": true } ], "id": 31639, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731187", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731187", "catalogueId": 1062, "uuid": "b3aef905-4998-52a9-a9f3-819307b9eb8b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain a current list of authorized maintenance organizations or personnel?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Authorized Maintenance Personnel", "description": "

Control Description

Mechanisms exist to maintain a current list of authorized maintenance organizations or personnel.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.\n▪ IT personnel, in conjunction with asset custodians, maintain a current list of authorized maintenance organizations or personnel.\n▪ Asset / process owners require maintenance personnel to obtain pre-approval and scheduling for non-local maintenance sessions.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain a current list of authorized maintenance organizations or personnel.

Level 4 - Quantitatively Controlled: Maintenance (MNT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.4.3", "controlId": "MNT-06", "family": "Maintenance", "enhancements": "", "sortId": "MNT-06", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)\n∙ Separation of Duties (SoD)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72566, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590786", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590786", "securityControlId": 31640, "ccis": [], "uuid": "e12f68ce-e64c-572c-80a9-b40cf31f97fc", "testId": "MNT-06.1_A01", "test": "maintenance personnel without required access authorization are supervised during maintenance activities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.7.6", "defaultText": null }, { "id": 72567, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590786", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590786", "securityControlId": 31640, "ccis": [], "uuid": "1b278206-2f69-54e7-ad0c-8d05a3c58ca9", "testId": "MNT-06.1_A02", "test": "organizational personnel with required access authorizations are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.07.06.d[01]\n53A_R5_MA-05c.", "defaultText": null }, { "id": 72568, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590786", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590786", "securityControlId": 31640, "ccis": [], "uuid": "4fd52f69-1416-5ff8-acf8-31e5d860f5f9", "testId": "MNT-06.1_A03", "test": "procedures for the use of maintenance personnel who lack appropriate security clearances or are not U.S. citizens are implemented and include approved organizational personnel who are fully cleared, have appropriate access authorizations and are technically qualified escorting and supervising maintenance personnel without the needed access authorization during the performance of maintenance and diagnostic activities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-05(01)(a)(01)", "defaultText": null }, { "id": 72569, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590787", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590787", "securityControlId": 31640, "ccis": [], "uuid": "3cb7da03-457a-5584-99a9-13d05aacdabf", "testId": "MNT-06.1_A04", "test": "procedures for the use of maintenance personnel who lack appropriate security clearances or are not U.S. citizens are implemented and include all volatile information storage components within the system being sanitized and all non-volatile storage media being removed or physically disconnected from the system and secured prior to initiating maintenance or diagnostic activities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-05(01)(a)(02)", "defaultText": null }, { "id": 72570, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590787", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590787", "securityControlId": 31640, "ccis": [], "uuid": "a4980092-4ac4-5371-9d67-5c03913d5d79", "testId": "MNT-06.1_A05", "test": "alternate controls are developed and implemented in the event that a system cannot be sanitized, removed or disconnected from the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-05(01)(b)", "defaultText": null }, { "id": 72571, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590787", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590787", "securityControlId": 31640, "ccis": [], "uuid": "63d80a75-b5a2-5a38-b6b6-1e275793327f", "testId": "MNT-06.1_A06", "test": "personnel performing maintenance and diagnostic activities on a system processing, storing or transmitting sensitive / regulated data possess security clearances for at least the highest classification level and for compartments of information on the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-05(02)[01]", "defaultText": null }, { "id": 72572, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590787", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590787", "securityControlId": 31640, "ccis": [], "uuid": "4d32cff9-86e5-5254-85fc-468945502230", "testId": "MNT-06.1_A07", "test": "personnel performing maintenance and diagnostic activities on a system processing, storing or transmitting sensitive / regulated data possess formal access approvals for at least the highest classification level and for compartments of information on the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-05(02)[02]", "defaultText": null }, { "id": 72573, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590787", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590787", "securityControlId": 31640, "ccis": [], "uuid": "84203158-388c-5325-b722-123c79bdf859", "testId": "MNT-06.1_A08", "test": "personnel performing maintenance and diagnostic activities on a system processing, storing or transmitting sensitive / regulated data are U.S. citizens.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-05(03)", "defaultText": null }, { "id": 72574, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590787", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590787", "securityControlId": 31640, "ccis": [], "uuid": "d5b645f7-cd35-5c7c-948c-d78add9b0ed1", "testId": "MNT-06.1_A09", "test": "foreign nationals are used to conduct maintenance and diagnostic activities on systems only when approved and authorized.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-05(04)(a)", "defaultText": null }, { "id": 72575, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590787", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590787", "securityControlId": 31640, "ccis": [], "uuid": "8ff6f91a-0e08-5d9a-a3bb-faf264a5cbaa", "testId": "MNT-06.1_A10", "test": "approvals regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-05(04)(b)[01]", "defaultText": null }, { "id": 72576, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590788", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590788", "securityControlId": 31640, "ccis": [], "uuid": "fd3e59be-1b2c-5500-8364-b1815a2ad6bc", "testId": "MNT-06.1_A11", "test": "consents regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-05(04)(b)[02]", "defaultText": null }, { "id": 72577, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590788", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590788", "securityControlId": 31640, "ccis": [], "uuid": "8e177274-f7a2-5ac9-bdbd-9259a176e733", "testId": "MNT-06.1_A12", "test": "detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MA-05(04)(b)[03]", "defaultText": null }, { "id": 72578, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590788", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590788", "securityControlId": 31640, "ccis": [], "uuid": "a70842e7-8f1f-5ff1-a8d8-b932a0ab20d7", "testId": "MNT-06.1_A13", "test": "non-escorted personnel who perform maintenance on the system possess the required access authorizations.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.07.06.c", "defaultText": null }, { "id": 72579, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590788", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590788", "securityControlId": 31640, "ccis": [], "uuid": "ed19e398-8baf-574c-9fbd-ed79cd869747", "testId": "MNT-06.1_A14", "test": "organizational personnel with required technical competence are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.07.06.d[02]", "defaultText": null } ], "externalMappings": [ { "id": 585457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2071069b-ee02-5179-9da2-2515f7e5cfcb", "parentControlId": 31640, "controlId": "MA-5(1)", "title": "MA-5(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587096" }, { "id": 585458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8beae73-3a77-51db-b6e5-35c4db51c840", "parentControlId": 31640, "controlId": "MA-5(2)", "title": "MA-5(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587096" }, { "id": 585459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf9d0e30-b810-5a85-9c9a-5894cdffd634", "parentControlId": 31640, "controlId": "MA-5(3)", "title": "MA-5(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587096" }, { "id": 585460, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5934eba0-59fb-568f-9f0b-8460772449c2", "parentControlId": 31640, "controlId": "MA-5(4)", "title": "MA-5(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587097" }, { "id": 585461, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b22dbd6-4fdb-5c0a-adaf-6528fe5bbdb1", "parentControlId": 31640, "controlId": "MA-05(01)", "title": "MA-05(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587097" }, { "id": 585462, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97e4269e-4808-5e62-bcad-60c7ed4b1af5", "parentControlId": 31640, "controlId": "MA-05(02)", "title": "MA-05(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587097" }, { "id": 585463, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c18bdd8-d160-5d08-a7d9-a208dd15608f", "parentControlId": 31640, "controlId": "MA-05(03)", "title": "MA-05(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587097" }, { "id": 585464, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d0fd89c-ad11-5aa8-8b1c-6d6384a53d55", "parentControlId": 31640, "controlId": "MA-05(04)", "title": "MA-05(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587097" }, { "id": 585465, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587097", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cdaa7e7e-04fe-5922-956c-acdb014d0e41", "parentControlId": 31640, "controlId": "MA-05(01)", "title": "MA-05(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587097" }, { "id": 585466, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "418985c5-c8c3-5e62-8a68-fcfd9fb5e4fc", "parentControlId": 31640, "controlId": "MA-05(01)", "title": "MA-05(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587098" }, { "id": 585467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "657f7d70-abcc-5f04-a202-65c9976f7ccb", "parentControlId": 31640, "controlId": "MA-05(02)", "title": "MA-05(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587098" }, { "id": 585468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c74a5ba6-9551-5953-8379-a97b9028f6a4", "parentControlId": 31640, "controlId": "MA-05(03)", "title": "MA-05(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587098" }, { "id": 585469, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44e6e1ba-ca5e-59f5-a7b7-65314b5cdd81", "parentControlId": 31640, "controlId": "MA-05(04)", "title": "MA-05(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587098" }, { "id": 585470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d18f15aa-6ec7-5895-b29f-db972c414f1b", "parentControlId": 31640, "controlId": "MA-05(01)", "title": "MA-05(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587099" }, { "id": 585471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41f07125-cdcf-5ace-8413-5f928f4a89ce", "parentControlId": 31640, "controlId": "MA-5(4)", "title": "MA-5(4)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587099" }, { "id": 585472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c938919-7507-5ffc-8334-e01553190c4e", "parentControlId": 31640, "controlId": "MA-5(4)", "title": "MA-5(4)", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587099" }, { "id": 585475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2d1a4a7-35d2-5b67-9a2d-53fb5d18d42e", "parentControlId": 31640, "controlId": "3.7.6", "title": "3.7.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587099" }, { "id": 585476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fa50f17-74f3-5c01-9ca3-2e72328dd6e3", "parentControlId": 31640, "controlId": "03.07.06.a", "title": "03.07.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587099" }, { "id": 585477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0ea1e8c-7cbe-5eb9-ba7d-2ca5127adc9e", "parentControlId": 31640, "controlId": "03.07.06.c", "title": "03.07.06.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587099" }, { "id": 585478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5871", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cecb0a6c-8476-5822-842e-3504d0ecd86b", "parentControlId": 31640, "controlId": "03.07.06.d", "title": "03.07.06.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5871" } ], "id": 31640, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731187", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731187", "catalogueId": 1062, "uuid": "0d8ad386-8cd1-56a1-90d2-c6af5d86e6e2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure the risks associated with maintenance personnel who do not have appropriate access authorizations, clearances or formal access approvals are appropriately mitigated?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Maintenance Personnel Without Appropriate Access", "description": "

Control Description

Mechanisms exist to ensure the risks associated with maintenance personnel who do not have appropriate access authorizations, clearances or formal access approvals are appropriately mitigated.

Evidence Request List (ERL)

E-MNT-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Maintenance (MNT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MNT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Maintenance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Maintenance controls are primarily administrative in nature (e.g., policies & standards) to manage change control processes associated with maintenance operations.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.\n▪ Asset / process owners require maintenance personnel to obtain pre-approval and scheduling for non-local maintenance sessions.\n▪ IT personnel, in conjunction with asset custodians, mitigate the risks associated with maintenance personnel who do not have appropriate access authorizations, clearances or formal access approvals are appropriately mitigated.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure the risks associated with maintenance personnel who do not have appropriate access authorizations, clearances or formal access approvals are appropriately mitigated.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-06.1", "family": "Maintenance", "enhancements": "", "sortId": "MNT-06.1", "references": "

Micro-Small Business (<10 staff)

∙ Role Based Access Control (RBAC)

Small Business (10-49 staff)

∙ Role Based Access Control (RBAC)

Medium Business (50-249 staff)

∙ Role Based Access Control (RBAC)

Large Business (250-999 staff)

∙ Role Based Access Control (RBAC)

Enterprise (>1,000 staff)

∙ Role Based Access Control (RBAC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72580, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590788", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590788", "securityControlId": 31641, "ccis": [], "uuid": "7f52f5cd-df3f-530d-9fd3-05d5ba70066b", "testId": "MNT-06.2_A01", "test": "non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system have required access authorizations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-05(05)", "defaultText": null }, { "id": 72581, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590788", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590788", "securityControlId": 31641, "ccis": [], "uuid": "46fa24ea-feb6-5efb-9ca2-9e279b25d25b", "testId": "MNT-06.2_A02", "test": "non-escorted personnel who perform maintenance on the system possess the required access authorizations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.07.06.c", "defaultText": null } ], "externalMappings": [ { "id": 585497, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d65dd6b-2367-5953-9554-6e8283db0e63", "parentControlId": 31641, "controlId": "MA-5(5)", "title": "MA-5(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587103" }, { "id": 585498, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d797f563-bf44-525b-8951-fe979a24e26a", "parentControlId": 31641, "controlId": "MA-05(05)", "title": "MA-05(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587103" }, { "id": 585499, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b195c56a-0391-515a-b56d-bc47b59b21f5", "parentControlId": 31641, "controlId": "MA-05(05)", "title": "MA-05(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587103" }, { "id": 585500, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2537320-7d27-5a0c-8904-4a51342e3d00", "parentControlId": 31641, "controlId": "3.7.6", "title": "3.7.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587103" }, { "id": 585501, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85a498f8-983b-5931-824d-8287034f3217", "parentControlId": 31641, "controlId": "03.07.06.a", "title": "03.07.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587103" }, { "id": 585502, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c97a32a4-955d-5fd0-915d-cca4a19815b2", "parentControlId": 31641, "controlId": "03.07.06.c", "title": "03.07.06.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587103" } ], "id": 31641, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731187", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731187", "catalogueId": 1062, "uuid": "26f677c5-aabe-5830-9ce8-e3933593e4a9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure that non-escorted personnel performing non-IT maintenance activities in the physical proximity of systems have required access authorizations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Non-System Related Maintenance", "description": "

Control Description

Mechanisms exist to ensure that non-escorted personnel performing non-IT maintenance activities in the physical proximity of systems have required access authorizations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.\n▪ Asset / process owners require maintenance personnel to obtain pre-approval and scheduling for non-local maintenance sessions.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure that non-escorted personnel performing non-IT maintenance activities in the physical proximity of systems have required access authorizations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-06.2", "family": "Maintenance", "enhancements": "", "sortId": "MNT-06.2", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72582, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590789", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590789", "securityControlId": 31642, "ccis": [], "uuid": "62a75719-6c68-509b-b291-0826c1f3596d", "testId": "MNT-07_A01", "test": "system components requiring configuration control are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-11(02)_ODP", "defaultText": null }, { "id": 72583, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590789", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590789", "securityControlId": 31642, "ccis": [], "uuid": "1837b60a-a63a-5a8b-8aea-c37c51602ead", "testId": "MNT-07_A02", "test": "configuration control over organization-defined system components awaiting service or repair is maintained.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-11(02)[01]", "defaultText": null }, { "id": 72584, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590789", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590789", "securityControlId": 31642, "ccis": [], "uuid": "6b80de8c-3f56-5201-9a5b-ea2b7a6b0660", "testId": "MNT-07_A03", "test": "configuration control over serviced or repaired organization-defined system components awaiting return to service is maintained.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-11(02)[02]", "defaultText": null } ], "externalMappings": [ { "id": 585508, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587104", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5277d5c-648d-5c9f-b36c-bc523847f1a0", "parentControlId": 31642, "controlId": "SR-11(02)", "title": "SR-11(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587104" }, { "id": 585509, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587104", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbc34495-52de-5679-81da-fa51b25ad6d7", "parentControlId": 31642, "controlId": "SR-11(02)", "title": "SR-11(02)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587104" }, { "id": 585510, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587105", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d1daca8-83a7-57f8-b0f4-30dccec29919", "parentControlId": 31642, "controlId": "SR-11(02)", "title": "SR-11(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587105" }, { "id": 585511, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587105", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "491b22dd-551b-5d98-857f-2bfc011e7f1d", "parentControlId": 31642, "controlId": "SR-11(02)", "title": "SR-11(02)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587105" }, { "id": 585512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587105", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acb00469-a03c-5157-bc89-0ac3e44c77f2", "parentControlId": 31642, "controlId": "SR-11(02)", "title": "SR-11(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587105" }, { "id": 585513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587105", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0576f757-688e-56b5-b860-6f7d2a60f662", "parentControlId": 31642, "controlId": "SR-11(02)", "title": "SR-11(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587105" }, { "id": 585514, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587105", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6a41ba1-db42-5fed-93e9-9184f47686e7", "parentControlId": 31642, "controlId": "SR-11(2)", "title": "SR-11(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587105" }, { "id": 585515, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587105", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f07af6e1-3652-54e4-a8ef-59587d82a89d", "parentControlId": 31642, "controlId": "SR-11(2)", "title": "SR-11(2)", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587105" }, { "controlId": "NSS-17T-Sec6.7", "title": "NSS-17T-Sec6.7 — Maintenance Tools, Outage Controls & Portable Media Sanitation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "c8686cbf-e4c7-5f9f-8e24-275ae652feb1", "isPublic": true }, { "controlId": "IEC-62645-8.1", "title": "IEC-62645-8.1 — Secure Maintenance & Diagnostic Test Equipment Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "1c551143-0cee-5c73-b2a3-61706bc00c26", "isPublic": true } ], "id": 31642, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731188", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731188", "catalogueId": 1062, "uuid": "c0227a81-6e8a-5b24-b0e2-fa9e5f4fcd00", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain proper physical security and configuration control over technology assets awaiting service or repair?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Maintain Configuration Control During Maintenance", "description": "

Control Description

Mechanisms exist to maintain proper physical security and configuration control over technology assets awaiting service or repair.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain proper physical security and configuration control over technology assets awaiting service or repair.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-07", "family": "Maintenance", "enhancements": "", "sortId": "MNT-07", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72585, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590789", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590789", "securityControlId": 31643, "ccis": [], "uuid": "005d8770-e3d0-57fc-bada-f2169d3377c9", "testId": "MNT-08_A01", "test": "systems or system components on which field maintenance is restricted or prohibited to trusted maintenance facilities are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-07_ODP[01]", "defaultText": null }, { "id": 72586, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590789", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590789", "securityControlId": 31643, "ccis": [], "uuid": "ed6ed536-771d-58be-bb71-0b84880019cd", "testId": "MNT-08_A02", "test": "trusted maintenance facilities that are not restricted or prohibited from conducting field maintenance are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-07_ODP[02]", "defaultText": null }, { "id": 72587, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59079", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59079", "securityControlId": 31643, "ccis": [], "uuid": "3c500fa4-c7ce-5246-89be-d6b3e9757eb1", "testId": "MNT-08_A03", "test": "field maintenance on systems or system components are restricted or prohibited to trusted maintenance facilities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_MA-07", "defaultText": null } ], "externalMappings": [ { "id": 585523, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "610a032e-a27c-5950-874a-b5d89458f662", "parentControlId": 31643, "controlId": "MA-07", "title": "MA-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587107" }, { "id": 585524, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f2d3336-e9a8-5237-b4f2-220ea10f80dd", "parentControlId": 31643, "controlId": "MA-07", "title": "MA-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587107" }, { "id": 585525, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff990c11-f393-5a5c-9710-51b317043fba", "parentControlId": 31643, "controlId": "MA-07", "title": "MA-07", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587107" }, { "id": 585526, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ea33733-e816-51cc-a163-a5328cda176f", "parentControlId": 31643, "controlId": "MA-07", "title": "MA-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587107" }, { "id": 585527, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c91c00a3-fa08-5802-bd39-496c246292cf", "parentControlId": 31643, "controlId": "MA-07", "title": "MA-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587107" }, { "id": 585528, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "459c411b-5f6a-5cc8-b98e-7e4c582c60ad", "parentControlId": 31643, "controlId": "MA-7", "title": "MA-7", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587107" }, { "controlId": "NSS-17T-Sec6.7", "title": "NSS-17T-Sec6.7 — Maintenance Tools, Outage Controls & Portable Media Sanitation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b54d0679-06ab-5e5f-b06d-77c4b59dc868", "isPublic": true }, { "controlId": "IEC-62645-8.1", "title": "IEC-62645-8.1 — Secure Maintenance & Diagnostic Test Equipment Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "703fae88-fa2f-5548-8c45-8602d6e147c8", "isPublic": true } ], "id": 31643, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731188", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731188", "catalogueId": 1062, "uuid": "58f8dc52-0665-5912-b66a-7e5b506942d2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization securely conduct field maintenance on geographically deployed assets?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Field Maintenance", "description": "

Control Description

Mechanisms exist to securely conduct field maintenance on geographically deployed assets.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to securely conduct field maintenance on geographically deployed assets.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-08", "family": "Maintenance", "enhancements": "", "sortId": "MNT-08", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72588, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59079", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59079", "securityControlId": 31644, "ccis": [], "uuid": "2074ecfb-0fa2-55a8-92b6-ec221ee5818b", "testId": "MNT-09_A01", "test": "off-site maintenance activities are conducted securely and the asset(s) undergoing maintenance actions are secured during physical transfer and storage while off-site.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 585532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587108", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa9cb856-cf83-520a-bf73-12c7fd6ebb4e", "parentControlId": 31644, "controlId": "03.07.04.a", "title": "03.07.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587108" }, { "controlId": "NSS-17T-Sec6.7", "title": "NSS-17T-Sec6.7 — Maintenance Tools, Outage Controls & Portable Media Sanitation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "1ef02991-397f-57c4-8d15-866fc0fdf637", "isPublic": true }, { "controlId": "IEC-62645-8.1", "title": "IEC-62645-8.1 — Secure Maintenance & Diagnostic Test Equipment Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "3d6f1de6-d91b-5eba-a15e-c7cf5ea7df5e", "isPublic": true } ], "id": 31644, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731188", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731188", "catalogueId": 1062, "uuid": "218f671c-4de8-58ca-909e-dd9fce8109b6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure off-site maintenance activities are conducted securely and the asset(s) undergoing maintenance actions are secured during physical transfer and storage while off-site?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Off-Site Maintenance", "description": "

Control Description

Mechanisms exist to ensure off-site maintenance activities are conducted securely and the asset(s) undergoing maintenance actions are secured during physical transfer and storage while off-site.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure off-site maintenance activities are conducted securely and the asset(s) undergoing maintenance actions are secured during physical transfer and storage while off-site.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-09", "family": "Maintenance", "enhancements": "", "sortId": "MNT-09", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72590, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59079", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59079", "securityControlId": 31646, "ccis": [], "uuid": "433ae8bb-fb35-5623-adb7-49deaa87c661", "testId": "MNT-11_A01", "test": "situational awareness is maintained of the quality and reliability of systems and components through tracking maintenance activities and component failure rates.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 585545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "573fbd23-d7bb-571c-9915-deebe8291488", "parentControlId": 31646, "controlId": "MA-8", "title": "MA-8", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58711" }, { "controlId": "NSS-17T-Sec6.7", "title": "NSS-17T-Sec6.7 — Maintenance Tools, Outage Controls & Portable Media Sanitation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "16d5a5f8-8c85-5cf5-ab2c-cba6bb4226ef", "isPublic": true }, { "controlId": "IEC-62645-8.1", "title": "IEC-62645-8.1 — Secure Maintenance & Diagnostic Test Equipment Controls", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (MNT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "0fcd3263-8087-5c38-ae1d-f89c563b6cf3", "isPublic": true } ], "id": 31646, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731189", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731189", "catalogueId": 1062, "uuid": "1d1f38a1-5e0a-5353-b457-ae319cf7dab7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain situational awareness of the quality and reliability of systems and components through tracking maintenance activities and component failure rates?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Maintenance Monitoring", "description": "

Control Description

Mechanisms exist to maintain situational awareness of the quality and reliability of systems and components through tracking maintenance activities and component failure rates.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Maintenance (MNT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MNT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Maintenance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Maintenance controls are primarily administrative in nature (e.g., policies & standards) to manage change control processes associated with maintenance operations.

Level 2 - Planned & Tracked: Maintenance (MNT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Maintenance-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel, in conjunction with asset custodians, develop and maintain facilitate localized/regionalized procedures to conduct controlled and timely maintenance activities throughout the lifecycle of the Technology Asset, Application and/or Service (TAAS).\n▪ Maintenance operations may be centralized for certain locations (e.g., datacenters) and decentralized for other locations, both in terms of change management and execution.

Level 3 - Well Defined: Maintenance (MNT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MNT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MNT domain capabilities (e.g., maintenance pans) are documented and maintained by process owners.\n▪ A centralized Change Management Office (CMO), or similar function, is appropriately staffed and supported to implement and maintain MNT domain capabilities.\n▪ Technical procedures (e.g., ITIL change enablement) are utilized along with change management governance capabilities to ensure successful, efficient and secure maintenance operations.\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MNT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain situational awareness of the quality and reliability of systems and components through tracking maintenance activities and component failure rates.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MNT-11", "family": "Maintenance", "enhancements": "", "sortId": "MNT-11", "references": "

Micro-Small Business (<10 staff)

∙ Document maintenance activities in a log

Small Business (10-49 staff)

∙ Maintenance log\n∙ Authorized maintenance personnel list

Medium Business (50-249 staff)

∙ Formal maintenance management program\n∙ CMMS or ticketing system

Large Business (250-999 staff)

∙ CMMS (e.g., Maximo, ServiceNow)\n∙ Scheduled maintenance program\n∙ Vendor access controls

Enterprise (>1,000 staff)

∙ Enterprise CMMS platform\n∙ Automated maintenance scheduling\n∙ Vendor access controls\n∙ Remote access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72591, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590791", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590791", "securityControlId": 31647, "ccis": [], "uuid": "4bd41886-ac31-55b0-8a9a-68c5572280f0", "testId": "MDM-01_A01", "test": "policies and standards facilitate the implementation of mobile device management controls.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72592, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590791", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590791", "securityControlId": 31647, "ccis": [], "uuid": "f1ccadfc-6883-5b12-8c7d-66f1d8163aed", "testId": "MDM-01_A02", "test": "usage restrictions are established for mobile devices.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.01.18.a[01]", "defaultText": null }, { "id": 72593, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590791", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590791", "securityControlId": 31647, "ccis": [], "uuid": "6baf4ee7-3ea3-5162-93a6-846d53a6d344", "testId": "MDM-01_A03", "test": "Mobile Device Management (MDM) operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72594, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590791", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590791", "securityControlId": 31647, "ccis": [], "uuid": "769085b0-0070-5965-b69b-ff1cefff3b75", "testId": "MDM-01_A04", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support Mobile Device Management (MDM) operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72595, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590791", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590791", "securityControlId": 31647, "ccis": [], "uuid": "6e6324c5-b669-5824-8f59-5f6345e87e5b", "testId": "MDM-01_A05", "test": "responsibility and authority for the performance of Mobile Device Management (MDM)-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72596, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590791", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590791", "securityControlId": 31647, "ccis": [], "uuid": "e3ffffa6-7235-5797-b90a-27761ad5109f", "testId": "MDM-01_A06", "test": "personnel performing Mobile Device Management (MDM)-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 585554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6018567d-39bb-5bc1-a573-4990d9e66c1c", "parentControlId": 31647, "controlId": "SR 2.3", "title": "SR 2.3", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587111" }, { "id": 585555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06dafd28-a71e-5285-bba5-89d443722711", "parentControlId": 31647, "controlId": "SR 2.3(b)", "title": "SR 2.3(b)", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587111" }, { "id": 585556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70945656-3a4a-59a1-a585-8a29f00371ba", "parentControlId": 31647, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587111" }, { "id": 585559, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587112", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "657fcec3-e3fa-5629-a4ca-1d6219733994", "parentControlId": 31647, "controlId": "3.1.18", "title": "3.1.18", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587112" }, { "id": 585560, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587112", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b688dd45-cc29-5dad-b6f2-68842ea59033", "parentControlId": 31647, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587112" }, { "id": 585561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587112", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20f94e00-abc4-5531-85f3-2a20245e71b4", "parentControlId": 31647, "controlId": "03.01.20.d", "title": "03.01.20.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587112" }, { "id": 585608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587129", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05b5788d-2555-5205-aec5-c5a8d98803ab", "parentControlId": 31647, "controlId": "B3.d", "title": "B3.d", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587129" }, { "controlId": "B.1.19", "title": "B.1.19 — Access Control for Portable and Mobile Devices", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-19, MP-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "5041605b-1d05-57e6-b6eb-721241506067", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.19", "title": "NEI 08-09 App D.1.19 — Access Control for Portable and Mobile Devices", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.19", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "4ede5af4-c81b-5c66-9e7e-159dc4ed83e1", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.19", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "66dce91b-f2ce-51aa-8f20-52e86c133bed", "isPublic": true }, { "controlId": "CIP-010-4-R4", "title": "CIP-010-4-R4 — Transient Cyber Asset and Removable Media Security", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "90d3c9bd-e7cb-50e7-944e-09cfc6afd2ee", "isPublic": true } ], "id": 31647, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731189", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731189", "catalogueId": 1062, "uuid": "929947ba-809a-5d2d-973a-ae2825002c50", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement and govern Mobile Device Management (MDM) controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Centralized Management Of Mobile Devices", "description": "

Control Description

Mechanisms exist to implement and govern Mobile Device Management (MDM) controls.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Mobile Device Management (MDM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MDM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ MDM-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ MDM is mostly administrative in nature (e.g., policies & standards) that rely on administrative “acceptable use” restrictions to govern mobile device usage.

Level 2 - Planned & Tracked: Mobile Device Management (MDM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MDM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MDM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MDM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ MDM-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ MDM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Mobile Device Management (MDM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MDM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MDM domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain MDM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of mobile device security operations (e.g., Mobile Device Management (MDM) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MDM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement and govern Mobile Device Management (MDM) controls.

Level 4 - Quantitatively Controlled: Mobile Device Management (MDM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.19
NERC-CIP (2026) Requirements: CIP-010-4-R4", "controlId": "MDM-01", "family": "Mobile Device Management", "enhancements": "", "sortId": "MDM-01", "references": "

Micro-Small Business (<10 staff)

∙ Mobile Device Management (MDM) program that covers organization-owned and personally-owned devices

Small Business (10-49 staff)

∙ Mobile Device Management (MDM) program that covers organization-owned and personally-owned devices

Medium Business (50-249 staff)

∙ Mobile Device Management (MDM) program that covers organization-owned and personally-owned devices

Large Business (250-999 staff)

∙ Mobile Device Management (MDM) program that covers organization-owned and personally-owned devices

Enterprise (>1,000 staff)

∙ Mobile Device Management (MDM) program that covers organization-owned and personally-owned devices", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72597, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590792", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590792", "securityControlId": 31648, "ccis": [], "uuid": "93f6f7cc-be36-59b6-860b-671959007308", "testId": "MDM-02_A01", "test": "configuration requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-19a.[01]", "defaultText": null }, { "id": 72598, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590792", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590792", "securityControlId": 31648, "ccis": [], "uuid": "25a3e24f-e262-584f-9eb3-0efb2235c4e2", "testId": "MDM-02_A02", "test": "connection requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-19a.[02]", "defaultText": null }, { "id": 72599, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590792", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590792", "securityControlId": 31648, "ccis": [], "uuid": "ddc0bfa8-d61b-535a-87e2-bf4d5e735a76", "testId": "MDM-02_A03", "test": "implementation guidance is established for organization-controlled mobile devices, including when such devices are outside of the controlled area.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-19a.[03]", "defaultText": null }, { "id": 72600, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590792", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590792", "securityControlId": 31648, "ccis": [], "uuid": "cc805be3-de00-5c01-92af-3599613d477e", "testId": "MDM-02_A04", "test": "the connection of mobile devices to the system is authorized.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_AC-19b.\n171A_3.1.18[b]\n171A_R3_A.03.01.18.b", "defaultText": null }, { "id": 72601, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590792", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590792", "securityControlId": 31648, "ccis": [], "uuid": "2c66e0d5-5c22-5ceb-ae68-b81a5844836d", "testId": "MDM-02_A05", "test": "mobile devices that process, store or transmit sensitive / regulated data are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.1.18[a]", "defaultText": null }, { "id": 72602, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590792", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590792", "securityControlId": 31648, "ccis": [], "uuid": "f9349980-3638-5b7f-a9c3-5eb8d15fe6bb", "testId": "MDM-02_A06", "test": "mobile device connections are monitored and logged.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.1.18[c]", "defaultText": null } ], "externalMappings": [ { "id": 585654, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587136", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "764de482-6dbb-5430-94c7-625dd318ba89", "parentControlId": 31648, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587136" }, { "id": 585657, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587137", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "467cd279-6c40-5463-bbe4-5ec756627aee", "parentControlId": 31648, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587137" }, { "id": 585658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587137", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8dcbff25-657f-5db0-8863-ec3e55f71019", "parentControlId": 31648, "controlId": "T1040", "title": "T1040", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587137" }, { "id": 585659, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587137", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e596df65-e830-5e66-996e-68fc24901eb3", "parentControlId": 31648, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587137" }, { "id": 585660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587137", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2eec29de-2a09-505e-a09e-46a82da748b2", "parentControlId": 31648, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587137" }, { "id": 585661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587137", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f733abe-16e1-55e3-8b5e-faac16fc498e", "parentControlId": 31648, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587137" }, { "id": 585662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587137", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ca79b00-ed1d-536e-b926-dde28c1c0c7a", "parentControlId": 31648, "controlId": "T1114", "title": "T1114", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587137" }, { "id": 585663, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587137", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6085e92-1994-530f-81dd-3cb15351cba2", "parentControlId": 31648, "controlId": "T1114.001", "title": "T1114.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587137" }, { "id": 585664, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587137", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97bbb482-7521-5156-aefe-984ed2c521a9", "parentControlId": 31648, "controlId": "T1114.002", "title": "T1114.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587137" }, { "id": 585665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587138", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3dacbaad-0897-56ed-bb4e-5f04349449b3", "parentControlId": 31648, "controlId": "T1114.003", "title": "T1114.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587138" }, { "id": 585666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587138", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "963f5b9f-d4c2-56db-b333-0674558ab6cf", "parentControlId": 31648, "controlId": "T1119", "title": "T1119", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587138" }, { "id": 585667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587138", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75db34f2-7f99-5cff-bc26-22392711ba55", "parentControlId": 31648, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587138" }, { "id": 585668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587138", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f860ca4-4fca-563b-b6d3-bbaaf60c1e8a", "parentControlId": 31648, "controlId": "T1550.001", "title": "T1550.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587138" }, { "id": 585669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587138", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1670d28e-624d-52f0-a0ec-b01448cf3eb3", "parentControlId": 31648, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587138" }, { "id": 585670, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587139", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b72157ee-679a-50bf-aab4-ab28ca6f62af", "parentControlId": 31648, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587139" }, { "id": 585671, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587139", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f641183b-5d1f-5366-994d-13228f5e4108", "parentControlId": 31648, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587139" }, { "id": 585672, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587139", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd1cfe7b-2fc6-531c-8069-1390e836be6c", "parentControlId": 31648, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587139" }, { "id": 585673, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587139", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9916e9e7-6115-5a82-ad63-1dc1cb4a36e6", "parentControlId": 31648, "controlId": "T1557.004", "title": "T1557.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587139" }, { "id": 585674, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587139", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9dfd9a51-91a8-5bbe-b41f-0a7805f2e3dd", "parentControlId": 31648, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587139" }, { "id": 585675, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587139", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "674fe8eb-cadc-5b9e-bac6-df3771fab62f", "parentControlId": 31648, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587139" }, { "id": 585676, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587139", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18b2bc59-d7be-5c46-882a-4fe28056ba93", "parentControlId": 31648, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587139" }, { "id": 585677, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58714", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81229d53-7582-594e-98fc-38d33f00db85", "parentControlId": 31648, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58714" }, { "id": 585678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58714", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5e64d60-388e-5d64-8c18-7e42eb191f9f", "parentControlId": 31648, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58714" }, { "id": 585679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58714", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "feba1b13-35d2-537c-9c47-ab79ac893549", "parentControlId": 31648, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58714" }, { "id": 585680, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58714", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e01434d-1d80-510b-8e9a-f1274c9e7526", "parentControlId": 31648, "controlId": "T1565.002", "title": "T1565.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58714" }, { "id": 585681, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58714", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0716681c-8a7f-5ccf-9605-02a886b32460", "parentControlId": 31648, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58714" }, { "id": 585682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58714", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64fc28b5-df32-592b-962f-230c48445222", "parentControlId": 31648, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58714" }, { "id": 585683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58714", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "291b9961-062d-56b9-8093-b71fc6c69599", "parentControlId": 31648, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58714" }, { "id": 585684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587141", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afe5852c-cb5f-5d75-a208-3214d51d016c", "parentControlId": 31648, "controlId": "AC-19", "title": "AC-19", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587141" }, { "id": 585685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587141", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf4d80a2-0a57-5c62-b59b-63e3304f61f3", "parentControlId": 31648, "controlId": "AC-19", "title": "AC-19", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587141" }, { "id": 585686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587141", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30b20283-1bfc-5765-9cca-4a7de9f25421", "parentControlId": 31648, "controlId": "AC-19", "title": "AC-19", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587141" }, { "id": 585687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587141", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55986aff-ae87-578b-9105-469411f1dd68", "parentControlId": 31648, "controlId": "AC-19", "title": "AC-19", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587141" }, { "id": 585688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587141", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b97923f6-efab-5069-8097-db3edc932047", "parentControlId": 31648, "controlId": "AC-19", "title": "AC-19", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587141" }, { "id": 585689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587141", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a466480e-eba8-5681-8570-32aa4d1d0d1a", "parentControlId": 31648, "controlId": "AC-19", "title": "AC-19", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587141" }, { "id": 585690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587141", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df2f1182-f7e0-5ad7-893b-34483a4449c2", "parentControlId": 31648, "controlId": "AC-19", "title": "AC-19", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587142" }, { "id": 585691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587142", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62a913ee-97ee-5b75-b2d7-0d4df47f5233", "parentControlId": 31648, "controlId": "AC-19", "title": "AC-19", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587142" }, { "id": 585692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587142", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bae14f9a-b25b-5d8b-aac5-c47ef407e148", "parentControlId": 31648, "controlId": "AC-19", "title": "AC-19", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587142" }, { "id": 585695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587142", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ced7eb96-598f-590d-b18f-d2d09dacc7e6", "parentControlId": 31648, "controlId": "3.1.18", "title": "3.1.18", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587142" }, { "id": 585696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587143", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ac2e4e3-cef9-56a7-b2d9-f8313d4970b5", "parentControlId": 31648, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587143" }, { "id": 585697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587143", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "304ae999-6057-5694-b7f2-003b81ea2c01", "parentControlId": 31648, "controlId": "03.01.18.b", "title": "03.01.18.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587143" }, { "controlId": "B.1.19", "title": "B.1.19 — Access Control for Portable and Mobile Devices", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-19, MP-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "82d3e92c-738d-579c-a23c-3f353732ccda", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.19", "title": "NEI 08-09 App D.1.19 — Access Control for Portable and Mobile Devices", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.19", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "2b608aea-37ad-5d28-8a77-9dc6eb1472a6", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.19", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "a76fc56d-ffae-5ac5-a07f-d0c35317d99a", "isPublic": true }, { "controlId": "CIP-004-7-R6", "title": "CIP-004-7-R6 — Access Authorization for Transient Cyber Assets and Removable Media", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e4200f9d-a55b-5062-a6ab-6029f113389e", "isPublic": true }, { "controlId": "CIP-004-7-6.1", "title": "CIP-004-7-6.1 — Prior to provisioning, authorize (unless already authorized according to Part 4.1.) based on need, as determined by t...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "45339115-0845-5c34-93db-d082bda08272", "isPublic": true }, { "controlId": "CIP-004-7-6.1.1", "title": "CIP-004-7-6.1.1 — Provisioned electronic access to electronic BCSI", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ec0391f0-f2e5-5a95-9dc4-58c98058f00f", "isPublic": true }, { "controlId": "CIP-004-7-6.1.2", "title": "CIP-004-7-6.1.2 — Provisioned physical access to physical BCSI.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e1c62070-ed9f-52f1-8c0a-dbbc64760816", "isPublic": true }, { "controlId": "CIP-004-7-6.2", "title": "CIP-004-7-6.2 — Verify at least once every 15 calendar months that all individuals with provisioned access to BCSI: 6.2.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "dc7e6780-3768-500c-8540-2c7b6b80c265", "isPublic": true }, { "controlId": "CIP-004-7-6.2.1", "title": "CIP-004-7-6.2.1 — have an authorization record", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "10d9928c-38ca-56e5-b9f5-f43b7b4564ec", "isPublic": true }, { "controlId": "CIP-004-7-6.2.2", "title": "CIP-004-7-6.2.2 — still need the provisioned access to perform their current work functions, as determined by the Responsible Entity.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8e52a3f1-728a-5477-8e04-f3e3cda711b2", "isPublic": true }, { "controlId": "CIP-004-7-6.3", "title": "CIP-004-7-6.3 — For termination actions, remove the individual’s ability to use provisioned access to BCSI (unless already revoked ac...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "aac9746e-1235-569d-a3d2-8949821154f5", "isPublic": true } ], "id": 31648, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73119", "catalogueId": 1062, "uuid": "ee0a0099-2866-5adf-bbe4-5b864a6e998c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce access control requirements for the connection of mobile devices to organizational Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Access Control For Mobile Devices", "description": "

Control Description

Mechanisms exist to enforce access control requirements for the connection of mobile devices to organizational Technology Assets, Applications and/or Services (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Mobile Device Management (MDM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MDM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MDM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MDM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ MDM-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ MDM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel restrict the connection of personally-owned, mobile devices to organizational TAASD.\n▪ Mobile devices containing sensitive/regulated data use MDM software to prevent the unauthorized disclosure of information at rest (e.g., container encryption).

Level 3 - Well Defined: Mobile Device Management (MDM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MDM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MDM domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain MDM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of mobile device security operations (e.g., Mobile Device Management (MDM) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MDM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enforce access control requirements for the connection of mobile devices to organizational Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Mobile Device Management (MDM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.19
NERC-CIP (2026) Requirements: CIP-004-7-R6", "controlId": "MDM-02", "family": "Mobile Device Management", "enhancements": "", "sortId": "MDM-02", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72603, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590792", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590792", "securityControlId": 31649, "ccis": [], "uuid": "38cd4ee8-7d8e-59de-b80a-aeb04c9bb63a", "testId": "MDM-03_A01", "test": "mobile devices on which to employ encryption are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-19(05)_ODP[02]", "defaultText": null }, { "id": 72604, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590792", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590792", "securityControlId": 31649, "ccis": [], "uuid": "8e3190e3-1ee4-501e-9c90-a9e218b0d49f", "testId": "MDM-03_A02", "test": "full-device or container-based encryption is implemented to protect the confidentiality of sensitive / regulated data on mobile devices.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-19(05)_ODP[01]\n53A_R5_AC-19(05)", "defaultText": null }, { "id": 72605, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590793", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590793", "securityControlId": 31649, "ccis": [], "uuid": "20a42c84-9ab5-5925-b103-4d5ff8403cc8", "testId": "MDM-03_A03", "test": "mobile devices and mobile computing platforms that process, store or transmit sensitive / regulated data are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.1.19[a]", "defaultText": null }, { "id": 72606, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590793", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590793", "securityControlId": 31649, "ccis": [], "uuid": "996fee70-117b-53d7-8749-951d58b72b9d", "testId": "MDM-03_A04", "test": "encryption is employed to protect sensitive / regulated data on identified mobile devices and mobile computing platforms
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.1.19[b]", "defaultText": null }, { "id": 72607, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590793", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590793", "securityControlId": 31649, "ccis": [], "uuid": "6194d694-a2aa-5f56-8874-8ad1b27b0cfb", "testId": "MDM-03_A05", "test": "full-device or container-based encryption is implemented to protect the confidentiality of CUI on mobile devices.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.01.18.c", "defaultText": null } ], "externalMappings": [ { "id": 585741, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58715", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d1f99b4-ff8a-553f-af75-f3a29b6317a4", "parentControlId": 31649, "controlId": "AC-19(5)", "title": "AC-19(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58715" }, { "id": 585742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58715", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05305d3c-97ee-5673-b332-6426f6a152b2", "parentControlId": 31649, "controlId": "AC-19(05)", "title": "AC-19(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58715" }, { "id": 585743, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58715", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9384f2b8-c556-59de-9256-fd4c625944be", "parentControlId": 31649, "controlId": "AC-19(05)", "title": "AC-19(05)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58715" }, { "id": 585744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58715", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed2f44b6-ae06-5d92-be40-2a06b7ee5bba", "parentControlId": 31649, "controlId": "AC-19(05)", "title": "AC-19(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58715" }, { "id": 585745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587151", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e14fb236-b9e8-5862-abfc-0b50313e97c9", "parentControlId": 31649, "controlId": "AC-19(05)", "title": "AC-19(05)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587151" }, { "id": 585746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587151", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4dd27548-b014-514c-86d5-34b1382fd1b9", "parentControlId": 31649, "controlId": "AC-19(05)", "title": "AC-19(05)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587151" }, { "id": 585747, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587151", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "791a11c7-e82e-5e68-84b1-21ba0a6e0c97", "parentControlId": 31649, "controlId": "3.1.19", "title": "3.1.19", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587151" }, { "id": 585748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587151", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40fa5dd7-3695-5eb2-97ef-d8bfaac649d9", "parentControlId": 31649, "controlId": "03.01.18.c", "title": "03.01.18.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587151" } ], "id": 31649, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73119", "catalogueId": 1062, "uuid": "7e138b63-1192-5517-a91a-cb10cbe6d8c7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Are cryptographic mechanisms utilized to protect the confidentiality and integrity of information on mobile devices through full-device or container encryption?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Full Device & Container-Based Encryption", "description": "

Control Description

Cryptographic mechanisms exist to protect the confidentiality and integrity of information on mobile devices through full-device or container encryption.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Mobile Device Management (MDM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MDM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MDM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MDM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ MDM-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ MDM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Mobile devices containing sensitive/regulated data use MDM software to prevent the unauthorized disclosure of information at rest (e.g., container encryption).

Level 3 - Well Defined: Mobile Device Management (MDM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MDM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MDM domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain MDM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of mobile device security operations (e.g., Mobile Device Management (MDM) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MDM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational cryptographic capability exists to protect the confidentiality and integrity of information on mobile devices through full-device or container encryption.

Level 4 - Quantitatively Controlled: Mobile Device Management (MDM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MDM-03", "family": "Mobile Device Management", "enhancements": "", "sortId": "MDM-03", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72608, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590793", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590793", "securityControlId": 31650, "ccis": [], "uuid": "a14a60ec-b2a2-5ac5-b236-9ebc3c8336d1", "testId": "MDM-04_A01", "test": "anti-tamper technologies to be employed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-03(05)_ODP[01]", "defaultText": null }, { "id": 72609, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590793", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590793", "securityControlId": 31650, "ccis": [], "uuid": "c6ac4fae-b568-569c-af35-3ec14be53764", "testId": "MDM-04_A02", "test": "hardware components to be protected from physical tampering or alteration are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-03(05)_ODP[03]", "defaultText": null }, { "id": 72610, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590794", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590794", "securityControlId": 31650, "ccis": [], "uuid": "d6712bcd-c015-5606-be0a-724c8b443e8c", "testId": "MDM-04_A03", "test": "anti-tamper technologies are employed to detect and/or prevent physical tampering or alteration of hardware components within the system.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-03(05)\n53A_R5_PE-03(05)_ODP[02]", "defaultText": null } ], "externalMappings": [ { "id": 585774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96f6bcb8-6062-5f4b-b2ff-ef85da4e9c4a", "parentControlId": 31650, "controlId": "PE-3(5)", "title": "PE-3(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587155" }, { "id": 585775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48a0617a-b816-5005-85b1-c3d10249b78f", "parentControlId": 31650, "controlId": "PE-03(05)", "title": "PE-03(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587155" }, { "id": 585776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a84cb875-b4e2-5efa-bace-24dbae4a4eec", "parentControlId": 31650, "controlId": "PE-03(05)", "title": "PE-03(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587155" }, { "id": 585778, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89e96103-081e-5af6-a5d0-5c0e99526e90", "parentControlId": 31650, "controlId": "PE-3(5)", "title": "PE-3(5)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587155" }, { "id": 585781, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587156", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72eb16d2-207c-5c1b-8679-2459575e087a", "parentControlId": 31650, "controlId": "03.04.12.b", "title": "03.04.12.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587156" } ], "id": 31650, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73119", "catalogueId": 1062, "uuid": "d8210ad7-2d14-5631-81fa-3f1ceecdd0c1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect mobile devices from tampering through inspecting devices returning from locations that the organization deems to be of significant risk, prior to the device being connected to its network?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Mobile Device Tampering", "description": "

Control Description

Mechanisms exist to protect mobile devices from tampering through inspecting devices returning from locations that the organization deems to be of significant risk, prior to the device being connected to the organization's network.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Mobile Device Management (MDM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MDM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MDM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MDM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ MDM-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ MDM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel protect mobile devices from tampering through inspecting devices returning from locations that the organization deems to be of significant risk, prior to the device being connected to the organization's network.

Level 3 - Well Defined: Mobile Device Management (MDM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MDM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MDM domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain MDM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of mobile device security operations (e.g., Mobile Device Management (MDM) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MDM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to protect mobile devices from tampering through inspecting devices returning from locations that the organization deems to be of significant risk, prior to the device being connected to the organization's network.

Level 4 - Quantitatively Controlled: Mobile Device Management (MDM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MDM-04", "family": "Mobile Device Management", "enhancements": "", "sortId": "MDM-04", "references": "

Micro-Small Business (<10 staff)

∙ Tamper tape\n∙ Microsoft Defender for Endpoint (MDE) (https://microsoft.com)

Small Business (10-49 staff)

∙ Tamper tape\n∙ Microsoft Defender for Endpoint (MDE) (https://microsoft.com)

Medium Business (50-249 staff)

∙ Tamper tape\n∙ Microsoft Defender for Endpoint (MDE) (https://microsoft.com)\n∙ Duo (https://duo.com)

Large Business (250-999 staff)

∙ Tamper tape\n∙ Microsoft Defender for Endpoint (MDE) (https://microsoft.com)\n∙ Duo (https://duo.com)

Enterprise (>1,000 staff)

∙ Tamper tape\n∙ Microsoft Defender for Endpoint (MDE) (https://microsoft.com)\n∙ Duo (https://duo.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72611, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590794", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590794", "securityControlId": 31651, "ccis": [], "uuid": "d64f988d-de7f-5554-82f2-c3be5836df87", "testId": "MDM-05_A01", "test": "mobile devices to be purged or wiped of information are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-07(02)_ODP[01]", "defaultText": null }, { "id": 72612, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590794", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590794", "securityControlId": 31651, "ccis": [], "uuid": "b692042a-a0ed-506a-8979-260fa056f515", "testId": "MDM-05_A02", "test": "purging or wiping requirements and techniques to be used when mobile devices are purged or wiped of information are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-07(02)_ODP[02]", "defaultText": null }, { "id": 72613, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590794", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590794", "securityControlId": 31651, "ccis": [], "uuid": "2006cbde-ac7b-5ef1-be26-9e537f5b3c28", "testId": "MDM-05_A03", "test": "information is purged or wiped from organization-defined mobile devices based on organization-defined purging or wiping requirements or techniques after organization-defined number consecutive, unsuccessful device logon attempts.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-07(02)", "defaultText": null }, { "id": 72614, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590795", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590795", "securityControlId": 31651, "ccis": [], "uuid": "21e317e2-0deb-592a-9b77-15c18037cbf9", "testId": "MDM-05_A04", "test": "the number of consecutive, unsuccessful logon attempts before the information is purged or wiped from mobile devices is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-07(02)_ODP[03]", "defaultText": null }, { "id": 72615, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590795", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590795", "securityControlId": 31651, "ccis": [], "uuid": "bebca9ce-71c4-55f3-a163-612516308b19", "testId": "MDM-05_A05", "test": "systems or system components to purge or wipe information either remotely or under specific conditions are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-06(08)_ODP[01]", "defaultText": null }, { "id": 72616, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590795", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590795", "securityControlId": 31651, "ccis": [], "uuid": "198e5215-76b8-5861-a0a6-7308610e6c2b", "testId": "MDM-05_A06", "test": "conditions under which information is to be purged or wiped are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_MP-06(08)_ODP[02]\n53A_R5_MP-06(08)_ODP[03]", "defaultText": null }, { "id": 72617, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590795", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590795", "securityControlId": 31651, "ccis": [], "uuid": "67f98b16-3058-59d6-a190-c748b769fa1e", "testId": "MDM-05_A07", "test": "the capability to purge or wipe information from systems or system components organization-defined criteria are provided.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_MP-06(08)", "defaultText": null } ], "externalMappings": [ { "id": 585792, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587157", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1c3030e-99bc-5397-9af6-932cfc0dc8e2", "parentControlId": 31651, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587158" }, { "id": 585796, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb347923-0b96-5d71-8176-395a8eb321f6", "parentControlId": 31651, "controlId": "AC-7(2)", "title": "AC-7(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587158" }, { "id": 585797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61fcf90c-be8e-518b-aa43-012d4a0b1112", "parentControlId": 31651, "controlId": "MP-6(8)", "title": "MP-6(8)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587158" }, { "id": 585798, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e006dbed-a12d-5a14-9abf-11c4511390bd", "parentControlId": 31651, "controlId": "AC-07(02)", "title": "AC-07(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587158" }, { "id": 585799, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587158", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7d05db3-7d49-5e1e-8431-6cbbfb88e594", "parentControlId": 31651, "controlId": "MP-06(08)", "title": "MP-06(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587158" }, { "id": 585800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587159", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ce9f12e-e45d-57d9-ad9b-09cf09f2b1e5", "parentControlId": 31651, "controlId": "AC-07(02)", "title": "AC-07(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587159" }, { "id": 585801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587159", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3936b3b-b009-50dc-a362-4f3aeed974a7", "parentControlId": 31651, "controlId": "MP-06(08)", "title": "MP-06(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587159" } ], "id": 31651, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731191", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731191", "catalogueId": 1062, "uuid": "154e7e3a-ea15-578d-bd6a-4ab29218369f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization remotely purge selected information from mobile devices?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Remote Purging", "description": "

Control Description

Mechanisms exist to remotely purge selected information from mobile devices.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Mobile Device Management (MDM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MDM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MDM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MDM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ MDM-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ MDM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ MDM software can remotely purge selected information from mobile devices.

Level 3 - Well Defined: Mobile Device Management (MDM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MDM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MDM domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain MDM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of mobile device security operations (e.g., Mobile Device Management (MDM) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MDM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to remotely purge selected information from mobile devices.

Level 4 - Quantitatively Controlled: Mobile Device Management (MDM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Mobile Device Management (MDM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "MDM-05", "family": "Mobile Device Management", "enhancements": "", "sortId": "MDM-05", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72618, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590795", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590795", "securityControlId": 31652, "ccis": [], "uuid": "6376fcb7-b255-5ebe-93e2-753e642a40ca", "testId": "MDM-06_A01", "test": "the connection of personally-owned, mobile devices to organizational systems and networks is restricted.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 585811, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a90c2b89-e159-52eb-9154-a70afc678934", "parentControlId": 31652, "controlId": "3.1.18", "title": "3.1.18", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58716" }, { "id": 585812, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5153e6a7-0c67-54f7-ad5d-f466ebd04d45", "parentControlId": 31652, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58716" }, { "id": 585813, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51334cd0-d51f-5c1c-9ebf-981ae67ea85d", "parentControlId": 31652, "controlId": "03.01.18.b", "title": "03.01.18.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58716" }, { "id": 585816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587161", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec389c5b-003c-5196-9380-c8dc33db7fd4", "parentControlId": 31652, "controlId": "9-3.d", "title": "9-3.d", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587161" } ], "id": 31652, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731191", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731191", "catalogueId": 1062, "uuid": "5675c8a0-b70b-5074-8fab-cc1f57ea6dcf", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict the connection of personally-owned, mobile devices to organizational Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Personally-Owned Mobile Devices", "description": "

Control Description

Mechanisms exist to restrict the connection of personally-owned, mobile devices to organizational Technology Assets, Applications and/or Services (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Mobile Device Management (MDM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MDM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MDM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MDM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ MDM-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ MDM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel restrict the connection of personally-owned, mobile devices to organizational TAASD.\n▪ MDM software is used to restrict the data that is stored/processed/transmitted on organization-owned and/or applicable Bring Your Own Device (BYOD) (e.g., personal devices).

Level 3 - Well Defined: Mobile Device Management (MDM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MDM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MDM domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain MDM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of mobile device security operations (e.g., Mobile Device Management (MDM) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MDM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict the connection of personally-owned, mobile devices to organizational Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Mobile Device Management (MDM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MDM-06", "family": "Mobile Device Management", "enhancements": "", "sortId": "MDM-06", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72619, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590796", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590796", "securityControlId": 31653, "ccis": [], "uuid": "de0e0b9e-e796-5d90-a71f-2b1dadb213ba", "testId": "MDM-07_A01", "test": "the installation of non-approved applications or approved applications not obtained through the organization-approved application store is prohibited.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 585832, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9cacd886-d370-5a50-891a-8a00f26ff16e", "parentControlId": 31653, "controlId": "3.1.18", "title": "3.1.18", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587163" }, { "id": 585833, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "813921b8-87b2-54bb-bb20-2c746a797181", "parentControlId": 31653, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587163" }, { "id": 585834, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5473c64e-a81e-5e9d-b67d-1cfdb12f499d", "parentControlId": 31653, "controlId": "03.01.18.b", "title": "03.01.18.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587163" }, { "id": 585835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8fc1107-fe40-576d-9fe3-15334ec4ad48", "parentControlId": 31653, "controlId": "03.01.20.d", "title": "03.01.20.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587163" } ], "id": 31653, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731192", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731192", "catalogueId": 1062, "uuid": "baad2b01-e878-56d4-ad90-7e33d53d3e57", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prohibit the installation of non-approved applications or approved applications not obtained through the organization-approved application store?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Organization-Owned Mobile Devices", "description": "

Control Description

Mechanisms exist to prohibit the installation of non-approved applications or approved applications not obtained through the organization-approved application store.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Mobile Device Management (MDM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MDM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with MDM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MDM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ MDM-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ MDM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Mobile devices containing sensitive/regulated data use MDM software to prevent the unauthorized disclosure of information at rest (e.g., container encryption).\n▪ MDM software is used to restrict the data that is stored/processed/transmitted on organization-owned and/or applicable Bring Your Own Device (BYOD) (e.g., personal devices).

Level 3 - Well Defined: Mobile Device Management (MDM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MDM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MDM domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain MDM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of mobile device security operations (e.g., Mobile Device Management (MDM) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MDM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prohibit the installation of non-approved applications or approved applications not obtained through the organization-approved application store.

Level 4 - Quantitatively Controlled: Mobile Device Management (MDM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MDM-07", "family": "Mobile Device Management", "enhancements": "", "sortId": "MDM-07", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72623, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590797", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590797", "securityControlId": 31657, "ccis": [], "uuid": "7b72cb63-3704-5e06-aa5e-eee6b6064fe6", "testId": "MDM-11_A01", "test": "the connectivity of unauthorized mobile devices is restricted from communicating with systems, applications and services.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 585851, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b44db4e7-b391-53de-b851-eee574401b0a", "parentControlId": 31657, "controlId": "SR 2.3(a)", "title": "SR 2.3(a)", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587165" }, { "id": 585852, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587166", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b181cc9-41d9-561f-8e25-ddbf2b965979", "parentControlId": 31657, "controlId": "SR 2.3(c)", "title": "SR 2.3(c)", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587166" }, { "id": 585853, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587166", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9db7a6f7-c2d0-5e2f-9398-9de508e241fc", "parentControlId": 31657, "controlId": "SR 2.3 RE 1", "title": "SR 2.3 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587166" }, { "id": 585854, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587166", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74ac7b47-b079-5f01-b3b1-bbd22111da9e", "parentControlId": 31657, "controlId": "03.01.18.b", "title": "03.01.18.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587166" } ], "id": 31657, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731193", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731193", "catalogueId": 1062, "uuid": "f63b437f-82b0-5d31-9c2c-e9b66e6db747", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict the connectivity of unauthorized mobile devices from communicating with organizational Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Restricting Access To Authorized Technology Assets, Applications and/or Services (TAAS)", "description": "

Control Description

Mechanisms exist to restrict the connectivity of unauthorized mobile devices from communicating with organizational Technology Assets, Applications and/or Services (TAAS).

Evidence Request List (ERL)

E-NET-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Mobile Device Management (MDM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with MDM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ MDM-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ MDM is mostly administrative in nature (e.g., policies & standards) that rely on administrative “acceptable use” restrictions to govern mobile device usage. \n▪ MDM software is used to restrict the data that is stored/processed/transmitted on organization-owned and/or applicable Bring Your Own Device (BYOD) (e.g., personal devices).\n▪ MDM software is used to prevent the unauthorized disclosure of sensitive/regulated data (e.g., cryptographic containerization).

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Mobile Device Management (MDM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with MDM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with MDM domain capabilities are well-documented and kept current by process owners.\n▪ An endpoint technology management team, or similar function, is appropriately staffed and supported to implement and maintain MDM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of mobile device security operations (e.g., Mobile Device Management (MDM) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MDM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict the connectivity of unauthorized mobile devices from communicating with organizational Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "MDM-11", "family": "Mobile Device Management", "enhancements": "", "sortId": "MDM-11", "references": "

Micro-Small Business (<10 staff)

∙ Mobile device policy (lock screen, encryption)

Small Business (10-49 staff)

∙ Mobile device policy\n∙ MDM solution (e.g., Microsoft Intune)\n∙ BYOD policy

Medium Business (50-249 staff)

∙ MDM/EMM solution (e.g., Microsoft Intune, Jamf)\n∙ Mobile device policy

Large Business (250-999 staff)

∙ Enterprise MDM/UEM (e.g., Microsoft Intune, VMware Workspace ONE)\n∙ Mobile threat defense

Enterprise (>1,000 staff)

∙ Enterprise UEM platform (e.g., Microsoft Intune, JAMF)\n∙ MTD solution\n∙ Zero-trust mobile access", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72624, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590797", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590797", "securityControlId": 31658, "ccis": [], "uuid": "922f9cc9-cc08-53d8-92d4-31d433f1e0ed", "testId": "NET-01_A01", "test": "system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-01a.[03]", "defaultText": null }, { "id": 72625, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590797", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590798", "securityControlId": 31658, "ccis": [], "uuid": "e9bac097-1216-5cda-8df6-a20e59a4c877", "testId": "NET-01_A02", "test": "personnel or roles to whom the system and communications protection policy is to be disseminated is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01_ODP[01]", "defaultText": null }, { "id": 72626, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590798", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590798", "securityControlId": 31658, "ccis": [], "uuid": "f4127aa3-fff3-5687-a96d-02af26b3b7c8", "testId": "NET-01_A03", "test": "personnel or roles to whom the system and communications protection procedures are to be disseminated is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01_ODP[02]", "defaultText": null }, { "id": 72627, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590798", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590798", "securityControlId": 31658, "ccis": [], "uuid": "c62f044e-f373-5e0a-9c90-cbd72150c4b7", "testId": "NET-01_A04", "test": "an official to manage the system and communications protection policy and procedures is defined.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_SC-01_ODP[03]\n53A_R5_SC-01_ODP[04]", "defaultText": null }, { "id": 72628, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590798", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590798", "securityControlId": 31658, "ccis": [], "uuid": "9a34e3c7-225a-5220-98f4-10a0c2b18362", "testId": "NET-01_A05", "test": "the frequency at which the current system and communications protection policy is reviewed / updated is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01_ODP[05]", "defaultText": null }, { "id": 72629, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590798", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590798", "securityControlId": 31658, "ccis": [], "uuid": "9dc9b0c7-b596-5d18-be98-ef519d4ddbb7", "testId": "NET-01_A06", "test": "events that would require the current system and communications protection policy to be reviewed / updated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01_ODP[06]", "defaultText": null }, { "id": 72630, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590798", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590798", "securityControlId": 31658, "ccis": [], "uuid": "9c114b49-18cb-5d2d-8487-54b69a4209cd", "testId": "NET-01_A07", "test": "the frequency at which the current system and communications protection procedures are reviewed / updated is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01_ODP[07]", "defaultText": null }, { "id": 72631, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590798", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590798", "securityControlId": 31658, "ccis": [], "uuid": "bf38ad46-834f-5f5d-86ab-6a135b67ad95", "testId": "NET-01_A08", "test": "events that would require the system and communications protection procedures to be reviewed / updated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01_ODP[08]", "defaultText": null }, { "id": 72632, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590799", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590799", "securityControlId": 31658, "ccis": [], "uuid": "f234d471-aef4-57f8-a74b-86cbc95b9685", "testId": "NET-01_A09", "test": "a system and communications protection policy is developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01a.[01]", "defaultText": null }, { "id": 72633, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590799", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590799", "securityControlId": 31658, "ccis": [], "uuid": "af25dca6-0641-5d2d-942d-9d0884c1d40a", "testId": "NET-01_A10", "test": "the system and communications protection policy is disseminated to organization-defined personnel or roles.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-01a.[02]", "defaultText": null }, { "id": 72634, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590799", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590799", "securityControlId": 31658, "ccis": [], "uuid": "5afd4cdd-2df4-5d8d-8fe2-f4e5e33fe4b5", "testId": "NET-01_A11", "test": "the system and communications protection procedures are disseminated to organization-defined personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01a.[04]", "defaultText": null }, { "id": 72635, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590799", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590799", "securityControlId": 31658, "ccis": [], "uuid": "bc217b94-a991-538c-9aa5-a83fef40339c", "testId": "NET-01_A12", "test": "the organization's system and communications protection policy addresses purpose.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01a.01(a)[01]", "defaultText": null }, { "id": 72636, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590799", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590799", "securityControlId": 31658, "ccis": [], "uuid": "4f6f9929-7aca-5860-a40f-0c5f8a9fe5c8", "testId": "NET-01_A13", "test": "the organization's system and communications protection policy addresses scope.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01a.01(a)[02]", "defaultText": null }, { "id": 72637, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590799", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590799", "securityControlId": 31658, "ccis": [], "uuid": "70e9455d-c206-517f-80ac-be03537d60ce", "testId": "NET-01_A14", "test": "the organization's system and communications protection policy addresses roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01a.01(a)[03]", "defaultText": null }, { "id": 72638, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590799", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590799", "securityControlId": 31658, "ccis": [], "uuid": "902460de-76e7-5cdd-919b-aa74d7f68136", "testId": "NET-01_A15", "test": "the organization's system and communications protection policy addresses responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01a.01(a)[04]", "defaultText": null }, { "id": 72639, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5908", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5908", "securityControlId": 31658, "ccis": [], "uuid": "67c5a066-8b6b-509c-9f15-04b9f14ac817", "testId": "NET-01_A16", "test": "the organization's system and communications protection policy addresses management commitment.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01a.01(a)[05]", "defaultText": null }, { "id": 72640, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5908", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5908", "securityControlId": 31658, "ccis": [], "uuid": "c754068f-5f36-567c-a6d4-ca2c54037891", "testId": "NET-01_A17", "test": "the organization's system and communications protection policy addresses coordination among organizational entities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01a.01(a)[06]", "defaultText": null }, { "id": 72641, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5908", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5908", "securityControlId": 31658, "ccis": [], "uuid": "da6d8319-249f-58f9-8bd7-9064962c1d16", "testId": "NET-01_A18", "test": "the organization's system and communications protection policy addresses compliance.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01a.01(a)[07]", "defaultText": null }, { "id": 72642, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5908", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5908", "securityControlId": 31658, "ccis": [], "uuid": "b87ed829-19bc-5cd9-a41f-8b7d42a560cc", "testId": "NET-01_A19", "test": "the organization's system and communications protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01a.01(b)", "defaultText": null }, { "id": 72643, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5908", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5908", "securityControlId": 31658, "ccis": [], "uuid": "30214191-c6f9-5493-9612-acf68dcc49ce", "testId": "NET-01_A20", "test": "the organization-defined official is designated to manage the development, documentation, and dissemination of the system and communications protection policy and procedures.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01b.", "defaultText": null }, { "id": 72644, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5908", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590801", "securityControlId": 31658, "ccis": [], "uuid": "35e623db-4a3e-5434-a0f3-34e5f4ea38f9", "testId": "NET-01_A21", "test": "the current system and communications protection policy is reviewed / updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01c.01[01]", "defaultText": null }, { "id": 72645, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590801", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590801", "securityControlId": 31658, "ccis": [], "uuid": "887060eb-f953-5923-b8ab-e92c765f040e", "testId": "NET-01_A22", "test": "the current system and communications protection policy is reviewed / updated following organization-defined events.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-01c.01[02]", "defaultText": null }, { "id": 72646, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590801", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590801", "securityControlId": 31658, "ccis": [], "uuid": "2299896e-5371-5c0d-819d-91e70a737f18", "testId": "NET-01_A23", "test": "the current system and communications protection procedures are reviewed / updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01c.02[01]", "defaultText": null }, { "id": 72647, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590801", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590801", "securityControlId": 31658, "ccis": [], "uuid": "e187440f-464c-593d-b24b-dcf58ef24534", "testId": "NET-01_A24", "test": "the current system and communications protection procedures are reviewed / updated following organization-defined events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-01c.02[02]", "defaultText": null }, { "id": 72648, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590801", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590801", "securityControlId": 31658, "ccis": [], "uuid": "2c1dd7f9-6363-56fe-b1ff-49d1ffa2b848", "testId": "NET-01_A25", "test": "network security management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72649, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590801", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590801", "securityControlId": 31658, "ccis": [], "uuid": "2f88ec41-ba4d-5be6-be39-0197a2aa7295", "testId": "NET-01_A26", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support network security management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72650, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590801", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590801", "securityControlId": 31658, "ccis": [], "uuid": "d03b72ba-783b-5365-b931-3f457c6cddc5", "testId": "NET-01_A27", "test": "responsibility and authority for the performance of network security management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72651, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590801", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590801", "securityControlId": 31658, "ccis": [], "uuid": "be01b2fd-fbd0-5c81-b387-577ad9926614", "testId": "NET-01_A28", "test": "personnel performing network security management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 585892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58717", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0847fd9-509a-5710-bdaf-e5c987081f70", "parentControlId": 31658, "controlId": "NET 1.2", "title": "NET 1.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58717" }, { "id": 585893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06a7bd29-8c4e-5f07-9d79-0e0f202c7d82", "parentControlId": 31658, "controlId": "SR 7.6", "title": "SR 7.6", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587171" }, { "id": 585895, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1cc82856-3f57-5505-8ae8-19eeaa8d9763", "parentControlId": 31658, "controlId": "5.14", "title": "5.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587171" }, { "id": 585896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46164110-772f-55b0-9d79-4e6a044d31e3", "parentControlId": 31658, "controlId": "8.12", "title": "8.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587171" }, { "id": 585897, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88b97ed2-4fa3-5d7a-9441-488530d3183d", "parentControlId": 31658, "controlId": "8.2", "title": "8.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587171" }, { "id": 585898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d2e6206-71d1-57b2-8bac-a8a6990fe12e", "parentControlId": 31658, "controlId": "8.21", "title": "8.21", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587171" }, { "id": 585914, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587173", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d75eee31-1689-5a71-950d-9a1c23df0a98", "parentControlId": 31658, "controlId": "SC-1", "title": "SC-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587173" }, { "id": 585915, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587173", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84840c98-c30a-5c91-9b29-70bfe68a408e", "parentControlId": 31658, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587173" }, { "id": 585917, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d67ea2f1-316a-5658-b2a6-efdbf7263c40", "parentControlId": 31658, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587182" }, { "id": 585919, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57a8bb80-fffe-5e6d-ad84-147a13eb19d8", "parentControlId": 31658, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587182" }, { "id": 585920, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad41e13f-ddf1-5c2b-998a-a1aab3e532d2", "parentControlId": 31658, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587182" }, { "id": 585921, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b37ac8d6-37f4-5082-8586-ebbae07bb47b", "parentControlId": 31658, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587182" }, { "id": 585922, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b5342b0-0480-5ea1-97c9-524985ce29bb", "parentControlId": 31658, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587182" }, { "id": 585923, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24cb0ffc-85fc-528c-8d44-9afe5a9a66be", "parentControlId": 31658, "controlId": "SC-1", "title": "SC-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587182" }, { "id": 585924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6719f33-19e8-5452-9217-964ad4ceb3e6", "parentControlId": 31658, "controlId": "SC-1", "title": "SC-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587183" }, { "id": 585928, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ca4a253-0f3a-55db-bf46-6afc0e0f4cf1", "parentControlId": 31658, "controlId": "3.13.1", "title": "3.13.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587183" }, { "id": 585929, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c770283f-c917-502c-892d-410746038977", "parentControlId": 31658, "controlId": "NFO - SC-1", "title": "NFO - SC-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587183" }, { "id": 585930, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c47fe987-0b98-5198-af12-71a929184ba9", "parentControlId": 31658, "controlId": "03.01.12.a", "title": "03.01.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587183" }, { "id": 585931, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "284e7482-5d13-57a0-857e-fb4b342deb2c", "parentControlId": 31658, "controlId": "03.01.16.a", "title": "03.01.16.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587183" }, { "id": 585932, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ccfb5c3-e5b5-5e0b-99d7-28add237ee6b", "parentControlId": 31658, "controlId": "03.01.16.b", "title": "03.01.16.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587184" }, { "id": 585933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a449748d-09cc-5bfa-8975-99123762d703", "parentControlId": 31658, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587184" }, { "id": 585934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a21c96fb-689b-5653-8fa6-6bcf4f4b88bd", "parentControlId": 31658, "controlId": "03.13.01.a", "title": "03.13.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587184" }, { "id": 585936, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d3bfeba-e3df-5f77-bdaa-8d09572c8bc4", "parentControlId": 31658, "controlId": "PR.IR-01", "title": "PR.IR-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587184" }, { "id": 585953, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd6f8d38-8f7c-5f9d-b151-e1161eac234c", "parentControlId": 31658, "controlId": "ARCHITECTURE-2a", "title": "ARCHITECTURE-2a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587187" }, { "id": 585954, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "431a07f2-7a35-5d3c-8041-fde174b957a0", "parentControlId": 31658, "controlId": "ARCHITECTURE-2c", "title": "ARCHITECTURE-2c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587187" }, { "id": 585955, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d0552d0-b193-5f93-9279-3f4fbccd3385", "parentControlId": 31658, "controlId": "ARCHITECTURE-2f", "title": "ARCHITECTURE-2f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587187" }, { "id": 585972, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f17a6e2-bf19-5cfb-8023-6da82f23d32d", "parentControlId": 31658, "controlId": "CIP-003-8 1.1.2", "title": "CIP-003-8 1.1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587189" }, { "id": 585973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587189", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75419075-b9c7-5d59-86da-0a9eda4be70e", "parentControlId": 31658, "controlId": "CIP-005-7 1.1", "title": "CIP-005-7 1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587189" }, { "id": 585974, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58719", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d5edb48-b27c-5eeb-9a13-19f917b74c8e", "parentControlId": 31658, "controlId": "CIP-005-7 1.2", "title": "CIP-005-7 1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58719" }, { "controlId": "B.3.1", "title": "B.3.1 — Critical Digital Asset and Communications Protection Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ceb15313-1752-5db0-b22d-d4245fa724b8", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.1", "title": "NEI 08-09 App D.3.1 — Critical Digital Asset and Communications Protection Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "cb43daea-e3d1-5686-873a-f77fc5b700f3", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "d827dea9-c7bc-5c94-a3c6-ed9f4643cdc1", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "4d429d40-b766-5aed-b6b1-d2f165fbfa7e", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "69116ff2-34ab-5447-a6e6-b6995dc4a193", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "b6c9a1b6-6039-5037-a18f-3570073a8c4c", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "1c8c7814-dd92-5255-bd12-7f4530479080", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "2de5e3d7-974c-5630-8614-ed1563b33922", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "043b5ad0-90d7-56d2-8537-206b9ba6d2a9", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "d8861121-b795-589f-bb15-191f29d3533f", "isPublic": true } ], "id": 31658, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731193", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731193", "catalogueId": 1062, "uuid": "b209cf7e-d040-5e30-a2db-e0a66f4844e4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization develop, govern & update procedures to facilitate the implementation of Network Security Controls (NSC)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Network Security Controls (NSC)", "description": "

Control Description

Mechanisms exist to develop, govern & update procedures to facilitate the implementation of Network Security Controls (NSC).

Evidence Request List (ERL)

E-NET-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Administrative processes are used to configure boundary devices (e.g., firewalls, routers, etc.) to deny network traffic by default and allow network traffic by exception (e.g., deny all, permit by exception). \n▪ Administrative processes enforce the use of human reviews for Access Control Lists (ACLs) and similar rulesets on a routine basis. \n▪ Internet-facing technologies are governed no differently from internal network assets.\n▪ Network communications containing sensitive/regulated data are protected using a cryptographic mechanism to prevent unauthorized disclosure of information while in transit (e.g., SSH, TLS, VPN, etc.). \n▪ Wireless access is protected via secure authentication and encryption.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ Network communications containing sensitive/regulated data use a cryptographic mechanism to prevent the unauthorized disclosure of information while in transit (e.g., SSH, TLS, VPN, etc.).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to develop, govern & update procedures to facilitate the implementation of Network Security Controls (NSC).

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.1", "controlId": "NET-01", "family": "Network Security", "enhancements": "", "sortId": "NET-01", "references": "

Micro-Small Business (<10 staff)

∙ Basic firewall (home router or free pfSense)\n∙ Network security policy

Small Business (10-49 staff)

∙ Small business firewall (e.g., Cisco Meraki, Fortinet FortiGate)\n∙ Network security policy

Medium Business (50-249 staff)

∙ Next-gen firewall (NGFW)\n∙ Network segmentation\n∙ IDS/IPS\n∙ Network security standards

Large Business (250-999 staff)

∙ Enterprise NGFW (e.g., Palo Alto Networks, Fortinet)\n∙ Network security program\n∙ IDS/IPS\n∙ NAC

Enterprise (>1,000 staff)

∙ Enterprise NGFW with threat intelligence feeds\n∙ Zero-trust network architecture\n∙ SIEM integration\n∙ NAC\n∙ SD-WAN", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72652, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590802", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590802", "securityControlId": 31659, "ccis": [], "uuid": "d9d0b03a-9baa-5a92-9599-4e0f2952ff90", "testId": "NET-01.1_A01", "test": "all users are treated as potential threats and prevent access to data and resources until the user can be properly authenticated and their access authorized.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72653, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590802", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590802", "securityControlId": 31659, "ccis": [], "uuid": "ef981ac6-effa-596f-b615-73ba0708d8b0", "testId": "NET-01.1_A02", "test": "all devices are treated as potential threats and prevent access to data and resources until the device can be properly authenticated and its access authorized.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 586105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587205", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ee370ae-e01b-5bb1-bd8c-3c8b863f94ef", "parentControlId": 31659, "controlId": "NDR 1.13", "title": "NDR 1.13", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587205" } ], "id": 31659, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731194", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731194", "catalogueId": 1062, "uuid": "04147271-55ab-50b7-ba4b-d46807ca0bd4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization treat all users and devices as potential threats and prevent access to data and resources until the users can be properly authenticated and their access authorized?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Zero Trust Architecture (ZTA)", "description": "

Control Description

Mechanisms exist to treat all users and devices as potential threats and prevent access to data and resources until the users can be properly authenticated and their access authorized.

Evidence Request List (ERL)

E-NET-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Administrative processes are used to configure boundary devices (e.g., firewalls, routers, etc.) to deny network traffic by default and allow network traffic by exception (e.g., deny all, permit by exception).

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to treat all users and devices as potential threats and prevent access to data and resources until the users can be properly authenticated and their access authorized.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-01.1", "family": "Network Security", "enhancements": "", "sortId": "NET-01.1", "references": "

Medium Business (50-249 staff)

∙ Zero Trust Architecture (ZTA) planning and roadmap

Large Business (250-999 staff)

∙ ZTA implementation\n∙ Identity-centric access controls\n∙ Microsegmentation

Enterprise (>1,000 staff)

∙ Enterprise ZTA platform (e.g., Zscaler, Palo Alto Prisma Access)\n∙ Identity-based access\n∙ Microsegmentation\n∙ Continuous validation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72654, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590802", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590802", "securityControlId": 31660, "ccis": [], "uuid": "5aae1c56-c13b-5a02-9e6f-a10ed7a4885a", "testId": "NET-02_A01", "test": "security functions are implemented as a layered structure that minimizes interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 586126, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2768da6a-8588-5ec3-8365-b76d21e2dff0", "parentControlId": 31660, "controlId": "NET 1.2", "title": "NET 1.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587208" }, { "id": 586127, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a04b470f-6927-57d6-8d7a-7f29c7dc1c99", "parentControlId": 31660, "controlId": "8.2", "title": "8.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587208" }, { "id": 586133, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af54fd24-4f8f-5182-a041-b8a348f92e74", "parentControlId": 31660, "controlId": "03.13.01.b", "title": "03.13.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587209" }, { "id": 586135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b73bff21-820e-58c7-8568-dcb1c0a71e14", "parentControlId": 31660, "controlId": "PR.IR-01", "title": "PR.IR-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587209" }, { "id": 586144, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58721", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7bba1ea2-e0cd-52a5-922d-2d86fc70f9ad", "parentControlId": 31660, "controlId": "ARCHITECTURE-2c", "title": "ARCHITECTURE-2c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587211" }, { "controlId": "A.3.1.4", "title": "A.3.1.4 — Reviews and Validation Testing", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, CA-7, RA-5, SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "06634238-79b7-5572-8d17-a31354bc3f1c", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.4", "title": "NEI 08-09 Sec 3.1.4 — Reviews and Validation Testing", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "eee65de4-44e7-5003-9639-f89781459f75", "isPublic": true }, { "controlId": "10 CFR 73.54(b)(1), (c)(2)", "title": "10 CFR 73.54(b)(1), (c)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "1c926754-91e6-5f09-9665-4809e7500477", "isPublic": true }, { "controlId": "A.3.1.5", "title": "A.3.1.5 — Defense-in-Depth Protective Strategies", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, PL-8, PM-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "c5628349-715a-54c0-acd6-b987a1dbf146", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.5 / Sec 3.2", "title": "NEI 08-09 Sec 3.1.5 / Sec 3.2 — Defense-in-Depth Protective Strategies", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "f9547cbb-6363-53de-ba00-9069499e8faf", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(2)", "title": "10 CFR 73.54(c)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "905bdc12-7bd5-55da-a00a-92f0754e9be1", "isPublic": true }, { "controlId": "B.1.4", "title": "B.1.4 — Information Flow Enforcement", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-4, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "23b7cc5e-7414-5190-b781-090b4bab12a1", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.4", "title": "NEI 08-09 App D.1.4 — Information Flow Enforcement", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "808d444f-2537-53ba-81ee-ef2a98a8d7fd", "isPublic": true }, { "controlId": "C.6", "title": "C.6 — Defensive Strategy", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, PL-8, CA-9", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a11fa3a6-1142-5d3c-90af-4e61874ec1ed", "isPublic": true }, { "controlId": "NEI 08-09 App E.6", "title": "NEI 08-09 App E.6 — Defensive Strategy", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "36b03e73-6500-51f4-8253-e39552cebd54", "isPublic": true }, { "controlId": "C.7", "title": "C.7 — Defense-in-Depth", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, AC-4, SC-7(21)", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "19d9732b-407f-59d7-a0cb-a2edee0e3f24", "isPublic": true }, { "controlId": "NEI 08-09 App E.7 / RG 1.152 Rev 4", "title": "NEI 08-09 App E.7 / RG 1.152 Rev 4 — Defense-in-Depth", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "363e9a26-691a-5527-b6df-b5f9b2a69dda", "isPublic": true }, { "controlId": "CIP-005-7-R1", "title": "CIP-005-7-R1 — Electronic Security Perimeter Implementation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e491dc49-f0cb-569b-9336-dc6791e3c81d", "isPublic": true }, { "controlId": "CIP-005-7-1.1", "title": "CIP-005-7-1.1 — All applicable Cyber Assets connected to a network via a routable protocol shall reside within a defined ESP.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "24dbcad6-8702-53f8-911b-538475951299", "isPublic": true }, { "controlId": "CIP-005-7-1.2", "title": "CIP-005-7-1.2 — All External Routable Connectivity must be through an identified Electronic Access Point (EAP).", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "77761416-864f-51aa-857d-9852b881fa74", "isPublic": true }, { "controlId": "CIP-005-7-1.3", "title": "CIP-005-7-1.3 — Require inbound and outbound access permissions, including the reason for granting access, and deny all other access...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2ff4bfb2-bedd-587f-9ad3-ea8cf9d0d057", "isPublic": true }, { "controlId": "CIP-005-7-1.4", "title": "CIP-005-7-1.4 — Where technically feasible, perform authentication when establishing Dial-up Connectivity with applicable Cyber Assets.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0467a0ad-1dc7-5405-8e06-4913d9650f22", "isPublic": true }, { "controlId": "CIP-005-7-1.5", "title": "CIP-005-7-1.5 — Have one or more methods for detecting known or suspected malicious communications for both inbound and outbound comm...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "925513c5-3bd8-57fe-b4e5-89663e4de30a", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "f39e8926-ac2b-5967-9ec3-dc62caa8f222", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "96298e7d-c146-543b-9036-1007b7cf19a1", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "f884ce85-dfa9-59c2-bdc1-07da937ba1ac", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "6ff2f403-d9d4-54ad-af83-acc5d55a98df", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "49f94893-ce95-5b1a-ae6b-a8e9cc41bd57", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "a3a7f922-b4b3-50fb-b6e0-ac0dc4300b76", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "d7dee7ae-f102-5d65-a811-7ba60c3aeb5f", "isPublic": true } ], "id": 31660, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731194", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731194", "catalogueId": 1062, "uuid": "42f5f822-96eb-5287-9794-62a5a8b6f8e5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement security functions as a layered structure that minimizes interactions between layers of the design and avoids any dependence by lower layers on the functionality or correctness of higher layers?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Layered Network Defenses", "description": "

Control Description

Mechanisms exist to implement security functions as a layered structure that minimizes interactions between layers of the design and avoids any dependence by lower layers on the functionality or correctness of higher layers.

Evidence Request List (ERL)

E-DCH-03\nE-DCH-04\nE-DCH-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Administrative processes are used to configure boundary devices (e.g., firewalls, routers, etc.) to deny network traffic by default and allow network traffic by exception (e.g., deny all, permit by exception).

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ IT and/or cybersecurity architects maintain a segmented development network to ensure a secure development environment.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to implement security functions as a layered structure that minimizes interactions between layers of the design and avoids any dependence by lower layers on the functionality or correctness of higher layers.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.4, A.3.1.5, B.1.4, C.6, C.7
NERC-CIP (2026) Requirements: CIP-005-7-R1", "controlId": "NET-02", "family": "Network Security", "enhancements": "", "sortId": "NET-02", "references": "

Micro-Small Business (<10 staff)

∙ Firewall + antivirus as layered defenses

Small Business (10-49 staff)

∙ Firewall + IDS/IPS + endpoint protection as layered defenses

Medium Business (50-249 staff)

∙ Layered defense-in-depth architecture\n∙ Firewall, IDS/IPS, endpoint protection, email filtering

Large Business (250-999 staff)

∙ Enterprise layered defense program\n∙ NGFW, IDS/IPS, EDR, email security, WAF

Enterprise (>1,000 staff)

∙ Enterprise defense-in-depth architecture\n∙ NGFW, SIEM, EDR/XDR, WAF, email security, DLP, UEBA", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72655, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590802", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590802", "securityControlId": 31661, "ccis": [], "uuid": "1f3d8586-cb9d-5603-989c-eb763a9d7a29", "testId": "NET-02.1_A01", "test": "types of denial-of-service events to be protected against or limited are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-05_ODP[01]\n53A_R5_SC-05(01)_ODP", "defaultText": null }, { "id": 72656, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590803", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590803", "securityControlId": 31661, "ccis": [], "uuid": "daad11a1-7dbf-57f6-b342-7c8147f03cb6", "testId": "NET-02.1_A02", "test": "resource prioritization is designed to limit negative effects of denial-of-service events.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-05_ODP[02]", "defaultText": null }, { "id": 72657, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590803", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590803", "securityControlId": 31661, "ccis": [], "uuid": "31be1107-eafc-5022-9311-de0c44fe7265", "testId": "NET-02.1_A03", "test": "controls to achieve the denial-of-service objective by type of denial-of-service event are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-05_ODP[03]", "defaultText": null }, { "id": 72658, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590803", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590803", "securityControlId": 31661, "ccis": [], "uuid": "5630e043-f0b1-57b3-81d0-6c2a3891bdef", "testId": "NET-02.1_A04", "test": "controls by type of denial-of-service event are employed to achieve the denial-of-service protection objective.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-05b.", "defaultText": null }, { "id": 72659, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590803", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590803", "securityControlId": 31661, "ccis": [], "uuid": "7d5e1452-e240-5b3a-88c7-2f3346de77d2", "testId": "NET-02.1_A05", "test": "the ability of individuals to launch denial-of-service attacks against other systems is restricted.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-05(01)", "defaultText": null }, { "id": 72660, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590803", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590803", "securityControlId": 31661, "ccis": [], "uuid": "80b04d71-c172-5b9d-ba88-254140835c23", "testId": "NET-02.1_A06", "test": "the effects of types of denial-of-service events are organizationally-defined.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-05a.", "defaultText": null }, { "id": 72661, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590803", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590803", "securityControlId": 31661, "ccis": [], "uuid": "630b0a97-a094-58ad-98ce-4762f1fd12c2", "testId": "NET-02.1_A07", "test": "capacity, bandwidth or other redundancies to limit the effects of information flooding denial-of-service attacks are managed.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-05(02)", "defaultText": null }, { "id": 72662, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590804", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590804", "securityControlId": 31661, "ccis": [], "uuid": "2a8ca99c-ff10-556c-ab44-5e473c10c42f", "testId": "NET-02.1_A08", "test": "monitoring tools for detecting indicators of denial-of-service attacks are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-05(03)_ODP[01]", "defaultText": null }, { "id": 72663, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590804", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590804", "securityControlId": 31661, "ccis": [], "uuid": "53703e1f-42fc-51ff-b056-d8d0e4ff79c5", "testId": "NET-02.1_A09", "test": "system resources to be monitored to determine if sufficient resources exist to prevent effective denial-of-service attacks are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-05(03)_ODP[02]", "defaultText": null }, { "id": 72664, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590804", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590804", "securityControlId": 31661, "ccis": [], "uuid": "7e1828ef-9738-590d-8486-b7cdcddbb91c", "testId": "NET-02.1_A10", "test": "monitoring tools are employed to detect indicators of denial-of-service attacks against or launched from the system.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-05(03)(a)", "defaultText": null }, { "id": 72665, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590804", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590804", "securityControlId": 31661, "ccis": [], "uuid": "9f31ffb3-65b2-5e4e-ad88-0d413a0bc51a", "testId": "NET-02.1_A11", "test": "system resources are monitored to determine if sufficient resources exist to prevent effective denial-of-service attacks.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-05(03)(b)", "defaultText": null } ], "externalMappings": [ { "id": 586167, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587214", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0112782e-7cde-581a-aa66-73b265acf5b1", "parentControlId": 31661, "controlId": "SR 7.1", "title": "SR 7.1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587214" }, { "id": 586168, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587214", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "770c78f9-9c09-51a9-97e6-35f5f3565be5", "parentControlId": 31661, "controlId": "SR 7.1 RE 1", "title": "SR 7.1 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587214" }, { "id": 586169, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587214", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f038e31-ae34-59cc-a954-2296f39a145f", "parentControlId": 31661, "controlId": "SR 7.1 RE 2", "title": "SR 7.1 RE 2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587214" }, { "id": 586170, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587214", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac648ae6-6ad2-5d4b-8b6b-1b600f5bf7c5", "parentControlId": 31661, "controlId": "CR 7.1", "title": "CR 7.1", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587214" }, { "id": 586171, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587214", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80890927-7535-531c-8eac-5fef25be1c5b", "parentControlId": 31661, "controlId": "CR 7.1(1)", "title": "CR 7.1(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587214" }, { "id": 586172, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f71dedd-76a6-5fae-b224-3c61ccb5de9b", "parentControlId": 31661, "controlId": "T1496.003", "title": "T1496.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587215" }, { "id": 586173, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c71890f6-7f22-5535-bdf3-f42abbda8ff3", "parentControlId": 31661, "controlId": "SC-5", "title": "SC-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587215" }, { "id": 586174, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7996ed85-3775-5238-a4f6-4ffbfb8cdf0b", "parentControlId": 31661, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587215" }, { "id": 586176, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb58a018-968f-5929-a5f8-ef32ac04eb50", "parentControlId": 31661, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587215" }, { "id": 586177, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "959e7da8-03b4-5be7-b18e-c9a2dca4e7f3", "parentControlId": 31661, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587215" }, { "id": 586178, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9bc1903-beaf-5276-b3ae-41f0d2134c88", "parentControlId": 31661, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587215" }, { "id": 586179, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a55cc4c-3552-517d-8733-ff7b1aced1be", "parentControlId": 31661, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587216" }, { "id": 586180, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587216", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5bb32162-5a2e-5fea-bf6d-55610b543ad4", "parentControlId": 31661, "controlId": "SC-05", "title": "SC-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587216" }, { "controlId": "B.3.4", "title": "B.3.4 — Denial of Service Protection", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "8d410e79-727b-5b69-8300-0867f4629611", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.4", "title": "NEI 08-09 App D.3.4 — Denial of Service Protection", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "3fa6d599-17cc-546a-8c14-a78a3ba6e8be", "isPublic": true }, { "controlId": "10 CFR 73.54(a)(2)", "title": "10 CFR 73.54(a)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "9ff2bc4a-c15f-509c-b648-2647ad08382c", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "8481ff16-89da-5022-93f6-b0e7319ad7a2", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "78c879ef-05c3-5a68-845e-87fa0eacd3c2", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "538afddb-2ef0-5cef-9259-85af6fedabbf", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "b79fce62-157c-5f35-a2c2-9a12d8575189", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "cc34a617-0625-583b-8234-10ded126875e", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "e52b03fe-fba2-59d5-8d36-d28a6a9679e7", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "9fed2ccb-9a78-53a6-9491-6e97dd6b82d6", "isPublic": true } ], "id": 31661, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731195", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731195", "catalogueId": 1062, "uuid": "4015274f-b432-546f-b500-a5eb2b95650a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to protect against or limit the effects of denial of service attacks?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Denial of Service (DoS) Protection", "description": "

Control Description

Automated mechanisms exist to protect against or limit the effects of denial of service attacks.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ Boundary protection technologies minimize the effect of Denial of Service (DoS) attacks against business-critical services.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to automatically protect against or limit the effects of denial of service attacks.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.4", "controlId": "NET-02.1", "family": "Network Security", "enhancements": "", "sortId": "NET-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Enable DDoS protection on ISP/hosting provider

Small Business (10-49 staff)

∙ Cloud-based DDoS protection (e.g., Cloudflare free tier)\n∙ ISP-level DDoS mitigation

Medium Business (50-249 staff)

∙ DDoS protection service (e.g., Cloudflare, Akamai)\n∙ Rate limiting\n∙ Traffic scrubbing

Large Business (250-999 staff)

∙ Enterprise DDoS protection (e.g., Cloudflare Enterprise, Akamai Prolexic)\n∙ On-premises mitigation appliances

Enterprise (>1,000 staff)

∙ Enterprise DDoS mitigation platform\n∙ BGP-based scrubbing centers\n∙ Always-on cloud DDoS protection\n∙ On-prem + cloud hybrid protection", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72666, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590804", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590804", "securityControlId": 31662, "ccis": [], "uuid": "f802e8cf-868c-5749-8f2b-c81055c23cd3", "testId": "NET-02.2_A01", "test": "a secure guest network is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72667, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590804", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590804", "securityControlId": 31662, "ccis": [], "uuid": "496a6884-4685-5494-92df-a7b9ab0e3a64", "testId": "NET-02.2_A02", "test": "a secure guest network is implemented
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72668, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590805", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590805", "securityControlId": 31662, "ccis": [], "uuid": "566f976c-eb22-5203-b825-87de92cf09b9", "testId": "NET-02.2_A03", "test": "each type of wireless access to the system is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.16.a[01]", "defaultText": null }, { "id": 72669, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590805", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590805", "securityControlId": 31662, "ccis": [], "uuid": "5e31c475-564c-52e6-9b64-ba4c450aece6", "testId": "NET-02.2_A04", "test": "usage restrictions are established for each type of wireless access to the system.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.16.a[02]", "defaultText": null }, { "id": 72670, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590805", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590805", "securityControlId": 31662, "ccis": [], "uuid": "6548097e-737b-5c80-ba72-81a379bcefc2", "testId": "NET-02.2_A05", "test": "connection requirements are established for each type of wireless access to the system.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.16.a[04]", "defaultText": null }, { "id": 72671, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590805", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590805", "securityControlId": 31662, "ccis": [], "uuid": "4927b4a4-fc49-5c2b-9ab7-0c76a95acbd8", "testId": "NET-02.2_A06", "test": "each type of wireless access to the system is authorized prior to establishing such connections.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.16.b", "defaultText": null } ], "externalMappings": [ { "id": 586211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58722", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d390c19-61bd-5bc4-ac7d-ed16216bf068", "parentControlId": 31662, "controlId": "3.13.1", "title": "3.13.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58722" }, { "id": 586212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58722", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "318df591-5f45-5cf9-94da-8aa7ffb0e7eb", "parentControlId": 31662, "controlId": "03.01.16.a", "title": "03.01.16.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58722" }, { "id": 586213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58722", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13ea5a71-b776-5f98-9764-5cbf4d3c9733", "parentControlId": 31662, "controlId": "03.01.16.b", "title": "03.01.16.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58722" } ], "id": 31662, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731195", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731195", "catalogueId": 1062, "uuid": "512c997b-0419-5230-b584-a0b6533deea6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement and manage a secure guest network?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Guest Networks", "description": "

Control Description

Mechanisms exist to implement and manage a secure guest network.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ IT and/or cybersecurity personnel implement and manage a secure guest network.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to implement and manage a secure guest network.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-02.2", "family": "Network Security", "enhancements": "", "sortId": "NET-02.2", "references": "

Micro-Small Business (<10 staff)

∙ Separate guest Wi-Fi network (available on most consumer routers)

Small Business (10-49 staff)

∙ Separate guest network with no access to internal resources\n∙ Guest network policy

Medium Business (50-249 staff)

∙ Segregated guest network\n∙ Captive portal\n∙ Guest network access controls

Large Business (250-999 staff)

∙ Enterprise guest network solution\n∙ NAC enforcement\n∙ Guest network monitoring\n∙ VLAN segmentation

Enterprise (>1,000 staff)

∙ Enterprise NAC with guest access management\n∙ Sponsored guest access\n∙ Guest network monitoring\n∙ Automated provisioning/deprovisioning", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72672, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590805", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590805", "securityControlId": 31663, "ccis": [], "uuid": "d6a668ca-2b48-5c63-9d6c-1ecacfbc8b17", "testId": "NET-02.3_A01", "test": "a Cross Domain Solution (CDS) is implemented to mitigate the specific security risks of accessing or transferring information between security domains.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 586250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7aab2c5-1085-55ac-9a77-9139c11cd6a2", "parentControlId": 31663, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587234" }, { "id": 586251, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a0c90bd-2602-5579-8c03-c69874c36e6c", "parentControlId": 31663, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587234" }, { "id": 586252, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d69646b-5a65-58c0-ad43-06591550303f", "parentControlId": 31663, "controlId": "T1021.006", "title": "T1021.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587234" }, { "id": 586253, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26089997-1b25-5637-a6ab-b28c12cba2b4", "parentControlId": 31663, "controlId": "T1046", "title": "T1046", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587234" }, { "id": 586254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86c634b0-128c-5375-a2be-b013ef2b177e", "parentControlId": 31663, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587234" }, { "id": 586255, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c006a86b-fdb1-53b3-8e04-c0e26c52c540", "parentControlId": 31663, "controlId": "T1048.001", "title": "T1048.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587235" }, { "id": 586256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc25b655-bc6b-5299-947f-5c1a1b3ce5b1", "parentControlId": 31663, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587235" }, { "id": 586257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d55c52b2-67be-5426-a49c-cf8222151567", "parentControlId": 31663, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587235" }, { "id": 586258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc034239-b0da-5f14-a628-1b6341898859", "parentControlId": 31663, "controlId": "T1098.001", "title": "T1098.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587235" }, { "id": 586259, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dba46f5a-46e4-5ea4-8cbc-56fe1154ec83", "parentControlId": 31663, "controlId": "T1133", "title": "T1133", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587235" }, { "id": 586260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fb02f69-d9cb-5c36-b8fe-3e14f1a23e39", "parentControlId": 31663, "controlId": "T1136", "title": "T1136", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587235" }, { "id": 586261, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7cde8a9e-5bc4-5919-8086-c5eac01c3eb7", "parentControlId": 31663, "controlId": "T1136.002", "title": "T1136.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587235" }, { "id": 586262, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64377514-af09-50cb-8382-f1f296fa3ade", "parentControlId": 31663, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587235" }, { "id": 586263, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587235", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ecab920-accc-5c5b-86d7-422e62095295", "parentControlId": 31663, "controlId": "T1199", "title": "T1199", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587235" }, { "id": 586264, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587236", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94bfef2d-6b13-56ae-abd8-5a9ca6c9132f", "parentControlId": 31663, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587236" }, { "id": 586265, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587236", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2903dc4-5ab9-5023-b9f8-405d2f216378", "parentControlId": 31663, "controlId": "T1482", "title": "T1482", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587236" }, { "id": 586266, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587236", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c47cfe6-4275-5b5c-a40f-1aa485657390", "parentControlId": 31663, "controlId": "T1489", "title": "T1489", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587236" }, { "id": 586267, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587236", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e32ae3fd-87b1-54eb-8e9b-5b5d3c1c1f5b", "parentControlId": 31663, "controlId": "T1552.007", "title": "T1552.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587236" }, { "id": 586268, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587236", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c00d7221-d0dc-5205-95bb-eb31d2b6c2ef", "parentControlId": 31663, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587236" }, { "id": 586269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587236", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f338e238-f145-5e22-a9ef-ff046bb4b385", "parentControlId": 31663, "controlId": "T1557.001", "title": "T1557.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587236" }, { "id": 586270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587236", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e215ddf-b576-5550-af47-4e9ffde2fd73", "parentControlId": 31663, "controlId": "T1557.003", "title": "T1557.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587236" }, { "id": 586271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06e228b7-8ce9-5894-a381-f36f0362fe86", "parentControlId": 31663, "controlId": "T1557.004", "title": "T1557.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587237" }, { "id": 586272, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3333642-05be-55e8-832e-1439c9b9ed51", "parentControlId": 31663, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587237" }, { "id": 586273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21ac5faf-78ae-5660-a431-58eea1b11fa0", "parentControlId": 31663, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587237" }, { "id": 586274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "983c6fef-8216-5658-9a0f-7fde916ebaae", "parentControlId": 31663, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587237" }, { "id": 586275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e73bf29-a35c-5440-bb77-3e4e4754ae03", "parentControlId": 31663, "controlId": "T1565.003", "title": "T1565.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587237" }, { "id": 586276, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7aa05a29-f018-51cc-9470-6ba578844394", "parentControlId": 31663, "controlId": "T1622", "title": "T1622", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587237" }, { "id": 586277, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "177feefc-7acf-562f-b5ec-9555fa0222b8", "parentControlId": 31663, "controlId": "SC-46", "title": "SC-46", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587237" }, { "id": 586278, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "936954b1-b856-50c3-9305-918da2fda748", "parentControlId": 31663, "controlId": "SC-46", "title": "SC-46", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587237" } ], "id": 31663, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731195", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731195", "catalogueId": 1062, "uuid": "e3c33ecc-f747-5c70-a5f4-c6ad7d555d53", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement a Cross Domain Solution (CDS) to mitigate the specific security risks of accessing or transferring information between security domains?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Cross Domain Solution (CDS)", "description": "

Control Description

Mechanisms exist to implement a Cross Domain Solution (CDS) to mitigate the specific security risks of accessing or transferring information between security domains.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to implement a Cross Domain Solution (CDS) to mitigate the specific security risks of accessing or transferring information between security domains.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-02.3", "family": "Network Security", "enhancements": "", "sortId": "NET-02.3", "references": "

Medium Business (50-249 staff)

∙ Documented cross-domain solution policy\n∙ Review data transfers between security domains

Large Business (250-999 staff)

∙ Formal cross-domain solution (CDS) controls\n∙ Data transfer approval process

Enterprise (>1,000 staff)

∙ Enterprise CDS platform\n∙ Hardware data diodes where applicable\n∙ Formal CDS approval and monitoring program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72673, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590805", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590805", "securityControlId": 31664, "ccis": [], "uuid": "48d7af83-b11c-556f-bd82-3284854c4239", "testId": "NET-03_A01", "test": "the external system boundary is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.13.1[a]", "defaultText": null }, { "id": 72674, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590806", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590806", "securityControlId": 31664, "ccis": [], "uuid": "f6d057bf-d9a7-579c-8b3e-727c11bbc356", "testId": "NET-03_A02", "test": "key internal system boundaries are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.13.1[b]", "defaultText": null }, { "id": 72675, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590806", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590806", "securityControlId": 31664, "ccis": [], "uuid": "e5883767-3f0f-5eec-a431-7d50782202e2", "testId": "NET-03_A03", "test": "communications are protected at the external system boundary.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.13.1[g]", "defaultText": null }, { "id": 72676, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590806", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590806", "securityControlId": 31664, "ccis": [], "uuid": "7eafd394-000b-5621-8e6d-a77f18a5a30b", "testId": "NET-03_A04", "test": "communications are protected at key internal boundaries.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.13.1[h]", "defaultText": null }, { "id": 72677, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590806", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590806", "securityControlId": 31664, "ccis": [], "uuid": "13eb28c7-c571-5432-a8fe-0808c3ae0008", "testId": "NET-03_A05", "test": "communications are monitored at the external system boundary.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07_ODP\n53A_R5_SC-07a.[01]\n171A_3.13.1[c]", "defaultText": null }, { "id": 72678, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590806", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590806", "securityControlId": 31664, "ccis": [], "uuid": "17371fdb-1f18-54f9-bf35-b7d4621e6d10", "testId": "NET-03_A06", "test": "communications are controlled at the external system boundary.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07_ODP\n53A_R5_SC-07a.[02]\n171A_3.13.1[e]", "defaultText": null }, { "id": 72679, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590806", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590806", "securityControlId": 31664, "ccis": [], "uuid": "2f235a21-e092-53ce-99b3-79622f051a4a", "testId": "NET-03_A07", "test": "communications are monitored at key internal boundaries.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07a.[03]\n171A_3.13.1[d]", "defaultText": null }, { "id": 72680, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590806", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590806", "securityControlId": 31664, "ccis": [], "uuid": "85657934-2471-5959-b750-bdcd8d8ead41", "testId": "NET-03_A08", "test": "communications are controlled at key internal boundaries.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07a.[04]\n171A_3.13.1[f]", "defaultText": null }, { "id": 72681, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590807", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590807", "securityControlId": 31664, "ccis": [], "uuid": "a732e526-2c31-57c5-841b-51a64aab1ae7", "testId": "NET-03_A09", "test": "subnetworks for publicly accessible system components are selected per organization-defined values separated from internal organizational networks.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07b.", "defaultText": null }, { "id": 72682, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590807", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590807", "securityControlId": 31664, "ccis": [], "uuid": "4344da07-ffef-5ad0-920a-368c77ba5812", "testId": "NET-03_A10", "test": "external networks or systems are only connected to through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational cybersecurity / data privacy architecture.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07c.", "defaultText": null }, { "id": 72683, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590807", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590807", "securityControlId": 31664, "ccis": [], "uuid": "00948a66-3563-5832-85ea-553b41eadfe8", "testId": "NET-03_A11", "test": "outgoing communications traffic posing a threat to external systems is detected.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(09)(a)[01]", "defaultText": null }, { "id": 72684, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590807", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590807", "securityControlId": 31664, "ccis": [], "uuid": "58e77d13-1f70-5ebe-accf-4269f68515a0", "testId": "NET-03_A12", "test": "outgoing communications traffic posing a threat to external systems is denied.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(09)(a)[02]", "defaultText": null }, { "id": 72685, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590807", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590807", "securityControlId": 31664, "ccis": [], "uuid": "4b08cb22-165c-56fd-8cda-b0bccc0bda55", "testId": "NET-03_A13", "test": "the identity of internal users associated with denied communications is audited.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(09)(b)", "defaultText": null }, { "id": 72686, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590807", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590808", "securityControlId": 31664, "ccis": [], "uuid": "3dd17bc6-44a0-5f99-9012-a60db9729e99", "testId": "NET-03_A14", "test": "authorized sources of incoming communications to be routed are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(11)_ODP[01]", "defaultText": null }, { "id": 72687, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590808", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590808", "securityControlId": 31664, "ccis": [], "uuid": "fe972fd4-e245-5659-9a44-131930af89e6", "testId": "NET-03_A15", "test": "authorized destinations to which incoming communications from authorized sources may be routed are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(11)_ODP[02]", "defaultText": null }, { "id": 72688, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590808", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590808", "securityControlId": 31664, "ccis": [], "uuid": "8fa989a7-da9e-5aa0-8c18-c305dc31c67c", "testId": "NET-03_A16", "test": "only incoming communications from authorized sources are allowed to be routed to authorized destinations.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(11)", "defaultText": null }, { "id": 72689, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590808", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590808", "securityControlId": 31664, "ccis": [], "uuid": "012d60d3-9e3d-53f0-9c07-225c034852ee", "testId": "NET-03_A17", "test": "one or more of the following is/are selected: physical isolation techniques. logical isolation techniques.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.13.4e_ODP[1]", "defaultText": null }, { "id": 72690, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590808", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590808", "securityControlId": 31664, "ccis": [], "uuid": "fb4af79d-0b22-5c66-87a8-bc9e025ecd98", "testId": "NET-03_A18", "test": "physical isolation techniques are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.13.4e_ODP[2]", "defaultText": null }, { "id": 72691, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590808", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590808", "securityControlId": 31664, "ccis": [], "uuid": "f8adbc92-38fd-5849-82ae-8ca5602c02e2", "testId": "NET-03_A19", "test": "logical isolation techniques are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.13.4e_ODP[3]", "defaultText": null }, { "id": 72692, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590808", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590808", "securityControlId": 31664, "ccis": [], "uuid": "537d9e32-baf4-59ea-a068-9974d15e7176", "testId": "NET-03_A20", "test": "physical isolation techniques and/or organization-defined logical isolation techniques are employed in organizational systems and system components.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.13.4e[a]", "defaultText": null }, { "id": 72693, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590809", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590809", "securityControlId": 31664, "ccis": [], "uuid": "bbd635f7-4b3b-5c97-bcbb-d41ee4fd7217", "testId": "NET-03_A21", "test": "connection requirements are established for mobile devices.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.18.a[03]", "defaultText": null }, { "id": 72694, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590809", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590809", "securityControlId": 31664, "ccis": [], "uuid": "2c5825f9-ae66-5808-83bd-1e35bac1ff8d", "testId": "NET-03_A22", "test": "external system connections are only made through managed interfaces that consist of boundary protection devices arranged in accordance with an organizational security architecture.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.13.01.c", "defaultText": null }, { "id": 72695, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590809", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590809", "securityControlId": 31664, "ccis": [], "uuid": "756b1afb-5cc3-5e82-89a3-3258244ecdd5", "testId": "NET-03_A23", "test": "communications at external managed interfaces to the system are controlled.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.13.01.a[02]", "defaultText": null }, { "id": 72696, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590809", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590809", "securityControlId": 31664, "ccis": [], "uuid": "d10d5e37-b8bd-5794-9052-ce3676b09e8e", "testId": "NET-03_A24", "test": "communications at key internal managed interfaces within the system are controlled.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.13.01.a[04]", "defaultText": null } ], "externalMappings": [ { "id": 586324, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587243", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1cdbb90-5bf1-542a-bab3-171ff9b117eb", "parentControlId": 31664, "controlId": "NET 1.3", "title": "NET 1.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587243" }, { "id": 586325, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587243", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce0a812e-d147-5429-9703-10c56088614f", "parentControlId": 31664, "controlId": "SR 5.2", "title": "SR 5.2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587243" }, { "id": 586326, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587243", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f403b6c1-66d6-5a83-a9d3-fb58a5c6c50a", "parentControlId": 31664, "controlId": "CR 5.2", "title": "CR 5.2", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587243" }, { "id": 586327, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587244", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b57d6d3a-2aa7-5ad5-b17d-d1a86e1be06f", "parentControlId": 31664, "controlId": "NDR 5.2", "title": "NDR 5.2", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587244" }, { "id": 586328, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587244", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5309b920-8818-5500-9e26-f5ad010ab5de", "parentControlId": 31664, "controlId": "8.2", "title": "8.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587244" }, { "id": 586329, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587244", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "910cc85b-c271-5dbb-b893-2a441d483255", "parentControlId": 31664, "controlId": "8.21", "title": "8.21", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587244" }, { "id": 586334, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f943956d-3cd0-50e7-9bac-ed630a43c642", "parentControlId": 31664, "controlId": "T1001", "title": "T1001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587245" }, { "id": 586335, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1cd0696-176c-522e-a7db-f65f705f2676", "parentControlId": 31664, "controlId": "T1001.001", "title": "T1001.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587245" }, { "id": 586336, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d43271e9-b334-5025-bddb-b5ba50095c71", "parentControlId": 31664, "controlId": "T1001.002", "title": "T1001.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587245" }, { "id": 586337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "244e4701-c7e5-56cd-ba88-46e02d4f3263", "parentControlId": 31664, "controlId": "T1001.003", "title": "T1001.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587245" }, { "id": 586338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41384f06-388f-585d-ba31-402a92b6133a", "parentControlId": 31664, "controlId": "T1008", "title": "T1008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587245" }, { "id": 586339, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2af35533-c16f-5156-a2ea-595e982a2009", "parentControlId": 31664, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587245" }, { "id": 586340, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19d5ac6d-0b4b-5316-9ab4-d77b2ed6deec", "parentControlId": 31664, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587245" }, { "id": 586341, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2833612a-59dc-5d9b-804f-47dafacf1de0", "parentControlId": 31664, "controlId": "T1021.002", "title": "T1021.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587246" }, { "id": 586342, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e061821-6dcc-5799-9d50-2ddb83f8f9d2", "parentControlId": 31664, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587246" }, { "id": 586343, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66eee804-80a4-55b0-bcf6-02f0c3d8ae26", "parentControlId": 31664, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587246" }, { "id": 586344, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af67f0d5-7d70-5e21-b506-cfbd950a5697", "parentControlId": 31664, "controlId": "T1021.006", "title": "T1021.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587246" }, { "id": 586345, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2efae4e-da8e-51c4-b42f-6f579f202f7d", "parentControlId": 31664, "controlId": "T1029", "title": "T1029", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587246" }, { "id": 586346, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "264c0938-641d-5b6f-8baf-9e145641b8b0", "parentControlId": 31664, "controlId": "T1030", "title": "T1030", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587246" }, { "id": 586347, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e98b58a-39ad-5a0b-9c1d-ef9a6612798e", "parentControlId": 31664, "controlId": "T1036.008", "title": "T1036.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587246" }, { "id": 586348, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82389f8a-015d-54f8-9d21-92d934990e4f", "parentControlId": 31664, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587246" }, { "id": 586349, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abd20655-4f6c-535f-a4b8-e2421ea9b8ae", "parentControlId": 31664, "controlId": "T1046", "title": "T1046", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587246" }, { "id": 586350, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06932aaf-a4aa-5e57-9b1e-9f467eed6ff2", "parentControlId": 31664, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587247" }, { "id": 586351, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eae31e64-52cd-5a2a-85ae-65b72ad86dbb", "parentControlId": 31664, "controlId": "T1048.001", "title": "T1048.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587247" }, { "id": 586352, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d112757-4278-5a95-9b0b-c7fd108ac7b5", "parentControlId": 31664, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587247" }, { "id": 586353, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89eab41c-2d1b-5043-be99-a43a78867395", "parentControlId": 31664, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587247" }, { "id": 586354, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b52d1ce-3538-54ee-8844-b06a25e99b69", "parentControlId": 31664, "controlId": "T1055", "title": "T1055", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587247" }, { "id": 586355, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee3a3cea-c821-5efc-92af-448f27838c5a", "parentControlId": 31664, "controlId": "T1055.001", "title": "T1055.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587247" }, { "id": 586356, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a1d5e33-948d-5ba2-948c-c6f583fd022c", "parentControlId": 31664, "controlId": "T1055.002", "title": "T1055.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587247" }, { "id": 586357, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "236810ee-9601-54cb-b841-72e38a541d7f", "parentControlId": 31664, "controlId": "T1055.003", "title": "T1055.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587247" }, { "id": 586358, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ad02fe7-073f-55fd-a0d1-b1d4d2860154", "parentControlId": 31664, "controlId": "T1055.004", "title": "T1055.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587247" }, { "id": 586359, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587248", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f6e5201-f076-5e4f-af9b-677036d666e9", "parentControlId": 31664, "controlId": "T1055.005", "title": "T1055.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587248" }, { "id": 586360, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587248", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87a29708-0984-5bc1-89bc-6f01cd204670", "parentControlId": 31664, "controlId": "T1055.008", "title": "T1055.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587248" }, { "id": 586361, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587248", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8240958-3d50-59f7-8461-96920ddcb01e", "parentControlId": 31664, "controlId": "T1055.009", "title": "T1055.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587248" }, { "id": 586362, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587248", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "202ac180-f392-57eb-8702-f97aa5a0510f", "parentControlId": 31664, "controlId": "T1055.011", "title": "T1055.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587248" }, { "id": 586363, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587248", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8858191-37ee-5202-ad98-fd876c284032", "parentControlId": 31664, "controlId": "T1055.012", "title": "T1055.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587248" }, { "id": 586364, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587248", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f2e3956-5b6b-527a-ad62-9e022448f1ec", "parentControlId": 31664, "controlId": "T1055.013", "title": "T1055.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587248" }, { "id": 586365, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587248", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e7d05d6-ed09-5131-be10-854b40b599f2", "parentControlId": 31664, "controlId": "T1055.014", "title": "T1055.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587248" }, { "id": 586366, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6091048-472f-5d1f-bfbc-bdbbc4c47c53", "parentControlId": 31664, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587249" }, { "id": 586367, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83858cb8-6e0b-5f01-b23d-1fae2a8f8042", "parentControlId": 31664, "controlId": "T1071", "title": "T1071", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587249" }, { "id": 586368, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1cc1083c-a0f6-5d23-a564-ff5d64264ebd", "parentControlId": 31664, "controlId": "T1071.001", "title": "T1071.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587249" }, { "id": 586369, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f25ef76f-4d60-5d58-af2e-1c218818a7e6", "parentControlId": 31664, "controlId": "T1071.002", "title": "T1071.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587249" }, { "id": 586370, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d29d4cb-2aad-5b42-883c-508ea6dbc7bf", "parentControlId": 31664, "controlId": "T1071.003", "title": "T1071.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587249" }, { "id": 586371, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1055bc88-4584-5778-bcdc-e7ffa14d94e5", "parentControlId": 31664, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587249" }, { "id": 586372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ddb737db-6fb6-5b30-84d2-79499a692ad1", "parentControlId": 31664, "controlId": "T1071.005", "title": "T1071.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587249" }, { "id": 586373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71e203df-de7b-5a97-9617-fd65ba7d1f4e", "parentControlId": 31664, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587249" }, { "id": 586374, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3685988b-b7ee-527a-ac58-8a4fd239dbce", "parentControlId": 31664, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587249" }, { "id": 586375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74c2df33-2007-50f6-8b83-10691136e175", "parentControlId": 31664, "controlId": "T1080", "title": "T1080", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58725" }, { "id": 586376, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1f69c10-301e-5880-b0e7-9a26e1868444", "parentControlId": 31664, "controlId": "T1090", "title": "T1090", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58725" }, { "id": 586377, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2ecc0e8-32e9-50e1-a27a-032f49a3d0db", "parentControlId": 31664, "controlId": "T1090.001", "title": "T1090.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58725" }, { "id": 586378, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7aa4d0b-0ccb-571d-8918-18328d26fdad", "parentControlId": 31664, "controlId": "T1090.002", "title": "T1090.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58725" }, { "id": 586379, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45925384-b6e6-568f-a7ae-efa0f1045678", "parentControlId": 31664, "controlId": "T1090.003", "title": "T1090.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58725" }, { "id": 586380, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c33627f-2c13-5d35-b40d-3c4b1519e8d9", "parentControlId": 31664, "controlId": "T1095", "title": "T1095", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58725" }, { "id": 586381, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2caf2003-4584-563a-bb1f-c7f34800d134", "parentControlId": 31664, "controlId": "T1098", "title": "T1098", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58725" }, { "id": 586382, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf079dfa-ee2a-5736-b022-6153d049371e", "parentControlId": 31664, "controlId": "T1098.001", "title": "T1098.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58725" }, { "id": 586383, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ead0351-b678-5258-8e9e-29b1c7e320a1", "parentControlId": 31664, "controlId": "T1102", "title": "T1102", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58725" }, { "id": 586384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5bcf7f6-ea11-5d88-b424-c0083f9ab0cf", "parentControlId": 31664, "controlId": "T1102.001", "title": "T1102.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587251" }, { "id": 586385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd2f13d6-c26f-535e-bc96-de5286f498bb", "parentControlId": 31664, "controlId": "T1102.002", "title": "T1102.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587251" }, { "id": 586386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56ac3c3d-a047-5ce6-8d89-2e23a63d93db", "parentControlId": 31664, "controlId": "T1102.003", "title": "T1102.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587251" }, { "id": 586387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59c27bc7-c3a3-5122-b6a4-cabb5d54cd91", "parentControlId": 31664, "controlId": "T1104", "title": "T1104", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587251" }, { "id": 586388, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8368dd31-bea1-5193-ad04-26acd4746c67", "parentControlId": 31664, "controlId": "T1105", "title": "T1105", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587251" }, { "id": 586389, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b4fc4c9-bf11-56cb-ac0d-7ddf1cfe61e0", "parentControlId": 31664, "controlId": "T1114", "title": "T1114", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587251" }, { "id": 586390, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e5938e3-5bb4-5206-8fee-8e0e7998139c", "parentControlId": 31664, "controlId": "T1114.003", "title": "T1114.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587251" }, { "id": 586391, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e2ccb3d-8869-5126-9101-c4fca7e35383", "parentControlId": 31664, "controlId": "T1132", "title": "T1132", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587251" }, { "id": 586392, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed9a28f4-d617-50b0-bff0-93eaf23db1db", "parentControlId": 31664, "controlId": "T1132.001", "title": "T1132.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587252" }, { "id": 586393, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79c73610-47e8-5a3e-a274-2af210c3f487", "parentControlId": 31664, "controlId": "T1132.002", "title": "T1132.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587252" }, { "id": 586394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1efdc9f9-7efe-5ddd-822c-9c28b7824e98", "parentControlId": 31664, "controlId": "T1133", "title": "T1133", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587252" }, { "id": 586395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f22ae42d-4bcc-5620-b153-bfdee36df645", "parentControlId": 31664, "controlId": "T1136", "title": "T1136", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587252" }, { "id": 586396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7cdee434-22d9-5666-a1a7-09ebda8fab9e", "parentControlId": 31664, "controlId": "T1136.002", "title": "T1136.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587252" }, { "id": 586397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9e862d3-e16a-5ac5-aad2-6ff14ad51c60", "parentControlId": 31664, "controlId": "T1136.003", "title": "T1136.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587252" }, { "id": 586398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7c6e88c-712a-563b-a421-ed3cdd5f2969", "parentControlId": 31664, "controlId": "T1176", "title": "T1176", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587252" }, { "id": 586399, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0e0b7a8-3290-5ef9-84b6-6961cdd7521e", "parentControlId": 31664, "controlId": "T1187", "title": "T1187", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587252" }, { "id": 586400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd7d3b9a-fe49-5e89-8c85-89039321f52a", "parentControlId": 31664, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587252" }, { "id": 586401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8758f55f-c303-5d1c-a25d-4d07b289eafe", "parentControlId": 31664, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587252" }, { "id": 586402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9bbe8f66-fd2b-5657-8455-79d52d65d06a", "parentControlId": 31664, "controlId": "T1197", "title": "T1197", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587253" }, { "id": 586403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "722a214f-f594-5622-9b9b-c4108b74d24f", "parentControlId": 31664, "controlId": "T1199", "title": "T1199", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587253" }, { "id": 586404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9a7815a-66e8-5e5a-96ab-7b6bfcd6bd9e", "parentControlId": 31664, "controlId": "T1203", "title": "T1203", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587253" }, { "id": 586405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9aa2bee-b329-5a18-81fc-628cdec619bc", "parentControlId": 31664, "controlId": "T1204", "title": "T1204", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587253" }, { "id": 586406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4cbb04c-d650-597c-855d-f97a49453d08", "parentControlId": 31664, "controlId": "T1204.001", "title": "T1204.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587253" }, { "id": 586407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70d01ecf-4a87-5b0f-9e51-c6306f904486", "parentControlId": 31664, "controlId": "T1204.002", "title": "T1204.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587253" }, { "id": 586408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13e1bc6b-ebda-514b-baf8-806acfdfe30e", "parentControlId": 31664, "controlId": "T1204.003", "title": "T1204.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587253" }, { "id": 586409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1cb70e72-ba28-59f7-a7bf-7c5bb9056215", "parentControlId": 31664, "controlId": "T1205", "title": "T1205", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587253" }, { "id": 586410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa48f80d-cacd-5782-90be-9bc0101e37eb", "parentControlId": 31664, "controlId": "T1205.001", "title": "T1205.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587253" }, { "id": 586411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4733e04e-695e-5eea-be83-8f4902b91786", "parentControlId": 31664, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587254" }, { "id": 586412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93b0c862-c3d6-5ff3-8b66-4f6bec2db81c", "parentControlId": 31664, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587254" }, { "id": 586413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "323e80ab-cb00-5db9-8055-b26cdbc2c4de", "parentControlId": 31664, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587254" }, { "id": 586414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1afa0cf-33e3-5c54-bc21-60a62365c33d", "parentControlId": 31664, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587254" }, { "id": 586415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "606c3cb5-2430-5e3c-b4e9-5613c0990269", "parentControlId": 31664, "controlId": "T1218.012", "title": "T1218.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587254" }, { "id": 586416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae80f86e-f8b3-584a-876b-64a71d8c417a", "parentControlId": 31664, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587254" }, { "id": 586417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d0df2c8-1176-5ed2-8f70-56459de9b462", "parentControlId": 31664, "controlId": "T1219", "title": "T1219", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587254" }, { "id": 586418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a87826d4-88de-52ee-9ec3-bd09ad66be80", "parentControlId": 31664, "controlId": "T1221", "title": "T1221", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587254" }, { "id": 586419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3af6f492-833f-59bd-a524-6805ff080c11", "parentControlId": 31664, "controlId": "T1482", "title": "T1482", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587255" }, { "id": 586420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58af65f8-4a00-5ded-8358-11e4a061fefb", "parentControlId": 31664, "controlId": "T1489", "title": "T1489", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587255" }, { "id": 586421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15d475a1-a88d-5288-9296-a9e4875d9bd5", "parentControlId": 31664, "controlId": "T1498", "title": "T1498", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587255" }, { "id": 586422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "872f1e91-60d5-51d1-a179-31f2d5d217cf", "parentControlId": 31664, "controlId": "T1498.001", "title": "T1498.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587255" }, { "id": 586423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e7b50a9-7396-5937-9990-934e6bb8556e", "parentControlId": 31664, "controlId": "T1498.002", "title": "T1498.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587255" }, { "id": 586424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eefd28cb-4c28-54d8-a4ec-77fdd9fa9b5c", "parentControlId": 31664, "controlId": "T1499", "title": "T1499", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587255" }, { "id": 586425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "849774b9-e1cc-5538-b34e-cdf05a2b33c8", "parentControlId": 31664, "controlId": "T1499.001", "title": "T1499.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587255" }, { "id": 586426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f41b50e7-49b6-5931-a8b6-ced0042916c5", "parentControlId": 31664, "controlId": "T1499.002", "title": "T1499.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587255" }, { "id": 586427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5c2c27a-2a4e-5358-82a6-7e22c28bc3fb", "parentControlId": 31664, "controlId": "T1499.003", "title": "T1499.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587256" }, { "id": 586428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1cfb90c-3dcf-5ff9-ae3f-3a5a308fa774", "parentControlId": 31664, "controlId": "T1499.004", "title": "T1499.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587256" }, { "id": 586429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c7c7e28-33ec-58d1-b02a-278967966958", "parentControlId": 31664, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587256" }, { "id": 586430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c5babb7-9e83-5494-aba1-c1d8b7192ec0", "parentControlId": 31664, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587256" }, { "id": 586431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc01f09d-1174-50fb-b2f9-d172f8beca90", "parentControlId": 31664, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587256" }, { "id": 586432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35e6e5c6-86f5-50a4-83c5-ad6fa591c66b", "parentControlId": 31664, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587256" }, { "id": 586433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7caf67f6-4bfc-5a8a-a3f6-ed5207c964a3", "parentControlId": 31664, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587256" }, { "id": 586434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d38a9b4-c373-54f4-bb8d-5ecebb5ffe5f", "parentControlId": 31664, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587256" }, { "id": 586435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c28c289-5abf-59c1-83f4-d87612e11f16", "parentControlId": 31664, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587256" }, { "id": 586436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "832e6d98-032c-5a6f-bd73-0c373a93a32a", "parentControlId": 31664, "controlId": "T1552.001", "title": "T1552.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587257" }, { "id": 586437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c53ee4a-cfae-5835-9a24-916956a7908c", "parentControlId": 31664, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587257" }, { "id": 586438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f55f5c54-bf42-5e69-8107-3121f0dd73dd", "parentControlId": 31664, "controlId": "T1552.005", "title": "T1552.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587257" }, { "id": 586439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1dd5bc50-e35b-5f2d-9704-89457844fc6d", "parentControlId": 31664, "controlId": "T1552.007", "title": "T1552.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587257" }, { "id": 586440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48683b6b-bee5-5028-8ee4-18b6be7952c4", "parentControlId": 31664, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587257" }, { "id": 586441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2fcfb60-046f-5929-b38e-562eb92b79a8", "parentControlId": 31664, "controlId": "T1557.001", "title": "T1557.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587257" }, { "id": 586442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87247dbb-f546-51fd-a603-64ae8f0b9fa4", "parentControlId": 31664, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587257" }, { "id": 586443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aaf1fd1f-6c95-53ae-b810-2d6d7eed348d", "parentControlId": 31664, "controlId": "T1557.003", "title": "T1557.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587257" }, { "id": 586444, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b465571e-48c6-5bdf-b690-cac3d1ee88c7", "parentControlId": 31664, "controlId": "T1557.004", "title": "T1557.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587258" }, { "id": 586445, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "898c622b-da86-5dce-8759-b88a63509aa9", "parentControlId": 31664, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587258" }, { "id": 586446, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74d60824-9ded-55a5-baa9-35d0dfe03d13", "parentControlId": 31664, "controlId": "T1559.001", "title": "T1559.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587258" }, { "id": 586447, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef945dea-b750-517d-97eb-cdc91d3ac90e", "parentControlId": 31664, "controlId": "T1559.002", "title": "T1559.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587258" }, { "id": 586448, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b14b9a51-c796-5e8b-9a2d-9ccefd0741f3", "parentControlId": 31664, "controlId": "T1560", "title": "T1560", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587258" }, { "id": 586449, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01e9aa4b-bf39-5737-bafc-35fd01c89ab5", "parentControlId": 31664, "controlId": "T1560.001", "title": "T1560.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587258" }, { "id": 586450, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99fd1fd0-5d9a-5fd0-9bb3-59e5980a13aa", "parentControlId": 31664, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587258" }, { "id": 586451, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee78b522-a40c-56f3-a2df-625ac0180b0b", "parentControlId": 31664, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587258" }, { "id": 586452, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c112b62e-ceb3-5dce-8751-cc6b73bcbe5f", "parentControlId": 31664, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587258" }, { "id": 586453, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "366e8e78-1c6a-5a3a-a360-4a39a8585890", "parentControlId": 31664, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587258" }, { "id": 586454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23ebeb76-9663-5a3a-ad80-f56305348f74", "parentControlId": 31664, "controlId": "T1565.003", "title": "T1565.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587259" }, { "id": 586455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "824553d5-b3f3-5027-bee5-fa5866759876", "parentControlId": 31664, "controlId": "T1566", "title": "T1566", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587259" }, { "id": 586456, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06b0d8f2-b416-579a-a0cd-246113334ce5", "parentControlId": 31664, "controlId": "T1566.001", "title": "T1566.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587259" }, { "id": 586457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4b050c6-0d03-5179-82c2-b6e530a2fabc", "parentControlId": 31664, "controlId": "T1566.002", "title": "T1566.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587259" }, { "id": 586458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9983eb60-2c9b-58c1-b221-7f08218962fe", "parentControlId": 31664, "controlId": "T1566.003", "title": "T1566.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587259" }, { "id": 586459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4241c801-8c42-59fe-ae9c-62a59e85b54e", "parentControlId": 31664, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587259" }, { "id": 586460, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4cb706db-ce38-53a2-9df3-f5496b0f8ed0", "parentControlId": 31664, "controlId": "T1567.001", "title": "T1567.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587259" }, { "id": 586461, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34965fc3-35a1-5076-b88d-92488f2edca8", "parentControlId": 31664, "controlId": "T1567.002", "title": "T1567.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587259" }, { "id": 586462, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6549cb7b-be8c-5676-9ac2-022a821be52c", "parentControlId": 31664, "controlId": "T1567.003", "title": "T1567.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587259" }, { "id": 586463, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc618686-adeb-5ca3-94d1-529be7080369", "parentControlId": 31664, "controlId": "T1567.004", "title": "T1567.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58726" }, { "id": 586464, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "019b50c3-af98-5580-92b5-645b97d0404e", "parentControlId": 31664, "controlId": "T1568", "title": "T1568", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58726" }, { "id": 586465, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f44a9ff-f113-5818-b781-3eaba315d4b4", "parentControlId": 31664, "controlId": "T1568.002", "title": "T1568.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58726" }, { "id": 586466, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a40184c-1dbe-5d17-8db0-32e0568be8bf", "parentControlId": 31664, "controlId": "T1570", "title": "T1570", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58726" }, { "id": 586467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad8db185-57a9-55a3-ac1b-952966aae687", "parentControlId": 31664, "controlId": "T1571", "title": "T1571", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58726" }, { "id": 586468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e301542-47ae-54f1-b826-5b70b781d983", "parentControlId": 31664, "controlId": "T1572", "title": "T1572", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58726" }, { "id": 586469, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "504579b1-1ac8-57dd-a006-ecb125711976", "parentControlId": 31664, "controlId": "T1573", "title": "T1573", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58726" }, { "id": 586470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6729b7e-ce39-5403-8e90-2c67ffcd11af", "parentControlId": 31664, "controlId": "T1573.001", "title": "T1573.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58726" }, { "id": 586471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587261", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14cffa9f-b41a-5fcd-a73c-9e90a039457c", "parentControlId": 31664, "controlId": "T1573.002", "title": "T1573.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587261" }, { "id": 586472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587261", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "038f4e3d-0baf-59a1-bff7-3dda9e7b64c4", "parentControlId": 31664, "controlId": "T1590.002", "title": "T1590.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587261" }, { "id": 586473, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587261", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b9cb4a8-503c-5f06-a193-547e413cccd9", "parentControlId": 31664, "controlId": "T1598", "title": "T1598", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587261" }, { "id": 586474, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587261", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "295aa85f-9063-55bc-81b9-8d076bdc77ef", "parentControlId": 31664, "controlId": "T1598.001", "title": "T1598.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587261" }, { "id": 586475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587261", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc97f1ed-f71c-5991-aaf7-0ad90751d12e", "parentControlId": 31664, "controlId": "T1598.002", "title": "T1598.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587261" }, { "id": 586476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587261", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee356116-9e33-5611-bf2a-12dcfc2e8d4b", "parentControlId": 31664, "controlId": "T1598.003", "title": "T1598.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587261" }, { "id": 586477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587261", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d424eef-2650-5345-a9ec-39c6d1a8c689", "parentControlId": 31664, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587261" }, { "id": 586478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587261", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79b82870-fff8-59b9-be74-f43888061bc0", "parentControlId": 31664, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587261" }, { "id": 586479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587261", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15df6367-da35-5f60-a998-63e439d79d94", "parentControlId": 31664, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587261" }, { "id": 586480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "044ebd80-7935-5f08-9129-518b382b31ca", "parentControlId": 31664, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587262" }, { "id": 586481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1596bcde-43e6-52b8-9d39-94c477c74114", "parentControlId": 31664, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587262" }, { "id": 586482, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e7a5ec2-860e-50f1-9d3c-5de51d7937b9", "parentControlId": 31664, "controlId": "T1609", "title": "T1609", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587262" }, { "id": 586483, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "860b601a-774c-5034-8ac5-cbb4e3f99d1a", "parentControlId": 31664, "controlId": "T1610", "title": "T1610", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587262" }, { "id": 586484, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56dabb9b-f514-57c7-b4c7-220953cb5b17", "parentControlId": 31664, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587262" }, { "id": 586485, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ea1e7ae-f5ff-5623-a63f-8464b5ec2e63", "parentControlId": 31664, "controlId": "T1612", "title": "T1612", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587262" }, { "id": 586486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76a37b74-5d30-5253-bfe0-e63acc7edc32", "parentControlId": 31664, "controlId": "T1613", "title": "T1613", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587262" }, { "id": 586487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7be52a73-0751-5f0f-a47a-ae216b9cc343", "parentControlId": 31664, "controlId": "T1622", "title": "T1622", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587262" }, { "id": 586488, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03ef25da-2945-5eaf-9736-4b455fcad24e", "parentControlId": 31664, "controlId": "T1648", "title": "T1648", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587262" }, { "id": 586489, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587262", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86575a6c-33b7-53ca-a3ba-4455197d3b09", "parentControlId": 31664, "controlId": "T1659", "title": "T1659", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587263" }, { "id": 586491, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73733acc-04db-543f-9835-50e98f4c19b8", "parentControlId": 31664, "controlId": "SC-7", "title": "SC-7", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587263" }, { "id": 586492, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb2f6101-3abf-5537-9293-e8b487d3d2a6", "parentControlId": 31664, "controlId": "SC-7(9)", "title": "SC-7(9)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587263" }, { "id": 586493, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7dda69b-709a-5f48-b1d3-e957320c9ec5", "parentControlId": 31664, "controlId": "SC-7(11)", "title": "SC-7(11)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587263" }, { "id": 586494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "116b42a8-71f9-54b3-a633-dd25c0a58fbb", "parentControlId": 31664, "controlId": "SC-07", "title": "SC-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587263" }, { "id": 586495, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c481bef-86ee-58f9-8917-f0768b3e065e", "parentControlId": 31664, "controlId": "SC-07(09)", "title": "SC-07(09)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587263" }, { "id": 586496, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5215f6fc-23bf-537e-8115-7eef6cad6404", "parentControlId": 31664, "controlId": "SC-07(11)", "title": "SC-07(11)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587263" }, { "id": 586499, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587264", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3cd1a9e4-e447-5f2b-9742-7ab7fe796d10", "parentControlId": 31664, "controlId": "SC-07", "title": "SC-07", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587264" }, { "id": 586500, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587264", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1855f44-618f-5756-bf8e-0b446e9b0d70", "parentControlId": 31664, "controlId": "SC-07", "title": "SC-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587264" }, { "id": 586501, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587264", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c862788-897d-5cac-9215-491523db5fed", "parentControlId": 31664, "controlId": "SC-07(09)", "title": "SC-07(09)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587264" }, { "id": 586502, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587264", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "858c9dc7-65e7-5509-99b2-021c5e3cd764", "parentControlId": 31664, "controlId": "SC-07(11)", "title": "SC-07(11)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587264" }, { "id": 586503, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587264", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23e3adae-adeb-55e8-a267-eec48c4de0dc", "parentControlId": 31664, "controlId": "SC-07", "title": "SC-07", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587264" }, { "id": 586504, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587264", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d19239f-1c87-5238-abe4-435447e2d969", "parentControlId": 31664, "controlId": "SC-07", "title": "SC-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587264" }, { "id": 586505, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587264", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20fdc398-0c10-5f5a-9129-105ca5f648bf", "parentControlId": 31664, "controlId": "SC-07", "title": "SC-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587264" }, { "id": 586508, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a06a9d5b-1ce6-5e5c-9219-853c38cdff1f", "parentControlId": 31664, "controlId": "SC-7", "title": "SC-7", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587265" }, { "id": 586509, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2ccf3b1-375a-55b9-903c-9966aa0ea3ff", "parentControlId": 31664, "controlId": "SC-7", "title": "SC-7", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587265" }, { "id": 586510, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e46bdce3-8ed8-52e4-9cc8-d53cd6a232bb", "parentControlId": 31664, "controlId": "SC-7", "title": "SC-7", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587265" }, { "id": 586512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "706a7f70-40cd-5298-85c8-143e097738a5", "parentControlId": 31664, "controlId": "3.13.1", "title": "3.13.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587265" }, { "id": 586513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1463e6d-6c92-5b9b-b39f-d5d5080adc81", "parentControlId": 31664, "controlId": "03.01.12.a", "title": "03.01.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587265" }, { "id": 586514, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6798da1-b866-543c-b6e4-8dd30429ef90", "parentControlId": 31664, "controlId": "03.13.01.a", "title": "03.13.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587265" }, { "id": 586515, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b7459da-6d00-5125-9540-3ce2cc20cd9b", "parentControlId": 31664, "controlId": "03.13.01.b", "title": "03.13.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587266" }, { "id": 586516, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587266", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6006906-06db-56ea-9269-1f33cfc41d29", "parentControlId": 31664, "controlId": "03.13.01.c", "title": "03.13.01.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587266" }, { "id": 586588, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb73457d-aaa5-552f-8d83-bd0f0216ae97", "parentControlId": 31664, "controlId": "CIP-005-7 1.5", "title": "CIP-005-7 1.5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587284" }, { "controlId": "A.3.1.5", "title": "A.3.1.5 — Defense-in-Depth Protective Strategies", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, PL-8, PM-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a1dd3b56-b9c9-5bc2-80d6-1d1476090f4e", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.5 / Sec 3.2", "title": "NEI 08-09 Sec 3.1.5 / Sec 3.2 — Defense-in-Depth Protective Strategies", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6d08cc4b-426b-50dc-81c2-6250810d8a3a", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(2)", "title": "10 CFR 73.54(c)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "47005d25-633c-50e0-9ef6-27ba76a44db3", "isPublic": true }, { "controlId": "B.1.4", "title": "B.1.4 — Information Flow Enforcement", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-4, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "88cdadbe-f65b-50ed-9b93-2151a08d0107", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.4", "title": "NEI 08-09 App D.1.4 — Information Flow Enforcement", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "45f61e76-4daa-5b28-bc59-0af0fb394527", "isPublic": true }, { "controlId": "B.1.18", "title": "B.1.18 — Insecure and Rogue Connections", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, CA-9, SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1e5982fe-98ae-5b7e-ba09-fb1a5e95b795", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.18", "title": "NEI 08-09 App D.1.18 — Insecure and Rogue Connections", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.18", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "5587c0dd-d320-5b3c-8c84-5a19aa4af5da", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.18", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "20f5e3d0-3f4e-5758-9034-012c9ede49fc", "isPublic": true }, { "controlId": "B.1.20", "title": "B.1.20 — Proprietary Protocol Visibility", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-4, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a34fdbeb-d964-50ca-a6fb-9ac9b2ddff0e", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.20", "title": "NEI 08-09 App D.1.20 — Proprietary Protocol Visibility", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.20", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "a2729f7c-329f-5766-a200-c61e10395533", "isPublic": true }, { "controlId": "C.6", "title": "C.6 — Defensive Strategy", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, PL-8, CA-9", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "323fcc62-26f2-5b00-b43a-cf5c32d0e78c", "isPublic": true }, { "controlId": "NEI 08-09 App E.6", "title": "NEI 08-09 App E.6 — Defensive Strategy", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "28bdbf4b-a6d4-55b5-81d5-93a3e9ce087d", "isPublic": true }, { "controlId": "C.7", "title": "C.7 — Defense-in-Depth", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, AC-4, SC-7(21)", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "89e152ce-d8da-5239-a5f6-a6e9897a05d6", "isPublic": true }, { "controlId": "NEI 08-09 App E.7 / RG 1.152 Rev 4", "title": "NEI 08-09 App E.7 / RG 1.152 Rev 4 — Defense-in-Depth", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "5e6f23ad-314f-5e5d-947f-09e4780766c5", "isPublic": true }, { "controlId": "CIP-005-7-R1", "title": "CIP-005-7-R1 — Electronic Security Perimeter Implementation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d80711ff-bf1d-5ee0-ad87-4ff6157954d4", "isPublic": true }, { "controlId": "CIP-005-7-1.1", "title": "CIP-005-7-1.1 — All applicable Cyber Assets connected to a network via a routable protocol shall reside within a defined ESP.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c512323b-d20d-5528-b7a9-b06a249918f1", "isPublic": true }, { "controlId": "CIP-005-7-1.2", "title": "CIP-005-7-1.2 — All External Routable Connectivity must be through an identified Electronic Access Point (EAP).", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2c90b23d-deee-514b-860b-6f6fc2b5f605", "isPublic": true }, { "controlId": "CIP-005-7-1.3", "title": "CIP-005-7-1.3 — Require inbound and outbound access permissions, including the reason for granting access, and deny all other access...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7aef247c-6090-56a3-b98c-d249f3725bd8", "isPublic": true }, { "controlId": "CIP-005-7-1.4", "title": "CIP-005-7-1.4 — Where technically feasible, perform authentication when establishing Dial-up Connectivity with applicable Cyber Assets.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "225630b4-6257-566c-a7e3-997c1fe8f9c6", "isPublic": true }, { "controlId": "CIP-005-7-1.5", "title": "CIP-005-7-1.5 — Have one or more methods for detecting known or suspected malicious communications for both inbound and outbound comm...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b32dc7ac-beb5-5203-9e66-51a2a6e98f2d", "isPublic": true }, { "controlId": "CIP-015-1-R1", "title": "CIP-015-1-R1 — Internal Network Security Monitoring (INSM) Processes", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "86950cf3-9d36-5631-8bd5-004dea6cd853", "isPublic": true }, { "controlId": "CIP-015-1-1.1", "title": "CIP-015-1-1.1 — Implement, using a risk-based rationale, network data feed(s) to monitor network activity", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-015-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5bcab980-cfee-5f15-bd53-caa8d928d5ed", "isPublic": true }, { "controlId": "CIP-015-1-1.2", "title": "CIP-015-1-1.2 — Implement one or more method(s) to detect anomalous network activity using the network data feed(s) from Part 1.1.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-015-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "905a3f43-8005-58c5-a55c-6df63c70bbf2", "isPublic": true }, { "controlId": "CIP-015-1-1.3", "title": "CIP-015-1-1.3 — Implement one or more method(s) to evaluate anomalous network activity detected in Part 1.2", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-015-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "fb76a1a5-0a38-5d94-aff3-e1c256ea91b2", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d3ada0a3-8844-5fcb-96fb-92c44f5e890e", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "4a457934-aa41-5d13-b954-f6de8257a001", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "3276044f-0af5-517a-aea4-26940fc6cd2b", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "46a3d7ce-5f5f-583d-bfda-b5d326445d33", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "a54dcf5d-8d99-566c-82df-bee663d15ebc", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "b9aa3868-32e8-5591-acf5-99f2c23ef2ad", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "210abbd6-eb8c-5782-b7cd-09863ffd948a", "isPublic": true } ], "id": 31664, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731196", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731196", "catalogueId": 1062, "uuid": "b6b22608-9683-533b-8220-4579550e178d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization monitor and control communications at the external network boundary and at key internal boundaries within the network?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Boundary Protection", "description": "

Control Description

Mechanisms exist to monitor and control communications at the external network boundary and at key internal boundaries within the network.

Evidence Request List (ERL)

E-NET-08\nE-NET-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ SBC enforce network activity monitoring and control communications at the external network boundary and at key internal boundaries within the network.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to monitor and control communications at the external network boundary and at key internal boundaries within the network.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.5, B.1.4, B.1.18, B.1.20, C.6, C.7
NERC-CIP (2026) Requirements: CIP-005-7-R1, CIP-015-1-R1", "controlId": "NET-03", "family": "Network Security", "enhancements": "", "sortId": "NET-03", "references": "

Micro-Small Business (<10 staff)

∙ Firewall as boundary protection device

Small Business (10-49 staff)

∙ Business-grade firewall (e.g., Cisco Meraki, pfSense)\n∙ DMZ for public-facing services

Medium Business (50-249 staff)

∙ NGFW boundary protection\n∙ DMZ architecture\n∙ IDS/IPS at perimeter

Large Business (250-999 staff)

∙ Enterprise NGFW with IPS\n∙ DMZ design\n∙ Network segmentation\n∙ Perimeter monitoring

Enterprise (>1,000 staff)

∙ Enterprise perimeter security\n∙ NGFW, IPS, DMZ\n∙ Zero-trust perimeter\n∙ Continuous boundary monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72697, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590809", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590809", "securityControlId": 31665, "ccis": [], "uuid": "00028da5-7cfd-5453-97c9-f73a440549ce", "testId": "NET-03.1_A01", "test": "the number of external network connections to the system is limited.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(03)", "defaultText": null } ], "externalMappings": [ { "id": 586727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6dd1771-274f-546e-8546-7f0141a9af29", "parentControlId": 31665, "controlId": "SC-7(3)", "title": "SC-7(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587302" }, { "id": 586728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a120f52c-c83b-5cbf-a510-4f1cccb07fee", "parentControlId": 31665, "controlId": "SC-07(03)", "title": "SC-07(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587302" }, { "id": 586729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7af58b71-77d8-55b6-acb5-bcaa1de04490", "parentControlId": 31665, "controlId": "SI-04(25)", "title": "SI-04(25)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587303" }, { "id": 586731, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "101070db-deda-5ad1-82ec-7485172a8444", "parentControlId": 31665, "controlId": "SC-07(03)", "title": "SC-07(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587303" }, { "id": 586732, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1b8dd15-e501-5f43-a836-1cdb409ed15a", "parentControlId": 31665, "controlId": "SC-07(03)", "title": "SC-07(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587303" }, { "id": 586733, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78074b1f-08a2-5a21-a61f-4efe27951d88", "parentControlId": 31665, "controlId": "SI-04(25)", "title": "SI-04(25)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587303" }, { "id": 586734, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f70b68ec-ec78-5325-bce9-5b7984c081ef", "parentControlId": 31665, "controlId": "SC-07(03)", "title": "SC-07(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587303" }, { "id": 586735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80e113aa-ca41-54cf-af84-5775e4d91ae4", "parentControlId": 31665, "controlId": "SC-07(03)", "title": "SC-07(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587303" }, { "id": 586737, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e150414-52e4-58ec-8f00-fbeb7afe622a", "parentControlId": 31665, "controlId": "NFO - SC-7(3)", "title": "NFO - SC-7(3)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587304" }, { "controlId": "B.1.4", "title": "B.1.4 — Information Flow Enforcement", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-4, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "0d24a935-f23a-5023-b5e6-0efd6d2ef4c0", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.4", "title": "NEI 08-09 App D.1.4 — Information Flow Enforcement", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "04acc96b-3c21-5e40-939b-6e6f03528aee", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(2)", "title": "10 CFR 73.54(c)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "b97a5f2b-03d7-5ad0-b4f6-348a649c462a", "isPublic": true }, { "controlId": "C.7", "title": "C.7 — Defense-in-Depth", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, AC-4, SC-7(21)", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "5ea1ff55-de80-5963-bf7e-1b3a4808a233", "isPublic": true }, { "controlId": "NEI 08-09 App E.7 / RG 1.152 Rev 4", "title": "NEI 08-09 App E.7 / RG 1.152 Rev 4 — Defense-in-Depth", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "02cf0581-62f6-5a62-8c8b-d96a6d2076cd", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "5a1b9fc5-b3e8-59c8-9533-d1287f58c426", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "6b376a13-083b-5c21-8c1d-3c41513befbb", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "678edef3-f1c8-509c-b66d-3ca051eaf993", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "1c093382-2329-5474-85d4-4bdd8abb8aff", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "5aa496c0-ede0-5457-a323-89cc6ccd0526", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "ce16ece5-272f-59ad-87d3-343a1404b763", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "b8be957a-f59a-55fb-9ad3-8331f6b1e978", "isPublic": true } ], "id": 31665, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731196", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731196", "catalogueId": 1062, "uuid": "c218a920-d5f5-5b4b-af3e-810e1ec6bbd8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization limit the number of concurrent external network connections to its Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Limit Network Connections", "description": "

Control Description

Mechanisms exist to limit the number of concurrent external network connections to its Technology Assets, Applications and/or Services (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to limit the number of concurrent external network connections to its Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.4, C.7", "controlId": "NET-03.1", "family": "Network Security", "enhancements": "", "sortId": "NET-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Firewall rules to limit inbound/outbound connections

Small Business (10-49 staff)

∙ Firewall rules limiting connections to business need\n∙ Deny-by-default policy

Medium Business (50-249 staff)

∙ Formal network connection policy\n∙ Firewall rule review process\n∙ Least-privilege network access

Large Business (250-999 staff)

∙ Enterprise firewall management\n∙ Automated firewall rule review\n∙ Network access control (NAC)

Enterprise (>1,000 staff)

∙ Enterprise firewall management platform (e.g., Tufin, FireMon)\n∙ Zero-trust network access (ZTNA)\n∙ Automated rule optimization", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72698, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59081", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59081", "securityControlId": 31666, "ccis": [], "uuid": "6ace8043-4f5e-5b36-ab0f-877aa3a201be", "testId": "NET-03.2_A01", "test": "the frequency at which to review exceptions to traffic flow policy is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least every 180 days or whenever there is a change in the threat environment that warrants a review of the exceptions", "otherId": "53A_R5_SC-07(04)_ODP", "defaultText": null }, { "id": 72699, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59081", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59081", "securityControlId": 31666, "ccis": [], "uuid": "d0c79e1a-ba5d-596a-830e-9976b7fe8b39", "testId": "NET-03.2_A02", "test": "a managed interface is implemented for each external telecommunication service.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(04)(a)", "defaultText": null }, { "id": 72700, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59081", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59081", "securityControlId": 31666, "ccis": [], "uuid": "e1c9fc55-fdcc-5479-92ec-b2c85d633959", "testId": "NET-03.2_A03", "test": "a traffic flow policy is established for each managed interface.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(04)(b)", "defaultText": null }, { "id": 72701, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59081", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59081", "securityControlId": 31666, "ccis": [], "uuid": "21abee7e-3ff1-5e34-8813-fee12c6a12f9", "testId": "NET-03.2_A04", "test": "the confidentiality of the information being transmitted across each interface is protected.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(04)(c)[01]", "defaultText": null }, { "id": 72702, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59081", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59081", "securityControlId": 31666, "ccis": [], "uuid": "9c052e45-1fd7-508e-99b7-98ce0e20ee37", "testId": "NET-03.2_A05", "test": "the integrity of the information being transmitted across each interface is protected.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(04)(c)[02]", "defaultText": null }, { "id": 72703, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590811", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590811", "securityControlId": 31666, "ccis": [], "uuid": "dbf54f17-27c2-5056-ae87-ae580dbe2853", "testId": "NET-03.2_A06", "test": "each exception to the traffic flow policy is documented with a supporting mission or business need and duration of that need.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(04)(d)", "defaultText": null }, { "id": 72704, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590811", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590811", "securityControlId": 31666, "ccis": [], "uuid": "ec2beb80-701c-5aa2-b2ef-0a04187e8290", "testId": "NET-03.2_A07", "test": "exceptions to the traffic flow policy are reviewed frequently.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least every 180 days or whenever there is a change in the threat environment that warrants a review of the exceptions", "otherId": "53A_R5_SC-07(04)(e)[01]", "defaultText": null }, { "id": 72705, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590811", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590811", "securityControlId": 31666, "ccis": [], "uuid": "37796148-368f-5932-8fc3-3bc03298e258", "testId": "NET-03.2_A08", "test": "exceptions to the traffic flow policy that are no longer supported by an explicit mission or business need are removed.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(04)(e)[02]", "defaultText": null }, { "id": 72706, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590811", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590811", "securityControlId": 31666, "ccis": [], "uuid": "3abd7ea4-555b-5080-a5b8-40418ffed791", "testId": "NET-03.2_A09", "test": "unauthorized exchanges of control plan traffic with external networks are prevented.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(04)(f)", "defaultText": null }, { "id": 72707, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590811", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590811", "securityControlId": 31666, "ccis": [], "uuid": "6cc6f249-1e84-5532-a8ca-cdbf22f0bfba", "testId": "NET-03.2_A10", "test": "information is published to enable remote networks to detect unauthorized control plane traffic from internal networks.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(04)(g)", "defaultText": null }, { "id": 72708, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590811", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590811", "securityControlId": 31666, "ccis": [], "uuid": "5550f20b-018e-5525-ad91-dbd1b53bd639", "testId": "NET-03.2_A11", "test": "unauthorized control plane traffic is filtered from external networks.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(04)(h)", "defaultText": null }, { "id": 72709, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590812", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590812", "securityControlId": 31666, "ccis": [], "uuid": "855f8978-14e4-54f9-8526-b8b3e9e63102", "testId": "NET-03.2_A12", "test": "outgoing communications traffic posing a threat to external systems is detected.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(09)(a)[01]", "defaultText": null }, { "id": 72710, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590812", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590812", "securityControlId": 31666, "ccis": [], "uuid": "0174175e-b209-5237-9c30-b8445b3f52ce", "testId": "NET-03.2_A13", "test": "outgoing communications traffic posing a threat to external systems is denied.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(09)(a)[02]", "defaultText": null }, { "id": 72711, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590812", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590812", "securityControlId": 31666, "ccis": [], "uuid": "409d321b-aa2d-5602-82b8-eec159d9480a", "testId": "NET-03.2_A14", "test": "the identity of internal users associated with denied communications is audited.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(09)(b)", "defaultText": null } ], "externalMappings": [ { "id": 586765, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca694e2f-1881-5d26-a0a3-83becc16773c", "parentControlId": 31666, "controlId": "SC-7(4)", "title": "SC-7(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587308" }, { "id": 586766, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4ff6c64-4e81-58e6-a9be-89349112e4d2", "parentControlId": 31666, "controlId": "SC-7(9)", "title": "SC-7(9)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587308" }, { "id": 586767, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "776c4942-bf6e-5445-9ef3-2df1c4f48c29", "parentControlId": 31666, "controlId": "SC-07(04)", "title": "SC-07(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587308" }, { "id": 586768, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c7107ae-a22f-56de-af88-e4e57bc81783", "parentControlId": 31666, "controlId": "SC-07(09)", "title": "SC-07(09)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587308" }, { "id": 586770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3c55688-4815-553c-b4ad-65f3341d04b8", "parentControlId": 31666, "controlId": "SC-07(04)", "title": "SC-07(04)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587308" }, { "id": 586771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a85ed76c-cf79-55aa-99cc-cf67946ac307", "parentControlId": 31666, "controlId": "SC-07(04)", "title": "SC-07(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587309" }, { "id": 586772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38b77703-3770-59c1-90fe-bb37c51f7170", "parentControlId": 31666, "controlId": "SC-07(09)", "title": "SC-07(09)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587309" }, { "id": 586773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe9c58ff-efc0-5426-9431-80149b15a68f", "parentControlId": 31666, "controlId": "SC-07(04)", "title": "SC-07(04)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587309" }, { "id": 586774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ea37bfe-b773-5557-8a7f-51d9b4e06648", "parentControlId": 31666, "controlId": "SC-07(04)", "title": "SC-07(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587309" }, { "id": 586775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "110da8e1-6cb8-551c-9772-33e45b242ce1", "parentControlId": 31666, "controlId": "NFO - SC-7(4)", "title": "NFO - SC-7(4)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587309" }, { "id": 586800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffc8cd98-01a8-574e-9f4d-8b5c826083a0", "parentControlId": 31666, "controlId": "12-2.a", "title": "12-2.a", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587313" } ], "id": 31666, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731196", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731196", "catalogueId": 1062, "uuid": "bb279aea-a882-5f09-8729-e176494d924b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain a managed interface for each external telecommunication service that protects the confidentiality and integrity of the information being transmitted across each interface?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "External Telecommunications Services", "description": "

Control Description

Mechanisms exist to maintain a managed interface for each external telecommunication service that protects the confidentiality and integrity of the information being transmitted across each interface.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to maintain a managed interface for each external telecommunication service that protects the confidentiality and integrity of the information being transmitted across each interface.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-03.2", "family": "Network Security", "enhancements": "", "sortId": "NET-03.2", "references": "

Micro-Small Business (<10 staff)

∙ Document external telecom services and provider contacts

Small Business (10-49 staff)

∙ External telecom service inventory\n∙ SLA requirements in provider agreements

Medium Business (50-249 staff)

∙ Formal external telecom management policy\n∙ Provider security requirements\n∙ Redundant connections

Large Business (250-999 staff)

∙ Telecommunications governance program\n∙ Redundant ISP connections\n∙ Provider SLA monitoring

Enterprise (>1,000 staff)

∙ Enterprise telecom governance framework\n∙ Redundant multi-provider architecture\n∙ Automated failover\n∙ Provider security assessments", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72712, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590812", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590812", "securityControlId": 31667, "ccis": [], "uuid": "27df51e6-78b1-5240-b9a1-aec6b323cdfe", "testId": "NET-03.3_A01", "test": "the discovery of specific system components that represent a managed interface is prevented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(16)", "defaultText": null } ], "externalMappings": [ { "id": 586806, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bba53061-0c78-5588-a43a-c3bb1b7548a2", "parentControlId": 31667, "controlId": "8.12", "title": "8.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587314" }, { "id": 586808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a36b5bc-b6c3-5ea0-96de-2abe5d4361bf", "parentControlId": 31667, "controlId": "T1590.001", "title": "T1590.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587314" }, { "id": 586809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "686f1d0e-dbe4-5680-b791-f876dbb134e9", "parentControlId": 31667, "controlId": "T1590.003", "title": "T1590.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587314" }, { "id": 586810, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df85fe83-ba25-5c6b-92cb-6809c2cb3aac", "parentControlId": 31667, "controlId": "T1590.004", "title": "T1590.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587314" }, { "id": 586811, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "feb88fa2-62ca-50e3-9b04-fa01ceb40283", "parentControlId": 31667, "controlId": "T1590.005", "title": "T1590.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587314" }, { "id": 586812, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f36945b-5233-506f-b637-be183b959139", "parentControlId": 31667, "controlId": "T1590.006", "title": "T1590.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587314" }, { "id": 586813, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c07020f-8052-50d8-b7aa-1909de13946c", "parentControlId": 31667, "controlId": "T1592", "title": "T1592", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587315" }, { "id": 586814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6be4892-1f6e-57e3-b571-d0dfba3c8877", "parentControlId": 31667, "controlId": "T1592.001", "title": "T1592.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587315" }, { "id": 586815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93dd4c9e-8d26-5b08-8fda-b143eb252e67", "parentControlId": 31667, "controlId": "T1592.002", "title": "T1592.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587315" }, { "id": 586816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a241e49a-860f-5266-86cc-234f13fd6351", "parentControlId": 31667, "controlId": "T1592.003", "title": "T1592.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587315" }, { "id": 586817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ddb928c2-9d13-53fe-8ba0-60500b62945e", "parentControlId": 31667, "controlId": "T1592.004", "title": "T1592.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587315" }, { "id": 586818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ac2803f-f96c-5355-9b5a-ceda8ed2edbc", "parentControlId": 31667, "controlId": "SC-7(16)", "title": "SC-7(16)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587316" }, { "id": 586819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78df3b4f-39b2-528c-918b-91b256541232", "parentControlId": 31667, "controlId": "SC-07(16)", "title": "SC-07(16)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587316" }, { "id": 586820, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587316", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d1b9635-768f-58f7-a6b4-d363d87b2200", "parentControlId": 31667, "controlId": "SC-07(16)", "title": "SC-07(16)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587316" } ], "id": 31667, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731197", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731197", "catalogueId": 1062, "uuid": "d809d82d-8f54-5f7d-a451-3adf627b26f7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prevent the public disclosure of internal network information?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Prevent Discovery of Internal Information", "description": "

Control Description

Mechanisms exist to prevent the public disclosure of internal network information.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to prevent the public disclosure of internal network information.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-03.3", "family": "Network Security", "enhancements": "", "sortId": "NET-03.3", "references": "

Micro-Small Business (<10 staff)

∙ Configure firewall to block external probing of internal network info

Small Business (10-49 staff)

∙ Firewall rules preventing internal network enumeration\n∙ Disable unnecessary banners

Medium Business (50-249 staff)

∙ Network hardening to prevent internal network discovery\n∙ OSINT monitoring for leaked network info

Large Business (250-999 staff)

∙ Network obfuscation controls\n∙ Active response to network scanning\n∙ Firewall rules blocking enumeration

Enterprise (>1,000 staff)

∙ Enterprise network obfuscation and deception (e.g., deception technology)\n∙ Automated blocking of reconnaissance\n∙ Network information leakage monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72713, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590813", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590813", "securityControlId": 31668, "ccis": [], "uuid": "edc711a9-d12d-59c9-bdd3-a27016d6c63c", "testId": "NET-03.4_A01", "test": "processing rules for systems that process Personal Data (PD) are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(24)_ODP", "defaultText": null }, { "id": 72714, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590813", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590813", "securityControlId": 31668, "ccis": [], "uuid": "6cf2167e-60f4-5183-8451-673c1976075b", "testId": "NET-03.4_A02", "test": "processing rules are applied to data elements of Personal Data (PD) on systems that process Personal Data (PD).
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(24)(a)", "defaultText": null }, { "id": 72715, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590813", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590813", "securityControlId": 31668, "ccis": [], "uuid": "82f0c4a7-53e2-5484-abb2-8a694ef2ccbd", "testId": "NET-03.4_A03", "test": "permitted processing is monitored at the external interfaces to the systems that process Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(24)(b)[01]", "defaultText": null }, { "id": 72716, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590813", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590813", "securityControlId": 31668, "ccis": [], "uuid": "bcada0f2-c9f9-58ed-acb4-561dc197f1e2", "testId": "NET-03.4_A04", "test": "permitted processing is monitored at key internal boundaries within the systems that process Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(24)(b)[02]", "defaultText": null }, { "id": 72717, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590813", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590813", "securityControlId": 31668, "ccis": [], "uuid": "fc5cd19b-482c-5aa4-b1d9-c6d349352c4a", "testId": "NET-03.4_A05", "test": "each processing exception is documented for systems that process Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(24)(c)", "defaultText": null }, { "id": 72718, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590814", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590814", "securityControlId": 31668, "ccis": [], "uuid": "57f56506-8f8e-5a0a-bf4f-615bfda96cc2", "testId": "NET-03.4_A06", "test": "exceptions for systems that process Personal Data (PD) are reviewed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(24)(d)[01]", "defaultText": null }, { "id": 72719, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590814", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590814", "securityControlId": 31668, "ccis": [], "uuid": "53fc2a6a-89f6-5063-8854-be729c396058", "testId": "NET-03.4_A07", "test": "exceptions for systems that process Personal Data (PD) that are no longer supported are removed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(24)(d)[02]", "defaultText": null } ], "externalMappings": [ { "id": 586828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e694691a-6cac-5be7-ab8d-bdc1cf70f9cf", "parentControlId": 31668, "controlId": "SC-07(24)", "title": "SC-07(24)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587317" }, { "id": 586830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587317", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f11d8cb-4877-5331-8024-614372fdcab1", "parentControlId": 31668, "controlId": "SC-07(24)", "title": "SC-07(24)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587317" } ], "id": 31668, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731197", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731197", "catalogueId": 1062, "uuid": "0b50f288-9888-5043-9b4c-4ea6993431ae", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization apply network-based processing rules to data elements of Personal Data (PD)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Personal Data (PD)", "description": "

Control Description

Mechanisms exist to apply network-based processing rules to data elements of Personal Data (PD).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to apply network-based processing rules to data elements of Personal Data (PD).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-03.4", "family": "Network Security", "enhancements": "", "sortId": "NET-03.4", "references": "

Micro-Small Business (<10 staff)

∙ Basic firewall\n∙ Network security policy

Small Business (10-49 staff)

∙ Small business firewall (e.g., Cisco Meraki)\n∙ Network security policy

Medium Business (50-249 staff)

∙ Data Loss Prevention (DLP)

Large Business (250-999 staff)

∙ Data Loss Prevention (DLP)

Enterprise (>1,000 staff)

∙ Data Loss Prevention (DLP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72720, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590814", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590814", "securityControlId": 31669, "ccis": [], "uuid": "0ff9efdd-5f6a-5c40-8645-2087a3e6abfa", "testId": "NET-03.5_A01", "test": "the exfiltration of information is prevented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(10)(a)", "defaultText": null }, { "id": 72721, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590814", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590814", "securityControlId": 31669, "ccis": [], "uuid": "9bad8173-6fd1-5064-882b-147a2e5cd273", "testId": "NET-03.5_A02", "test": "the frequency for conducting exfiltration tests is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(10)_ODP", "defaultText": null }, { "id": 72722, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590814", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590814", "securityControlId": 31669, "ccis": [], "uuid": "b3232a87-2c10-509a-98be-3b6bd7e14dad", "testId": "NET-03.5_A03", "test": "exfiltration tests are conducted per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(10)(b)", "defaultText": null } ], "externalMappings": [ { "id": 586838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f47dc2ff-0f50-5cbe-af3f-175cd3791d21", "parentControlId": 31669, "controlId": "8.12", "title": "8.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587318" }, { "id": 586840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15301164-34ce-55b3-bb04-385f39a7b119", "parentControlId": 31669, "controlId": "SC-7(10)", "title": "SC-7(10)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587319" }, { "id": 586841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9aa7713e-ab65-5581-b27f-1c3d7b0a89e8", "parentControlId": 31669, "controlId": "SC-07(10)", "title": "SC-07(10)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587319" }, { "id": 586843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b03216bb-0bb4-5fb1-87e2-6b3e13705685", "parentControlId": 31669, "controlId": "SC-07(10)", "title": "SC-07(10)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587319" }, { "id": 586852, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58732", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8dc67214-082c-522e-99f1-c4a7f48d1d6d", "parentControlId": 31669, "controlId": "ARCHITECTURE-5f", "title": "ARCHITECTURE-5f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58732" } ], "id": 31669, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731197", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731197", "catalogueId": 1062, "uuid": "c9b1253c-f479-599e-87e9-0582b94d9e0e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to prevent the unauthorized exfiltration of sensitive/regulated data across managed interfaces?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Prevent Unauthorized Exfiltration", "description": "

Control Description

Automated mechanisms exist to prevent the unauthorized exfiltration of sensitive/regulated data across managed interfaces.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to automatically prevent the unauthorized exfiltration of sensitive/regulated data across managed interfaces.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-03.5", "family": "Network Security", "enhancements": "", "sortId": "NET-03.5", "references": "

Micro-Small Business (<10 staff)

∙ Basic firewall\n∙ Network security policy

Small Business (10-49 staff)

∙ Small business firewall (e.g., Cisco Meraki)\n∙ Network security policy

Medium Business (50-249 staff)

∙ Data Loss Prevention (DLP)

Large Business (250-999 staff)

∙ Data Loss Prevention (DLP)

Enterprise (>1,000 staff)

∙ Data Loss Prevention (DLP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72723, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590815", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590815", "securityControlId": 31670, "ccis": [], "uuid": "e8888760-09a7-5720-9d78-0656d0a8886f", "testId": "NET-03.6_A01", "test": "system components to be dynamically isolated from other system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(20)_ODP", "defaultText": null }, { "id": 72724, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590815", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590815", "securityControlId": 31670, "ccis": [], "uuid": "1bc5ee34-b43a-59a1-aaeb-a785320fe66f", "testId": "NET-03.6_A02", "test": "the capability to dynamically isolate organization-defined system components from other system components is provided.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(20)", "defaultText": null } ], "externalMappings": [ { "id": 586863, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fd07756-9adf-5a20-bab4-763ffa58f4ec", "parentControlId": 31670, "controlId": "SC-7(20)", "title": "SC-7(20)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587322" }, { "id": 586864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7420d48-1ed6-5bc0-bff8-b55c4adc7b9e", "parentControlId": 31670, "controlId": "SC-07(20)", "title": "SC-07(20)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587322" }, { "id": 586865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f060b884-867c-5f67-bbee-b87cf44da281", "parentControlId": 31670, "controlId": "SC-07(20)", "title": "SC-07(20)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587322" }, { "id": 586867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587323", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d677506-6a8d-5809-a1f6-4c41b07b560e", "parentControlId": 31670, "controlId": "ARCHITECTURE-2l", "title": "ARCHITECTURE-2l", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587323" } ], "id": 31670, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731198", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731198", "catalogueId": 1062, "uuid": "35dd659a-5e41-5d0a-8496-6bbb8f911259", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to dynamically isolate (e.g., sandbox) untrusted components during runtime, where the component is isolated in a fault-contained environment but it can still collaborate with the application?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Dynamic Isolation & Segregation (Sandboxing)", "description": "

Control Description

Automated mechanisms exist to dynamically isolate (e.g., sandbox) untrusted components during runtime, where the component is isolated in a fault-contained environment but it can still collaborate with the application.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to automatically dynamically isolate (e.g., sandbox) untrusted components during runtime, where the component is isolated in a fault-contained environment but it can still collaborate with the application.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-03.6", "family": "Network Security", "enhancements": "", "sortId": "NET-03.6", "references": "

Micro-Small Business (<10 staff)

∙ Use sandbox environment for testing suspicious files/code

Small Business (10-49 staff)

∙ Sandbox analysis tool (e.g., Any.run, free tiers)\n∙ Isolation policy for suspicious activity

Medium Business (50-249 staff)

∙ Dynamic sandboxing solution (e.g., Cuckoo Sandbox)\n∙ Network isolation for suspected threats

Large Business (250-999 staff)

∙ Enterprise sandbox platform (e.g., Palo Alto WildFire, Cisco Threat Grid)\n∙ Automated isolation workflows

Enterprise (>1,000 staff)

∙ Enterprise sandboxing and dynamic isolation platform\n∙ Automated containment via SOAR\n∙ Network quarantine capabilities", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72725, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590815", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590815", "securityControlId": 31671, "ccis": [], "uuid": "2606e24a-b43f-5751-bec5-fa7cb86a1766", "testId": "NET-03.7_A01", "test": "system components to be isolated by boundary protection mechanisms are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(21)_ODP[01]", "defaultText": null }, { "id": 72726, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590815", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590815", "securityControlId": 31671, "ccis": [], "uuid": "6151a344-629c-5790-9072-d1f25e0f72f0", "testId": "NET-03.7_A02", "test": "boundary protection mechanisms are employed to isolate system components supporting missions and/or business functions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(21)", "defaultText": null }, { "id": 72727, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590816", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590816", "securityControlId": 31671, "ccis": [], "uuid": "71ed9922-f4e5-5ec9-876f-fb1076609bde", "testId": "NET-03.7_A03", "test": "missions and/or business functions to be supported by system components isolated by boundary protection mechanisms are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(21)_ODP[02]", "defaultText": null }, { "id": 72728, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590816", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590816", "securityControlId": 31671, "ccis": [], "uuid": "c3d19b3e-35c6-5b5d-bfe9-6f1769464f4f", "testId": "NET-03.7_A04", "test": "physical isolation techniques are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.13.4e_ODP[2]\n172A_3.13.4e_ODP[1]", "defaultText": null }, { "id": 72729, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590816", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590816", "securityControlId": 31671, "ccis": [], "uuid": "2c654316-5bbb-5044-96f0-4d458ca976c6", "testId": "NET-03.7_A05", "test": "logical isolation techniques are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.13.4e_ODP[3]\n172A_3.13.4e_ODP[1]", "defaultText": null }, { "id": 72730, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590816", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590816", "securityControlId": 31671, "ccis": [], "uuid": "c0b96383-4009-58cc-b29a-a00fd4fcf194", "testId": "NET-03.7_A06", "test": "physical isolation techniques and/or organization-defined logical isolation techniques are employed in organizational systems and system components.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.13.4e[a]", "defaultText": null } ], "externalMappings": [ { "id": 586873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587324", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bcf0e9ff-e4a4-5394-a71f-36a6dad020b0", "parentControlId": 31671, "controlId": "NET 1.3", "title": "NET 1.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587324" }, { "id": 586874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587324", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da93fcc9-928a-5fa9-819e-e98f70be2b5a", "parentControlId": 31671, "controlId": "NET 1.7", "title": "NET 1.7", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587324" }, { "id": 586875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587324", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "958c3838-32ab-5327-9bb8-bded8c1d5b32", "parentControlId": 31671, "controlId": "SC-7(21)", "title": "SC-7(21)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587324" }, { "id": 586876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587324", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cae4666b-6a00-5ad4-8fa5-2ced5aee9efa", "parentControlId": 31671, "controlId": "SC-07(21)", "title": "SC-07(21)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587324" }, { "id": 586877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587324", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "702f2791-ab3d-5488-834d-b31a42edb8df", "parentControlId": 31671, "controlId": "SC-07(21)", "title": "SC-07(21)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587324" }, { "id": 586878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587324", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d001887-b2cb-5622-8cc4-8f36f9e869ee", "parentControlId": 31671, "controlId": "SC-07(21)", "title": "SC-07(21)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587324" }, { "id": 586879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587325", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7a9f574-781e-594b-a73e-aa67ba993ab1", "parentControlId": 31671, "controlId": "SC-07(21)", "title": "SC-07(21)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587325" } ], "id": 31671, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731198", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731198", "catalogueId": 1062, "uuid": "bf47573c-c3e8-5cca-8561-8a372c0f740c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization employ boundary protections to isolate Technology Assets, Applications and/or Services (TAAS) that support critical missions and/or business functions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Isolation of System Components", "description": "

Control Description

Mechanisms exist to employ boundary protections to isolate Technology Assets, Applications and/or Services (TAAS) that support critical missions and/or business functions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to employ boundary protections to isolate Technology Assets, Applications and/or Services (TAAS) that support critical missions and/or business functions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-03.7", "family": "Network Security", "enhancements": "", "sortId": "NET-03.7", "references": "

Micro-Small Business (<10 staff)

∙ Use VLANs or separate physical networks for sensitive systems

Small Business (10-49 staff)

∙ VLAN segmentation for critical systems\n∙ Network isolation policy

Medium Business (50-249 staff)

∙ Network segmentation with VLANs\n∙ Isolated segments for sensitive systems\n∙ Inter-VLAN firewall rules

Large Business (250-999 staff)

∙ Enterprise network segmentation program\n∙ Microsegmentation for sensitive workloads\n∙ SDN-based isolation

Enterprise (>1,000 staff)

∙ Enterprise microsegmentation platform (e.g., Illumio, VMware NSX)\n∙ Zero-trust workload isolation\n∙ Automated policy enforcement", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72731, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590816", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590816", "securityControlId": 31672, "ccis": [], "uuid": "db754b9f-fd08-55a6-9cc6-41a9d65ebd23", "testId": "NET-03.8_A01", "test": "separate network addresses are implemented to connect to systems in different security domains.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(22)", "defaultText": null }, { "id": 72732, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590816", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590816", "securityControlId": 31672, "ccis": [], "uuid": "3b9a96f2-05b9-5b22-826d-f6cbb7622af9", "testId": "NET-03.8_A02", "test": "critical system components and functions are logically isolated.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(29)_ODP[01]", "defaultText": null }, { "id": 72733, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590817", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590817", "securityControlId": 31672, "ccis": [], "uuid": "dd1638db-5560-5db0-978f-a055a9a9da7b", "testId": "NET-03.8_A03", "test": "critical system components and functions to be isolated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(29)_ODP[02]", "defaultText": null }, { "id": 72734, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590817", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590817", "securityControlId": 31672, "ccis": [], "uuid": "e5d4e35f-5ceb-5cbd-bcdc-5d5911197a69", "testId": "NET-03.8_A04", "test": "subnetworks are separated organization-defined criteria to isolate critical system components and functions.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(29)", "defaultText": null }, { "id": 72735, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590817", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590817", "securityControlId": 31672, "ccis": [], "uuid": "edba22bc-0810-5e7a-accd-ccbbe0f4d1c3", "testId": "NET-03.8_A05", "test": "physical isolation techniques are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.13.4e_ODP[1]\n172A_3.13.4e_ODP[2]", "defaultText": null }, { "id": 72736, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590817", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590817", "securityControlId": 31672, "ccis": [], "uuid": "8c5f6899-2f97-5c63-86d4-e732843a9e85", "testId": "NET-03.8_A06", "test": "logical isolation techniques are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.13.4e_ODP[1]\n172A_3.13.4e_ODP[3]", "defaultText": null }, { "id": 72737, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590825", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590825", "securityControlId": 31672, "ccis": [], "uuid": "e2ba5fc3-aa2c-59ef-9040-58617a088b46", "testId": "NET-03.8_A07", "test": "physical isolation techniques and/or organization-defined logical isolation techniques are employed in organizational systems and system components.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.13.4e[a]", "defaultText": null } ], "externalMappings": [ { "id": 586899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07da476b-349c-5ce5-9391-3006b34ade6f", "parentControlId": 31672, "controlId": "NET 1.3", "title": "NET 1.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587337" }, { "id": 586900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a88b52f-5988-511d-9318-d362e259e82a", "parentControlId": 31672, "controlId": "SC-7(22)", "title": "SC-7(22)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587337" }, { "id": 586901, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f71cf8c9-ac84-5353-8e3d-1da5a56ef8d1", "parentControlId": 31672, "controlId": "SC-07(22)", "title": "SC-07(22)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587337" }, { "id": 586902, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "370146aa-aeab-5365-af95-9967fb6c6c75", "parentControlId": 31672, "controlId": "SC-07(29)", "title": "SC-07(29)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587337" }, { "id": 586904, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db878a7d-fa0e-58ac-9d83-abf39941092c", "parentControlId": 31672, "controlId": "SC-07(22)", "title": "SC-07(22)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587337" }, { "id": 586905, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587337", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "edcbb0d0-c597-5dfa-80d2-6d04bb60a099", "parentControlId": 31672, "controlId": "SC-07(29)", "title": "SC-07(29)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587337" }, { "id": 586908, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587338", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e30878bb-89c8-531c-b6ba-5cccbcebeba8", "parentControlId": 31672, "controlId": "03.13.01.b", "title": "03.13.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587338" } ], "id": 31672, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731198", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731198", "catalogueId": 1062, "uuid": "e9144557-10fc-524f-9741-299166526cf9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement separate network addresses (e.g., different subnets) to connect to systems in different security domains?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Separate Subnet for Connecting to Different Security Domains", "description": "

Control Description

Mechanisms exist to implement separate network addresses (e.g., different subnets) to connect to systems in different security domains.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to implement separate network addresses (e.g., different subnets) to connect to systems in different security domains.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-03.8", "family": "Network Security", "enhancements": "", "sortId": "NET-03.8", "references": "

Micro-Small Business (<10 staff)

∙ Separate network segment for systems with different security requirements

Small Business (10-49 staff)

∙ VLAN-based subnet separation for different security domains

Medium Business (50-249 staff)

∙ Formal network segmentation policy\n∙ Separate subnets per security domain\n∙ Inter-segment access controls

Large Business (250-999 staff)

∙ Enterprise network segmentation with dedicated subnets per security zone

Enterprise (>1,000 staff)

∙ Enterprise network architecture with security-domain-based subnets\n∙ Automated firewall policy enforcement between zones", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72738, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590826", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590826", "securityControlId": 31673, "ccis": [], "uuid": "3a7388b8-848d-5e18-bcd3-ed5b6c2275d8", "testId": "NET-04_A01", "test": "information flow control policies are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.3[a]\n53A_R5_AC-04_ODP", "defaultText": null }, { "id": 72739, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590826", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590826", "securityControlId": 31673, "ccis": [], "uuid": "bd1dca4a-41b7-5e5a-bbe1-20ce66338453", "testId": "NET-04_A02", "test": "methods and enforcement mechanisms for controlling the flow of sensitive / regulated data are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.3[b]", "defaultText": null }, { "id": 72740, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590826", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590826", "securityControlId": 31673, "ccis": [], "uuid": "70593a6f-899b-5b2f-9253-0f93a11e1525", "testId": "NET-04_A03", "test": "approved authorizations are enforced for controlling the flow of information within the system and between connected systems based on organization-defined information flow control policies.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-04", "defaultText": null }, { "id": 72741, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590826", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590826", "securityControlId": 31673, "ccis": [], "uuid": "1a07c359-9c4f-5ed4-b36f-adb52d25d948", "testId": "NET-04_A04", "test": "designated sources and destinations (e.g., networks, individuals and devices) for sensitive / regulated data within the system and between interconnected systems are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.1.3[c]", "defaultText": null }, { "id": 72742, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590827", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590827", "securityControlId": 31673, "ccis": [], "uuid": "2d00a6da-9491-575e-9cfd-1940095c4f1e", "testId": "NET-04_A05", "test": "authorizations for controlling the flow of sensitive / regulated data are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.1.3[d]", "defaultText": null }, { "id": 72743, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590827", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590827", "securityControlId": 31673, "ccis": [], "uuid": "c5ffb589-6621-53b6-9db7-444810b5d5b8", "testId": "NET-04_A06", "test": "approved authorizations are enforced for controlling the flow of CUI between connected systems.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_3.1.3[e]\n171A_R3_A.03.01.03[02]", "defaultText": null }, { "id": 72744, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590827", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590827", "securityControlId": 31673, "ccis": [], "uuid": "8fa27924-0ae9-5b53-94b8-a2a86d43c198", "testId": "NET-04_A07", "test": "secure information transfer solutions are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.1.3e_ODP[1]", "defaultText": null }, { "id": 72745, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590827", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590827", "securityControlId": 31673, "ccis": [], "uuid": "d437d826-2ceb-5a7e-b9fe-401b119fc3f0", "testId": "NET-04_A08", "test": "information flows between security domains on connected systems are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.1.3e[a]", "defaultText": null }, { "id": 72746, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590827", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590827", "securityControlId": 31673, "ccis": [], "uuid": "e72037b8-d345-528a-ae9a-b0590c3de76f", "testId": "NET-04_A09", "test": "solutions are employed to control information flows between security domains on connected systems.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.1.3e[b]", "defaultText": null }, { "id": 72747, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590827", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590827", "securityControlId": 31673, "ccis": [], "uuid": "11f0ab93-f2fd-5d85-a2a3-cbf7cfbc5158", "testId": "NET-04_A10", "test": "systems and system components included in the scope of the specified enhanced security requirements are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.3e_ODP[1]", "defaultText": null }, { "id": 72748, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590827", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590827", "securityControlId": 31673, "ccis": [], "uuid": "22b231ed-6e16-508f-8c6a-f94d2bf37a0f", "testId": "NET-04_A11", "test": "systems and system components are included in the scope of the specified enhanced security requirements.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.14.3e[a]", "defaultText": null }, { "id": 72749, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590828", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590828", "securityControlId": 31673, "ccis": [], "uuid": "d0e8e63e-9179-51a3-81dc-4ae2d1d4a941", "testId": "NET-04_A12", "test": "systems and system components that are not included in systems and system components are segregated in purpose-specific networks.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.14.3e[b]", "defaultText": null } ], "externalMappings": [ { "id": 586948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99c4e8fa-1c2c-5475-b324-fea7c4883ba4", "parentControlId": 31673, "controlId": "NET 1.6", "title": "NET 1.6", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587343" }, { "id": 586949, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f63f00eb-3e93-532e-bdf7-3e2114d38f68", "parentControlId": 31673, "controlId": "NET 1.8", "title": "NET 1.8", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587343" }, { "id": 586950, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6b527b4-ddc8-57a0-933c-ef4ed1be1a08", "parentControlId": 31673, "controlId": "SR 1.13 RE 1", "title": "SR 1.13 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587343" }, { "id": 586951, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b719d26-8ae1-5173-94be-666d80dac3a9", "parentControlId": 31673, "controlId": "SR 5.3", "title": "SR 5.3", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587343" }, { "id": 586952, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e3b7489-bf56-5d38-87c6-322d9fe6af49", "parentControlId": 31673, "controlId": "NDR 1.13(1)", "title": "NDR 1.13(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587343" }, { "id": 586953, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36b97f4b-cc22-5b0a-ac0a-8d9854fc7385", "parentControlId": 31673, "controlId": "5.14", "title": "5.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587343" }, { "id": 586954, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a92e430-e46e-5439-a95e-b9be00233fab", "parentControlId": 31673, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587343" }, { "id": 586955, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587344", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57ad5186-31b8-5b4f-b2d7-0d2906559b37", "parentControlId": 31673, "controlId": "8.2", "title": "8.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587344" }, { "id": 586962, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587344", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "894ee6a1-1f61-5e97-bcdf-294d5a7dcfef", "parentControlId": 31673, "controlId": "T1001", "title": "T1001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587344" }, { "id": 586963, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f046647a-ccc0-5581-8ac5-2d98046f87be", "parentControlId": 31673, "controlId": "T1001.001", "title": "T1001.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587345" }, { "id": 586964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d4d47b8-02f1-5744-b66a-9f771ecc78dd", "parentControlId": 31673, "controlId": "T1001.002", "title": "T1001.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587345" }, { "id": 586965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18eb7d36-6f82-579e-a62c-54dc5d27501c", "parentControlId": 31673, "controlId": "T1001.003", "title": "T1001.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587345" }, { "id": 586966, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cbae8dc-76fa-5d2b-a7f7-bc494ffd78fd", "parentControlId": 31673, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587345" }, { "id": 586967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05070046-ed82-5a1d-aeaf-18f5e045b1b7", "parentControlId": 31673, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587345" }, { "id": 586968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2bad62f-6e96-5ead-abe2-c6c817f26904", "parentControlId": 31673, "controlId": "T1003.005", "title": "T1003.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587345" }, { "id": 586969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b03c49c-f1f8-57b5-aede-e5ddca6e2e40", "parentControlId": 31673, "controlId": "T1003.006", "title": "T1003.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587345" }, { "id": 586970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31c1912b-4b93-5846-95c2-5000dd0c295e", "parentControlId": 31673, "controlId": "T1008", "title": "T1008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587345" }, { "id": 586971, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffe4d147-1293-5adc-80ad-c3ee48f9804c", "parentControlId": 31673, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587346" }, { "id": 586972, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a594da86-dc94-5691-b9c8-8d7118dde524", "parentControlId": 31673, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587346" }, { "id": 586973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c24fbb23-af96-5694-98c0-f399ad3f0be6", "parentControlId": 31673, "controlId": "T1021.002", "title": "T1021.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587346" }, { "id": 586974, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15c7f9c1-02a8-5072-9532-bd42d1b38d29", "parentControlId": 31673, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587346" }, { "id": 586975, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4c3d615-c4ba-57e3-9ee0-3a9376ff3e94", "parentControlId": 31673, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587346" }, { "id": 586976, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2656e52b-6579-5c55-9913-136ac81ef682", "parentControlId": 31673, "controlId": "T1021.006", "title": "T1021.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587346" }, { "id": 586977, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3814ccb0-7bca-5ae4-9b55-4c00921acb91", "parentControlId": 31673, "controlId": "T1029", "title": "T1029", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587346" }, { "id": 586978, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d55275bc-44d7-5fee-a83c-6129d8fb29bc", "parentControlId": 31673, "controlId": "T1030", "title": "T1030", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587346" }, { "id": 586979, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d74c6a8-e525-55bc-8b27-d5ea346f8f20", "parentControlId": 31673, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587346" }, { "id": 586980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9bac79e9-4a49-54d8-8a6b-44eb2a86d8df", "parentControlId": 31673, "controlId": "T1046", "title": "T1046", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587347" }, { "id": 586981, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a20fc434-e419-52d2-9f78-e64d799ccad2", "parentControlId": 31673, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587347" }, { "id": 586982, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2556f198-81ed-56d6-8a4e-1fcc0de88084", "parentControlId": 31673, "controlId": "T1048.001", "title": "T1048.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587347" }, { "id": 586983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af56d4db-e811-52c5-88b1-23cc06fc156b", "parentControlId": 31673, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587347" }, { "id": 586984, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e3238b8-7793-5a2e-b070-fc626333afea", "parentControlId": 31673, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587347" }, { "id": 586985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e119b7d-3b76-54af-a61f-67924d399787", "parentControlId": 31673, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587347" }, { "id": 586986, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57366fc7-0691-58b3-a64e-1578fe5ad8de", "parentControlId": 31673, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587347" }, { "id": 586987, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fd14d6f-5410-5d3e-9776-ea4394fbbaba", "parentControlId": 31673, "controlId": "T1071", "title": "T1071", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587347" }, { "id": 586988, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1aaa2a02-5c1e-5524-b2d1-2781f4aba2df", "parentControlId": 31673, "controlId": "T1071.001", "title": "T1071.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587347" }, { "id": 586989, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "766e4f94-3085-5e81-9455-e5f30651cbe4", "parentControlId": 31673, "controlId": "T1071.002", "title": "T1071.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587347" }, { "id": 586990, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97bdd408-bd03-5a4d-93cf-9cb11925cd7d", "parentControlId": 31673, "controlId": "T1071.003", "title": "T1071.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587348" }, { "id": 586991, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3572f00-45ca-518b-84ef-5b9172d1f6a9", "parentControlId": 31673, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587348" }, { "id": 586992, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f24ed03-1b03-597a-bf79-2dd260eef25c", "parentControlId": 31673, "controlId": "T1071.005", "title": "T1071.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587348" }, { "id": 586993, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "298b7768-d9ab-51da-b4f1-3ef27a7ea683", "parentControlId": 31673, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587348" }, { "id": 586994, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03bbe04b-bf86-5c6d-8af4-6c319e09ada8", "parentControlId": 31673, "controlId": "T1090", "title": "T1090", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587348" }, { "id": 586995, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75fad5e3-7c64-5b8a-bd6b-7a47df453838", "parentControlId": 31673, "controlId": "T1090.001", "title": "T1090.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587348" }, { "id": 586996, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42455524-a3a3-506e-802b-24a19ea3b10a", "parentControlId": 31673, "controlId": "T1090.002", "title": "T1090.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587348" }, { "id": 586997, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e1542b0-fc94-590c-8afb-38a32fc16d11", "parentControlId": 31673, "controlId": "T1090.003", "title": "T1090.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587349" }, { "id": 586998, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1e71679-82bf-527e-a2a9-13d711fa4c79", "parentControlId": 31673, "controlId": "T1095", "title": "T1095", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587349" }, { "id": 586999, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c250a249-e2d2-588c-bb9a-f8a72f98cd16", "parentControlId": 31673, "controlId": "T1098", "title": "T1098", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587349" }, { "id": 587000, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2202cae2-3a33-5831-b8d4-4e9010d90a1e", "parentControlId": 31673, "controlId": "T1098.001", "title": "T1098.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587349" }, { "id": 587001, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60ec97ab-0cf9-5501-ab54-16be835c0d8e", "parentControlId": 31673, "controlId": "T1098.007", "title": "T1098.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587349" }, { "id": 587002, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7970a797-846d-5318-a5ee-9342d631271f", "parentControlId": 31673, "controlId": "T1102", "title": "T1102", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587349" }, { "id": 587003, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81ada5e5-8989-5763-aedc-30b9202911ae", "parentControlId": 31673, "controlId": "T1102.001", "title": "T1102.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587349" }, { "id": 587004, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a30781fb-512a-549b-ad37-48866c045d40", "parentControlId": 31673, "controlId": "T1102.002", "title": "T1102.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587349" }, { "id": 587005, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fc17464-89d1-5480-90c9-8fe91574f0c7", "parentControlId": 31673, "controlId": "T1102.003", "title": "T1102.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587349" }, { "id": 587006, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8075282d-27d3-5516-9aef-2048bb7b937a", "parentControlId": 31673, "controlId": "T1104", "title": "T1104", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58735" }, { "id": 587007, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9af36e6e-ac16-500c-952c-5c3f9030bca7", "parentControlId": 31673, "controlId": "T1105", "title": "T1105", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58735" }, { "id": 587008, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45e2cb6f-ad14-5f24-8751-f89c9f1ef1dc", "parentControlId": 31673, "controlId": "T1114", "title": "T1114", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58735" }, { "id": 587009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51d8bf59-d62c-51c6-9709-9dc16c2cc377", "parentControlId": 31673, "controlId": "T1114.001", "title": "T1114.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58735" }, { "id": 587010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85ead57e-7a87-5391-ba8c-0eb63e64d1df", "parentControlId": 31673, "controlId": "T1114.002", "title": "T1114.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58735" }, { "id": 587011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3da04ea5-6e0a-564c-8685-a44fa7454692", "parentControlId": 31673, "controlId": "T1114.003", "title": "T1114.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58735" }, { "id": 587012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e112da8c-3f89-55dc-baba-5ee22c0cb1db", "parentControlId": 31673, "controlId": "T1132", "title": "T1132", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58735" }, { "id": 587013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c5ec8c7-fda2-53df-92e3-2e46f2d0ea66", "parentControlId": 31673, "controlId": "T1132.001", "title": "T1132.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58735" }, { "id": 587014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "015e2c0d-7884-5ffc-9de4-cff7772b960d", "parentControlId": 31673, "controlId": "T1132.002", "title": "T1132.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58735" }, { "id": 587015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587351", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52376ca4-7ab0-57e9-aa1e-fe1f338f7d94", "parentControlId": 31673, "controlId": "T1133", "title": "T1133", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587351" }, { "id": 587016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587351", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00891714-197f-5c91-9a8a-822929556097", "parentControlId": 31673, "controlId": "T1134.005", "title": "T1134.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587351" }, { "id": 587017, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587351", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d7b7ba9-0e10-5c17-ae42-43d84ebc2be4", "parentControlId": 31673, "controlId": "T1136", "title": "T1136", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587351" }, { "id": 587018, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587351", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2213a5fc-d294-573f-97d0-e008893a4782", "parentControlId": 31673, "controlId": "T1136.002", "title": "T1136.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587351" }, { "id": 587019, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587351", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c85587f8-4821-5f6c-b117-1e4f1cc3fba8", "parentControlId": 31673, "controlId": "T1136.003", "title": "T1136.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587351" }, { "id": 587020, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587351", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ffec9bc-da02-5c0f-9c67-b6d6df07550e", "parentControlId": 31673, "controlId": "T1187", "title": "T1187", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587351" }, { "id": 587021, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587352", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "097bddd8-940e-51b6-838c-b87685406967", "parentControlId": 31673, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587352" }, { "id": 587022, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587352", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "562a6a07-1c62-52c9-bf9f-272a135aef6c", "parentControlId": 31673, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587352" }, { "id": 587023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587352", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "677269b2-e2e2-5aea-84f4-0614c150013f", "parentControlId": 31673, "controlId": "T1197", "title": "T1197", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587352" }, { "id": 587024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587352", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "687283f9-167e-5890-951a-755f7ec67994", "parentControlId": 31673, "controlId": "T1199", "title": "T1199", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587352" }, { "id": 587025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587352", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7b52fab-a5a2-5ac1-9d26-9147c3d5f859", "parentControlId": 31673, "controlId": "T1203", "title": "T1203", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587352" }, { "id": 587026, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587352", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7cd2d04-d40b-5e06-816c-274094bfde78", "parentControlId": 31673, "controlId": "T1204", "title": "T1204", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587352" }, { "id": 587027, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587352", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20875d31-4477-5e87-8959-168edba33e0a", "parentControlId": 31673, "controlId": "T1204.001", "title": "T1204.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587352" }, { "id": 587028, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587352", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d55b667-46e5-582d-b3d7-70fc0a399cbb", "parentControlId": 31673, "controlId": "T1204.002", "title": "T1204.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587352" }, { "id": 587029, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587352", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78af9c72-5fc0-5c5c-83c4-f5ef32daed37", "parentControlId": 31673, "controlId": "T1204.003", "title": "T1204.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587352" }, { "id": 587030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587352", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48d2fa77-28a0-5628-9168-0f5dc5076c83", "parentControlId": 31673, "controlId": "T1205", "title": "T1205", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587352" }, { "id": 587031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54e1dbf4-debc-53c1-9c93-30d1b10074d4", "parentControlId": 31673, "controlId": "T1205.001", "title": "T1205.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587353" }, { "id": 587032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92c81f24-36c3-506b-87c3-6ed0afe2b1c8", "parentControlId": 31673, "controlId": "T1205.002", "title": "T1205.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587353" }, { "id": 587033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51bee3cb-a1a7-54c9-9869-ca1692b4d7f4", "parentControlId": 31673, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587353" }, { "id": 587034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19b8c0d8-68e2-5dcb-84bb-afc4fb667980", "parentControlId": 31673, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587353" }, { "id": 587035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b475f5e-ba4d-50b0-8179-77e8c1d0b82e", "parentControlId": 31673, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587353" }, { "id": 587036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a49f2c3e-14a7-5ec0-a8fe-b2dc586d3f13", "parentControlId": 31673, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587353" }, { "id": 587037, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa4295cc-74fb-51cb-b582-fd9cfcb6c60c", "parentControlId": 31673, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587353" }, { "id": 587038, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc608567-094c-5198-9008-2b9a104f8dbd", "parentControlId": 31673, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587353" }, { "id": 587039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58b4584e-80fc-5a9e-82c0-6234f4ecfba6", "parentControlId": 31673, "controlId": "T1213.004", "title": "T1213.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587353" }, { "id": 587040, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587354", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a840dc3a-8a9c-521d-9991-c485bc80a7a5", "parentControlId": 31673, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587354" }, { "id": 587041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587354", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0384a8d-6ed3-5711-89c9-6766bb344b9b", "parentControlId": 31673, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587354" }, { "id": 587042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587354", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1fa056e-c953-5195-a439-dfd4be058fe9", "parentControlId": 31673, "controlId": "T1218.012", "title": "T1218.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587354" }, { "id": 587043, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587354", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6d6275f-6029-5dd7-b484-a4ce9ac415d9", "parentControlId": 31673, "controlId": "T1219", "title": "T1219", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587354" }, { "id": 587044, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587354", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b919f58-9b6a-559f-be7f-b1e9c4c971f7", "parentControlId": 31673, "controlId": "T1482", "title": "T1482", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587354" }, { "id": 587045, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587354", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5efa0452-8ca9-5f61-ba1e-2776818c44cc", "parentControlId": 31673, "controlId": "T1484", "title": "T1484", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587354" }, { "id": 587046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587354", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2800cfc0-0b12-56d8-9c0f-2ef6ede42702", "parentControlId": 31673, "controlId": "T1489", "title": "T1489", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587354" }, { "id": 587047, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587354", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b9d4c95-8a29-590b-87a4-8029be2fa00c", "parentControlId": 31673, "controlId": "T1498", "title": "T1498", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587354" }, { "id": 587048, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f5649ab-689c-5643-b8e1-d6b262ceaff6", "parentControlId": 31673, "controlId": "T1498.001", "title": "T1498.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587355" }, { "id": 587049, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d030d502-2fc1-5854-b6bc-699a2e94e357", "parentControlId": 31673, "controlId": "T1498.002", "title": "T1498.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587355" }, { "id": 587050, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31a09017-a9b1-52a7-80a3-640cbc20b3de", "parentControlId": 31673, "controlId": "T1499", "title": "T1499", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587355" }, { "id": 587051, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8aafd9e8-db0c-5b80-96d7-5e496df262a7", "parentControlId": 31673, "controlId": "T1499.001", "title": "T1499.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587355" }, { "id": 587052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54f59ded-5fed-500c-9fb5-50bdbfd97bb2", "parentControlId": 31673, "controlId": "T1499.002", "title": "T1499.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587355" }, { "id": 587053, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ecf570f-cbc8-5727-bca3-ae62bb8ade47", "parentControlId": 31673, "controlId": "T1499.003", "title": "T1499.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587355" }, { "id": 587054, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a76d09f-226a-5575-908b-06d6b18f991c", "parentControlId": 31673, "controlId": "T1499.004", "title": "T1499.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587355" }, { "id": 587055, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0987eaa-9234-526f-ad73-8f79fd32c1ec", "parentControlId": 31673, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587355" }, { "id": 587056, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51b73eb6-cbe1-5869-9675-821e2993811c", "parentControlId": 31673, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587355" }, { "id": 587057, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587356", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12b3b52c-da79-52ec-88b8-3f3d73913583", "parentControlId": 31673, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587356" }, { "id": 587058, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587356", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb54b006-231a-57fd-853d-aef13e8c8bde", "parentControlId": 31673, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587356" }, { "id": 587059, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587356", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc7b4cc9-a585-5d3d-911d-ed3401ab8eda", "parentControlId": 31673, "controlId": "T1547.003", "title": "T1547.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587356" }, { "id": 587060, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587356", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86717dd1-e24c-592b-9f69-d198ec7d2fc7", "parentControlId": 31673, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587356" }, { "id": 587061, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587356", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab88142a-a49e-5ab3-868f-be3549bb4951", "parentControlId": 31673, "controlId": "T1552.001", "title": "T1552.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587356" }, { "id": 587062, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587356", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "268f3b12-d651-5f7a-9960-e7a5022fee0c", "parentControlId": 31673, "controlId": "T1552.005", "title": "T1552.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587356" }, { "id": 587063, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587356", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "595d4a16-08f6-50d4-9331-a18cd78ed9fe", "parentControlId": 31673, "controlId": "T1552.007", "title": "T1552.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587356" }, { "id": 587064, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587356", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "086d6542-1c15-55d3-b82b-496cfe8f5052", "parentControlId": 31673, "controlId": "T1552.008", "title": "T1552.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587356" }, { "id": 587065, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587356", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2a82323-b23f-57a1-90a7-bcf444bd823c", "parentControlId": 31673, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587356" }, { "id": 587066, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587357", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "362819cc-04a0-5d54-b2a8-72e138b282a0", "parentControlId": 31673, "controlId": "T1557.001", "title": "T1557.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587357" }, { "id": 587067, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587357", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68ec516e-e5d0-5f29-87fd-7c67b4c84f61", "parentControlId": 31673, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587357" }, { "id": 587068, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587357", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "925e657e-dd22-5ff2-b413-58f140cfc5f0", "parentControlId": 31673, "controlId": "T1557.003", "title": "T1557.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587357" }, { "id": 587069, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587357", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2731bb77-180d-54c1-a771-9f7c3d332441", "parentControlId": 31673, "controlId": "T1557.004", "title": "T1557.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587357" }, { "id": 587070, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587357", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08a13604-965e-5df1-95ba-97a95c8afbb3", "parentControlId": 31673, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587357" }, { "id": 587071, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587357", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db8f7d6e-9c24-535f-b648-22bf980ac34d", "parentControlId": 31673, "controlId": "T1559.001", "title": "T1559.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587357" }, { "id": 587072, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587357", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "517a84ce-0188-5258-a67a-3b3914549796", "parentControlId": 31673, "controlId": "T1559.002", "title": "T1559.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587357" }, { "id": 587073, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587357", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a01037f-0d62-5619-b0bd-e8576c9a4b59", "parentControlId": 31673, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587357" }, { "id": 587074, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69e0da70-1c12-5980-aea0-f7389558618c", "parentControlId": 31673, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587358" }, { "id": 587075, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0673f980-bb5f-5068-8d4b-5ddc5a6e543c", "parentControlId": 31673, "controlId": "T1564.008", "title": "T1564.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587358" }, { "id": 587076, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ab31c9c-5dd8-5348-869a-50b7ccbcdb88", "parentControlId": 31673, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587358" }, { "id": 587077, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "725a985b-0391-5f14-ad07-5f5bec41c5e2", "parentControlId": 31673, "controlId": "T1565.003", "title": "T1565.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587358" }, { "id": 587078, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a033c1d-0e3b-52cf-983d-d899cf19589e", "parentControlId": 31673, "controlId": "T1566", "title": "T1566", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587358" }, { "id": 587079, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d9a7d9b-f2d8-5a2e-af5d-a6caedfcef01", "parentControlId": 31673, "controlId": "T1566.001", "title": "T1566.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587358" }, { "id": 587080, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9b4d316-a2ab-5618-8de4-c6a56cce158d", "parentControlId": 31673, "controlId": "T1566.002", "title": "T1566.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587358" }, { "id": 587081, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4cd99604-879e-5a8a-973c-bd3a850377ff", "parentControlId": 31673, "controlId": "T1566.003", "title": "T1566.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587358" }, { "id": 587082, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "735a3696-ff1d-5779-bf87-123fce59e9b4", "parentControlId": 31673, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587358" }, { "id": 587083, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587358", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80447e48-5eb0-5d75-944e-b4449230d505", "parentControlId": 31673, "controlId": "T1567.001", "title": "T1567.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587359" }, { "id": 587084, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9dfd3b1-0dd9-57b2-8b41-1685ad43c11d", "parentControlId": 31673, "controlId": "T1567.002", "title": "T1567.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587359" }, { "id": 587085, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e2e094c-04eb-57e7-9150-a47c9a67fc80", "parentControlId": 31673, "controlId": "T1567.003", "title": "T1567.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587359" }, { "id": 587086, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "342dfeaf-f8d4-5762-b00c-276d6407f493", "parentControlId": 31673, "controlId": "T1567.004", "title": "T1567.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587359" }, { "id": 587087, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c2e8b6a-d866-51e3-9dfb-1043e4c9a1d5", "parentControlId": 31673, "controlId": "T1568", "title": "T1568", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587359" }, { "id": 587088, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e82b4102-b57f-53eb-ab0c-38cc5cc2217b", "parentControlId": 31673, "controlId": "T1568.002", "title": "T1568.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587359" }, { "id": 587089, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d625b2f4-a7f7-53f2-999b-ec15359509b5", "parentControlId": 31673, "controlId": "T1570", "title": "T1570", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587359" }, { "id": 587090, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1708a456-aa8b-5ae7-a24c-d550bdde1afe", "parentControlId": 31673, "controlId": "T1571", "title": "T1571", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587359" }, { "id": 587091, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587359", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea4209fe-6cd8-513f-a94b-d66403f644af", "parentControlId": 31673, "controlId": "T1572", "title": "T1572", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587359" }, { "id": 587092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d4dc9e1-1f72-55ff-826e-dfeb2fb6a84a", "parentControlId": 31673, "controlId": "T1573", "title": "T1573", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58736" }, { "id": 587093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33277252-5173-57db-9163-1a6a2d1fdb3b", "parentControlId": 31673, "controlId": "T1573.001", "title": "T1573.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58736" }, { "id": 587094, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa541b0e-48d0-59f0-87ae-020f3864ecaf", "parentControlId": 31673, "controlId": "T1573.002", "title": "T1573.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58736" }, { "id": 587095, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18713150-7cb3-50cd-846a-5afc963c6721", "parentControlId": 31673, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58736" }, { "id": 587096, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4582a74-9dfd-5bb5-b3d0-5e78f440218c", "parentControlId": 31673, "controlId": "T1574.004", "title": "T1574.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58736" }, { "id": 587097, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd70288e-583c-5190-8c83-0cb54cc97142", "parentControlId": 31673, "controlId": "T1574.005", "title": "T1574.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58736" }, { "id": 587098, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "085d4060-61ce-5f3f-9b06-1657bed684db", "parentControlId": 31673, "controlId": "T1574.007", "title": "T1574.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58736" }, { "id": 587099, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a55881cf-633d-5dd2-ad15-2ad5aa1de888", "parentControlId": 31673, "controlId": "T1574.008", "title": "T1574.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58736" }, { "id": 587100, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39ad152b-6d20-560f-a538-5a20f0bd29a0", "parentControlId": 31673, "controlId": "T1574.009", "title": "T1574.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58736" }, { "id": 587101, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17d8ee1f-42f0-53b7-b9f2-fb43e829d854", "parentControlId": 31673, "controlId": "T1574.010", "title": "T1574.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587361" }, { "id": 587102, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a1ce9a0-2d93-5b4a-8247-3825b7afc1bf", "parentControlId": 31673, "controlId": "T1590.002", "title": "T1590.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587361" }, { "id": 587103, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "892452d7-42f4-5d1b-bcd3-94a79cce5acb", "parentControlId": 31673, "controlId": "T1598", "title": "T1598", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587361" }, { "id": 587104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ff6426b-6bb7-5d75-a73d-2f9772fc7f32", "parentControlId": 31673, "controlId": "T1598.001", "title": "T1598.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587361" }, { "id": 587105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3415bf6-46f2-53e9-b008-5f05c60684f2", "parentControlId": 31673, "controlId": "T1598.002", "title": "T1598.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587361" }, { "id": 587106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "316072fb-6813-5e23-bb37-8dc41a01daa3", "parentControlId": 31673, "controlId": "T1598.003", "title": "T1598.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587361" }, { "id": 587107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb4008a6-9492-5d72-9fd6-aedc8c4f7c32", "parentControlId": 31673, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587361" }, { "id": 587108, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4bb57142-6396-5252-90ab-e0bfd7f408c7", "parentControlId": 31673, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587361" }, { "id": 587109, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b2d2805-83b8-58c1-8f39-ccb2a54724e3", "parentControlId": 31673, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587361" }, { "id": 587110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9718f5e3-c2c1-5ba1-9ae3-25b10258d244", "parentControlId": 31673, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587362" }, { "id": 587111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0d238f1-8147-52aa-9da5-fe411303f04f", "parentControlId": 31673, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587362" }, { "id": 587112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a31b8a1d-7a74-58f7-bc43-2c47535c360e", "parentControlId": 31673, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587362" }, { "id": 587113, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0eb55c08-f5fb-5d16-8ada-78bc80b0b504", "parentControlId": 31673, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587362" }, { "id": 587114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f01f3ca-6d2f-5455-9ea1-de1e8ea0ad96", "parentControlId": 31673, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587362" }, { "id": 587115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bb25e95-66bc-5a8a-8d8b-00f5711fa844", "parentControlId": 31673, "controlId": "T1609", "title": "T1609", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587362" }, { "id": 587116, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "697a9a30-6c0a-530d-90ce-aa083c04e4be", "parentControlId": 31673, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587362" }, { "id": 587117, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587362", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53c5f47a-ad47-521b-b27e-70c00493fccb", "parentControlId": 31673, "controlId": "T1622", "title": "T1622", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587362" }, { "id": 587118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "032c44b5-1c60-53a0-bb78-7398c1e8c24f", "parentControlId": 31673, "controlId": "T1654", "title": "T1654", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587363" }, { "id": 587119, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f514ab6-26c1-5743-86ee-039c44fb427e", "parentControlId": 31673, "controlId": "T1659", "title": "T1659", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587363" }, { "id": 587123, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fdfacf7-32e3-5ad2-9b1b-6a6f9cea26b2", "parentControlId": 31673, "controlId": "AC-4", "title": "AC-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587363" }, { "id": 587124, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80135ace-bf6d-500a-aac2-ff2da847ea47", "parentControlId": 31673, "controlId": "AC-04", "title": "AC-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587363" }, { "id": 587125, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6256b645-c1c1-5fe7-8354-7161dc106dc5", "parentControlId": 31673, "controlId": "AC-04", "title": "AC-04", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587363" }, { "id": 587126, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3aff4b7e-9162-5115-ab39-597dfc0ed3ab", "parentControlId": 31673, "controlId": "AC-04", "title": "AC-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587363" }, { "id": 587127, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56c314ef-fa8d-5aaf-bb41-6d742e7fb2a0", "parentControlId": 31673, "controlId": "AC-04", "title": "AC-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587364" }, { "id": 587128, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587364", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4e2683c-cb4f-5950-a23f-b86c9010d3d8", "parentControlId": 31673, "controlId": "AC-04", "title": "AC-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587364" }, { "id": 587129, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587364", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9af0c0ba-7a93-54b9-bab1-69588b01e4a9", "parentControlId": 31673, "controlId": "AC-4", "title": "AC-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587364" }, { "id": 587130, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587364", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b7088e7-4fa8-515f-a3f4-d5f21b8e9fae", "parentControlId": 31673, "controlId": "AC-4", "title": "AC-4", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587364" }, { "id": 587133, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587364", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4fc7e31-c85a-57b5-96f3-01156a6fab96", "parentControlId": 31673, "controlId": "3.1.3", "title": "3.1.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587364" }, { "id": 587134, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587364", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7b33e3f-4e2e-51ce-97f4-1c0f199a3cea", "parentControlId": 31673, "controlId": "03.01.03", "title": "03.01.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587364" }, { "id": 587135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587364", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e90b795-e759-5959-9980-dbc83e6f9fd5", "parentControlId": 31673, "controlId": "03.13.01.a", "title": "03.13.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587364" }, { "id": 587136, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587364", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ba99111-08ed-56b1-8cba-9035c9879269", "parentControlId": 31673, "controlId": "03.13.01.c", "title": "03.13.01.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587364" }, { "id": 587177, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79bf0ec0-c6dc-548b-9005-169f6c3be89d", "parentControlId": 31673, "controlId": "ARCHITECTURE-2e", "title": "ARCHITECTURE-2e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587369" }, { "id": 587184, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3638fcfe-9631-55e0-97cd-59795cc07600", "parentControlId": 31673, "controlId": "CIP-005-7 1.3", "title": "CIP-005-7 1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58737" }, { "controlId": "B.1.15", "title": "B.1.15 — Network Access Control", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-17, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "f642ef17-e772-5684-96e9-9718a9d836ea", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.15", "title": "NEI 08-09 App D.1.15 — Network Access Control", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.15", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "69273c78-e475-5033-aacc-aa2eb156ad5b", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.15", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "b8a2ceaf-52ad-5eeb-97bb-99a4c9b41b16", "isPublic": true }, { "controlId": "B.1.18", "title": "B.1.18 — Insecure and Rogue Connections", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, CA-9, SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a4d7394b-336f-58f1-bd9c-2e40aef11a8d", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.18", "title": "NEI 08-09 App D.1.18 — Insecure and Rogue Connections", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.18", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "01e2ef70-e780-54ce-b3d6-9425393c4bc2", "isPublic": true }, { "controlId": "CIP-003-8-R2", "title": "CIP-003-8-R2 — Cyber Security Plan Implementation for Low Impact BES Cyber Systems", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "77a5b01d-6993-5820-acd4-fab5e325cf76", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec1", "title": "CIP-003-9-Attachment1-Sec1 — Low Impact Cyber Security Awareness", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "96d0a072-94c1-58b1-a6db-0d6d8a793cba", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec2", "title": "CIP-003-9-Attachment1-Sec2 — Low Impact Physical Security Controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "298d4cc7-ac82-5415-b80f-80be0e731cf0", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec3", "title": "CIP-003-9-Attachment1-Sec3 — Low Impact Electronic Access Controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c6d85f1a-181c-5ff1-a4b2-fab959356acb", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec4", "title": "CIP-003-9-Attachment1-Sec4 — Low Impact Cyber Security Incident Response", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3396de12-fe8d-5325-9a6a-14c30d5b0a5f", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec5", "title": "CIP-003-9-Attachment1-Sec5 — Low Impact Transient Cyber Asset and Removable Media Malicious Code Risk Mitigation", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1f25251b-ccc8-5d35-bb7d-876005b29d6d", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec6", "title": "CIP-003-9-Attachment1-Sec6 — Low Impact Vendor Electronic Remote Access Security Controls (CIP-003-9)", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f87df909-20af-51c8-a0a8-555d45363da9", "isPublic": true }, { "controlId": "CIP-005-7-R1", "title": "CIP-005-7-R1 — Electronic Security Perimeter Implementation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ce99fb27-c8c0-5488-a2aa-44bfc2da1b4b", "isPublic": true }, { "controlId": "CIP-005-7-1.1", "title": "CIP-005-7-1.1 — All applicable Cyber Assets connected to a network via a routable protocol shall reside within a defined ESP.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b4aa7bc4-7d43-5dfa-838d-44d36170041e", "isPublic": true }, { "controlId": "CIP-005-7-1.2", "title": "CIP-005-7-1.2 — All External Routable Connectivity must be through an identified Electronic Access Point (EAP).", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b69628b1-5b8f-51c7-a8f5-d80d9e57b3e5", "isPublic": true }, { "controlId": "CIP-005-7-1.3", "title": "CIP-005-7-1.3 — Require inbound and outbound access permissions, including the reason for granting access, and deny all other access...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "41f2f75c-4a0c-5cd4-88c5-5535ccc7d25f", "isPublic": true }, { "controlId": "CIP-005-7-1.4", "title": "CIP-005-7-1.4 — Where technically feasible, perform authentication when establishing Dial-up Connectivity with applicable Cyber Assets.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9405685c-a0de-5057-8286-ab5296b223d7", "isPublic": true }, { "controlId": "CIP-005-7-1.5", "title": "CIP-005-7-1.5 — Have one or more methods for detecting known or suspected malicious communications for both inbound and outbound comm...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "fcbea3b5-84c8-5792-8818-dbe073d36604", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "bdd8eab9-f666-5749-a71b-e13ee3d594a5", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "798498e8-18b5-5fe6-872d-ffc02f59d8ef", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "62bd25c8-09cd-5ccd-bb7f-c97da5a1c0a9", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "b910332e-2590-517e-9a68-87c62419cb48", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "d10623f7-2243-5bf4-a0ee-df88398f802e", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "32e5c651-d858-55d7-b29f-2bf2a44560ef", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "82f1d898-bb2d-58d7-a7ba-2f1f1e1aff9a", "isPublic": true } ], "id": 31673, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731199", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731199", "catalogueId": 1062, "uuid": "415f9048-8c6a-5308-87b8-638085c186ba", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement and govern Access Control Lists (ACLs) to provide data flow enforcement that explicitly restrict network traffic to only what is authorized?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Data Flow Enforcement – Access Control Lists (ACLs)", "description": "

Control Description

Mechanisms exist to implement and govern Access Control Lists (ACLs) to provide data flow enforcement that explicitly restrict network traffic to only what is authorized.

Evidence Request List (ERL)

E-AST-12\nE-AST-19\nE-NET-06\nE-NET-07\nE-NET-10

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Administrative processes enforce the use of human reviews for Access Control Lists (ACLs) and similar rulesets on a routine basis.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to implement and govern Access Control Lists (ACLs) to provide data flow enforcement that explicitly restrict network traffic to only what is authorized.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.15, B.1.18
NERC-CIP (2026) Requirements: CIP-003-8-R2, CIP-005-7-R1", "controlId": "NET-04", "family": "Network Security", "enhancements": "", "sortId": "NET-04", "references": "

Micro-Small Business (<10 staff)

∙ Access Control Lists (ACLs)

Small Business (10-49 staff)

∙ Access Control Lists (ACLs)

Medium Business (50-249 staff)

∙ Access Control Lists (ACLs)

Large Business (250-999 staff)

∙ Access Control Lists (ACLs)

Enterprise (>1,000 staff)

∙ Access Control Lists (ACLs)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72750, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590828", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590828", "securityControlId": 31674, "ccis": [], "uuid": "e7309216-27e1-5889-ae67-4f9d65265e1d", "testId": "NET-04.1_A01", "test": "network communications traffic is denied by default.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.13.6[a]\n171A_R3_A.03.13.06[01]\n53A_R5_SC-07(05)[01]", "defaultText": null }, { "id": 72751, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590828", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590828", "securityControlId": 31674, "ccis": [], "uuid": "85752d26-f74d-5ddc-8a12-a2fd8dd0b8d1", "testId": "NET-04.1_A02", "test": "network communications traffic is allowed by exception.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.13.6[b]\n171A_R3_A.03.13.06[02]\n53A_R5_SC-07(05)[02]", "defaultText": null }, { "id": 72752, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590828", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590828", "securityControlId": 31674, "ccis": [], "uuid": "b59eb8fc-76e8-5fc4-b16e-a57465748752", "testId": "NET-04.1_A03", "test": "systems for which network communications traffic is denied by default and network communications traffic is allowed by exception are defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: any systems", "otherId": "53A_R5_SC-07(05)_ODP[01]\n53A_R5_SC-07(05)_ODP[02]", "defaultText": null }, { "id": 72753, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590829", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590829", "securityControlId": 31674, "ccis": [], "uuid": "b7a8e063-1d64-5fe1-93cb-bd88b4d1807f", "testId": "NET-04.1_A04", "test": "authorized sources of incoming communications to be routed are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(11)_ODP[01]", "defaultText": null }, { "id": 72754, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590829", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590829", "securityControlId": 31674, "ccis": [], "uuid": "40f1753e-02ce-5d3b-8a4b-ebcf9929db22", "testId": "NET-04.1_A05", "test": "authorized destinations to which incoming communications from authorized sources may be routed are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(11)_ODP[02]", "defaultText": null }, { "id": 72755, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590829", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590829", "securityControlId": 31674, "ccis": [], "uuid": "b38c905c-e30d-5a42-ba0a-7d6921e16cbc", "testId": "NET-04.1_A06", "test": "only incoming communications from authorized sources are allowed to be routed to authorized destinations.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(11)", "defaultText": null } ], "externalMappings": [ { "id": 587238, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587384", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc41ca0c-d736-50e3-91d0-6e367b73baa3", "parentControlId": 31674, "controlId": "NET 1.7", "title": "NET 1.7", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587384" }, { "id": 587239, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587384", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66945031-e984-5057-ab1f-c3ad1995b5f4", "parentControlId": 31674, "controlId": "SR 5.2 RE 1", "title": "SR 5.2 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587384" }, { "id": 587240, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587384", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3211d13a-004b-57f5-a83e-f05977a59029", "parentControlId": 31674, "controlId": "SR 5.3 RE 1", "title": "SR 5.3 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587384" }, { "id": 587241, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587385", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ee66231-621b-5b40-a5c3-f246f43ead7e", "parentControlId": 31674, "controlId": "CR 5.3", "title": "CR 5.3", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587385" }, { "id": 587242, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587385", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de6af0ca-9be6-5f4f-8700-98534469c4a5", "parentControlId": 31674, "controlId": "NDR 1.13(1)", "title": "NDR 1.13(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587385" }, { "id": 587243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587385", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c74bd5a9-36d0-5171-b898-4bceaa3e2078", "parentControlId": 31674, "controlId": "NDR 5.2(1)", "title": "NDR 5.2(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587385" }, { "id": 587244, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587385", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13421997-09db-5c35-b939-802908e62823", "parentControlId": 31674, "controlId": "NDR 5.2(2)", "title": "NDR 5.2(2)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587385" }, { "id": 587245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587385", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44517e3d-7747-5fde-ad72-d772f79c1afe", "parentControlId": 31674, "controlId": "NDR 5.3", "title": "NDR 5.3", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587385" }, { "id": 587246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587385", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0bee6328-f585-538f-adfc-1f5e2760a461", "parentControlId": 31674, "controlId": "5.14", "title": "5.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587385" }, { "id": 587247, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587385", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "854579ee-c3d5-5028-9b42-ebe501e23c75", "parentControlId": 31674, "controlId": "8.2", "title": "8.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587385" }, { "id": 587254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587386", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2a3ca73-fe6d-5638-8bbe-98c648dfc939", "parentControlId": 31674, "controlId": "CA-3(5)", "title": "CA-3(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587386" }, { "id": 587255, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587386", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cdf226cc-3a4c-5970-bcf5-fedb2f877b99", "parentControlId": 31674, "controlId": "SC-7(5)", "title": "SC-7(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587386" }, { "id": 587256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587386", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fdf361f-20c8-5eb4-a962-45fd4f02b894", "parentControlId": 31674, "controlId": "SC-7(11)", "title": "SC-7(11)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587386" }, { "id": 587257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587386", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49cdadb0-2a4b-58e4-be3d-3367c2075d3f", "parentControlId": 31674, "controlId": "SC-07(05)", "title": "SC-07(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587386" }, { "id": 587258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63136896-37c6-588c-bd77-1d772aeb19fc", "parentControlId": 31674, "controlId": "SC-07(11)", "title": "SC-07(11)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587387" }, { "id": 587260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d675501-17a9-5232-bd8b-74ee948272f5", "parentControlId": 31674, "controlId": "SC-07(05)", "title": "SC-07(05)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587387" }, { "id": 587261, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35164875-4f9f-5ea1-8813-e4382a34e0b8", "parentControlId": 31674, "controlId": "SC-07(05)", "title": "SC-07(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587387" }, { "id": 587262, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b508f77-36df-5138-b7eb-fd29deac2f8a", "parentControlId": 31674, "controlId": "SC-07(11)", "title": "SC-07(11)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587387" }, { "id": 587263, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75b63875-8280-5303-ac60-93f1f91ee94f", "parentControlId": 31674, "controlId": "SC-07(05)", "title": "SC-07(05)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587387" }, { "id": 587264, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587387", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01d47bb4-e1f3-5d29-825d-47b4d01c48bf", "parentControlId": 31674, "controlId": "SC-07(05)", "title": "SC-07(05)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587387" }, { "id": 587266, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48b7ca17-6f82-5d7b-a880-34173dec37d8", "parentControlId": 31674, "controlId": "3.13.6", "title": "3.13.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587388" }, { "id": 587267, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1958e33-f046-5ae5-b01d-0d2ea3230aaf", "parentControlId": 31674, "controlId": "NFO - CA-3(5)", "title": "NFO - CA-3(5)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587388" }, { "id": 587268, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "861f6310-14de-5c94-b639-73e5621663f9", "parentControlId": 31674, "controlId": "03.13.01.a", "title": "03.13.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587388" }, { "id": 587269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "936af7e9-c7a4-572d-811b-90ee333f63d9", "parentControlId": 31674, "controlId": "03.13.06", "title": "03.13.06", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587388" }, { "id": 587307, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587392", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3f219a8-d77d-5ae2-acb2-a7e17e3a9e65", "parentControlId": 31674, "controlId": "ARCHITECTURE-2e", "title": "ARCHITECTURE-2e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587392" } ], "id": 31674, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731199", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731199", "catalogueId": 1062, "uuid": "f11a570a-2e83-50bc-b188-aa031b70c49d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization configure firewall and router configurations to deny network traffic by default and allow network traffic by exception (e.g., deny all, permit by exception)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Deny Traffic by Default & Allow Traffic by Exception", "description": "

Control Description

Mechanisms exist to configure firewall and router configurations to deny network traffic by default and allow network traffic by exception (e.g., deny all, permit by exception).

Evidence Request List (ERL)

E-AST-12\nE-AST-19\nE-NET-07\nE-NET-10

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to configure firewall and router configurations to deny network traffic by default and allow network traffic by exception (e.g., deny all, permit by exception).

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "NET-04.1", "family": "Network Security", "enhancements": "", "sortId": "NET-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Access Control Lists (ACLs)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Access Control Lists (ACLs)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Access Control Lists (ACLs)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Access Control Lists (ACLs)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Access Control Lists (ACLs)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72756, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590829", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590829", "securityControlId": 31675, "ccis": [], "uuid": "81681f3c-8d91-5f4b-a4ed-bb7c7a74410b", "testId": "NET-04.2_A01", "test": "cybersecurity / data privacy attributes associated with information, source and destination objects are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(01)_ODP[01]\n53A_R5_AC-04(01)_ODP[02]", "defaultText": null }, { "id": 72757, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590829", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590829", "securityControlId": 31675, "ccis": [], "uuid": "00f6fc1c-2c93-5b02-8c38-7d0b547f0311", "testId": "NET-04.2_A02", "test": "information objects to be associated with cybersecurity / data privacy attributes are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-04(01)_ODP[03]\n53A_R5_AC-04(01)_ODP[04]", "defaultText": null }, { "id": 72758, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590829", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590829", "securityControlId": 31675, "ccis": [], "uuid": "87e48d55-2cc4-51de-928e-56ce3be5cd29", "testId": "NET-04.2_A03", "test": "source objects to be associated with cybersecurity / data privacy attributes are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-04(01)_ODP[05]\n53A_R5_AC-04(01)_ODP[06]", "defaultText": null }, { "id": 72759, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59083", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59083", "securityControlId": 31675, "ccis": [], "uuid": "2191860e-fdfc-5890-ba58-804255b64a6f", "testId": "NET-04.2_A04", "test": "destination objects to be associated with cybersecurity / data privacy attributes are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-04(01)_ODP[07]\n53A_R5_AC-04(01)_ODP[08]", "defaultText": null }, { "id": 72760, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59083", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59083", "securityControlId": 31675, "ccis": [], "uuid": "716d08e3-2183-5e87-84d7-8c34c2b3c76c", "testId": "NET-04.2_A05", "test": "information flow control policies as a basis for enforcement of flow control decisions are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-04(01)_ODP[09]", "defaultText": null }, { "id": 72761, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59083", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59083", "securityControlId": 31675, "ccis": [], "uuid": "cc1a2877-1afd-5190-bfba-382a8b28a760", "testId": "NET-04.2_A06", "test": "organization-defined cybersecurity / data privacy attributes associated with organization-defined information objects, organization-defined source objects and organization-defined destination objects are used to enforce organization-defined information flow control policies as a basis for flow control decisions.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-04(01)[01]\n53A_R5_AC-04(01)[02]", "defaultText": null }, { "id": 72762, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59083", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59083", "securityControlId": 31675, "ccis": [], "uuid": "0603127c-2685-52b0-8d86-018d3e1f74b6", "testId": "NET-04.2_A07", "test": "secure information transfer solutions are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.1.3e_ODP[1]", "defaultText": null }, { "id": 72763, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59083", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590831", "securityControlId": 31675, "ccis": [], "uuid": "e992c3e0-0744-51f6-ba04-fc4f654f516c", "testId": "NET-04.2_A08", "test": "information flows between security domains on connected systems are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.1.3e[a]", "defaultText": null }, { "id": 72764, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590831", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590831", "securityControlId": 31675, "ccis": [], "uuid": "84f4ea3d-16c6-5f61-bc92-797e38641393", "testId": "NET-04.2_A09", "test": "solutions are employed to control information flows between security domains on connected systems.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.1.3e[b]", "defaultText": null } ], "externalMappings": [ { "id": 587339, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78a34bfa-98d3-5b46-89b2-e1e76c867cc2", "parentControlId": 31675, "controlId": "AC-4(1)", "title": "AC-4(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587396" }, { "id": 587340, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3447b34e-6631-5cbf-87a5-d3b04a437696", "parentControlId": 31675, "controlId": "AC-04(01)", "title": "AC-04(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587396" }, { "id": 587341, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf363bfa-c9e0-5eab-a7f2-baffc36ec9ae", "parentControlId": 31675, "controlId": "AC-04(01)", "title": "AC-04(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587396" } ], "id": 31675, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.7312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.7312", "catalogueId": 1062, "uuid": "632d2474-2446-5b90-98d2-c9e9e0d6fdef", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization associate security attributes with information, source and destination objects to enforce defined information flow control configurations as a basis for flow control decisions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Object Security Attributes", "description": "

Control Description

Mechanisms exist to associate security attributes with information, source and destination objects to enforce defined information flow control configurations as a basis for flow control decisions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to associate security attributes with information, source and destination objects to enforce defined information flow control configurations as a basis for flow control decisions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-04.2", "family": "Network Security", "enhancements": "", "sortId": "NET-04.2", "references": "

Micro-Small Business (<10 staff)

∙ Tag files with classification labels before transferring

Small Business (10-49 staff)

∙ Data classification labels applied to objects in transit\n∙ DLP policy for classified data

Medium Business (50-249 staff)

∙ Object-level security attributes policy\n∙ DLP enforcement based on attributes

Large Business (250-999 staff)

∙ Enterprise DLP with object-level classification enforcement\n∙ Rights management (IRM)

Enterprise (>1,000 staff)

∙ Enterprise DLP platform (e.g., Microsoft Purview, Symantec DLP)\n∙ IRM/DRM\n∙ Automated classification and enforcement", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72765, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590831", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590831", "securityControlId": 31676, "ccis": [], "uuid": "16766aa8-7f3a-5b36-bf62-b48114ca2a1f", "testId": "NET-04.3_A01", "test": "information flow control mechanisms that encrypted information is prevented from bypassing are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(04)_ODP[01]", "defaultText": null }, { "id": 72766, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590831", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590831", "securityControlId": 31676, "ccis": [], "uuid": "62386769-fa09-561c-bf2c-076ccab679a1", "testId": "NET-04.3_A02", "test": "the organization-defined procedure or method used to prevent encrypted information from bypassing information flow control mechanisms is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(04)_ODP[02]\n53A_R5_AC-04(04)_ODP[03]", "defaultText": null }, { "id": 72767, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590831", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590831", "securityControlId": 31676, "ccis": [], "uuid": "e586099e-4bf4-5208-8846-040b3c51afa0", "testId": "NET-04.3_A03", "test": "encrypted information is prevented from bypassing the organization's information flow control mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: intrusion detection mechanisms", "otherId": "53A_R5_AC-04(04)", "defaultText": null } ], "externalMappings": [ { "id": 587342, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587396", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51ff4326-5a59-5110-b142-bbf37f828d1b", "parentControlId": 31676, "controlId": "AC-4(4)", "title": "AC-4(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587396" }, { "id": 587343, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c72368e8-ce64-5789-b0fe-9bc3f84a185a", "parentControlId": 31676, "controlId": "AC-04(04)", "title": "AC-04(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587397" }, { "id": 587344, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80831b63-1c2d-5fe4-bac7-3cb5865f2c0c", "parentControlId": 31676, "controlId": "AC-04(04)", "title": "AC-04(04)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587397" }, { "id": 587345, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b9b46ee-ca0f-588e-a6f9-2aa88ec1d448", "parentControlId": 31676, "controlId": "AC-04(04)", "title": "AC-04(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587397" }, { "id": 587346, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "939b79b0-9cdd-5eb7-96de-b9eae54a87c3", "parentControlId": 31676, "controlId": "AC-04(04)", "title": "AC-04(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587397" } ], "id": 31676, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.7312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.7312", "catalogueId": 1062, "uuid": "0d49be6c-22af-5387-ad12-8c5f0e2f7ae2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prevent encrypted data from bypassing content-checking mechanisms?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Content Check for Encrypted Data", "description": "

Control Description

Mechanisms exist to prevent encrypted data from bypassing content-checking mechanisms.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to prevent encrypted data from bypassing content-checking mechanisms.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-04.3", "family": "Network Security", "enhancements": "", "sortId": "NET-04.3", "references": "

Micro-Small Business (<10 staff)

∙ Enable TLS inspection on firewall if available

Small Business (10-49 staff)

∙ TLS inspection on gateway firewall\n∙ Policy for inspecting encrypted traffic

Medium Business (50-249 staff)

∙ SSL/TLS inspection on NGFW or proxy\n∙ Policy defining inspection rules

Large Business (250-999 staff)

∙ Enterprise TLS inspection platform\n∙ Decryption policy for high-risk traffic categories

Enterprise (>1,000 staff)

∙ Enterprise SSL/TLS inspection with NGFW or dedicated proxy (e.g., Zscaler)\n∙ Selective decryption policies\n∙ Privacy compliance for inspection", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72768, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590831", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590831", "securityControlId": 31677, "ccis": [], "uuid": "7e2fd73e-3b72-5da5-b35b-3d8fcbdb543f", "testId": "NET-04.4_A01", "test": "limitations on embedding data types within other data types are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(05)_ODP", "defaultText": null }, { "id": 72769, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590832", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590832", "securityControlId": 31677, "ccis": [], "uuid": "f8de0e10-bf46-54de-8633-0e797f094716", "testId": "NET-04.4_A02", "test": "organization-defined limitations are enforced on embedding data types within other data types.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(05)", "defaultText": null } ], "externalMappings": [ { "id": 587349, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78b28305-fcd6-5f79-b55f-d87e7e7fc4b5", "parentControlId": 31677, "controlId": "AC-4(5)", "title": "AC-4(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587397" }, { "id": 587350, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587397", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "940504d4-914e-5882-8ff1-9dba286d02d0", "parentControlId": 31677, "controlId": "AC-04(05)", "title": "AC-04(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587397" }, { "id": 587351, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2fff569-6e16-5898-aa77-5560ef36b546", "parentControlId": 31677, "controlId": "AC-04(05)", "title": "AC-04(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587398" } ], "id": 31677, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.7312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.7312", "catalogueId": 1062, "uuid": "26e7c71e-0347-5eea-aa46-306a1654f9cd", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce limitations on embedding data within other data types?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Embedded Data Types", "description": "

Control Description

Mechanisms exist to enforce limitations on embedding data within other data types.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to enforce limitations on embedding data within other data types.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-04.4", "family": "Network Security", "enhancements": "", "sortId": "NET-04.4", "references": "

Micro-Small Business (<10 staff)

∙ Block unauthorized file types at email gateway

Small Business (10-49 staff)

∙ Email gateway file type filtering\n∙ Web proxy content type controls

Medium Business (50-249 staff)

∙ Content inspection policy for embedded data types\n∙ Gateway filtering for prohibited file types

Large Business (250-999 staff)

∙ Enterprise content inspection solution\n∙ NGFW application layer filtering\n∙ Data type policies

Enterprise (>1,000 staff)

∙ Enterprise content inspection platform\n∙ NGFW with application-layer DPI\n∙ DLP for embedded data types\n∙ CASB for cloud content", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72770, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590832", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590832", "securityControlId": 31678, "ccis": [], "uuid": "92cb86de-7341-5fb0-bab6-7c484730233c", "testId": "NET-04.5_A01", "test": "metadata on which to base enforcement of information flow control is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(06)_ODP", "defaultText": null }, { "id": 72771, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590832", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590832", "securityControlId": 31678, "ccis": [], "uuid": "513b6e76-4108-5327-a9eb-7a68172d23db", "testId": "NET-04.5_A02", "test": "information flow control enforcement is based on organization-defined metadata.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(06)", "defaultText": null }, { "id": 72772, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590832", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590832", "securityControlId": 31678, "ccis": [], "uuid": "33a416d2-9ad2-5d47-8fd1-2b339544c821", "testId": "NET-04.5_A03", "test": "secure information transfer solutions are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.1.3e_ODP[1]", "defaultText": null }, { "id": 72773, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590832", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590832", "securityControlId": 31678, "ccis": [], "uuid": "37a50092-84df-56b5-9df9-4b5e5617522f", "testId": "NET-04.5_A04", "test": "information flows between security domains on connected systems are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.1.3e[a]", "defaultText": null }, { "id": 72774, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590832", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590832", "securityControlId": 31678, "ccis": [], "uuid": "3e5b85df-af91-5920-a0a4-12e4929b2206", "testId": "NET-04.5_A05", "test": "solutions are employed to control information flows between security domains on connected systems.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.1.3e[b]", "defaultText": null } ], "externalMappings": [ { "id": 587355, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae81eb21-c9ca-58ee-9dd7-70a239bcdbb0", "parentControlId": 31678, "controlId": "AC-4(6)", "title": "AC-4(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587398" }, { "id": 587356, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9626288f-837f-5d9c-9758-3057bf0202cc", "parentControlId": 31678, "controlId": "AC-04(06)", "title": "AC-04(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587398" }, { "id": 587357, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ffe3609-5cb9-52d7-a621-f44f3c255df6", "parentControlId": 31678, "controlId": "AC-04(06)", "title": "AC-04(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587398" }, { "id": 587358, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587398", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc54cc10-fb35-52a8-b3a1-2ce694030723", "parentControlId": 31678, "controlId": "AC-4(6)", "title": "AC-4(6)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587398" } ], "id": 31678, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.7312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.7312", "catalogueId": 1062, "uuid": "c0f57494-5245-5491-9770-f38881aae197", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce information flow controls based on metadata?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Metadata", "description": "

Control Description

Mechanisms exist to enforce information flow controls based on metadata.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to enforce information flow controls based on metadata.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-04.5", "family": "Network Security", "enhancements": "", "sortId": "NET-04.5", "references": "

Micro-Small Business (<10 staff)

∙ Review metadata in files before sharing externally

Small Business (10-49 staff)

∙ Policy requiring metadata review/stripping before external sharing

Medium Business (50-249 staff)

∙ Metadata scrubbing tools\n∙ Policy for metadata controls on shared files

Large Business (250-999 staff)

∙ Enterprise metadata management tools\n∙ Automated metadata stripping for external sharing

Enterprise (>1,000 staff)

∙ Enterprise metadata management and DLP platform\n∙ Automated metadata classification and stripping\n∙ DLP integration", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72775, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590833", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590833", "securityControlId": 31679, "ccis": [], "uuid": "eb1c1b9e-5270-52ad-b302-70823fc76bc3", "testId": "NET-04.6_A01", "test": "information flows requiring the use of human reviews are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(09)_ODP[01]", "defaultText": null }, { "id": 72776, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590833", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590833", "securityControlId": 31679, "ccis": [], "uuid": "7a64a2f7-b187-5dd1-9af4-e06cc9591039", "testId": "NET-04.6_A02", "test": "conditions under which the use of human reviews for information flows are to be enforced are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(09)_ODP[02]", "defaultText": null }, { "id": 72777, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590833", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590833", "securityControlId": 31679, "ccis": [], "uuid": "8f4fa096-78a7-528d-b610-4cc368589a06", "testId": "NET-04.6_A03", "test": "human reviews are used for organization-defined conditions.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(09)", "defaultText": null } ], "externalMappings": [ { "id": 587364, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587399", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99f6f357-6393-5e4a-9819-5ddcdb2c1a41", "parentControlId": 31679, "controlId": "AC-4(9)", "title": "AC-4(9)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587399" }, { "id": 587365, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587399", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ac5adbd-2112-5199-a1cc-8dec3618a874", "parentControlId": 31679, "controlId": "AC-04(09)", "title": "AC-04(09)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587399" }, { "id": 587366, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587399", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3416c372-dfe5-596b-aa7d-b786941cd809", "parentControlId": 31679, "controlId": "AC-04(09)", "title": "AC-04(09)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587399" } ], "id": 31679, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731201", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731201", "catalogueId": 1062, "uuid": "8dddd2ad-eaf2-583a-9703-5b35db22530b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce the use of human reviews for Access Control Lists (ACLs) and similar rulesets on a routine basis?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Human Reviews", "description": "

Control Description

Mechanisms exist to enforce the use of human reviews for Access Control Lists (ACLs) and similar rulesets on a routine basis.

Evidence Request List (ERL)

E-AST-12

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to enforce the use of human reviews for Access Control Lists (ACLs) and similar rulesets on a routine basis.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-04.6", "family": "Network Security", "enhancements": "", "sortId": "NET-04.6", "references": "

Micro-Small Business (<10 staff)

∙ Human review of flagged data transfers

Small Business (10-49 staff)

∙ Policy requiring human review of sensitive data transfers

Medium Business (50-249 staff)

∙ Human review process for cross-boundary data transfers\n∙ DLP alert review procedures

Large Business (250-999 staff)

∙ DLP alert triage workflow with human review\n∙ Dedicated review team

Enterprise (>1,000 staff)

∙ Enterprise DLP with human review workflow (SOC integration)\n∙ SOAR-assisted triage\n∙ 24/7 human review for critical transfers", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72778, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590833", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590833", "securityControlId": 31680, "ccis": [], "uuid": "879c1847-cc6d-5543-ac32-395d7ee3ec0a", "testId": "NET-04.7_A01", "test": "information flows between security domains on connected systems are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.1.3e[a]", "defaultText": null }, { "id": 72779, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590834", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590834", "securityControlId": 31680, "ccis": [], "uuid": "d810d7cd-80b1-5e98-866b-f3207d037992", "testId": "NET-04.7_A02", "test": "solutions are employed to control information flows between security domains on connected systems.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "172A_3.1.3e[b]", "defaultText": null }, { "id": 72780, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590834", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590834", "securityControlId": 31680, "ccis": [], "uuid": "fdc351ac-9958-540d-acbd-094b3572d224", "testId": "NET-04.7_A03", "test": "cybersecurity / data privacy policy filters to be used as a basis for enforcing information flow control are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(08)_ODP[01]\n53A_R5_AC-04(08)_ODP[02]", "defaultText": null }, { "id": 72781, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590834", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590834", "securityControlId": 31680, "ccis": [], "uuid": "35eaa52b-d15b-5435-bbcb-1693197c2f55", "testId": "NET-04.7_A04", "test": "information flows for which information flow control is enforced by cybersecurity / data privacy filters are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(08)_ODP[03]\n53A_R5_AC-04(08)_ODP[04]\n172A_3.1.3e_ODP[1]", "defaultText": null }, { "id": 72782, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590834", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590834", "securityControlId": 31680, "ccis": [], "uuid": "d51a804c-96e1-5fe7-b386-2a9d337b0ae9", "testId": "NET-04.7_A05", "test": "information flow control is enforced using organization-defined cybersecurity / data privacy policy filter as a basis for flow control decisions for organization-defined information flows.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(08)(a)[01]\n53A_R5_AC-04(08)(a)[02]", "defaultText": null }, { "id": 72783, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590834", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590834", "securityControlId": 31680, "ccis": [], "uuid": "0b30a7c1-9b6f-5e15-b3e4-f223894a93ab", "testId": "NET-04.7_A06", "test": "cybersecurity / data privacy policy identifying actions to be taken after a filter processing failure are defined (e.g., block, strip, modify or quarantine)
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-04(08)_ODP[05]\n53A_R5_AC-04(08)_ODP[06]", "defaultText": null }, { "id": 72784, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590834", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590834", "securityControlId": 31680, "ccis": [], "uuid": "d54043c5-3e4f-5d2c-8e17-f0fb05a255d7", "testId": "NET-04.7_A07", "test": "policy identifying actions to be taken after a filter processing failure are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-04(08)_ODP[07]", "defaultText": null }, { "id": 72785, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590835", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590835", "securityControlId": 31680, "ccis": [], "uuid": "2fdea09c-ba67-5cf3-a105-09738328ce43", "testId": "NET-04.7_A08", "test": "organization's data after a filter processing failure in accordance with organization's data after a filter processing failure in accordance with organization-defined privacy policy.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-04(08)(b)", "defaultText": null }, { "id": 72786, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590835", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590835", "securityControlId": 31680, "ccis": [], "uuid": "40a1af48-e5d7-577a-9664-dd063b0f4e2e", "testId": "NET-04.7_A09", "test": "when transferring information between different security domains, data is sanitized to minimize organization's in accordance with organization-defined policy.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-04(25)_ODP[01]\n53A_R5_AC-04(25)", "defaultText": null } ], "externalMappings": [ { "id": 587378, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8403ce27-c626-5a99-9db4-6217d9f00fd5", "parentControlId": 31680, "controlId": "AC-4(8)", "title": "AC-4(8)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587401" }, { "id": 587379, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8a58480-88b9-57aa-8e0e-f36600751488", "parentControlId": 31680, "controlId": "AC-04(08)", "title": "AC-04(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587401" }, { "id": 587380, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587401", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e0bcb56-7a25-5718-a608-f23ba3e3a7da", "parentControlId": 31680, "controlId": "AC-04(08)", "title": "AC-04(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587401" } ], "id": 31680, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731201", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731201", "catalogueId": 1062, "uuid": "389af909-292b-5d97-8da1-6665d05f0d56", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization evaluate access requests against established criteria to dynamically and uniformly enforce access rights and permissions?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Policy Decision Point (PDP)", "description": "

Control Description

Automated mechanisms exist to evaluate access requests against established criteria to dynamically and uniformly enforce access rights and permissions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to automatically evaluate access requests against established criteria to dynamically and uniformly enforce access rights and permissions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-04.7", "family": "Network Security", "enhancements": "", "sortId": "NET-04.7", "references": "

Medium Business (50-249 staff)

∙ Document policy decision points for network access control

Large Business (250-999 staff)

∙ Policy Decision Point (PDP) implemented in firewall/NAC\n∙ Access policy centralization

Enterprise (>1,000 staff)

∙ Enterprise PDP implementation (e.g., XACML, Zero Trust policy engine)\n∙ Centralized access policy management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72787, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590835", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590835", "securityControlId": 31681, "ccis": [], "uuid": "43a9b02e-0c6b-5573-b1a0-f8d39fbb7913", "testId": "NET-04.8_A01", "test": "data type identifiers to be used to validate data essential for information flow decisions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(12)_ODP", "defaultText": null }, { "id": 72788, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590836", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590836", "securityControlId": 31681, "ccis": [], "uuid": "3ba13158-de7b-5f3d-9c2c-ebf8026b81ae", "testId": "NET-04.8_A02", "test": "when transferring information between different security domains, organization-defined data type identifiers are used to validate data essential for information flow decisions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(12)", "defaultText": null } ], "externalMappings": [ { "id": 587395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587403", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8aa0dd7-edfa-5809-88f2-bafe4b4cc130", "parentControlId": 31681, "controlId": "AC-4(12)", "title": "AC-4(12)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587403" }, { "id": 587396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587403", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed6a3e8f-fac2-59b5-ba48-fc6596729dbb", "parentControlId": 31681, "controlId": "AC-04(12)", "title": "AC-04(12)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587403" }, { "id": 587397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587403", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aedcbd64-649f-537e-9868-12130f6d6617", "parentControlId": 31681, "controlId": "AC-04(12)", "title": "AC-04(12)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587403" } ], "id": 31681, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731201", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731201", "catalogueId": 1062, "uuid": "b2102b0a-9bb8-57ab-a9fb-84bf0a6e10a2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to utilize data type identifiers to validate data essential for information flow decisions when transferring information between different security domains?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Data Type Identifiers", "description": "

Control Description

Automated mechanisms exist to utilize data type identifiers to validate data essential for information flow decisions when transferring information between different security domains.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to automatically utilize data type identifiers to validate data essential for information flow decisions when transferring information between different security domains.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-04.8", "family": "Network Security", "enhancements": "", "sortId": "NET-04.8", "references": "

Micro-Small Business (<10 staff)

∙ Use file extension controls to restrict unauthorized data types

Small Business (10-49 staff)

∙ File type controls at email and web gateways

Medium Business (50-249 staff)

∙ Data type identifier policy\n∙ Content inspection with data type identification

Large Business (250-999 staff)

∙ Enterprise DLP with data type identification capabilities

Enterprise (>1,000 staff)

∙ Enterprise DLP with advanced data type identification (e.g., Symantec DLP, Forcepoint)\n∙ Pattern-based detection", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72789, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590836", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590836", "securityControlId": 31682, "ccis": [], "uuid": "9e7b043c-2e82-5419-a5e6-cf191a90c416", "testId": "NET-04.9_A01", "test": "policy-relevant subcomponents into which to decompose information for submission to policy enforcement mechanisms are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(13)_ODP", "defaultText": null }, { "id": 72790, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590836", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590836", "securityControlId": 31682, "ccis": [], "uuid": "e9c3bda8-6d6f-52bb-ac63-6d796c484d27", "testId": "NET-04.9_A02", "test": "when transferring information between different security domains, information is decomposed into organization-defined policy-relevant subcomponents for submission to policy enforcement mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(13)", "defaultText": null } ], "externalMappings": [ { "id": 587399, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587403", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "726a9ec6-d55c-5367-b80e-304e33469041", "parentControlId": 31682, "controlId": "AC-4(13)", "title": "AC-4(13)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587403" }, { "id": 587400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f32e4c26-be82-588e-bfc4-9a8a8017b8c5", "parentControlId": 31682, "controlId": "AC-04(13)", "title": "AC-04(13)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587404" }, { "id": 587401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f156c594-b258-5dba-9092-5ecc0deda09c", "parentControlId": 31682, "controlId": "AC-04(13)", "title": "AC-04(13)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587404" } ], "id": 31682, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731202", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731202", "catalogueId": 1062, "uuid": "55ee3578-81f7-58aa-beef-7a9b1bfcc202", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to decompose information into policy-relevant subcomponents for submission to policy enforcement mechanisms, when transferring information between different security domains?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Decomposition Into Policy-Related Subcomponents", "description": "

Control Description

Automated mechanisms exist to decompose information into policy-relevant subcomponents for submission to policy enforcement mechanisms, when transferring information between different security domains.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to automatically decompose information into policy-relevant subcomponents for submission to policy enforcement mechanisms, when transferring information between different security domains.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-04.9", "family": "Network Security", "enhancements": "", "sortId": "NET-04.9", "references": "

Medium Business (50-249 staff)

∙ Documented policy decomposition approach for network access

Large Business (250-999 staff)

∙ Formal policy decomposition methodology\n∙ Modular policy design

Enterprise (>1,000 staff)

∙ Enterprise policy framework with decomposed network access policies\n∙ Automated policy engine", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72791, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590836", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590836", "securityControlId": 31683, "ccis": [], "uuid": "d784445c-0157-549b-bc1c-3bf4b8910ea8", "testId": "NET-04.10_A01", "test": "unsanctioned information to be detected is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(15)_ODP[01]", "defaultText": null }, { "id": 72792, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590836", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590836", "securityControlId": 31683, "ccis": [], "uuid": "29f97949-12cd-592d-b557-fe49fe95f535", "testId": "NET-04.10_A02", "test": "cybersecurity / data privacy policy that requires the transfer of unsanctioned information between different security domains to be prohibited is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(15)_ODP[02]\n53A_R5_AC-04(15)_ODP[03]", "defaultText": null }, { "id": 72793, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590837", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590837", "securityControlId": 31683, "ccis": [], "uuid": "d1bf2e25-0829-5b12-8656-8aea3e143f8a", "testId": "NET-04.10_A03", "test": "when transferring information between different security domains, information is examined for the presence of organization-defined unsanctioned information.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(15)[01]", "defaultText": null }, { "id": 72794, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590837", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590837", "securityControlId": 31683, "ccis": [], "uuid": "9ffd4f2b-7d51-58c3-9490-623ae032c46b", "testId": "NET-04.10_A04", "test": "when transferring information between different security domains, transfer of organization-defined unsanctioned information is prohibited in accordance with the organization-defined cybersecurity / data privacy policy.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(15)[02]\n53A_R5_AC-04(15)[03]", "defaultText": null } ], "externalMappings": [ { "id": 587402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1df6fca3-ffad-5cec-807c-1f2a0cca81e1", "parentControlId": 31683, "controlId": "AC-4(15)", "title": "AC-4(15)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587404" }, { "id": 587403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f559368-d994-5c04-9946-40e88f9cbaa0", "parentControlId": 31683, "controlId": "AC-04(15)", "title": "AC-04(15)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587404" }, { "id": 587404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587404", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfce74e6-a84e-5b0f-93fd-0da9d647d80f", "parentControlId": 31683, "controlId": "AC-04(15)", "title": "AC-04(15)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587404" } ], "id": 31683, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731202", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731202", "catalogueId": 1062, "uuid": "bf6064ca-42f5-5932-93eb-07dd0ef5a5e6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to implement security policy filters requiring fully enumerated formats that restrict data structure and content, when transferring information between different security domains?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Detection of Unsanctioned Information", "description": "

Control Description

Automated mechanisms exist to implement security policy filters requiring fully enumerated formats that restrict data structure and content, when transferring information between different security domains.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to automatically implement security policy filters requiring fully enumerated formats that restrict data structure and content, when transferring information between different security domains.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-04.10", "family": "Network Security", "enhancements": "", "sortId": "NET-04.10", "references": "

Small Business (10-49 staff)

∙ DLP rules for detecting unsanctioned data in transfers

Medium Business (50-249 staff)

∙ DLP solution with content inspection for unsanctioned information detection

Large Business (250-999 staff)

∙ Enterprise DLP with keyword and pattern matching for unsanctioned info

Enterprise (>1,000 staff)

∙ Enterprise DLP platform (e.g., Microsoft Purview, Forcepoint)\n∙ ML-based unsanctioned information detection", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72795, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590837", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590837", "securityControlId": 31684, "ccis": [], "uuid": "1ea166e3-9a86-5cd6-9ea6-5a1d0e6c0e68", "testId": "NET-04.11_A01", "test": "solutions in approved configurations to control the flow of information across security domains are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(20)_ODP[01]", "defaultText": null }, { "id": 72796, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590837", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590837", "securityControlId": 31684, "ccis": [], "uuid": "166a6bf5-1a74-590a-9374-11f3f76a7443", "testId": "NET-04.11_A02", "test": "information to be controlled when it flows across security domains is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(20)_ODP[02]", "defaultText": null }, { "id": 72797, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590838", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590838", "securityControlId": 31684, "ccis": [], "uuid": "85197331-6b41-5461-93b2-b07bbdd44517", "testId": "NET-04.11_A03", "test": "organization-defined solutions in approved configurations are employed to control the flow of organization-defined information across security domains.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(20)", "defaultText": null } ], "externalMappings": [ { "id": 587405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac0ec90b-4343-5a59-bae9-577c3ad0999e", "parentControlId": 31684, "controlId": "AC-4(20)", "title": "AC-4(20)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587405" }, { "id": 587406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7d15bf1-e160-5f64-af7b-2460c04d0ccc", "parentControlId": 31684, "controlId": "AC-04(20)", "title": "AC-04(20)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587405" }, { "id": 587407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d244a2d7-d626-542e-afdd-19946d5ed78a", "parentControlId": 31684, "controlId": "AC-04(20)", "title": "AC-04(20)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587405" } ], "id": 31684, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731203", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731203", "catalogueId": 1062, "uuid": "86871dbe-f819-5dd6-89d8-b352eb338e12", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to examine information for the presence of unsanctioned information and prohibits the transfer of such information, when transferring information between different security domains?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Approved Solutions", "description": "

Control Description

Automated mechanisms exist to examine information for the presence of unsanctioned information and prohibits the transfer of such information, when transferring information between different security domains.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to automatically examine information for the presence of unsanctioned information and prohibits the transfer of such information, when transferring information between different security domains.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "NET-04.11", "family": "Network Security", "enhancements": "", "sortId": "NET-04.11", "references": "

Micro-Small Business (<10 staff)

∙ Use only approved tools for network data transfer

Small Business (10-49 staff)

∙ Approved network transfer tools list\n∙ Policy prohibiting unapproved transfer methods

Medium Business (50-249 staff)

∙ Approved solutions list for cross-domain data transfer\n∙ Policy enforcement at gateway

Large Business (250-999 staff)

∙ Formal approved solutions program\n∙ Gateway enforcement of approved transfer tools only

Enterprise (>1,000 staff)

∙ Enterprise approved solutions program with technical enforcement\n∙ CASB for cloud transfer control", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72798, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590838", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590838", "securityControlId": 31685, "ccis": [], "uuid": "4734d95b-d728-50ce-bfcc-531d85485c10", "testId": "NET-04.12_A01", "test": "source and destination points are uniquely identified and authenticated by organization-defined criteria for information transfer (e.g., organization, system, application, service or individual).
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(17)_ODP\n53A_R5_AC-04(17)", "defaultText": null } ], "externalMappings": [ { "id": 587409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb874deb-e851-5e3f-b16e-f24c662c0d5b", "parentControlId": 31685, "controlId": "AC-04(17)", "title": "AC-04(17)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587405" }, { "id": 587410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587405", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a666305-8dfe-53cb-8171-2e3eaf7df11a", "parentControlId": 31685, "controlId": "AC-04(17)", "title": "AC-04(17)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587405" }, { "id": 587412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39ec73f9-e9a1-5824-9b7c-98cccb209e2d", "parentControlId": 31685, "controlId": "AC-4(17)", "title": "AC-4(17)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587406" } ], "id": 31685, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731203", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731203", "catalogueId": 1062, "uuid": "5f0eca76-a2c4-521a-bfcd-c99422518bb0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to uniquely identify and authenticate source and destination points for information transfer?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Cross Domain Authentication", "description": "

Control Description

Automated mechanisms exist to uniquely identify and authenticate source and destination points for information transfer.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to automatically uniquely identify and authenticate source and destination points for information transfer.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-04.12", "family": "Network Security", "enhancements": "", "sortId": "NET-04.12", "references": "

Medium Business (50-249 staff)

∙ Cross-domain authentication policy and procedure

Large Business (250-999 staff)

∙ Federated identity for cross-domain authentication\n∙ Formal cross-domain auth standards

Enterprise (>1,000 staff)

∙ Enterprise federated identity management (e.g., Okta, Ping Identity)\n∙ Cross-domain authentication standards", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72799, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590838", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590838", "securityControlId": 31686, "ccis": [], "uuid": "8c810a2f-af30-55a2-a091-a543fe7bd6bd", "testId": "NET-04.13_A01", "test": "cybersecurity / data privacy policy filters to be implemented on metadata are defined (if selected).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(19)_ODP[01]\n53A_R5_AC-04(19)_ODP[02]", "defaultText": null }, { "id": 72800, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590838", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590838", "securityControlId": 31686, "ccis": [], "uuid": "6c7f8c2e-94da-5a23-a9dc-42f5cc88b2c9", "testId": "NET-04.13_A02", "test": "when transferring information between different security domains, organization-defined cybersecurity / data privacy policy filters are implemented on metadata.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(19)[01]\n53A_R5_AC-04(19)[02]", "defaultText": null } ], "externalMappings": [ { "id": 587416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdf7066f-d7c0-53e5-af9b-e773d7d21c44", "parentControlId": 31686, "controlId": "AC-04(19)", "title": "AC-04(19)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587406" }, { "id": 587417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2397d676-f038-5f08-ad17-c543deae90de", "parentControlId": 31686, "controlId": "AC-04(19)", "title": "AC-04(19)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587406" }, { "id": 587418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45566c86-2f74-5674-8c04-8471e9257fe2", "parentControlId": 31686, "controlId": "AC-4(19)", "title": "AC-4(19)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587406" } ], "id": 31686, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731203", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731203", "catalogueId": 1062, "uuid": "40661303-e134-531d-bcfb-a43f81e24892", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to apply cybersecurity and/or data protection filters on metadata?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 2.0, "title": "Metadata Validation", "description": "

Control Description

Automated mechanisms exist to apply cybersecurity and/or data protection filters on metadata.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to automatically apply cybersecurity and/or data protection filters on metadata.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-04.13", "family": "Network Security", "enhancements": "", "sortId": "NET-04.13", "references": "

Medium Business (50-249 staff)

∙ Validate metadata integrity for cross-domain transfers

Large Business (250-999 staff)

∙ Metadata validation controls for cross-domain data movement

Enterprise (>1,000 staff)

∙ Enterprise metadata validation framework\n∙ Automated metadata integrity checking", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72802, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590839", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590839", "securityControlId": 31688, "ccis": [], "uuid": "e91e036f-4453-5f9a-9c02-d1f0e179e379", "testId": "NET-05_A01", "test": "the type of agreement used to approve and manage the exchange of information is defined (e.g., interconnection security agreements, information exchange security agreements, memoranda of understanding or agreement, service level agreements, user agreements, non-disclosure agreements or organization-defined type of agreements).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-03_ODP[01]\n53A_R5_CA-03_ODP[02]", "defaultText": null }, { "id": 72803, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590839", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590839", "securityControlId": 31688, "ccis": [], "uuid": "105b59aa-729d-518f-a25e-49de74cda511", "testId": "NET-05_A02", "test": "security requirements for each system are documented as part of the exchange agreements.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-03b.[02]\n53A_R5_CA-03b.[03]\n171A_R3_A.03.12.05.b[02]", "defaultText": null }, { "id": 72804, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590839", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590839", "securityControlId": 31688, "ccis": [], "uuid": "43c417f5-c1fa-5b62-a499-30af87735114", "testId": "NET-05_A03", "test": "controls are documented as part of each exchange agreement.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-03b.[04]", "defaultText": null }, { "id": 72805, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590839", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590839", "securityControlId": 31688, "ccis": [], "uuid": "bdd4c327-70c6-5ae7-b871-505a8fb7f255", "testId": "NET-05_A04", "test": "the frequency at which to review and update agreements is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CA-03_ODP[03]\n171A_R3_A.03.12.05.ODP[02]", "defaultText": null }, { "id": 72806, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59084", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59084", "securityControlId": 31688, "ccis": [], "uuid": "468c4c2e-7498-5c34-a1c1-d3702d9a3f3d", "testId": "NET-05_A05", "test": "the exchange of sensitive / regulated data between the system and other systems is approved using organization-defined values.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_CA-03a.", "defaultText": null }, { "id": 72807, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59084", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59084", "securityControlId": 31688, "ccis": [], "uuid": "e7baef30-36f3-5321-a42d-e4e06d00cf09", "testId": "NET-05_A06", "test": "the exchange of sensitive / regulated data between the system and other systems is managed using organization-defined values.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_CA-03a.", "defaultText": null }, { "id": 72808, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59084", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59084", "securityControlId": 31688, "ccis": [], "uuid": "26bdd325-ae9b-5ad9-a351-6c13f4b3531a", "testId": "NET-05_A07", "test": "interface characteristics for each system are documented as part of the exchange agreements.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CA-03b.[01]\n171A_R3_A.03.12.05.b[01]", "defaultText": null }, { "id": 72809, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59084", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59084", "securityControlId": 31688, "ccis": [], "uuid": "3309ce58-600c-51f3-a9ec-87328e679037", "testId": "NET-05_A08", "test": "responsibilities for each system are documented as part of the exchange agreements.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_CA-03b.[05]\n171A_R3_A.03.12.05.b[03]", "defaultText": null }, { "id": 72810, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59084", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59084", "securityControlId": 31688, "ccis": [], "uuid": "8dc21be5-7c83-53bf-8d30-55fe8e8ab819", "testId": "NET-05_A09", "test": "the impact level of the information communicated is documented as part of each exchange agreement.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-03b.[06]", "defaultText": null }, { "id": 72811, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59084", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59084", "securityControlId": 31688, "ccis": [], "uuid": "be2ab896-0c60-5c21-827a-50b7e1967be0", "testId": "NET-05_A10", "test": "exchange agreements are reviewed per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-03c.", "defaultText": null }, { "id": 72812, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590841", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590841", "securityControlId": 31688, "ccis": [], "uuid": "284a78c9-3018-56bd-8e8d-f9775445f21c", "testId": "NET-05_A11", "test": "exchange agreements are updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-03c.", "defaultText": null }, { "id": 72813, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590841", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590841", "securityControlId": 31688, "ccis": [], "uuid": "8b4f999f-3883-507a-940c-bd2a3e2d1015", "testId": "NET-05_A12", "test": "systems are prohibited from directly connecting to an external network is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(25)_ODP[01]", "defaultText": null }, { "id": 72814, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590841", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590841", "securityControlId": 31688, "ccis": [], "uuid": "e19f6874-4cf3-55e6-a7ab-e4de1b6e3f1c", "testId": "NET-05_A13", "test": "the boundary protection device required for a direct connection to an external network is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(25)_ODP[02]\n53A_R5_SC-07(26)_ODP", "defaultText": null }, { "id": 72815, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590841", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590841", "securityControlId": 31688, "ccis": [], "uuid": "0a87c463-ab73-5636-b41d-273b1c05a26e", "testId": "NET-05_A14", "test": "the direct connection of systems to an external network without the use of boundary protection device is prohibited.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(25)", "defaultText": null }, { "id": 72816, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590841", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590841", "securityControlId": 31688, "ccis": [], "uuid": "201067a8-de32-5ea9-8067-102b34b4620e", "testId": "NET-05_A15", "test": "the direct connection of classified national security system to an external network without the use of an organization-defined boundary protection device is prohibited.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(26)", "defaultText": null }, { "id": 72817, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590842", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590842", "securityControlId": 31688, "ccis": [], "uuid": "b000fe43-732c-577c-9d1d-5c8ef87c43f6", "testId": "NET-05_A16", "test": "approved authorizations are enforced for controlling the flow of CUI between connected systems.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.01.03[02]", "defaultText": null }, { "id": 72818, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590842", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590842", "securityControlId": 31688, "ccis": [], "uuid": "4cb138b3-e65c-5382-9b1d-b6d216fac406", "testId": "NET-05_A17", "test": "one or more of the following PARAMETER VALUES are selected: {interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service-level agreements; user agreements; non-disclosure agreements; other types of agreements}.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.12.05.ODP[01]", "defaultText": null }, { "id": 72819, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590842", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590842", "securityControlId": 31688, "ccis": [], "uuid": "c47fa3eb-c60b-5488-95de-c11ccfce9ef0", "testId": "NET-05_A18", "test": "the exchange of CUI between the system and other systems is approved using .
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171
SCF Defined Parameters: requirements as described in the contract", "otherId": "171A_R3_A.03.12.05.a[01]", "defaultText": null }, { "id": 72820, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590842", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590842", "securityControlId": 31688, "ccis": [], "uuid": "9793e8e8-ad8b-5794-9def-ae0c9249bcc1", "testId": "NET-05_A19", "test": "the exchange of CUI between the system and other systems is managed using .
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171
SCF Defined Parameters: requirements as described in the contract", "otherId": "171A_R3_A.03.12.05.a[02]", "defaultText": null }, { "id": 72821, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590843", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590843", "securityControlId": 31688, "ccis": [], "uuid": "c9c5c2b1-be32-5fa0-990f-670b2e38d027", "testId": "NET-05_A20", "test": "exchange agreements are reviewed .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months", "otherId": "171A_R3_A.03.12.05.c[01]", "defaultText": null }, { "id": 72822, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590843", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590843", "securityControlId": 31688, "ccis": [], "uuid": "3d7f4863-8fa4-517a-99df-753618bcd03e", "testId": "NET-05_A21", "test": "exchange agreements are updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months", "otherId": "171A_R3_A.03.12.05.c[02]", "defaultText": null } ], "externalMappings": [ { "id": 587426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4791a167-f46f-5dc9-b9f5-db6a63054833", "parentControlId": 31688, "controlId": "NET 1.2", "title": "NET 1.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587407" }, { "id": 587427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91e17949-34c0-5ef4-98a6-90317ff5b506", "parentControlId": 31688, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587408" }, { "id": 587428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c73257b-f019-5e74-9392-e93a7d80a06e", "parentControlId": 31688, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587408" }, { "id": 587429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92d788a4-b127-50d3-b5da-e7d2fe027463", "parentControlId": 31688, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587408" }, { "id": 587430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8cc144e5-9ee1-51f9-897d-fd54039b24b8", "parentControlId": 31688, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587408" }, { "id": 587431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e62599f-9273-53c8-8113-b72b9b6cfbfb", "parentControlId": 31688, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587408" }, { "id": 587432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e213c3d-f19c-52b8-9569-252ef47b7e75", "parentControlId": 31688, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587408" }, { "id": 587433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bcff5c76-ef56-5946-a247-186c981e3dd5", "parentControlId": 31688, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587408" }, { "id": 587434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9799a926-e9d9-5ca7-a8b5-aa04c176988e", "parentControlId": 31688, "controlId": "CA-3", "title": "CA-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587408" }, { "id": 587435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2185c850-7402-5aff-a542-a4224b4f5ef8", "parentControlId": 31688, "controlId": "CA-3(1)", "title": "CA-3(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587408" }, { "id": 587436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8dde254e-7749-5973-b652-deb9610f48bb", "parentControlId": 31688, "controlId": "CA-3(2)", "title": "CA-3(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587409" }, { "id": 587437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b62b2143-33e1-5be1-bbab-2cf8a7f67902", "parentControlId": 31688, "controlId": "CA-03", "title": "CA-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587409" }, { "id": 587438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "985f1696-6adf-518d-99ec-eaf8725cf247", "parentControlId": 31688, "controlId": "SC-07(25)", "title": "SC-07(25)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587409" }, { "id": 587439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de9b4771-b1de-5ee7-bfb1-ec62fb3c708a", "parentControlId": 31688, "controlId": "SC-07(26)", "title": "SC-07(26)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587409" }, { "id": 587440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81560737-4d29-5142-856f-c872059e0b77", "parentControlId": 31688, "controlId": "CA-03", "title": "CA-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587409" }, { "id": 587441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e8468e1-593a-5bd6-9592-4a00d0f71f46", "parentControlId": 31688, "controlId": "CA-03", "title": "CA-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587409" }, { "id": 587442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b88b0d39-3000-5e73-afe8-d994684a51e6", "parentControlId": 31688, "controlId": "SC-07(25)", "title": "SC-07(25)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587409" }, { "id": 587443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "854eaad1-c5df-5950-bd99-ef59171ba717", "parentControlId": 31688, "controlId": "SC-07(26)", "title": "SC-07(26)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587409" }, { "id": 587444, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46b89210-9757-5e2a-8ff8-6f9f5ae3dd09", "parentControlId": 31688, "controlId": "CA-03", "title": "CA-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58741" }, { "id": 587445, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac362f12-342d-5f57-a697-30f001736c85", "parentControlId": 31688, "controlId": "CA-03", "title": "CA-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58741" }, { "id": 587446, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af8b04d0-f100-56cb-8e56-ba0575e993dc", "parentControlId": 31688, "controlId": "CA-03", "title": "CA-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58741" }, { "id": 587447, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86f814f1-64ca-5706-a84e-d9a73e89a947", "parentControlId": 31688, "controlId": "CA-3", "title": "CA-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58741" }, { "id": 587448, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "400192d9-6eed-5bc8-810d-47e237e8c7d9", "parentControlId": 31688, "controlId": "CA-3", "title": "CA-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58741" }, { "id": 587449, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7382b30-774a-50d8-8516-8e78c67fb51a", "parentControlId": 31688, "controlId": "CA-3", "title": "CA-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58741" }, { "id": 587451, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bac3f4fd-fc02-5c51-bb46-f12a30e84011", "parentControlId": 31688, "controlId": "NFO - CA-3", "title": "NFO - CA-3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58741" }, { "id": 587452, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61db2b12-d593-52de-bd5e-9bdf122df706", "parentControlId": 31688, "controlId": "03.01.03", "title": "03.01.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58741" }, { "id": 587453, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88d006b9-2f04-5a18-b2ff-e3f0a4ca0791", "parentControlId": 31688, "controlId": "03.01.20.c.02", "title": "03.01.20.c.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587411" }, { "id": 587454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e360a0a-800a-5688-b61a-e9e8c1eba8ff", "parentControlId": 31688, "controlId": "03.12.05.a", "title": "03.12.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587411" }, { "id": 587455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8adf8e3f-e98f-5c3f-adf3-b0fe42f73e01", "parentControlId": 31688, "controlId": "03.12.05.b", "title": "03.12.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587411" }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "9f1fe538-66ee-5895-9afb-cf73533a4c20", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "0fe6dda7-5a31-5d95-8462-c630252ac4a0", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "5db881aa-61f9-5b58-99a7-4e55e17962f1", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "6b78b5c2-ab86-5f66-bfeb-84657800fb4e", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "a86d44bb-e7e2-5b1f-b74e-97cd057a2036", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "a1d8bb25-9b4e-5b55-90dc-a93fee966339", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "a76bee6c-892f-5632-a8b9-a52c638691b7", "isPublic": true } ], "id": 31688, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731204", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731204", "catalogueId": 1062, "uuid": "b0d1d25a-2da5-5ac8-ae79-3e34c1822d02", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization authorize connections from systems to other systems using Interconnection Security Agreements (ISAs), or similar methods, that document, for each interconnection:\n(1) Interface characteristics;\n(2) Security, compliance and resilience requirements; and;\n(3) The nature of the information communicated?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Interconnection Security Agreements (ISAs)", "description": "

Control Description

Mechanisms exist to authorize connections from systems to other systems using Interconnection Security Agreements (ISAs), or similar methods, that document, for each interconnection:\n(1) Interface characteristics;\n(2) Security, compliance and resilience requirements; and;\n(3) The nature of the information communicated.

Evidence Request List (ERL)

E-NET-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to authorize connections from systems to other systems using Interconnection Security Agreements (ISAs), or similar methods, that document, for each interconnection:\n(1) Interface characteristics;\n(2) Security, compliance and resilience requirements; and;\n(3) The nature of the information communicated.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-05", "family": "Network Security", "enhancements": "", "sortId": "NET-05", "references": "

Micro-Small Business (<10 staff)

∙ Interconnection Security Agreement (ISA)\n∙ Information Exchange Security Agreements (IESA)\n∙ Memoranda of Understanding (MOU) / Agreement (MOA)

Small Business (10-49 staff)

∙ Interconnection Security Agreement (ISA)\n∙ Information Exchange Security Agreements (IESA)\n∙ Memoranda of Understanding (MOU) / Agreement (MOA)

Medium Business (50-249 staff)

∙ Interconnection Security Agreement (ISA)\n∙ Information Exchange Security Agreements (IESA)\n∙ Memoranda of Understanding (MOU) / Agreement (MOA)

Large Business (250-999 staff)

∙ Interconnection Security Agreement (ISA)\n∙ Information Exchange Security Agreements (IESA)\n∙ Memoranda of Understanding (MOU) / Agreement (MOA)

Enterprise (>1,000 staff)

∙ Interconnection Security Agreement (ISA)\n∙ Information Exchange Security Agreements (IESA)\n∙ Memoranda of Understanding (MOU) / Agreement (MOA)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72823, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590843", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590843", "securityControlId": 31689, "ccis": [], "uuid": "d867cb94-cb25-5646-9d00-3f2f28c7184d", "testId": "NET-05.1_A01", "test": "systems are prohibited from directly connecting to an external network is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(27)_ODP[01]", "defaultText": null }, { "id": 72824, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590843", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590843", "securityControlId": 31689, "ccis": [], "uuid": "b3906807-9a34-50b5-b60d-f161b0dcbb35", "testId": "NET-05.1_A02", "test": "the boundary protection device required for a direct connection of a system to an external network is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(27)_ODP[02]", "defaultText": null }, { "id": 72825, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590843", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590843", "securityControlId": 31689, "ccis": [], "uuid": "3d4f2fe7-6de6-59a2-ab1b-d2e2866de94c", "testId": "NET-05.1_A03", "test": "the direct connection of a system to an external network without the use of a boundary protection device is prohibited.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(27)", "defaultText": null } ], "externalMappings": [ { "id": 587495, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b2ebede-07fa-5585-bfc0-cf2f2ccfad9d", "parentControlId": 31689, "controlId": "CA-3(3)", "title": "CA-3(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587416" }, { "id": 587496, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a8a61f2-1e71-529c-becc-3c556c8f83c3", "parentControlId": 31689, "controlId": "SC-07(27)", "title": "SC-07(27)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587416" }, { "id": 587497, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587416", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f959b5ba-fac0-50cb-85ce-65fcc14451bc", "parentControlId": 31689, "controlId": "SC-07(27)", "title": "SC-07(27)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587416" } ], "id": 31689, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731204", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731204", "catalogueId": 1062, "uuid": "1f066ef2-01f8-55ff-9762-c6b5b8550bf0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prohibit the direct connection of a sensitive system to an external network without the use of an organization-defined boundary protection device?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "External System Connections", "description": "

Control Description

Mechanisms exist to prohibit the direct connection of a sensitive system to an external network without the use of an organization-defined boundary protection device.

Evidence Request List (ERL)

E-NET-06\nE-NET-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to prohibit the direct connection of a sensitive system to an external network without the use of an organization-defined boundary protection device.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-05.1", "family": "Network Security", "enhancements": "", "sortId": "NET-05.1", "references": "

Micro-Small Business (<10 staff)

∙ Document authorized external system connections

Small Business (10-49 staff)

∙ External connection inventory\n∙ Connection approval policy

Medium Business (50-249 staff)

∙ Formal external system connection management process\n∙ Connection authorization records

Large Business (250-999 staff)

∙ External connection governance program\n∙ Automated connection inventory

Enterprise (>1,000 staff)

∙ Enterprise external connection governance platform\n∙ Automated discovery and authorization of external connections", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72826, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590844", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590844", "securityControlId": 31690, "ccis": [], "uuid": "e2068ba3-cb90-5e0d-b5e5-e484094104b0", "testId": "NET-05.2_A01", "test": "internal connections of organization-defined system components to the system are authorized.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CA-09a.", "defaultText": null }, { "id": 72827, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590844", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590844", "securityControlId": 31690, "ccis": [], "uuid": "dbab1c0d-0a22-556a-9fb5-baccdfe85ae2", "testId": "NET-05.2_A02", "test": "for each internal connection, the interface characteristics are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-09b.[01]", "defaultText": null }, { "id": 72828, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590844", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590844", "securityControlId": 31690, "ccis": [], "uuid": "223e838f-9dc5-5504-a1d8-d6182251dd00", "testId": "NET-05.2_A03", "test": "for each internal connection, the security requirements are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-09b.[02]", "defaultText": null }, { "id": 72829, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590844", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590844", "securityControlId": 31690, "ccis": [], "uuid": "d714abae-fd17-506f-89c8-09c43a02ff71", "testId": "NET-05.2_A04", "test": "for each internal connection, the privacy requirements are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-09b.[03]", "defaultText": null }, { "id": 72830, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590844", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590844", "securityControlId": 31690, "ccis": [], "uuid": "3fe015dc-0f8c-510f-b295-b275bd9c5091", "testId": "NET-05.2_A05", "test": "for each internal connection, the nature of the information communicated is documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-09b.[04]", "defaultText": null }, { "id": 72831, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590844", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590844", "securityControlId": 31690, "ccis": [], "uuid": "83dd2cf0-0c28-55bc-a70e-36ac4224eeb7", "testId": "NET-05.2_A06", "test": "internal system connections are terminated after organization-defined conditions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CA-09c.", "defaultText": null }, { "id": 72832, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590844", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590844", "securityControlId": 31690, "ccis": [], "uuid": "a7754215-824a-5bd2-8a32-5607a163b532", "testId": "NET-05.2_A07", "test": "the continued need for each internal connection is reviewed organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-09d.", "defaultText": null }, { "id": 72833, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590845", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590845", "securityControlId": 31690, "ccis": [], "uuid": "a6dafc99-af9e-5b9e-9b2c-689e6ea4bcb3", "testId": "NET-05.2_A08", "test": "system components or classes of components requiring internal connections to the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-09_ODP[01]", "defaultText": null }, { "id": 72834, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590845", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590845", "securityControlId": 31690, "ccis": [], "uuid": "4caebb59-af64-5c27-8869-21d31d988911", "testId": "NET-05.2_A09", "test": "conditions requiring termination of internal connections are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-09_ODP[02]", "defaultText": null }, { "id": 72835, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590845", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590845", "securityControlId": 31690, "ccis": [], "uuid": "55ec0887-9d3a-5341-813a-8072ed6adb96", "testId": "NET-05.2_A10", "test": "frequency at which to review the continued need for each internal connection is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-09_ODP[03]", "defaultText": null } ], "externalMappings": [ { "id": 587518, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c3ce3f5-a815-5236-b3eb-ac7e7395c77d", "parentControlId": 31690, "controlId": "NET 1.6", "title": "NET 1.6", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587419" }, { "id": 587519, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acebbba5-1bbe-5a84-9841-da2a06eb637e", "parentControlId": 31690, "controlId": "NET 2.1(b)", "title": "NET 2.1(b)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587419" }, { "id": 587520, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62ff31b0-d07b-55b6-a115-383811247414", "parentControlId": 31690, "controlId": "CA-9", "title": "CA-9", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587419" }, { "id": 587521, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e265318-bc12-5dbb-9969-809f86470071", "parentControlId": 31690, "controlId": "CA-09", "title": "CA-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587419" }, { "id": 587522, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8be5ccf1-8025-5524-a3e1-0ac1aa030b09", "parentControlId": 31690, "controlId": "CA-09", "title": "CA-09", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587419" }, { "id": 587523, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25dc6987-74d8-53b3-a4aa-d3d38d8e1141", "parentControlId": 31690, "controlId": "CA-09", "title": "CA-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587419" }, { "id": 587524, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d83418d1-9140-5d59-b13a-b78f44ded2f6", "parentControlId": 31690, "controlId": "CA-09", "title": "CA-09", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587419" }, { "id": 587525, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f1a073c-9a9b-5822-9e75-157caf28cdf6", "parentControlId": 31690, "controlId": "CA-09", "title": "CA-09", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587419" }, { "id": 587526, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad1125a4-fa0a-5b46-88c5-0f9d762f97b9", "parentControlId": 31690, "controlId": "CA-09", "title": "CA-09", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587419" }, { "id": 587527, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89ad7aab-ce8f-56d3-a319-af8288bfd49e", "parentControlId": 31690, "controlId": "NFO - CA-9", "title": "NFO - CA-9", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58742" }, { "id": 587528, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5841bca9-b473-553c-a32a-429f7b81ddd5", "parentControlId": 31690, "controlId": "03.01.03", "title": "03.01.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58742" }, { "id": 587529, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a761ea92-b3f1-5749-9458-8370e0b9d893", "parentControlId": 31690, "controlId": "03.12.05.a", "title": "03.12.05.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58742" }, { "id": 587530, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a66e2592-f19b-59f8-9053-4b6490c1e61a", "parentControlId": 31690, "controlId": "03.12.05.b", "title": "03.12.05.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58742" }, { "id": 587531, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f50e42c-a50b-54c3-b197-80290b3cd93d", "parentControlId": 31690, "controlId": "03.12.05.c", "title": "03.12.05.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58742" }, { "controlId": "B.1.18", "title": "B.1.18 — Insecure and Rogue Connections", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, CA-9, SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "d8da8417-ad78-5203-89c2-953317b31073", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.18", "title": "NEI 08-09 App D.1.18 — Insecure and Rogue Connections", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.18", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "72f01300-02f8-579e-9ed8-38a8d3a6cf11", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.18", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "2cb9bd5f-b2be-5185-b9b9-30611d0ad4a5", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "fa72182d-574c-53a9-81db-38b1409f776f", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "80d99cd2-9c0a-53a3-a11d-035f06a9d15c", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "11e1107d-90bc-5a55-ac8a-c4c3a4369730", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "f4dc9f3f-6c59-5337-87b1-4a553d674588", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "5941f3a0-a949-5549-b120-7c3eb88ee7f8", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "54fc11e3-4db1-523c-848e-948386aa564d", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "e02f66cf-abec-5935-a175-1d7d272c0e6d", "isPublic": true } ], "id": 31690, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731205", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731205", "catalogueId": 1062, "uuid": "a4966be6-cefb-5ef4-a6eb-6375024a95a8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization control internal system connections through authorizing internal connections of systems and documenting, for each internal connection, the interface characteristics, security requirements and the nature of the information communicated?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Internal System Connections", "description": "

Control Description

Mechanisms exist to control internal system connections through authorizing internal connections of systems and documenting, for each internal connection, the interface characteristics, security requirements and the nature of the information communicated.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to control internal system connections through authorizing internal connections of systems and documenting, for each internal connection, the interface characteristics, security requirements and the nature of the information communicated.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.18", "controlId": "NET-05.2", "family": "Network Security", "enhancements": "", "sortId": "NET-05.2", "references": "

Micro-Small Business (<10 staff)

∙ Document authorized internal system connections

Small Business (10-49 staff)

∙ Internal network connection documentation\n∙ Connection authorization process

Medium Business (50-249 staff)

∙ Formal internal connection management policy\n∙ Network topology documentation

Large Business (250-999 staff)

∙ Enterprise CMDB with internal connection mapping\n∙ Automated network topology discovery

Enterprise (>1,000 staff)

∙ Enterprise CMDB (e.g., ServiceNow)\n∙ Automated network discovery (e.g., Nmap, SolarWinds)\n∙ Connection governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72836, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590845", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590845", "securityControlId": 31691, "ccis": [], "uuid": "b8db64c3-cfdf-5017-a0d9-681cb7eb73fa", "testId": "NET-06_A01", "test": "logical isolation techniques are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.13.4e_ODP[1]\n172A_3.13.4e_ODP[3]", "defaultText": null }, { "id": 72837, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590845", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590845", "securityControlId": 31691, "ccis": [], "uuid": "eb5f571f-debe-52e6-bf1a-94f68270cfe2", "testId": "NET-06_A02", "test": "mechanisms and/or techniques used to logically separate information flows are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(21)_ODP[01]", "defaultText": null }, { "id": 72838, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590846", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590846", "securityControlId": 31691, "ccis": [], "uuid": "542b8fbf-6cf7-56d7-9622-3f90d13de9a3", "testId": "NET-06_A03", "test": "information flows are separated logically using organization-defined mechanisms and/or techniques to accomplish organization-defined required separations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-04(21)[01]", "defaultText": null }, { "id": 72839, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590846", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590846", "securityControlId": 31691, "ccis": [], "uuid": "ab647805-05e0-531b-a4ee-c15788fc7823", "testId": "NET-06_A04", "test": "publicly accessible system components are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.13.5[a]", "defaultText": null }, { "id": 72840, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590846", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590846", "securityControlId": 31691, "ccis": [], "uuid": "9a54497f-9c23-5ef8-b474-86e467030804", "testId": "NET-06_A05", "test": "subnetworks for publicly accessible system components are physically or logically separated from internal networks.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.13.5[b]", "defaultText": null }, { "id": 72841, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590846", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590846", "securityControlId": 31691, "ccis": [], "uuid": "4bda7831-a8b2-51a6-bea4-369bf1bdd3d1", "testId": "NET-06_A06", "test": "physical isolation techniques and/or organization-defined logical isolation techniques are employed in organizational systems and system components.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.13.4e[a]", "defaultText": null }, { "id": 72842, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590846", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590846", "securityControlId": 31691, "ccis": [], "uuid": "0ddbb324-15b6-5000-a7a3-5a6233355bef", "testId": "NET-06_A07", "test": "mechanisms and/or techniques used to physically separate information flows are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-04(21)_ODP[02]", "defaultText": null }, { "id": 72843, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590846", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590846", "securityControlId": 31691, "ccis": [], "uuid": "d3da2429-596e-5b41-bcb4-d6114ded4e8b", "testId": "NET-06_A08", "test": "required separations by types of information are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-04(21)_ODP[03]", "defaultText": null }, { "id": 72844, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590847", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590847", "securityControlId": 31691, "ccis": [], "uuid": "15640404-9327-560b-9454-65850299fc3c", "testId": "NET-06_A09", "test": "information flows are separated physically using organization-defined mechanisms and/or techniques to accomplish organization-defined required separations.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-04(21)[02]", "defaultText": null }, { "id": 72845, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590847", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590847", "securityControlId": 31691, "ccis": [], "uuid": "f30c11dd-8e20-541f-be8e-ba751689031f", "testId": "NET-06_A10", "test": "subnetworks are implemented for publicly accessible system components that are physically or logically separated from internal networks.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.13.01.b", "defaultText": null } ], "externalMappings": [ { "id": 587561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587431", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b13c893c-3033-541e-b8a3-de9f69a61b54", "parentControlId": 31691, "controlId": "NET 1.1", "title": "NET 1.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587431" }, { "id": 587562, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fdf6cbf-8ea8-5fd5-b6cc-3c821799ae93", "parentControlId": 31691, "controlId": "NET 1.3", "title": "NET 1.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587432" }, { "id": 587563, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bbad5cc-075c-512e-b0bf-216d4ae2a843", "parentControlId": 31691, "controlId": "NET 2.2", "title": "NET 2.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587432" }, { "id": 587564, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59c3569c-93d9-5333-b6fb-131480e1f878", "parentControlId": 31691, "controlId": "SR 5.1", "title": "SR 5.1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587432" }, { "id": 587565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55d9a2aa-ca63-53cd-9c05-b974784079fb", "parentControlId": 31691, "controlId": "SR 5.1 RE 1", "title": "SR 5.1 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587432" }, { "id": 587566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ff0a9cd-6e1f-508a-bd30-67dc06970642", "parentControlId": 31691, "controlId": "CR 5.1", "title": "CR 5.1", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587432" }, { "id": 587568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17fb8a31-a35b-54e0-b5bc-79351839f1f0", "parentControlId": 31691, "controlId": "8.2", "title": "8.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587432" }, { "id": 587569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c854a29c-2aa9-56b3-88b3-322febd11856", "parentControlId": 31691, "controlId": "8.22", "title": "8.22", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587432" }, { "id": 587578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8ed96f7-e89b-5793-a162-45410d4d0cf6", "parentControlId": 31691, "controlId": "AC-4(21)", "title": "AC-4(21)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587433" }, { "id": 587579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "199ffef2-afa7-56da-a56b-2e4f814a36d1", "parentControlId": 31691, "controlId": "AC-04(21)", "title": "AC-04(21)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587434" }, { "id": 587580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587434", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "527f14d2-3798-543f-9185-e4a24e2f047c", "parentControlId": 31691, "controlId": "AC-04(21)", "title": "AC-04(21)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587434" }, { "id": 587582, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587434", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7307735-90d9-50a1-a696-9eda071d7332", "parentControlId": 31691, "controlId": "AC-4(21)", "title": "AC-4(21)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587434" }, { "id": 587584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587434", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d72dc97-c116-5d6b-b796-554066af07ec", "parentControlId": 31691, "controlId": "3.13.5", "title": "3.13.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587434" }, { "id": 587585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587434", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a84c781-85bb-559c-9beb-96416c9a5cbb", "parentControlId": 31691, "controlId": "03.13.01.b", "title": "03.13.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587434" }, { "id": 587673, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98fb41c2-fe54-5897-ae4c-c9d2efe5de9e", "parentControlId": 31691, "controlId": "ARCHITECTURE-2b", "title": "ARCHITECTURE-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587445" }, { "id": 587674, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4c605c9-dc50-5322-b559-22fdbbf3d188", "parentControlId": 31691, "controlId": "ARCHITECTURE-2d", "title": "ARCHITECTURE-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587445" }, { "id": 587675, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7db5128e-d8a7-57b3-940e-725ab1003ee7", "parentControlId": 31691, "controlId": "ARCHITECTURE-2h", "title": "ARCHITECTURE-2h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587445" }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "357e28ee-aaba-5a00-a7ad-3287be504af0", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "b5260cf6-63cd-500b-b602-bc336aab06ec", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "7a2cb6a7-0229-55bd-acce-37ebe144d1fe", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "d8a751e7-cb92-5106-afdb-1c1a4e854b08", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "23d13d33-0511-581b-92da-9ba385606567", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "bca2c23e-1679-586a-b881-9dd2fcebc715", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "5a4390ab-3fec-5686-ac12-9c7e16f023b3", "isPublic": true } ], "id": 31691, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731205", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731205", "catalogueId": 1062, "uuid": "031e9298-53ed-5612-971f-f2c917afdeec", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure network architecture utilizes network segmentation to isolate Technology Assets, Applications and/or Services (TAAS) to protect from other network resources?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Network Segmentation (macrosegementation)", "description": "

Control Description

Mechanisms exist to ensure network architecture utilizes network segmentation to isolate Technology Assets, Applications and/or Services (TAAS) to protect from other network resources.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ Network segmentation exists to implement separate network addresses (e.g., different subnets) to connect TAASD in different security domains (e.g., sensitive/regulated data environments).\n▪ IT and/or cybersecurity architects maintain a segmented development network to ensure a secure development environment.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to ensure network architecture utilizes network segmentation to isolate Technology Assets, Applications and/or Services (TAAS) to protect from other network resources.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-06", "family": "Network Security", "enhancements": "", "sortId": "NET-06", "references": "

Micro-Small Business (<10 staff)

∙ Subnetting\n∙ Virtual Local Area Network (VLAN)

Small Business (10-49 staff)

∙ Subnetting\n∙ Virtual Local Area Network (VLAN)

Medium Business (50-249 staff)

∙ Subnetting\n∙ Virtual Local Area Network (VLAN)

Large Business (250-999 staff)

∙ Subnetting\n∙ Virtual Local Area Network (VLAN)

Enterprise (>1,000 staff)

∙ Subnetting\n∙ Virtual Local Area Network (VLAN)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72846, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590847", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590847", "securityControlId": 31692, "ccis": [], "uuid": "22444b0d-3062-526e-b596-c29b748d85ea", "testId": "NET-06.1_A01", "test": "cybersecurity tools, mechanisms and support components to be isolated from other internal system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(13)_ODP", "defaultText": null }, { "id": 72847, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590847", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590847", "securityControlId": 31692, "ccis": [], "uuid": "5447383a-5747-5042-8b09-2b4352f3a3e2", "testId": "NET-06.1_A02", "test": "cybersecurity tools, mechanisms and support components are isolated from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(13)", "defaultText": null }, { "id": 72848, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590847", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590847", "securityControlId": 31692, "ccis": [], "uuid": "b5e766f5-94a7-57be-8d0a-f9c0596eb2a5", "testId": "NET-06.1_A03", "test": "security management subnets are logically isolated.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(29)_ODP[01]", "defaultText": null }, { "id": 72849, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590848", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590848", "securityControlId": 31692, "ccis": [], "uuid": "117d91b7-271e-5256-aa0d-e50b5a9390d9", "testId": "NET-06.1_A04", "test": "security management subnet system components and functions to be isolated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(29)_ODP[02]", "defaultText": null }, { "id": 72850, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590848", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590848", "securityControlId": 31692, "ccis": [], "uuid": "43585d8c-d36d-5c9b-b704-cfb14b38c35e", "testId": "NET-06.1_A05", "test": "organization-defined criteria are used to isolate security management subnets.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(29)", "defaultText": null }, { "id": 72851, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590848", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590848", "securityControlId": 31692, "ccis": [], "uuid": "019a81e8-5b9f-5bd6-b5b4-4ea7c461b214", "testId": "NET-06.1_A06", "test": "physical isolation techniques are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.13.4e_ODP[1]\n172A_3.13.4e_ODP[2]", "defaultText": null }, { "id": 72852, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590848", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590848", "securityControlId": 31692, "ccis": [], "uuid": "f88addb5-e6f8-59ba-b472-1eb317d27b7b", "testId": "NET-06.1_A07", "test": "logical isolation techniques are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.13.4e_ODP[1]\n172A_3.13.4e_ODP[3]", "defaultText": null }, { "id": 72853, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590848", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590848", "securityControlId": 31692, "ccis": [], "uuid": "fc07d911-5bbe-529b-960a-74e119defab5", "testId": "NET-06.1_A08", "test": "physical isolation techniques and/or organization-defined logical isolation techniques are employed in organizational systems and system components.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.13.4e[a]", "defaultText": null } ], "externalMappings": [ { "id": 587758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587454", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "276a3876-e4eb-5e2b-a855-9cec5b7537c9", "parentControlId": 31692, "controlId": "SR 5.1 RE 2", "title": "SR 5.1 RE 2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587454" }, { "id": 587759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de6aafae-6070-5e61-a78b-5be985d41035", "parentControlId": 31692, "controlId": "8.22", "title": "8.22", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587455" }, { "id": 587762, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37288198-ff0e-5740-96ec-b79cd13a8985", "parentControlId": 31692, "controlId": "SC-7(13)", "title": "SC-7(13)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587455" }, { "id": 587763, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29606b4f-ed9b-5de0-836d-f40e2ef02032", "parentControlId": 31692, "controlId": "SC-07(13)", "title": "SC-07(13)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587455" }, { "id": 587764, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587455", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5128d4a9-eaa2-5ca1-8efe-12ed50517f55", "parentControlId": 31692, "controlId": "SC-07(29)", "title": "SC-07(29)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587455" }, { "id": 587766, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587456", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43a5bbe6-4189-5317-916b-779d411aab5a", "parentControlId": 31692, "controlId": "SC-07(13)", "title": "SC-07(13)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587456" }, { "id": 587767, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587456", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ed35e0d-3be2-5b79-ae51-34ae14463a41", "parentControlId": 31692, "controlId": "SC-07(29)", "title": "SC-07(29)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587456" }, { "id": 587770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587456", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51ee759c-14f7-58dc-9016-fc899173419e", "parentControlId": 31692, "controlId": "SC-7(13)", "title": "SC-7(13)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587456" }, { "id": 587771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587456", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7dc6f7f-ed41-5a31-a7d6-a017483af1d8", "parentControlId": 31692, "controlId": "SC-7(13)", "title": "SC-7(13)", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587456" } ], "id": 31692, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731205", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731205", "catalogueId": 1062, "uuid": "9d57511d-9493-594f-8337-9ee950d0456f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement security management subnets to isolate security tools and support components from other internal system components by implementing separate subnetworks with managed interfaces to other components of the system?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Security Management Subnets", "description": "

Control Description

Mechanisms exist to implement security management subnets to isolate security tools and support components from other internal system components by implementing separate subnetworks with managed interfaces to other components of the system.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ Processing and storage of service location, including a managed security zone to house cybersecurity and data protection tools.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to implement security management subnets to isolate security tools and support components from other internal system components by implementing separate subnetworks with managed interfaces to other components of the system.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-06.1", "family": "Network Security", "enhancements": "", "sortId": "NET-06.1", "references": "

Medium Business (50-249 staff)

∙ Separate management network or VLAN for security management

Large Business (250-999 staff)

∙ Dedicated security management subnet\n∙ Out-of-band management access controls

Enterprise (>1,000 staff)

∙ Enterprise out-of-band management network\n∙ Dedicated jump servers\n∙ Privileged access workstations (PAW)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72855, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590849", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590849", "securityControlId": 31694, "ccis": [], "uuid": "fea4700f-eada-542f-ab57-a0c774307d1e", "testId": "NET-06.3_A01", "test": "segmentation controls restrict inbound and outbound connectivity for sensitive / regulated data enclaves (secure zones).
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 587801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60b72729-1bcc-5b3e-9387-b2716a7dfaa9", "parentControlId": 31694, "controlId": "NET 1.5", "title": "NET 1.5", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587459" }, { "id": 587802, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58746", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4259c1b9-085f-5018-b846-1c0eca252d68", "parentControlId": 31694, "controlId": "SR 5.1 RE 3", "title": "SR 5.1 RE 3", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58746" }, { "id": 587803, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58746", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "089fb7d5-6892-52d2-aeb1-ea76ffc51d34", "parentControlId": 31694, "controlId": "SR 5.2 RE 2", "title": "SR 5.2 RE 2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58746" }, { "id": 587804, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58746", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53d46188-8b1f-5e89-812d-99554bbfb661", "parentControlId": 31694, "controlId": "03.13.01.b", "title": "03.13.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58746" } ], "id": 31694, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731206", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731206", "catalogueId": 1062, "uuid": "d699f911-81de-57fb-9f9e-50e1f52e09c0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement segmentation controls to restrict inbound and outbound connectivity for sensitive/regulated data enclaves (secure zones)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Sensitive / Regulated Data Enclave (Secure Zone)", "description": "

Control Description

Mechanisms exist to implement segmentation controls to restrict inbound and outbound connectivity for sensitive/regulated data enclaves (secure zones).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to implement segmentation controls to restrict inbound and outbound connectivity for sensitive/regulated data enclaves (secure zones).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-06.3", "family": "Network Security", "enhancements": "", "sortId": "NET-06.3", "references": "

Medium Business (50-249 staff)

∙ Dedicated network segment for sensitive/regulated data systems

Large Business (250-999 staff)

∙ Secure enclave/zone for sensitive data\n∙ Enhanced controls within the zone

Enterprise (>1,000 staff)

∙ Enterprise secure data enclave with enhanced controls\n∙ Data loss prevention at enclave boundary\n∙ Microsegmentation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72856, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590849", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590849", "securityControlId": 31695, "ccis": [], "uuid": "ac185611-33b7-59c3-a023-88487b5d7df4", "testId": "NET-06.4_A01", "test": "sensitive / regulated data enclaves (secure zones) are isolated from corporate-provided IT resources by providing enclave-specific IT services (e.g., directory services, DNS, NTP, ITAM, antimalware, patch management, etc.) to those isolated network segments.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 587823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42994476-4d9c-5996-9071-536d4d1a5a9d", "parentControlId": 31695, "controlId": "ARCHITECTURE-2i", "title": "ARCHITECTURE-2i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587462" }, { "id": 587824, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587462", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42c42a0a-2a28-5bb7-904f-9d595c99f028", "parentControlId": 31695, "controlId": "ARCHITECTURE-2j", "title": "ARCHITECTURE-2j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587462" } ], "id": 31695, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731206", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731206", "catalogueId": 1062, "uuid": "a9b4b8ed-4e89-5f59-a854-68ffd9405377", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization isolate sensitive/regulated data enclaves (secure zones) from corporate-provided IT resources by providing enclave-specific IT services (e.g., directory services, DNS, NTP, ITAM, antimalware, patch management, etc.) to those isolated network segments?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Segregation From Enterprise Services", "description": "

Control Description

Mechanisms exist to isolate sensitive/regulated data enclaves (secure zones) from corporate-provided IT resources by providing enclave-specific IT services (e.g., directory services, DNS, NTP, ITAM, antimalware, patch management, etc.) to those isolated network segments.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to isolate sensitive/regulated data enclaves (secure zones) from corporate-provided IT resources by providing enclave-specific IT services (e.g., directory services, DNS, NTP, ITAM, antimalware, patch management, etc.) to those isolated network segments.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-06.4", "family": "Network Security", "enhancements": "", "sortId": "NET-06.4", "references": "

Medium Business (50-249 staff)

∙ Segregate sensitive systems from general enterprise network services

Large Business (250-999 staff)

∙ Network isolation for sensitive systems from enterprise services\n∙ Controlled access points

Enterprise (>1,000 staff)

∙ Enterprise network segmentation with isolated sensitive-system zones\n∙ Zero-trust access to sensitive zones", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72857, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59085", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59085", "securityControlId": 31696, "ccis": [], "uuid": "79129056-c526-5e44-ab8a-c26972193ca2", "testId": "NET-06.5_A01", "test": "Internet access from sensitive / regulated data enclaves (secure zones) is prohibited or strictly-controlled.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 587835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03a9fbc7-bb70-5990-a170-c460e1d7f01a", "parentControlId": 31696, "controlId": "SC-07(28)", "title": "SC-07(28)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587463" }, { "id": 587836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ecccc0f3-a3cf-5de7-b774-cca426979775", "parentControlId": 31696, "controlId": "SC-07(28)", "title": "SC-07(28)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587463" }, { "id": 587837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "771db868-3c31-51eb-82c5-b461d93396e7", "parentControlId": 31696, "controlId": "SC-07(28)", "title": "SC-07(28)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587464" }, { "id": 587838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "351a0d4e-004b-545c-967d-623cdb86f4af", "parentControlId": 31696, "controlId": "SC-07(28)", "title": "SC-07(28)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587464" }, { "id": 587839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587464", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73483dc3-e8c4-5047-baec-102e8b769d99", "parentControlId": 31696, "controlId": "SC-07(28)", "title": "SC-07(28)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587464" } ], "id": 31696, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731207", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731207", "catalogueId": 1062, "uuid": "6137948d-b04b-5d64-933d-317cac74440f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prohibit, or strictly-control, Internet access from sensitive/regulated data enclaves (secure zones)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Direct Internet Access Restrictions", "description": "

Control Description

Mechanisms exist to prohibit, or strictly-control, Internet access from sensitive/regulated data enclaves (secure zones).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to prohibit, or strictly-control, Internet access from sensitive/regulated data enclaves (secure zones).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-06.5", "family": "Network Security", "enhancements": "", "sortId": "NET-06.5", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Access Control Lists (ACLs)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Access Control Lists (ACLs)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Access Control Lists (ACLs)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Access Control Lists (ACLs)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Access Control Lists (ACLs)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72862, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590851", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590851", "securityControlId": 31699, "ccis": [], "uuid": "857396ff-28f7-570c-9dce-4e0516bde78c", "testId": "NET-07_A01", "test": "a period of inactivity to terminate network connections associated with communications sessions is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: no longer than ten (10) minutes for privileged sessions and no longer than fifteen (15) minutes for user sessions", "otherId": "171A_3.13.9[a]\n53A_R5_SC-10_ODP", "defaultText": null }, { "id": 72863, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590851", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590851", "securityControlId": 31699, "ccis": [], "uuid": "e9d3f1a5-98ef-57f1-aa73-db2aa72dba73", "testId": "NET-07_A02", "test": "network connections associated with communications sessions are terminated at the end of the sessions.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: no longer than ten (10) minutes for privileged sessions and no longer than fifteen (15) minutes for user sessions", "otherId": "171A_3.13.9[b]\n53A_R5_SC-10", "defaultText": null }, { "id": 72864, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590851", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590851", "securityControlId": 31699, "ccis": [], "uuid": "332a1cdf-26ab-5b76-90ac-7cf10016eaae", "testId": "NET-07_A03", "test": "network connections associated with communications sessions are terminated after the defined period of inactivity.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: no longer than ten (10) minutes for privileged sessions and no longer than fifteen (15) minutes for user sessions", "otherId": "171A_3.13.9[c]\n53A_R5_SC-10", "defaultText": null }, { "id": 72865, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590851", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590851", "securityControlId": 31699, "ccis": [], "uuid": "8b28eb23-80af-56dd-a066-d223c919bc84", "testId": "NET-07_A04", "test": "network connections are terminated when nonlocal maintenance is completed.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.07.05.c[02]", "defaultText": null }, { "id": 72866, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590852", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590852", "securityControlId": 31699, "ccis": [], "uuid": "6311505c-8d6f-5ce6-bafb-a5ffe9c10f73", "testId": "NET-07_A05", "test": "the time period of inactivity after which the system terminates a network connection associated with a communications session is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.13.09.ODP[01]", "defaultText": null }, { "id": 72867, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590852", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590852", "securityControlId": 31699, "ccis": [], "uuid": "b73ab855-261a-54d8-a646-b5e52491eb54", "testId": "NET-07_A06", "test": "the network connection associated with a communications session is terminated at the end of the session or after an organization-defined time period of inactivity.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 72868, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590852", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590852", "securityControlId": 31699, "ccis": [], "uuid": "2c007342-639f-5e54-a82f-f79b9fa8682c", "testId": "NET-07_A07", "test": "the network connection associated with a communications session is terminated at the end of the session or after of inactivity.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: no longer than 15 minutes", "otherId": "171A_R3_A.03.13.09", "defaultText": null } ], "externalMappings": [ { "id": 587866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91f6acce-1e9d-5d24-b029-553397f380d8", "parentControlId": 31699, "controlId": "NET 3.3", "title": "NET 3.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587475" }, { "id": 587867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16be2c9f-e01e-5e7e-9a17-6eb9156ed9c5", "parentControlId": 31699, "controlId": "CR 2.6", "title": "CR 2.6", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587475" }, { "id": 587868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a91ce5ef-82ed-5b9b-aea3-959cc867b534", "parentControlId": 31699, "controlId": "T1071", "title": "T1071", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587475" }, { "id": 587869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03a09403-7b65-56d4-9371-1c540fbab2f3", "parentControlId": 31699, "controlId": "T1071.001", "title": "T1071.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587475" }, { "id": 587870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa9909f6-b0e6-5cb3-9adc-17e1ba441e1c", "parentControlId": 31699, "controlId": "T1071.002", "title": "T1071.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587475" }, { "id": 587871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5ab6faa-38b3-5ac6-addd-39c5652b319c", "parentControlId": 31699, "controlId": "T1071.003", "title": "T1071.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587475" }, { "id": 587872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587475", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fc8c44f-6601-5a0a-962e-5434e87f595d", "parentControlId": 31699, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587475" }, { "id": 587873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587476", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bbee1d6-d649-5cc8-b98c-23e9049383c7", "parentControlId": 31699, "controlId": "SC-10", "title": "SC-10", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587476" }, { "id": 587874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587476", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2925f6eb-bd9f-586a-8cdf-b0bf647358dc", "parentControlId": 31699, "controlId": "SC-10", "title": "SC-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587476" }, { "id": 587875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587476", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2084e143-347e-52de-9395-c2b323943fd8", "parentControlId": 31699, "controlId": "SC-10", "title": "SC-10", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587476" }, { "id": 587876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587476", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1bfd1ee-5938-56db-a20f-671fe75e0a3c", "parentControlId": 31699, "controlId": "SC-10", "title": "SC-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587476" }, { "id": 587878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587476", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92beb747-7d82-59c4-8ace-7d8fb63aa836", "parentControlId": 31699, "controlId": "3.13.9", "title": "3.13.9", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587476" }, { "id": 587879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587476", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a860d29-7d58-55ed-88af-7269800b2200", "parentControlId": 31699, "controlId": "03.13.09", "title": "03.13.09", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587476" }, { "controlId": "B.1.16", "title": "B.1.16 — “Open/Insecure” Protocol Restrictions", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-7, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a483cacf-d910-5a74-a6c9-4613d15ae690", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.16", "title": "NEI 08-09 App D.1.16 — “Open/Insecure” Protocol Restrictions", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.16", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "18e60a12-cdca-5b0a-9d6d-a0c0eda2d29d", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.16", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "07acf345-55d3-5034-bf89-ca742a8e60ce", "isPublic": true }, { "controlId": "CIP-007-6-R1", "title": "CIP-007-6-R1 — System Security Management - Ports and Services", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "aa9299e8-98e5-5584-9c31-9fe8e0ce137a", "isPublic": true }, { "controlId": "CIP-007-6-1.1", "title": "CIP-007-6-1.1 — Where technically feasible, enable only logical network accessible ports that have been determined to be needed by th...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a3958765-2c15-511e-9dc8-52f37c4d3453", "isPublic": true }, { "controlId": "CIP-007-6-1.2", "title": "CIP-007-6-1.2 — Protect against the use of unnecessary physical input/output ports used for network connectivity, console commands, o...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8ea739ba-84e4-5d85-82a5-af78cda50ab6", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "3a9c913b-928a-527d-ac43-959d43f3adc5", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "95638c6d-9eac-53bd-b68f-4507009584d6", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "d2e6b6ab-716e-5271-bfa1-28777e32b04e", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "1e2954eb-6009-5ec0-9aba-61dc5d8fb6a0", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "72f65fc8-3ae7-551a-b4fc-2590dc4db2ce", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "64003715-1d21-5611-b809-c7c22d61389d", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "e2cf445b-13ea-5128-b00a-778138f530e5", "isPublic": true } ], "id": 31699, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731208", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731208", "catalogueId": 1062, "uuid": "691700f1-9513-5081-a669-22cb531d4919", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization terminate network connections at the end of a session or after an organization-defined time period of inactivity?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Network Connection Termination", "description": "

Control Description

Mechanisms exist to terminate network connections at the end of a session or after an organization-defined time period of inactivity.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ SBC enforce network connection terminations at the end of a session or after an entity-defined time period of inactivity.\n▪ SBC terminate remote sessions at the end of the session or after an entity-defined time period of inactivity.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to terminate network connections at the end of a session or after an organization-defined time period of inactivity.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.16
NERC-CIP (2026) Requirements: CIP-007-6-R1", "controlId": "NET-07", "family": "Network Security", "enhancements": "", "sortId": "NET-07", "references": "

Micro-Small Business (<10 staff)

∙ Configure session timeouts on systems and applications

Small Business (10-49 staff)

∙ Session timeout policy\n∙ Configure timeouts on all key systems

Medium Business (50-249 staff)

∙ Formal network session termination policy\n∙ Automated session timeout enforcement

Large Business (250-999 staff)

∙ Enterprise session management controls\n∙ Automated disconnect for idle sessions\n∙ Network access control enforcement

Enterprise (>1,000 staff)

∙ Enterprise session management platform\n∙ Automated session termination via NAC/IAM\n∙ Zero-trust continuous session validation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72869, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590852", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590852", "securityControlId": 31700, "ccis": [], "uuid": "9f1a2a6c-8bed-5fc6-a3ec-374cfa4578dd", "testId": "NET-08_A01", "test": "Network Intrusion Detection / Prevention Systems (NIDS/NIPS) is utilized to detect and/or prevent intrusions into the network.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 587920, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2460befc-6caa-5945-83ea-0e12d23296ca", "parentControlId": 31700, "controlId": "8.21", "title": "8.21", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587482" }, { "id": 587924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e932e4f1-5889-5580-b79a-a6424fbb5c08", "parentControlId": 31700, "controlId": "3.14.6", "title": "3.14.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587482" }, { "id": 587925, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7530f6cd-90cf-5dc3-8153-78824bc63938", "parentControlId": 31700, "controlId": "03.13.01.a", "title": "03.13.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587482" }, { "id": 587926, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587483", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da98c0a5-d070-50b0-98eb-bb97a774e350", "parentControlId": 31700, "controlId": "03.14.06.c", "title": "03.14.06.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587483" }, { "id": 587945, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587485", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db85e118-a44a-5e33-a064-a07b18fbabe6", "parentControlId": 31700, "controlId": "CIP-005-7 1.5", "title": "CIP-005-7 1.5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587485" }, { "controlId": "B.3.6", "title": "B.3.6 — Transmission Integrity", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "3e61fd36-8ef7-55a1-8352-cfd05648e46e", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.6", "title": "NEI 08-09 App D.3.6 — Transmission Integrity", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "3e2768f4-03fd-5c29-9947-307602210972", "isPublic": true }, { "controlId": "10 CFR 73.54(a)(2)", "title": "10 CFR 73.54(a)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "2f491298-31ec-537e-88a3-092e022ac749", "isPublic": true }, { "controlId": "CIP-012-1-R1", "title": "CIP-012-1-R1 — Real-time Assessment and Monitoring Data Protection Between Control Centers", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b5750291-a836-571b-9b87-06d362014a23", "isPublic": true }, { "controlId": "CIP-012-1-1.1", "title": "CIP-012-1-1.1 — Identification of security protection used to mitigate the risks posed by unauthorized disclosure and unauthorized mo...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-012-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a3dda5cf-fb7e-5b35-9652-d006ae901d32", "isPublic": true }, { "controlId": "CIP-012-1-1.2", "title": "CIP-012-1-1.2 — Identification of where the Responsible Entity applied security protection for transmitting Real-time Assessment and...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-012-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "52dacf86-8675-5bca-bbf1-a2c8dcfc207c", "isPublic": true }, { "controlId": "CIP-012-1-1.3", "title": "CIP-012-1-1.3 — If the Control Centers are owned or operated by different Responsible Entities, identification of the responsibilitie...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-012-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "84fcf8f4-0025-5b02-980f-09fa2aac8efe", "isPublic": true }, { "controlId": "CIP-012-2-1.1", "title": "CIP-012-2-1.1 — Risk Mitigation for Availability, Integrity, and Confidentiality of Real-Time Data (CIP-012-2)", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-012-1-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "56bbd94f-eb5f-50ec-be33-401980dc78c6", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "c10d526b-5cdf-5845-b496-119b8b9cc180", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "9b8264c6-d69d-5bf0-82f4-bc0be6212541", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "e1a68ace-991d-5ae2-8b90-3b957b9c5c2c", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "94d4aac5-4923-5cf1-8f54-99038c1c3fd3", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "5633af5f-896f-59e5-98f0-8d11c82a88e1", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "2a7f0a14-1175-548c-a2ee-cb643a768478", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "8ed94493-5546-5b39-9559-26a49d1b2478", "isPublic": true } ], "id": 31700, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731208", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731208", "catalogueId": 1062, "uuid": "dc0cdb8b-dc80-50ee-9f24-d565096b70e0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Network Intrusion Detection / Prevention Systems (NIDS / NIPS)", "description": "

Control Description

Mechanisms exist to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to employ Network Intrusion Detection / Prevention Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.6
NERC-CIP (2026) Requirements: CIP-012-1-R1", "controlId": "NET-08", "family": "Network Security", "enhancements": "", "sortId": "NET-08", "references": "

Micro-Small Business (<10 staff)

∙ Network Intrusion Detection System (NIDS)\n∙ Network Intrusion Prevention Systems (NIPS)

Small Business (10-49 staff)

∙ Network Intrusion Detection System (NIDS)\n∙ Network Intrusion Prevention Systems (NIPS)

Medium Business (50-249 staff)

∙ Network Intrusion Detection System (NIDS)\n∙ Network Intrusion Prevention Systems (NIPS)

Large Business (250-999 staff)

∙ Network Intrusion Detection System (NIDS)\n∙ Network Intrusion Prevention Systems (NIPS)

Enterprise (>1,000 staff)

∙ Network Intrusion Detection System (NIDS)\n∙ Network Intrusion Prevention Systems (NIPS)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72870, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590852", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590853", "securityControlId": 31701, "ccis": [], "uuid": "3b601200-7838-5d43-b4a6-5098f579b801", "testId": "NET-08.1_A01", "test": "De-Militarized Zone (DMZ) network segments exist to separate untrusted networks from trusted networks.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 587970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "292d45cb-041e-5711-a85d-c9e07a621465", "parentControlId": 31701, "controlId": "SR 1.13", "title": "SR 1.13", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587488" }, { "id": 587971, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52daef02-fec3-57b6-a10f-dd314d027645", "parentControlId": 31701, "controlId": "8.2", "title": "8.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587488" }, { "id": 587974, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587488", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e1654d6-3494-5a03-b910-6a357084d07c", "parentControlId": 31701, "controlId": "03.13.01.b", "title": "03.13.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587488" } ], "id": 31701, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731208", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731208", "catalogueId": 1062, "uuid": "de29b78f-f952-5680-8272-c77a4a357e7c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization monitor De-Militarized Zone (DMZ) network segments to separate untrusted networks from trusted networks?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "DMZ Networks", "description": "

Control Description

Mechanisms exist to monitor De-Militarized Zone (DMZ) network segments to separate untrusted networks from trusted networks.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Administrative processes are used to configure boundary devices (e.g., firewalls, routers, etc.) to deny network traffic by default and allow network traffic by exception (e.g., deny all, permit by exception). \n▪ Internet-facing technologies are governed no differently from internal network assets.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to monitor De-Militarized Zone (DMZ) network segments to separate untrusted networks from trusted networks.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-08.1", "family": "Network Security", "enhancements": "", "sortId": "NET-08.1", "references": "

Micro-Small Business (<10 staff)

∙ System Security Plan (SSP)

Small Business (10-49 staff)

∙ System Security Plan (SSP)

Medium Business (50-249 staff)

∙ Architectural review board\n∙ System Security Plan (SSP)

Large Business (250-999 staff)

∙ Architectural review board\n∙ System Security Plan (SSP)

Enterprise (>1,000 staff)

∙ Architectural review board\n∙ System Security Plan (SSP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72871, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590853", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590853", "securityControlId": 31702, "ccis": [], "uuid": "c78c99a3-f179-5199-8bdb-0e9fcb767a55", "testId": "NET-08.2_A01", "test": "wireless network segments implement Wireless Intrusion Detection / Prevention Systems (WIDS/WIPS) technologies.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 588060, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587498", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e72888df-98e1-5676-bbe5-000bbccb758d", "parentControlId": 31702, "controlId": "SI-4(14)", "title": "SI-4(14)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587498" }, { "id": 588061, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587498", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c547da9d-93f1-5256-b1bb-53fdde83386a", "parentControlId": 31702, "controlId": "SI-4(15)", "title": "SI-4(15)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587498" }, { "id": 588062, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587498", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00b8174f-9f93-52b5-9129-c90dedb70ce1", "parentControlId": 31702, "controlId": "SI-04(15)", "title": "SI-04(15)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587498" }, { "id": 588063, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587498", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d783b47b-9529-59ae-ac01-fba19969d8c1", "parentControlId": 31702, "controlId": "SI-04(15)", "title": "SI-04(15)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587498" } ], "id": 31702, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731209", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731209", "catalogueId": 1062, "uuid": "53e31a09-5d22-5998-9ffe-799fee0634d4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize Wireless Intrusion Detection / Protection Systems (WIDS / WIPS) on wireless network segments?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Wireless Intrusion Detection / Prevention Systems (WIDS / WIPS) Deployment", "description": "

Control Description

Mechanisms exist to utilize Wireless Intrusion Detection / Protection Systems (WIDS / WIPS) on wireless network segments.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ IT and/or cybersecurity personnel receive feeds from Wireless Intrusion Detection / Protection Systems (WIDS / WIPS) to identify rogue wireless devices and to detect attack attempts via wireless networks.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to utilize Wireless Intrusion Detection / Protection Systems (WIDS / WIPS) on wireless network segments.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-08.2", "family": "Network Security", "enhancements": "", "sortId": "NET-08.2", "references": "

Micro-Small Business (<10 staff)

∙ Wireless Intrusion Detection System (WIDS)\n∙ Wireless Intrusion Prevention Systems (WIPS)

Small Business (10-49 staff)

∙ Wireless Intrusion Detection System (WIDS)\n∙ Wireless Intrusion Prevention Systems (WIPS)

Medium Business (50-249 staff)

∙ Wireless Intrusion Detection System (WIDS)\n∙ Wireless Intrusion Prevention Systems (WIPS)

Large Business (250-999 staff)

∙ Wireless Intrusion Detection System (WIDS)\n∙ Wireless Intrusion Prevention Systems (WIPS)

Enterprise (>1,000 staff)

∙ Wireless Intrusion Detection System (WIDS)\n∙ Wireless Intrusion Prevention Systems (WIPS)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72874, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590854", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590854", "securityControlId": 31705, "ccis": [], "uuid": "87f516dc-ac2f-5c2b-8cf2-018fffa46d4d", "testId": "NET-09_A01", "test": "the authenticity of communications sessions is protected.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.13.15\n171A_R3_A.03.13.15\n53A_R5_SC-23", "defaultText": null }, { "id": 72875, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590854", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590854", "securityControlId": 31705, "ccis": [], "uuid": "ea092a1d-42ca-5440-a2fa-28aa9fda283f", "testId": "NET-09_A02", "test": "the confidentiality and/or integrity of information is/are maintained during preparation for transmission.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-08(02)[01]\n53A_R5_SC-08(02)_ODP", "defaultText": null }, { "id": 72876, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590854", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590854", "securityControlId": 31705, "ccis": [], "uuid": "d4d7d1fd-c62b-5d61-b999-60be21ceedcc", "testId": "NET-09_A03", "test": "the confidentiality and/or integrity of information is/are maintained during reception.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-08(02)[02]\n53A_R5_SC-08(02)_ODP", "defaultText": null } ], "externalMappings": [ { "id": 588096, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e7f218f-bbc7-5920-8394-2d4f87c892de", "parentControlId": 31705, "controlId": "USER 1.16", "title": "USER 1.16", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58751" }, { "id": 588097, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9ddddd1-674f-53ad-a808-e34d05f3845c", "parentControlId": 31705, "controlId": "SR 3.8", "title": "SR 3.8", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58751" }, { "id": 588098, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1bc4e01-f59c-52e4-a8d2-90595413d46a", "parentControlId": 31705, "controlId": "CR 3.8", "title": "CR 3.8", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58751" }, { "id": 588099, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c5e9635-f2db-5d82-97a2-2d8394c724f4", "parentControlId": 31705, "controlId": "CR 3.8(a)", "title": "CR 3.8(a)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58751" }, { "id": 588100, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29fd3912-c11b-5547-b29b-f83d4168d42b", "parentControlId": 31705, "controlId": "CR 3.8(b)", "title": "CR 3.8(b)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58751" }, { "id": 588101, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587511", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8aaca27-dd26-5546-b76f-3b35b045f178", "parentControlId": 31705, "controlId": "CR 3.8(c)", "title": "CR 3.8(c)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587511" }, { "id": 588102, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587511", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83be9116-0b16-505b-b474-dfed52f49184", "parentControlId": 31705, "controlId": "T1071", "title": "T1071", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587511" }, { "id": 588103, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587511", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1183e226-d327-5ef7-8b3a-016c3bafb269", "parentControlId": 31705, "controlId": "T1071.001", "title": "T1071.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587511" }, { "id": 588104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587511", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89c1260b-6033-5f71-b8b2-96846a91325b", "parentControlId": 31705, "controlId": "T1071.002", "title": "T1071.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587511" }, { "id": 588105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587511", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c23fd2a-046d-5c17-ae62-859ec290a1f1", "parentControlId": 31705, "controlId": "T1071.003", "title": "T1071.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587511" }, { "id": 588106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587511", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47db7ad9-ff1a-5adc-82cd-de2bf8ed943b", "parentControlId": 31705, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587511" }, { "id": 588107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587511", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3406d6cb-c916-58ee-9766-718c27fe5d65", "parentControlId": 31705, "controlId": "T1185", "title": "T1185", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587511" }, { "id": 588108, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587511", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89b1a648-75eb-5856-85a2-f51aa21bc208", "parentControlId": 31705, "controlId": "T1535", "title": "T1535", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587511" }, { "id": 588109, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587511", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "428c528b-f8bd-5ae9-8b7a-d3ca77043504", "parentControlId": 31705, "controlId": "T1550.004", "title": "T1550.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587511" }, { "id": 588110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587512", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a80f07a8-f97f-5b0c-b591-004939506122", "parentControlId": 31705, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587512" }, { "id": 588111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587512", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b89ae6a-ce58-586e-ab44-56eebd4ec7f4", "parentControlId": 31705, "controlId": "T1557.001", "title": "T1557.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587512" }, { "id": 588112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587512", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "110d1e9f-8174-5cdb-994b-055fc5d0b0c6", "parentControlId": 31705, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587512" }, { "id": 588113, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587512", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5d3ac0f-9639-59ed-a129-e404c384101e", "parentControlId": 31705, "controlId": "T1557.003", "title": "T1557.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587512" }, { "id": 588114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587512", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4fcc5a1-cb0b-5966-9ac0-b0304b6c1210", "parentControlId": 31705, "controlId": "T1557.004", "title": "T1557.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587512" }, { "id": 588115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587512", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2befd25e-08c8-5a0f-b7b0-a8880dbb7746", "parentControlId": 31705, "controlId": "T1562.006", "title": "T1562.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587512" }, { "id": 588116, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4e3cbb6-d0d1-5c21-851f-b44be3b2219a", "parentControlId": 31705, "controlId": "T1562.009", "title": "T1562.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587513" }, { "id": 588117, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "708c56c0-7927-500b-ac39-c71449fd246e", "parentControlId": 31705, "controlId": "T1563.001", "title": "T1563.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587513" }, { "id": 588118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4d876fc-297a-5bc7-a606-21679f87ce24", "parentControlId": 31705, "controlId": "T1573", "title": "T1573", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587513" }, { "id": 588119, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "097b8275-258e-5b60-8e90-cc799b5608a7", "parentControlId": 31705, "controlId": "T1573.001", "title": "T1573.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587513" }, { "id": 588120, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1cd704cb-4a5a-510e-bda1-b202565a030c", "parentControlId": 31705, "controlId": "T1573.002", "title": "T1573.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587513" }, { "id": 588121, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ab57389-5a1b-5422-b102-eb9c3946b39b", "parentControlId": 31705, "controlId": "T1622", "title": "T1622", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587513" }, { "id": 588123, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e06901a0-3928-50a2-835f-155b130399d9", "parentControlId": 31705, "controlId": "SC-23", "title": "SC-23", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587513" }, { "id": 588124, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e56e1fee-c265-5f25-af28-68ee6a95a3af", "parentControlId": 31705, "controlId": "SC-23", "title": "SC-23", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587513" }, { "id": 588125, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587514", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4450b58f-1739-5e12-bbdb-954d9d641db7", "parentControlId": 31705, "controlId": "SC-23", "title": "SC-23", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587514" }, { "id": 588126, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587514", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8951bca4-8061-534d-bac5-3a08f43c3048", "parentControlId": 31705, "controlId": "SC-23", "title": "SC-23", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587514" }, { "id": 588127, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587514", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "504f4763-349f-5927-8f7a-c2a4388d57e3", "parentControlId": 31705, "controlId": "SC-23", "title": "SC-23", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587514" }, { "id": 588128, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587514", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2b4fd25-43a4-54d5-8107-844f33df05c1", "parentControlId": 31705, "controlId": "SC-23", "title": "SC-23", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587514" }, { "id": 588129, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587514", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3273a9c1-9148-5ed3-b5c7-4ae3e0c1772d", "parentControlId": 31705, "controlId": "3.13.15", "title": "3.13.15", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587514" }, { "id": 588130, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587514", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05b00bde-ff9e-58b3-9a88-f86d99bd7688", "parentControlId": 31705, "controlId": "03.13.15", "title": "03.13.15", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587514" }, { "controlId": "B.3.12", "title": "B.3.12 — Transmission of Security Parameters", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-16", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "bcc5a5d6-943a-5ada-a016-a0199d5cff44", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.12", "title": "NEI 08-09 App D.3.12 — Transmission of Security Parameters", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.12", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "edde8be8-aa8d-551b-b5e4-f58d7a24649a", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.12", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "c666f2a6-f9b9-574c-b787-4985981ccd12", "isPublic": true }, { "controlId": "B.3.18", "title": "B.3.18 — Session Authenticity", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-23", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1e7bf659-af37-53fd-bcdf-63c82b5187c9", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.18", "title": "NEI 08-09 App D.3.18 — Session Authenticity", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.18", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "1112113b-e584-57d0-8c56-b7d0beefdbdf", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "6b1eb691-391d-50f4-89cf-2d1d59ccff66", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "471e592f-97d9-53c0-ad50-3849c9174377", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "0a6a38cc-bf8d-53f9-8d04-5e0a2bcb6cc8", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "be34cd7f-ad6a-5ca4-87f2-669d30cf6334", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "d60b1db2-f9e7-5c6c-9e2a-a23f9e86d2fb", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "ac55208e-815f-5604-8bac-3ad9bf8ffaab", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "e90f8c9c-974a-587e-b69d-a584eb0af5a6", "isPublic": true } ], "id": 31705, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73121", "catalogueId": 1062, "uuid": "883b83fe-c834-5996-9c76-7095e528b7b5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect the authenticity and integrity of communications sessions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Session Integrity", "description": "

Control Description

Mechanisms exist to protect the authenticity and integrity of communications sessions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to protect the authenticity and integrity of communications sessions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.12, B.3.18", "controlId": "NET-09", "family": "Network Security", "enhancements": "", "sortId": "NET-09", "references": "

Micro-Small Business (<10 staff)

∙ Use HTTPS and ensure session cookies are secured

Small Business (10-49 staff)

∙ Session management policy\n∙ Enforce HTTPS\n∙ Secure cookie attributes

Medium Business (50-249 staff)

∙ Formal session integrity controls\n∙ HTTPS enforcement\n∙ Session token management standards

Large Business (250-999 staff)

∙ Web application session integrity controls\n∙ WAF session protection\n∙ Secure cookie policy enforcement

Enterprise (>1,000 staff)

∙ Enterprise WAF (e.g., Imperva, Cloudflare)\n∙ Application-level session integrity\n∙ Token binding\n∙ Zero-trust session validation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72877, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590855", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590855", "securityControlId": 31706, "ccis": [], "uuid": "0032d236-b560-56ff-877e-f3c725869407", "testId": "NET-09.1_A01", "test": "session identifiers are invalidated upon user logout or other session termination.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-23(01)", "defaultText": null } ], "externalMappings": [ { "id": 588153, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f9ba6d9-60fa-515a-94e2-937d5c324409", "parentControlId": 31706, "controlId": "SR 3.8 RE 1", "title": "SR 3.8 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587517" }, { "id": 588154, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "800f4f3a-701e-5e77-a345-e53ab3449a68", "parentControlId": 31706, "controlId": "SC-23(1)", "title": "SC-23(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587517" }, { "id": 588155, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba8bc998-624b-5547-b3ab-541c103256cb", "parentControlId": 31706, "controlId": "SC-23(01)", "title": "SC-23(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587517" }, { "id": 588156, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c466abe-ac0a-5cca-90d3-504837bf8fe7", "parentControlId": 31706, "controlId": "SC-23(01)", "title": "SC-23(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587517" } ], "id": 31706, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73121", "catalogueId": 1062, "uuid": "d1b8aa6d-78a7-5a6f-a864-f38944668906", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to invalidate session identifiers upon user logout or other session termination?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Invalidate Session Identifiers at Logout", "description": "

Control Description

Automated mechanisms exist to invalidate session identifiers upon user logout or other session termination.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to automatically invalidate session identifiers upon user logout or other session termination.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-09.1", "family": "Network Security", "enhancements": "", "sortId": "NET-09.1", "references": "

Micro-Small Business (<10 staff)

∙ Configure applications to invalidate sessions on logout

Small Business (10-49 staff)

∙ Session invalidation policy\n∙ Ensure session tokens expire on logout

Medium Business (50-249 staff)

∙ Formal session management policy\n∙ Application-level session invalidation on logout

Large Business (250-999 staff)

∙ Application session management standards\n∙ Automated testing for session invalidation

Enterprise (>1,000 staff)

∙ Enterprise application security standards\n∙ Automated session management testing (DAST)\n∙ Session token lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72878, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590855", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590855", "securityControlId": 31707, "ccis": [], "uuid": "92413224-9545-5c0a-9965-13eeb8b4b000", "testId": "NET-09.2_A01", "test": "randomness requirements for generating a unique session identifier for each session are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-23(03)_ODP", "defaultText": null }, { "id": 72879, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590855", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590855", "securityControlId": 31707, "ccis": [], "uuid": "a5aeb779-51df-55ef-aef2-6cbcfa36c7ec", "testId": "NET-09.2_A02", "test": "a unique session identifier is generated for each session with organization-defined randomness requirements.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-23(03)[01]", "defaultText": null }, { "id": 72880, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590855", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590855", "securityControlId": 31707, "ccis": [], "uuid": "b8d81b0d-4e61-5227-a26f-7205856be5e9", "testId": "NET-09.2_A03", "test": "only system-generated session identifiers are recognized.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-23(03)[02]", "defaultText": null } ], "externalMappings": [ { "id": 588159, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587518", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "608cec3a-07e0-5bb6-b051-521e98d8960f", "parentControlId": 31707, "controlId": "SR 3.8 RE 2", "title": "SR 3.8 RE 2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587518" }, { "id": 588160, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587518", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52621eab-cb44-50ed-b258-228698542cec", "parentControlId": 31707, "controlId": "SR 3.8 RE 3", "title": "SR 3.8 RE 3", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587518" }, { "id": 588162, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587518", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38ba967d-f7b4-580d-b15f-ffdc854235bb", "parentControlId": 31707, "controlId": "SC-23(3)", "title": "SC-23(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587518" }, { "id": 588163, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587518", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2092f10a-7925-55d2-983c-ecb30047954e", "parentControlId": 31707, "controlId": "SC-23(03)", "title": "SC-23(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587518" }, { "id": 588164, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587518", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97bb1013-759c-535d-a9eb-058ddef91372", "parentControlId": 31707, "controlId": "SC-23(03)", "title": "SC-23(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587518" } ], "id": 31707, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73121", "catalogueId": 1062, "uuid": "a7c61858-6db0-5260-a96a-435945802388", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to generate and recognize unique session identifiers for each session?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 3.0, "title": "Unique System-Generated Session Identifiers", "description": "

Control Description

Automated mechanisms exist to generate and recognize unique session identifiers for each session.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to automatically generate and recognize unique session identifiers for each session.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-09.2", "family": "Network Security", "enhancements": "", "sortId": "NET-09.2", "references": "

Micro-Small Business (<10 staff)

∙ Use randomly generated session IDs in applications

Small Business (10-49 staff)

∙ Session ID generation policy\n∙ Use cryptographically random session identifiers

Medium Business (50-249 staff)

∙ Formal session ID management standards\n∙ Cryptographic PRNG for session IDs

Large Business (250-999 staff)

∙ Application security standards for session management\n∙ SAST/DAST testing for session ID generation

Enterprise (>1,000 staff)

∙ Enterprise application security framework\n∙ SAST/DAST automation (e.g., Veracode, Checkmarx)\n∙ Session management standards", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72881, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590855", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590856", "securityControlId": 31708, "ccis": [], "uuid": "7314448b-d438-54f6-a84f-3793a1703983", "testId": "NET-10_A01", "test": "additional data origin authentication is provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-20a.[01]", "defaultText": null }, { "id": 72882, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590856", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590856", "securityControlId": 31708, "ccis": [], "uuid": "aba6912d-bc57-5d83-8ec2-c31ad3ed3471", "testId": "NET-10_A02", "test": "integrity verification artifacts are provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-20a.[02]", "defaultText": null }, { "id": 72883, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590856", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590856", "securityControlId": 31708, "ccis": [], "uuid": "e7e65406-aa81-56be-ad7b-3c081b860905", "testId": "NET-10_A03", "test": "the means to indicate the security status of child zones (and if the child supports secure resolution services) is provided when operating as part of a distributed, hierarchical namespace.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-20b.[01]", "defaultText": null }, { "id": 72884, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590856", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590856", "securityControlId": 31708, "ccis": [], "uuid": "c2d36673-4e60-5543-9eb1-83a8df7c4e8c", "testId": "NET-10_A04", "test": "the means to enable verification of a chain of trust among parent and child domains when operating as part of a distributed, hierarchical namespace is provided.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-20b.[02]", "defaultText": null } ], "externalMappings": [ { "id": 588175, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587519", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02819670-6491-5f26-bf68-2ec05e4002d9", "parentControlId": 31708, "controlId": "T1071", "title": "T1071", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587519" }, { "id": 588176, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587519", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe7e7bbc-cd5f-5101-8f8c-17dad9d450fb", "parentControlId": 31708, "controlId": "T1071.001", "title": "T1071.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587519" }, { "id": 588177, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbbd2f17-e65e-546b-8221-7d16aa64c051", "parentControlId": 31708, "controlId": "T1071.002", "title": "T1071.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58752" }, { "id": 588178, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57e5bd3a-c51d-52fc-b434-b828cf3a3fb5", "parentControlId": 31708, "controlId": "T1071.003", "title": "T1071.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58752" }, { "id": 588179, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbcec3dc-96b6-5889-941e-cb44f95befd0", "parentControlId": 31708, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58752" }, { "id": 588180, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a307418-8348-5e82-a1da-618befc28ed1", "parentControlId": 31708, "controlId": "T1553.004", "title": "T1553.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58752" }, { "id": 588181, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0be3895-e392-5c88-8a09-e829fec14c9e", "parentControlId": 31708, "controlId": "T1566", "title": "T1566", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58752" }, { "id": 588182, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d0c141a-4fd7-5ff8-a049-73e26ef869cb", "parentControlId": 31708, "controlId": "T1566.001", "title": "T1566.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58752" }, { "id": 588183, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e76a156-b79f-5624-8ed8-e45b9b2c47c7", "parentControlId": 31708, "controlId": "T1566.002", "title": "T1566.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58752" }, { "id": 588184, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d80f630-0cf8-530a-afdf-b8355ec155ac", "parentControlId": 31708, "controlId": "T1568", "title": "T1568", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58752" }, { "id": 588185, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96b2e033-b896-5aa4-b20f-e1c7d082cbc5", "parentControlId": 31708, "controlId": "T1568.002", "title": "T1568.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58752" }, { "id": 588186, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67a7facb-30d5-5552-b62c-48d62800b89f", "parentControlId": 31708, "controlId": "T1598", "title": "T1598", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587521" }, { "id": 588187, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2711c6b-99a2-5c48-a793-85172ba0e7cf", "parentControlId": 31708, "controlId": "T1598.002", "title": "T1598.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587521" }, { "id": 588188, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee49e567-fa37-5e13-b899-99eae0664764", "parentControlId": 31708, "controlId": "T1598.003", "title": "T1598.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587521" }, { "id": 588189, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f87fede4-81d8-5126-b4e9-112351689216", "parentControlId": 31708, "controlId": "SC-20", "title": "SC-20", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587521" }, { "id": 588190, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c11b263a-9381-5340-9e8e-67ab939e2cc1", "parentControlId": 31708, "controlId": "SC-20(2)", "title": "SC-20(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587521" }, { "id": 588191, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fa7d29f-1ac2-5dfb-8528-c2a2bb54194b", "parentControlId": 31708, "controlId": "SC-20", "title": "SC-20", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587521" }, { "id": 588192, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88b5a56c-b617-55ef-860f-1864e4efe862", "parentControlId": 31708, "controlId": "SC-20(02)", "title": "SC-20(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587521" }, { "id": 588193, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c4d7d07-0c57-58ba-96ab-980496a7af2f", "parentControlId": 31708, "controlId": "SC-20", "title": "SC-20", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587521" }, { "id": 588194, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "470612be-f188-5041-9d2e-da37bc235074", "parentControlId": 31708, "controlId": "SC-20", "title": "SC-20", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587522" }, { "id": 588195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2759741-a6e5-5b93-811a-988dfa2a2f32", "parentControlId": 31708, "controlId": "SC-20(02)", "title": "SC-20(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587522" }, { "id": 588196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0549ed58-9db2-5596-a193-fa588126ae0f", "parentControlId": 31708, "controlId": "SC-20", "title": "SC-20", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587522" }, { "id": 588197, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b668f84e-bc44-521c-b6e4-8cbb661232b8", "parentControlId": 31708, "controlId": "SC-20", "title": "SC-20", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587522" }, { "id": 588198, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0ce3256-cd06-5887-9871-a2c2f030760a", "parentControlId": 31708, "controlId": "SC-20", "title": "SC-20", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587522" }, { "id": 588199, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9750484-ac05-5565-9c75-c61cf5af96c4", "parentControlId": 31708, "controlId": "NFO - SC-20", "title": "NFO - SC-20", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587522" }, { "controlId": "B.3.15", "title": "B.3.15 — Secure Name/Address Resolution Service (Authoritative/Trusted Source)", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-20", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "7f4b8d7b-3113-51b6-838a-991238691d41", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.15", "title": "NEI 08-09 App D.3.15 — Secure Name/Address Resolution Service (Authoritative/Trusted Source)", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.15", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "aa602f9c-a79c-514a-8870-0a9c552d6091", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.15", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "5cc54eff-9912-51b3-8826-2173fc569c4b", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "f08b0008-ee2b-57c5-b0f5-0567f88c862a", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "32143ce8-a1df-5a3f-930b-5f2a7437e577", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "3bbc6340-3c81-502b-90b3-8cd5dde1d4e5", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "047ef4d6-c7d2-59f5-ae9c-9c975bfe4693", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "24fe9a42-a721-5c15-a798-73e812365d70", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "3e51a688-11c0-5ddf-9dd6-9db4519cfbd5", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "417875b4-ab47-59ae-b4f9-2d5c57153d4c", "isPublic": true } ], "id": 31708, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731211", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731211", "catalogueId": 1062, "uuid": "ab331da2-d4ba-50bd-83ec-9ae00a301246", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure Domain Name Service (DNS) resolution is designed, implemented and managed to protect the security of name / address resolution?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Domain Name Service (DNS) Resolution", "description": "

Control Description

Mechanisms exist to ensure Domain Name Service (DNS) resolution is designed, implemented and managed to protect the security of name / address resolution.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ IT and/or cybersecurity personnel ensure Domain Name Service (DNS) resolution is designed, implemented and managed to protect the security of name / address resolution.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to ensure Domain Name Service (DNS) resolution is designed, implemented and managed to protect the security of name / address resolution.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.15", "controlId": "NET-10", "family": "Network Security", "enhancements": "", "sortId": "NET-10", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72885, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590857", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590857", "securityControlId": 31709, "ccis": [], "uuid": "0911ff37-1e27-5b3d-94e8-c0677b3c016d", "testId": "NET-10.1_A01", "test": "the systems that collectively provide name/address resolution services for an organization are fault-tolerant.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-22[01]", "defaultText": null }, { "id": 72886, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590857", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590857", "securityControlId": 31709, "ccis": [], "uuid": "7910701c-16d9-52e2-b186-7bfe800e8082", "testId": "NET-10.1_A02", "test": "the systems that collectively provide name/address resolution services for an organization implement internal role separation.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-22[02]", "defaultText": null }, { "id": 72887, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590858", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590858", "securityControlId": 31709, "ccis": [], "uuid": "13500d52-9fd7-5498-9f7e-e7df043d70f6", "testId": "NET-10.1_A03", "test": "the systems that collectively provide name/address resolution services for an organization implement external role separation.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-22[03]", "defaultText": null } ], "externalMappings": [ { "id": 588242, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587527", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9630a3db-77ad-58bb-a5f5-82a595062004", "parentControlId": 31709, "controlId": "T1071", "title": "T1071", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587527" }, { "id": 588243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587527", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b7de484-d652-5efd-9108-da5cd4997878", "parentControlId": 31709, "controlId": "T1071.001", "title": "T1071.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587527" }, { "id": 588244, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "253ea774-0932-58c7-bd22-06f8f3ba8d66", "parentControlId": 31709, "controlId": "T1071.002", "title": "T1071.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587528" }, { "id": 588245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2bf8381-6014-5ecb-8155-4466ee87cf2d", "parentControlId": 31709, "controlId": "T1071.003", "title": "T1071.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587528" }, { "id": 588246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "475ee7e8-12b8-5cd0-95fc-f505f12e8c0a", "parentControlId": 31709, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587528" }, { "id": 588247, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "678ecb19-4a11-5164-ae4d-712453a33578", "parentControlId": 31709, "controlId": "T1568", "title": "T1568", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587528" }, { "id": 588248, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e0e5c8c-f813-52ad-afdc-057b12976461", "parentControlId": 31709, "controlId": "T1568.002", "title": "T1568.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587528" }, { "id": 588249, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc236527-e967-5fd4-b9f8-2d78520c6e15", "parentControlId": 31709, "controlId": "T1583.002", "title": "T1583.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587528" }, { "id": 588250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b740734-597d-5935-9706-e8414a42c00a", "parentControlId": 31709, "controlId": "T1584.002", "title": "T1584.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587528" }, { "id": 588251, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c57c3c5e-fe70-535e-9ccd-f022c2edaf31", "parentControlId": 31709, "controlId": "T1596.001", "title": "T1596.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587528" }, { "id": 588252, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8aaf0593-6085-561e-8849-eff46624388c", "parentControlId": 31709, "controlId": "SC-22", "title": "SC-22", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587528" }, { "id": 588253, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587528", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "019a5d71-3514-5aa2-b4c5-260327d2428d", "parentControlId": 31709, "controlId": "SC-22", "title": "SC-22", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587529" }, { "id": 588254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36b1d23a-50b3-5416-a6c4-c1741d3199b9", "parentControlId": 31709, "controlId": "SC-22", "title": "SC-22", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587529" }, { "id": 588255, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf6f3db7-f334-5706-8005-f4df3733076e", "parentControlId": 31709, "controlId": "SC-22", "title": "SC-22", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587529" }, { "id": 588256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d31f3deb-4d0e-55f5-8394-d842cd53e756", "parentControlId": 31709, "controlId": "SC-22", "title": "SC-22", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587529" }, { "id": 588257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b64c07a9-5c38-58f7-a4b3-41a32534d894", "parentControlId": 31709, "controlId": "SC-22", "title": "SC-22", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587529" }, { "id": 588258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d77fe8e-5239-5ba0-ba95-648928fb5e98", "parentControlId": 31709, "controlId": "SC-22", "title": "SC-22", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587529" }, { "id": 588260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0367e890-d140-5264-aa12-c1926feddf58", "parentControlId": 31709, "controlId": "NFO - SC-22", "title": "NFO - SC-22", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587529" }, { "controlId": "B.3.16", "title": "B.3.16 — Secure Name/Address Resolution Service (Recursive or Caching Resolver)", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-21", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1b137fa9-cb8f-5d7c-8d5c-72c1375ab60a", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.16", "title": "NEI 08-09 App D.3.16 — Secure Name/Address Resolution Service (Recursive or Caching Resolver)", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.16", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6c705621-979a-579d-bff1-437d01125799", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.16", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "9fb11826-a092-5511-9e23-a34b50bf3dd2", "isPublic": true }, { "controlId": "B.3.17", "title": "B.3.17 — Architecture and Provisioning for Name/Address Resolution Service", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-22", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1a9cd033-a223-58ba-8b60-f3d4c03f2cda", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.17", "title": "NEI 08-09 App D.3.17 — Architecture and Provisioning for Name/Address Resolution Service", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.17", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "fc4d302e-ad45-5e4b-9252-34d83cf4e4af", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "59e5b974-5e07-540b-83e7-38de60fd27bc", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "e0679b8b-b5b8-5d36-af24-0e9f79910fcb", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "30aee312-3307-53fe-95bc-397eb2fd6b4b", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "c4e222d9-3d55-516f-9ab7-cd27bce43cdb", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "e5705043-fbe9-52a5-ad0d-0fa0144b1bfc", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "ccc5ea8a-7bb6-5bb6-a8c8-9f0c07e24074", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "bbfbc934-da31-523e-a168-360295b98e7c", "isPublic": true } ], "id": 31709, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731211", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731211", "catalogueId": 1062, "uuid": "44f27166-ef70-56ab-a19d-eff30b983075", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure systems that collectively provide Domain Name Service (DNS) resolution service are fault-tolerant and implement internal/external role separation?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Architecture & Provisioning for Name / Address Resolution Service", "description": "

Control Description

Mechanisms exist to ensure systems that collectively provide Domain Name Service (DNS) resolution service are fault-tolerant and implement internal/external role separation.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ IT and/or cybersecurity personnel ensure systems that collectively provide Domain Name Service (DNS) resolution service for are fault-tolerant and implement internal/external role separation.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to ensure systems that collectively provide Domain Name Service (DNS) resolution service are fault-tolerant and implement internal/external role separation.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.16, B.3.17", "controlId": "NET-10.1", "family": "Network Security", "enhancements": "", "sortId": "NET-10.1", "references": "

Micro-Small Business (<10 staff)

∙ Use redundant DNS providers for availability

Small Business (10-49 staff)

∙ Redundant DNS configuration\n∙ DNS security policy

Medium Business (50-249 staff)

∙ DNS security architecture\n∙ Redundant authoritative DNS\n∙ DNSSEC consideration

Large Business (250-999 staff)

∙ Enterprise DNS management\n∙ DNSSEC implementation\n∙ DNS monitoring\n∙ Redundant DNS infrastructure

Enterprise (>1,000 staff)

∙ Enterprise DNS security platform (e.g., Infoblox, BlueCat)\n∙ DNSSEC\n∙ DNS firewall\n∙ High-availability DNS architecture", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72888, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590858", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590858", "securityControlId": 31710, "ccis": [], "uuid": "b1d60cfd-9cab-5dd9-bfad-429cf95f9821", "testId": "NET-10.2_A01", "test": "data origin authentication is requested for the name/address resolution responses that the system receives from authoritative sources.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-21[01]", "defaultText": null }, { "id": 72889, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590858", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590858", "securityControlId": 31710, "ccis": [], "uuid": "083b19ec-2fbc-5722-a8e1-5bfea4f58af2", "testId": "NET-10.2_A02", "test": "data origin authentication is performed on the name/address resolution responses that the system receives from authoritative sources.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-21[02]", "defaultText": null }, { "id": 72890, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590858", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590858", "securityControlId": 31710, "ccis": [], "uuid": "50d7869e-a5b7-52b7-934d-0316f27464fa", "testId": "NET-10.2_A03", "test": "data integrity verification is requested for the name/address resolution responses that the system receives from authoritative sources.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-21[03]", "defaultText": null }, { "id": 72891, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590859", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590859", "securityControlId": 31710, "ccis": [], "uuid": "0bac3904-9baa-5148-9094-7e3a3755ae0a", "testId": "NET-10.2_A04", "test": "data integrity verification is performed on the name/address resolution responses that the system receives from authoritative sources.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-21[04]", "defaultText": null } ], "externalMappings": [ { "id": 588280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99317ea0-c5a4-571c-91cb-34f288031fea", "parentControlId": 31710, "controlId": "T1071", "title": "T1071", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587532" }, { "id": 588281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82eff9ba-3535-5b4d-aeb5-ce5d22304a22", "parentControlId": 31710, "controlId": "T1071.001", "title": "T1071.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587532" }, { "id": 588282, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b96319fa-4b11-5fa8-afbb-eada4e5e0a14", "parentControlId": 31710, "controlId": "T1071.002", "title": "T1071.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587532" }, { "id": 588283, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41af4d80-c8c3-59bb-b123-cf653085234b", "parentControlId": 31710, "controlId": "T1071.003", "title": "T1071.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587532" }, { "id": 588284, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0bdefc69-ffb4-5b52-8a59-a3c997d79d02", "parentControlId": 31710, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587532" }, { "id": 588285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32cdda3c-3c26-5f86-a470-5947d36c9768", "parentControlId": 31710, "controlId": "T1568", "title": "T1568", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587532" }, { "id": 588286, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90b1c470-8b82-5101-a0f9-54cf73de1072", "parentControlId": 31710, "controlId": "T1568.002", "title": "T1568.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587532" }, { "id": 588287, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "738ce999-53ce-5d02-9a15-bfe499bf0463", "parentControlId": 31710, "controlId": "SC-21", "title": "SC-21", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587532" }, { "id": 588288, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59b01ed7-b944-5d47-9948-47f9a89a33d6", "parentControlId": 31710, "controlId": "SC-21", "title": "SC-21", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587532" }, { "id": 588289, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587532", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a811214e-97d5-5a97-8ad9-909014de628a", "parentControlId": 31710, "controlId": "SC-21", "title": "SC-21", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587532" }, { "id": 588290, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587533", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee0a06c2-99e8-5df9-9bb8-51d898607f77", "parentControlId": 31710, "controlId": "SC-21", "title": "SC-21", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587533" }, { "id": 588291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587533", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b88b7525-3154-5c18-9bd7-60cbe80183c0", "parentControlId": 31710, "controlId": "SC-21", "title": "SC-21", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587533" }, { "id": 588292, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587533", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a03bbadc-78a3-587c-82a7-491c7b1902b2", "parentControlId": 31710, "controlId": "SC-21", "title": "SC-21", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587533" }, { "id": 588293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587533", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3427adfa-1e37-5cf9-a3c9-d9a65947a3d6", "parentControlId": 31710, "controlId": "SC-21", "title": "SC-21", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587533" }, { "id": 588294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587533", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59bcbb63-5c0f-5918-aab4-44131500f745", "parentControlId": 31710, "controlId": "NFO - SC-21", "title": "NFO - SC-21", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587533" }, { "controlId": "B.3.16", "title": "B.3.16 — Secure Name/Address Resolution Service (Recursive or Caching Resolver)", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-21", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ddd2fb22-722b-58f8-b2c6-89046bb76fcd", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.16", "title": "NEI 08-09 App D.3.16 — Secure Name/Address Resolution Service (Recursive or Caching Resolver)", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.16", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "ec456b9e-938f-5081-b336-54d3e45e5d53", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.16", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "23183c3b-12af-504b-8391-86c3d2363f8a", "isPublic": true }, { "controlId": "B.3.17", "title": "B.3.17 — Architecture and Provisioning for Name/Address Resolution Service", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-22", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "5b880dce-70b9-5e28-9da2-4d5f4f2b6833", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.17", "title": "NEI 08-09 App D.3.17 — Architecture and Provisioning for Name/Address Resolution Service", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.17", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "9ee898f3-3cd0-5f13-af4f-c416cda7b7b1", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b0678023-b896-52c7-9e70-9a7b91f9e501", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "d0f82fb1-bf79-5007-a838-8052ef230aa7", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "110dfa27-1ae2-51db-b1f3-17d1e54c2a7a", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "5999ad5a-3d96-5d6f-b916-46b62080ef55", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "46a8017e-0248-5861-8c95-ce60bffa5c49", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "f9649b09-5a80-5650-ab19-2102225a181f", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "6ef05435-e4b2-50d7-b39b-4b980a79c662", "isPublic": true } ], "id": 31710, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731212", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731212", "catalogueId": 1062, "uuid": "c5c502c5-2f89-54e7-b8c9-2aa0d5daadda", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization perform data origin authentication and data integrity verification on the Domain Name Service (DNS) resolution responses received from authoritative sources when requested by client systems?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Secure Name / Address Resolution Service (Recursive or Caching Resolver)", "description": "

Control Description

Mechanisms exist to perform data origin authentication and data integrity verification on the Domain Name Service (DNS) resolution responses received from authoritative sources when requested by client systems.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to perform data origin authentication and data integrity verification on the Domain Name Service (DNS) resolution responses received from authoritative sources when requested by client systems.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.16, B.3.17", "controlId": "NET-10.2", "family": "Network Security", "enhancements": "", "sortId": "NET-10.2", "references": "

Micro-Small Business (<10 staff)

∙ Use reputable DNS resolver (e.g., Cloudflare 1.1.1.1, Google 8.8.8.8)

Small Business (10-49 staff)

∙ Secure DNS resolver with filtering (e.g., Cisco Umbrella free, Cloudflare Gateway)

Medium Business (50-249 staff)

∙ DNS security service (e.g., Cisco Umbrella, Cloudflare Gateway)\n∙ DNS filtering policy

Large Business (250-999 staff)

∙ Enterprise DNS security service (e.g., Cisco Umbrella, Palo Alto DNS Security)\n∙ DNS-layer threat blocking

Enterprise (>1,000 staff)

∙ Enterprise DNS security platform with threat intelligence\n∙ Recursive resolver security\n∙ DNSSEC validation\n∙ DNS over HTTPS (DoH)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72893, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590859", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590859", "securityControlId": 31712, "ccis": [], "uuid": "9025ab9e-0c58-5b39-96c6-7b2a068c6b6f", "testId": "NET-10.4_A01", "test": "the domain name registrar is locked to prevent a denial of service caused by unauthorized deletion, transfer or other unauthorized modification of a domain’s registration details.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 588329, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587537", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a23a2b5-22ad-5ef2-baf2-58585b91c39a", "parentControlId": 31712, "controlId": "T1596.002", "title": "T1596.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587537" } ], "id": 31712, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731212", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731212", "catalogueId": 1062, "uuid": "d92dd40d-8bdd-56f7-90da-51494f36b901", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization lock the domain name registrar to prevent a denial of service caused by unauthorized deletion, transfer or other unauthorized modification of a domain’s registration details?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Domain Registrar Security", "description": "

Control Description

Mechanisms exist to lock the domain name registrar to prevent a denial of service caused by unauthorized deletion, transfer or other unauthorized modification of a domain’s registration details.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to lock the domain name registrar to prevent a denial of service caused by unauthorized deletion, transfer or other unauthorized modification of a domain’s registration details.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-10.4", "family": "Network Security", "enhancements": "", "sortId": "NET-10.4", "references": "

Micro-Small Business (<10 staff)

∙ Enable domain registrar 2FA and lock domain registrations

Small Business (10-49 staff)

∙ Domain registrar security controls\n∙ Enable 2FA, registrar lock, WHOIS privacy

Medium Business (50-249 staff)

∙ Formal domain registrar security program\n∙ Registrar lock, 2FA, monitoring for unauthorized changes

Large Business (250-999 staff)

∙ Enterprise domain management platform\n∙ Registrar lock, MFA, domain change monitoring

Enterprise (>1,000 staff)

∙ Enterprise domain management platform (e.g., CSC Digital Brand Services, MarkMonitor)\n∙ Domain locking, MFA, real-time change alerts", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72894, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59086", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59086", "securityControlId": 31713, "ccis": [], "uuid": "95171510-8724-5f51-8821-681a22a0747b", "testId": "NET-11_A01", "test": "out-of-band channels to be employed for the physical delivery or electronic transmission of information, system components or devices to individuals or the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-37_ODP[01]", "defaultText": null }, { "id": 72895, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59086", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59086", "securityControlId": 31713, "ccis": [], "uuid": "c19a84f1-d700-582a-b48d-949ddddb96d2", "testId": "NET-11_A02", "test": "out-of-band channels are employed for the physical delivery or electronic transmission of information, system components or devices to individuals or systems.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-37", "defaultText": null }, { "id": 72896, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59086", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59086", "securityControlId": 31713, "ccis": [], "uuid": "dc97b099-0014-5b18-8418-8357d88aba3c", "testId": "NET-11_A03", "test": "information, system components or devices to employ out-of-band-channels for physical delivery or electronic transmission are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-37_ODP[02]", "defaultText": null }, { "id": 72897, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59086", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59086", "securityControlId": 31713, "ccis": [], "uuid": "5bb86c3e-690e-5368-bcea-f9e2550a8c34", "testId": "NET-11_A04", "test": "individuals or systems to which physical delivery or electronic transmission of information, system components or devices is to be achieved via the employment of out-of-band channels are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-37_ODP[03]", "defaultText": null }, { "id": 72898, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59086", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59086", "securityControlId": 31713, "ccis": [], "uuid": "2ae1dfc9-c73c-5adb-b11f-469daf612f5e", "testId": "NET-11_A05", "test": "controls to be employed to ensure that only designated individuals or systems receive specific information, system components or devices are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-37(01)_ODP[01]", "defaultText": null }, { "id": 72899, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590861", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590861", "securityControlId": 31713, "ccis": [], "uuid": "7f3bff71-8755-528f-b06f-333a4dc2004a", "testId": "NET-11_A06", "test": "individuals or systems designated to receive specific information, system components or devices are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-37(01)_ODP[02]", "defaultText": null }, { "id": 72900, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590861", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590861", "securityControlId": 31713, "ccis": [], "uuid": "d7fa805b-1dab-59f5-a3cd-2678b670a93c", "testId": "NET-11_A07", "test": "information, system components or devices that only individuals or systems are designated to receive are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-37(01)_ODP[03]", "defaultText": null }, { "id": 72901, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590861", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590861", "securityControlId": 31713, "ccis": [], "uuid": "4b4617aa-1d5a-5499-b86e-fd11d275a902", "testId": "NET-11_A08", "test": "organization-defined controls are employed to ensure that only authorized individuals or systems receive information, system components or devices.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-37(01)", "defaultText": null } ], "externalMappings": [ { "id": 588333, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7897db0a-a487-51b1-aa9c-b17a0678c02f", "parentControlId": 31713, "controlId": "T1071", "title": "T1071", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587538" }, { "id": 588334, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "768cfc9d-03ce-5387-95b3-1a567249e0c0", "parentControlId": 31713, "controlId": "T1071.001", "title": "T1071.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587538" }, { "id": 588335, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40cc4166-01d3-5e98-8027-a89436cfb032", "parentControlId": 31713, "controlId": "T1071.002", "title": "T1071.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587538" }, { "id": 588336, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6ed611c-38ff-5bfc-8fbe-ea76d9c26291", "parentControlId": 31713, "controlId": "T1071.003", "title": "T1071.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587538" }, { "id": 588337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68f91cae-1760-5316-b7ca-15176da2b6bd", "parentControlId": 31713, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587538" }, { "id": 588338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b04b3c7b-0641-534b-9b34-c3a2b34c83e7", "parentControlId": 31713, "controlId": "T1114", "title": "T1114", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587538" }, { "id": 588339, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "727a4b87-98a8-5457-82f6-d2ebe9a642d5", "parentControlId": 31713, "controlId": "T1114.001", "title": "T1114.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587538" }, { "id": 588340, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b11c0e5a-1091-57a1-af37-6ed1adb5a48d", "parentControlId": 31713, "controlId": "T1114.002", "title": "T1114.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587538" }, { "id": 588341, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58854e74-104e-5698-8eca-43fc3e8ef331", "parentControlId": 31713, "controlId": "T1114.003", "title": "T1114.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587539" }, { "id": 588342, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f0dec58-8bc7-59db-ae6e-6987ddda48df", "parentControlId": 31713, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587539" }, { "id": 588343, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9825d283-8639-59f0-b473-5ccebf9f3532", "parentControlId": 31713, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587539" }, { "id": 588344, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30e8b5c2-2277-532d-8b92-c32be85b9df4", "parentControlId": 31713, "controlId": "T1489", "title": "T1489", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587539" }, { "id": 588345, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fd2b09b-ae19-5abd-abae-3e9dcdf944c2", "parentControlId": 31713, "controlId": "SC-37", "title": "SC-37", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587539" }, { "id": 588346, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11585a66-cb04-558d-b0bb-b51b4c366cb0", "parentControlId": 31713, "controlId": "SC-37(1)", "title": "SC-37(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587539" }, { "id": 588347, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff6f44bd-76a0-57ab-8ff9-142f862182f6", "parentControlId": 31713, "controlId": "SC-37", "title": "SC-37", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587539" }, { "id": 588348, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0fd4350b-164a-539d-b1f9-48e1546cb6f3", "parentControlId": 31713, "controlId": "SC-37(01)", "title": "SC-37(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587539" }, { "id": 588349, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1869500-7907-5fb2-9569-a31185c44b81", "parentControlId": 31713, "controlId": "SC-37", "title": "SC-37", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587539" }, { "id": 588350, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58754", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be6bb5f4-886f-5ed2-9cb4-8c4c1db65259", "parentControlId": 31713, "controlId": "SC-37(01)", "title": "SC-37(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58754" }, { "id": 588352, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58754", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3dc63e1c-3eb7-5aa9-8f06-b0c93d2845cf", "parentControlId": 31713, "controlId": "SC-37", "title": "SC-37", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58754" }, { "id": 588353, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58754", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ca8e73b-4bff-525e-94b8-91b81b75763f", "parentControlId": 31713, "controlId": "SC-37(1)", "title": "SC-37(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58754" }, { "controlId": "B.3.18", "title": "B.3.18 — Session Authenticity", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-23", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "d90eaa6c-18c5-5f81-ad32-0cf5b99c6a39", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.18", "title": "NEI 08-09 App D.3.18 — Session Authenticity", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.18", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "cb2ed755-4136-51f0-b5ff-aeeca5326d90", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.18", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "2150913f-61df-5eca-8b33-03f8ba6f4bcb", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "54828f5f-3973-52b8-9a92-633d5ce21dec", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "1256b34f-d9cb-5442-9e57-bb8437ed0026", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "5a574f70-d5bc-564b-b122-1da067191b29", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "a5389fd6-2ee1-5990-94b5-8266b323c6a3", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "49c1a23c-a7a0-5462-b7f5-bcd476e5d029", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "269e2d09-28eb-5754-8ba5-6da2f27d2632", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "f522212c-accf-5d33-8e06-f430711cbd88", "isPublic": true } ], "id": 31713, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731213", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731213", "catalogueId": 1062, "uuid": "5e1e8ea5-ab93-5124-8332-ee5bfeed15d6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize out-of-band channels for the electronic transmission of information and/or the physical shipment of system components or devices to authorized individuals?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Out-of-Band Channels", "description": "

Control Description

Mechanisms exist to utilize out-of-band channels for the electronic transmission of information and/or the physical shipment of system components or devices to authorized individuals.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to utilize out-of-band channels for the electronic transmission of information and/or the physical shipment of system components or devices to authorized individuals.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.18", "controlId": "NET-11", "family": "Network Security", "enhancements": "", "sortId": "NET-11", "references": "

Micro-Small Business (<10 staff)

∙ Use a separate channel (e.g., phone call) for critical communications

Small Business (10-49 staff)

∙ Out-of-band communication policy for critical operations

Medium Business (50-249 staff)

∙ Formal out-of-band channel for management and security communications\n∙ OOB procedure

Large Business (250-999 staff)

∙ Dedicated out-of-band management channel\n∙ OOB network for critical operations

Enterprise (>1,000 staff)

∙ Enterprise out-of-band management network (OOBM)\n∙ Dedicated OOB access for critical systems\n∙ Emergency communication protocols", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72902, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590861", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590861", "securityControlId": 31714, "ccis": [], "uuid": "d7342734-34bd-5a52-addb-670c49244ede", "testId": "NET-12_A01", "test": "approved authorizations for logical access to information and system resources are enforced in accordance with applicable access control policies.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-03", "defaultText": null } ], "externalMappings": [ { "id": 588400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3afae69-991e-5b4f-8df4-8acf3adf59fc", "parentControlId": 31714, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587553" }, { "id": 588401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f02a31f-d6d0-520b-824f-64383771ea43", "parentControlId": 31714, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587554" }, { "id": 588402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67927d60-bb79-5e92-b9c7-188bb825d6b8", "parentControlId": 31714, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587554" }, { "id": 588403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b243c0d0-589f-57b2-9ba9-0c4baa7810e4", "parentControlId": 31714, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587554" }, { "id": 588404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5ed39da-3b9e-5f4f-b657-0bf0b6ef1b1a", "parentControlId": 31714, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587554" }, { "id": 588405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92901517-ff01-5df9-877b-064305cadaf3", "parentControlId": 31714, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587554" }, { "id": 588406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d262b006-1cd5-500d-8842-446942574c88", "parentControlId": 31714, "controlId": "SI-07", "title": "SI-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587554" }, { "id": 588407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "352fbcfe-c3a6-51c2-9ee8-ef5814a6adb5", "parentControlId": 31714, "controlId": "SI-10", "title": "SI-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587554" }, { "id": 588416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587555", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a805de8-2646-56a7-9817-ae56f1432b68", "parentControlId": 31714, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587555" }, { "id": 588417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587555", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b8bd91e-a926-5a81-bb26-280eb60480b6", "parentControlId": 31714, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587555" }, { "id": 588418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15353c46-b2ca-571a-b552-f840a65edaa4", "parentControlId": 31714, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587556" }, { "id": 588419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35d50263-de10-5daf-a84d-d0d1cc70a11f", "parentControlId": 31714, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587556" }, { "id": 588420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c558c1e1-e667-55b6-996c-4f625ad7c20b", "parentControlId": 31714, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587556" }, { "id": 588421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e8b994f-8c23-5503-bc73-f2dc181a2f6b", "parentControlId": 31714, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587556" }, { "id": 588422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6695f925-7d50-5961-a9ec-66bdde966b49", "parentControlId": 31714, "controlId": "SI-07", "title": "SI-07", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587556" }, { "id": 588423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77c01091-3841-5b1f-861f-855f9329135a", "parentControlId": 31714, "controlId": "SI-10", "title": "SI-10", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587556" }, { "id": 588424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0bfe404c-10cc-526a-8455-126b93464bc8", "parentControlId": 31714, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587556" }, { "id": 588425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4323fa2d-4509-5c3d-80e9-3f5abd6b0dea", "parentControlId": 31714, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587556" }, { "id": 588426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bdb8db9-2ef6-5ff3-926d-2c478f7db894", "parentControlId": 31714, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587556" }, { "id": 588427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06771236-9c62-57a3-8704-83f2edfdbdf3", "parentControlId": 31714, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587557" }, { "id": 588428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c616b75-aa01-51ca-b9ab-90acc3cd9cfa", "parentControlId": 31714, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587557" }, { "id": 588429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1dac9a3-e908-5647-bff0-ec5a7760fe73", "parentControlId": 31714, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587557" }, { "id": 588430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea0527f9-c09b-55cc-bcec-f205135e6792", "parentControlId": 31714, "controlId": "SI-07", "title": "SI-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587557" }, { "id": 588431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64b91eea-6009-50bc-b523-780ead81d4f2", "parentControlId": 31714, "controlId": "SI-10", "title": "SI-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587557" }, { "id": 588432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3e2492a-93d1-53ee-85a8-96c941ba9189", "parentControlId": 31714, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587557" }, { "id": 588433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16598a33-da58-507b-a2e1-9ae2fbfd5dd8", "parentControlId": 31714, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587557" }, { "id": 588434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96bfda73-2722-5899-bc5a-36325bc2446b", "parentControlId": 31714, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587557" }, { "id": 588435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f09cacd-f81c-5941-ae76-99911da52f01", "parentControlId": 31714, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587557" }, { "id": 588436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ff1f6cd-0590-54f5-84db-31aecf6c9bfb", "parentControlId": 31714, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587558" }, { "id": 588437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eff23b63-dcd0-5729-86f4-f6ac1c126432", "parentControlId": 31714, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587558" }, { "id": 588438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a26dd0b8-e955-5017-a54b-9f2f93b03c60", "parentControlId": 31714, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587558" }, { "id": 588439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "607bddc8-3e76-536a-a995-f7c981723d71", "parentControlId": 31714, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587558" }, { "id": 588440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf18aa45-ea1f-5963-823f-c031288f0358", "parentControlId": 31714, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587558" }, { "id": 588441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e36e33a-fcb5-5894-9889-d9cfa79b6e8a", "parentControlId": 31714, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587558" }, { "id": 588442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da942b6d-0333-5df9-abe3-503dd4fbb05a", "parentControlId": 31714, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587559" }, { "id": 588443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "981f7371-7c6f-5b76-b261-7b4a27d1fd35", "parentControlId": 31714, "controlId": "SI-07", "title": "SI-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587559" }, { "id": 588444, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "860ab90f-f324-596e-bbff-57719a86ce80", "parentControlId": 31714, "controlId": "SI-10", "title": "SI-10", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587559" }, { "id": 588445, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c662f70-24ea-54d1-ad6c-8ae649a86f47", "parentControlId": 31714, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587559" }, { "id": 588446, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0caaea2-d723-5625-a200-c0f8f75d7f39", "parentControlId": 31714, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587559" }, { "id": 588447, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f487870d-0d55-5ea7-a5de-dc8da46a700b", "parentControlId": 31714, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587559" }, { "id": 588448, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95576fff-dfe9-58e7-bbbd-26149758cb07", "parentControlId": 31714, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587559" }, { "id": 588449, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9cba3d12-5216-583c-b4a5-aedd9059f8d4", "parentControlId": 31714, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587559" }, { "id": 588450, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da360f1f-ddd6-5009-8cb2-830629e1cadb", "parentControlId": 31714, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587559" }, { "id": 588451, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f23d5397-dc0b-5c99-b6f4-38df5949f651", "parentControlId": 31714, "controlId": "SI-07", "title": "SI-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58756" }, { "id": 588452, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f759f32-6c06-5f58-99da-8975067b55ab", "parentControlId": 31714, "controlId": "SI-10", "title": "SI-10", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58756" }, { "id": 588454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b196b8ad-687b-553e-a11c-fd1f9000fa23", "parentControlId": 31714, "controlId": "AC-2", "title": "AC-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58756" }, { "id": 588455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c9d345b-323c-5ebb-b160-e116bd8b77de", "parentControlId": 31714, "controlId": "AC-3", "title": "AC-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58756" }, { "id": 588456, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "135e9fa2-cbd8-55c9-b90c-5104f250b504", "parentControlId": 31714, "controlId": "AC-5", "title": "AC-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58756" }, { "id": 588457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e61f304-454f-5bea-907f-5a4a2a963e34", "parentControlId": 31714, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58756" }, { "id": 588458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1cafba6c-9f42-52ef-9cd9-168d42d2bdff", "parentControlId": 31714, "controlId": "SI-4", "title": "SI-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58756" }, { "id": 588459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d4f449a-fc70-5a0f-af66-882b894d2c3a", "parentControlId": 31714, "controlId": "SI-5", "title": "SI-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58756" }, { "id": 588460, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2524f641-d08d-5211-be91-bf2e8c89035c", "parentControlId": 31714, "controlId": "SI-7", "title": "SI-7", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587561" }, { "id": 588461, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c382d4b2-f622-5f9e-8a1c-1dc407dfe6b4", "parentControlId": 31714, "controlId": "AC-2", "title": "AC-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587561" }, { "id": 588462, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24d8413f-e7c3-5e3e-91ed-d1826709853d", "parentControlId": 31714, "controlId": "AC-3", "title": "AC-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587561" }, { "id": 588463, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "025d996d-0606-5b2f-a0db-a52dcb474444", "parentControlId": 31714, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587561" }, { "id": 588464, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8492607-4209-53e7-88d1-d494f402ba61", "parentControlId": 31714, "controlId": "SI-4", "title": "SI-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587561" }, { "id": 588465, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7992aa1e-d6a4-5803-8058-a6333d0b2e23", "parentControlId": 31714, "controlId": "SI-5", "title": "SI-5", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587561" }, { "id": 588466, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a891e1a3-4c98-50fc-a3ec-39170a32d1f7", "parentControlId": 31714, "controlId": "SI-7", "title": "SI-7", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587561" }, { "id": 588467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bb89036-c4fc-5e2e-8077-f49b94b9d354", "parentControlId": 31714, "controlId": "AC-2", "title": "AC-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587561" }, { "id": 588468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7cfe3d6-d8a0-5728-beac-fcccd489631c", "parentControlId": 31714, "controlId": "AC-3", "title": "AC-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587562" }, { "id": 588469, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdb22b9f-ba8c-53b2-a73a-6331696fe7f7", "parentControlId": 31714, "controlId": "AC-5", "title": "AC-5", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587562" }, { "id": 588470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d6fbc4b-7de7-546d-86fa-655a44bc8ece", "parentControlId": 31714, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587562" }, { "id": 588471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eed9904f-307c-5b52-b69a-2164e7f5ab6d", "parentControlId": 31714, "controlId": "SI-4", "title": "SI-4", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587562" }, { "id": 588472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "101fce01-afed-5b2e-a0bd-656b6cf98e05", "parentControlId": 31714, "controlId": "SI-5", "title": "SI-5", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587562" }, { "id": 588473, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca9da141-f31a-5532-997f-15891df18f9d", "parentControlId": 31714, "controlId": "SI-7", "title": "SI-7", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587562" }, { "controlId": "C.3.8", "title": "C.3.8 — Information Input Restrictions", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-10", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a345e3bf-e9eb-5a66-acf5-e85ea28302cb", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.8", "title": "NEI 08-09 App E.3.8 — Information Input Restrictions", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d45e3291-0027-5a8d-b0e6-7f00eba6c6c5", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.3.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "7db85b0a-4d17-5e18-a5be-28507949526c", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d4d66c5e-31c6-5d40-bbfe-4fc38f861462", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "e0e42131-b4e3-586d-b1e8-509888db2418", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "5855abdc-6257-5cb0-9f1b-1040e415c15c", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "270a24d7-918e-5bc8-ad08-2fe6a859ec27", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "2f869115-b1bd-5b96-b680-df0f44877d8f", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "37a86cf4-c8bb-5221-92ea-1951d355b373", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "98ec7696-658b-546d-bc4b-c31a7662f4f4", "isPublic": true } ], "id": 31714, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731213", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731213", "catalogueId": 1062, "uuid": "a1801bb7-1e37-5dc6-b488-f38a96838747", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Are cryptographic mechanisms utilized to implement strong cryptography and security protocols to safeguard sensitive/regulated data during transmission over open, public networks?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Safeguarding Data Over Open Networks", "description": "

Control Description

Cryptographic mechanisms exist to implement strong cryptography and security protocols to safeguard sensitive/regulated data during transmission over open, public networks.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Network communications containing sensitive/regulated data are protected using a cryptographic mechanism to prevent unauthorized disclosure of information while in transit (e.g., SSH, TLS, VPN, etc.). \n▪ Wireless access is protected via secure authentication and encryption.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ Network communications containing sensitive/regulated data use a cryptographic mechanism to prevent the unauthorized disclosure of information while in transit (e.g., SSH, TLS, VPN, etc.).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational cryptographic capability exists to implement strong cryptography and security protocols to safeguard sensitive/regulated data during transmission over open, public networks.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.3.8", "controlId": "NET-12", "family": "Network Security", "enhancements": "", "sortId": "NET-12", "references": "

Micro-Small Business (<10 staff)

∙ Use HTTPS/TLS for all internet-facing communications

Small Business (10-49 staff)

∙ TLS for all internet traffic\n∙ No unencrypted protocols over public networks

Medium Business (50-249 staff)

∙ Encryption-in-transit standards\n∙ TLS 1.2+ enforcement\n∙ Certificate management

Large Business (250-999 staff)

∙ Enterprise encryption-in-transit program\n∙ TLS 1.3 enforcement\n∙ Certificate lifecycle management

Enterprise (>1,000 staff)

∙ Enterprise encryption governance program\n∙ TLS 1.3+\n∙ Certificate management platform (e.g., Venafi)\n∙ Automated certificate monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72903, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590862", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590862", "securityControlId": 31715, "ccis": [], "uuid": "e3592029-9183-59b2-a2b1-0621b380f2ab", "testId": "NET-12.1_A01", "test": "external wireless links to be protected from particular types of signal parameter attacks are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-40_ODP[01]", "defaultText": null }, { "id": 72904, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590862", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590862", "securityControlId": 31715, "ccis": [], "uuid": "3b3b3eb2-17d6-55a1-943d-5a5d9ef38794", "testId": "NET-12.1_A02", "test": "internal wireless links to be protected from particular types of signal parameter attacks are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-40_ODP[03]", "defaultText": null }, { "id": 72905, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590862", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590862", "securityControlId": 31715, "ccis": [], "uuid": "d487787c-02ee-57be-974e-892f11fb393e", "testId": "NET-12.1_A03", "test": "external wireless links are protected from types of signal parameter attacks or references to sources for such attacks.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-40[01]", "defaultText": null }, { "id": 72906, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590862", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590862", "securityControlId": 31715, "ccis": [], "uuid": "69b294c3-6e94-5316-aa99-db88e2a46109", "testId": "NET-12.1_A04", "test": "internal wireless links are protected from types of signal parameter attacks or references to sources for such attacks.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-40[02]", "defaultText": null }, { "id": 72907, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590862", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590862", "securityControlId": 31715, "ccis": [], "uuid": "6ffb95d9-2778-5f3b-8495-c7e0f14fead2", "testId": "NET-12.1_A05", "test": "types of signal parameter attacks or references to sources for such attacks from which to protect external wireless links are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-40_ODP[02]", "defaultText": null }, { "id": 72908, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590863", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590863", "securityControlId": 31715, "ccis": [], "uuid": "01035f70-4460-53e5-aeae-d2f157c93522", "testId": "NET-12.1_A06", "test": "types of signal parameter attacks or references to sources for such attacks from which to protect internal wireless links are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-40_ODP[04]", "defaultText": null } ], "externalMappings": [ { "id": 588600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fee68a69-b442-55f3-b5ed-bc3ec45d3b12", "parentControlId": 31715, "controlId": "T1557.004", "title": "T1557.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587577" }, { "id": 588601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b319ead-8247-5790-bf2e-2b21cf845f56", "parentControlId": 31715, "controlId": "SC-40", "title": "SC-40", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587577" }, { "id": 588602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b519e91d-1f60-5179-98f5-f469dce56795", "parentControlId": 31715, "controlId": "SC-40", "title": "SC-40", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587577" }, { "id": 588604, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b4197a2-ea72-59f5-8acb-68d462544ce3", "parentControlId": 31715, "controlId": "SC-40", "title": "SC-40", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587577" } ], "id": 31715, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731213", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731213", "catalogueId": 1062, "uuid": "2a881c2d-2c08-5b71-95af-da25558e69a2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect external and internal wireless links from signal parameter attacks through monitoring for unauthorized wireless connections, including scanning for unauthorized wireless access points and taking appropriate action, if an unauthorized connection is discovered?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Wireless Link Protection", "description": "

Control Description

Mechanisms exist to protect external and internal wireless links from signal parameter attacks through monitoring for unauthorized wireless connections, including scanning for unauthorized wireless access points and taking appropriate action, if an unauthorized connection is discovered.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Network communications containing sensitive/regulated data are protected using a cryptographic mechanism to prevent unauthorized disclosure of information while in transit (e.g., SSH, TLS, VPN, etc.). \n▪ Wireless access is protected via secure authentication and encryption.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ Network communications containing sensitive/regulated data use a cryptographic mechanism to prevent the unauthorized disclosure of information while in transit (e.g., SSH, TLS, VPN, etc.).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to protect external and internal wireless links from signal parameter attacks through monitoring for unauthorized wireless connections, including scanning for unauthorized wireless access points and taking appropriate action, if an unauthorized connection is discovered.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-12.1", "family": "Network Security", "enhancements": "", "sortId": "NET-12.1", "references": "

Micro-Small Business (<10 staff)

∙ Use WPA2/WPA3 encryption on all Wi-Fi networks

Small Business (10-49 staff)

∙ WPA3 Wi-Fi encryption\n∙ Wireless security policy

Medium Business (50-249 staff)

∙ Enterprise wireless security standard\n∙ WPA3-Enterprise\n∙ 802.1X authentication

Large Business (250-999 staff)

∙ Enterprise wireless security (WPA3-Enterprise + 802.1X)\n∙ Wireless IDS/IPS\n∙ RF monitoring

Enterprise (>1,000 staff)

∙ Enterprise WLAN security platform\n∙ WPA3-Enterprise with RADIUS\n∙ Wireless IDS/IPS (e.g., Cisco Wireless, Aruba)\n∙ RF scanning", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72909, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590863", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590863", "securityControlId": 31716, "ccis": [], "uuid": "668393a5-48f6-5807-b7fd-95844fb88f64", "testId": "NET-12.2_A01", "test": "the transmission of unprotected sensitive / regulated data by end-user messaging technologies is prohibited through administrative and/or technical means.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 588662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "472d77c6-7013-5d4d-a4c7-563f8b57b14e", "parentControlId": 31716, "controlId": "NET 1.8", "title": "NET 1.8", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587584" } ], "id": 31716, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731214", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731214", "catalogueId": 1062, "uuid": "7cd54f36-f268-508a-a02f-591a501fa51b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prohibit the transmission of unprotected sensitive/regulated data by end-user messaging technologies?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "End-User Messaging Technologies", "description": "

Control Description

Mechanisms exist to prohibit the transmission of unprotected sensitive/regulated data by end-user messaging technologies.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Network communications containing sensitive/regulated data are protected using a cryptographic mechanism to prevent unauthorized disclosure of information while in transit (e.g., SSH, TLS, VPN, etc.).

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to prohibit the transmission of unprotected sensitive/regulated data by end-user messaging technologies.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-12.2", "family": "Network Security", "enhancements": "", "sortId": "NET-12.2", "references": "

Micro-Small Business (<10 staff)

∙ Acceptable Use Policy (AUP)\n∙ Data Loss Prevention (DLP)

Small Business (10-49 staff)

∙ Acceptable Use Policy (AUP)\n∙ Data Loss Prevention (DLP)

Medium Business (50-249 staff)

∙ Acceptable Use Policy (AUP)\n∙ Data Loss Prevention (DLP)

Large Business (250-999 staff)

∙ Acceptable Use Policy (AUP)\n∙ Data Loss Prevention (DLP)

Enterprise (>1,000 staff)

∙ Acceptable Use Policy (AUP)\n∙ Data Loss Prevention (DLP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72910, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590863", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590863", "securityControlId": 31717, "ccis": [], "uuid": "3c94f701-d05f-5760-94ed-c72c119bfcd9", "testId": "NET-13_A01", "test": "cryptographic mechanisms are implemented to protect message externals unless otherwise protected by alternative physical controls.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-08(03)", "defaultText": null }, { "id": 72911, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590863", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590863", "securityControlId": 31717, "ccis": [], "uuid": "d3b2460f-0289-569e-82b0-d2d812e7f7da", "testId": "NET-13_A02", "test": "alternative physical controls to protect message externals are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-08(03)_ODP", "defaultText": null }, { "id": 72912, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590868", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590868", "securityControlId": 31717, "ccis": [], "uuid": "c2ad5ff0-3359-5875-b31a-baaf11c4fd1f", "testId": "NET-13_A03", "test": "use of Voice over Internet Protocol (VoIP) technologies is controlled.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.13.14[a]", "defaultText": null }, { "id": 72913, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590868", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590868", "securityControlId": 31717, "ccis": [], "uuid": "80be4081-a8d8-59ad-af88-9b6919ec015c", "testId": "NET-13_A04", "test": "use of Voice over Internet Protocol (VoIP) technologies is monitored.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.13.14[b]", "defaultText": null } ], "externalMappings": [ { "id": 588671, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ef611a9-b8ee-5aed-ba31-e8abbd3de8df", "parentControlId": 31717, "controlId": "5.14", "title": "5.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587585" }, { "id": 588675, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9b25040-587f-557a-8317-4294ce19aac1", "parentControlId": 31717, "controlId": "SC-8(3)", "title": "SC-8(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587585" }, { "id": 588676, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b5f0a0b-df1e-57fa-9758-3f9c8ed83d71", "parentControlId": 31717, "controlId": "SC-19", "title": "SC-19", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587586" }, { "id": 588677, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587586", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ec3e15a-f93c-5b03-a89d-92c94f13040a", "parentControlId": 31717, "controlId": "SC-08(03)", "title": "SC-08(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587586" }, { "id": 588678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587586", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d99a6730-317d-53c1-b357-135128a039f9", "parentControlId": 31717, "controlId": "SC-08(03)", "title": "SC-08(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587586" }, { "id": 588679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587586", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87adb108-a5f0-5c20-8868-c85b65d8d734", "parentControlId": 31717, "controlId": "3.13.14", "title": "3.13.14", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587586" }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d9904adf-957f-5861-bc2d-95028040329e", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "e5878903-77a6-5d97-8676-c56391d949bd", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "f85d8e5a-50f5-51b9-bfa2-6a4645e5015c", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "d8d16c35-2436-5524-a7b9-7265db18ddde", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "c594c91c-c4ea-5241-8044-05d70caab3a6", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "4d6744b6-24f2-5c66-b87a-5bb71354100f", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "fdfe0b2b-0097-53ac-b762-07a447068829", "isPublic": true } ], "id": 31717, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731214", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731214", "catalogueId": 1062, "uuid": "74e9188d-bf1f-5bdf-ae25-30d146b6f7c8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect the confidentiality, integrity and availability of electronic messaging communications?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Electronic Messaging", "description": "

Control Description

Mechanisms exist to protect the confidentiality, integrity and availability of electronic messaging communications.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Network communications containing sensitive/regulated data are protected using a cryptographic mechanism to prevent unauthorized disclosure of information while in transit (e.g., SSH, TLS, VPN, etc.).

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to protect the confidentiality, integrity and availability of electronic messaging communications.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-13", "family": "Network Security", "enhancements": "", "sortId": "NET-13", "references": "

Micro-Small Business (<10 staff)

∙ Acceptable Use Policy (AUP)\n∙ Data Loss Prevention (DLP)

Small Business (10-49 staff)

∙ Acceptable Use Policy (AUP)\n∙ Data Loss Prevention (DLP)

Medium Business (50-249 staff)

∙ Acceptable Use Policy (AUP)\n∙ Data Loss Prevention (DLP)

Large Business (250-999 staff)

∙ Acceptable Use Policy (AUP)\n∙ Data Loss Prevention (DLP)

Enterprise (>1,000 staff)

∙ Acceptable Use Policy (AUP)\n∙ Data Loss Prevention (DLP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72914, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590868", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590868", "securityControlId": 31718, "ccis": [], "uuid": "3103b648-fd1e-5c12-9147-e83fe49bebb0", "testId": "NET-14_A01", "test": "usage restrictions are established for each type of allowable remote system access.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-17a.[01]\n171A_R3_A.03.01.12.a[02]", "defaultText": null }, { "id": 72915, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590868", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590868", "securityControlId": 31718, "ccis": [], "uuid": "b5b7b6a3-0fab-5e85-8b6f-7601214b291d", "testId": "NET-14_A02", "test": "types of allowable remote system access are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.01.12.a[01]", "defaultText": null }, { "id": 72916, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590869", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590869", "securityControlId": 31718, "ccis": [], "uuid": "97575dea-241a-5af3-a233-107988689a70", "testId": "NET-14_A03", "test": "connection requirements are established for each type of allowable remote system access.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.01.12.a[04]", "defaultText": null }, { "id": 72917, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590869", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590869", "securityControlId": 31718, "ccis": [], "uuid": "44804289-3449-5b49-bc30-fa9d50b33413", "testId": "NET-14_A04", "test": "each type of remote system access is authorized prior to establishing such connections.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.01.12.b", "defaultText": null }, { "id": 72918, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590869", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590869", "securityControlId": 31718, "ccis": [], "uuid": "ff4b7273-67c1-513e-8643-bfb42f0d46cb", "testId": "NET-14_A05", "test": "configuration requirements are established for each type of allowable remote system access.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_AC-17a.[02]\n171A_R3_A.03.01.12.a[03]", "defaultText": null }, { "id": 72919, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590869", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590869", "securityControlId": 31718, "ccis": [], "uuid": "b0552732-e942-5d31-8b69-35a3c922c18f", "testId": "NET-14_A06", "test": "implementation guidance is established and documented for each type of remote access allowed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-17a.[03]", "defaultText": null }, { "id": 72920, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590869", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590869", "securityControlId": 31718, "ccis": [], "uuid": "c5643bb1-28a6-5d46-a1c8-5181a91e58b9", "testId": "NET-14_A07", "test": "each type of remote access to the system is authorized prior to allowing such connections.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-17b.", "defaultText": null }, { "id": 72921, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590869", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590869", "securityControlId": 31718, "ccis": [], "uuid": "8c04d3df-1348-5cdc-90c3-ee71498fa250", "testId": "NET-14_A08", "test": "information about remote access mechanisms is protected from unauthorized use and disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-17(06)", "defaultText": null }, { "id": 72922, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59087", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59087", "securityControlId": 31718, "ccis": [], "uuid": "6b45c271-4125-575c-bca5-db1fa5bb8672", "testId": "NET-14_A09", "test": "remote access to the system is routed through authorized access control points.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.12.c[01]", "defaultText": null }, { "id": 72923, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59087", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59087", "securityControlId": 31718, "ccis": [], "uuid": "66d19d04-27be-51f3-bd26-61674d930fa1", "testId": "NET-14_A10", "test": "remote access to the system is routed through managed access control points.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.12.c[02]", "defaultText": null }, { "id": 72924, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59087", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59087", "securityControlId": 31718, "ccis": [], "uuid": "f9f5ff24-81c5-5f4b-9fe7-050d57f1598c", "testId": "NET-14_A11", "test": "remote execution of privileged commands is authorized.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.12.d[1]", "defaultText": null }, { "id": 72925, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59087", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59087", "securityControlId": 31718, "ccis": [], "uuid": "4bae06c7-821a-58fd-9f52-05db1a1803bd", "testId": "NET-14_A12", "test": "remote access to security-relevant information is authorized.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.12.d[2]", "defaultText": null } ], "externalMappings": [ { "id": 588786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "931c24d5-0c99-5f05-8cae-aafadea1c2a0", "parentControlId": 31718, "controlId": "NET 3.1", "title": "NET 3.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587608" }, { "id": 588787, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58fbe856-1385-5786-904a-77e357d4037f", "parentControlId": 31718, "controlId": "NET 3.2", "title": "NET 3.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587608" }, { "id": 588788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d293393c-9d66-5a22-b60c-03c658d377b6", "parentControlId": 31718, "controlId": "NET 3.2(a)", "title": "NET 3.2(a)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587608" }, { "id": 588789, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c32de40d-3658-5586-b575-66f0a435dbd1", "parentControlId": 31718, "controlId": "NET 3.2(b)", "title": "NET 3.2(b)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587608" }, { "id": 588790, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587608", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8706de4-0a69-59cd-9d6c-810cb5a4edc4", "parentControlId": 31718, "controlId": "NET 3.2(c)", "title": "NET 3.2(c)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587608" }, { "id": 588791, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b62a88a-55b7-57ca-ad86-f51b1f6edabd", "parentControlId": 31718, "controlId": "NET 3.2(d)", "title": "NET 3.2(d)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587609" }, { "id": 588792, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5393904f-2c3d-56e1-9bd9-9df69985d934", "parentControlId": 31718, "controlId": "NET 3.2(e)", "title": "NET 3.2(e)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587609" }, { "id": 588793, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1598c05b-4530-5c39-a3c7-a2af00a12afd", "parentControlId": 31718, "controlId": "NET 3.2(f)", "title": "NET 3.2(f)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587609" }, { "id": 588794, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16c43293-2bfd-5719-ae65-b4ca6f6d93b2", "parentControlId": 31718, "controlId": "NET 3.2(g)", "title": "NET 3.2(g)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587609" }, { "id": 588795, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99f3e593-822a-55c1-a8bc-fe1a160187be", "parentControlId": 31718, "controlId": "NET 3.2(h)", "title": "NET 3.2(h)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587609" }, { "id": 588796, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef724544-ed90-540b-918e-a26572b28bc2", "parentControlId": 31718, "controlId": "6.7", "title": "6.7", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587609" }, { "id": 588798, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66c591e4-ca79-5deb-9420-8f2b0593223c", "parentControlId": 31718, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587609" }, { "id": 588799, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61866160-3770-5182-b8f9-af334e9a3b4e", "parentControlId": 31718, "controlId": "T1021", "title": "T1021", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58761" }, { "id": 588800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58761", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f44bbcf3-1dca-5051-8c1b-710fd0c3bf33", "parentControlId": 31718, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58761" }, { "id": 588801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58761", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fff4fc26-e8e2-5d7f-9d19-7a3ee6f95aac", "parentControlId": 31718, "controlId": "T1021.002", "title": "T1021.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58761" }, { "id": 588802, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58761", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a871de6d-354f-5269-b5d0-4d181b4853ce", "parentControlId": 31718, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58761" }, { "id": 588803, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58761", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d00e9c2b-1a23-567d-93cc-7659df4cbda0", "parentControlId": 31718, "controlId": "T1021.004", "title": "T1021.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58761" }, { "id": 588804, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58761", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24a4f77d-6b79-5f1c-ae63-9e7cadabe369", "parentControlId": 31718, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58761" }, { "id": 588805, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58761", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1aa6b670-131a-51ce-a8f5-9e63f996e47d", "parentControlId": 31718, "controlId": "T1021.006", "title": "T1021.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58761" }, { "id": 588806, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58761", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8dcb89a-3eb8-50ee-8de2-74f778ad64a8", "parentControlId": 31718, "controlId": "T1021.008", "title": "T1021.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58761" }, { "id": 588807, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58761", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9aca1bac-6bf8-58ac-b487-9efebffaad96", "parentControlId": 31718, "controlId": "T1037", "title": "T1037", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58761" }, { "id": 588808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc9a95c1-1040-5012-aa11-40b5f182b749", "parentControlId": 31718, "controlId": "T1037.001", "title": "T1037.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587611" }, { "id": 588809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74efe9b9-59f5-50c6-8292-52ff5c9087f4", "parentControlId": 31718, "controlId": "T1040", "title": "T1040", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587611" }, { "id": 588810, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd6d9062-f48b-58f5-bfe6-df6c0792c2a9", "parentControlId": 31718, "controlId": "T1047", "title": "T1047", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587611" }, { "id": 588811, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "245f5a4a-b68b-5b4d-be65-59946a5b05e5", "parentControlId": 31718, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587611" }, { "id": 588812, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfc67b17-47bd-5e41-80a8-ecde94bf4b24", "parentControlId": 31718, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587611" }, { "id": 588813, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6af57b19-6beb-595b-820f-0a8152a98e17", "parentControlId": 31718, "controlId": "T1059.002", "title": "T1059.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587611" }, { "id": 588814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5fb21101-b4a2-5c8e-b16b-6cdd8050750e", "parentControlId": 31718, "controlId": "T1059.003", "title": "T1059.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587611" }, { "id": 588815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587611", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1b2045e-a1b6-5721-a574-2b9e4340caed", "parentControlId": 31718, "controlId": "T1059.004", "title": "T1059.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587611" }, { "id": 588816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d00b2c73-8074-543e-b685-f1048c00478c", "parentControlId": 31718, "controlId": "T1059.005", "title": "T1059.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587612" }, { "id": 588817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15820664-0ffc-5c4d-a8ba-d45334f548da", "parentControlId": 31718, "controlId": "T1059.006", "title": "T1059.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587612" }, { "id": 588818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffa4092d-5665-592a-aa68-f5e5470179fa", "parentControlId": 31718, "controlId": "T1059.007", "title": "T1059.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587612" }, { "id": 588819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97ef6a4a-c20e-59d5-b997-2fe01103c32b", "parentControlId": 31718, "controlId": "T1059.008", "title": "T1059.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587612" }, { "id": 588820, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3e8d4c9-ac1b-5840-b5eb-c624ee09dcd2", "parentControlId": 31718, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587612" }, { "id": 588821, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7132d3a-1525-5ec5-a04f-5d789285a85e", "parentControlId": 31718, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587612" }, { "id": 588822, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67999cf7-5062-5184-97b3-1a74df0a8ad0", "parentControlId": 31718, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587612" }, { "id": 588823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587612", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "302b682f-8de3-51a1-aabb-1158af1a2bcd", "parentControlId": 31718, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587613" }, { "id": 588824, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0006e389-a135-5a68-91c1-1a553d66dcee", "parentControlId": 31718, "controlId": "T1114", "title": "T1114", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587613" }, { "id": 588825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8bfd7aa-063f-51de-b12f-218a0b88eaa4", "parentControlId": 31718, "controlId": "T1114.001", "title": "T1114.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587613" }, { "id": 588826, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe80b6df-a295-568c-8db2-e3fd382f369d", "parentControlId": 31718, "controlId": "T1114.002", "title": "T1114.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587613" }, { "id": 588827, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40073af7-0ad8-5a3c-945d-245963543322", "parentControlId": 31718, "controlId": "T1114.003", "title": "T1114.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587613" }, { "id": 588828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68b1f16d-e1d9-55c2-bad1-41972e15844c", "parentControlId": 31718, "controlId": "T1119", "title": "T1119", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587613" }, { "id": 588829, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50814a3d-1680-5145-8650-273bbe37ad00", "parentControlId": 31718, "controlId": "T1127.002", "title": "T1127.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587613" }, { "id": 588830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e14043d-db16-517b-9192-4391514e65fd", "parentControlId": 31718, "controlId": "T1133", "title": "T1133", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587613" }, { "id": 588831, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60438392-8d5f-5508-9fd4-ebeb3eafd43b", "parentControlId": 31718, "controlId": "T1137", "title": "T1137", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587613" }, { "id": 588832, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c49f3139-fd12-580e-81eb-64b263c2f2d4", "parentControlId": 31718, "controlId": "T1137.002", "title": "T1137.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587614" }, { "id": 588833, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5da339b-440a-5a95-90cf-00731822a8e1", "parentControlId": 31718, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587614" }, { "id": 588834, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb2a86a9-2fbf-5f30-a230-8a0a07827465", "parentControlId": 31718, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587614" }, { "id": 588835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd302ba1-17c1-533b-a035-bf5a302115fc", "parentControlId": 31718, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587614" }, { "id": 588836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fd8d250-a314-563b-9d25-8c195332430f", "parentControlId": 31718, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587614" }, { "id": 588837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ed82bce-2c93-516e-8576-61b57b8d763d", "parentControlId": 31718, "controlId": "T1219", "title": "T1219", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587614" }, { "id": 588838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b97e3183-19eb-5caa-aa53-92a0ff108759", "parentControlId": 31718, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587614" }, { "id": 588839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b214f532-3acc-5972-b525-e35e481b020d", "parentControlId": 31718, "controlId": "T1505.005", "title": "T1505.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587614" }, { "id": 588840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97f6a69f-8a39-5d1e-bc32-4962c90cf91c", "parentControlId": 31718, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587614" }, { "id": 588841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2be496f-39ca-58e5-997e-68c2c5512a41", "parentControlId": 31718, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587615" }, { "id": 588842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f776aea3-7156-5576-b110-c88b562628cd", "parentControlId": 31718, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587615" }, { "id": 588843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75c88164-a4c4-5698-8d3c-9cff2cc83557", "parentControlId": 31718, "controlId": "T1547.003", "title": "T1547.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587615" }, { "id": 588844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b02f6b9-cb91-5db7-8e50-2cf39863e621", "parentControlId": 31718, "controlId": "T1547.004", "title": "T1547.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587615" }, { "id": 588845, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "635b2eb3-f4d4-54ef-8c09-40bacdee823f", "parentControlId": 31718, "controlId": "T1547.009", "title": "T1547.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587615" }, { "id": 588846, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afe39ad4-8ac7-5013-a481-596e5209eeeb", "parentControlId": 31718, "controlId": "T1547.012", "title": "T1547.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587615" }, { "id": 588847, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ce781fb-4bdf-5655-95e1-9bef5e30135e", "parentControlId": 31718, "controlId": "T1547.013", "title": "T1547.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587615" }, { "id": 588848, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2abaeb8-2df4-5cfd-9532-271666214760", "parentControlId": 31718, "controlId": "T1550.001", "title": "T1550.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587615" }, { "id": 588849, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "060b7330-aa34-5bbc-906d-c6ccc134dbea", "parentControlId": 31718, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587616" }, { "id": 588850, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bdfd4e0-80f2-5d11-a027-a159bbc94b90", "parentControlId": 31718, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587616" }, { "id": 588851, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0e5b3a1-6de6-59ab-8dca-1e4f41c8b72b", "parentControlId": 31718, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587616" }, { "id": 588852, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bfbf7fa-2a2f-51a8-b390-4dff64288352", "parentControlId": 31718, "controlId": "T1552.005", "title": "T1552.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587616" }, { "id": 588853, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e4d77be-570f-517b-86de-8dfbff864eda", "parentControlId": 31718, "controlId": "T1552.007", "title": "T1552.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587616" }, { "id": 588854, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16d7d97b-a254-5cfa-bc5b-a80d3f91b6de", "parentControlId": 31718, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587616" }, { "id": 588855, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ab517d0-9884-5f8e-b746-90ffffb5e950", "parentControlId": 31718, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587616" }, { "id": 588856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cdac3881-b228-5ff0-8c32-2962d909b6cd", "parentControlId": 31718, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587616" }, { "id": 588857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76312a8e-760c-5ada-9d01-e57bd343d866", "parentControlId": 31718, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587616" }, { "id": 588858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99a97a50-2a87-5367-981a-c50bea99d4c9", "parentControlId": 31718, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587617" }, { "id": 588859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a905aae3-c2e1-5134-bd8d-6c197407a50c", "parentControlId": 31718, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587617" }, { "id": 588860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba2b3bb9-4abf-5535-aa1f-a4d73e9597b7", "parentControlId": 31718, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587617" }, { "id": 588861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e58b7442-ae8d-53a7-adbc-e71e98d3f71f", "parentControlId": 31718, "controlId": "T1563.001", "title": "T1563.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587617" }, { "id": 588862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "adc1af12-89b1-503b-8af2-273320a395c3", "parentControlId": 31718, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587617" }, { "id": 588863, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f120214-8d43-5d2b-aff4-44c5517e001d", "parentControlId": 31718, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587617" }, { "id": 588864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0bf8068-b63c-5539-9f5e-66b0c967cce4", "parentControlId": 31718, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587617" }, { "id": 588865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4cdc710b-fd04-5a25-a490-3c93a2856057", "parentControlId": 31718, "controlId": "T1565.002", "title": "T1565.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587617" }, { "id": 588866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ce3139d-9013-54f2-a6bc-cb7f4d8828c1", "parentControlId": 31718, "controlId": "T1567.003", "title": "T1567.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587618" }, { "id": 588867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd8bb104-cdc3-5da4-9ec5-e45761ef20a9", "parentControlId": 31718, "controlId": "T1567.004", "title": "T1567.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587618" }, { "id": 588868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c65c3f9e-8c71-5e7c-a935-394010911a0b", "parentControlId": 31718, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587618" }, { "id": 588869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1df119cf-5181-5bcb-92fa-8720aa446ef1", "parentControlId": 31718, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587618" }, { "id": 588870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb90491a-714e-59fa-8e4a-01a807d6b2de", "parentControlId": 31718, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587618" }, { "id": 588871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "971d4783-2358-5aff-80e8-38a4923614e9", "parentControlId": 31718, "controlId": "T1609", "title": "T1609", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587618" }, { "id": 588872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6580af5-43ca-5581-a939-38edc01a2f7c", "parentControlId": 31718, "controlId": "T1610", "title": "T1610", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587618" }, { "id": 588873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e362262-8a1d-57e6-a4ed-4dd12c56b72b", "parentControlId": 31718, "controlId": "T1612", "title": "T1612", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587618" }, { "id": 588874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23ad5b37-a8de-527b-ad23-c23132d5bbb2", "parentControlId": 31718, "controlId": "T1613", "title": "T1613", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587618" }, { "id": 588875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0fcf540d-f2dc-56fe-9a67-9d53bfcc278b", "parentControlId": 31718, "controlId": "T1619", "title": "T1619", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587619" }, { "id": 588876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26abc533-a2ba-5611-b85d-92b1efb23fdc", "parentControlId": 31718, "controlId": "T1647", "title": "T1647", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587619" }, { "id": 588877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb61a40c-06f9-5a6d-9abe-d25b4d1e1863", "parentControlId": 31718, "controlId": "T1651", "title": "T1651", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587619" }, { "id": 588878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a4eecd7-8c54-51e0-a7b8-2be5842a5549", "parentControlId": 31718, "controlId": "T1659", "title": "T1659", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587619" }, { "id": 588883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "224245aa-5331-5fd4-bc8c-9cf7d8566d73", "parentControlId": 31718, "controlId": "AC-17", "title": "AC-17", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587628" }, { "id": 588884, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11bae945-b257-5aaf-b8f7-499788fa8c1b", "parentControlId": 31718, "controlId": "AC-17(6)", "title": "AC-17(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587628" }, { "id": 588885, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "228e7db6-8cc9-5bfe-8843-5435bea841ee", "parentControlId": 31718, "controlId": "AC-17", "title": "AC-17", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587628" }, { "id": 588886, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "326b310d-45fa-5ff1-88a0-a17f6d5a1514", "parentControlId": 31718, "controlId": "AC-17(06)", "title": "AC-17(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587628" }, { "id": 588887, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7df36c63-7d17-53a7-a7e5-746c0303c092", "parentControlId": 31718, "controlId": "AC-17", "title": "AC-17", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587629" }, { "id": 588888, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0bfdebb5-9a61-58f2-af3e-3b2914d56912", "parentControlId": 31718, "controlId": "AC-17", "title": "AC-17", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587629" }, { "id": 588889, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "429a57a6-f16c-58b9-aba1-6aa849378b64", "parentControlId": 31718, "controlId": "AC-17(06)", "title": "AC-17(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587629" }, { "id": 588890, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9155412-a7b5-5c01-861b-62c927a93314", "parentControlId": 31718, "controlId": "AC-17", "title": "AC-17", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587629" }, { "id": 588891, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d8c6371-2d29-594e-bcf9-1eb60b0039a5", "parentControlId": 31718, "controlId": "AC-17", "title": "AC-17", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587629" }, { "id": 588892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "363c2a6b-ccfb-5032-aa24-6cae355584b5", "parentControlId": 31718, "controlId": "AC-17", "title": "AC-17", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587629" }, { "id": 588893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5783a773-6039-5859-9e3d-b7d3d0da74b2", "parentControlId": 31718, "controlId": "AC-17", "title": "AC-17", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587629" }, { "id": 588894, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93b7d03b-ee43-5493-98a2-14b6b50c8e63", "parentControlId": 31718, "controlId": "AC-17(6)", "title": "AC-17(6)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587629" }, { "id": 588895, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58763", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fd0b767-f16f-5cf6-85f9-aacbf5171cf1", "parentControlId": 31718, "controlId": "AC-17", "title": "AC-17", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58763" }, { "id": 588896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58763", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07cdb745-10f2-5ae8-b976-f2e43a3f6947", "parentControlId": 31718, "controlId": "AC-17", "title": "AC-17", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58763" }, { "id": 588901, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58763", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e59f8fe1-093d-583d-b25f-2f3faeb874a6", "parentControlId": 31718, "controlId": "3.1.12", "title": "3.1.12", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58763" }, { "id": 588902, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58763", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92c82081-932d-591d-bf63-edf70c474394", "parentControlId": 31718, "controlId": "03.01.12.a", "title": "03.01.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58763" }, { "id": 588903, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58763", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d602f2f3-7897-577a-bb0d-bce282fcc1c6", "parentControlId": 31718, "controlId": "03.01.12.b", "title": "03.01.12.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58763" }, { "id": 588904, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587631", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42b12ced-8984-5cc9-be08-163ca39ee351", "parentControlId": 31718, "controlId": "03.01.12.c", "title": "03.01.12.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587631" }, { "id": 588905, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587631", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebaa54ea-f5fd-50ba-887d-f6d05a02b1ae", "parentControlId": 31718, "controlId": "03.01.12.d", "title": "03.01.12.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587631" }, { "id": 588964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587637", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae9ed3f2-fa16-5536-8a91-377dbfff3a83", "parentControlId": 31718, "controlId": "CIP-005-7 2.1", "title": "CIP-005-7 2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587637" }, { "id": 588965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7ee2321-794c-5aa7-abb5-cd21ff0162a1", "parentControlId": 31718, "controlId": "CIP-005-7 2.3", "title": "CIP-005-7 2.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587638" }, { "id": 588966, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56167432-2a39-5abe-8907-6847ecc32349", "parentControlId": 31718, "controlId": "CIP-005-7 2.4", "title": "CIP-005-7 2.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587638" }, { "controlId": "B.1.15", "title": "B.1.15 — Network Access Control", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-17, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "2db92abc-0d9d-500d-aefc-ab900e797a48", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.15", "title": "NEI 08-09 App D.1.15 — Network Access Control", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.15", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "a6a35482-dc15-590a-8a0b-5a0584aaa458", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.15", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "d793abef-d92b-50ed-8a44-3904cc1dbcfd", "isPublic": true }, { "controlId": "CIP-003-9-1.2.6", "title": "CIP-003-9-1.2.6", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "bd8d0753-d260-557f-9307-0cd37aa02b8e", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec6", "title": "CIP-003-9-Attachment1-Sec6", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b6321fa0-93d5-537a-ad1f-5d8280a4c266", "isPublic": true }, { "controlId": "CIP-005-7-R2", "title": "CIP-005-7-R2 — Interactive Remote Access Management", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e65be38d-41d1-5177-95cd-44b86e3e420a", "isPublic": true }, { "controlId": "CIP-005-7-2.1", "title": "CIP-005-7-2.1 — For all Interactive Remote Access, utilize an Intermediate System such that the Cyber Asset initiating Interactive Re...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4044a2d0-8915-5a28-8fac-e49c72058c2b", "isPublic": true }, { "controlId": "CIP-005-7-2.2", "title": "CIP-005-7-2.2 — For all Interactive Remote Access sessions, utilize encryption that terminates at an Intermediate System.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "dc76c1f6-89bf-53c4-89ff-5a2ea20d61df", "isPublic": true }, { "controlId": "CIP-005-7-2.3", "title": "CIP-005-7-2.3 — Require multi-factor authentication for all Interactive Remote Access sessions.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0ef3e4e1-d1cd-5ac1-8f54-7f3f1e3991fd", "isPublic": true }, { "controlId": "CIP-005-7-2.4", "title": "CIP-005-7-2.4 — Have one or more methods for determining active vendor remote access sessions (including Interactive Remote Access an...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "baa56e04-ad57-5b0d-a4ef-7076dfb62311", "isPublic": true }, { "controlId": "CIP-005-7-2.5", "title": "CIP-005-7-2.5 — Have one or more method(s) to disable active vendor remote access (including Interactive Remote Access and system- to...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1f22b705-cb83-5ec9-be1a-c8ddce7c532a", "isPublic": true }, { "controlId": "CIP-005-7-R3", "title": "CIP-005-7-R3 — Vendor Remote Access Management", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "57b29893-7168-5ed9-98a5-a080eb87fd26", "isPublic": true }, { "controlId": "CIP-005-7-3.1", "title": "CIP-005-7-3.1 — Have one or more method(s) to determine authenticated vendor- initiated remote connections.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "489d4405-8940-5e26-a20c-8fc497ea6b6a", "isPublic": true }, { "controlId": "CIP-005-7-3.2", "title": "CIP-005-7-3.2 — Have one or more method(s) to terminate authenticated vendor-initiated remote connections and control the ability to...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c5666ce6-0a5d-52e3-b6aa-5d38bca8d048", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "31b10dd0-eb5d-5765-8000-4cbaafab80c4", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "ec1b5208-da77-5b92-9d9f-12444dc5f06e", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "538b122e-ef72-5f2b-8f32-c75d5f56dc2e", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "49e30e0e-500b-5620-9c04-815e29912f92", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "4720ab8d-9e69-533d-b040-b751f5143b30", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "3feb82e0-95b6-50d8-8609-9638dcd2b628", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "adb9a040-eb8b-5a97-8317-552fe93a8de7", "isPublic": true } ], "id": 31718, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731214", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731215", "catalogueId": 1062, "uuid": "803f9c65-ecc6-5194-ac0a-d6d59bef7f67", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define, control and review organization-approved, secure remote access methods?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Remote Access", "description": "

Control Description

Mechanisms exist to define, control and review organization-approved, secure remote access methods.

Evidence Request List (ERL)

E-NET-03\nE-IAM-14

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to define, control and review organization-approved, secure remote access methods.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.15
NERC-CIP (2026) Requirements: CIP-005-7-R2, CIP-005-7-R3", "controlId": "NET-14", "family": "Network Security", "enhancements": "", "sortId": "NET-14", "references": "

Micro-Small Business (<10 staff)

∙ VPN for remote access\n∙ Remote access policy

Small Business (10-49 staff)

∙ VPN with MFA for remote access\n∙ Documented remote access policy

Medium Business (50-249 staff)

∙ Enterprise VPN with MFA\n∙ Remote access policy\n∙ Split tunneling controls

Large Business (250-999 staff)

∙ Enterprise VPN or ZTNA solution\n∙ Remote access monitoring\n∙ MFA enforcement

Enterprise (>1,000 staff)

∙ Enterprise ZTNA/SASE platform (e.g., Zscaler, Palo Alto Prisma Access)\n∙ VPN with MFA\n∙ Remote access monitoring and logging", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72926, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590871", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590871", "securityControlId": 31719, "ccis": [], "uuid": "3e4d64e6-5512-537e-b5bf-b40f9fea7292", "testId": "NET-14.1_A01", "test": "remote access sessions are controlled.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.12[c]\n53A_R5_AC-17(01)[02]", "defaultText": null }, { "id": 72927, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590871", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590871", "securityControlId": 31719, "ccis": [], "uuid": "f2054602-6e02-5d35-9567-e3fbf37f5c32", "testId": "NET-14.1_A02", "test": "remote access sessions are permitted.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.1.12[a]", "defaultText": null }, { "id": 72928, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590871", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590871", "securityControlId": 31719, "ccis": [], "uuid": "c3968dea-bf15-56e0-a39e-f9280f0c7db7", "testId": "NET-14.1_A03", "test": "the types of permitted remote access are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.1.12[b]", "defaultText": null }, { "id": 72929, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590871", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590871", "securityControlId": 31719, "ccis": [], "uuid": "f1cf4206-df2d-5952-9898-d552a3eb1d88", "testId": "NET-14.1_A04", "test": "remote access sessions are monitored.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.1.12[d]\n53A_R5_AC-17(01)[01]", "defaultText": null } ], "externalMappings": [ { "id": 589012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587643", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b0d4e5e-4762-558b-9824-a8ead9d68851", "parentControlId": 31719, "controlId": "AC-17(1)", "title": "AC-17(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587643" }, { "id": 589013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587643", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3dd6a03-a10e-5a2a-8da8-ce4cb16bc319", "parentControlId": 31719, "controlId": "AC-17(01)", "title": "AC-17(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587643" }, { "id": 589014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587643", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30a05403-6348-5295-b54b-54a0ea6416ea", "parentControlId": 31719, "controlId": "AC-17(01)", "title": "AC-17(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587643" }, { "id": 589015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587643", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3686b665-74eb-5dc2-b734-0fd5ad457195", "parentControlId": 31719, "controlId": "AC-17(01)", "title": "AC-17(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587643" }, { "id": 589016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3950dd3d-bdf4-5d29-ab15-5ae0aa6e3bcd", "parentControlId": 31719, "controlId": "AC-17(01)", "title": "AC-17(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587644" }, { "id": 589017, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61e053fe-932c-5772-ba15-c783dfbf4302", "parentControlId": 31719, "controlId": "AC-17(01)", "title": "AC-17(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587644" }, { "id": 589018, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "650d8d36-615b-5552-99bd-6e70c4bed97d", "parentControlId": 31719, "controlId": "3.1.12", "title": "3.1.12", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587644" }, { "id": 589019, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d4bc45b-3718-596b-9917-c83064a7fccc", "parentControlId": 31719, "controlId": "03.01.12.b", "title": "03.01.12.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587644" } ], "id": 31719, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731215", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731215", "catalogueId": 1062, "uuid": "cd2c7fe7-959e-5b29-b7ef-990591b7b844", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to monitor and control remote access sessions?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 1.0, "title": "Automated Monitoring & Control", "description": "

Control Description

Automated mechanisms exist to monitor and control remote access sessions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to automatically monitor and control remote access sessions.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "NET-14.1", "family": "Network Security", "enhancements": "", "sortId": "NET-14.1", "references": "

Micro-Small Business (<10 staff)

∙ Monitor VPN usage logs periodically

Small Business (10-49 staff)

∙ Automated monitoring of VPN usage\n∙ Alerting on anomalous remote access

Medium Business (50-249 staff)

∙ Automated monitoring and control of remote access sessions\n∙ SIEM alerts for remote access anomalies

Large Business (250-999 staff)

∙ Enterprise remote access monitoring platform\n∙ Automated session controls\n∙ SIEM integration

Enterprise (>1,000 staff)

∙ Enterprise SIEM/SOAR with remote access monitoring\n∙ Automated anomaly detection\n∙ Just-in-time access controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72930, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590871", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590871", "securityControlId": 31720, "ccis": [], "uuid": "4b78f7f8-ea13-5fb1-8f8d-cf5c2c6a6c52", "testId": "NET-14.2_A01", "test": "cryptographic mechanisms to protect the confidentiality of remote access sessions are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.13[a]", "defaultText": null }, { "id": 72931, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590871", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590871", "securityControlId": 31720, "ccis": [], "uuid": "a297aa53-b39c-5069-84fb-e6d73b542c94", "testId": "NET-14.2_A02", "test": "cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.13[b]\n53A_R5_AC-17(02)", "defaultText": null } ], "externalMappings": [ { "id": 589042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587655", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "878c9169-3b2e-50d8-a4ea-082d16b7ce41", "parentControlId": 31720, "controlId": "AC-17(2)", "title": "AC-17(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587655" }, { "id": 589043, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587655", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd6857a0-aecb-53a4-a01e-c0351876bf34", "parentControlId": 31720, "controlId": "AC-17(02)", "title": "AC-17(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587655" }, { "id": 589044, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587655", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b0dae86-d893-5af6-bf58-0dfc9fd7306f", "parentControlId": 31720, "controlId": "AC-17(02)", "title": "AC-17(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587655" }, { "id": 589045, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587655", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a81f633-0c53-557e-9400-6a1b44d7f467", "parentControlId": 31720, "controlId": "AC-17(02)", "title": "AC-17(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587655" }, { "id": 589046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587655", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6eae5da-375f-5a15-bf82-787c506213a8", "parentControlId": 31720, "controlId": "AC-17(02)", "title": "AC-17(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587656" }, { "id": 589047, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10cd3caf-9f80-549e-a5ed-528878cadc2c", "parentControlId": 31720, "controlId": "AC-17(02)", "title": "AC-17(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587656" }, { "id": 589048, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05bf27da-ba84-59e9-b016-3e1543e9b97d", "parentControlId": 31720, "controlId": "3.1.13", "title": "3.1.13", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587656" }, { "id": 589049, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86074a9c-2265-5ed7-8234-5a31051186af", "parentControlId": 31720, "controlId": "03.01.12.a", "title": "03.01.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587656" }, { "id": 589059, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587657", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36866b57-eac1-5287-b9a9-edb194e748af", "parentControlId": 31720, "controlId": "CIP-005-7 2.2", "title": "CIP-005-7 2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587657" } ], "id": 31720, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731215", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731215", "catalogueId": 1062, "uuid": "44fd2681-3230-57fd-9a29-f88dce75b679", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Are cryptographic mechanisms utilized to protect the confidentiality and integrity of remote access sessions (e.g., VPN)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Protection of Confidentiality / Integrity Using Encryption", "description": "

Control Description

Cryptographic mechanisms exist to protect the confidentiality and integrity of remote access sessions (e.g., VPN).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational cryptographic capability exists to protect the confidentiality and integrity of remote access sessions (e.g., VPN).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-14.2", "family": "Network Security", "enhancements": "", "sortId": "NET-14.2", "references": "

Micro-Small Business (<10 staff)

∙ Use VPN with encryption for remote access

Small Business (10-49 staff)

∙ Encrypted VPN (TLS/IPSec) for all remote access

Medium Business (50-249 staff)

∙ Encrypted remote access standard\n∙ TLS/IPSec VPN\n∙ Certificate-based authentication

Large Business (250-999 staff)

∙ Enterprise encrypted VPN with certificate-based auth\n∙ FIPS-compliant encryption

Enterprise (>1,000 staff)

∙ Enterprise encrypted ZTNA/VPN platform\n∙ FIPS 140-2/140-3 compliant encryption\n∙ End-to-end encryption enforcement", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72932, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590872", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590872", "securityControlId": 31721, "ccis": [], "uuid": "c6c23265-1d9b-57a7-8211-dcf5d1d5919d", "testId": "NET-14.3_A01", "test": "managed access control points are identified and implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.14[a]", "defaultText": null }, { "id": 72933, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590872", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590872", "securityControlId": 31721, "ccis": [], "uuid": "4b5d3873-6490-50dd-93a8-bf0c9aeb192a", "testId": "NET-14.3_A02", "test": "remote access is routed through managed network access control points.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.14[b]\n53A_R5_AC-17(03)", "defaultText": null } ], "externalMappings": [ { "id": 589080, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a167dc2-d77b-535e-9e9a-062d7eb7278b", "parentControlId": 31721, "controlId": "AC-17(3)", "title": "AC-17(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58766" }, { "id": 589081, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52fb67f6-334b-5efe-a75a-30e768fc9e26", "parentControlId": 31721, "controlId": "AC-17(03)", "title": "AC-17(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58766" }, { "id": 589082, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b871aadb-13ec-518b-923f-6e8310ab47ab", "parentControlId": 31721, "controlId": "AC-17(03)", "title": "AC-17(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58766" }, { "id": 589083, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e3719df-857b-58d8-9b76-fe66081b44f4", "parentControlId": 31721, "controlId": "AC-17(03)", "title": "AC-17(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58766" }, { "id": 589084, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1761291-1bc9-5a84-9aa4-bfb53708c156", "parentControlId": 31721, "controlId": "AC-17(03)", "title": "AC-17(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58766" }, { "id": 589085, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c7861fb-d5e5-5b61-9641-085894985608", "parentControlId": 31721, "controlId": "AC-17(03)", "title": "AC-17(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58766" }, { "id": 589086, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d22fb7a-3aa7-58a4-adda-b5d3980e72da", "parentControlId": 31721, "controlId": "3.1.14", "title": "3.1.14", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58766" }, { "id": 589087, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ba6db63-fb23-5ceb-a8b4-8b14fbf722c6", "parentControlId": 31721, "controlId": "03.01.12.b", "title": "03.01.12.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58766" }, { "id": 589088, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587661", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48b8d14c-a700-51e2-8c43-a869a4cc563a", "parentControlId": 31721, "controlId": "03.01.12.c", "title": "03.01.12.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587661" } ], "id": 31721, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731216", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731216", "catalogueId": 1062, "uuid": "52f3cfff-04f8-54ec-9a7b-682d62ac9d1e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization route all remote accesses through managed network access control points (e.g., VPN concentrator)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Managed Access Control Points", "description": "

Control Description

Mechanisms exist to route all remote accesses through managed network access control points (e.g., VPN concentrator).

Evidence Request List (ERL)

E-NET-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to route all remote accesses through managed network access control points (e.g., VPN concentrator).

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-14.3", "family": "Network Security", "enhancements": "", "sortId": "NET-14.3", "references": "

Micro-Small Business (<10 staff)

∙ Use a single, monitored VPN gateway for remote access

Small Business (10-49 staff)

∙ Consolidated remote access through managed gateway\n∙ Access point documentation

Medium Business (50-249 staff)

∙ Formal managed access control point policy\n∙ Centralized remote access gateway

Large Business (250-999 staff)

∙ Enterprise centralized remote access with monitoring\n∙ Access control enforcement at gateway

Enterprise (>1,000 staff)

∙ Enterprise centralized remote access platform (ZTNA/VPN)\n∙ All remote access through managed control points\n∙ SIEM monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72934, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590872", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590872", "securityControlId": 31722, "ccis": [], "uuid": "9c760b9b-8ecc-57c3-b311-ed49c9b65b3e", "testId": "NET-14.4_A01", "test": "privileged commands authorized for remote execution are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.15[a]\n53A_R5_AC-17(04)_ODP[01]", "defaultText": null }, { "id": 72935, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590872", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590872", "securityControlId": 31722, "ccis": [], "uuid": "092565c4-ace0-561f-9beb-017eb2f38d12", "testId": "NET-14.4_A02", "test": "security-relevant information authorized to be accessed remotely is identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.15[b]\n53A_R5_AC-17(04)_ODP[02]", "defaultText": null }, { "id": 72936, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590872", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590872", "securityControlId": 31722, "ccis": [], "uuid": "8c6ec22a-55d5-50bb-b617-771f7b0c5515", "testId": "NET-14.4_A03", "test": "the execution of the identified privileged commands via remote access is authorized.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.15[c]\n53A_R5_AC-17(04)(a)[01]", "defaultText": null }, { "id": 72937, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590873", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590873", "securityControlId": 31722, "ccis": [], "uuid": "7a707b81-255d-50a1-bc1a-b9cc3e5301c3", "testId": "NET-14.4_A04", "test": "access to the identified security-relevant information via remote access is authorized.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.1.15[d]\n53A_R5_AC-17(04)(a)[02]\n53A_R5_AC-17(04)(a)[04]", "defaultText": null }, { "id": 72938, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590873", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590873", "securityControlId": 31722, "ccis": [], "uuid": "084b6d1c-4c4d-5133-8151-deab49c73bcf", "testId": "NET-14.4_A05", "test": "the rationale for remote access is documented in the security plan for the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-17(04)(b)", "defaultText": null }, { "id": 72939, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590873", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590873", "securityControlId": 31722, "ccis": [], "uuid": "2c8aef84-d86f-526e-ad32-44e9602fe07e", "testId": "NET-14.4_A06", "test": "remote execution of privileged commands is authorized.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.12.d[1]", "defaultText": null }, { "id": 72940, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590873", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590873", "securityControlId": 31722, "ccis": [], "uuid": "4d46aa19-79d4-5ad6-a1d4-0c66f61abb2d", "testId": "NET-14.4_A07", "test": "remote access to security-relevant information is authorized.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.12.d[2]", "defaultText": null } ], "externalMappings": [ { "id": 589111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587663", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4cf4f302-cad8-568b-924d-e099f294c3ef", "parentControlId": 31722, "controlId": "AC-17(4)", "title": "AC-17(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587663" }, { "id": 589112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587664", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe15dc40-657d-5f2c-9b15-fa77dd2c71f8", "parentControlId": 31722, "controlId": "AC-17(04)", "title": "AC-17(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587664" }, { "id": 589113, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587664", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f06241b7-7817-51d2-9902-54ea125ae95b", "parentControlId": 31722, "controlId": "AC-17(04)", "title": "AC-17(04)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587664" }, { "id": 589114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587664", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfb2f616-b88b-590b-94c6-64286e9525c8", "parentControlId": 31722, "controlId": "AC-17(04)", "title": "AC-17(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587664" }, { "id": 589115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587664", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e21c09ab-1f2b-5a65-ae44-040d4056b2ac", "parentControlId": 31722, "controlId": "AC-17(04)", "title": "AC-17(04)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587664" }, { "id": 589116, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587664", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f3f5b3b-5ba9-5e52-937e-d4d327fced34", "parentControlId": 31722, "controlId": "AC-17(04)", "title": "AC-17(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587664" }, { "id": 589117, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587664", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9229904-e83c-5727-a101-c286c9be1842", "parentControlId": 31722, "controlId": "3.1.15", "title": "3.1.15", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587664" }, { "id": 589118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587664", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b367027-a08b-503a-9409-bc86981d5a06", "parentControlId": 31722, "controlId": "03.01.12.d", "title": "03.01.12.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587664" } ], "id": 31722, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731216", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731216", "catalogueId": 1062, "uuid": "bb10dd43-c3b3-5548-963e-f61566b950d8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict the execution of privileged commands and access to security-relevant information via remote access only for compelling operational needs?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Remote Privileged Commands & Sensitive Data Access", "description": "

Control Description

Mechanisms exist to restrict the execution of privileged commands and access to security-relevant information via remote access only for compelling operational needs.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ Network communications containing sensitive/regulated data use a cryptographic mechanism to prevent the unauthorized disclosure of information while in transit (e.g., SSH, TLS, VPN, etc.).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to restrict the execution of privileged commands and access to security-relevant information via remote access only for compelling operational needs.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-14.4", "family": "Network Security", "enhancements": "", "sortId": "NET-14.4", "references": "

Micro-Small Business (<10 staff)

∙ Require MFA and VPN for privileged remote access

Small Business (10-49 staff)

∙ Policy restricting privileged remote commands to authenticated sessions

Medium Business (50-249 staff)

∙ Formal privileged remote access policy\n∙ Encrypted and authenticated remote privileged sessions

Large Business (250-999 staff)

∙ PAM solution for privileged remote access\n∙ Session recording for privileged commands

Enterprise (>1,000 staff)

∙ Enterprise PAM with privileged remote access control (e.g., CyberArk)\n∙ Session recording\n∙ Just-in-time privileged access", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72941, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590873", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590873", "securityControlId": 31723, "ccis": [], "uuid": "65b4274e-134f-5ece-8b9c-471838ff685e", "testId": "NET-14.5_A01", "test": "secure telecommuting practices are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72942, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590873", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590873", "securityControlId": 31723, "ccis": [], "uuid": "e75b8b2c-d1e8-5c52-be61-9a7b2a543cd0", "testId": "NET-14.5_A02", "test": "technical measures govern remote access to systems and data for remote workers.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72943, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590874", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590874", "securityControlId": 31723, "ccis": [], "uuid": "b0b07d84-c3b5-5b5e-b8d5-418a9491d1d1", "testId": "NET-14.5_A03", "test": "administrative measures govern rules of behavior for telecommuting practices.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 72944, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590874", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590874", "securityControlId": 31723, "ccis": [], "uuid": "e6a673ac-48fe-5e08-a092-cdd0f24cf25f", "testId": "NET-14.5_A04", "test": "security requirements to be employed at alternate work sites are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.10.06.ODP[01]", "defaultText": null }, { "id": 72945, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590874", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590874", "securityControlId": 31723, "ccis": [], "uuid": "4b0171d0-87da-5ab2-81a0-c5a0068f4e75", "testId": "NET-14.5_A05", "test": "alternate work sites allowed for use by employees are determined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.10.06.a", "defaultText": null }, { "id": 72946, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590874", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590874", "securityControlId": 31723, "ccis": [], "uuid": "4a9373f5-a5d8-55e2-a3c4-399f89082b67", "testId": "NET-14.5_A06", "test": "the following security requirements are employed at alternate work sites: .
PPTDF Applicability: Facility
Assessment Rigor: NIST 800-171
SCF Defined Parameters: adequate security, comparable to organizational security requirements at the primary work site where practical, documented in policy, and covered by training", "otherId": "171A_R3_A.03.10.06.b", "defaultText": null } ], "externalMappings": [ { "id": 589147, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587668", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9efbeeb-59f5-570b-b0c2-18ba8132651d", "parentControlId": 31723, "controlId": "6.7", "title": "6.7", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587668" }, { "id": 589148, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587668", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "085b42ac-9d57-5ed6-83bb-d3e2bf46c753", "parentControlId": 31723, "controlId": "7.9", "title": "7.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587668" }, { "id": 589155, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587669", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fc872af-a438-5938-ad00-3239c6349471", "parentControlId": 31723, "controlId": "3.1.12", "title": "3.1.12", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587669" }, { "id": 589156, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587669", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50f22469-dd94-5091-a046-c0597db1a91d", "parentControlId": 31723, "controlId": "3.10.6", "title": "3.10.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587669" }, { "id": 589157, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587669", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe8bdf0f-1e4e-5847-ab17-ea6cb3ecdd6d", "parentControlId": 31723, "controlId": "03.01.12.a", "title": "03.01.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587669" }, { "id": 589158, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587669", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c409d87f-d4d8-56ce-a677-7065f4dbad50", "parentControlId": 31723, "controlId": "03.01.12.c", "title": "03.01.12.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587669" }, { "id": 589159, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587669", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a5c6021-a5cb-5458-ae6a-b23307bed2e1", "parentControlId": 31723, "controlId": "03.10.06.a", "title": "03.10.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587669" }, { "id": 589160, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587669", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2b740cd-7cb4-5241-9e16-c15b72d52d89", "parentControlId": 31723, "controlId": "03.10.06.b", "title": "03.10.06.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587669" } ], "id": 31723, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731216", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731216", "catalogueId": 1062, "uuid": "619e26a6-1d40-599e-97ca-898006f8a6c8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define secure telecommuting practices and govern remote access to Technology Assets, Applications, Services and/or Data (TAASD) for remote workers?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Work From Anywhere (WFA) - Telecommuting Security", "description": "

Control Description

Mechanisms exist to define secure telecommuting practices and govern remote access to Technology Assets, Applications, Services and/or Data (TAASD) for remote workers.

Evidence Request List (ERL)

E-NET-03\nE-IAM-14

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to define secure telecommuting practices and govern remote access to TAASD for remote workers.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-14.5", "family": "Network Security", "enhancements": "", "sortId": "NET-14.5", "references": "

Micro-Small Business (<10 staff)

∙ Remote work security policy\n∙ VPN requirement for home workers

Small Business (10-49 staff)

∙ Work-from-anywhere security policy\n∙ VPN + MFA for remote workers\n∙ Acceptable use policy

Medium Business (50-249 staff)

∙ Formal WFA security program\n∙ VPN/ZTNA + MFA\n∙ Endpoint security for remote devices

Large Business (250-999 staff)

∙ Enterprise WFA security program\n∙ ZTNA/SASE solution\n∙ Remote endpoint management (MDM/UEM)

Enterprise (>1,000 staff)

∙ Enterprise WFA security framework\n∙ SASE platform (e.g., Zscaler, Netskope)\n∙ UEM for remote endpoints\n∙ Security awareness training for remote work", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72947, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590874", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590874", "securityControlId": 31724, "ccis": [], "uuid": "29c33357-ea84-52ef-ba5d-69b6dcc965a9", "testId": "NET-14.6_A01", "test": "proactively control and monitor third-party accounts used to access, support or maintain system components via remote access.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 589224, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3aa036e2-405d-5122-ad16-4a66752d7099", "parentControlId": 31724, "controlId": "CIP-005-7 2.4", "title": "CIP-005-7 2.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587677" }, { "id": 589225, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f21020e7-ece0-54fb-aea9-37fc1c059a51", "parentControlId": 31724, "controlId": "CIP-005-7 2.5", "title": "CIP-005-7 2.5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587677" }, { "id": 589226, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cee48ac9-efcf-5fad-b9d3-f943fed867df", "parentControlId": 31724, "controlId": "CIP-005-7 3.1", "title": "CIP-005-7 3.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587677" }, { "id": 589227, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6960e07-2ce3-5fbf-871b-c36173d6b617", "parentControlId": 31724, "controlId": "CIP-005-7 3.2", "title": "CIP-005-7 3.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587677" } ], "id": 31724, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731217", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731217", "catalogueId": 1062, "uuid": "bcc7dd98-acf5-5222-b807-bf2b4e98ab12", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization proactively control and monitor third-party accounts used to access, support, or maintain system components via remote access?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 8.0, "title": "Third-Party Remote Access Governance", "description": "

Control Description

Mechanisms exist to proactively control and monitor third-party accounts used to access, support, or maintain system components via remote access.

Evidence Request List (ERL)

E-IAM-14

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to proactively control and monitor third-party accounts used to access, support, or maintain system components via remote access.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-14.6", "family": "Network Security", "enhancements": "", "sortId": "NET-14.6", "references": "

Micro-Small Business (<10 staff)

∙ Document and approve all third-party remote access

Small Business (10-49 staff)

∙ Third-party remote access policy\n∙ Require justification and time limits

Medium Business (50-249 staff)

∙ Formal third-party remote access governance policy\n∙ Session monitoring requirements

Large Business (250-999 staff)

∙ Enterprise third-party remote access governance\n∙ PAM-managed third-party sessions\n∙ Session recording

Enterprise (>1,000 staff)

∙ Enterprise third-party remote access platform (e.g., BeyondTrust, CyberArk)\n∙ Just-in-time access\n∙ Session recording and monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72948, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590875", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590875", "securityControlId": 31725, "ccis": [], "uuid": "98f28388-b410-5e61-8443-7ab70394249b", "testId": "NET-14.7_A01", "test": "cybersecurity / data privacy compliance checks are performed on constituent system components prior to the establishment of the internal connection.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CA-09(01)[01]\n53A_R5_CA-09(01)[02]", "defaultText": null } ], "externalMappings": [ { "id": 589233, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9700e68-3330-5f74-aa16-5ecc5954415b", "parentControlId": 31725, "controlId": "CA-09(01)", "title": "CA-09(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587678" }, { "id": 589234, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0dd726ce-1213-51aa-8ee4-bdaf176298f2", "parentControlId": 31725, "controlId": "CA-09(01)", "title": "CA-09(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587678" } ], "id": 31725, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731217", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731217", "catalogueId": 1062, "uuid": "a2fe838a-5843-5db7-878d-ac7720aa4f29", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization validate the security posture of the endpoint devices (e.g., software versions, patch levels, etc.) prior to allowing devices to connect to organizational Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 6.0, "title": "Endpoint Security Validation", "description": "

Control Description

Automated mechanisms exist to validate the security posture of the endpoint devices (e.g., software versions, patch levels, etc.) prior to allowing devices to connect to organizational Technology Assets, Applications and/or Services (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to automatically validate the security posture of the endpoint devices (e.g., software versions, patch levels, etc.) prior to allowing devices to connect to organizational Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-14.7", "family": "Network Security", "enhancements": "", "sortId": "NET-14.7", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Small Business (10-49 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Medium Business (50-249 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Large Business (250-999 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)

Enterprise (>1,000 staff)

∙ Microsoft Entra (https://microsoft.com)\n∙ AWS IAM (https://aws.amazon.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72949, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590875", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590875", "securityControlId": 31726, "ccis": [], "uuid": "3b080a9d-2e60-5e08-b8cf-8c915d3ed0ca", "testId": "NET-14.8_A01", "test": "the time period within which to disconnect or disable remote access to the system is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-17(09)_ODP", "defaultText": null }, { "id": 72950, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590875", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590875", "securityControlId": 31726, "ccis": [], "uuid": "d7db6955-e630-5fa8-848f-3d52a698792f", "testId": "NET-14.8_A02", "test": "the capability to disconnect or disable remote access to the system within an organization-defined time period is provided.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-17(09)", "defaultText": null } ], "externalMappings": [ { "id": 589253, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44c5a488-a2ab-5497-ae8e-2cc0d67ecbaf", "parentControlId": 31726, "controlId": "AC-17(9)", "title": "AC-17(9)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58768" }, { "id": 589254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55730707-edf1-5324-9b5a-94c88740846c", "parentControlId": 31726, "controlId": "AC-17(09)", "title": "AC-17(09)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58768" }, { "id": 589255, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a681c661-d564-50e8-aa41-818090d02829", "parentControlId": 31726, "controlId": "AC-17(09)", "title": "AC-17(09)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58768" }, { "id": 589256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d097bcfa-7bd0-56e4-992c-b9d222b751cd", "parentControlId": 31726, "controlId": "AC-17(09)", "title": "AC-17(09)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58768" }, { "id": 589257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587681", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c34e2b76-4c2e-5cbd-a530-7f5796562b49", "parentControlId": 31726, "controlId": "AC-17(09)", "title": "AC-17(09)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587681" }, { "id": 589258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587681", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c91995ea-1727-52fa-9ac0-57c2bb035942", "parentControlId": 31726, "controlId": "AC-17(09)", "title": "AC-17(09)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587681" }, { "id": 589260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587681", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5953149d-9b17-57e2-a967-1eeb0e63669d", "parentControlId": 31726, "controlId": "CIP-005-7 2.5", "title": "CIP-005-7 2.5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587681" }, { "id": 589261, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587681", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db32c655-ac3a-55f1-855f-807fb71df5f2", "parentControlId": 31726, "controlId": "CIP-005-7 3.2", "title": "CIP-005-7 3.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587681" } ], "id": 31726, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731217", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731217", "catalogueId": 1062, "uuid": "e3538a4b-178a-5eb7-a4fe-e1a27722b627", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide the capability to expeditiously disconnect or disable a user's remote access session?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Expeditious Disconnect / Disable Capability", "description": "

Control Description

Mechanisms exist to provide the capability to expeditiously disconnect or disable a user's remote access session.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ IT and/or cybersecurity personnel provide the capability to expeditiously disconnect or disable a user's remote access session.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to provide the capability to expeditiously disconnect or disable a user's remote access session.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "NET-14.8", "family": "Network Security", "enhancements": "", "sortId": "NET-14.8", "references": "

Micro-Small Business (<10 staff)

∙ Document how to disconnect remote sessions immediately when needed

Small Business (10-49 staff)

∙ Remote session termination procedure\n∙ Ability to immediately revoke VPN access

Medium Business (50-249 staff)

∙ Formal remote session termination policy and capability\n∙ Documented procedure for emergency disconnect

Large Business (250-999 staff)

∙ Enterprise remote access platform with immediate termination capability\n∙ Automated session revocation procedures

Enterprise (>1,000 staff)

∙ Enterprise remote access platform with automated disconnect capability (SOAR integration)\n∙ Zero-trust session termination", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72951, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590875", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590875", "securityControlId": 31727, "ccis": [], "uuid": "bd12c85f-eaea-5ea7-a41a-925ffbfdf61b", "testId": "NET-15_A01", "test": "usage restrictions are established for each type of wireless access to the system.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.01.16.a[02]", "defaultText": null }, { "id": 72952, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590876", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590876", "securityControlId": 31727, "ccis": [], "uuid": "02d30e0b-6067-5a76-98df-cd839ae43ab8", "testId": "NET-15_A02", "test": "connection requirements are established for each type of wireless access to the system.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_R3_A.03.01.16.a[04]\n53A_R5_AC-18a.[01]\n53A_R5_AC-18a.[02]\n53A_R5_AC-18a.[03]", "defaultText": null }, { "id": 72953, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590876", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590876", "securityControlId": 31727, "ccis": [], "uuid": "734fea19-a1d0-5e91-afe3-7d258d1745c4", "testId": "NET-15_A03", "test": "wireless access points are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.1.16[a]", "defaultText": null }, { "id": 72954, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590876", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590876", "securityControlId": 31727, "ccis": [], "uuid": "81d142e6-493c-58fa-90c9-f6e010c2d04b", "testId": "NET-15_A04", "test": "wireless access is authorized prior to allowing such connections.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.1.16[b]\n53A_R5_AC-18b.", "defaultText": null }, { "id": 72955, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590876", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590876", "securityControlId": 31727, "ccis": [], "uuid": "3254c75a-7712-564e-8a27-82ada56205d2", "testId": "NET-15_A05", "test": "each type of wireless access to the system is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.01.16.a[01]", "defaultText": null } ], "externalMappings": [ { "id": 589269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587682", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8acfae4-5971-53c0-baec-8522b618bd3c", "parentControlId": 31727, "controlId": "NET 2.1", "title": "NET 2.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587682" }, { "id": 589270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587682", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84ba3a57-ddd4-57a9-9562-b7c716b21b4c", "parentControlId": 31727, "controlId": "SR 1.6 RE 1", "title": "SR 1.6 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587682" }, { "id": 589271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587682", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec55f595-191a-5ecb-81a2-4fa4cc5e66f1", "parentControlId": 31727, "controlId": "SR 2.2", "title": "SR 2.2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587682" }, { "id": 589272, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587682", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10fed2e1-421b-5884-864a-5d6131e2ed91", "parentControlId": 31727, "controlId": "NDR 1.6", "title": "NDR 1.6", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587682" }, { "id": 589273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587682", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be09146f-14c4-5b5e-aef5-77f9e61dcd58", "parentControlId": 31727, "controlId": "8.21", "title": "8.21", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587682" }, { "id": 589276, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ed2507a-8cb9-547a-a810-962aca0e2234", "parentControlId": 31727, "controlId": "T1011", "title": "T1011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587683" }, { "id": 589277, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c87f5533-7b55-54c0-9115-49382a115da5", "parentControlId": 31727, "controlId": "T1011.001", "title": "T1011.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587683" }, { "id": 589278, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77bf8f7f-1c01-5498-bef0-9e9d89d765e7", "parentControlId": 31727, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587683" }, { "id": 589279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29361008-1f16-5d56-a617-0a271504a478", "parentControlId": 31727, "controlId": "T1040", "title": "T1040", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587683" }, { "id": 589280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96642759-550b-5c6d-901e-f7cb9fd657bb", "parentControlId": 31727, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587683" }, { "id": 589281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22783019-7a75-5ea2-9b80-4d0ab7541946", "parentControlId": 31727, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587683" }, { "id": 589282, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43ce7060-4268-5fd3-87f9-bda4d69044ad", "parentControlId": 31727, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587683" }, { "id": 589283, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "597fe7a6-d1e1-598a-86f6-938e5777040d", "parentControlId": 31727, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587684" }, { "id": 589284, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "065dc489-b805-5786-bd33-f0f9710d0c27", "parentControlId": 31727, "controlId": "T1119", "title": "T1119", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587684" }, { "id": 589285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a71bd275-6051-5522-9cf3-368700f0be40", "parentControlId": 31727, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587684" }, { "id": 589286, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e5e99b3-40b4-5e14-b112-98636536a189", "parentControlId": 31727, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587684" }, { "id": 589287, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "553735eb-47ff-5a90-994f-f35c86662dc5", "parentControlId": 31727, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587684" }, { "id": 589288, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "623afe07-9ee6-5f20-89e3-84e67e914013", "parentControlId": 31727, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587684" }, { "id": 589289, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18e41bbb-1b1f-5882-bd0c-af17cf48a372", "parentControlId": 31727, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587684" }, { "id": 589290, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f837d388-6c2b-5a03-9609-269f7d92e10a", "parentControlId": 31727, "controlId": "T1557.004", "title": "T1557.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587684" }, { "id": 589291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b162fd61-260c-5e32-9335-b46f022ad067", "parentControlId": 31727, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587684" }, { "id": 589292, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5edb8822-a5ab-5039-bfe9-bb98e589c543", "parentControlId": 31727, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587685" }, { "id": 589293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ada6f2ba-b461-5e0a-b2ff-f961afe4c121", "parentControlId": 31727, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587685" }, { "id": 589294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a5272ed-73ab-5714-b5c3-66aab8ef049b", "parentControlId": 31727, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587685" }, { "id": 589295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "653d525a-e972-511b-b237-d00c9b59fcfe", "parentControlId": 31727, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587685" }, { "id": 589296, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "849d8d57-ab5b-5015-8c70-6709b94eada6", "parentControlId": 31727, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587685" }, { "id": 589297, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e8c38cb-c55d-533e-b8d6-5e9049db5494", "parentControlId": 31727, "controlId": "T1565.002", "title": "T1565.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587685" }, { "id": 589298, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f13908b-35b3-5cd7-a0d8-6382e7b50b85", "parentControlId": 31727, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587685" }, { "id": 589299, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c8949f7-cbef-56b8-b2ff-b0e25d58198e", "parentControlId": 31727, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587685" }, { "id": 589300, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da829b47-5487-5f95-8f5a-1197e7ae3f3b", "parentControlId": 31727, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587685" }, { "id": 589302, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74c6c8b5-c03e-5547-85cb-5d8b7a706b97", "parentControlId": 31727, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587686" }, { "id": 589303, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5bfa856b-80bc-5a4f-b513-0d516ad259af", "parentControlId": 31727, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587686" }, { "id": 589305, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d38f47fd-7f82-5c10-93e2-7cf53dd88db4", "parentControlId": 31727, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587686" }, { "id": 589306, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a31349b6-7e34-572f-b02c-68ce299cf1f0", "parentControlId": 31727, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587686" }, { "id": 589307, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e37a1f5-e670-5d6d-bb3f-95bfb070c2cb", "parentControlId": 31727, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587686" }, { "id": 589308, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7dd11b98-05fa-55b2-bf37-b30f951968bd", "parentControlId": 31727, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587686" }, { "id": 589309, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0bead4a1-cf97-5e2d-8abd-0cc38ff5e1d5", "parentControlId": 31727, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587686" }, { "id": 589310, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee2a5369-718d-51f7-bcfa-5fa06f09ff45", "parentControlId": 31727, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587686" }, { "id": 589311, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa64d065-84b5-5921-bc01-a73fc9224ded", "parentControlId": 31727, "controlId": "AC-18", "title": "AC-18", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587687" }, { "id": 589315, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d37f277-a94d-5890-9ba1-c6c12ea1c975", "parentControlId": 31727, "controlId": "3.1.16", "title": "3.1.16", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587687" }, { "id": 589316, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae976e09-027f-5501-ac6a-1e17cb006293", "parentControlId": 31727, "controlId": "03.01.16.a", "title": "03.01.16.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587687" }, { "id": 589317, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0cda5ea-9d68-59bf-adf3-7e1607cacb90", "parentControlId": 31727, "controlId": "03.01.16.b", "title": "03.01.16.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587688" }, { "controlId": "B.1.17", "title": "B.1.17 — Wireless Access Restrictions", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-18", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "2b9c7a7b-53bc-56de-a77c-3772dd0abf04", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.17", "title": "NEI 08-09 App D.1.17 — Wireless Access Restrictions", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.17", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6947ceb2-f8d7-5370-9bd5-5955c745946e", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.17", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "07a3e00c-d33a-53fe-8f88-4572aeb2c8d7", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "4a935d86-c356-5752-916b-973795ff5086", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "5da6823c-d1fd-5e24-bb5e-c18e65c87d89", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "18fb2cca-22c2-5503-bd31-99210b355697", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "74ced697-8faa-581c-b612-5fa1c3b45d33", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "7f0453d1-4bcc-58b5-91e7-4ccac5f1bef4", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "892450d0-3aa0-5a31-ba74-99c24ab959e7", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "6eab9de6-64c2-55bd-aba4-02f17ea4d23f", "isPublic": true } ], "id": 31727, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731218", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731218", "catalogueId": 1062, "uuid": "4a22dd77-a981-505c-8e78-23f157133c20", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization control authorized wireless usage and monitor for unauthorized wireless access?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Wireless Networking", "description": "

Control Description

Mechanisms exist to control authorized wireless usage and monitor for unauthorized wireless access.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ Wireless access is protected via secure authentication and encryption.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to control authorized wireless usage and monitor for unauthorized wireless access.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.17", "controlId": "NET-15", "family": "Network Security", "enhancements": "", "sortId": "NET-15", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72956, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590877", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590877", "securityControlId": 31728, "ccis": [], "uuid": "6a84f0df-c609-5d10-bc74-ad516207ae48", "testId": "NET-15.1_A01", "test": "wireless access to the system is protected using authentication.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.17[a]\n171A_R3_A.03.01.16.d[01]\n53A_R5_AC-18(01)_ODP\n53A_R5_AC-18(01)[01]", "defaultText": null }, { "id": 72957, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590877", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590877", "securityControlId": 31728, "ccis": [], "uuid": "aa7f1963-e0a4-529d-a093-758c7ce87339", "testId": "NET-15.1_A02", "test": "wireless access to the system is protected using encryption.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.1.17[b]\n171A_R3_A.03.01.16.d[02]\n53A_R5_AC-18(01)[02]", "defaultText": null }, { "id": 72958, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590877", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590877", "securityControlId": 31728, "ccis": [], "uuid": "a6d65ac8-92d2-554e-89e8-f20fc2adb415", "testId": "NET-15.1_A03", "test": "information is/are maintained during preparation for transmission.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-08(02)[01]\n53A_R5_SC-08(02)_ODP", "defaultText": null }, { "id": 72959, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590877", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590877", "securityControlId": 31728, "ccis": [], "uuid": "5807dd62-2eb0-5ee2-9721-ac78c7dee49d", "testId": "NET-15.1_A04", "test": "information is/are maintained during reception.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-08(02)[02]\n53A_R5_SC-08(02)_ODP", "defaultText": null } ], "externalMappings": [ { "id": 589402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587706", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "681aeaf5-45a0-55fd-a1fb-06e3f469a86d", "parentControlId": 31728, "controlId": "NDR 1.6(1)", "title": "NDR 1.6(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587706" }, { "id": 589403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ff6067d-cfc1-56a3-870c-078d44d1a8cb", "parentControlId": 31728, "controlId": "AC-18(1)", "title": "AC-18(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587707" }, { "id": 589404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a55fea04-6116-5739-8180-ebfa9d344bb1", "parentControlId": 31728, "controlId": "AC-18(01)", "title": "AC-18(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587707" }, { "id": 589405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "180a1722-170d-5a6d-b2ae-7d385963dd36", "parentControlId": 31728, "controlId": "AC-18(01)", "title": "AC-18(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587707" }, { "id": 589406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4471159b-02cb-5854-9d4b-d3bbdad8acfc", "parentControlId": 31728, "controlId": "AC-18(01)", "title": "AC-18(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587707" }, { "id": 589407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cebc6739-0a51-5a2f-b1e4-aa9390b7234f", "parentControlId": 31728, "controlId": "AC-18(01)", "title": "AC-18(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587707" }, { "id": 589408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c07cbb7-a83e-5962-af76-12e4d3be587b", "parentControlId": 31728, "controlId": "AC-18(01)", "title": "AC-18(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587707" }, { "id": 589409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c79c8655-594a-50ca-b17d-bc568b68fd9e", "parentControlId": 31728, "controlId": "3.1.17", "title": "3.1.17", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587707" }, { "id": 589410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fa578b0-3e23-591c-84c0-1ad79a3e28f2", "parentControlId": 31728, "controlId": "03.01.16.a", "title": "03.01.16.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587707" }, { "id": 589411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bc43eba-750e-52f6-b575-caf53f9171b7", "parentControlId": 31728, "controlId": "03.01.16.b", "title": "03.01.16.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587707" }, { "id": 589412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587708", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "040a4a07-e8a0-5d65-8fea-bc0d17bd68db", "parentControlId": 31728, "controlId": "03.01.16.d", "title": "03.01.16.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587708" }, { "controlId": "B.1.17", "title": "B.1.17 — Wireless Access Restrictions", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-18", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ae5c9257-6465-594f-92e7-0edc42d3cb9c", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.17", "title": "NEI 08-09 App D.1.17 — Wireless Access Restrictions", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.17", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "48d7ba05-74bf-5913-9634-a3e0396eab1b", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.17", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "96b1dc8d-9eeb-5d52-ab96-b06be506620a", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "ed56b79c-7b0d-50ca-9462-b6b6d6761752", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "52cd428c-1139-54de-ad6d-2c5d86a0b177", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "08641de1-fd3e-5141-961b-688c3e777de8", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "7e07a895-b4b2-5fb8-9b31-e5200dc50d32", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "8d15227b-3e83-5a97-bb1f-6470b532236e", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "8d0e8fc7-70f0-53fd-8234-9fc09eeb5c0f", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "faf5d040-82df-57b0-954a-d668bb6fa2f4", "isPublic": true } ], "id": 31728, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731218", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731218", "catalogueId": 1062, "uuid": "08d8375c-de14-53f5-bd81-586df0ed5444", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization secure Wi-Fi (e.g., IEEE 802.11) and prevent unauthorized access by:\n (1) Authenticating devices trying to connect; and \n (2) Encrypting transmitted data?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Authentication & Encryption", "description": "

Control Description

Mechanisms exist to secure Wi-Fi (e.g., IEEE 802.11) and prevent unauthorized access by:\n(1) Authenticating devices trying to connect; and \n(2) Encrypting transmitted data.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Wireless access is protected via secure authentication and encryption.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to secure Wi-Fi (e.g., IEEE 802.11) and prevent unauthorized access by:\n(1) Authenticating devices trying to connect; and \n(2) Encrypting transmitted data.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.17", "controlId": "NET-15.1", "family": "Network Security", "enhancements": "", "sortId": "NET-15.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72960, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590877", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590877", "securityControlId": 31729, "ccis": [], "uuid": "be5bb595-2673-51fe-aaea-73d89ff67033", "testId": "NET-15.2_A01", "test": "when not intended for use, wireless networking capabilities embedded within system components are disabled prior to issuance and deployment.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-18(03)", "defaultText": null } ], "externalMappings": [ { "id": 589478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587715", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24391d63-f0d7-54e1-b794-bd5ce114a60e", "parentControlId": 31729, "controlId": "AC-18(3)", "title": "AC-18(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587715" }, { "id": 589479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587715", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "691e0d87-02ca-568c-bbc1-f9fb36142088", "parentControlId": 31729, "controlId": "AC-18(03)", "title": "AC-18(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587715" }, { "id": 589480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bd144b9-0570-56d6-bfd1-c4a529d5eddb", "parentControlId": 31729, "controlId": "AC-18(03)", "title": "AC-18(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587716" }, { "id": 589481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63d3c693-3a88-5de5-b2a8-b3c44bb599b1", "parentControlId": 31729, "controlId": "AC-18(03)", "title": "AC-18(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587716" }, { "id": 589482, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8d560df-a263-5fd1-9e58-3bdd4cefb69c", "parentControlId": 31729, "controlId": "AC-18(03)", "title": "AC-18(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587716" }, { "id": 589483, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5897a1e-a976-553a-870e-028b958cb6fa", "parentControlId": 31729, "controlId": "AC-18(03)", "title": "AC-18(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587716" }, { "id": 589484, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b7ac699-7874-5568-9820-87ae6b754371", "parentControlId": 31729, "controlId": "03.01.16.c", "title": "03.01.16.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587716" } ], "id": 31729, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731218", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731218", "catalogueId": 1062, "uuid": "021973d2-4d99-5e4e-97e0-3394e3ba26ef", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization disable unnecessary wireless networking capabilities that are internally embedded within system components prior to issuance to end users?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Disable Wireless Networking", "description": "

Control Description

Mechanisms exist to disable unnecessary wireless networking capabilities that are internally embedded within system components prior to issuance to end users.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to disable unnecessary wireless networking capabilities that are internally embedded within system components prior to issuance to end users.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-15.2", "family": "Network Security", "enhancements": "", "sortId": "NET-15.2", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72961, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590878", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590878", "securityControlId": 31730, "ccis": [], "uuid": "317cb8b1-e13f-5486-9c64-1b94c7278452", "testId": "NET-15.3_A01", "test": "users allowed to independently configure wireless networking capabilities are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-18(04)[01]", "defaultText": null }, { "id": 72962, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590879", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590879", "securityControlId": 31730, "ccis": [], "uuid": "544ade4d-d642-5998-8dfb-9705b21191f7", "testId": "NET-15.3_A02", "test": "users allowed to independently configure wireless networking capabilities are explicitly authorized.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-18(04)[02]", "defaultText": null }, { "id": 72963, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59088", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59088", "securityControlId": 31730, "ccis": [], "uuid": "c325c828-11f5-5797-8c88-6869bb6863fd", "testId": "NET-15.3_A03", "test": "radio antennas are selected to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-18(05)[01]", "defaultText": null } ], "externalMappings": [ { "id": 589497, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587717", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c0f4b52-09df-5ea3-9230-dab0b9adc3f1", "parentControlId": 31730, "controlId": "AC-18(4)", "title": "AC-18(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587717" }, { "id": 589498, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587718", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "538a3df4-41d3-5264-9f71-5d3599f35f5d", "parentControlId": 31730, "controlId": "AC-18(04)", "title": "AC-18(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587718" }, { "id": 589499, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587718", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e56040b-a504-5b66-a133-19dbf08906dd", "parentControlId": 31730, "controlId": "AC-18(04)", "title": "AC-18(04)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587718" }, { "id": 589500, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587718", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4915e5ed-3223-5cd1-b40e-a38c43e3481e", "parentControlId": 31730, "controlId": "AC-18(04)", "title": "AC-18(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587718" }, { "id": 589501, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587718", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ebc2562-66d8-5ba4-9143-af6c3f9f74a7", "parentControlId": 31730, "controlId": "AC-18(04)", "title": "AC-18(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587718" }, { "id": 589502, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587718", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14260e00-8418-5663-ad87-aee08bbc6f0b", "parentControlId": 31730, "controlId": "03.01.16.a", "title": "03.01.16.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587718" }, { "id": 589503, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587718", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "816661ed-687b-5c5d-9ae0-5f01549da0a2", "parentControlId": 31730, "controlId": "03.01.16.c", "title": "03.01.16.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587718" } ], "id": 31730, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731219", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731219", "catalogueId": 1062, "uuid": "6e328034-af66-509c-a00f-d772cf05186c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify and explicitly authorize users who are allowed to independently configure wireless networking capabilities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Restrict Configuration By Users", "description": "

Control Description

Mechanisms exist to identify and explicitly authorize users who are allowed to independently configure wireless networking capabilities.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to identify and explicitly authorize users who are allowed to independently configure wireless networking capabilities.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-15.3", "family": "Network Security", "enhancements": "", "sortId": "NET-15.3", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72964, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59088", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59088", "securityControlId": 31731, "ccis": [], "uuid": "5e6513bc-4b20-57b4-94ef-034655f450c6", "testId": "NET-15.4_A01", "test": "transmission power levels are calibrated to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-18(05)[02]", "defaultText": null } ], "externalMappings": [ { "id": 589510, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587719", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d98cf4b-e1c4-5473-b225-5745de62ad8a", "parentControlId": 31731, "controlId": "AC-18(5)", "title": "AC-18(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587719" }, { "id": 589511, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587719", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65aeaff8-f0ff-5197-97bf-fca829632824", "parentControlId": 31731, "controlId": "AC-18(05)", "title": "AC-18(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587719" }, { "id": 589512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587719", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d567d91a-3c80-5713-9ca2-1ff5f2c50fde", "parentControlId": 31731, "controlId": "AC-18(05)", "title": "AC-18(05)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587719" }, { "id": 589513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587719", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77546b18-86e2-59b5-80d1-021d2e2c7bf7", "parentControlId": 31731, "controlId": "AC-18(05)", "title": "AC-18(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587719" }, { "id": 589514, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587719", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2d0d322-c04c-5824-8e0e-4ef1b8112013", "parentControlId": 31731, "controlId": "AC-18(05)", "title": "AC-18(05)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587719" } ], "id": 31731, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731219", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731219", "catalogueId": 1062, "uuid": "876c4e02-8c4c-590d-9c2f-22bb52b470e0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization confine wireless communications to organization-controlled boundaries?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Wireless Boundaries", "description": "

Control Description

Mechanisms exist to confine wireless communications to organization-controlled boundaries.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to confine wireless communications to organization-controlled boundaries.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-15.4", "family": "Network Security", "enhancements": "", "sortId": "NET-15.4", "references": "

Micro-Small Business (<10 staff)

∙ Configure Wi-Fi to minimize signal broadcast outside facility

Small Business (10-49 staff)

∙ Wireless signal containment policy\n∙ Antenna placement review

Medium Business (50-249 staff)

∙ Formal wireless boundary policy\n∙ RF signal containment measures\n∙ Wireless site survey

Large Business (250-999 staff)

∙ Enterprise wireless boundary management\n∙ RF planning\n∙ Directional antennas to limit signal leakage

Enterprise (>1,000 staff)

∙ Enterprise wireless management platform\n∙ RF signal monitoring\n∙ Directional antenna design\n∙ Wireless boundary testing", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72969, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590881", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590881", "securityControlId": 31734, "ccis": [], "uuid": "85f61187-c1a1-5cd0-8c16-0db8a0821707", "testId": "NET-17_A01", "test": "points where communications traffic is to be analyzed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(18)_ODP", "defaultText": null }, { "id": 72970, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590881", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590881", "securityControlId": 31734, "ccis": [], "uuid": "0acc338a-4fa9-5065-8f6d-52d69d73020b", "testId": "NET-17_A02", "test": "outbound communications traffic is analyzed at interfaces external to the system to detect covert exfiltration of information.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(18)[01]", "defaultText": null }, { "id": 72971, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590881", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590881", "securityControlId": 31734, "ccis": [], "uuid": "cfa89df5-3135-50ed-8f8e-f9d69cfe1ffb", "testId": "NET-17_A03", "test": "outbound communications traffic is analyzed at interfaces internal to the system to detect covert exfiltration of information.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(18)[02]", "defaultText": null } ], "externalMappings": [ { "id": 589539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587722", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e34c75be-d049-52ee-a4b9-d3932125c656", "parentControlId": 31734, "controlId": "SC-7(10)", "title": "SC-7(10)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587722" }, { "id": 589540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587722", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2be3d55d-5f8e-5abe-b491-6010bd4a3fea", "parentControlId": 31734, "controlId": "SC-07(10)", "title": "SC-07(10)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587722" }, { "id": 589541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587723", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7499dff6-3496-505b-8086-271de047ea99", "parentControlId": 31734, "controlId": "SI-04(18)", "title": "SI-04(18)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587723" }, { "id": 589544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587723", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b53429f-dd1f-5f21-999d-8cbb37a8fa02", "parentControlId": 31734, "controlId": "SC-07(10)", "title": "SC-07(10)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587723" }, { "id": 589545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587723", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8ace4e2-de75-5e00-bb26-dad2f5da5a59", "parentControlId": 31734, "controlId": "SI-04(18)", "title": "SI-04(18)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587723" }, { "id": 589555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587724", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5af15c19-36f9-5773-8d7c-233aba17a9f2", "parentControlId": 31734, "controlId": "ARCHITECTURE-5f", "title": "ARCHITECTURE-5f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587724" }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "5e7b09cd-7bf0-5153-972c-ec1dc0b922ac", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "18aaf7ac-7965-5a82-81b8-34501ddbf16a", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "cbcfadd4-f6cb-5c7e-9f5c-275700d7d531", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "6878073e-580e-5dd6-b7b1-d3e9a376345c", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "61daf982-8729-5feb-bc9d-697f95f55372", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "57b6dce2-da39-50a6-a758-320a1b911972", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "fc0a8af8-46bc-5979-89c2-8a6a5533d15b", "isPublic": true } ], "id": 31734, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73122", "catalogueId": 1062, "uuid": "a449bfed-bead-55bd-a926-a8ec2fe538cd", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to implement Data Loss Prevention (DLP) to protect sensitive information as it is stored, transmitted and processed?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 8.0, "title": "Data Loss Prevention (DLP)", "description": "

Control Description

Automated mechanisms exist to implement Data Loss Prevention (DLP) to protect sensitive information as it is stored, transmitted and processed.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ Data Loss Prevention (DLP), or similar technologies, prevent unauthorized devices from connecting to endpoint devices to control the distribution of sensitive/regulated data.\n▪ DLP prevents unauthorized devices from connecting to endpoint devices to control the distribution of sensitive/regulated data.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to automatically implement Data Loss Prevention (DLP) to protect sensitive information as it is stored, transmitted and processed.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "NET-17", "family": "Network Security", "enhancements": "", "sortId": "NET-17", "references": "

Micro-Small Business (<10 staff)

∙ Data Loss Prevention (DLP)

Small Business (10-49 staff)

∙ Data Loss Prevention (DLP)

Medium Business (50-249 staff)

∙ Data Loss Prevention (DLP)

Large Business (250-999 staff)

∙ Data Loss Prevention (DLP)

Enterprise (>1,000 staff)

∙ Data Loss Prevention (DLP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72972, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590882", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590882", "securityControlId": 31735, "ccis": [], "uuid": "69a8e23d-7cfc-53b8-8712-a0f7785b8e87", "testId": "NET-18_A01", "test": "Internet-bound network traffic is routed through a proxy device or service for URL content filtering and DNS filtering to limit a user's ability to connect to dangerous or prohibited Internet sites.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 589601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587729", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48403db9-c98f-5808-97a0-e0e18bad60eb", "parentControlId": 31735, "controlId": "5.14", "title": "5.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587729" }, { "id": 589602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587729", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd82a142-9dbd-5c8e-9197-a1ed247d4ad7", "parentControlId": 31735, "controlId": "8.23", "title": "8.23", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587729" }, { "id": 589608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8bbabff-7bd9-5938-85e6-87fdf4aaff6a", "parentControlId": 31735, "controlId": "SC-7(8)", "title": "SC-7(8)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58773" }, { "id": 589609, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b211d69a-bc18-584d-8bf7-dd3a03a9ffa6", "parentControlId": 31735, "controlId": "SC-18(3)", "title": "SC-18(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58773" }, { "id": 589610, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf4a4164-21f2-579d-a837-40132acdb1f6", "parentControlId": 31735, "controlId": "SC-07(08)", "title": "SC-07(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58773" }, { "id": 589611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf6322d2-51d0-5c7c-a31d-a661a1f1a72b", "parentControlId": 31735, "controlId": "SC-18(03)", "title": "SC-18(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58773" }, { "id": 589614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acba8061-566b-50c6-b50d-5220f390f1b3", "parentControlId": 31735, "controlId": "SC-07(08)", "title": "SC-07(08)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587731" }, { "id": 589615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c105eb0-e5ff-585e-9cf2-f204144413fd", "parentControlId": 31735, "controlId": "SC-07(08)", "title": "SC-07(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587731" }, { "id": 589616, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4962ee47-6545-55b7-aea2-7ccba6d88bc2", "parentControlId": 31735, "controlId": "SC-18(03)", "title": "SC-18(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587731" }, { "id": 589617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee4d4843-13f7-5a77-9769-17a62af3aafb", "parentControlId": 31735, "controlId": "SC-07(08)", "title": "SC-07(08)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587731" }, { "id": 589618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afb1940b-9275-5dd0-9994-f73d24fbb434", "parentControlId": 31735, "controlId": "SC-07(08)", "title": "SC-07(08)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587731" }, { "id": 589619, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b745731-4060-5bbf-aa7b-c2798f57f076", "parentControlId": 31735, "controlId": "3.1.3", "title": "3.1.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587731" }, { "id": 589620, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00ce2a99-02ca-560a-b8fe-410ada6ea15c", "parentControlId": 31735, "controlId": "03.14.06.c", "title": "03.14.06.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587731" }, { "id": 589621, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587732", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d204e92-fb2c-5f2f-94f1-31c80836f71d", "parentControlId": 31735, "controlId": "DE.CM-03", "title": "DE.CM-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587732" }, { "id": 589636, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587733", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbcd92ea-9dd8-5e15-9eea-cbd10ef1e745", "parentControlId": 31735, "controlId": "ARCHITECTURE-2g", "title": "ARCHITECTURE-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587733" }, { "id": 589637, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587733", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b11da004-a942-5acb-8ee7-3b14659e48f9", "parentControlId": 31735, "controlId": "ARCHITECTURE-5f", "title": "ARCHITECTURE-5f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587733" }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels (Levels 1-5)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b648a564-2d64-5ec1-8b0e-7b6bfe84983b", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Security Zones, Conduits, and Unidirectional Boundary Decoupling", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "92bb5b38-3f37-51c2-8177-321fe6c6cdb3", "isPublic": true }, { "controlId": "IEC-63096-13.1", "title": "IEC-63096-13.1 — Network Security Management & Deterministic Decoupling (Data Diodes)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "3e3d3589-f5a1-5fc9-9057-8fc7749d5034", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence and Communication Isolation Between Safety & Non-Safety Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "e73bcbfa-2e23-5fb6-a296-444397a6bd31", "isPublic": true }, { "controlId": "10-CFR-73.100(d)", "title": "10-CFR-73.100(d) — Defense-in-Depth & Autonomous/Remote Reactor Network Isolation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "1cf1297b-7435-575f-bf0a-8693dda70bfa", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec5", "title": "REGDOC-2.12.1-Sec5 — Defensive Architecture & Deterministic Zone Segregation", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "ea755507-af63-5dec-9516-c425411b0329", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-ARCH", "title": "ONR-SyAP-FSyP7-ARCH — Secure Architecture & Boundary Enforcement", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (NET Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "e0b00fa5-ab87-5212-b473-0d810515ceed", "isPublic": true } ], "id": 31735, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73122", "catalogueId": 1062, "uuid": "4c2c1842-d47c-5f0d-b3db-820c155d772e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization force Internet-bound network traffic through a proxy device (e.g., Policy Enforcement Point (PEP)) for URL content filtering and DNS filtering to limit a user's ability to connect to dangerous or prohibited Internet sites?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "DNS & Content Filtering", "description": "

Control Description

Mechanisms exist to force Internet-bound network traffic through a proxy device (e.g., Policy Enforcement Point (PEP)) for URL content filtering and DNS filtering to limit a user's ability to connect to dangerous or prohibited Internet sites.

Evidence Request List (ERL)

E-NET-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ SBC enforce Internet-bound network traffic routing through a proxy device for URL content filtering to limit a user's ability to connect to prohibited content.\n▪ Content filtering blocks users from performing ad hoc file transfers through unapproved file transfer services (e.g., Box, Dropbox, Google Drive, etc.).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to force Internet-bound network traffic through a proxy device (e.g., Policy Enforcement Point (PEP)) for URL content filtering and DNS filtering to limit a user's ability to connect to dangerous or prohibited Internet sites.

Level 4 - Quantitatively Controlled: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "NET-18", "family": "Network Security", "enhancements": "", "sortId": "NET-18", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72973, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590882", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590882", "securityControlId": 31736, "ccis": [], "uuid": "9ff3b270-802b-5ed4-b831-42f7c17959e7", "testId": "NET-18.1_A01", "test": "internal communications traffic to be routed to external networks is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(08)_ODP[01]", "defaultText": null }, { "id": 72974, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590882", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590882", "securityControlId": 31736, "ccis": [], "uuid": "acb5af9f-384c-5606-b7b5-97a9c824d0c4", "testId": "NET-18.1_A02", "test": "external networks to which internal communications traffic is to be routed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: any network outside of organizational control and any network outside the authorization boundary", "otherId": "53A_R5_SC-07(08)_ODP[02]", "defaultText": null }, { "id": 72975, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590883", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590883", "securityControlId": 31736, "ccis": [], "uuid": "7e8e9914-a3c3-502a-86bb-df1f6790e73d", "testId": "NET-18.1_A03", "test": "internal communications traffic is routed to external networks through authenticated proxy servers at managed interfaces.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(08)", "defaultText": null } ], "externalMappings": [ { "id": 589716, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58775", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98c17676-95bc-5964-843d-31ccb8134837", "parentControlId": 31736, "controlId": "SC-7(8)", "title": "SC-7(8)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58775" }, { "id": 589717, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58775", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fdc38f7-fefa-5473-8d45-a1ecaf62873c", "parentControlId": 31736, "controlId": "SC-07(08)", "title": "SC-07(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58775" }, { "id": 589719, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9f378df-b828-5a0d-8b41-7f956d9083ed", "parentControlId": 31736, "controlId": "SC-07(08)", "title": "SC-07(08)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587751" }, { "id": 589720, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c70261c-3928-5fc6-ab3f-eccfa25ddc08", "parentControlId": 31736, "controlId": "SC-07(08)", "title": "SC-07(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587751" }, { "id": 589721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8170d783-f5e7-59d4-bdee-4d0320fd6f5d", "parentControlId": 31736, "controlId": "SC-07(08)", "title": "SC-07(08)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587751" }, { "id": 589722, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33725b6a-4956-53de-adf8-5aa6742f8d71", "parentControlId": 31736, "controlId": "SC-07(08)", "title": "SC-07(08)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587751" } ], "id": 31736, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731221", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731221", "catalogueId": 1062, "uuid": "3ad87411-2c82-5e4a-ad58-e8f78d449864", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization route internal communications traffic to external networks through organization-approved proxy servers at managed interfaces?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Route Internal Traffic to Proxy Servers", "description": "

Control Description

Mechanisms exist to route internal communications traffic to external networks through organization-approved proxy servers at managed interfaces.

Evidence Request List (ERL)

E-NET-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ SBC enforce Internet-bound network traffic routing through a proxy device for URL content filtering to limit a user's ability to connect to prohibited content.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to route internal communications traffic to external networks through organization-approved proxy servers at managed interfaces.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-18.1", "family": "Network Security", "enhancements": "", "sortId": "NET-18.1", "references": "

Micro-Small Business (<10 staff)

∙ Route internet traffic through a web proxy/filter

Small Business (10-49 staff)

∙ Web proxy for internet traffic (e.g., Squid)\n∙ Proxy usage policy

Medium Business (50-249 staff)

∙ Secure web proxy for internet traffic routing\n∙ Proxy policy enforcement

Large Business (250-999 staff)

∙ Enterprise secure web gateway (SWG) with proxy (e.g., Symantec, Zscaler)

Enterprise (>1,000 staff)

∙ Enterprise SWG (e.g., Zscaler, Netskope, Symantec Web Security)\n∙ All internet traffic routed through proxy\n∙ SSL inspection", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72976, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590883", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590883", "securityControlId": 31737, "ccis": [], "uuid": "ebe30dcf-f611-57cd-8315-5a7974b12bf9", "testId": "NET-18.2_A01", "test": "encrypted communications traffic to be made visible to system monitoring tools and mechanisms is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(10)_ODP[01]", "defaultText": null }, { "id": 72977, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590883", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590883", "securityControlId": 31737, "ccis": [], "uuid": "f9adfc18-e66b-58ac-b49d-f29f06ee723e", "testId": "NET-18.2_A02", "test": "system monitoring tools and mechanisms to be provided access to encrypted communications traffic are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(10)_ODP[02]", "defaultText": null }, { "id": 72978, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590883", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590883", "securityControlId": 31737, "ccis": [], "uuid": "f99b1a44-88e6-5d5b-af29-05c5278f3c63", "testId": "NET-18.2_A03", "test": "provisions are made so that encrypted communications traffic is visible to system monitoring tools and mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-04(10)", "defaultText": null } ], "externalMappings": [ { "id": 589742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4fd9a84a-40c8-581b-98a1-83346745c779", "parentControlId": 31737, "controlId": "SI-04(10)", "title": "SI-04(10)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587756" }, { "id": 589743, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08633d3f-2d7b-5c18-acfa-5da763d33555", "parentControlId": 31737, "controlId": "SI-04(10)", "title": "SI-04(10)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587756" }, { "id": 589744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca9a2464-78ae-5abc-9e59-48274b551580", "parentControlId": 31737, "controlId": "SI-04(10)", "title": "SI-04(10)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587756" }, { "id": 589745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c5461d1-6fee-5939-b4bb-9973fd80a94c", "parentControlId": 31737, "controlId": "SI-04(10)", "title": "SI-04(10)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587756" } ], "id": 31737, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731221", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731221", "catalogueId": 1062, "uuid": "b445f006-de37-51b7-bc97-75d0af7e0484", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization configure the proxy to make encrypted communications traffic visible to monitoring tools and mechanisms?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Visibility of Encrypted Communications", "description": "

Control Description

Mechanisms exist to configure the proxy to make encrypted communications traffic visible to monitoring tools and mechanisms.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to configure the proxy to make encrypted communications traffic visible to monitoring tools and mechanisms.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-18.2", "family": "Network Security", "enhancements": "", "sortId": "NET-18.2", "references": "

Micro-Small Business (<10 staff)

∙ Enable TLS inspection on proxy/firewall if supported

Small Business (10-49 staff)

∙ TLS inspection on web proxy or NGFW

Medium Business (50-249 staff)

∙ SSL/TLS inspection policy and implementation on SWG/NGFW

Large Business (250-999 staff)

∙ Enterprise TLS inspection solution with privacy controls

Enterprise (>1,000 staff)

∙ Enterprise SSL/TLS inspection platform (e.g., Zscaler, BlueCoat)\n∙ Selective decryption policy\n∙ Privacy compliance for inspection", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 72979, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590883", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590884", "securityControlId": 31738, "ccis": [], "uuid": "6486364c-0db6-54c0-a3ee-3788138b2315", "testId": "NET-18.3_A01", "test": "networked, privileged accesses are routed through a dedicated, managed interface for purposes of auditing.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-07(15)[02]", "defaultText": null }, { "id": 72980, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590884", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590884", "securityControlId": 31738, "ccis": [], "uuid": "20d24640-20f9-5349-b9c7-63d6cb7da6ed", "testId": "NET-18.3_A02", "test": "networked, privileged accesses are routed through a dedicated, managed interface for purposes of access control.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(15)[01]", "defaultText": null } ], "externalMappings": [ { "id": 589754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587757", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2af90fcf-051f-575e-bf13-8caad6da9da0", "parentControlId": 31738, "controlId": "SC-07(15)", "title": "SC-07(15)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587757" }, { "id": 589755, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587757", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03d8b81b-a04f-5dee-a808-599ce72d890b", "parentControlId": 31738, "controlId": "SC-07(15)", "title": "SC-07(15)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587757" } ], "id": 31738, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731221", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731221", "catalogueId": 1062, "uuid": "f09c952e-79a9-55d9-a6fa-01e764d7a1eb", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to route networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 1.0, "title": "Route Privileged Network Access", "description": "

Control Description

Automated mechanisms exist to route networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Network Security (NET) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are well-documented and kept current by process owners.\n▪ A network security management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of network security operations (e.g., network management solution, log aggregator, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies.\n▪ An implemented and operational capability exists to automatically route networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "NET-18.3", "family": "Network Security", "enhancements": "", "sortId": "NET-18.3", "references": "

Micro-Small Business (<10 staff)

∙ Route admin/privileged access through a separate, secured path

Small Business (10-49 staff)

∙ Separate network path for privileged/administrative access

Medium Business (50-249 staff)

∙ Formal privileged network access routing policy\n∙ Dedicated administrative access path

Large Business (250-999 staff)

∙ Dedicated administrative network segment\n∙ Jump servers for privileged access routing

Enterprise (>1,000 staff)

∙ Enterprise privileged access workstations (PAW)\n∙ Dedicated admin network\n∙ Just-in-time privileged access (e.g., CyberArk, BeyondTrust)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73008, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590891", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590891", "securityControlId": 31756, "ccis": [], "uuid": "2774b1b0-6508-5cc7-a6cf-1ebcae48036d", "testId": "PES-01_A01", "test": "the physical facility where organizational systems reside is protected.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "171A_3.10.2[a]", "defaultText": null }, { "id": 73009, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590891", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590891", "securityControlId": 31756, "ccis": [], "uuid": "3711046e-cbd8-5754-96c8-5070fd72e380", "testId": "PES-01_A02", "test": "the location or site of the facility where the system resides is planned considering physical and environmental hazards.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-23a.", "defaultText": null }, { "id": 73010, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590891", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590891", "securityControlId": 31756, "ccis": [], "uuid": "4ff6e2c5-3ca2-52bf-b28c-dc14977311ed", "testId": "PES-01_A03", "test": "for existing facilities, physical and environmental hazards are considered in the organizational risk management strategy.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-23b.", "defaultText": null }, { "id": 73011, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590891", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590891", "securityControlId": 31756, "ccis": [], "uuid": "33c99904-54bc-5544-ace8-1046bb96e1c1", "testId": "PES-01_A04", "test": "the support infrastructure for organizational systems is protected.
PPTDF Applicability: Facility
Assessment Rigor: 2", "otherId": "171A_3.10.2[b]", "defaultText": null }, { "id": 73012, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590893", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590893", "securityControlId": 31756, "ccis": [], "uuid": "4c0029f0-dada-55be-ae2c-29fe9afb9e0b", "testId": "PES-01_A05", "test": "the physical facility where organizational systems reside is monitored.
PPTDF Applicability: Facility
Assessment Rigor: 2", "otherId": "171A_3.10.2[c]", "defaultText": null }, { "id": 73013, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590893", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590893", "securityControlId": 31756, "ccis": [], "uuid": "8a2a3cdd-4508-5a5c-994c-61700047e019", "testId": "PES-01_A06", "test": "the support infrastructure for organizational systems is monitored.
PPTDF Applicability: Facility
Assessment Rigor: 2", "otherId": "171A_3.10.2[d]", "defaultText": null }, { "id": 73014, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590893", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590893", "securityControlId": 31756, "ccis": [], "uuid": "40115418-00e7-58a5-bdd5-27d15468a2b7", "testId": "PES-01_A07", "test": "physical security operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73015, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590894", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590894", "securityControlId": 31756, "ccis": [], "uuid": "dd91d5a8-ecf6-5215-9124-18e098b09b62", "testId": "PES-01_A08", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support physical security operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73016, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590894", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590894", "securityControlId": 31756, "ccis": [], "uuid": "5454c0d1-5f15-5ecd-95db-fc6ff6316ad5", "testId": "PES-01_A09", "test": "responsibility and authority for the performance of physical security-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73017, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590894", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590894", "securityControlId": 31756, "ccis": [], "uuid": "78be3dc3-458f-5550-9732-9f65b90b7110", "testId": "PES-01_A10", "test": "personnel performing physical security-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 589814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a094adb-50c1-5bf7-a139-8a2331010c4e", "parentControlId": 31756, "controlId": "ORG 3.1", "title": "ORG 3.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587767" }, { "id": 589815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b95b92d9-7a06-5ede-b445-2ab1468f1398", "parentControlId": 31756, "controlId": "5.14", "title": "5.14", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587767" }, { "id": 589816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "837f7a1b-4010-5ea1-a829-787dfb01c21f", "parentControlId": 31756, "controlId": "5.15", "title": "5.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587767" }, { "id": 589817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b58a854-5125-5bae-b5b5-b17d168c9a0f", "parentControlId": 31756, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587767" }, { "id": 589818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8597aaa6-0d4b-5ece-bf7c-2be86fe6f463", "parentControlId": 31756, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587767" }, { "id": 589819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a15f23e4-f275-5039-964f-aeeae359aaed", "parentControlId": 31756, "controlId": "7.5", "title": "7.5", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587767" }, { "id": 589835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d38ce0c-a986-51df-94d8-040a573ad189", "parentControlId": 31756, "controlId": "PE-1", "title": "PE-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587769" }, { "id": 589836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58777", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3574e475-8887-5bf2-a138-7bdeb67d2c7c", "parentControlId": 31756, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58777" }, { "id": 589837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58777", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51520d2f-3ab8-51ca-9dbb-648b8af4f976", "parentControlId": 31756, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58777" }, { "id": 589840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58777", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3995c62d-6dd6-597b-ab4a-374d3fec9998", "parentControlId": 31756, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58777" }, { "id": 589842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58777", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2600052-c703-5a48-a50c-7b605bbe6d86", "parentControlId": 31756, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587771" }, { "id": 589843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a5e6b42-bf5f-5cf5-b921-eac4a3c2f305", "parentControlId": 31756, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587771" }, { "id": 589844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "590a4900-789a-5a87-9dbe-1bfbdf2fd44d", "parentControlId": 31756, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587771" }, { "id": 589845, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f4861e5-70d9-587a-85f1-9ed1d53b7ccb", "parentControlId": 31756, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587771" }, { "id": 589846, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d27944a-3c07-5f6f-b5a4-f9878029ed8b", "parentControlId": 31756, "controlId": "PE-01", "title": "PE-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587771" }, { "id": 589847, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60fd42f6-131f-5da2-9a98-91c6344b205a", "parentControlId": 31756, "controlId": "PE-1", "title": "PE-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587771" }, { "id": 589848, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b7d9fea-158c-5e01-bf9d-d2427e8cd5a9", "parentControlId": 31756, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587771" }, { "id": 589849, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587771", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95941b17-7fce-58bd-88c1-a56939a66d11", "parentControlId": 31756, "controlId": "PE-1", "title": "PE-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587772" }, { "id": 589850, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587772", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d074357-58e5-5d4c-af7c-beb973393477", "parentControlId": 31756, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587772" }, { "id": 589856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587772", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a19cdb34-a26b-5edb-944c-c045560d11ec", "parentControlId": 31756, "controlId": "3.10.2", "title": "3.10.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587772" }, { "id": 589857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "521185cd-08b8-580f-83c3-934fb61f199a", "parentControlId": 31756, "controlId": "NFO - PE-1", "title": "NFO - PE-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587773" }, { "id": 589858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aaae01c8-b5b3-5032-a93b-761e8b0e6aa0", "parentControlId": 31756, "controlId": "03.08.01", "title": "03.08.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587773" }, { "id": 589859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "581658bb-12f4-585f-b8b0-0bb9fe81c072", "parentControlId": 31756, "controlId": "03.08.02", "title": "03.08.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587773" }, { "id": 589860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd574a75-357c-53e5-88c8-f4808d858e12", "parentControlId": 31756, "controlId": "03.10.01.a", "title": "03.10.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587773" }, { "id": 589861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c08238a5-93ad-53ae-a269-255fe7bcbb91", "parentControlId": 31756, "controlId": "03.10.07.a", "title": "03.10.07.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587773" }, { "id": 589866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587774", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2da3d742-476a-5d5b-9a5a-4044773b5e65", "parentControlId": 31756, "controlId": "ID.AM", "title": "ID.AM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587774" }, { "id": 589867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587774", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53f9366b-406d-57b4-8bf3-4fd58a07e067", "parentControlId": 31756, "controlId": "PR.AA", "title": "PR.AA", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587774" }, { "id": 589868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587774", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b0a9d29-314c-5459-83de-c433c56f7732", "parentControlId": 31756, "controlId": "PR.AA-06", "title": "PR.AA-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587774" }, { "id": 589869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587774", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3ffaeb8-fde3-555a-9a41-41d6506ba1b7", "parentControlId": 31756, "controlId": "PR.IR-02", "title": "PR.IR-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587774" }, { "id": 589870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587775", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27336e69-4eca-5c41-aca8-88a80b36770c", "parentControlId": 31756, "controlId": "DE.CM-02", "title": "DE.CM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587775" }, { "id": 589890, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587777", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65429450-0eaa-5288-bb4a-722486a5efe5", "parentControlId": 31756, "controlId": "ACCESS-3a", "title": "ACCESS-3a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587777" }, { "id": 589891, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587778", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c65167d9-ec67-51c3-bf9b-0b7da8e1433d", "parentControlId": 31756, "controlId": "ACCESS-3d", "title": "ACCESS-3d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587778" }, { "id": 589892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587778", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3584a76e-d0f4-571e-9761-85bd06028d98", "parentControlId": 31756, "controlId": "ARCHITECTURE-3a", "title": "ARCHITECTURE-3a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587778" }, { "id": 589893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587778", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1defe90-84d3-5e37-b7d7-f8d3cb262a25", "parentControlId": 31756, "controlId": "ARCHITECTURE-3j", "title": "ARCHITECTURE-3j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587778" }, { "id": 589915, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587781", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "184c47b8-c1dd-5fe7-a814-e2c39ded780d", "parentControlId": 31756, "controlId": "CIP-003-8 1.1.3", "title": "CIP-003-8 1.1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587781" }, { "id": 589916, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587782", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7035e8b1-78dd-51bf-bf67-67a92b3b3fb9", "parentControlId": 31756, "controlId": "CIP-003-8 1.2.2", "title": "CIP-003-8 1.2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587782" }, { "controlId": "A.3.1.4", "title": "A.3.1.4 — Reviews and Validation Testing", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, CA-7, RA-5, SI-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "5a98b22d-7b3f-58c4-bcaa-9db98a270f20", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.4", "title": "NEI 08-09 Sec 3.1.4 — Reviews and Validation Testing", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "f5143e5b-1c6a-50c2-bb31-30f57d25e43a", "isPublic": true }, { "controlId": "10 CFR 73.54(b)(1), (c)(2)", "title": "10 CFR 73.54(b)(1), (c)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "940869c4-f041-5880-8b8d-88fdf0fbf45f", "isPublic": true }, { "controlId": "A.3.2", "title": "A.3.2 — Incorporating the Cyber Security Program into the Physical Protection Program", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-1, PM-1, IR-4, CP-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "d9d6d154-19cc-565a-9c06-78a0d6019008", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.2", "title": "NEI 08-09 Sec 3.2 — Incorporating the Cyber Security Program into the Physical Protection Program", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "27992a63-0412-5f19-866d-a995128189bd", "isPublic": true }, { "controlId": "10 CFR 73.54(b)(3), 73.55(c)(6)", "title": "10 CFR 73.54(b)(3), 73.55(c)(6) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "050ab65c-331e-5d47-8e22-61b0faac37e2", "isPublic": true }, { "controlId": "C.5.1", "title": "C.5.1 — Physical and Environmental Protection Policies and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "da600658-8117-52df-a0ac-58575bf3ab4b", "isPublic": true }, { "controlId": "NEI 08-09 App E.5.1", "title": "NEI 08-09 App E.5.1 — Physical and Environmental Protection Policies and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.5.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d0e651aa-c36e-564b-b72c-bc5a91d48806", "isPublic": true }, { "controlId": "10 CFR 73.55", "title": "10 CFR 73.55 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.5.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "e7ef817d-7426-50f8-a33e-4ba61f3faab2", "isPublic": true }, { "controlId": "CIP-003-8-R2", "title": "CIP-003-8-R2 — Cyber Security Plan Implementation for Low Impact BES Cyber Systems", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "cd74032c-46fb-54f0-a411-581fd4b68900", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec1", "title": "CIP-003-9-Attachment1-Sec1 — Low Impact Cyber Security Awareness", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "03101e76-8e3b-5bc3-88fa-e0d79084dfa8", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec2", "title": "CIP-003-9-Attachment1-Sec2 — Low Impact Physical Security Controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "940ea9ea-0082-5cb3-ae8f-c16a122b4fe9", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec3", "title": "CIP-003-9-Attachment1-Sec3 — Low Impact Electronic Access Controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "383cf1f4-ad9c-5771-bfa9-f8f2c6f64c57", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec4", "title": "CIP-003-9-Attachment1-Sec4 — Low Impact Cyber Security Incident Response", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3e5b249c-e1b4-55b9-aea2-2f4754497f64", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec5", "title": "CIP-003-9-Attachment1-Sec5 — Low Impact Transient Cyber Asset and Removable Media Malicious Code Risk Mitigation", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "18eece2b-b7c3-5edc-b4ab-22e13f16430c", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec6", "title": "CIP-003-9-Attachment1-Sec6 — Low Impact Vendor Electronic Remote Access Security Controls (CIP-003-9)", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "bdeccb2a-4ec1-58d2-a2bf-ed91454af5d9", "isPublic": true }, { "controlId": "CIP-006-6-R1", "title": "CIP-006-6-R1 — Physical Security Plan", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4940fde2-1292-5b2b-985a-f78465986cf7", "isPublic": true }, { "controlId": "CIP-006-6-1.1", "title": "CIP-006-6-1.1 — Define operational or procedural controls to restrict physical access.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "888b2523-e314-5454-9bbb-4b7086be7d52", "isPublic": true }, { "controlId": "CIP-006-6-1.2", "title": "CIP-006-6-1.2 — Utilize at least one physical access control to allow unescorted physical access into each applicable Physical Securi...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2f34522c-49fe-5bfa-8aec-f7741e0ffd6d", "isPublic": true }, { "controlId": "CIP-006-6-1.3", "title": "CIP-006-6-1.3 — Where technically feasible, utilize two or more different physical access controls (this does not require two complet...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "010dcea3-69d2-5b25-9cf0-47ed82b3bce6", "isPublic": true }, { "controlId": "CIP-006-6-1.4", "title": "CIP-006-6-1.4 — Monitor for unauthorized access through a physical access point into a Physical Security Perimeter.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "15e9d5de-5871-53ba-83d2-b59c473e0da4", "isPublic": true }, { "controlId": "CIP-006-6-1.5", "title": "CIP-006-6-1.5 — Issue an alarm or alert in response to detected unauthorized access through a physical access point into a Physical S...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d8313450-97f2-5acc-984a-20ddf5a9ffab", "isPublic": true }, { "controlId": "CIP-006-6-1.6", "title": "CIP-006-6-1.6 — Monitor each Physical Access Control System for unauthorized physical access to a Physical Access Control System.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d0903495-9a51-56df-9b6e-736ca69c3db5", "isPublic": true }, { "controlId": "CIP-006-6-1.7", "title": "CIP-006-6-1.7 — Issue an alarm or alert in response to detected unauthorized physical access to a Physical Access Control System to t...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "471f2ee3-feb7-58d7-bb74-6d693b1e47c2", "isPublic": true }, { "controlId": "CIP-006-6-1.8", "title": "CIP-006-6-1.8 — Log (through automated means or by personnel who control entry) entry of each individual with authorized unescorted p...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2fbff6d2-6418-5f82-8723-e95ac0d9b7bb", "isPublic": true }, { "controlId": "CIP-006-6-1.9", "title": "CIP-006-6-1.9 — Retain physical access logs of entry of individuals with authorized unescorted physical access into each Physical Sec...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ebbd7b3d-3796-5f42-8ca9-07da33210e36", "isPublic": true }, { "controlId": "CIP-006-6-1.10", "title": "CIP-006-6-1.10 — Restrict physical access to cabling and other nonprogrammable communication components used for connection between ap...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "970f3865-c25c-5b78-b015-dc94e2a8a8aa", "isPublic": true }, { "controlId": "CIP-006-6-R3", "title": "CIP-006-6-R3 — Physical Access Control System Maintenance and Testing", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b38b5ae6-bd8a-51fd-a9a6-954851ecf6b4", "isPublic": true }, { "controlId": "CIP-014-3-R1", "title": "CIP-014-3-R1 — Transmission Station and Substation Risk Assessment", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4b665939-483b-57ec-b649-889dbeb222f8", "isPublic": true }, { "controlId": "CIP-014-3-1.1", "title": "CIP-014-3-1.1 — Subsequent risk assessments shall be performed", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "96bd4460-135c-58a9-a05e-8fbffa7f325d", "isPublic": true }, { "controlId": "CIP-014-3-1.2", "title": "CIP-014-3-1.2 — The Transmission Owner shall identify the primary control center that operationally controls each Transmission statio...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7725b943-4902-505d-b6b5-279b3d40c2cd", "isPublic": true }, { "controlId": "CIP-014-3-R4", "title": "CIP-014-3-R4 — Evaluation of Potential Threats and Vulnerabilities", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "bdde7206-4cca-5271-af7e-4211ae150e19", "isPublic": true }, { "controlId": "CIP-014-3-4.1", "title": "CIP-014-3-4.1 — Unique characteristics of the identified and verified Transmission station(s), Transmission substation(s), and primar...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8515270b-809d-57fb-9f4c-d2444ff040e8", "isPublic": true }, { "controlId": "CIP-014-3-4.2", "title": "CIP-014-3-4.2 — Prior history of attack on similar facilities taking into account the frequency, geographic proximity, and severity o...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1937ebf5-6415-5062-9986-abbffe0e3007", "isPublic": true }, { "controlId": "CIP-014-3-4.3", "title": "CIP-014-3-4.3 — Intelligence or threat warnings received from sources such as law enforcement, the Electric Reliability Organization...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f9a0a3e6-9fac-5cd7-9498-1c8c1407583b", "isPublic": true }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "190f960f-145a-5b18-8218-72a7b44e2c4c", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "6f054f09-efb7-5dba-9d50-f5d40f3098f6", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "27862f5f-d97b-5b23-a2be-14b4becb0b4f", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "99e95b6d-6739-55d7-92ce-f0ebfcd8f212", "isPublic": true } ], "id": 31756, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731235", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731235", "catalogueId": 1062, "uuid": "3ea47380-28b4-5f7d-b690-065b540a2b17", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the operation of physical and environmental protection controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Physical & Environmental Protections", "description": "

Control Description

Mechanisms exist to facilitate the operation of physical and environmental protection controls.

Evidence Request List (ERL)

E-PES-01\nE-PES-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ The Human Resources (HR) department maintains a current list of personnel with authorized access to organizational facilities and facilitates the implementation of physical access management controls.\n▪ Physical security controls and technologies ensure that only authorized personnel are allowed access to secure areas.\n▪ A facilities maintenance team, or similar function, manages the operation of automated physical and environmental protection controls.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the operation of physical and environmental protection controls.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.4, A.3.2, C.5.1
NERC-CIP (2026) Requirements: CIP-003-8-R2, CIP-006-6-R1, CIP-006-6-R3, CIP-014-3-R1, CIP-014-3-R4", "controlId": "PES-01", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-01", "references": "

Micro-Small Business (<10 staff)

∙ Physical security policy\n∙ Door locks and key management

Small Business (10-49 staff)

∙ Physical security policy\n∙ Access log\n∙ Visitor sign-in procedure

Medium Business (50-249 staff)

∙ Formal physical security program\n∙ Card-based access control\n∙ CCTV

Large Business (250-999 staff)

∙ Enterprise physical security program\n∙ Multi-zone card access\n∙ CCTV monitoring\n∙ Security guard coverage

Enterprise (>1,000 staff)

∙ Enterprise physical security platform (e.g., Lenel, Genetec)\n∙ Integrated access control/CCTV\n∙ 24/7 security operations\n∙ Environmental monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73018, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590894", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590894", "securityControlId": 31757, "ccis": [], "uuid": "f9772aed-b1a8-5f30-855d-7938de973596", "testId": "PES-01.1_A01", "test": "a Site Security Plan (SitePlan) is documented for each server and communications room to summarize the implemented security controls to protect physical access to technology assets, as well as applicable risks and threats.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 589994, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20c77e75-9304-55e6-a0f0-be9e0675661d", "parentControlId": 31757, "controlId": "CIP-006-6 R1", "title": "CIP-006-6 R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587803" }, { "id": 589995, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9fe61ac-205e-5d4d-85e9-2f7f3609306f", "parentControlId": 31757, "controlId": "CIP-006-6 1.1", "title": "CIP-006-6 1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587803" }, { "controlId": "A.3.2", "title": "A.3.2 — Incorporating the Cyber Security Program into the Physical Protection Program", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-1, PM-1, IR-4, CP-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "8d26c826-962e-5578-a327-e057c0ec2cd4", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.2", "title": "NEI 08-09 Sec 3.2 — Incorporating the Cyber Security Program into the Physical Protection Program", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d55d2b30-da85-5c51-9e3d-9f3c2f248744", "isPublic": true }, { "controlId": "10 CFR 73.54(b)(3), 73.55(c)(6)", "title": "10 CFR 73.54(b)(3), 73.55(c)(6) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "c6735c47-a70e-5bff-92a4-2e204becd197", "isPublic": true }, { "controlId": "C.5.1", "title": "C.5.1 — Physical and Environmental Protection Policies and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "4433a63c-bf4e-5e71-9126-623ed1cff942", "isPublic": true }, { "controlId": "NEI 08-09 App E.5.1", "title": "NEI 08-09 App E.5.1 — Physical and Environmental Protection Policies and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.5.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "094fdd94-0494-51aa-bf80-cd9af910bdbe", "isPublic": true }, { "controlId": "10 CFR 73.55", "title": "10 CFR 73.55 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.5.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "e69b85d7-08df-57c4-ab75-14b1ed932473", "isPublic": true }, { "controlId": "CIP-006-6-R1", "title": "CIP-006-6-R1 — Physical Security Plan", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5afb3480-21c6-5a63-984e-1b8465ed2891", "isPublic": true }, { "controlId": "CIP-006-6-1.1", "title": "CIP-006-6-1.1 — Define operational or procedural controls to restrict physical access.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "905242df-85bb-5dcc-b341-a2436ae11cc3", "isPublic": true }, { "controlId": "CIP-006-6-1.2", "title": "CIP-006-6-1.2 — Utilize at least one physical access control to allow unescorted physical access into each applicable Physical Securi...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f83b51cf-4e02-58a8-9f1c-dad814cf25da", "isPublic": true }, { "controlId": "CIP-006-6-1.3", "title": "CIP-006-6-1.3 — Where technically feasible, utilize two or more different physical access controls (this does not require two complet...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4302a629-68e0-5186-a4e5-61e2a2b0402f", "isPublic": true }, { "controlId": "CIP-006-6-1.4", "title": "CIP-006-6-1.4 — Monitor for unauthorized access through a physical access point into a Physical Security Perimeter.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "27e77557-c33a-5f48-864f-ac50ff66a4af", "isPublic": true }, { "controlId": "CIP-006-6-1.5", "title": "CIP-006-6-1.5 — Issue an alarm or alert in response to detected unauthorized access through a physical access point into a Physical S...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6013c56e-721a-5bb3-8dd9-16ea20b00dde", "isPublic": true }, { "controlId": "CIP-006-6-1.6", "title": "CIP-006-6-1.6 — Monitor each Physical Access Control System for unauthorized physical access to a Physical Access Control System.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2c8e4896-9bc7-5b58-b2e3-7d4c7527cac1", "isPublic": true }, { "controlId": "CIP-006-6-1.7", "title": "CIP-006-6-1.7 — Issue an alarm or alert in response to detected unauthorized physical access to a Physical Access Control System to t...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e83dcf3f-4437-5aa0-a336-4ff1b8d2ea0c", "isPublic": true }, { "controlId": "CIP-006-6-1.8", "title": "CIP-006-6-1.8 — Log (through automated means or by personnel who control entry) entry of each individual with authorized unescorted p...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b6ab85a4-3c24-57e1-8037-66cafa2098ef", "isPublic": true }, { "controlId": "CIP-006-6-1.9", "title": "CIP-006-6-1.9 — Retain physical access logs of entry of individuals with authorized unescorted physical access into each Physical Sec...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c4b25ea3-5d94-5418-9f19-71880098c5b6", "isPublic": true }, { "controlId": "CIP-006-6-1.10", "title": "CIP-006-6-1.10 — Restrict physical access to cabling and other nonprogrammable communication components used for connection between ap...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "eaf1a585-02b6-5f52-90fb-4e9caa8ca872", "isPublic": true }, { "controlId": "CIP-014-3-R5", "title": "CIP-014-3-R5 — Physical Security Plan Development and Implementation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "71d11ba9-751c-550e-bb67-b38b9634de8b", "isPublic": true }, { "controlId": "CIP-014-3-5.1", "title": "CIP-014-3-5.1 — Resiliency or security measures designed collectively to deter, detect, delay, assess, communicate, and respond to po...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c464f537-810f-5894-a558-3e90b60900f1", "isPublic": true }, { "controlId": "CIP-014-3-5.2", "title": "CIP-014-3-5.2 — Law enforcement contact and coordination information.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e9d7bbd5-833d-59d0-aab6-a723908c94c9", "isPublic": true }, { "controlId": "CIP-014-3-5.3", "title": "CIP-014-3-5.3 — A timeline for executing the physical security enhancements and modifications specified in the physical security plan.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7cc03fd9-b749-5844-8e8d-3c9af8dc1b15", "isPublic": true }, { "controlId": "CIP-014-3-5.4", "title": "CIP-014-3-5.4 — Provisions to evaluate evolving physical threats, and their corresponding security measures, to the Transmission stat...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e9044d7e-bd62-57ff-a207-b6c5d32539dc", "isPublic": true }, { "controlId": "CIP-014-3-R6", "title": "CIP-014-3-R6 — Third-Party Review of Physical Security Evaluation and Plan", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "39c4ca4e-3775-5640-a791-8274ba3c899d", "isPublic": true }, { "controlId": "CIP-014-3-6.1", "title": "CIP-014-3-6.1 — Each Transmission Owner and Transmission Operator shall select an unaffiliated third party reviewer from the following", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b2bbb226-2b4a-555a-a8d4-911dfe4ada30", "isPublic": true }, { "controlId": "CIP-014-3-6.2", "title": "CIP-014-3-6.2 — The Transmission Owner or Transmission Operator, respectively, shall ensure that the unaffiliated third party review...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "32d07f2b-ab41-5d52-b205-6893f577d9b9", "isPublic": true }, { "controlId": "CIP-014-3-6.3", "title": "CIP-014-3-6.3 — If the unaffiliated third party reviewer recommends changes to the evaluation performed under Requirement R4 or secur...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "63bc2d32-8149-5120-b116-acbd3d23b2f4", "isPublic": true }, { "controlId": "CIP-014-3-6.4", "title": "CIP-014-3-6.4 — Each Transmission Owner and Transmission Operator shall implement procedures, such as the use of non-disclosure agree...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "91a3c26d-c2bb-5f91-adbd-d42a1f15db0d", "isPublic": true }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "70a1bff2-ef10-5605-af91-d4299bd76af7", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "e468e40b-9e3b-5a8b-93b7-7f9c21e6a7a9", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "1070db34-f948-54f3-944d-99f55facb276", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "49a06e38-37a0-59ab-8aee-9e9a6902766c", "isPublic": true } ], "id": 31757, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731235", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731235", "catalogueId": 1062, "uuid": "7d86013a-729f-51f2-82b2-5fe0929cf4da", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization document a Site Security Plan (SitePlan) for each server and communications room to summarize the implemented security controls to protect physical access to technology assets, as well as applicable risks and threats?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Physical Security Plan (PSP)", "description": "

Control Description

Mechanisms exist to document a Physical Security Plan (PSP), or similar document, to summarize the implemented security controls to protect physical access to technology assets, as well as applicable risks and threats.

Evidence Request List (ERL)

E-PES-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPhysical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to document a Physical Security Plan (PSP), or similar document, to summarize the implemented security controls to protect physical access to technology assets, as well as applicable risks and threats.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.2, C.5.1
NERC-CIP (2026) Requirements: CIP-006-6-R1, CIP-014-3-R5, CIP-014-3-R6", "controlId": "PES-01.1", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Physical security policy\n∙ Door locks and key management

Small Business (10-49 staff)

∙ Physical security policy\n∙ Access log\n∙ Visitor procedures

Medium Business (50-249 staff)

∙ Documented Site Security Plan (SitePlan)

Large Business (250-999 staff)

∙ Documented Site Security Plan (SitePlan)

Enterprise (>1,000 staff)

∙ Documented Site Security Plan (SitePlan)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73019, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590895", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590895", "securityControlId": 31758, "ccis": [], "uuid": "1bbfadbb-0b20-5a13-89d1-b5b857fc4a78", "testId": "PES-01.2_A01", "test": "a zone-based approach to physical security is developed.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73020, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590895", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590895", "securityControlId": 31758, "ccis": [], "uuid": "b926c021-70b9-5b5c-97bb-525e37458f9f", "testId": "PES-01.2_A02", "test": "a zone-based approach to physical security is implemented.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 590003, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34313ebd-e73b-508a-8856-c331504617d1", "parentControlId": 31758, "controlId": "CIP-006-6 1.2", "title": "CIP-006-6 1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587804" }, { "controlId": "CIP-014-3-R5", "title": "CIP-014-3-R5 — Physical Security Plan Development and Implementation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9a1a8698-4e64-53b3-ae22-cd6bd45945db", "isPublic": true }, { "controlId": "CIP-014-3-5.1", "title": "CIP-014-3-5.1 — Resiliency or security measures designed collectively to deter, detect, delay, assess, communicate, and respond to po...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2b4f7ac7-b487-5bb0-901f-7414865215cf", "isPublic": true }, { "controlId": "CIP-014-3-5.2", "title": "CIP-014-3-5.2 — Law enforcement contact and coordination information.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "375ae8c1-e8a5-54d7-8dcd-7cb41e499f2c", "isPublic": true }, { "controlId": "CIP-014-3-5.3", "title": "CIP-014-3-5.3 — A timeline for executing the physical security enhancements and modifications specified in the physical security plan.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0438a222-2117-5b7f-b239-e2acd5f288ff", "isPublic": true }, { "controlId": "CIP-014-3-5.4", "title": "CIP-014-3-5.4 — Provisions to evaluate evolving physical threats, and their corresponding security measures, to the Transmission stat...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c79f4025-b646-514e-9b38-1cbbbea98ee9", "isPublic": true }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "8ad85688-0df3-5897-ab68-1afe8294906b", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "406340ae-edec-5823-b3cc-2d8d5a1542b8", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "c9c954de-cb71-550a-b96e-a815b22fe7c1", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "74d4bde5-9ee1-5944-8ecd-dbe61ede5b20", "isPublic": true } ], "id": 31758, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731236", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731236", "catalogueId": 1062, "uuid": "3b3f2fa5-1215-5f78-b3f3-0c995bb6ae02", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement a zone-based approach to physical security?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Zone-Based Physical Security", "description": "

Control Description

Mechanisms exist to implement a zone-based approach to physical security.

Evidence Request List (ERL)

E-PES-11

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement a zone-based approach to physical security.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

NERC-CIP (2026) Requirements: CIP-014-3-R5", "controlId": "PES-01.2", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-01.2", "references": "

Micro-Small Business (<10 staff)

∙ Physical security policy with basic controls documented

Small Business (10-49 staff)

∙ Documented physical security procedures\n∙ Review annually

Medium Business (50-249 staff)

∙ Formal physical security procedures for all zones\n∙ Training for relevant staff

Large Business (250-999 staff)

∙ Enterprise physical security procedures\n∙ Regular drills and exercises

Enterprise (>1,000 staff)

∙ Enterprise physical security program with comprehensive procedures\n∙ Regular exercises and audits\n∙ Third-party security assessments", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73021, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590895", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590895", "securityControlId": 31759, "ccis": [], "uuid": "0499efaf-35f4-5987-9590-e51bad7d40dc", "testId": "PES-02_A01", "test": "authorized individuals allowed physical access are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.10.1[a]\n53A_R5_PE-02a.[01]", "defaultText": null }, { "id": 73022, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590895", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590895", "securityControlId": 31759, "ccis": [], "uuid": "d334a98b-9f83-566e-a29c-2175379ef9d5", "testId": "PES-02_A02", "test": "physical access to operating environments is limited to authorized individuals.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "171A_3.10.1[d]", "defaultText": null }, { "id": 73023, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590896", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590896", "securityControlId": 31759, "ccis": [], "uuid": "a772009d-c829-55b8-9417-56a0512610ab", "testId": "PES-02_A03", "test": "physical access to organizational systems is limited to authorized individuals.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "171A_3.10.1[b]", "defaultText": null }, { "id": 73024, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590896", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590896", "securityControlId": 31759, "ccis": [], "uuid": "7e848f48-3cb7-5acd-903d-c1b201d974f0", "testId": "PES-02_A04", "test": "physical access to equipment is limited to authorized individuals.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "171A_3.10.1[c]", "defaultText": null }, { "id": 73025, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590896", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590896", "securityControlId": 31759, "ccis": [], "uuid": "8cbae53b-fd7c-57b4-afc2-7e9b2251d781", "testId": "PES-02_A05", "test": "the frequency at which to review the access list detailing authorized facility access by individuals is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PE-02_ODP\n171A_R3_A.03.10.01.ODP[01]", "defaultText": null }, { "id": 73026, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590896", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590896", "securityControlId": 31759, "ccis": [], "uuid": "3b8db9b8-4aed-543e-8f9e-f4122786a010", "testId": "PES-02_A06", "test": "a list of individuals with authorized access to the facility where the system resides is approved.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PE-02a.[02]\n171A_R3_A.03.10.01.a[02]", "defaultText": null }, { "id": 73027, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590896", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590896", "securityControlId": 31759, "ccis": [], "uuid": "b09a013a-5060-5cc4-97a7-723492ccd03d", "testId": "PES-02_A07", "test": "a list of individuals with authorized access to the facility where the system resides is maintained.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PE-02a.[03]\n171A_R3_A.03.10.01.a[03]", "defaultText": null }, { "id": 73028, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590896", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590896", "securityControlId": 31759, "ccis": [], "uuid": "f62be623-c113-5e43-bbe3-e1add130658b", "testId": "PES-02_A08", "test": "authorization credentials are issued for facility access.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-02b.", "defaultText": null }, { "id": 73029, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590896", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590896", "securityControlId": 31759, "ccis": [], "uuid": "16f7412b-aa39-5381-8719-e86e295b8dd5", "testId": "PES-02_A09", "test": "the facility access list is reviewed per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PE-02c.", "defaultText": null }, { "id": 73030, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590897", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590897", "securityControlId": 31759, "ccis": [], "uuid": "71ae4d2c-ba55-5d88-a6c5-3c222d709561", "testId": "PES-02_A10", "test": "individuals from the facility access list are removed when access is no longer required.
PPTDF Applicability: Facility
Assessment Rigor: 2", "otherId": "53A_R5_PE-02d.\n171A_R3_A.03.10.01.d", "defaultText": null }, { "id": 73031, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590897", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590897", "securityControlId": 31759, "ccis": [], "uuid": "4bcc96a3-078b-5f88-9565-f47e3c887c64", "testId": "PES-02_A11", "test": "physical access restrictions associated with changes to the system are approved.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.05[02]", "defaultText": null }, { "id": 73032, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590897", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590897", "securityControlId": 31759, "ccis": [], "uuid": "52fe022c-93c3-584e-aa7c-71a8166948ac", "testId": "PES-02_A12", "test": "a list of individuals with authorized access to the facility where the system resides is developed.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.10.01.a[01]", "defaultText": null }, { "id": 73033, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590897", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590897", "securityControlId": 31759, "ccis": [], "uuid": "b237971b-57f6-5842-9a0e-0d286825f1a4", "testId": "PES-02_A13", "test": "physical access authorizations are enforced at entry and exit points to the facility where the system resides by verifying individual physical access authorizations before granting access.
PPTDF Applicability: Facility
Assessment Rigor: 2", "otherId": "171A_R3_A.03.10.07.a.01", "defaultText": null }, { "id": 73034, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590898", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590898", "securityControlId": 31759, "ccis": [], "uuid": "52c77b48-64fb-53ce-9d74-c0924c3f55d1", "testId": "PES-02_A14", "test": "the facility access list is reviewed .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months, or when there are significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.10.01.c", "defaultText": null } ], "externalMappings": [ { "id": 590015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587806", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63043fa5-4100-5a94-8725-b4548c139fd7", "parentControlId": 31759, "controlId": "5.15", "title": "5.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587806" }, { "id": 590016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25d6bf68-7735-53bc-9b2b-0e64488cafef", "parentControlId": 31759, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587807" }, { "id": 590017, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e83983f-47e9-5b25-9b14-a0483de519fb", "parentControlId": 31759, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587807" }, { "id": 590026, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587808", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52825bcb-7882-53b2-bb58-adb644548b98", "parentControlId": 31759, "controlId": "PE-2", "title": "PE-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587808" }, { "id": 590027, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587808", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0fafe7a-f0d6-5b4f-a3a1-8ad7e2c6fea1", "parentControlId": 31759, "controlId": "PE-02", "title": "PE-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587808" }, { "id": 590028, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587808", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ff558a4-6348-5d15-b8ae-93992146a08b", "parentControlId": 31759, "controlId": "PE-02", "title": "PE-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587808" }, { "id": 590030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587808", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab28397a-5ffb-56cb-b31b-aacc9c1bba3c", "parentControlId": 31759, "controlId": "PE-02", "title": "PE-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587808" }, { "id": 590031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587808", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83fe614b-1f63-56c8-979a-19879189d8b8", "parentControlId": 31759, "controlId": "PE-02", "title": "PE-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587808" }, { "id": 590032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587808", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c3aaa19-3002-5c8c-85fc-94d3da3dfa36", "parentControlId": 31759, "controlId": "PE-02", "title": "PE-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587808" }, { "id": 590033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5d16385-9171-5201-a1c9-8d0f0e4b8987", "parentControlId": 31759, "controlId": "PE-02", "title": "PE-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587809" }, { "id": 590034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de757f4d-2aa7-512e-8a71-58badc678bd8", "parentControlId": 31759, "controlId": "PE-2", "title": "PE-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587809" }, { "id": 590035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6cc3dca-e964-5a0f-9dd7-6d2e2331f2cd", "parentControlId": 31759, "controlId": "PE-2", "title": "PE-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587809" }, { "id": 590036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "492912ec-6724-5244-8c0d-a73293c2c7b0", "parentControlId": 31759, "controlId": "PE-2", "title": "PE-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587809" }, { "id": 590039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c4b5e04-3637-54fe-a66a-32a3f8b39059", "parentControlId": 31759, "controlId": "3.10.1", "title": "3.10.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587809" }, { "id": 590040, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a234f8f-3090-5d8a-a47d-08bcacdb0812", "parentControlId": 31759, "controlId": "03.08.01", "title": "03.08.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587809" }, { "id": 590041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58781", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57f9dd96-c010-52d4-9129-43728aa1c7dc", "parentControlId": 31759, "controlId": "03.08.02", "title": "03.08.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58781" }, { "id": 590042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58781", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6172dc82-4515-5ad3-9902-91768b6ce798", "parentControlId": 31759, "controlId": "03.10.01.a", "title": "03.10.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58781" }, { "id": 590043, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58781", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ab65f9a-b222-5f39-ad19-be00b04bf563", "parentControlId": 31759, "controlId": "03.10.01.b", "title": "03.10.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58781" }, { "id": 590044, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58781", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a494d62c-3d33-5a8d-95fa-8e3936645a7a", "parentControlId": 31759, "controlId": "03.10.01.c", "title": "03.10.01.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58781" }, { "id": 590045, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58781", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f1c585a-4ab1-564f-bdbc-90361d6e16b5", "parentControlId": 31759, "controlId": "03.10.01.d", "title": "03.10.01.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58781" }, { "id": 590046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58781", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e6b00ec-4032-54d7-9f79-d65bb08bf051", "parentControlId": 31759, "controlId": "03.10.07.a", "title": "03.10.07.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58781" }, { "id": 590059, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c35901e2-a35f-5053-81af-cd235a82938f", "parentControlId": 31759, "controlId": "PR.AA", "title": "PR.AA", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587812" }, { "id": 590060, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5a060e4-0b89-556e-aa3f-2d0b326b4a03", "parentControlId": 31759, "controlId": "PR.AA-06", "title": "PR.AA-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587812" }, { "id": 590080, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c034280-b0fe-5d2f-82c7-3ff1ac1f3f27", "parentControlId": 31759, "controlId": "ACCESS-3b", "title": "ACCESS-3b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587814" }, { "id": 590081, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2719bb86-e87c-51cc-a852-572826f45a8d", "parentControlId": 31759, "controlId": "ACCESS-3d", "title": "ACCESS-3d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587814" }, { "id": 590082, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4e0ed0c-790c-5429-a7d0-bdbd40a0a777", "parentControlId": 31759, "controlId": "ACCESS-3f", "title": "ACCESS-3f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587815" }, { "id": 590083, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "278b9fc9-0027-57d6-a7d4-e7dbe0681d77", "parentControlId": 31759, "controlId": "ACCESS-3g", "title": "ACCESS-3g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587815" }, { "id": 590084, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c966784-923b-5ace-9c86-4763cddae059", "parentControlId": 31759, "controlId": "ACCESS-3i", "title": "ACCESS-3i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587815" }, { "id": 590114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acab8902-9779-5548-bb07-285dc0b7bb80", "parentControlId": 31759, "controlId": "CIP-004-7 4.1.2", "title": "CIP-004-7 4.1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587821" }, { "id": 590115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23bc6201-856e-5a27-bb4d-67e45c209b3e", "parentControlId": 31759, "controlId": "CIP-004-7 4.2", "title": "CIP-004-7 4.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587821" }, { "id": 590116, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "099a0b94-1a07-5042-a0d6-6b633aea2579", "parentControlId": 31759, "controlId": "CIP-004-7 6.1.2", "title": "CIP-004-7 6.1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587821" }, { "controlId": "C.5.3", "title": "C.5.3 — Physical and Environmental Protection", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-2, PE-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "0459612a-5a24-5c35-8412-f54c0c44eaf5", "isPublic": true }, { "controlId": "NEI 08-09 App E.5.3", "title": "NEI 08-09 App E.5.3 — Physical and Environmental Protection", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.5.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "ea42c1b0-ff56-51f5-a16d-a053c5333fd2", "isPublic": true }, { "controlId": "10 CFR 73.55", "title": "10 CFR 73.55 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.5.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "ee5f9f0e-42f7-52e5-aeb8-e4ea04003771", "isPublic": true }, { "controlId": "C.5.4", "title": "C.5.4 — Physical Access Authorizations", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "9aabef63-c549-5a6c-b0d4-ad8047ea4893", "isPublic": true }, { "controlId": "NEI 08-09 App E.5.4", "title": "NEI 08-09 App E.5.4 — Physical Access Authorizations", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.5.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "a23e21fd-4a91-57b0-b000-681077fdbc52", "isPublic": true }, { "controlId": "10 CFR 73.55(g)", "title": "10 CFR 73.55(g) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.5.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "d0b1edc6-d3f9-56ad-a55b-f873ed9b3ca8", "isPublic": true }, { "controlId": "CIP-004-7-R4", "title": "CIP-004-7-R4 — Access Management Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "984a7d78-199e-5804-bee4-d2d631463bb2", "isPublic": true }, { "controlId": "CIP-004-7-4.1", "title": "CIP-004-7-4.1 — Process to authorize based on need, as determined by the Responsible Entity, except for CIP Exceptional Circumstances", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d39d4866-67f8-5b75-a9db-9c8af455e063", "isPublic": true }, { "controlId": "CIP-004-7-4.1.1", "title": "CIP-004-7-4.1.1 — Electronic access", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a1106416-e0df-58cc-92bb-f95f855a3bba", "isPublic": true }, { "controlId": "CIP-004-7-4.1.2", "title": "CIP-004-7-4.1.2 — Unescorted physical access into a Physical Security Perimeter", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6d299155-d5e3-5b70-bbfb-0e85af414a1f", "isPublic": true }, { "controlId": "CIP-004-7-4.2", "title": "CIP-004-7-4.2 — Verify at least once each calendar quarter that individuals with active electronic access or unescorted physical acce...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c0f83c1c-456a-53c8-adfa-dc6bc795d0b8", "isPublic": true }, { "controlId": "CIP-004-7-4.3", "title": "CIP-004-7-4.3 — For electronic access, verify at least once every 15 calendar months that all user accounts, user account groups, or...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b48056dc-992e-5350-abb9-44f1e61fa37a", "isPublic": true }, { "controlId": "CIP-006-6-R1", "title": "CIP-006-6-R1 — Physical Security Plan", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "13f13ded-18a8-5594-b257-8ed15b434fa8", "isPublic": true }, { "controlId": "CIP-006-6-1.1", "title": "CIP-006-6-1.1 — Define operational or procedural controls to restrict physical access.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3370549a-7035-5060-9480-8bd28ffe8255", "isPublic": true }, { "controlId": "CIP-006-6-1.2", "title": "CIP-006-6-1.2 — Utilize at least one physical access control to allow unescorted physical access into each applicable Physical Securi...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2ea6b372-d7d2-5025-9c40-c4c776c7902a", "isPublic": true }, { "controlId": "CIP-006-6-1.3", "title": "CIP-006-6-1.3 — Where technically feasible, utilize two or more different physical access controls (this does not require two complet...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "adb58d2c-eb5b-57bc-a3a8-27731f164c07", "isPublic": true }, { "controlId": "CIP-006-6-1.4", "title": "CIP-006-6-1.4 — Monitor for unauthorized access through a physical access point into a Physical Security Perimeter.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8782cd61-1ce7-5e8c-9a44-ed059d258782", "isPublic": true }, { "controlId": "CIP-006-6-1.5", "title": "CIP-006-6-1.5 — Issue an alarm or alert in response to detected unauthorized access through a physical access point into a Physical S...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "16da713a-f013-50a9-a63b-04644b8e8105", "isPublic": true }, { "controlId": "CIP-006-6-1.6", "title": "CIP-006-6-1.6 — Monitor each Physical Access Control System for unauthorized physical access to a Physical Access Control System.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e0b61594-d0e2-564c-a179-a57225560544", "isPublic": true }, { "controlId": "CIP-006-6-1.7", "title": "CIP-006-6-1.7 — Issue an alarm or alert in response to detected unauthorized physical access to a Physical Access Control System to t...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f1747865-674f-51d6-82a4-962e8b11cf8f", "isPublic": true }, { "controlId": "CIP-006-6-1.8", "title": "CIP-006-6-1.8 — Log (through automated means or by personnel who control entry) entry of each individual with authorized unescorted p...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4c3e93d7-b51b-5d6c-bf3f-7d92629e9cc8", "isPublic": true }, { "controlId": "CIP-006-6-1.9", "title": "CIP-006-6-1.9 — Retain physical access logs of entry of individuals with authorized unescorted physical access into each Physical Sec...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "007da05b-6804-5b2b-8852-b5f8efec27fe", "isPublic": true }, { "controlId": "CIP-006-6-1.10", "title": "CIP-006-6-1.10 — Restrict physical access to cabling and other nonprogrammable communication components used for connection between ap...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c396ba79-b356-5314-b2e6-351f07f0658e", "isPublic": true }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "84830640-aae9-5e30-b10c-a6c64a078ed4", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "32f2756e-f8be-5c83-b204-c33dff22c203", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "9c2c6bca-e503-5777-8b33-9fffc33cc3c5", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "e79f21bb-b52a-5b38-8786-51fc76bc8166", "isPublic": true } ], "id": 31759, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731236", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731236", "catalogueId": 1062, "uuid": "5920b1cb-f411-560c-be37-c8c4420c3cbc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain a current list of personnel with authorized access to organizational facilities (except for those areas within the facility officially designated as publicly accessible)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Physical Access Authorizations", "description": "

Control Description

Physical access control mechanisms exist to maintain a current list of personnel with authorized access to organizational facilities (except for those areas within the facility officially designated as publicly accessible).

Evidence Request List (ERL)

E-HRS-28\nE-PES-03\nE-PES-05\nE-PES-10

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ The Human Resources (HR) department maintains a current list of personnel with authorized access to organizational facilities and facilitates the implementation of physical access management controls.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to maintain a current list of personnel with authorized access to organizational facilities (except for those areas within the facility officially designated as publicly accessible).

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.5.3, C.5.4
NERC-CIP (2026) Requirements: CIP-004-7-R4, CIP-006-6-R1", "controlId": "PES-02", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-02", "references": "

Micro-Small Business (<10 staff)

∙ Lock server room/data closet, limit key holders

Small Business (10-49 staff)

∙ Physical access controls to IT equipment locations\n∙ Visitor escort policy

Medium Business (50-249 staff)

∙ Formal physical access control program\n∙ Card access for sensitive areas\n∙ Visitor management

Large Business (250-999 staff)

∙ Enterprise physical access management\n∙ Multi-factor physical access for sensitive zones\n∙ Mantrap / tailgating controls

Enterprise (>1,000 staff)

∙ Enterprise physical access platform (e.g., Lenel S2, Genetec)\n∙ Multi-factor physical auth\n∙ Mantrap\n∙ Anti-tailgating controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73035, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590898", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590898", "securityControlId": 31760, "ccis": [], "uuid": "a3ac9f98-b212-56f2-819f-b80d38d4a3ae", "testId": "PES-02.1_A01", "test": "physical access to the facility where the system resides is authorized based on position or role.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-02(01)", "defaultText": null }, { "id": 73036, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590898", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590898", "securityControlId": 31760, "ccis": [], "uuid": "0e77045b-f86c-5c26-a6e5-78119c6180b7", "testId": "PES-02.1_A02", "test": "physical access restrictions associated with changes to the system are defined and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.04.05[01]", "defaultText": null }, { "id": 73037, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590899", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590899", "securityControlId": 31760, "ccis": [], "uuid": "920ae3c9-d737-5497-ada4-c2dcdd2b966b", "testId": "PES-02.1_A03", "test": "the frequency at which to review the access list detailing authorized facility access by individuals is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least annually or earlier as required by a security relevant event", "otherId": "171A_R3_A.03.10.01.ODP[01]", "defaultText": null }, { "id": 73038, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590899", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590899", "securityControlId": 31760, "ccis": [], "uuid": "a490a0da-962e-5198-a64c-1e1794be7c3a", "testId": "PES-02.1_A04", "test": "authorization credentials for facility access are issued.
PPTDF Applicability: Facility
Assessment Rigor: 2", "otherId": "171A_R3_A.03.10.01.b", "defaultText": null } ], "externalMappings": [ { "id": 590153, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a660521b-7f7c-59f4-8d3b-22792591a76e", "parentControlId": 31760, "controlId": "5.15", "title": "5.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587826" }, { "id": 590154, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef73cd09-7196-58ce-86de-90f6b87be022", "parentControlId": 31760, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587826" }, { "id": 590158, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "220dd462-e698-5216-8f08-29b01ae31c41", "parentControlId": 31760, "controlId": "PE-2(1)", "title": "PE-2(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587826" }, { "id": 590159, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50e86738-adaf-5c9e-96be-5617bf888eac", "parentControlId": 31760, "controlId": "PE-02(01)", "title": "PE-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587826" }, { "id": 590161, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8c38ae6-c929-5783-9515-78e5a893d66c", "parentControlId": 31760, "controlId": "PE-02(01)", "title": "PE-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587827" }, { "id": 590162, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f243df0-ded2-59e6-a01d-c5dcbb5c8504", "parentControlId": 31760, "controlId": "PE-2(1)", "title": "PE-2(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587827" }, { "id": 590165, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c4248b8-c71e-5219-ada8-561ffbeea9af", "parentControlId": 31760, "controlId": "3.10.1", "title": "3.10.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587827" }, { "id": 590166, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f34fb0fc-2594-5540-a6ea-11f2606f17c8", "parentControlId": 31760, "controlId": "03.08.01", "title": "03.08.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587827" }, { "id": 590167, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b254b682-a4b7-5c02-b620-f95ab37e09b0", "parentControlId": 31760, "controlId": "03.08.02", "title": "03.08.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587827" }, { "id": 590168, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efceabf4-e19d-5849-b935-d23381d4f44a", "parentControlId": 31760, "controlId": "03.10.01.b", "title": "03.10.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587827" }, { "id": 590169, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d8b4b09-aab4-58ce-a6ad-2dddb2c8e2e4", "parentControlId": 31760, "controlId": "03.10.01.d", "title": "03.10.01.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587828" }, { "id": 590173, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587828", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "645d7cf1-741b-549e-9e1f-b7848fc2bca3", "parentControlId": 31760, "controlId": "PR.AA-06", "title": "PR.AA-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587828" }, { "id": 590195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58783", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0ca4aae-71e9-5713-9cf4-1e232580612d", "parentControlId": 31760, "controlId": "ACCESS-3e", "title": "ACCESS-3e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58783" }, { "id": 590196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58783", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82291775-a634-5cdb-bd5d-0d31c7796664", "parentControlId": 31760, "controlId": "ACCESS-3f", "title": "ACCESS-3f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587831" }, { "id": 590203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea09fe1a-e457-5b30-a458-3dfd75c50402", "parentControlId": 31760, "controlId": "CIP-006-6 1.2", "title": "CIP-006-6 1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587831" } ], "id": 31760, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731236", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731236", "catalogueId": 1062, "uuid": "256b4972-56d1-5785-81da-250323e3973f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization authorize physical access to facilities based on the position or role of the individual?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Role-Based Physical Access", "description": "

Control Description

Physical access control mechanisms exist to authorize physical access to facilities based on the position or role of the individual.

Evidence Request List (ERL)

E-PES-03\nE-PES-05\nE-PES-10

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPhysical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ The Human Resources (HR) department maintains a current list of personnel with authorized access to organizational facilities and facilitates the implementation of physical access management controls.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to authorize physical access to facilities based on the position or role of the individual.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "PES-02.1", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Visitor sign-in log and escort policy

Small Business (10-49 staff)

∙ Visitor management policy\n∙ Escort requirement for all visitors in sensitive areas

Medium Business (50-249 staff)

∙ Formal visitor management program\n∙ Visitor registration, badging, and escort

Large Business (250-999 staff)

∙ Enterprise visitor management system (e.g., Envoy, Proxyclick)\n∙ Escort enforcement\n∙ Badge issuance

Enterprise (>1,000 staff)

∙ Enterprise visitor management platform (e.g., Lenel/Envoy integration)\n∙ Automated visitor pre-registration\n∙ Background check integration", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73039, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590899", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590899", "securityControlId": 31761, "ccis": [], "uuid": "fee10b47-f6a2-5e70-bf96-ad3af179c630", "testId": "PES-02.2_A01", "test": "a \"two-person rule\" is enforced for physical access by requiring two authorized individuals with separate access cards, keys or PINs, to access highly-sensitive areas (e.g., safe, high-security cage, etc.).
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 590224, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587834", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4caaf3d-1e89-514b-bc11-e7d900b39c9a", "parentControlId": 31761, "controlId": "ACCESS-3f", "title": "ACCESS-3f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587834" } ], "id": 31761, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731237", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731237", "catalogueId": 1062, "uuid": "055524b2-65be-54ef-a311-033e69a4110d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce a \"two-person rule\" for physical access by requiring two authorized individuals with separate access cards, keys or PINs, to access highly-sensitive areas (e.g., safe, high-security cage, etc.)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Dual Authorization for Physical Access", "description": "

Control Description

Mechanisms exist to enforce a \"two-person rule\" for physical access by requiring two authorized individuals with separate access cards, keys or PINs, to access highly-sensitive areas (e.g., safe, high-security cage, etc.).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPhysical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enforce a \"two-person rule\" for physical access by requiring two authorized individuals with separate access cards, keys or PINs, to access highly-sensitive areas (e.g., safe, high-security cage, etc.).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-02.2", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-02.2", "references": "

Micro-Small Business (<10 staff)

∙ Require visitors to sign out when leaving

Small Business (10-49 staff)

∙ Visitor sign-out procedure\n∙ Retrieve visitor badge upon departure

Medium Business (50-249 staff)

∙ Formal visitor checkout procedure\n∙ Badge return verification

Large Business (250-999 staff)

∙ Enterprise visitor management with automated checkout tracking

Enterprise (>1,000 staff)

∙ Enterprise visitor management platform with automated checkout workflows and real-time occupancy tracking", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73040, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590899", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590899", "securityControlId": 31762, "ccis": [], "uuid": "a7ffcb0d-c7df-57cd-a21d-f3e2fdadd375", "testId": "PES-03_A01", "test": "physical access controls to control access to areas within the facility designated as publicly accessible are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-03_ODP[05]", "defaultText": null }, { "id": 73041, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5909", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5909", "securityControlId": 31762, "ccis": [], "uuid": "63ca7da6-9097-5684-bf71-da953315ea76", "testId": "PES-03_A02", "test": "physical access authorizations are enforced at entry and exit points to the facility where the system resides by controlling ingress and egress with physical access control systems, devices, or guards.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-03a.01\n171A_R3_A.03.10.07.a.02", "defaultText": null }, { "id": 73042, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5909", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5909", "securityControlId": 31762, "ccis": [], "uuid": "42def792-1dd8-5bca-bfcf-d7f131c71c5a", "testId": "PES-03_A03", "test": "entry and exit points to the facility in which the system resides are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PE-03_ODP[01]", "defaultText": null }, { "id": 73043, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5909", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5909", "securityControlId": 31762, "ccis": [], "uuid": "97ea8ffc-f674-58f8-93c1-418e4263d568", "testId": "PES-03_A04", "test": "entry or exit points for which physical access logs are maintained are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PE-03_ODP[04]", "defaultText": null }, { "id": 73044, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5909", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5909", "securityControlId": 31762, "ccis": [], "uuid": "47b20d92-3fdf-524a-a924-c3ee34baeda6", "testId": "PES-03_A05", "test": "physical access devices are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.10.5[a]\n53A_R5_PE-03_ODP[02]\n53A_R5_PE-03_ODP[03]", "defaultText": null }, { "id": 73045, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5909", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5909", "securityControlId": 31762, "ccis": [], "uuid": "f2bb54a1-e339-5bd2-bc47-2a999aa47309", "testId": "PES-03_A06", "test": "physical access devices are controlled.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "171A_3.10.5[b]", "defaultText": null }, { "id": 73046, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5909", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590901", "securityControlId": 31762, "ccis": [], "uuid": "30943a46-96b7-5e5a-8007-f4ce38a2f52b", "testId": "PES-03_A07", "test": "physical access devices are managed.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "171A_3.10.5[c]", "defaultText": null }, { "id": 73047, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590901", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590901", "securityControlId": 31762, "ccis": [], "uuid": "3b158465-9999-5887-9869-abb9e2297270", "testId": "PES-03_A08", "test": "circumstances requiring visitor escorts and control of visitor activity are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PE-03_ODP[06]", "defaultText": null }, { "id": 73048, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590901", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590901", "securityControlId": 31762, "ccis": [], "uuid": "fe5bbae3-68c4-5f94-a7ee-0074e5afc920", "testId": "PES-03_A09", "test": "physical access devices to be inventoried are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PE-03_ODP[07]", "defaultText": null }, { "id": 73049, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590901", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590901", "securityControlId": 31762, "ccis": [], "uuid": "2474c354-33d9-5469-9d6b-93072e06c314", "testId": "PES-03_A10", "test": "frequency at which to inventory physical access devices is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually or earlier as required by a security relevant event", "otherId": "53A_R5_PE-03_ODP[08]", "defaultText": null }, { "id": 73050, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590901", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590901", "securityControlId": 31762, "ccis": [], "uuid": "42778b0a-2d41-5494-9333-6269b7dba02e", "testId": "PES-03_A11", "test": "frequency at which to change combinations is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: as required by a security relevant event", "otherId": "53A_R5_PE-03_ODP[09]", "defaultText": null }, { "id": 73051, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590901", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590901", "securityControlId": 31762, "ccis": [], "uuid": "50c08472-6da3-5387-99ee-952d1f196129", "testId": "PES-03_A12", "test": "frequency at which to change keys is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: as required by a security relevant event", "otherId": "53A_R5_PE-03_ODP[10]", "defaultText": null }, { "id": 73052, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590901", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590901", "securityControlId": 31762, "ccis": [], "uuid": "079cc25e-eefa-586e-a7f1-f62427eb81ed", "testId": "PES-03_A13", "test": "physical access authorizations are enforced at entry and exit points by controlling ingress and egress to the facility.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-03a.02", "defaultText": null }, { "id": 73053, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590902", "securityControlId": 31762, "ccis": [], "uuid": "27e55b0a-5895-5886-b8ec-e47b9de1d517", "testId": "PES-03_A14", "test": "physical access event logs are maintained for entry or exit points.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-03b.", "defaultText": null }, { "id": 73054, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590902", "securityControlId": 31762, "ccis": [], "uuid": "01e55205-6d24-58e6-8ea7-20b104ed919f", "testId": "PES-03_A15", "test": "access to areas within the facility designated as publicly accessible are maintained by implementing physical access controls.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-03c.", "defaultText": null }, { "id": 73055, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590902", "securityControlId": 31762, "ccis": [], "uuid": "b1bca425-7038-55d5-b450-d12aa37b0728", "testId": "PES-03_A16", "test": "visitors are escorted.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-03d.[01]", "defaultText": null }, { "id": 73056, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590902", "securityControlId": 31762, "ccis": [], "uuid": "704411b7-066e-51ee-98f4-c74c2dac4670", "testId": "PES-03_A17", "test": "visitor activity is controlled circumstances.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-03d.[02]", "defaultText": null }, { "id": 73057, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590902", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590902", "securityControlId": 31762, "ccis": [], "uuid": "f764a854-6c7e-53b2-8bbb-8b93ef69d9ff", "testId": "PES-03_A18", "test": "physical access devices are inventoried frequently.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually or earlier as required by a security relevant event", "otherId": "53A_R5_PE-03f.", "defaultText": null }, { "id": 73058, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590903", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590903", "securityControlId": 31762, "ccis": [], "uuid": "e682a799-895e-59c1-9e53-c22205a268a0", "testId": "PES-03_A19", "test": "combinations are changed frequently, when combinations are compromised or when individuals possessing the combinations are transferred or terminated.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: as required by a security relevant event", "otherId": "53A_R5_PE-03g.[01]", "defaultText": null }, { "id": 73059, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590903", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590903", "securityControlId": 31762, "ccis": [], "uuid": "6739ee7a-cf3f-585e-adc5-85c490f41370", "testId": "PES-03_A20", "test": "keys are changed frequency, when keys are lost or when individuals possessing the keys are transferred or terminated.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: as required by a security relevant event", "otherId": "53A_R5_PE-03g.[02]", "defaultText": null }, { "id": 73060, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590903", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590903", "securityControlId": 31762, "ccis": [], "uuid": "9a6671c7-e354-57e3-bd0d-23f864783483", "testId": "PES-03_A21", "test": "the frequency at which to perform security checks at the physical perimeter of the facility or system for exfiltration of information or removal of system components is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PE-03(02)_ODP", "defaultText": null }, { "id": 73061, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590903", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590903", "securityControlId": 31762, "ccis": [], "uuid": "157aa63b-d7c8-5c09-9cbd-9f6065b72fd8", "testId": "PES-03_A22", "test": "security checks are performed C at the physical perimeter of the facility or system for exfiltration of information or removal of system components.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PE-03(02)", "defaultText": null }, { "id": 73062, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590905", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590905", "securityControlId": 31762, "ccis": [], "uuid": "355169fe-e8fe-5220-b59b-1695f9f67623", "testId": "PES-03_A23", "test": "physical access points to the facility where the system resides are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PE-03(03)_ODP", "defaultText": null }, { "id": 73063, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590905", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590905", "securityControlId": 31762, "ccis": [], "uuid": "8d8addbd-004c-5cdf-a49a-8d5871ba2299", "testId": "PES-03_A24", "test": "guards are employed to control physical access points to the facility where the system resides 24 hours per day, 7 days per week.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-03(03)", "defaultText": null }, { "id": 73064, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590905", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590905", "securityControlId": 31762, "ccis": [], "uuid": "f36924d9-0956-5c90-88af-15cfde2dacbd", "testId": "PES-03_A25", "test": "physical access restrictions associated with changes to the system are enforced.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.04.05[03]", "defaultText": null }, { "id": 73065, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590906", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590906", "securityControlId": 31762, "ccis": [], "uuid": "a73a0720-c54c-54f7-a17f-b2c5b4618dda", "testId": "PES-03_A26", "test": "keys, combinations, and other physical access devices are secured.
PPTDF Applicability: Facility
Assessment Rigor: 2", "otherId": "171A_R3_A.03.10.07.d\n53A_R5_PE-03e.[01]\n53A_R5_PE-03e.[02]\n53A_R5_PE-03e.[03]", "defaultText": null } ], "externalMappings": [ { "id": 590240, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587836", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4b28529-88b7-5e98-8386-a2df8f567bea", "parentControlId": 31762, "controlId": "5.15", "title": "5.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587836" }, { "id": 590241, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587836", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b28e5133-b9b0-5e1d-af8c-a2f748d56415", "parentControlId": 31762, "controlId": "5.18", "title": "5.18", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587836" }, { "id": 590242, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587836", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7aa9c01-1b7d-51f2-a7ab-97293bdc0b0b", "parentControlId": 31762, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587836" }, { "id": 590243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587836", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49a4029c-8b34-5968-b560-ced1e990154e", "parentControlId": 31762, "controlId": "7.4", "title": "7.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587836" }, { "id": 590254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d142735-f766-51b2-a44a-a90d01580f2c", "parentControlId": 31762, "controlId": "PE-3", "title": "PE-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587837" }, { "id": 590255, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f4c5b9b-c678-5a20-b9df-b56f8ecc1d7d", "parentControlId": 31762, "controlId": "PE-3(2)", "title": "PE-3(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587838" }, { "id": 590256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "041993d2-431e-55e7-82db-3a4d25982618", "parentControlId": 31762, "controlId": "PE-3(3)", "title": "PE-3(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587838" }, { "id": 590257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "862981e1-d7ec-5c89-9564-4f9d84ee187f", "parentControlId": 31762, "controlId": "PE-03", "title": "PE-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587838" }, { "id": 590258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87eff807-7d7e-5450-a861-d38d7dac092e", "parentControlId": 31762, "controlId": "PE-03(02)", "title": "PE-03(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587838" }, { "id": 590259, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f912fb2e-fb5b-5b04-8e09-28f65e17af04", "parentControlId": 31762, "controlId": "PE-03(03)", "title": "PE-03(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587838" }, { "id": 590260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86d6e784-0f34-5469-8425-8f9c474c6c9a", "parentControlId": 31762, "controlId": "PE-03", "title": "PE-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587838" }, { "id": 590263, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ffc7c3c-cf83-5a6b-a7f9-e1c75478867f", "parentControlId": 31762, "controlId": "PE-03", "title": "PE-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587838" }, { "id": 590264, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "187494fe-2dbf-54cd-97b3-b412fa095918", "parentControlId": 31762, "controlId": "PE-03(02)", "title": "PE-03(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587839" }, { "id": 590265, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3903e732-670e-5960-a6d2-4859ba8631f0", "parentControlId": 31762, "controlId": "PE-03(03)", "title": "PE-03(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587839" }, { "id": 590266, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5aed506-68fe-5b7b-ae91-c97099d4d538", "parentControlId": 31762, "controlId": "PE-03", "title": "PE-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587839" }, { "id": 590267, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce2af6d2-c837-53cc-9dc4-9000a8b4a608", "parentControlId": 31762, "controlId": "PE-03", "title": "PE-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587839" }, { "id": 590268, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d58772e-a404-5c2e-8dce-6f4f535f0a6e", "parentControlId": 31762, "controlId": "PE-03", "title": "PE-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587839" }, { "id": 590269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d430126e-bee5-561c-8e2b-031ac6bfa9ca", "parentControlId": 31762, "controlId": "PE-3", "title": "PE-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587839" }, { "id": 590270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "126d272f-a231-5b6b-b414-8968a0d28abc", "parentControlId": 31762, "controlId": "PE-3(2)", "title": "PE-3(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587839" }, { "id": 590271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a1695ae-dc3d-502e-b6bd-c1cd8c7fb69f", "parentControlId": 31762, "controlId": "PE-3", "title": "PE-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587839" }, { "id": 590276, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd506b7b-99bc-538f-a944-5b1837b73f5f", "parentControlId": 31762, "controlId": "3.10.3", "title": "3.10.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58784" }, { "id": 590277, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e5ce9f9-1cfe-56cd-9339-e23275338650", "parentControlId": 31762, "controlId": "3.10.5", "title": "3.10.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58784" }, { "id": 590278, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4aedf427-6759-5a15-8800-ede1e01c59c5", "parentControlId": 31762, "controlId": "03.10.02.a", "title": "03.10.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58784" }, { "id": 590279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36300d5b-47dd-5158-8dff-13f7e3b8edd3", "parentControlId": 31762, "controlId": "03.10.07.a", "title": "03.10.07.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58784" }, { "id": 590280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79bbd21e-6550-54fa-9907-af813b215fcd", "parentControlId": 31762, "controlId": "03.10.07.a.01", "title": "03.10.07.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58784" }, { "id": 590281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7da13112-736f-5e4c-96a3-6ff37043f7f6", "parentControlId": 31762, "controlId": "03.10.07.a.02", "title": "03.10.07.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587841" }, { "id": 590282, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89416759-8c71-52ad-8ca1-3991ee16b6db", "parentControlId": 31762, "controlId": "03.10.07.d", "title": "03.10.07.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587841" }, { "id": 590290, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "470a0071-39ea-5bf0-8fa0-6015fe16b5af", "parentControlId": 31762, "controlId": "PR.AA", "title": "PR.AA", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587842" }, { "id": 590291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c44895c-967a-5409-bc61-4c73859b368e", "parentControlId": 31762, "controlId": "PR.AA-06", "title": "PR.AA-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587842" }, { "id": 590292, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "351a3293-ca73-5a8c-8fbd-7b9601d4925c", "parentControlId": 31762, "controlId": "DE.CM-02", "title": "DE.CM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587842" }, { "id": 590308, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bbfe478-c2bb-55ca-ac5e-5d4611039634", "parentControlId": 31762, "controlId": "ACCESS-3a", "title": "ACCESS-3a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587844" }, { "id": 590309, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a70fa3e2-3614-5b0d-8b29-f6b4fc7e84a3", "parentControlId": 31762, "controlId": "ACCESS-3d", "title": "ACCESS-3d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587844" }, { "id": 590310, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c004e6b5-21fd-528a-b19d-473236a39a63", "parentControlId": 31762, "controlId": "ACCESS-3e", "title": "ACCESS-3e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587844" }, { "id": 590311, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "659f8d6c-1147-51e7-8ab8-58c6ab444cfa", "parentControlId": 31762, "controlId": "ACCESS-3f", "title": "ACCESS-3f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587844" }, { "id": 590312, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0952ad4c-c8a2-5d8e-a0f9-8179d5dc5c33", "parentControlId": 31762, "controlId": "ACCESS-3g", "title": "ACCESS-3g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587844" }, { "id": 590313, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e95bb260-f033-5973-ad1d-6930582356a4", "parentControlId": 31762, "controlId": "ACCESS-3j", "title": "ACCESS-3j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587844" }, { "id": 590348, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587856", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0520f149-0664-5ad8-a508-b8501a1badff", "parentControlId": 31762, "controlId": "CIP-006-6 1.1", "title": "CIP-006-6 1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587856" }, { "id": 590349, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587856", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef94bc0f-039e-51cf-8354-ec4ee4fef91e", "parentControlId": 31762, "controlId": "CIP-006-6 1.3", "title": "CIP-006-6 1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587856" }, { "id": 590350, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587856", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d34af87-4c5b-5137-9f9d-7e8094af6322", "parentControlId": 31762, "controlId": "CIP-006-6 1.5", "title": "CIP-006-6 1.5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587857" }, { "id": 590351, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587857", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3227d062-7283-5ecc-a8fa-b42478da9c33", "parentControlId": 31762, "controlId": "CIP-006-6 1.10", "title": "CIP-006-6 1.10", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587857" }, { "id": 590352, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587857", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81d20e22-d39a-59ab-a347-6252b00d719d", "parentControlId": 31762, "controlId": "§117.15(e)(4)", "title": "§117.15(e)(4)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587857" }, { "controlId": "C.5.2", "title": "C.5.2 — Third Party/Escorted Access", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-3, PE-8, MA-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "7bc7478b-4ac6-5849-baba-e2a7e339cd9c", "isPublic": true }, { "controlId": "NEI 08-09 App E.5.2", "title": "NEI 08-09 App E.5.2 — Third Party/Escorted Access", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.5.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "0d613695-5081-5f3c-b238-7dcf2097727d", "isPublic": true }, { "controlId": "10 CFR 73.55(g)", "title": "10 CFR 73.55(g) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.5.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "b7ca794f-7310-5889-9b64-c7832842b5d9", "isPublic": true }, { "controlId": "C.5.3", "title": "C.5.3 — Physical and Environmental Protection", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-2, PE-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "3fa4b72f-f1c3-5b75-a88a-c6a50efa4764", "isPublic": true }, { "controlId": "NEI 08-09 App E.5.3", "title": "NEI 08-09 App E.5.3 — Physical and Environmental Protection", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.5.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "b557db47-de18-5332-bef3-8561e94389fb", "isPublic": true }, { "controlId": "10 CFR 73.55", "title": "10 CFR 73.55 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.5.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "f5d08b4f-2926-54dd-b118-854fe5a011ed", "isPublic": true }, { "controlId": "C.5.5", "title": "C.5.5 — Physical Access Control", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "d5176325-673a-56b7-8915-86369fb2a634", "isPublic": true }, { "controlId": "NEI 08-09 App E.5.5", "title": "NEI 08-09 App E.5.5 — Physical Access Control", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.5.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6ee16698-775c-5a58-a06e-cd7fe8941294", "isPublic": true }, { "controlId": "CIP-006-6-R1", "title": "CIP-006-6-R1 — Physical Security Plan", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c0712b4a-3043-5714-b98f-e789acb5f821", "isPublic": true }, { "controlId": "CIP-006-6-1.1", "title": "CIP-006-6-1.1 — Define operational or procedural controls to restrict physical access.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "81701b75-f290-55bb-bd06-8fda785c7baf", "isPublic": true }, { "controlId": "CIP-006-6-1.2", "title": "CIP-006-6-1.2 — Utilize at least one physical access control to allow unescorted physical access into each applicable Physical Securi...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2b5759e2-bbde-58da-adac-b18e293f6495", "isPublic": true }, { "controlId": "CIP-006-6-1.3", "title": "CIP-006-6-1.3 — Where technically feasible, utilize two or more different physical access controls (this does not require two complet...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5fd784cc-32f5-50e0-891c-c7fada9a38e5", "isPublic": true }, { "controlId": "CIP-006-6-1.4", "title": "CIP-006-6-1.4 — Monitor for unauthorized access through a physical access point into a Physical Security Perimeter.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b27cdc2d-e3d0-51f3-a56f-d576b9919ca7", "isPublic": true }, { "controlId": "CIP-006-6-1.5", "title": "CIP-006-6-1.5 — Issue an alarm or alert in response to detected unauthorized access through a physical access point into a Physical S...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c354722b-3fc0-5681-bf7b-8f9d69eb3620", "isPublic": true }, { "controlId": "CIP-006-6-1.6", "title": "CIP-006-6-1.6 — Monitor each Physical Access Control System for unauthorized physical access to a Physical Access Control System.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a0a15fde-9459-5445-bed4-f7324e4fe75f", "isPublic": true }, { "controlId": "CIP-006-6-1.7", "title": "CIP-006-6-1.7 — Issue an alarm or alert in response to detected unauthorized physical access to a Physical Access Control System to t...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "900fdd1a-6a21-5e73-ae99-eca17b19c41d", "isPublic": true }, { "controlId": "CIP-006-6-1.8", "title": "CIP-006-6-1.8 — Log (through automated means or by personnel who control entry) entry of each individual with authorized unescorted p...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8d7eaa61-eca9-596d-a1a4-2cea6b1f8120", "isPublic": true }, { "controlId": "CIP-006-6-1.9", "title": "CIP-006-6-1.9 — Retain physical access logs of entry of individuals with authorized unescorted physical access into each Physical Sec...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d96327ed-9865-5c56-991b-5f8f886b2abd", "isPublic": true }, { "controlId": "CIP-006-6-1.10", "title": "CIP-006-6-1.10 — Restrict physical access to cabling and other nonprogrammable communication components used for connection between ap...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "84e24e36-04d9-5478-b7e1-996d87ad8d14", "isPublic": true }, { "controlId": "CIP-006-6-R2", "title": "CIP-006-6-R2 — Visitor Control Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9563f8f7-b6cf-525b-a654-e64061b2f1cb", "isPublic": true }, { "controlId": "CIP-006-6-2.1", "title": "CIP-006-6-2.1 — Require continuous escorted access of visitors (individuals who are provided access but are not authorized for unesco...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a1a84f00-9045-5654-989e-9e852a89b6d1", "isPublic": true }, { "controlId": "CIP-006-6-2.2", "title": "CIP-006-6-2.2 — Require manual or automated logging of visitor entry into and exit from the Physical Security Perimeter that includes...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "76edaf78-88b7-529e-86bb-ddf496205b64", "isPublic": true }, { "controlId": "CIP-006-6-2.3", "title": "CIP-006-6-2.3 — Retain visitor logs for at least ninety calendar days.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f7a8a43a-877a-5ca4-a21a-01449f4f53ec", "isPublic": true }, { "controlId": "CIP-014-3-R5", "title": "CIP-014-3-R5 — Physical Security Plan Development and Implementation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "256e5379-a465-5872-8757-6287a71e2eba", "isPublic": true }, { "controlId": "CIP-014-3-5.1", "title": "CIP-014-3-5.1 — Resiliency or security measures designed collectively to deter, detect, delay, assess, communicate, and respond to po...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2f648e1a-83cd-5d58-92e3-70975c0f243d", "isPublic": true }, { "controlId": "CIP-014-3-5.2", "title": "CIP-014-3-5.2 — Law enforcement contact and coordination information.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "29eb7b2b-98df-5fe0-97ec-24edffff5268", "isPublic": true }, { "controlId": "CIP-014-3-5.3", "title": "CIP-014-3-5.3 — A timeline for executing the physical security enhancements and modifications specified in the physical security plan.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "da5476d5-dffe-5cc0-843e-6a5944531163", "isPublic": true }, { "controlId": "CIP-014-3-5.4", "title": "CIP-014-3-5.4 — Provisions to evaluate evolving physical threats, and their corresponding security measures, to the Transmission stat...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c95e231f-8acb-5352-823f-3ad7f1ccbac7", "isPublic": true }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "bb10ba04-4586-5915-a38c-9b8e57c7b98a", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "9a1713a4-69ff-5ed9-9a7b-7c5b8a23d296", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "a18b5508-4903-5e5c-b0ae-98ba96081889", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "defd8c8d-5526-5ef9-955c-60ee4d6cee29", "isPublic": true } ], "id": 31762, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731237", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731237", "catalogueId": 1062, "uuid": "c31b8f28-f440-5255-b07c-b1be2dcdc7c4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Physical Access Control", "description": "

Control Description

Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).

Evidence Request List (ERL)

E-PES-05\nE-PES-06\nE-PES-07\nE-PES-08\nE-PES-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPhysical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Physical security controls and technologies ensure that only authorized personnel are allowed access to secure areas.\n▪ A facilities maintenance team, or similar function, manages the operation of automated physical and environmental protection controls.\n▪ Physical security controls and technologies are configured to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.5.2, C.5.3, C.5.5
NERC-CIP (2026) Requirements: CIP-006-6-R1, CIP-006-6-R2, CIP-014-3-R5", "controlId": "PES-03", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-03", "references": "

Micro-Small Business (<10 staff)

∙ Physical security policy\n∙ Door locks and key management

Small Business (10-49 staff)

∙ Physical security policy\n∙ Access log\n∙ Visitor procedures

Medium Business (50-249 staff)

∙ Staffed lobby (receptionist)\n∙ Physical security guards\n∙ Verify individual access authorizations before granting access to the facility.\n∙ Control entry to the facility containing the system using physical access devices and/or guards.\n∙ Control access to areas officially designated as publicly accessible in accordance with the organization's assessment of risk.\n∙ Secure keys, combinations and other physical access devices.

Large Business (250-999 staff)

∙ Staffed lobby (receptionist)\n∙ Physical security guards\n∙ Verify individual access authorizations before granting access to the facility.\n∙ Control entry to the facility containing the system using physical access devices and/or guards.\n∙ Control access to areas officially designated as publicly accessible in accordance with the organization's assessment of risk.\n∙ Secure keys, combinations and other physical access devices.

Enterprise (>1,000 staff)

∙ Staffed lobby (receptionist)\n∙ Physical security guards\n∙ Verify individual access authorizations before granting access to the facility.\n∙ Control entry to the facility containing the system using physical access devices and/or guards.\n∙ Control access to areas officially designated as publicly accessible in accordance with the organization's assessment of risk.\n∙ Secure keys, combinations and other physical access devices.", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73066, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590906", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590906", "securityControlId": 31763, "ccis": [], "uuid": "844d6e0d-38fd-5c1c-b618-f3e73e97b7f8", "testId": "PES-03.1_A01", "test": "physical access control mechanisms limit physical access through controlled ingress and egress points.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73067, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590906", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590906", "securityControlId": 31763, "ccis": [], "uuid": "a73cb0fb-7129-5b49-9f66-740c828f8b2c", "testId": "PES-03.1_A02", "test": "physical access control mechanisms monitor physical access through controlled ingress and egress points.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 590406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587863", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7bf6a5d5-e7cc-5ff3-9f0d-6437bcad25fc", "parentControlId": 31763, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587863" }, { "id": 590407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "348bc3fc-acca-5aab-8a6f-a36a335446df", "parentControlId": 31763, "controlId": "7.2", "title": "7.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587864" }, { "id": 590413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "582b6722-aab9-5935-aa72-816aaa318ae4", "parentControlId": 31763, "controlId": "03.10.02.a", "title": "03.10.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587864" }, { "id": 590414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40044dc9-c8f2-5792-9da5-3770e65ab9ba", "parentControlId": 31763, "controlId": "03.10.07.a", "title": "03.10.07.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587864" }, { "id": 590415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd16846f-91d2-57b8-b68e-340635132a58", "parentControlId": 31763, "controlId": "03.10.07.a.02", "title": "03.10.07.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587864" }, { "id": 590427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587866", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1847e44-47c6-5717-b4f0-3c0282710016", "parentControlId": 31763, "controlId": "CIP-006-6 1.5", "title": "CIP-006-6 1.5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587866" } ], "id": 31763, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731237", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731237", "catalogueId": 1062, "uuid": "45e03a97-bb8d-56f4-aa3d-e9913c5fa083", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization limit and monitor physical access through controlled ingress and egress points?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Controlled Ingress & Egress Points", "description": "

Control Description

Physical access control mechanisms exist to limit and monitor physical access through controlled ingress and egress points.

Evidence Request List (ERL)

E-PES-12

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Physical security controls and technologies ensure that only authorized personnel are allowed access to secure areas.\n▪ Physical security controls and technologies are configured to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).\n▪ Where applicable, physical security controls and technologies are configured to generate a log entry for each access attempt through controlled ingress and egress points.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to limit and monitor physical access through controlled ingress and egress points.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-03.1", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Physical security policy\n∙ Door locks and key management

Small Business (10-49 staff)

∙ Physical security policy\n∙ Access log\n∙ Visitor procedures

Medium Business (50-249 staff)

∙ Control entry to the facility containing the system using physical access devices and/or guards.\n∙ Control access to areas officially designated as publicly accessible in accordance with the organization's assessment of risk.

Large Business (250-999 staff)

∙ Control entry to the facility containing the system using physical access devices and/or guards.\n∙ Control access to areas officially designated as publicly accessible in accordance with the organization's assessment of risk.

Enterprise (>1,000 staff)

∙ Control entry to the facility containing the system using physical access devices and/or guards.\n∙ Control access to areas officially designated as publicly accessible in accordance with the organization's assessment of risk.", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73068, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590906", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590906", "securityControlId": 31764, "ccis": [], "uuid": "bba65b02-8165-5d4c-9f18-9e9c63495b8e", "testId": "PES-03.2_A01", "test": "system components to be protected from unauthorized physical access are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-03(04)_ODP", "defaultText": null }, { "id": 73069, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590907", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590907", "securityControlId": 31764, "ccis": [], "uuid": "b0d0cf82-d05e-5673-922e-19b66b34d847", "testId": "PES-03.2_A02", "test": "lockable physical casings are used to protect system components from unauthorized access.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-03(04)", "defaultText": null } ], "externalMappings": [ { "id": 590441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fda1c00-1d5e-5fe5-a374-af9b58baa308", "parentControlId": 31764, "controlId": "PE-3(4)", "title": "PE-3(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587868" }, { "id": 590442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46c27343-c8a9-5c14-8d14-4f7bc2299555", "parentControlId": 31764, "controlId": "SC-7(14)", "title": "SC-7(14)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587868" }, { "id": 590443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5c7e285-92e4-5e3c-9066-0b8384f7315e", "parentControlId": 31764, "controlId": "PE-03(04)", "title": "PE-03(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587868" }, { "id": 590444, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5992c66-7846-5e9d-b3a4-424aad103946", "parentControlId": 31764, "controlId": "SC-07(14)", "title": "SC-07(14)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587868" }, { "id": 590446, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7386520-4111-54b1-97fa-b4ef6f7515cc", "parentControlId": 31764, "controlId": "PE-03(04)", "title": "PE-03(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587868" }, { "id": 590447, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66c5b526-38eb-51e5-87fc-020bd1311fb8", "parentControlId": 31764, "controlId": "SC-07(14)", "title": "SC-07(14)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587868" }, { "id": 590448, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c2cdbb6-bbec-5c8d-b914-bf751fabb115", "parentControlId": 31764, "controlId": "SC-7(14)", "title": "SC-7(14)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587868" } ], "id": 31764, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731238", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731238", "catalogueId": 1062, "uuid": "2f4c5032-54da-5edb-acc0-1535e51bc787", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect system components from unauthorized physical access (e.g., lockable physical casings)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Lockable Physical Casings", "description": "

Control Description

Physical access control mechanisms exist to protect system components from unauthorized physical access (e.g., lockable physical casings).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to protect system components from unauthorized physical access (e.g., lockable physical casings).

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-03.2", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-03.2", "references": "

Micro-Small Business (<10 staff)

∙ Keep server room cool and document temperature requirements

Small Business (10-49 staff)

∙ Temperature and humidity monitoring for IT equipment rooms

Medium Business (50-249 staff)

∙ Environmental monitoring system for temperature and humidity

Large Business (250-999 staff)

∙ Enterprise environmental monitoring system (e.g., APC, Schneider Electric)\n∙ Automated alerting

Enterprise (>1,000 staff)

∙ Enterprise DCIM/environmental monitoring platform (e.g., Nlyte, Schneider EcoStruxure)\n∙ Redundant sensors\n∙ Automated HVAC controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73070, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590907", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590907", "securityControlId": 31765, "ccis": [], "uuid": "6da74e92-273d-5bb8-8eaa-8450e36527d9", "testId": "PES-03.3_A01", "test": "physical access audit logs for entry or exit points are maintained.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "171A_3.10.4\n171A_R3_A.03.10.07.b", "defaultText": null }, { "id": 73071, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590907", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590907", "securityControlId": 31765, "ccis": [], "uuid": "fc69c311-e8ac-53d5-9bef-e6ac6ea41dbc", "testId": "PES-03.3_A02", "test": "time period for which to maintain visitor access records for the facility where the system resides is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: for a minimum of one (1) year", "otherId": "53A_R5_PE-08_ODP[01]", "defaultText": null }, { "id": 73072, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590907", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590907", "securityControlId": 31765, "ccis": [], "uuid": "af2b914d-b1b7-5c59-91ac-f2a20c3a3af3", "testId": "PES-03.3_A03", "test": "visitor access records for the facility where the system resides are maintained for time period.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: for a minimum of one (1) year", "otherId": "53A_R5_PE-08a.", "defaultText": null }, { "id": 73073, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590907", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590907", "securityControlId": 31765, "ccis": [], "uuid": "4c7012c7-8cae-5314-a39b-61af45e131bb", "testId": "PES-03.3_A04", "test": "the frequency at which to review visitor access records is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least monthly", "otherId": "53A_R5_PE-08_ODP[02]", "defaultText": null }, { "id": 73074, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590908", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590908", "securityControlId": 31765, "ccis": [], "uuid": "cb782bab-bc12-536b-ac1f-84452345361c", "testId": "PES-03.3_A05", "test": "visitor access records are reviewed frequently.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least monthly", "otherId": "53A_R5_PE-08b.", "defaultText": null }, { "id": 73075, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590908", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590908", "securityControlId": 31765, "ccis": [], "uuid": "9a9f2ed2-1b36-548a-ace0-a8b244158566", "testId": "PES-03.3_A06", "test": "personnel to whom visitor access records anomalies are reported to is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PE-08_ODP[03]", "defaultText": null }, { "id": 73076, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590908", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590908", "securityControlId": 31765, "ccis": [], "uuid": "04c8c229-3d02-5fe3-a263-d67d6c04f73b", "testId": "PES-03.3_A07", "test": "visitor access records anomalies are reported to personnel.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PE-08c.", "defaultText": null }, { "id": 73077, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590908", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590908", "securityControlId": 31765, "ccis": [], "uuid": "fc4c55c0-0481-543e-aaea-15d017f3490c", "testId": "PES-03.3_A08", "test": "audit logs of physical access are maintained.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "CMMC L1 Assessment Guide", "defaultText": null } ], "externalMappings": [ { "id": 590471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587871", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f7c5f31-e112-5f30-9df4-d8a09b954651", "parentControlId": 31765, "controlId": "7.2", "title": "7.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587871" }, { "id": 590477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587872", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2dbbf464-acfa-5424-b99f-33c91c8c709e", "parentControlId": 31765, "controlId": "PE-8", "title": "PE-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587872" }, { "id": 590478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587872", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51eb50b3-65e6-54f2-b99a-8ddd8f484ed2", "parentControlId": 31765, "controlId": "PE-08", "title": "PE-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587872" }, { "id": 590479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587872", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50b392ec-7c0a-5c6b-9f49-34a7cc263704", "parentControlId": 31765, "controlId": "PE-08", "title": "PE-08", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587873" }, { "id": 590480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1693138f-a2f8-5a41-8080-36ab89348c9e", "parentControlId": 31765, "controlId": "PE-08", "title": "PE-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587873" }, { "id": 590481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "449a9bd4-e43d-5c80-9bb7-608351cea065", "parentControlId": 31765, "controlId": "PE-08", "title": "PE-08", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587873" }, { "id": 590482, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32d908f2-3bc0-5d7e-b599-4f228e9b0ab0", "parentControlId": 31765, "controlId": "PE-08", "title": "PE-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587873" }, { "id": 590483, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9badc431-e904-5a52-935d-59e9066fcbcb", "parentControlId": 31765, "controlId": "PE-08", "title": "PE-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587873" }, { "id": 590484, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10fce80d-da50-5a90-a784-5388a571563f", "parentControlId": 31765, "controlId": "3.10.4", "title": "3.10.4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587873" }, { "id": 590485, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51623da1-63c8-58cf-a6e6-d849cf402f8e", "parentControlId": 31765, "controlId": "NFO - PE-8", "title": "NFO - PE-8", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587873" }, { "id": 590486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587873", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8583781-a8bf-5d93-bc7b-b7ec75fe7bfb", "parentControlId": 31765, "controlId": "03.10.02.a", "title": "03.10.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587873" }, { "id": 590487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587874", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44afa0b1-d4db-5419-a59f-91900570fa8e", "parentControlId": 31765, "controlId": "03.10.07.b", "title": "03.10.07.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587874" }, { "id": 590490, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587874", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41e659ba-9794-527a-903b-ec026336191d", "parentControlId": 31765, "controlId": "DE.CM-02", "title": "DE.CM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587874" }, { "id": 590502, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587876", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac68b2fc-9f0a-567d-88d2-88cbcc95eb5d", "parentControlId": 31765, "controlId": "ACCESS-3c", "title": "ACCESS-3c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587876" }, { "id": 590517, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587878", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d53091d0-46f2-5c04-9efa-78c9c7cde0e8", "parentControlId": 31765, "controlId": "CIP-006-6 1.4", "title": "CIP-006-6 1.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587878" }, { "id": 590518, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587878", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c17791e-9108-5ef4-9748-531039c95c9b", "parentControlId": 31765, "controlId": "CIP-006-6 1.8", "title": "CIP-006-6 1.8", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587878" }, { "controlId": "C.5.9", "title": "C.5.9 — Visitor Control Access Records", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "cf61c5e4-9f48-5eaa-b4f0-cc87c86fa9bc", "isPublic": true }, { "controlId": "NEI 08-09 App E.5.9", "title": "NEI 08-09 App E.5.9 — Visitor Control Access Records", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.5.9", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6f313377-966b-5505-9f79-4a18eeb982d8", "isPublic": true }, { "controlId": "10 CFR 73.55(g)(7)", "title": "10 CFR 73.55(g)(7) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.5.9", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "164f237d-be51-5ed8-8e62-6ea56a956ea3", "isPublic": true }, { "controlId": "CIP-006-6-R2", "title": "CIP-006-6-R2 — Visitor Control Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "59573237-ba92-574a-b0ce-89d4b9a42e14", "isPublic": true }, { "controlId": "CIP-006-6-2.1", "title": "CIP-006-6-2.1 — Require continuous escorted access of visitors (individuals who are provided access but are not authorized for unesco...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0c93b2cb-2f95-5a49-8774-8176c35498a5", "isPublic": true }, { "controlId": "CIP-006-6-2.2", "title": "CIP-006-6-2.2 — Require manual or automated logging of visitor entry into and exit from the Physical Security Perimeter that includes...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9fb7adab-b903-5388-b7fc-598e3f9cb6d8", "isPublic": true }, { "controlId": "CIP-006-6-2.3", "title": "CIP-006-6-2.3 — Retain visitor logs for at least ninety calendar days.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c5349264-70a3-59b5-91b4-9cb855084934", "isPublic": true }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "0ab0db92-3528-520f-8212-85ae4504bd45", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "a4091ecf-810c-5fa2-94bf-df9a8f89e13b", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "a8ce73c1-06fa-5231-af58-0a1f6b8114b8", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "19536351-2580-51c2-8a40-af3faf88eee6", "isPublic": true } ], "id": 31765, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731238", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731238", "catalogueId": 1062, "uuid": "73bc7885-b460-5f06-9de2-b6a87e72592c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization generate a log entry for each access attempt through controlled ingress and egress points?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Physical Access Logs", "description": "

Control Description

Physical access control mechanisms generate a log entry for each access attempt through controlled ingress and egress points.

Evidence Request List (ERL)

E-PES-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPhysical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Where applicable, physical security controls and technologies are configured to generate a log entry for each access attempt through controlled ingress and egress points.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to generate a log entry for each access attempt through controlled ingress and egress points.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.5.9
NERC-CIP (2026) Requirements: CIP-006-6-R2", "controlId": "PES-03.3", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-03.3", "references": "

Micro-Small Business (<10 staff)

∙ Visitor logbook\n∙ iLobby (https://goilobby.com)\n∙ The Receptionist (https://thereceptionist.com)\n∙ LobbyGuard (http://lobbyguard.com)

Small Business (10-49 staff)

∙ Visitor logbook\n∙ iLobby (https://goilobby.com)\n∙ The Receptionist (https://thereceptionist.com)\n∙ LobbyGuard (http://lobbyguard.com)

Medium Business (50-249 staff)

∙ Visitor logbook\n∙ iLobby (https://goilobby.com)\n∙ The Receptionist (https://thereceptionist.com)\n∙ LobbyGuard (http://lobbyguard.com)

Large Business (250-999 staff)

∙ Staffed lobby (receptionist)\n∙ Visitor logbook

Enterprise (>1,000 staff)

∙ Staffed lobby (receptionist)\n∙ Visitor logbook", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73078, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590908", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590908", "securityControlId": 31766, "ccis": [], "uuid": "fb22f38c-0961-5df9-ab8c-f5a039416d6c", "testId": "PES-03.4_A01", "test": "physical spaces are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-03(01)_ODP", "defaultText": null }, { "id": 73079, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590908", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590908", "securityControlId": 31766, "ccis": [], "uuid": "22806158-fd55-5ab3-bea4-ac9060da407f", "testId": "PES-03.4_A02", "test": "physical access controls are enforced for the facility at physical spaces.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-03(01)02]", "defaultText": null }, { "id": 73080, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590909", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590909", "securityControlId": 31766, "ccis": [], "uuid": "359900ed-722f-586b-a92b-f1e25b166190", "testId": "PES-03.4_A03", "test": "physical access authorizations are enforced.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-03(01)[01]", "defaultText": null } ], "externalMappings": [ { "id": 590538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9447bf47-e147-54a9-bf28-0b622b8ec56b", "parentControlId": 31766, "controlId": "PE-3(1)", "title": "PE-3(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587881" }, { "id": 590539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8678f224-9b2b-5c6a-8ab1-543b6d369cdc", "parentControlId": 31766, "controlId": "PE-03(01)", "title": "PE-03(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587881" }, { "id": 590540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "165d997b-afea-5c09-8e31-2c73b58ba3da", "parentControlId": 31766, "controlId": "PE-03(01)", "title": "PE-03(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587881" }, { "id": 590543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587882", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3cc5f503-d01d-55af-a42c-318f8668f571", "parentControlId": 31766, "controlId": "PE-03(01)", "title": "PE-03(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587882" }, { "id": 590544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587882", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d0ffac5-627a-5200-a1df-bd5fc6a21b5a", "parentControlId": 31766, "controlId": "PE-03(01)", "title": "PE-03(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587882" }, { "id": 590545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587882", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3cfa2ff-d243-561c-93dc-336959400069", "parentControlId": 31766, "controlId": "PE-3(1)", "title": "PE-3(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587882" }, { "id": 590548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587882", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38f428fc-a825-5b9d-a9f7-9f903081c26f", "parentControlId": 31766, "controlId": "3.10.1", "title": "3.10.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587882" }, { "id": 590549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587882", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d836726b-b6ec-5f75-beb8-d38cf7b73c59", "parentControlId": 31766, "controlId": "03.10.07.a.01", "title": "03.10.07.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587882" }, { "id": 590550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587883", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3418c7b-479b-518b-81e6-3cfccbc34a2b", "parentControlId": 31766, "controlId": "03.10.07.a.02", "title": "03.10.07.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587883" } ], "id": 31766, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731238", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731238", "catalogueId": 1062, "uuid": "efa909b4-ea09-5993-ba37-498fe6cea437", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enforce physical access to critical systems or sensitive/regulated data, in addition to the physical access controls for the facility?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Access To Critical Systems", "description": "

Control Description

Physical access control mechanisms exist to enforce physical access to critical systems or sensitive/regulated data, in addition to the physical access controls for the facility.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Where applicable, physical security controls and technologies are configured to generate a log entry for each access attempt through controlled ingress and egress points.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to enforce physical access to critical systems or sensitive/regulated data, in addition to the physical access controls for the facility.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-03.4", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-03.4", "references": "

Micro-Small Business (<10 staff)

∙ Ensure adequate power for IT equipment with UPS backup

Small Business (10-49 staff)

∙ UPS for critical IT equipment\n∙ Power protection policy

Medium Business (50-249 staff)

∙ UPS and generator backup for critical IT systems\n∙ Power protection plan

Large Business (250-999 staff)

∙ Enterprise power protection (UPS + generator)\n∙ Redundant power feeds\n∙ Power monitoring

Enterprise (>1,000 staff)

∙ Enterprise power management (UPS, generators, PDU monitoring)\n∙ N+1 redundancy\n∙ DCIM integration\n∙ Automated failover", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73081, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590909", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590909", "securityControlId": 31767, "ccis": [], "uuid": "47383690-20cf-5873-898d-fc39572e41dc", "testId": "PES-04_A01", "test": "identify systems, equipment and respective operating environments that require limited physical access so that appropriate physical access controls are designed and implemented for offices, rooms and facilities.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 590589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587888", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1bbf031-ffb7-5369-91b5-ffc5375c27ce", "parentControlId": 31767, "controlId": "5.15", "title": "5.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587888" }, { "id": 590590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587888", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6d7d08d-a1a8-5281-a429-84bf536f6045", "parentControlId": 31767, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587888" }, { "id": 590591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587888", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "330003b8-f49f-528e-a753-6ea1db654f80", "parentControlId": 31767, "controlId": "7.3", "title": "7.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587888" }, { "id": 590592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587888", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ec05a5c-e2c1-5dda-b9be-c9424aff3f0a", "parentControlId": 31767, "controlId": "7.5", "title": "7.5", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587888" }, { "id": 590593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587888", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b17e6e43-db52-5e94-92d0-87f0ed9cd06d", "parentControlId": 31767, "controlId": "7.7", "title": "7.7", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587888" }, { "id": 590610, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e97a0c33-dab2-50dd-970e-c28ca9bb7a68", "parentControlId": 31767, "controlId": "3.10.5", "title": "3.10.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587892" }, { "id": 590611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47f9755e-133f-5c52-80cd-05c32236e305", "parentControlId": 31767, "controlId": "03.08.01", "title": "03.08.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587892" }, { "id": 590612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f101cca-c53b-560d-8c68-05d0ad19decb", "parentControlId": 31767, "controlId": "03.08.02", "title": "03.08.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587892" }, { "id": 590613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e666077f-2deb-5b29-82a4-58a8cfec57c5", "parentControlId": 31767, "controlId": "03.10.07.a.01", "title": "03.10.07.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587892" }, { "id": 590614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5fd3ac3b-0052-5d95-b777-fded280b2fe4", "parentControlId": 31767, "controlId": "03.10.07.a.02", "title": "03.10.07.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587893" }, { "id": 590615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587893", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0acd0afb-adad-595e-a8ae-a7ad64ebdef6", "parentControlId": 31767, "controlId": "03.10.07.d", "title": "03.10.07.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587893" }, { "controlId": "C.5.6", "title": "C.5.6 — Access Control for Transmission Medium", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "cf79840e-ca65-5437-9494-fa6e00819098", "isPublic": true }, { "controlId": "NEI 08-09 App E.5.6", "title": "NEI 08-09 App E.5.6 — Access Control for Transmission Medium", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.5.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "34c5e1cd-dd42-5984-808a-105369a7c879", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.5.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "d6de29af-e947-5447-837b-7e22736a82bb", "isPublic": true }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "83952299-86e8-5323-b307-6fa5f92d4f32", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "9fb6bc1c-f691-5914-b960-fde467821f21", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "27a7d4d5-704e-552e-86d2-221803c6f58d", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "738be667-c828-59c5-82c4-0739e1d1f80a", "isPublic": true } ], "id": 31767, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731239", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731239", "catalogueId": 1062, "uuid": "b4a0c702-7c91-517a-893c-3f078bc60610", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify systems, equipment and respective operating environments that require limited physical access so that appropriate physical access controls are designed and implemented for offices, rooms and facilities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Physical Security of Offices, Rooms & Facilities", "description": "

Control Description

Mechanisms exist to identify systems, equipment and respective operating environments that require limited physical access so that appropriate physical access controls are designed and implemented for offices, rooms and facilities.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Physical security controls and technologies are primarily designed and implemented for offices, rooms and facilities that focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify systems, equipment and respective operating environments that require limited physical access so that appropriate physical access controls are designed and implemented for offices, rooms and facilities.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.5.6", "controlId": "PES-04", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-04", "references": "

Micro-Small Business (<10 staff)

∙ \"clean desk\" requirements\n∙ Personnel manager spot checks

Small Business (10-49 staff)

∙ \"clean desk\" requirements\n∙ Personnel manager spot checks

Medium Business (50-249 staff)

∙ \"clean desk\" requirements\n∙ Personnel manager spot checks

Large Business (250-999 staff)

∙ \"clean desk\" requirements\n∙ Personnel manager spot checks

Enterprise (>1,000 staff)

∙ \"clean desk\" requirements\n∙ Personnel manager spot checks", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73082, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590909", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590909", "securityControlId": 31768, "ccis": [], "uuid": "cd656c3b-eacf-5de7-912b-f6164d40a39e", "testId": "PES-04.1_A01", "test": "physical security access controls allow only authorized personnel access to secure areas.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 590666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d45ae289-eb34-5525-b31f-1873ef703127", "parentControlId": 31768, "controlId": "5.15", "title": "5.15", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587909" }, { "id": 590667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99cb5f68-5258-53b6-832d-20849acac50f", "parentControlId": 31768, "controlId": "7.2", "title": "7.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587909" }, { "id": 590668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587909", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17e40153-02fe-5c34-acc5-5a9ce5eab69f", "parentControlId": 31768, "controlId": "7.3", "title": "7.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58791" }, { "id": 590669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9affc363-e699-5758-9d66-f4d7fa70cdb3", "parentControlId": 31768, "controlId": "7.6", "title": "7.6", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58791" }, { "id": 590682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cdc627d0-4413-5c5f-8904-acd0f3c987e8", "parentControlId": 31768, "controlId": "03.08.01", "title": "03.08.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587913" }, { "id": 590683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "977f1a87-a315-5c6c-91bf-a5d97ff8ee1b", "parentControlId": 31768, "controlId": "03.08.02", "title": "03.08.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587913" }, { "id": 590684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "023b828f-9d4c-52d0-95c4-40f14243c942", "parentControlId": 31768, "controlId": "03.10.07.a.01", "title": "03.10.07.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587913" }, { "id": 590685, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587914", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35f3c762-ff58-55b6-8333-c94b4d62f00e", "parentControlId": 31768, "controlId": "03.10.07.a.02", "title": "03.10.07.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587914" }, { "id": 590686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587914", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af082636-1d79-5553-9a74-82b1a201d088", "parentControlId": 31768, "controlId": "03.10.07.d", "title": "03.10.07.d", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587914" }, { "id": 590695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587915", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c91da9f5-409d-5e40-ba1e-f4b5afd6a46c", "parentControlId": 31768, "controlId": "8-3.a(2)", "title": "8-3.a(2)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587915" } ], "id": 31768, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731239", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731239", "catalogueId": 1062, "uuid": "f8aa36a0-0b62-5dde-b985-8c0122354324", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization allow only authorized personnel access to secure areas?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Working in Secure Areas", "description": "

Control Description

Physical security mechanisms exist to allow only authorized personnel access to secure areas.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPhysical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to allow only authorized personnel access to secure areas.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-04.1", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Visitor escorts

Small Business (10-49 staff)

∙ Visitor escorts

Medium Business (50-249 staff)

∙ Visitor escorts

Large Business (250-999 staff)

∙ Visitor escorts

Enterprise (>1,000 staff)

∙ Visitor escorts", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73085, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59091", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59091", "securityControlId": 31771, "ccis": [], "uuid": "6cd57216-21c1-5189-b22b-b2670b1921f4", "testId": "PES-05_A01", "test": "the frequency at which to review physical access logs is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least monthly", "otherId": "53A_R5_PE-06_ODP[01]\n171A_R3_A.03.10.02.ODP[01]", "defaultText": null }, { "id": 73086, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590911", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590911", "securityControlId": 31771, "ccis": [], "uuid": "8cf484c4-319b-5d6a-9b58-b5255c31f23f", "testId": "PES-05_A02", "test": "events or potential indications of events requiring physical access logs to be reviewed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-06_ODP[02]\n171A_R3_A.03.10.02.ODP[02]", "defaultText": null }, { "id": 73087, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59092", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59092", "securityControlId": 31771, "ccis": [], "uuid": "ae8538cd-273c-5670-bdb1-9b14052f4dd4", "testId": "PES-05_A03", "test": "physical access to the facility where the system resides is monitored to detect physical security incidents.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-06a.\n171A_R3_A.03.10.02.a[01]", "defaultText": null }, { "id": 73088, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59092", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59092", "securityControlId": 31771, "ccis": [], "uuid": "1e326b81-73f1-5794-b21e-e15db884c7b9", "testId": "PES-05_A04", "test": "physical access logs are reviewed per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least monthly", "otherId": "53A_R5_PE-06b.[01]", "defaultText": null }, { "id": 73089, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59092", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59092", "securityControlId": 31771, "ccis": [], "uuid": "54a54fc8-cc73-51e9-9eb5-aaf9a3365360", "testId": "PES-05_A05", "test": "physical access logs are reviewed upon occurrence of organization-defined events or potential indicators of events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PE-06b.[02]", "defaultText": null }, { "id": 73090, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59092", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59092", "securityControlId": 31771, "ccis": [], "uuid": "eb7fd5ea-eb01-56f2-9365-c0e5f28a5221", "testId": "PES-05_A06", "test": "results of reviews are coordinated with organizational incident response capabilities.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-06c.[01]", "defaultText": null }, { "id": 73091, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59092", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59092", "securityControlId": 31771, "ccis": [], "uuid": "fdf39117-ec46-5205-a4ea-a15af3da730a", "testId": "PES-05_A07", "test": "results of investigations are coordinated with organizational incident response capabilities.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-06c.[02]", "defaultText": null }, { "id": 73092, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590921", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590921", "securityControlId": 31771, "ccis": [], "uuid": "0dbe8dbf-cb31-57cb-b2bf-8db148006726", "testId": "PES-05_A08", "test": "physical security incidents are responded to.
PPTDF Applicability: Facility
Assessment Rigor: 2", "otherId": "171A_R3_A.03.10.02.a[02]", "defaultText": null }, { "id": 73093, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590921", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590921", "securityControlId": 31771, "ccis": [], "uuid": "cf4b7f7c-5b3f-5d29-a45f-2bccf81845e2", "testId": "PES-05_A09", "test": "physical access logs are reviewed .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: SDP values: at least every 45 days", "otherId": "171A_R3_A.03.10.02.b[01]", "defaultText": null }, { "id": 73094, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590921", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590921", "securityControlId": 31771, "ccis": [], "uuid": "fae1d180-9f88-5cc1-8359-7a4ed3d2e87d", "testId": "PES-05_A10", "test": "physical access logs are reviewed upon occurrence of .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: SDP values: significant, novel incidents, or significant changes to risks.", "otherId": "171A_R3_A.03.10.02.b[02]", "defaultText": null } ], "externalMappings": [ { "id": 590730, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587922", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e370aaa8-269a-57c7-8ad9-158e1ecddb64", "parentControlId": 31771, "controlId": "7.4", "title": "7.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587922" }, { "id": 590733, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587922", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f462220-ee26-50a8-8ac8-c6f63e096cd9", "parentControlId": 31771, "controlId": "PE-6", "title": "PE-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587922" }, { "id": 590734, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587922", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47694633-4f64-5f8f-85e2-e315c51ed6aa", "parentControlId": 31771, "controlId": "PE-06", "title": "PE-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587922" }, { "id": 590735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587922", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "530a68ed-ed27-56c8-b73f-4b800ffc848b", "parentControlId": 31771, "controlId": "PE-06", "title": "PE-06", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587922" }, { "id": 590736, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587922", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0ba449a-75e0-5ccd-a44a-116db67420e5", "parentControlId": 31771, "controlId": "PE-06", "title": "PE-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587922" }, { "id": 590737, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587923", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24b80088-a874-5b25-ba89-683217fb6e4d", "parentControlId": 31771, "controlId": "PE-06", "title": "PE-06", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587923" }, { "id": 590738, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587923", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e73d699-f2ae-5e51-b2b9-0cc878a66c5d", "parentControlId": 31771, "controlId": "PE-06", "title": "PE-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587923" }, { "id": 590739, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587924", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73e56cbb-7bf5-5a6d-8b5c-58543c5b189c", "parentControlId": 31771, "controlId": "PE-06", "title": "PE-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587924" }, { "id": 590741, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587924", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fe2d227-d0d8-55a9-9d28-705347f26b41", "parentControlId": 31771, "controlId": "PE-6", "title": "PE-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587924" }, { "id": 590742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587924", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f39b6067-13c6-5a6f-b2b1-36b40b4097c8", "parentControlId": 31771, "controlId": "PE-6", "title": "PE-6", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587924" }, { "id": 590746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587925", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7069f2c-15b9-5131-a764-8ffd3774673b", "parentControlId": 31771, "controlId": "3.10.2", "title": "3.10.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587925" }, { "id": 590747, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587925", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88844c55-2b7c-5206-86a2-21047f2d2968", "parentControlId": 31771, "controlId": "03.10.02.a", "title": "03.10.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587925" }, { "id": 590748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587925", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6da0f2c9-e80e-5004-8c61-6abf8e7bd6cd", "parentControlId": 31771, "controlId": "03.10.02.b", "title": "03.10.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587925" }, { "id": 590757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587926", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "732169b9-8deb-50a2-bc41-4580edf0a85d", "parentControlId": 31771, "controlId": "DE.CM-02", "title": "DE.CM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587926" }, { "id": 590777, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587929", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c659f9e8-029f-51f1-99a9-cfa5b43028a0", "parentControlId": 31771, "controlId": "CIP-006-6 1.4", "title": "CIP-006-6 1.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587929" }, { "id": 590778, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587929", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b59514e-d0a4-5475-8c8d-da2e295875d0", "parentControlId": 31771, "controlId": "CIP-006-6 1.6", "title": "CIP-006-6 1.6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587929" }, { "id": 590779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587929", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63f540e2-b275-5118-a84a-d647939b8eed", "parentControlId": 31771, "controlId": "CIP-006-6 1.7", "title": "CIP-006-6 1.7", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58793" }, { "controlId": "C.5.7", "title": "C.5.7 — Access Control for Display Medium", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "3f7c9189-141e-5ff5-aef3-e1b61430a771", "isPublic": true }, { "controlId": "NEI 08-09 App E.5.7", "title": "NEI 08-09 App E.5.7 — Access Control for Display Medium", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.5.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "f10e2332-371c-5d31-bbdb-41660dc1e36c", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.5.7", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "350f749a-dcc2-504c-a8f5-1323f9bc7a49", "isPublic": true }, { "controlId": "C.5.8", "title": "C.5.8 — Monitoring Physical Access", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "741abdf2-25c1-57a5-a2ae-0c20a79f87a3", "isPublic": true }, { "controlId": "NEI 08-09 App E.5.8", "title": "NEI 08-09 App E.5.8 — Monitoring Physical Access", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.5.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "1534c59b-20bf-521c-b73f-3a5bb1a04653", "isPublic": true }, { "controlId": "10 CFR 73.55(i)", "title": "10 CFR 73.55(i) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.5.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "3a6fe040-f2d5-59b8-8785-71e0ea8e5cd9", "isPublic": true }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "ebdfde6c-32a6-5a59-8c40-ffc24c9b8234", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "09a2e140-f7ab-5e32-b351-e26d70964c68", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "eca27a73-4eac-5e56-90c8-1afe3afc9354", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "6d3c4e63-718b-53de-8f11-0dff0c993ebe", "isPublic": true } ], "id": 31771, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73124", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73124", "catalogueId": 1062, "uuid": "e02b8a97-1a24-5a26-aea8-de3f7c46be47", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization monitor for, detect and respond to physical security incidents?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 7.0, "title": "Monitoring Physical Access", "description": "

Control Description

Physical access control mechanisms exist to monitor for, detect and respond to physical security incidents.

Evidence Request List (ERL)

E-PES-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Where applicable, physical security controls and technologies are configured to monitor for, detect and respond to physical security incidents.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to monitor for, detect and respond to physical security incidents.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.5.7, C.5.8", "controlId": "PES-05", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-05", "references": "

Micro-Small Business (<10 staff)

∙ Physical alarm systems\n∙ Video surveillance systems

Small Business (10-49 staff)

∙ Physical alarm systems\n∙ Video surveillance systems

Medium Business (50-249 staff)

∙ Physical alarm systems\n∙ Video surveillance systems

Large Business (250-999 staff)

∙ Physical alarm systems\n∙ Video surveillance systems\n∙ Physical security guards\n∙ Staffed lobby (receptionist)

Enterprise (>1,000 staff)

∙ Physical alarm systems\n∙ Video surveillance systems\n∙ Physical security guards\n∙ Staffed lobby (receptionist)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73095, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590921", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590921", "securityControlId": 31772, "ccis": [], "uuid": "01d6a9dd-0112-53dc-b63f-830cc1bfae82", "testId": "PES-05.1_A01", "test": "physical access to the facility where the system resides is monitored using physical intrusion alarms.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-06(01)[01]", "defaultText": null }, { "id": 73096, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590922", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590922", "securityControlId": 31772, "ccis": [], "uuid": "ec33cae7-ac7f-56e5-b935-625df1f69a46", "testId": "PES-05.1_A02", "test": "physical access to the facility where the system resides is monitored using physical surveillance equipment.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-06(01)[02]", "defaultText": null } ], "externalMappings": [ { "id": 590809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587933", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a505a8c-f29a-5c67-8956-11feda21cee5", "parentControlId": 31772, "controlId": "7.4", "title": "7.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587933" }, { "id": 590813, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587934", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a3a00c9-e9e9-50aa-a460-d45935e7bc75", "parentControlId": 31772, "controlId": "PE-6(1)", "title": "PE-6(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587934" }, { "id": 590814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587934", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49bc77a9-ca0d-5991-8904-8137aac0253a", "parentControlId": 31772, "controlId": "PE-06(01)", "title": "PE-06(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587934" }, { "id": 590815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587934", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53ead3d8-d9e4-59a2-989a-af6c871c00d4", "parentControlId": 31772, "controlId": "PE-06(01)", "title": "PE-06(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587934" }, { "id": 590816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587934", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "176fe16a-fcdc-5cba-8768-3fab344ca19e", "parentControlId": 31772, "controlId": "PE-06(01)", "title": "PE-06(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587934" }, { "id": 590817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587934", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b744522d-c947-5911-9976-cdf7cd950b1c", "parentControlId": 31772, "controlId": "PE-06(01)", "title": "PE-06(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587934" }, { "id": 590818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90659801-84fc-56a2-976e-c375181fc481", "parentControlId": 31772, "controlId": "PE-06(01)", "title": "PE-06(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587935" }, { "id": 590819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f25bfb7-e244-53b5-b737-450f197325ef", "parentControlId": 31772, "controlId": "3.10.2", "title": "3.10.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587935" }, { "id": 590820, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0f40332-2bff-50c4-bd33-bdb15dfaffe3", "parentControlId": 31772, "controlId": "NFO - PE-6(1)", "title": "NFO - PE-6(1)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587935" }, { "id": 590821, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42d134ea-8101-578f-b374-5a70a9f13b40", "parentControlId": 31772, "controlId": "03.10.02.a", "title": "03.10.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587935" }, { "id": 590822, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9dbdb73-7746-5342-9036-81a97acf03c0", "parentControlId": 31772, "controlId": "03.10.02.b", "title": "03.10.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587935" }, { "id": 590836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587936", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f74b24cd-8a90-5531-a604-1270648e3e7d", "parentControlId": 31772, "controlId": "CIP-006-6 1.5", "title": "CIP-006-6 1.5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587936" }, { "id": 590837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587937", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a06b740e-a4ff-5b6d-a931-62023595eaaa", "parentControlId": 31772, "controlId": "CIP-006-6 1.7", "title": "CIP-006-6 1.7", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587937" } ], "id": 31772, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731241", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731241", "catalogueId": 1062, "uuid": "0a15a14d-bed3-5742-9ead-3ef3e74fe1dc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization monitor physical intrusion alarms and surveillance equipment?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Intrusion Alarms / Surveillance Equipment", "description": "

Control Description

Physical access control mechanisms exist to monitor physical intrusion alarms and surveillance equipment.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Where applicable, physical security controls and technologies are configured to monitor for, detect and respond to physical security incidents.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to monitor physical intrusion alarms and surveillance equipment.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "PES-05.1", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-05.1", "references": "

Micro-Small Business (<10 staff)

∙ Physical alarm systems\n∙ Video surveillance systems

Small Business (10-49 staff)

∙ Physical alarm systems\n∙ Video surveillance systems

Medium Business (50-249 staff)

∙ Physical alarm systems\n∙ Video surveillance systems

Large Business (250-999 staff)

∙ Physical alarm systems\n∙ Video surveillance systems

Enterprise (>1,000 staff)

∙ Physical alarm systems\n∙ Video surveillance systems", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73097, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590922", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590922", "securityControlId": 31773, "ccis": [], "uuid": "64465d81-40cd-59ab-b248-7536e28cb06e", "testId": "PES-05.2_A01", "test": "physical spaces containing one or more components of the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-06(04)_ODP", "defaultText": null }, { "id": 73098, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590922", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590922", "securityControlId": 31773, "ccis": [], "uuid": "431defe8-72c5-5506-a424-0754af257090", "testId": "PES-05.2_A02", "test": "physical access to the system is monitored in addition to the physical access monitoring of the facility at physical spaces.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-06(04)", "defaultText": null } ], "externalMappings": [ { "id": 590854, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6f0a5d7-f9c6-52ca-8775-2d142e66c276", "parentControlId": 31773, "controlId": "7.4", "title": "7.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587939" }, { "id": 590857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2ba17af-c7d4-53b8-b885-4e6ffe20f6ee", "parentControlId": 31773, "controlId": "PE-6(4)", "title": "PE-6(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587939" }, { "id": 590858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97c6cc19-ac92-5c05-851f-b46ae2c00508", "parentControlId": 31773, "controlId": "PE-06(04)", "title": "PE-06(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58794" }, { "id": 590859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58794", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab9b1d02-03fd-5a15-9387-f4e48ec6f32e", "parentControlId": 31773, "controlId": "PE-06(04)", "title": "PE-06(04)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58794" }, { "id": 590860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58794", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f185f28-959b-5573-a39e-deab6fc7d49e", "parentControlId": 31773, "controlId": "PE-06(04)", "title": "PE-06(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58794" }, { "id": 590861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58794", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d4dacb3-7c62-5f5e-8b39-bd94e13ca5a2", "parentControlId": 31773, "controlId": "PE-06(04)", "title": "PE-06(04)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58794" }, { "id": 590862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58794", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f57507d-6ee9-598f-a828-9d70fa4d3055", "parentControlId": 31773, "controlId": "PE-06(04)", "title": "PE-06(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58794" }, { "id": 590864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58794", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd625c97-9aa1-5e65-8501-e6a7e827b596", "parentControlId": 31773, "controlId": "3.10.2", "title": "3.10.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58794" }, { "id": 590865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58794", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ee4665d-a6b9-5384-8969-795774aa51d5", "parentControlId": 31773, "controlId": "03.10.02.a", "title": "03.10.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58794" }, { "id": 590866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587941", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef81a19b-edc1-53cf-867e-90aafaa5abf5", "parentControlId": 31773, "controlId": "03.10.02.b", "title": "03.10.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587941" } ], "id": 31773, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731241", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731241", "catalogueId": 1062, "uuid": "8f8cd3ed-17b5-5a20-8ec3-5844e637f05a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization monitor physical access to critical systems or sensitive/regulated data, in addition to the physical access monitoring of the facility?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Monitoring Physical Access To Critical Systems", "description": "

Control Description

Facility security mechanisms exist to monitor physical access to critical systems or sensitive/regulated data, in addition to the physical access monitoring of the facility.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.\n▪ Facility security mechanisms exist to monitor physical access to business-critical Technology Assets, Applications, Services and/or Data (TAASD), in addition to the physical access monitoring of the facility.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Where applicable, physical security controls and technologies are configured to monitor for, detect and respond to physical security incidents.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to monitor physical access to critical systems or sensitive/regulated data, in addition to the physical access monitoring of the facility.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-05.2", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-05.2", "references": "

Micro-Small Business (<10 staff)

∙ Physical security policy\n∙ Door locks and key management

Small Business (10-49 staff)

∙ Physical security policy\n∙ Access log\n∙ Visitor procedures

Medium Business (50-249 staff)

∙ Physical security guards

Large Business (250-999 staff)

∙ Physical security guards

Enterprise (>1,000 staff)

∙ Physical security guards", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73099, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590922", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590922", "securityControlId": 31774, "ccis": [], "uuid": "6618fcb6-5449-52ef-972b-a36dbc3dc8e6", "testId": "PES-06_A01", "test": "visitors are escorted.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "171A_3.10.3[a]\n171A_R3_A.03.10.07.c[01]", "defaultText": null }, { "id": 73100, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590923", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590923", "securityControlId": 31774, "ccis": [], "uuid": "939f9090-d2a1-553d-9cb6-17654b4ce2dd", "testId": "PES-06_A02", "test": "visitor activity is controlled.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "171A_3.10.3[b]\n171A_R3_A.03.10.07.c[02]", "defaultText": null } ], "externalMappings": [ { "id": 590878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587942", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79fdbb70-3958-5b55-a041-bc5f5a3cc171", "parentControlId": 31774, "controlId": "7.2", "title": "7.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587942" }, { "id": 590884, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87931aba-1a68-5f5b-8aa6-b38ce8113b58", "parentControlId": 31774, "controlId": "3.10.3", "title": "3.10.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587943" }, { "id": 590885, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59f8ec37-7521-5480-bb24-07bde3be9f4b", "parentControlId": 31774, "controlId": "03.10.02.b", "title": "03.10.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587943" }, { "id": 590886, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bac0f59-d54b-50d5-b236-b95f06d1eaed", "parentControlId": 31774, "controlId": "03.10.07.c", "title": "03.10.07.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587943" }, { "id": 590917, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58795", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e53b3afe-7454-53d7-9fcf-08becfb17b39", "parentControlId": 31774, "controlId": "CIP-006-6 1.2", "title": "CIP-006-6 1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58795" }, { "id": 590918, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58795", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48e6fe60-4b5a-548d-834a-0d26b7a691bb", "parentControlId": 31774, "controlId": "CIP-006-6 1.3", "title": "CIP-006-6 1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58795" }, { "id": 590919, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58795", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70e17e06-a2e1-5423-bf65-db214bfbcfb3", "parentControlId": 31774, "controlId": "CIP-006-6 R2", "title": "CIP-006-6 R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587951" }, { "id": 590920, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587951", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d3c708d-0a12-51ee-be52-91a7aff4dfd6", "parentControlId": 31774, "controlId": "CIP-006-6 2.2", "title": "CIP-006-6 2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587951" }, { "id": 590921, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587951", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0e4b4c2-350b-5a35-ae4d-3ba036c8c099", "parentControlId": 31774, "controlId": "8-3.a", "title": "8-3.a", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587951" }, { "id": 590922, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587951", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f8b1796-740f-595e-a26d-3661a3a59adc", "parentControlId": 31774, "controlId": "8-3.a(1)", "title": "8-3.a(1)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587951" }, { "id": 590923, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587951", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b349d8b-05e2-532b-848c-e9609a2c8703", "parentControlId": 31774, "controlId": "8-3.a(3)", "title": "8-3.a(3)", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587951" }, { "controlId": "C.5.2", "title": "C.5.2 — Third Party/Escorted Access", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-3, PE-8, MA-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "b3c49e68-d560-5bf0-9e4b-7cecd1eb4163", "isPublic": true }, { "controlId": "NEI 08-09 App E.5.2", "title": "NEI 08-09 App E.5.2 — Third Party/Escorted Access", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.5.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "b2000803-13be-5128-ad51-cd25123ec798", "isPublic": true }, { "controlId": "10 CFR 73.55(g)", "title": "10 CFR 73.55(g) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.5.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "3883f797-db62-56e5-a9d2-e85702d35e69", "isPublic": true }, { "controlId": "C.5.8", "title": "C.5.8 — Monitoring Physical Access", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "958047ab-e477-585d-86fd-ec8be1ef6cc7", "isPublic": true }, { "controlId": "NEI 08-09 App E.5.8", "title": "NEI 08-09 App E.5.8 — Monitoring Physical Access", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.5.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "92f21cbe-e809-530c-8418-b7832bc1ce6f", "isPublic": true }, { "controlId": "10 CFR 73.55(i)", "title": "10 CFR 73.55(i) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.5.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "dd77d697-31a8-523f-b640-c4ca97aefe48", "isPublic": true }, { "controlId": "CIP-006-6-R1", "title": "CIP-006-6-R1 — Physical Security Plan", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "083ec81f-fdab-54b0-9f7f-4d5c1125246f", "isPublic": true }, { "controlId": "CIP-006-6-1.1", "title": "CIP-006-6-1.1 — Define operational or procedural controls to restrict physical access.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "79fbe1bc-68c4-5f1b-b65e-65eb0a63f675", "isPublic": true }, { "controlId": "CIP-006-6-1.2", "title": "CIP-006-6-1.2 — Utilize at least one physical access control to allow unescorted physical access into each applicable Physical Securi...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b3071f5d-b649-5f1d-96a0-228fa58ffccc", "isPublic": true }, { "controlId": "CIP-006-6-1.3", "title": "CIP-006-6-1.3 — Where technically feasible, utilize two or more different physical access controls (this does not require two complet...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "01659c74-6b4b-5d92-a06f-b99388c34452", "isPublic": true }, { "controlId": "CIP-006-6-1.4", "title": "CIP-006-6-1.4 — Monitor for unauthorized access through a physical access point into a Physical Security Perimeter.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c17efd4f-ec03-599c-9d1e-c39092e742ba", "isPublic": true }, { "controlId": "CIP-006-6-1.5", "title": "CIP-006-6-1.5 — Issue an alarm or alert in response to detected unauthorized access through a physical access point into a Physical S...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "67793ee3-95e9-51fc-be17-a49e8902d68e", "isPublic": true }, { "controlId": "CIP-006-6-1.6", "title": "CIP-006-6-1.6 — Monitor each Physical Access Control System for unauthorized physical access to a Physical Access Control System.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6aa55783-ee0d-5c31-9a84-ddc36815a154", "isPublic": true }, { "controlId": "CIP-006-6-1.7", "title": "CIP-006-6-1.7 — Issue an alarm or alert in response to detected unauthorized physical access to a Physical Access Control System to t...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5f1af147-ce2d-5d5d-acc4-a27996cab78b", "isPublic": true }, { "controlId": "CIP-006-6-1.8", "title": "CIP-006-6-1.8 — Log (through automated means or by personnel who control entry) entry of each individual with authorized unescorted p...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d6439cce-8266-5c8c-923e-80704c61be9c", "isPublic": true }, { "controlId": "CIP-006-6-1.9", "title": "CIP-006-6-1.9 — Retain physical access logs of entry of individuals with authorized unescorted physical access into each Physical Sec...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "27ded340-aa5f-5e83-afba-ecf0f1be638a", "isPublic": true }, { "controlId": "CIP-006-6-1.10", "title": "CIP-006-6-1.10 — Restrict physical access to cabling and other nonprogrammable communication components used for connection between ap...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "98cf1a87-5c88-5cf4-bc50-2fe0f93dca93", "isPublic": true }, { "controlId": "CIP-006-6-R2", "title": "CIP-006-6-R2 — Visitor Control Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "38dda9ac-3d24-5342-86bb-445daf7ad9e4", "isPublic": true }, { "controlId": "CIP-006-6-2.1", "title": "CIP-006-6-2.1 — Require continuous escorted access of visitors (individuals who are provided access but are not authorized for unesco...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2592b476-ccf0-5c73-8bb4-0a9948aec134", "isPublic": true }, { "controlId": "CIP-006-6-2.2", "title": "CIP-006-6-2.2 — Require manual or automated logging of visitor entry into and exit from the Physical Security Perimeter that includes...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "46fefa58-6df2-5e9e-9e6b-45040a11127a", "isPublic": true }, { "controlId": "CIP-006-6-2.3", "title": "CIP-006-6-2.3 — Retain visitor logs for at least ninety calendar days.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "94f86c07-b2ab-5686-b52b-d8e93ca160ea", "isPublic": true }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "01cf9694-2aad-5132-a2bd-9dd6f313b19b", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "98f33d03-19b6-5cc8-9650-7289143b96cb", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "bf56812c-a758-5c58-8426-d9d6a56e2603", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "e212c49e-abf3-5fe4-8eb4-499de6c65305", "isPublic": true } ], "id": 31774, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731241", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731241", "catalogueId": 1062, "uuid": "c33cded3-1f3c-55b8-ab18-fc86a2e71660", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify, authorize and monitor visitors before allowing access to the facility (other than areas designated as publicly accessible)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Visitor Control", "description": "

Control Description

Physical access control mechanisms exist to identify, authorize and monitor visitors before allowing access to the facility (other than areas designated as publicly accessible).

Evidence Request List (ERL)

E-PES-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Physical security controls distinguish between onsite personnel and visitors, especially in areas where sensitive/regulated data is accessible.\n▪ Users are trained and encouraged to stop and question anyone attempting to install or remove IT assets from facilities.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to identify, authorize and monitor visitors before allowing access to the facility (other than areas designated as publicly accessible).

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.5.2, C.5.8
NERC-CIP (2026) Requirements: CIP-006-6-R1, CIP-006-6-R2", "controlId": "PES-06", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-06", "references": "

Micro-Small Business (<10 staff)

∙ Visitor logbook\n∙ iLobby (https://goilobby.com)\n∙ The Receptionist (https://thereceptionist.com)\n∙ LobbyGuard (http://lobbyguard.com)

Small Business (10-49 staff)

∙ Visitor logbook\n∙ iLobby (https://goilobby.com)\n∙ The Receptionist (https://thereceptionist.com)\n∙ LobbyGuard (http://lobbyguard.com)

Medium Business (50-249 staff)

∙ Visitor logbook\n∙ iLobby (https://goilobby.com)\n∙ The Receptionist (https://thereceptionist.com)\n∙ LobbyGuard (http://lobbyguard.com)

Large Business (250-999 staff)

∙ Staffed lobby (receptionist)\n∙ Visitor logbook

Enterprise (>1,000 staff)

∙ Staffed lobby (receptionist)\n∙ Visitor logbook", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73101, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590923", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590923", "securityControlId": 31775, "ccis": [], "uuid": "d78a9b8e-e876-56ce-aa06-6db81b8fee83", "testId": "PES-06.1_A01", "test": "physical access control mechanisms distinguish between onsite personnel and visitors, especially in areas where sensitive / regulated data is accessible.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73102, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590923", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590923", "securityControlId": 31775, "ccis": [], "uuid": "bb48f7af-6e2d-5425-92c7-363d9f9e3930", "testId": "PES-06.1_A02", "test": "visitors are escorted.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "171A_3.10.3[a]\n171A_R3_A.03.10.07.c[01]", "defaultText": null }, { "id": 73103, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590924", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590924", "securityControlId": 31775, "ccis": [], "uuid": "c9bf123f-506f-5f78-ac13-5be5e2749ae1", "testId": "PES-06.1_A03", "test": "visitor activity is controlled.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "171A_3.10.3[b]\n171A_R3_A.03.10.07.c[02]", "defaultText": null } ], "externalMappings": [ { "id": 590947, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587954", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e5e7f01-2374-567f-8267-6a5a42955dad", "parentControlId": 31775, "controlId": "3.10.3", "title": "3.10.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587954" }, { "id": 590948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587954", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b97f7543-7fdf-535a-b5da-573e3454f4e3", "parentControlId": 31775, "controlId": "03.10.02.b", "title": "03.10.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587954" }, { "id": 590949, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587954", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0052c9e-7d83-59a4-95b8-cc468a9d7b75", "parentControlId": 31775, "controlId": "03.10.07.c", "title": "03.10.07.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587954" } ], "id": 31775, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731242", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731242", "catalogueId": 1062, "uuid": "51216aa8-fb62-5d53-a266-a366304532cc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization easily distinguish between onsite personnel and visitors, especially in areas where sensitive/regulated data is accessible?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Distinguish Visitors from On-Site Personnel", "description": "

Control Description

Physical access control mechanisms exist to easily distinguish between onsite personnel and visitors, especially in areas where sensitive/regulated data is accessible.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Physical security controls distinguish between onsite personnel and visitors, especially in areas where sensitive/regulated data is accessible.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to easily distinguish between onsite personnel and visitors, especially in areas where sensitive/regulated data is accessible.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-06.1", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-06.1", "references": "

Micro-Small Business (<10 staff)

∙ Visible badges for visitors that are different from organizational personnel

Small Business (10-49 staff)

∙ Visible badges for visitors that are different from organizational personnel

Medium Business (50-249 staff)

∙ Visible badges for visitors that are different from organizational personnel

Large Business (250-999 staff)

∙ Visible badges for visitors that are different from organizational personnel

Enterprise (>1,000 staff)

∙ Visible badges for visitors that are different from organizational personnel", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73104, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590924", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590924", "securityControlId": 31776, "ccis": [], "uuid": "de6eb6cf-0dbd-5a72-8a81-a3293e674fc2", "testId": "PES-06.2_A01", "test": "a list of acceptable forms of identification for visitor access to the facility where the system resides is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-02(02)_ODP", "defaultText": null }, { "id": 73105, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590924", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590924", "securityControlId": 31776, "ccis": [], "uuid": "b8bbf0aa-f04b-5eca-ab02-cefc0eae1305", "testId": "PES-06.2_A02", "test": "two forms of identification are required from list of acceptable forms of identification for visitor access to the facility where the system resides.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-02(02)", "defaultText": null } ], "externalMappings": [ { "id": 590969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587965", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f51a59a-3ece-57de-8fde-5f5d2b58ea70", "parentControlId": 31776, "controlId": "PE-2(2)", "title": "PE-2(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587965" }, { "id": 590970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587965", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86ce57a6-a753-572f-ad5c-ff21899b60a1", "parentControlId": 31776, "controlId": "PE-02(02)", "title": "PE-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587965" }, { "id": 590971, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587965", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21a34fe0-b40d-54d6-9ca5-b4bd0b853901", "parentControlId": 31776, "controlId": "PE-02(02)", "title": "PE-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587965" }, { "id": 590972, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587965", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26dccbd9-4bbd-5be7-bfa1-68cb1127f7a0", "parentControlId": 31776, "controlId": "03.10.07.c", "title": "03.10.07.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587965" }, { "id": 590977, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587966", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c4fef2d-07f9-51c5-883f-9c6322835dcc", "parentControlId": 31776, "controlId": "CIP-006-6 2.2", "title": "CIP-006-6 2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587966" } ], "id": 31776, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731242", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731242", "catalogueId": 1062, "uuid": "ce535056-b44b-563f-9aad-99ac05c553eb", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require at least one (1) form of government-issued or organization-issued photo identification to authenticate individuals before they can gain access to the facility?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Identification Requirement", "description": "

Control Description

Physical access control mechanisms exist to requires at least one(1) form of government-issued or organization-issued photo identification to authenticate individuals before they can gain access to the facility.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Users are trained and encouraged to stop and question anyone attempting to install or remove IT assets from facilities.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to requires at least one(1) form of government-issued or organization-issued photo identification to authenticate individuals before they can gain access to the facility.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-06.2", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-06.2", "references": "

Micro-Small Business (<10 staff)

∙ Ensure fire extinguisher near server room

Small Business (10-49 staff)

∙ Fire detection and suppression in server/data rooms\n∙ Sprinkler or suppression system

Medium Business (50-249 staff)

∙ Formal fire protection system for data areas\n∙ Fire suppression appropriate for electronics

Large Business (250-999 staff)

∙ Enterprise fire protection (FM-200 or Novec 1230 suppression)\n∙ VESDA early warning system

Enterprise (>1,000 staff)

∙ Enterprise fire suppression system (FM-200, Novec 1230)\n∙ VESDA early smoke detection\n∙ Integration with building management system", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73106, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590924", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590924", "securityControlId": 31777, "ccis": [], "uuid": "95426d5b-5c82-5e45-83dd-0c584fb8d4de", "testId": "PES-06.3_A01", "test": "visitor activity is controlled.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "171A_R3_A.03.10.07.c[02]", "defaultText": null }, { "id": 73107, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590925", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590925", "securityControlId": 31777, "ccis": [], "uuid": "d55ca5c5-bdb1-5d88-944d-705c8d8d8f88", "testId": "PES-06.3_A02", "test": "unescorted access to the facility where the system resides is restricted.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-02(03)", "defaultText": null }, { "id": 73108, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590925", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590925", "securityControlId": 31777, "ccis": [], "uuid": "d0afa094-fac0-5df2-83cf-6f6341998cbd", "testId": "PES-06.3_A03", "test": "visitor activity is monitored.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "171A_3.10.3[b]", "defaultText": null }, { "id": 73109, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590925", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590925", "securityControlId": 31777, "ccis": [], "uuid": "552a5735-972a-59c0-9370-7be660e91b33", "testId": "PES-06.3_A04", "test": "visitors are escorted.
PPTDF Applicability: Facility
Assessment Rigor: 2", "otherId": "171A_3.10.3[a]\n171A_R3_A.03.10.07.c[01]", "defaultText": null }, { "id": 73110, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590925", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590925", "securityControlId": 31777, "ccis": [], "uuid": "b2a3bd6f-413c-5323-bff9-7e4e4bfba461", "testId": "PES-06.3_A05", "test": "physical access authorizations for unescorted access to the facility where the system resides are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PE-02(03)_ODP[01]\n53A_R5_PE-02(03)_ODP[02]", "defaultText": null } ], "externalMappings": [ { "id": 590985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "611f7679-176b-55c4-8594-d9799606ac98", "parentControlId": 31777, "controlId": "PE-2(3)", "title": "PE-2(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587967" }, { "id": 590986, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3327ecb9-a68b-5b5a-9f26-81740f93c8bb", "parentControlId": 31777, "controlId": "PE-02(03)", "title": "PE-02(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587967" }, { "id": 590987, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d73ac867-af50-50f2-93e5-a7e60eec871c", "parentControlId": 31777, "controlId": "PE-02(03)", "title": "PE-02(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587967" }, { "id": 590988, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3f334ab-6288-527e-8cdc-e5d7a883f0e3", "parentControlId": 31777, "controlId": "3.10.3", "title": "3.10.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587967" }, { "id": 590989, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7733f2fe-9737-522e-a35c-9553870a9783", "parentControlId": 31777, "controlId": "03.10.07.c", "title": "03.10.07.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587967" }, { "id": 591002, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587969", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93fd07e5-4e1b-5430-add7-76af91d26bdc", "parentControlId": 31777, "controlId": "CIP-004-7 4.1.2", "title": "CIP-004-7 4.1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587969" }, { "id": 591003, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587969", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a12bc19f-8cda-5357-9e6e-1e52bb60b60b", "parentControlId": 31777, "controlId": "CIP-006-6 1.2", "title": "CIP-006-6 1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587969" }, { "id": 591004, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587969", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b9a1ba3-f6fb-5eb2-aebb-4acc9d3f5412", "parentControlId": 31777, "controlId": "CIP-006-6 1.3", "title": "CIP-006-6 1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587969" }, { "id": 591005, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587969", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d9a66d7-6982-574b-a312-c7d2c76ed509", "parentControlId": 31777, "controlId": "CIP-006-6 2.1", "title": "CIP-006-6 2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587969" } ], "id": 31777, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731242", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731242", "catalogueId": 1062, "uuid": "7152a9cc-aeeb-5302-9bc2-e8d8254a1985", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict unescorted access to facilities to personnel with required security clearances, formal access authorizations and validate the need for access?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Restrict Unescorted Access", "description": "

Control Description

Physical access control mechanisms exist to restrict unescorted access to facilities to personnel with required security clearances, formal access authorizations and validate the need for access.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPhysical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Users are trained and encouraged to stop and question anyone attempting to install or remove IT assets from facilities.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to restrict unescorted access to facilities to personnel with required security clearances, formal access authorizations and validate the need for access.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-06.3", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-06.3", "references": "

Medium Business (50-249 staff)

∙ Emergency power shutoff procedure for IT equipment rooms

Large Business (250-999 staff)

∙ Emergency power shutoff capability for data center/server room (EPO)

Enterprise (>1,000 staff)

∙ Enterprise emergency power off (EPO) system\n∙ EPO training and drills\n∙ Integration with facility management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73111, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590925", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590925", "securityControlId": 31778, "ccis": [], "uuid": "48e29807-b6d9-5888-9566-dee0287bfe01", "testId": "PES-06.4_A01", "test": "automated mechanisms used to maintain visitor access records are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-08(01)_ODP[01]", "defaultText": null }, { "id": 73112, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590928", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590928", "securityControlId": 31778, "ccis": [], "uuid": "145fc23e-e88a-59ca-8bd0-5ca0c13dff2c", "testId": "PES-06.4_A02", "test": "automated mechanisms used to review visitor access records are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-08(01)_ODP[02]", "defaultText": null }, { "id": 73113, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590928", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590928", "securityControlId": 31778, "ccis": [], "uuid": "d25946a9-9b49-56c0-96d4-7a01afccd4e4", "testId": "PES-06.4_A03", "test": "visitor access records are maintained using automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PE-08(01)[01]", "defaultText": null }, { "id": 73114, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590928", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590928", "securityControlId": 31778, "ccis": [], "uuid": "978f9899-1db1-5b47-9007-e20755973eef", "testId": "PES-06.4_A04", "test": "visitor access records are reviewed using automated mechanisms.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-08(01)[02]", "defaultText": null } ], "externalMappings": [ { "id": 591014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58797", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c793b372-c335-513b-abf3-5117405d5af0", "parentControlId": 31778, "controlId": "PE-8(1)", "title": "PE-8(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58797" }, { "id": 591015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587971", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c05e8b0d-d80d-52dc-aaed-e2bdd336b065", "parentControlId": 31778, "controlId": "PE-08(01)", "title": "PE-08(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587971" }, { "id": 591016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587971", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2ece49d-07c4-5890-a640-e218e3fbf152", "parentControlId": 31778, "controlId": "PE-08(01)", "title": "PE-08(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587971" }, { "id": 591017, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587971", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "201703cc-089f-5ded-a823-9d5f43b0f915", "parentControlId": 31778, "controlId": "PE-08(01)", "title": "PE-08(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587971" }, { "id": 591018, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587971", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9add6486-0996-5aa4-b94c-bd55a0c3d4f9", "parentControlId": 31778, "controlId": "PE-08(01)", "title": "PE-08(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587971" } ], "id": 31778, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731243", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731243", "catalogueId": 1062, "uuid": "4a767cd5-05ed-5e18-ae87-bb0e0d060bae", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to facilitate the maintenance and review of visitor access records?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Automated Records Management & Review", "description": "

Control Description

Automated mechanisms exist to facilitate the maintenance and review of visitor access records.

Evidence Request List (ERL)

E-PES-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPhysical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically facilitate the maintenance and review of visitor access records.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-06.4", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-06.4", "references": "

Medium Business (50-249 staff)

∙ Emergency lighting in IT facility areas

Large Business (250-999 staff)

∙ Emergency lighting system in data center and critical areas

Enterprise (>1,000 staff)

∙ Enterprise emergency lighting system with battery backup\n∙ Regular testing program\n∙ Integration with facility safety systems", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73115, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590929", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590929", "securityControlId": 31779, "ccis": [], "uuid": "77e24372-33c2-5655-9bbb-1c22363bf672", "testId": "PES-06.5_A01", "test": "elements identified in the privacy risk assessment to limit Personal Data (PD) contained in visitor access logs are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-08(03)_ODP", "defaultText": null }, { "id": 73116, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590929", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590929", "securityControlId": 31779, "ccis": [], "uuid": "ecf6688b-ac72-5da2-ab2c-88a865d0dcd3", "testId": "PES-06.5_A02", "test": "Personal Data (PD) contained in visitor access records is limited to elements identified in the privacy risk assessment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-08(03)", "defaultText": null }, { "id": 73117, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590929", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590929", "securityControlId": 31779, "ccis": [], "uuid": "8f45b403-5e91-5cc6-9a62-0fccfd1aa381", "testId": "PES-06.5_A03", "test": "processes that implement the privacy principle of minimization are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08(33)_ODP", "defaultText": null }, { "id": 73118, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590929", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590929", "securityControlId": 31779, "ccis": [], "uuid": "700b6063-bbc4-5ad2-a5a1-abce1548c993", "testId": "PES-06.5_A04", "test": "the privacy principle of minimization is implemented using organization-defined processes.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08(33)", "defaultText": null } ], "externalMappings": [ { "id": 591024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587972", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92a90d81-5d22-593e-ae14-84254796a239", "parentControlId": 31779, "controlId": "PE-08(03)", "title": "PE-08(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587972" }, { "id": 591025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587972", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "daf225d3-2e2e-5ad5-95d0-3be8258a993d", "parentControlId": 31779, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587972" }, { "id": 591026, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587972", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b56f6a04-a63e-536c-a9d2-268ed0278b41", "parentControlId": 31779, "controlId": "SA-08(33)", "title": "SA-08(33)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587972" }, { "id": 591030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a09c6d14-8cf0-50f9-8ed1-52701f8cf36a", "parentControlId": 31779, "controlId": "PE-08(03)", "title": "PE-08(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587973" }, { "id": 591031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d43f5d68-7db8-5c13-a090-2c32cb7b087d", "parentControlId": 31779, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587973" }, { "id": 591032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9072500-d036-5ea3-8b61-2662be2275ba", "parentControlId": 31779, "controlId": "SA-08(33)", "title": "SA-08(33)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587973" }, { "id": 591033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d397f9c8-5075-5767-9c04-62fbe3ca305e", "parentControlId": 31779, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587973" }, { "id": 591034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3693a90-92b4-52bf-97fe-eabcc401ad95", "parentControlId": 31779, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587973" }, { "id": 591035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a3735cc-a0b4-5b64-b665-f1ccd1ffd687", "parentControlId": 31779, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587973" }, { "id": 591036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbee1e5b-6447-5ecc-a188-1971482deba8", "parentControlId": 31779, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587973" } ], "id": 31779, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731243", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731243", "catalogueId": 1062, "uuid": "2ded036e-1a0a-5677-85bb-f13bc5baf0d8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization minimize the collection of Personal Data (PD) contained in visitor access records?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Minimize Visitor Personal Data (PD)", "description": "

Control Description

Mechanisms exist to minimize the collection of Personal Data (PD) contained in visitor access records.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPhysical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to minimize the collection of Personal Data (PD) contained in visitor access records.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-06.5", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-06.5", "references": "

Medium Business (50-249 staff)

∙ Emergency response procedure for IT facility

Large Business (250-999 staff)

∙ Formal emergency response plan for IT facilities

Enterprise (>1,000 staff)

∙ Enterprise emergency response program for IT facilities\n∙ Regular drills\n∙ Integration with corporate emergency management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73119, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59093", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59093", "securityControlId": 31780, "ccis": [], "uuid": "175b7e1e-26e3-593f-ac6b-91535ca8b486", "testId": "PES-06.6_A01", "test": "visitor badges, or other issued identification, are surrendered before visitors leave the facility or are deactivated at a pre-determined time/date of expiration.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 591053, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03649387-6d80-5f84-a6a0-e93f9eea1a2d", "parentControlId": 31780, "controlId": "03.10.07.c", "title": "03.10.07.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587975" } ], "id": 31780, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731244", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731244", "catalogueId": 1062, "uuid": "37c856f6-ab33-5bb5-831a-7fc4c0bb4ddc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure visitor badges, or other issued identification, are surrendered before visitors leave the facility or are deactivated at a pre-determined time/date of expiration?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Visitor Access Revocation", "description": "

Control Description

Mechanisms exist to ensure visitor badges, or other issued identification, are surrendered before visitors leave the facility or are deactivated at a pre-determined time/date of expiration.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure visitor badges, or other issued identification, are surrendered before visitors leave the facility or are deactivated at a pre-determined time/date of expiration.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-06.6", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-06.6", "references": "

Large Business (250-999 staff)

∙ Physical security response capabilities for facility threats

Enterprise (>1,000 staff)

∙ Enterprise physical security response program\n∙ Dedicated security team\n∙ Coordination with law enforcement", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73120, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59093", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59093", "securityControlId": 31781, "ccis": [], "uuid": "7268496b-519e-500b-9c81-b346ff55667c", "testId": "PES-07_A01", "test": "power equipment for the system is protected from damage and destruction.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-09[01]", "defaultText": null }, { "id": 73121, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59093", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59093", "securityControlId": 31781, "ccis": [], "uuid": "cbda738a-03f2-5de3-95b0-5dda61ac2ce5", "testId": "PES-07_A02", "test": "power cabling for the system is protected from damage and destruction.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-09[02]", "defaultText": null } ], "externalMappings": [ { "id": 591071, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587977", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b5b8277-328b-57d2-bdb0-b8233a28524d", "parentControlId": 31781, "controlId": "7.11", "title": "7.11", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587977" }, { "id": 591072, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587977", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "018b6300-b9e2-5f4b-a03e-51578e7c0ab6", "parentControlId": 31781, "controlId": "7.12", "title": "7.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587977" }, { "id": 591079, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587979", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "874cf433-7996-526e-b6bc-ea258d4406fb", "parentControlId": 31781, "controlId": "PE-9", "title": "PE-9", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587979" }, { "id": 591080, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587979", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "434d4c35-1107-516b-bb87-79fe3b0fb3d5", "parentControlId": 31781, "controlId": "PE-09", "title": "PE-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587979" }, { "id": 591081, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587979", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92cab623-1247-57fe-a8a7-f05850537017", "parentControlId": 31781, "controlId": "PE-09", "title": "PE-09", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587979" }, { "id": 591082, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d62b929-ba11-5b3c-a02a-59b341e37c77", "parentControlId": 31781, "controlId": "PE-09", "title": "PE-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58798" }, { "id": 591083, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd8299f1-f09c-5e2f-a914-3a33a5a073b1", "parentControlId": 31781, "controlId": "PE-09", "title": "PE-09", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58798" }, { "id": 591084, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa1efa8e-7fa0-595e-af87-7ae4c89bf8ad", "parentControlId": 31781, "controlId": "PE-09", "title": "PE-09", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58798" }, { "id": 591085, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b0032b8-d8a7-5a0f-82f7-a2d5cc1d5d84", "parentControlId": 31781, "controlId": "03.10.08", "title": "03.10.08", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58798" }, { "id": 591086, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25def4a3-d5e4-5bc1-b1e2-3ee2629f4216", "parentControlId": 31781, "controlId": "PR.IR-02", "title": "PR.IR-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58798" }, { "controlId": "C.5.9", "title": "C.5.9 — Visitor Control Access Records", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "356f03cb-0ad4-51cb-9fb4-3c2cb03f94dc", "isPublic": true }, { "controlId": "NEI 08-09 App E.5.9", "title": "NEI 08-09 App E.5.9 — Visitor Control Access Records", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.5.9", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "eb278992-ae58-5500-abed-5466201c4342", "isPublic": true }, { "controlId": "10 CFR 73.55(g)(7)", "title": "10 CFR 73.55(g)(7) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.5.9", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "59900163-692a-55ff-9f97-7d3a11fed576", "isPublic": true }, { "controlId": "CIP-006-6-R2", "title": "CIP-006-6-R2 — Visitor Control Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e202c1c6-ca34-534b-a8a0-060bc13942cc", "isPublic": true }, { "controlId": "CIP-006-6-2.1", "title": "CIP-006-6-2.1 — Require continuous escorted access of visitors (individuals who are provided access but are not authorized for unesco...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "251d273b-8cfc-5cf0-83d2-92800edd7177", "isPublic": true }, { "controlId": "CIP-006-6-2.2", "title": "CIP-006-6-2.2 — Require manual or automated logging of visitor entry into and exit from the Physical Security Perimeter that includes...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "747e4ba4-9044-5b12-b562-5ac937d11eac", "isPublic": true }, { "controlId": "CIP-006-6-2.3", "title": "CIP-006-6-2.3 — Retain visitor logs for at least ninety calendar days.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-006-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "55400fde-5559-5bb4-90f8-32402667b9f9", "isPublic": true }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "9cd5de79-cacc-5174-86f7-c8e012013c07", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "345d6244-90eb-57cc-b592-196456fb6d5c", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "0e224693-d397-5da0-b125-1d10cbbdbc47", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "de1edd55-62cb-57c1-a9f6-2f5288b026cf", "isPublic": true } ], "id": 31781, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731244", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731244", "catalogueId": 1062, "uuid": "04b71e2e-4da8-5bdc-a451-fba8b31de9e0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect power equipment and power cabling for the system from damage and destruction?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Supporting Utilities", "description": "

Control Description

Facility security mechanisms exist to protect power equipment and power cabling for the system from damage and destruction.

Evidence Request List (ERL)

E-PES-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to protect power equipment and power cabling for the system from damage and destruction.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.5.9
NERC-CIP (2026) Requirements: CIP-006-6-R2", "controlId": "PES-07", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-07", "references": "

Micro-Small Business (<10 staff)

∙ Inspect deliveries for tampering before bringing into facility

Small Business (10-49 staff)

∙ Delivery inspection policy\n∙ Designated delivery area

Medium Business (50-249 staff)

∙ Formal delivery and removal inspection procedure

Large Business (250-999 staff)

∙ Enterprise delivery management program\n∙ Dedicated loading/receiving area\n∙ Package screening

Enterprise (>1,000 staff)

∙ Enterprise delivery security program\n∙ X-ray/screening for deliveries\n∙ Access controls at loading dock\n∙ CCTV monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73122, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590931", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590931", "securityControlId": 31782, "ccis": [], "uuid": "82c28313-6fdf-5a09-a1a9-53b99366e365", "testId": "PES-07.1_A01", "test": "the critical system components that require automatic voltage controls are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-09(02)_ODP", "defaultText": null }, { "id": 73123, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590931", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590931", "securityControlId": 31782, "ccis": [], "uuid": "96068e95-ea73-57ae-b0e7-23feae2540ff", "testId": "PES-07.1_A02", "test": "automatic voltage controls for critical system components are employed.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-09(02)", "defaultText": null } ], "externalMappings": [ { "id": 591118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ddfd65b-f339-51c6-8a5d-a1d85eb760c0", "parentControlId": 31782, "controlId": "7.11", "title": "7.11", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587984" }, { "id": 591122, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bff49689-f096-5ca9-a9c1-e965c918addc", "parentControlId": 31782, "controlId": "PE-9(2)", "title": "PE-9(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587984" }, { "id": 591123, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4029847-e81f-5f8f-91ba-95d959af09bb", "parentControlId": 31782, "controlId": "PE-09(02)", "title": "PE-09(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587985" }, { "id": 591124, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3cbb2c5f-5cdc-5144-9ba7-42e5a36e47f9", "parentControlId": 31782, "controlId": "PE-09(02)", "title": "PE-09(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587985" } ], "id": 31782, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731244", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731244", "catalogueId": 1062, "uuid": "1c5d69ca-8296-5733-b6e8-94cd34680e7e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize automatic voltage controls for critical system components?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Automatic Voltage Controls", "description": "

Control Description

Facility security mechanisms exist to utilize automatic voltage controls for critical system components.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to utilize automatic voltage controls for critical system components.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-07.1", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-07.1", "references": "

Micro-Small Business (<10 staff)

∙ Document and approve all equipment removals from facility

Small Business (10-49 staff)

∙ Equipment removal authorization policy

Medium Business (50-249 staff)

∙ Formal equipment removal authorization and logging procedure

Large Business (250-999 staff)

∙ Enterprise asset removal management program\n∙ Automated tracking of asset movements

Enterprise (>1,000 staff)

∙ Enterprise asset management platform with removal tracking (e.g., ServiceNow)\n∙ RFID/barcode tracking\n∙ Automated authorization workflows", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73124, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590931", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590931", "securityControlId": 31783, "ccis": [], "uuid": "d13ce3b3-947f-592c-81c4-d75364259720", "testId": "PES-07.2_A01", "test": "system or individual system components that require the capability to shut off power in emergency situations is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-10_ODP[01]", "defaultText": null }, { "id": 73125, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590931", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590931", "securityControlId": 31783, "ccis": [], "uuid": "444582e1-e829-546e-8202-e197b89c36b5", "testId": "PES-07.2_A02", "test": "location of emergency shutoff switches or devices by system or system component is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-10_ODP[02]", "defaultText": null }, { "id": 73126, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590931", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590931", "securityControlId": 31783, "ccis": [], "uuid": "7cec2168-5b9c-542c-89c9-e40e6ef0b846", "testId": "PES-07.2_A03", "test": "the capability to shut off power to system or individual system components in emergency situations is provided.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-10a.", "defaultText": null }, { "id": 73127, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590931", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590932", "securityControlId": 31783, "ccis": [], "uuid": "0de855fc-d658-5547-87f5-85a110506aea", "testId": "PES-07.2_A04", "test": "emergency shutoff switches or devices are placed in location to facilitate access for authorized personnel.
PPTDF Applicability: Facility
Assessment Rigor: 1
SCF Defined Parameters: near more than one egress point of the IT area and ensures it is labeled and protected by a cover to prevent accidental shut-off", "otherId": "53A_R5_PE-10b.", "defaultText": null }, { "id": 73128, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590932", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590932", "securityControlId": 31783, "ccis": [], "uuid": "5af6a857-f010-5d46-96c9-d81708ce048c", "testId": "PES-07.2_A05", "test": "the emergency power shutoff capability is protected from unauthorized activation.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PE-10c.", "defaultText": null } ], "externalMappings": [ { "id": 591134, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87126fbc-7e06-5241-8bac-d78b2d36236c", "parentControlId": 31783, "controlId": "7.11", "title": "7.11", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587986" }, { "id": 591138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d42fb676-91b9-531b-9c28-510b49bd134c", "parentControlId": 31783, "controlId": "PE-10", "title": "PE-10", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587986" }, { "id": 591139, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "470b7c6c-f3dc-597f-b2b5-6477a0dd36a1", "parentControlId": 31783, "controlId": "PE-10", "title": "PE-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587986" }, { "id": 591140, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34e1f290-e5fa-582b-98b9-2abced87b665", "parentControlId": 31783, "controlId": "PE-10", "title": "PE-10", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587986" }, { "id": 591141, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3881d1d3-55e1-565d-aaaa-81ef602dcb6d", "parentControlId": 31783, "controlId": "PE-10", "title": "PE-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587987" }, { "id": 591142, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0df03a6-3e96-596f-87a5-f77a2c5449ef", "parentControlId": 31783, "controlId": "PE-10", "title": "PE-10", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587987" }, { "id": 591143, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f23d07bd-ee1c-5238-a8b1-696fde9dc1ae", "parentControlId": 31783, "controlId": "PE-10", "title": "PE-10", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587987" } ], "id": 31783, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731244", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731244", "catalogueId": 1062, "uuid": "ac37ad9a-d390-5d77-8dfc-45e95d1c18ba", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization shut off power in emergency situations by:\n (1) Placing emergency shutoff switches or devices in close proximity to systems or system components to facilitate safe and easy access for personnel; and\n (2) Protecting emergency power shutoff capability from unauthorized activation?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Emergency Shutoff", "description": "

Control Description

Facility security mechanisms exist to shut off power in emergency situations by:\n(1) Placing emergency shutoff switches or devices in close proximity to systems or system components to facilitate safe and easy access for personnel; and\n(2) Protecting emergency power shutoff capability from unauthorized activation.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to shut off power in emergency situations by:\n(1) Placing emergency shutoff switches or devices in close proximity to systems or system components to facilitate safe and easy access for personnel; and\n(2) Protecting emergency power shutoff capability from unauthorized activation.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-07.2", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-07.2", "references": "

Micro-Small Business (<10 staff)

∙ Maintain a log of equipment entering and leaving the facility

Small Business (10-49 staff)

∙ Equipment movement log\n∙ Sign-in/sign-out for equipment

Medium Business (50-249 staff)

∙ Formal equipment movement tracking system\n∙ Barcode or asset tag scanning

Large Business (250-999 staff)

∙ Enterprise asset movement tracking system with barcode/RFID

Enterprise (>1,000 staff)

∙ Enterprise asset management with automated movement tracking (RFID/barcode)\n∙ Integration with physical access system", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73129, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590932", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590932", "securityControlId": 31784, "ccis": [], "uuid": "f1013a84-2e33-522b-8975-c93b5daf743c", "testId": "PES-07.3_A01", "test": "an uninterruptible power supply is provided to facilitate selected organization-defined values in the event of a primary power source loss.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-11_ODP\n53A_R5_PE-11", "defaultText": null }, { "id": 73130, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590932", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590932", "securityControlId": 31784, "ccis": [], "uuid": "4a84ed95-bdd0-5db2-bbdb-49d81879a484", "testId": "PES-07.3_A02", "test": "an alternate power supply provided for the system is activated upon organization-defined criteria.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-11(01)_ODP\n53A_R5_PE-11(01)[01]", "defaultText": null }, { "id": 73131, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590932", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590932", "securityControlId": 31784, "ccis": [], "uuid": "b4934bb1-bc49-5359-b5a7-e90a43b34e24", "testId": "PES-07.3_A03", "test": "the alternate power supply provided for the system can maintain minimally required operational capability in the event of an extended loss of the primary power source.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-11(01)[02]", "defaultText": null } ], "externalMappings": [ { "id": 591162, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587989", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe6b5dc0-a64b-5f5f-ba90-ec0f5f9c508e", "parentControlId": 31784, "controlId": "SR 7.5", "title": "SR 7.5", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587989" }, { "id": 591163, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587989", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cbd8d92e-c38f-5427-9d31-0ffc1809cae7", "parentControlId": 31784, "controlId": "7.11", "title": "7.11", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587989" }, { "id": 591167, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ca9fe9c-2385-5f34-b849-c3bf83a0bcb4", "parentControlId": 31784, "controlId": "PE-11", "title": "PE-11", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58799" }, { "id": 591168, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b73d36aa-e67d-58b6-a2fd-7c4abbc28071", "parentControlId": 31784, "controlId": "PE-11(1)", "title": "PE-11(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58799" }, { "id": 591169, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "039b21d1-a769-5f34-8196-a44dab71024b", "parentControlId": 31784, "controlId": "PE-11(2)", "title": "PE-11(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58799" }, { "id": 591170, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f57dda7-2bd4-5cfc-9a64-86049cbd8630", "parentControlId": 31784, "controlId": "PE-11", "title": "PE-11", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58799" }, { "id": 591171, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15f0515f-5bb3-52e0-ac68-ac5b16fd7855", "parentControlId": 31784, "controlId": "PE-11(01)", "title": "PE-11(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58799" }, { "id": 591172, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1240bd96-6958-5da0-b43e-452f635e095f", "parentControlId": 31784, "controlId": "PE-11(02)", "title": "PE-11(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58799" }, { "id": 591173, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6851aac9-c2e9-5e15-8ae6-0bcad5e270ad", "parentControlId": 31784, "controlId": "PE-11", "title": "PE-11", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58799" }, { "id": 591174, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab5ab337-10da-5850-a916-6b05bcf87ce0", "parentControlId": 31784, "controlId": "PE-11(01)", "title": "PE-11(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58799" }, { "id": 591175, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09a72ca7-982a-5bc2-b3c1-9742418da693", "parentControlId": 31784, "controlId": "PE-11", "title": "PE-11", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58799" }, { "id": 591176, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0619a954-b38f-5cff-b8e4-3196aa01997e", "parentControlId": 31784, "controlId": "PE-11(01)", "title": "PE-11(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587991" }, { "id": 591177, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "349e1c9d-c3cd-5dfd-86eb-5b5be338f60b", "parentControlId": 31784, "controlId": "PE-11(02)", "title": "PE-11(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587991" }, { "id": 591178, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78b385dc-fa82-5e44-bc23-a7fdf53d06a5", "parentControlId": 31784, "controlId": "PE-11", "title": "PE-11", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587991" }, { "id": 591179, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2223d679-362d-56b3-af6f-d54ec13cc993", "parentControlId": 31784, "controlId": "PE-11", "title": "PE-11", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587991" }, { "id": 591180, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587991", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45fb23d9-e0da-5dbe-b2ac-053ee4482f5c", "parentControlId": 31784, "controlId": "PE-11(01)", "title": "PE-11(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587991" } ], "id": 31784, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731245", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731245", "catalogueId": 1062, "uuid": "64aa1763-7295-51a6-af05-3198e38a08f8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization supply alternate power, capable of maintaining minimally-required operational capability, in the event of an extended loss of the primary power source?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Emergency Power", "description": "

Control Description

Facility security mechanisms exist to supply alternate power, capable of maintaining minimally-required operational capability, in the event of an extended loss of the primary power source.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to supply alternate power, capable of maintaining minimally-required operational capability, in the event of an extended loss of the primary power source.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-07.3", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-07.3", "references": "

Micro-Small Business (<10 staff)

∙ Periodically verify that IT equipment is present and accounted for

Small Business (10-49 staff)

∙ Periodic physical inventory of IT assets

Medium Business (50-249 staff)

∙ Formal physical asset inventory procedure\n∙ Scheduled physical audits

Large Business (250-999 staff)

∙ Enterprise physical asset audit program\n∙ Automated inventory verification

Enterprise (>1,000 staff)

∙ Enterprise asset management platform with automated physical inventory (RFID, barcode)\n∙ Scheduled audit program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73132, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590933", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590933", "securityControlId": 31785, "ccis": [], "uuid": "6b4b313c-d0b6-53a4-8733-7fa1bf1b49f4", "testId": "PES-07.4_A01", "test": "automatic emergency lighting that activates in the event of a power outage or disruption is employed for the system.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-12[01]", "defaultText": null }, { "id": 73133, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590933", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590933", "securityControlId": 31785, "ccis": [], "uuid": "74eaff81-18ac-529d-94e1-793e8f566076", "testId": "PES-07.4_A02", "test": "automatic emergency lighting that activates in the event of a power outage or disruption is maintained for the system.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-12[02]", "defaultText": null }, { "id": 73134, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590933", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590933", "securityControlId": 31785, "ccis": [], "uuid": "750bc5b9-c0cc-5d04-8ac8-faa5291f8f45", "testId": "PES-07.4_A03", "test": "automatic emergency lighting for the system covers emergency exits within the facility.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-12[03]", "defaultText": null }, { "id": 73135, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590933", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590933", "securityControlId": 31785, "ccis": [], "uuid": "7746ad86-073c-535c-be35-99d083aefa76", "testId": "PES-07.4_A04", "test": "automatic emergency lighting for the system covers evacuation routes within the facility.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-12[04]", "defaultText": null } ], "externalMappings": [ { "id": 591206, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b645cf6b-795e-541f-9d94-996afeb76e12", "parentControlId": 31785, "controlId": "7.11", "title": "7.11", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587994" }, { "id": 591210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5df5caac-d6f7-54dc-9f7a-0fe2d35aa789", "parentControlId": 31785, "controlId": "PE-12", "title": "PE-12", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587994" }, { "id": 591211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "787e664d-e004-514b-bfd9-414ece8b4a41", "parentControlId": 31785, "controlId": "PE-12", "title": "PE-12", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587995" }, { "id": 591212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e82ac31b-2f87-577b-85b2-4624d91c4569", "parentControlId": 31785, "controlId": "PE-12", "title": "PE-12", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587995" }, { "id": 591213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39fd9c1e-971f-5245-97c1-79f1b0024b9f", "parentControlId": 31785, "controlId": "PE-12", "title": "PE-12", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587995" }, { "id": 591214, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "267cf255-ded4-550c-b7d6-87f4f3fdc46c", "parentControlId": 31785, "controlId": "PE-12", "title": "PE-12", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587995" }, { "id": 591215, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ccbd9078-0e01-5f65-a375-7903215f9068", "parentControlId": 31785, "controlId": "PE-12", "title": "PE-12", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587995" }, { "id": 591216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a39cff3-6d98-51ae-897f-09ed660d8ce3", "parentControlId": 31785, "controlId": "PE-12", "title": "PE-12", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587995" } ], "id": 31785, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731245", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731245", "catalogueId": 1062, "uuid": "212201a6-e041-55d5-a85c-1a4ff30aeedf", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize and maintain automatic emergency lighting that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Emergency Lighting", "description": "

Control Description

Facility security mechanisms exist to utilize and maintain automatic emergency lighting that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to utilize and maintain automatic emergency lighting that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-07.4", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-07.4", "references": "

Micro-Small Business (<10 staff)

∙ Store equipment securely when not in use

Small Business (10-49 staff)

∙ Equipment storage security policy\n∙ Secure storage for portable/critical equipment

Medium Business (50-249 staff)

∙ Formal equipment storage security policy\n∙ Locked storage with access controls

Large Business (250-999 staff)

∙ Enterprise secure equipment storage program\n∙ Access-controlled storage areas

Enterprise (>1,000 staff)

∙ Enterprise secure equipment storage and management program\n∙ Access-controlled vaults\n∙ Environmental monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73136, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590933", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590933", "securityControlId": 31786, "ccis": [], "uuid": "c1495ab5-da91-51a1-b9d7-e04f357ac579", "testId": "PES-07.5_A01", "test": "the system is protected from damage resulting from water leakage by providing master shutoff or isolation valves.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-15[01]", "defaultText": null }, { "id": 73137, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59094", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59094", "securityControlId": 31786, "ccis": [], "uuid": "2fd40473-905a-54b3-816e-123e5f23102d", "testId": "PES-07.5_A02", "test": "the master shutoff or isolation valves are accessible.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-15[02]", "defaultText": null }, { "id": 73138, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59094", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59094", "securityControlId": 31786, "ccis": [], "uuid": "74f3236b-2f54-5719-aae2-546232589f52", "testId": "PES-07.5_A03", "test": "the master shutoff or isolation valves are working properly.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-15[03]", "defaultText": null }, { "id": 73139, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59094", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59094", "securityControlId": 31786, "ccis": [], "uuid": "19f91667-6fd2-56d6-969b-3a6c0af436de", "testId": "PES-07.5_A04", "test": "the master shutoff or isolation valves are known to key personnel.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-15[04]", "defaultText": null } ], "externalMappings": [ { "id": 591239, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00c27540-c89a-5ac4-afab-aced11d7fca3", "parentControlId": 31786, "controlId": "PE-15", "title": "PE-15", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587998" }, { "id": 591240, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d3ce3b4-26a3-5337-9dd7-9f98c70c295f", "parentControlId": 31786, "controlId": "PE-15", "title": "PE-15", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587998" }, { "id": 591241, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77a6b9b0-ef94-5885-a684-7daf245370c1", "parentControlId": 31786, "controlId": "PE-15", "title": "PE-15", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587999" }, { "id": 591242, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e34aa703-6478-5342-b4cf-e11d62264cc0", "parentControlId": 31786, "controlId": "PE-15", "title": "PE-15", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587999" }, { "id": 591243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a56471a1-ba0a-56ae-8110-f4c88b94f616", "parentControlId": 31786, "controlId": "PE-15", "title": "PE-15", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587999" }, { "id": 591244, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9278e85-582a-5451-acc7-3edbfa1149e8", "parentControlId": 31786, "controlId": "PE-15", "title": "PE-15", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587999" }, { "id": 591245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "224b7bb1-a64e-5c22-b687-7bce276530de", "parentControlId": 31786, "controlId": "PE-15", "title": "PE-15", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587999" }, { "id": 591246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.587999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5635329d-ffa1-5d99-a7a7-edb23a4f6495", "parentControlId": 31786, "controlId": "PR.IR-02", "title": "PR.IR-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.587999" } ], "id": 31786, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731245", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731245", "catalogueId": 1062, "uuid": "72ae9252-6b03-5556-9c04-a2cdae3aa70f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect systems from damage resulting from water leakage by providing master shutoff valves that are accessible, working properly and known to key personnel?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Water Damage Protection", "description": "

Control Description

Facility security mechanisms exist to protect systems from damage resulting from water leakage by providing master shutoff valves that are accessible, working properly and known to key personnel.

Evidence Request List (ERL)

E-PES-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPhysical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to protect systems from damage resulting from water leakage by providing master shutoff valves that are accessible, working properly and known to key personnel.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-07.5", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-07.5", "references": "

Micro-Small Business (<10 staff)

∙ Water leak sensors\n∙ Humidity sensors

Small Business (10-49 staff)

∙ Water leak sensors\n∙ Humidity sensors

Medium Business (50-249 staff)

∙ Water leak sensors\n∙ Humidity sensors

Large Business (250-999 staff)

∙ Water leak sensors\n∙ Humidity sensors

Enterprise (>1,000 staff)

∙ Water leak sensors\n∙ Humidity sensors", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73140, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59094", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59094", "securityControlId": 31787, "ccis": [], "uuid": "fe43dfdd-53dd-580b-91b8-146463d81b6a", "testId": "PES-07.6_A01", "test": "personnel or roles to be alerted when the presence of water is detected near the system is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-15(01)_ODP[01]", "defaultText": null }, { "id": 73141, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590941", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590941", "securityControlId": 31787, "ccis": [], "uuid": "050d729a-7709-5b73-9fd4-8a194a993da3", "testId": "PES-07.6_A02", "test": "automated mechanisms used to detect the presence of water near the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-15(01)_ODP[02]", "defaultText": null }, { "id": 73142, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590941", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590941", "securityControlId": 31787, "ccis": [], "uuid": "3523369d-4fd9-5f5e-be15-b4be5c41adee", "testId": "PES-07.6_A03", "test": "the presence of water near the system can be detected automatically.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-15(01)[01]", "defaultText": null }, { "id": 73143, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590941", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590941", "securityControlId": 31787, "ccis": [], "uuid": "01c39cc5-4e30-56b2-8b6a-d7338b7a208c", "testId": "PES-07.6_A04", "test": "organization-defined personnel or roles is/are alerted using organization-defined automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PE-15(01)[02]", "defaultText": null } ], "externalMappings": [ { "id": 591262, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588001", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42492d10-fa2e-56d2-8a5c-d10857e9d8cf", "parentControlId": 31787, "controlId": "PE-15(1)", "title": "PE-15(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588001" }, { "id": 591263, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "569381a0-ef1a-5bcf-b8af-49e4af2ae1db", "parentControlId": 31787, "controlId": "PE-15(01)", "title": "PE-15(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588002" }, { "id": 591264, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffed42f6-427f-5210-9256-23d83c7f644f", "parentControlId": 31787, "controlId": "PE-15(01)", "title": "PE-15(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588002" }, { "id": 591265, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bf35785-5a6e-5c75-94ad-65ffacca17c8", "parentControlId": 31787, "controlId": "PE-15(01)", "title": "PE-15(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588002" }, { "id": 591266, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fe76e64-d0b5-53e4-bc38-0a9fe4cae285", "parentControlId": 31787, "controlId": "PE-15(01)", "title": "PE-15(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588002" } ], "id": 31787, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731246", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731246", "catalogueId": 1062, "uuid": "e2475739-5f58-5b24-8b95-9ff43dd9e8da", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization detect the presence of water in the vicinity of critical systems and alert facility maintenance and IT personnel?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Automation Support for Water Damage Protection", "description": "

Control Description

Facility security mechanisms exist to detect the presence of water in the vicinity of critical systems and alert facility maintenance and IT personnel.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPhysical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to detect the presence of water in the vicinity of critical systems and alert facility maintenance and IT personnel.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-07.6", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-07.6", "references": "

Micro-Small Business (<10 staff)

∙ Inspect returned equipment for damage or tampering

Small Business (10-49 staff)

∙ Equipment inspection policy upon return from external use

Medium Business (50-249 staff)

∙ Formal returned equipment inspection procedure

Large Business (250-999 staff)

∙ Enterprise equipment return and inspection program\n∙ Sanitization before reuse

Enterprise (>1,000 staff)

∙ Enterprise equipment lifecycle management\n∙ Formal inspection and sanitization procedures\n∙ Forensic review for suspect equipment", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73144, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590941", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590941", "securityControlId": 31788, "ccis": [], "uuid": "621c2b33-741f-5c85-b9b3-053cb03bac6e", "testId": "PES-07.7_A01", "test": "distance by which redundant power cabling paths are to be physically separated is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-09(01)_ODP", "defaultText": null }, { "id": 73145, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590942", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590942", "securityControlId": 31788, "ccis": [], "uuid": "3e270fe6-b1ce-5d36-a2ac-50db39aa4c4d", "testId": "PES-07.7_A02", "test": "redundant power cabling paths that are physically separated by organization-defined distance are employed.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-09(01)", "defaultText": null } ], "externalMappings": [ { "id": 591269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b00dfb4-3b55-5f66-93fa-94e24d295657", "parentControlId": 31788, "controlId": "PE-9(1)", "title": "PE-9(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588003" }, { "id": 591270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f9c9fdd-3b41-5152-9069-c0055d0a5de7", "parentControlId": 31788, "controlId": "PE-09(01)", "title": "PE-09(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588003" }, { "id": 591271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e127002-3856-5ab7-ac85-1721e3016a5c", "parentControlId": 31788, "controlId": "PE-09(01)", "title": "PE-09(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588003" } ], "id": 31788, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731246", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731246", "catalogueId": 1062, "uuid": "1b490163-f740-53c9-aea6-b2b3a218945f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization employ redundant power cabling paths that are physically separated to ensure that power continues to flow in the event one of the cables is cut or otherwise damaged?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Redundant Cabling", "description": "

Control Description

Mechanisms exist to employ redundant power cabling paths that are physically separated to ensure that power continues to flow in the event one of the cables is cut or otherwise damaged.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to employ redundant power cabling paths that are physically separated to ensure that power continues to flow in the event one of the cables is cut or otherwise damaged.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-07.7", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-07.7", "references": "

Medium Business (50-249 staff)

∙ Review and approve any AI/autonomous equipment brought into facility

Large Business (250-999 staff)

∙ Policy for AI/autonomous equipment in facility\n∙ Approval process for new AI devices

Enterprise (>1,000 staff)

∙ Enterprise AI equipment governance policy\n∙ Formal approval process for AI devices in facility", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73146, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590942", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590942", "securityControlId": 31789, "ccis": [], "uuid": "74aca67e-8da3-5288-b767-bd0f3e22eb57", "testId": "PES-08_A01", "test": "fire detection systems are employed.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-13[01]", "defaultText": null }, { "id": 73147, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590942", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590942", "securityControlId": 31789, "ccis": [], "uuid": "a98be8c6-6750-5fb0-b2d0-f21bd8c362ae", "testId": "PES-08_A02", "test": "employed fire detection systems are supported by an independent energy source.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-13[02]", "defaultText": null }, { "id": 73148, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590942", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590942", "securityControlId": 31789, "ccis": [], "uuid": "4af50f94-f3a1-591c-8e32-e541cbdc3909", "testId": "PES-08_A03", "test": "employed fire detection systems are maintained.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-13[03]", "defaultText": null }, { "id": 73149, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590942", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590942", "securityControlId": 31789, "ccis": [], "uuid": "cdea9725-0451-5840-b486-f66aba141058", "testId": "PES-08_A04", "test": "fire suppression systems are employed.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-13[04]", "defaultText": null }, { "id": 73150, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590943", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590943", "securityControlId": 31789, "ccis": [], "uuid": "8d14971a-f35d-58bd-9b00-d8c8a17c4fe1", "testId": "PES-08_A05", "test": "employed fire suppression systems are supported by an independent energy source.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-13[05]", "defaultText": null }, { "id": 73151, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590943", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590943", "securityControlId": 31789, "ccis": [], "uuid": "1ed6e30f-71a2-515b-82e8-7dd1e13b6e8f", "testId": "PES-08_A06", "test": "employed fire suppression systems are maintained.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-13[06]", "defaultText": null } ], "externalMappings": [ { "id": 591282, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588004", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c09072d-7503-5c19-acb1-6531c758cbce", "parentControlId": 31789, "controlId": "PE-13", "title": "PE-13", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588004" }, { "id": 591283, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588005", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "654bd2c9-bcfb-512f-9535-282381207b95", "parentControlId": 31789, "controlId": "PE-13", "title": "PE-13", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588005" }, { "id": 591284, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588006", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07a1eb29-2ee8-5707-bdf0-043a0caf2da9", "parentControlId": 31789, "controlId": "PE-13", "title": "PE-13", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588006" }, { "id": 591285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588006", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75c6f58f-7871-57bd-bdb5-4b6db27d0fac", "parentControlId": 31789, "controlId": "PE-13", "title": "PE-13", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588006" }, { "id": 591286, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588006", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d061daf-7b32-5276-8493-d27149f3a388", "parentControlId": 31789, "controlId": "PE-13", "title": "PE-13", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588006" }, { "id": 591287, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588006", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a941f5c6-c79b-5e69-9977-c0fc20f73b53", "parentControlId": 31789, "controlId": "PE-13", "title": "PE-13", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588006" }, { "id": 591288, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588006", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33df4ccb-6d9e-58ee-be04-510be34382e2", "parentControlId": 31789, "controlId": "PE-13", "title": "PE-13", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588006" }, { "id": 591289, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588006", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c30390a-4c47-5e66-ac05-4159f56efae6", "parentControlId": 31789, "controlId": "PR.IR-02", "title": "PR.IR-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588006" }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "fd2e2ff2-4979-561d-93c8-b75cb305025f", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "738d9e8b-85d3-56a4-98c0-9dc1a9f80e98", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "ef94f0a4-ce32-58e2-b1ba-45e0b915c266", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "f9b26ab2-e77b-5f12-8c28-f44e7985eea1", "isPublic": true } ], "id": 31789, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731247", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731247", "catalogueId": 1062, "uuid": "d745a50f-70f8-579b-82f6-2e3756244403", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize and maintain fire suppression and detection devices/systems for the system that are supported by an independent energy source?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Fire Protection", "description": "

Control Description

Facility security mechanisms exist to utilize and maintain fire suppression and detection devices/systems for the system that are supported by an independent energy source.

Evidence Request List (ERL)

E-PES-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to utilize and maintain fire suppression and detection devices/systems for the system that are supported by an independent energy source.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-08", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-08", "references": "

Micro-Small Business (<10 staff)

∙ Secure cables and equipment to prevent unauthorized access

Small Business (10-49 staff)

∙ Cabling security policy\n∙ Protect network and power cabling

Medium Business (50-249 staff)

∙ Formal cabling security standards\n∙ Cable protection and labeling

Large Business (250-999 staff)

∙ Enterprise cabling management program\n∙ Protected pathways\n∙ Cable labeling and documentation

Enterprise (>1,000 staff)

∙ Enterprise cabling security and management program (e.g., structured cabling standards)\n∙ Automated cable plant documentation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73152, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590943", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590943", "securityControlId": 31790, "ccis": [], "uuid": "2a11b66b-2ff1-50d0-b7f2-4db4ea9bc163", "testId": "PES-08.1_A01", "test": "personnel or roles to be notified in the event of a fire is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: service provider building maintenance/physical security personnel", "otherId": "53A_R5_PE-13(01)_ODP[01]", "defaultText": null }, { "id": 73153, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590943", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590943", "securityControlId": 31790, "ccis": [], "uuid": "232f040e-708f-5b99-a8b6-90da43018ee5", "testId": "PES-08.1_A02", "test": "emergency responders to be notified in the event of a fire are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: service provider emergency responders with incident response responsibilities", "otherId": "53A_R5_PE-13(01)_ODP[02]", "defaultText": null }, { "id": 73154, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590943", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590943", "securityControlId": 31790, "ccis": [], "uuid": "8f298e50-6344-5bad-a2ab-cd256f0e67a5", "testId": "PES-08.1_A03", "test": "fire detection systems that activate automatically are employed in the event of a fire.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-13(01)[01]", "defaultText": null }, { "id": 73155, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590944", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590944", "securityControlId": 31790, "ccis": [], "uuid": "e93337bc-2458-5e56-a93a-91ece1764f00", "testId": "PES-08.1_A04", "test": "fire detection systems that notify organization-defined personnel or roles automatically are employed in the event of a fire.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-13(01)[02]", "defaultText": null }, { "id": 73156, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590944", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590944", "securityControlId": 31790, "ccis": [], "uuid": "c45f4ba9-0194-5b9e-9eb3-ecfd43d3196d", "testId": "PES-08.1_A05", "test": "fire detection systems that notify organization-defined emergency responders automatically are employed in the event of a fire.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-13(01)[03]", "defaultText": null } ], "externalMappings": [ { "id": 591311, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65dd7fe9-195e-5c38-8dfd-a7b8469b017d", "parentControlId": 31790, "controlId": "PE-13(1)", "title": "PE-13(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58802" }, { "id": 591312, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0cecaf7-b8b5-535c-80c5-6d7b024bcbbc", "parentControlId": 31790, "controlId": "PE-13(01)", "title": "PE-13(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58802" }, { "id": 591313, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4827303e-ae84-5518-b502-18b392a23a99", "parentControlId": 31790, "controlId": "PE-13(01)", "title": "PE-13(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58802" }, { "id": 591314, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588021", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30bcb80d-1b25-53b3-913d-f4af83eda689", "parentControlId": 31790, "controlId": "PE-13(01)", "title": "PE-13(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588021" }, { "id": 591315, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588021", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c870b946-0018-5289-a947-5907775d4de6", "parentControlId": 31790, "controlId": "PE-13(01)", "title": "PE-13(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588021" }, { "id": 591316, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588021", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58c2c79a-bb24-51f7-a17a-8930039f46ae", "parentControlId": 31790, "controlId": "PE-13(01)", "title": "PE-13(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588021" } ], "id": 31790, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731247", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731247", "catalogueId": 1062, "uuid": "0eb302ee-4658-54df-ae18-f1689500f720", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize and maintain fire detection devices/systems that activate automatically and notify organizational personnel and emergency responders in the event of a fire?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Fire Detection Devices", "description": "

Control Description

Facility security mechanisms exist to utilize and maintain fire detection devices/systems that activate automatically and notify organizational personnel and emergency responders in the event of a fire.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to utilize and maintain fire detection devices/systems that activate automatically and notify organizational personnel and emergency responders in the event of a fire.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-08.1", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-08.1", "references": "

Micro-Small Business (<10 staff)

∙ Label and document all network cables

Small Business (10-49 staff)

∙ Cable labeling policy and procedure

Medium Business (50-249 staff)

∙ Formal cable labeling and documentation standards

Large Business (250-999 staff)

∙ Enterprise cable management system with documentation

Enterprise (>1,000 staff)

∙ Enterprise cable management platform (e.g., Netbox, IT Portal)\n∙ Automated cable plant documentation\n∙ DCIM integration", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73157, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590944", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590944", "securityControlId": 31791, "ccis": [], "uuid": "89b1c7c0-04b1-5f78-931e-113bef291dbb", "testId": "PES-08.2_A01", "test": "fire suppression systems that notify organization-defined personnel or roles automatically are employed.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-13(02)(a)[02]", "defaultText": null }, { "id": 73158, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590944", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590944", "securityControlId": 31791, "ccis": [], "uuid": "2877d3e9-7e01-5804-8ed6-0e25fd7c53bd", "testId": "PES-08.2_A02", "test": "fire suppression systems that notify organization-defined emergency responders automatically are employed.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-13(02)(a)[03]", "defaultText": null }, { "id": 73159, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590945", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590945", "securityControlId": 31791, "ccis": [], "uuid": "2df23630-15d2-5f1a-9e06-8b59fde2cb64", "testId": "PES-08.2_A03", "test": "personnel or roles to be notified in the event of a fire is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PE-13(02)_ODP[01]", "defaultText": null }, { "id": 73160, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590945", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590945", "securityControlId": 31791, "ccis": [], "uuid": "858e7ffe-b2d1-5138-8614-12ce55789e6d", "testId": "PES-08.2_A04", "test": "emergency responders to be notified in the event of a fire are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PE-13(02)_ODP[02]", "defaultText": null }, { "id": 73161, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590945", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590945", "securityControlId": 31791, "ccis": [], "uuid": "21c2d62d-f95d-55d7-8945-d7604a814712", "testId": "PES-08.2_A05", "test": "fire suppression systems that activate automatically are employed.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-13(02)(a)[01]", "defaultText": null } ], "externalMappings": [ { "id": 591330, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588023", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bf44bca-4884-5735-9b2a-f07cc73c212e", "parentControlId": 31791, "controlId": "PE-13(2)", "title": "PE-13(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588023" }, { "id": 591331, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588023", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7f0e42d-c3df-55b5-9a3a-fe6388d5e671", "parentControlId": 31791, "controlId": "PE-13(02)", "title": "PE-13(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588023" }, { "id": 591333, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588023", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00fb880e-effd-5e82-b28f-25c489fdcebc", "parentControlId": 31791, "controlId": "PE-13(02)", "title": "PE-13(02)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588023" }, { "id": 591334, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588023", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b386d42-31c3-52de-8d38-24bbf821c7db", "parentControlId": 31791, "controlId": "PE-13(02)", "title": "PE-13(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588023" } ], "id": 31791, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731247", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731247", "catalogueId": 1062, "uuid": "cff88dea-317a-54b1-8756-bd486f13abe8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize fire suppression devices/systems that provide automatic notification of any activation to organizational personnel and emergency responders?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 3.0, "title": "Fire Suppression Devices", "description": "

Control Description

Facility security mechanisms exist to utilize fire suppression devices/systems that provide automatic notification of any activation to organizational personnel and emergency responders.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPhysical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to utilize fire suppression devices/systems that provide automatic notification of any activation to organizational personnel and emergency responders.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-08.2", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-08.2", "references": "

Micro-Small Business (<10 staff)

∙ Protect cables from physical damage

Small Business (10-49 staff)

∙ Physical cable protection policy\n∙ Use cable conduits in sensitive areas

Medium Business (50-249 staff)

∙ Formal cabling protection standards\n∙ Conduit use in exposed or high-risk areas

Large Business (250-999 staff)

∙ Enterprise cabling protection program\n∙ Armored cabling for sensitive runs\n∙ Physical cable protection audits

Enterprise (>1,000 staff)

∙ Enterprise cabling protection and management program\n∙ Armored conduits\n∙ Regular physical cable audits", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73162, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590947", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590947", "securityControlId": 31792, "ccis": [], "uuid": "98884c02-44e6-5555-b522-bc58664e7975", "testId": "PES-08.3_A01", "test": "an automatic fire suppression capability is employed when the facility is not staffed on a continuous basis.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-13(02)(b)", "defaultText": null } ], "externalMappings": [ { "id": 591350, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588025", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e69536fa-854d-547d-8e45-cb17bfe5aef5", "parentControlId": 31792, "controlId": "PE-13(3)", "title": "PE-13(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588025" }, { "id": 591351, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588026", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5df45bbc-9ac3-58fc-a9e7-a1487d4aee17", "parentControlId": 31792, "controlId": "PE-13(02)", "title": "PE-13(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588026" }, { "id": 591353, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588026", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84a080ee-daac-50e0-8691-7a367298c3de", "parentControlId": 31792, "controlId": "PE-13(02)", "title": "PE-13(02)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588026" }, { "id": 591354, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588026", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "521e4191-0aaa-5b14-8e56-2a740bbc56f1", "parentControlId": 31792, "controlId": "PE-13(02)", "title": "PE-13(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588026" }, { "id": 591355, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588026", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fa360f2-d320-5f13-9ad8-cb1930765dc3", "parentControlId": 31792, "controlId": "PE-13(02)", "title": "PE-13(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588026" } ], "id": 31792, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731248", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731248", "catalogueId": 1062, "uuid": "0ecae9c0-ece8-5b12-9011-3eb45ff9897a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization employ an automatic fire suppression capability for critical systems when the facility is not staffed on a continuous basis?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Automatic Fire Suppression", "description": "

Control Description

Facility security mechanisms exist to employ an automatic fire suppression capability for critical systems when the facility is not staffed on a continuous basis.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to employ an automatic fire suppression capability for critical systems when the facility is not staffed on a continuous basis.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-08.3", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-08.3", "references": "

Micro-Small Business (<10 staff)

∙ Separate power and data cables to reduce interference and tampering risk

Small Business (10-49 staff)

∙ Power/data cable separation policy

Medium Business (50-249 staff)

∙ Formal power and data cable separation standards

Large Business (250-999 staff)

∙ Enterprise cabling standards with physical separation of power and data

Enterprise (>1,000 staff)

∙ Enterprise cabling infrastructure program with full power/data separation\n∙ DCIM documentation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73163, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590947", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590947", "securityControlId": 31793, "ccis": [], "uuid": "89ff9cdc-1ca4-5a96-a6eb-efd020ae4a3e", "testId": "PES-09_A01", "test": "environmental control(s) for which to maintain a specified level in the facility where the system resides are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-14_ODP[01]\n53A_R5_PE-14_ODP[02]", "defaultText": null }, { "id": 73164, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590947", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590947", "securityControlId": 31793, "ccis": [], "uuid": "56df78ef-2d3a-5ae9-a02a-906452c9fdb8", "testId": "PES-09_A02", "test": "acceptable levels for environmental controls are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-14_ODP[03]", "defaultText": null }, { "id": 73165, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590948", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590948", "securityControlId": 31793, "ccis": [], "uuid": "942cb7e6-18ef-5251-8bd6-61a26a16f4f6", "testId": "PES-09_A03", "test": "frequency at which to monitor environmental control levels is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-14_ODP[04]", "defaultText": null }, { "id": 73166, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590948", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590948", "securityControlId": 31793, "ccis": [], "uuid": "3757b36f-37c2-5dee-8ab2-55e1a0e0dce0", "testId": "PES-09_A04", "test": "levels are maintained at acceptable levels within the facility where the system resides.
PPTDF Applicability: Facility
Assessment Rigor: 1
SCF Defined Parameters: consistent with American Society of Heating, Refrigerating and Air-conditioning Engineers (ASHRAE) document entitled Thermal Guidelines for Data Processing Environments", "otherId": "53A_R5_PE-14a.", "defaultText": null }, { "id": 73167, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590948", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590948", "securityControlId": 31793, "ccis": [], "uuid": "56a170fb-e11b-5a7d-9f7e-b33ae73ef59b", "testId": "PES-09_A05", "test": "environmental control levels are monitored frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PE-14b.", "defaultText": null } ], "externalMappings": [ { "id": 591372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588028", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25f2be3c-8ba9-5ad8-a858-83e17f5f4e44", "parentControlId": 31793, "controlId": "PE-14", "title": "PE-14", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588028" }, { "id": 591373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588028", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "865fc34c-88df-5bb0-821d-0f92b3da9f9e", "parentControlId": 31793, "controlId": "PE-14", "title": "PE-14", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588028" }, { "id": 591374, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588028", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "158e8afd-2f96-57b5-88a5-3bf3e351c6da", "parentControlId": 31793, "controlId": "PE-14", "title": "PE-14", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588028" }, { "id": 591375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588028", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d285accb-7fa8-5c69-b613-b83d6b35a04d", "parentControlId": 31793, "controlId": "PE-14", "title": "PE-14", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588028" }, { "id": 591376, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15546988-3743-5aa5-a294-872c58c8e778", "parentControlId": 31793, "controlId": "PE-14", "title": "PE-14", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588029" }, { "id": 591377, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb2b8432-1202-55ee-8b20-d96f180ee85b", "parentControlId": 31793, "controlId": "PE-14", "title": "PE-14", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588029" }, { "id": 591378, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc28fe34-2d3b-539a-8381-36c6ee40d9c3", "parentControlId": 31793, "controlId": "PE-14", "title": "PE-14", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588029" }, { "id": 591379, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e183e49-e14e-53e5-b157-36ccb4f279e2", "parentControlId": 31793, "controlId": "PR.IR-02", "title": "PR.IR-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588029" }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "1f93edae-c6a5-5783-aff2-1eafc6c9fe36", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "82366a06-7fcc-5d63-9efb-9f6c791ff2a8", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "b13910c3-dab9-5713-998e-27b29f751223", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "c145026b-8d5a-59b5-9f64-f3475d83d48c", "isPublic": true } ], "id": 31793, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731248", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731248", "catalogueId": 1062, "uuid": "a8491918-432f-5444-b438-e25cd88697a7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain and monitor temperature and humidity levels within the facility?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Temperature & Humidity Controls", "description": "

Control Description

Facility security mechanisms exist to maintain and monitor temperature and humidity levels within the facility.

Evidence Request List (ERL)

E-PES-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to maintain and monitor temperature and humidity levels within the facility.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-09", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-09", "references": "

Micro-Small Business (<10 staff)

∙ Know what utilities (power, water, HVAC) serve IT equipment

Small Business (10-49 staff)

∙ Utility inventory for IT facilities\n∙ Utility service contacts

Medium Business (50-249 staff)

∙ Formal utility management policy for IT facilities\n∙ Utility protection measures

Large Business (250-999 staff)

∙ Enterprise utility management program\n∙ Redundant utilities\n∙ Monitoring of utility services

Enterprise (>1,000 staff)

∙ Enterprise utility management platform\n∙ Redundant utility feeds\n∙ Automated utility monitoring\n∙ Emergency utility procedures", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73168, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590948", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590948", "securityControlId": 31794, "ccis": [], "uuid": "5800ea7e-69c5-57cf-a5c3-9678d90fdb3a", "testId": "PES-09.1_A01", "test": "personnel or roles to be notified by environmental control monitoring when environmental changes are potentially harmful to personnel or equipment is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-14(02)_ODP", "defaultText": null }, { "id": 73169, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590948", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590948", "securityControlId": 31794, "ccis": [], "uuid": "25c83091-1020-5b56-965b-81fc8201e567", "testId": "PES-09.1_A02", "test": "environmental control monitoring is employed.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-14(02)[01]", "defaultText": null }, { "id": 73170, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590949", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590949", "securityControlId": 31794, "ccis": [], "uuid": "496bbb6c-6b3a-5777-ad36-8715a8395905", "testId": "PES-09.1_A03", "test": "personnel or roles are notified when changes are potentially harmful to personnel or equipment.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-14(02)[02]", "defaultText": null } ], "externalMappings": [ { "id": 591411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588033", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "862dadb0-7eb9-5b1a-a3c3-b9d152071c8a", "parentControlId": 31794, "controlId": "PE-14(2)", "title": "PE-14(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588033" }, { "id": 591412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588033", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1da743a7-1768-5505-87f5-5e6c13903cbc", "parentControlId": 31794, "controlId": "PE-14(02)", "title": "PE-14(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588033" }, { "id": 591413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588033", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48ec2231-a5fb-576d-bcb5-ec5b92c6ce58", "parentControlId": 31794, "controlId": "PE-14(02)", "title": "PE-14(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588033" } ], "id": 31794, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731248", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731248", "catalogueId": 1062, "uuid": "d83294c0-d8e2-5399-945c-9737fd5477f5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization trigger an alarm or notification of temperature and humidity changes that be potentially harmful to personnel or equipment?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 8.0, "title": "Monitoring with Alarms / Notifications", "description": "

Control Description

Facility security mechanisms exist to trigger an alarm or notification of temperature and humidity changes that be potentially harmful to personnel or equipment.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to trigger an alarm or notification of temperature and humidity changes that be potentially harmful to personnel or equipment.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-09.1", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-09.1", "references": "

Micro-Small Business (<10 staff)

∙ Know location of power shutoffs for IT areas

Small Business (10-49 staff)

∙ Utility shutoff documentation and procedure

Medium Business (50-249 staff)

∙ Formal utility emergency shutoff procedures\n∙ Documentation of shutoff locations

Large Business (250-999 staff)

∙ Enterprise utility emergency management\n∙ EPO systems\n∙ Utility shutoff training

Enterprise (>1,000 staff)

∙ Enterprise facility emergency management\n∙ Automated utility monitoring\n∙ EPO integration\n∙ Emergency utility procedures", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73171, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590949", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590949", "securityControlId": 31795, "ccis": [], "uuid": "5586db4c-c610-5e09-a070-fbeec3cdf031", "testId": "PES-10_A01", "test": "types of system components to be authorized and controlled when entering the facility are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-16_ODP[01]", "defaultText": null }, { "id": 73172, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590949", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590949", "securityControlId": 31795, "ccis": [], "uuid": "0b42777f-d1f4-576e-8d1b-1d7ebcee8e3c", "testId": "PES-10_A02", "test": "types of system components to be authorized and controlled when exiting the facility are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-16_ODP[02]", "defaultText": null }, { "id": 73173, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590949", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590949", "securityControlId": 31795, "ccis": [], "uuid": "a5ab5876-87ae-5713-a81f-407d4bb95a78", "testId": "PES-10_A03", "test": "types of system components are authorized and controlled when entering the facility.
PPTDF Applicability: Facility
Assessment Rigor: 1
SCF Defined Parameters: all information system components", "otherId": "53A_R5_PE-16a.[01]\n53A_R5_PE-16a.[02]", "defaultText": null }, { "id": 73174, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59095", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59095", "securityControlId": 31795, "ccis": [], "uuid": "05c70645-fcb7-5dc9-9d46-794134564df1", "testId": "PES-10_A04", "test": "types of system components are authorized and controlled when exiting the facility.
PPTDF Applicability: Facility
Assessment Rigor: 1
SCF Defined Parameters: all information system components", "otherId": "53A_R5_PE-16a.[03]\n53A_R5_PE-16a.[04]", "defaultText": null }, { "id": 73175, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59095", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59095", "securityControlId": 31795, "ccis": [], "uuid": "0f8d9c02-1875-5d4f-9ce5-ad867a4a6331", "testId": "PES-10_A05", "test": "records of the system components are maintained.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_PE-16b.", "defaultText": null } ], "externalMappings": [ { "id": 591424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588034", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebc8eb5f-38bf-5a5b-b1ae-817df5a39061", "parentControlId": 31795, "controlId": "7.2", "title": "7.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588034" }, { "id": 591428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02248d05-053b-58b0-b411-fbaba26aa0ee", "parentControlId": 31795, "controlId": "PE-16", "title": "PE-16", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588035" }, { "id": 591429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "769825fd-a7ef-541c-bfdc-3b400fc76742", "parentControlId": 31795, "controlId": "PE-16", "title": "PE-16", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588035" }, { "id": 591430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7560bdc-cacb-54c9-bea7-8c703797b4bc", "parentControlId": 31795, "controlId": "PE-16", "title": "PE-16", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588035" }, { "id": 591431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9550a35-2dc6-522e-b101-90728dbdde65", "parentControlId": 31795, "controlId": "PE-16", "title": "PE-16", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588035" }, { "id": 591432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6efaa3d0-1315-5805-b7d9-0a3e0d88dd7f", "parentControlId": 31795, "controlId": "PE-16", "title": "PE-16", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588035" }, { "id": 591433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea983370-b6c7-5176-94f7-4e4de7610fb0", "parentControlId": 31795, "controlId": "PE-16", "title": "PE-16", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588035" }, { "id": 591434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c79051a-1956-5f1d-a206-8372db5f5721", "parentControlId": 31795, "controlId": "PE-16", "title": "PE-16", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588035" }, { "id": 591435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bd4f087-2b55-5cd5-a34e-04b46fc2207b", "parentControlId": 31795, "controlId": "PE-16", "title": "PE-16", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588035" }, { "id": 591436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51279465-76b6-54f0-abea-1d7865a0af9b", "parentControlId": 31795, "controlId": "PE-16", "title": "PE-16", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588035" }, { "id": 591438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "167d4e70-1270-5a7d-b2e8-d03aabd6cccc", "parentControlId": 31795, "controlId": "NFO - PE-16", "title": "NFO - PE-16", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588036" }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "fbf0b96a-1e20-5bc0-9da3-ae6a285cba44", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "b2780875-90a9-550d-a116-1f437208ca75", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "8bbc110b-5b93-58fb-8f16-27e946ac5a39", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "f1b75779-eb13-5e3c-98be-bf85887b3a2b", "isPublic": true } ], "id": 31795, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731249", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731249", "catalogueId": 1062, "uuid": "d77bc0de-f4b3-5342-9e48-9219d7f4ed70", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization isolate information processing facilities from points such as delivery and loading areas and other points to avoid unauthorized access?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Delivery & Removal", "description": "

Control Description

Physical security mechanisms exist to isolate information processing facilities from points such as delivery and loading areas and other points to avoid unauthorized access.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to isolate information processing facilities from points such as delivery and loading areas and other points to avoid unauthorized access.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-10", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-10", "references": "

Micro-Small Business (<10 staff)

∙ Shred sensitive paper documents before disposal

Small Business (10-49 staff)

∙ Clean desk policy\n∙ Shredding policy for sensitive documents

Medium Business (50-249 staff)

∙ Formal clear desk and secure disposal policy\n∙ Shredding service for sensitive materials

Large Business (250-999 staff)

∙ Enterprise clear desk/clean screen program\n∙ Shredding service contract\n∙ Regular audits

Enterprise (>1,000 staff)

∙ Enterprise information handling program\n∙ Contracted shredding service (e.g., Iron Mountain)\n∙ Regular compliance audits\n∙ Secure printer management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73176, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59095", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59095", "securityControlId": 31796, "ccis": [], "uuid": "8f8ce1ea-93f6-549e-8e9e-8a4fa3b793c1", "testId": "PES-11_A01", "test": "alternate work sites allowed for use by employees are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-17_ODP[01]", "defaultText": null }, { "id": 73177, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59095", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59095", "securityControlId": 31796, "ccis": [], "uuid": "e9318622-2660-5998-b43c-970345f57d0d", "testId": "PES-11_A02", "test": "security requirements to be employed at alternate work sites are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-17_ODP[02]\n171A_R3_A.03.10.06.ODP[01]", "defaultText": null }, { "id": 73178, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590951", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590951", "securityControlId": 31796, "ccis": [], "uuid": "64942614-e569-5f9f-a42c-d7051a142eff", "testId": "PES-11_A03", "test": "alternate work sites allowed for use by employees are determined.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-17a.\n171A_R3_A.03.10.06.a", "defaultText": null }, { "id": 73179, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590951", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590951", "securityControlId": 31796, "ccis": [], "uuid": "b9a9650f-dfc8-55c0-aa95-a3bc3c609531", "testId": "PES-11_A04", "test": "organization-defined security requirements are employed at alternate work sites.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-17b.", "defaultText": null }, { "id": 73180, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590951", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590951", "securityControlId": 31796, "ccis": [], "uuid": "1f031716-d3ae-50f3-a15f-61b942dbf0e7", "testId": "PES-11_A05", "test": "the effectiveness of controls at alternate work sites is assessed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PE-17c.", "defaultText": null }, { "id": 73181, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590951", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590951", "securityControlId": 31796, "ccis": [], "uuid": "58dd73c1-1e4c-5fc5-ab1f-64d7fdb434cf", "testId": "PES-11_A06", "test": "a means for employees to communicate with cybersecurity / data privacy personnel in case of incidents is provided.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PE-17d.", "defaultText": null }, { "id": 73182, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590951", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590952", "securityControlId": 31796, "ccis": [], "uuid": "7d7f93d8-bc19-59e9-bf32-ce2470c8da79", "testId": "PES-11_A07", "test": "safeguarding measures for sensitive / regulated data are defined for alternate work sites.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.10.6[a]", "defaultText": null }, { "id": 73183, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590952", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590952", "securityControlId": 31796, "ccis": [], "uuid": "53904765-55d4-5252-8926-57e8f77025b5", "testId": "PES-11_A08", "test": "safeguarding measures for sensitive / regulated data are enforced for alternate work sites.
PPTDF Applicability: Data
Assessment Rigor: 2", "otherId": "171A_3.10.6[b]", "defaultText": null }, { "id": 73184, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590952", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590952", "securityControlId": 31796, "ccis": [], "uuid": "109a8d4e-55da-5035-bf36-abdf8a7b8616", "testId": "PES-11_A09", "test": "the following security requirements are employed at alternate work sites: .
PPTDF Applicability: Facility
Assessment Rigor: NIST 800-171
SCF Defined Parameters: adequate security, comparable to organizational security requirements at the primary work site where practical, documented in policy, and covered by training", "otherId": "171A_R3_A.03.10.06.b", "defaultText": null } ], "externalMappings": [ { "id": 591468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8ab4ad1-22fc-5fce-b8e0-24918a7c13e8", "parentControlId": 31796, "controlId": "PE-17", "title": "PE-17", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588039" }, { "id": 591469, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b68e9e7c-a971-501a-a28a-a9caa50f6294", "parentControlId": 31796, "controlId": "PE-17", "title": "PE-17", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588039" }, { "id": 591470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "418ff8fc-18e9-5a6c-b2f4-6e0ed206bcfd", "parentControlId": 31796, "controlId": "PE-17", "title": "PE-17", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588039" }, { "id": 591471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce18b741-f302-5ef2-b00f-e8ad3a843b4a", "parentControlId": 31796, "controlId": "PE-17", "title": "PE-17", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588039" }, { "id": 591472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98ede4e1-4e93-56eb-a9d5-275bcc42d4ec", "parentControlId": 31796, "controlId": "PE-17", "title": "PE-17", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58804" }, { "id": 591473, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5c76ca6-3d2d-52f8-b0ec-5000f6e08cb8", "parentControlId": 31796, "controlId": "PE-17", "title": "PE-17", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58804" }, { "id": 591475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aed59c01-aac2-5797-8d63-dd309bc4c346", "parentControlId": 31796, "controlId": "PE-17", "title": "PE-17", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58804" }, { "id": 591477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69c189d1-defe-5d10-9285-c81307390363", "parentControlId": 31796, "controlId": "3.10.6", "title": "3.10.6", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58804" }, { "id": 591478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d376043-4088-583d-88ec-9904da5f888d", "parentControlId": 31796, "controlId": "03.10.06.a", "title": "03.10.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58804" }, { "id": 591479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6254b148-facf-5646-b533-90965c9ea93b", "parentControlId": 31796, "controlId": "03.10.06.b", "title": "03.10.06.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58804" }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "5326d235-f702-55a0-82ab-0c5cfc13ba18", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "fdd497c2-a084-54b5-8487-881043480c78", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "aaa9dd8e-a725-55aa-8c3b-dcd9592d1462", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "1fea4bb9-fbb5-584e-85bf-2b0d088fc6ca", "isPublic": true } ], "id": 31796, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731249", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731249", "catalogueId": 1062, "uuid": "64f7e627-5673-5c48-92ee-023d4483543d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize appropriate management, operational and technical controls at alternate work sites?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Alternate Work Site", "description": "

Control Description

Physical security mechanisms exist to utilize appropriate management, operational and technical controls at alternate work sites.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Where applicable, physical security controls and technologies are employed at alternate work sites to provide “equal protection” of physical and digital assets.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to utilize appropriate management, operational and technical controls at alternate work sites.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-11", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-11", "references": "

Micro-Small Business (<10 staff)

∙ Formally-designated alternate work sites

Small Business (10-49 staff)

∙ Formally-designated alternate work sites

Medium Business (50-249 staff)

∙ Formally-designated alternate work sites

Large Business (250-999 staff)

∙ Formally-designated alternate work sites

Enterprise (>1,000 staff)

∙ Formally-designated alternate work sites", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73185, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590952", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590952", "securityControlId": 31797, "ccis": [], "uuid": "2af43580-dbd3-57d8-ae78-232277b5f1bd", "testId": "PES-12_A01", "test": "the location or site of the facility where the system resides is planned considering physical and environmental hazards.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-23a.", "defaultText": null }, { "id": 73186, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590952", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590952", "securityControlId": 31797, "ccis": [], "uuid": "67b170dc-ff24-5f62-b865-50a7a0027909", "testId": "PES-12_A02", "test": "for existing facilities, physical and environmental hazards are considered in the organizational risk management strategy.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-23b.", "defaultText": null }, { "id": 73187, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590953", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590953", "securityControlId": 31797, "ccis": [], "uuid": "d5b7d3e3-423a-5c29-ada0-a93791009986", "testId": "PES-12_A03", "test": "physical and environmental hazards that could result in potential damage to system components within the facility are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-18_ODP", "defaultText": null }, { "id": 73188, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590953", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590953", "securityControlId": 31797, "ccis": [], "uuid": "05486127-8c18-57c3-924f-6dd7390b4597", "testId": "PES-12_A04", "test": "system components are positioned within the facility to minimize potential damage from physical and environmental hazards and to minimize the opportunity for unauthorized access.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-18", "defaultText": null }, { "id": 73189, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590953", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590953", "securityControlId": 31797, "ccis": [], "uuid": "bff91156-c480-5210-a22b-5af61f72ea5d", "testId": "PES-12_A05", "test": "managed interfaces to be protected against unauthorized physical connections are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(14)_ODP", "defaultText": null }, { "id": 73190, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590953", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590953", "securityControlId": 31797, "ccis": [], "uuid": "b26669a3-2b5c-5435-bcdc-5dc19224f1f9", "testId": "PES-12_A06", "test": "managed interfaces are protected against unauthorized physical connections.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(14)", "defaultText": null } ], "externalMappings": [ { "id": 591510, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cfb760ab-5863-5427-be83-b533850e6158", "parentControlId": 31797, "controlId": "7.12", "title": "7.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588044" }, { "id": 591511, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d3471ba-18d0-58e4-8262-250d39baa135", "parentControlId": 31797, "controlId": "7.3", "title": "7.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588044" }, { "id": 591512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9995fcb-f998-5f37-bbc6-877225894c83", "parentControlId": 31797, "controlId": "7.5", "title": "7.5", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588044" }, { "id": 591513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588044", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f77484e0-b309-5b06-8c7a-870485c07fcd", "parentControlId": 31797, "controlId": "7.8", "title": "7.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588044" }, { "id": 591522, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5ec702b-d90d-5096-9d40-f3f601bc3659", "parentControlId": 31797, "controlId": "PE-18", "title": "PE-18", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588045" }, { "id": 591523, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf3b8f88-de4e-5bf9-abae-5c86dd29ac8b", "parentControlId": 31797, "controlId": "PE-18(1)", "title": "PE-18(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588045" }, { "id": 591524, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2036012-3ca5-58b0-b963-00b8cb369ac6", "parentControlId": 31797, "controlId": "SC-7(14)", "title": "SC-7(14)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588046" }, { "id": 591525, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "145ac791-ca48-596e-b024-1ea0c8918dae", "parentControlId": 31797, "controlId": "PE-18", "title": "PE-18", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588046" }, { "id": 591526, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "578f50a0-56b3-59b6-99c2-6a8a75ec4108", "parentControlId": 31797, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588046" }, { "id": 591527, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee1dabc4-1cd4-545f-81e2-4b1a57457056", "parentControlId": 31797, "controlId": "SC-07(14)", "title": "SC-07(14)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588046" }, { "id": 591530, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e255e0eb-1e38-5821-9612-f5913548436f", "parentControlId": 31797, "controlId": "PE-18", "title": "PE-18", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588046" }, { "id": 591531, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94472816-897b-5fc1-b5f8-3a18efa38392", "parentControlId": 31797, "controlId": "PE-18", "title": "PE-18", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588046" }, { "id": 591532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7650b4d-3623-568d-bb24-3dcc1a73abe6", "parentControlId": 31797, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588046" }, { "id": 591533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "edaed4c0-f939-553e-9ce5-41cd1cbdb21c", "parentControlId": 31797, "controlId": "SC-07(14)", "title": "SC-07(14)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588047" }, { "id": 591534, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3abc7547-6d74-5df2-9174-89198125dfe4", "parentControlId": 31797, "controlId": "PE-18", "title": "PE-18", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588047" }, { "id": 591535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f579d7e-9e84-57d8-ba99-86ec26566887", "parentControlId": 31797, "controlId": "PE-18", "title": "PE-18", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588047" }, { "id": 591536, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9dd6725d-06f9-58a6-97e8-7161c224a58c", "parentControlId": 31797, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588047" }, { "id": 591537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ba57aea-5700-5644-9ebf-d09cf963327c", "parentControlId": 31797, "controlId": "SC-7(14)", "title": "SC-7(14)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588047" }, { "id": 591538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588047", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c7cf776-287e-51eb-9cf0-c54328bbf856", "parentControlId": 31797, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588047" }, { "id": 591546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a54400ef-627d-56cb-b0f2-a28f1e1eadc8", "parentControlId": 31797, "controlId": "3.10.1", "title": "3.10.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588048" }, { "id": 591547, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e50694ea-7ad7-5695-9641-b224a729fe2d", "parentControlId": 31797, "controlId": "03.10.07.e", "title": "03.10.07.e", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588048" }, { "id": 591548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d51b280-18d1-56a9-b418-b07446521d05", "parentControlId": 31797, "controlId": "03.10.08", "title": "03.10.08", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588048" }, { "id": 591579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f90a56f5-2dbe-5d16-892d-eca7bda50967", "parentControlId": 31797, "controlId": "CIP-006-6 1.10", "title": "CIP-006-6 1.10", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588052" }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b5e487aa-3328-5685-b9c3-00c09ef7290a", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "03863fc4-52a9-5e97-ba7f-ff743f3a6797", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "dd479f28-bfe5-5216-a8eb-63b5a164cd65", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "0910b840-a597-51a6-bb89-d0ee748ad2fc", "isPublic": true } ], "id": 31797, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731249", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731249", "catalogueId": 1062, "uuid": "f967b48a-4df0-5d76-b2c0-f08bb2ee40ca", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization locate system components within the facility to minimize potential damage from physical and environmental hazards and to minimize the opportunity for unauthorized access?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Equipment Siting & Protection", "description": "

Control Description

Physical security mechanisms exist to locate system components within the facility to minimize potential damage from physical and environmental hazards and to minimize the opportunity for unauthorized access.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Physical security controls address system component location within the facility to minimize potential damage from physical and environmental hazards and to minimize the opportunity for unauthorized access.\n▪ Physical security controls isolate information processing facilities from points such as delivery and loading areas and other points to avoid unauthorized access.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to locate system components within the facility to minimize potential damage from physical and environmental hazards and to minimize the opportunity for unauthorized access.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-12", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-12", "references": "

Micro-Small Business (<10 staff)

∙ Keep valuable/sensitive equipment out of high-visibility areas

Small Business (10-49 staff)

∙ Equipment placement policy\n∙ Protect sensitive equipment from public view

Medium Business (50-249 staff)

∙ Formal equipment placement and protection policy

Large Business (250-999 staff)

∙ Enterprise equipment positioning and protection program\n∙ Physical security zones

Enterprise (>1,000 staff)

∙ Enterprise physical security design program\n∙ Security zones with appropriate controls\n∙ Physical security reviews during facility design", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73191, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590953", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590953", "securityControlId": 31798, "ccis": [], "uuid": "832fff4e-3b88-5882-a2b1-157bd75e05a3", "testId": "PES-12.1_A01", "test": "system distribution and transmission lines requiring physical access controls are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-04_ODP[01]", "defaultText": null }, { "id": 73192, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590953", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590953", "securityControlId": 31798, "ccis": [], "uuid": "0550533e-838d-5155-9324-9343d6b99171", "testId": "PES-12.1_A02", "test": "security controls to be implemented to control physical access to system distribution and transmission lines within the organizational facility are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-04_ODP[02]", "defaultText": null }, { "id": 73193, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590954", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590954", "securityControlId": 31798, "ccis": [], "uuid": "830b858b-d87d-55f5-b819-91b0ad7c9c83", "testId": "PES-12.1_A03", "test": "physical access to system distribution and transmission lines within organizational facilities is controlled.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-04\n171A_R3_A.03.10.08", "defaultText": null }, { "id": 73194, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590954", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590954", "securityControlId": 31798, "ccis": [], "uuid": "8bca37fb-2e59-56d7-b950-897f87270279", "testId": "PES-12.1_A04", "test": "managed interfaces to be protected against unauthorized physical connections are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(14)_ODP", "defaultText": null }, { "id": 73195, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590954", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590954", "securityControlId": 31798, "ccis": [], "uuid": "d93d7468-3c99-5c05-a097-d2618ebb0840", "testId": "PES-12.1_A05", "test": "managed interfaces are protected against unauthorized physical connections.
PPTDF Applicability: Facility
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(14)", "defaultText": null } ], "externalMappings": [ { "id": 591608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a7e8513-e34d-557d-bb19-951f00df2b7c", "parentControlId": 31798, "controlId": "7.12", "title": "7.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588055" }, { "id": 591611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b21ccd0-e7da-5393-af39-386a46ce7e31", "parentControlId": 31798, "controlId": "PE-4", "title": "PE-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588055" }, { "id": 591612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5972064-618f-50cd-a03a-2288446fee98", "parentControlId": 31798, "controlId": "SC-7(14)", "title": "SC-7(14)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588055" }, { "id": 591613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afa666b4-fb2d-5e1e-9928-ccbac35edb41", "parentControlId": 31798, "controlId": "PE-04", "title": "PE-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588055" }, { "id": 591614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3106ebae-891d-597c-b381-c1fc159793a1", "parentControlId": 31798, "controlId": "SC-07(14)", "title": "SC-07(14)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588056" }, { "id": 591616, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9aba459-33c3-500e-8ba2-9480d0e62a9b", "parentControlId": 31798, "controlId": "PE-04", "title": "PE-04", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588064" }, { "id": 591617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a198905c-263e-5add-a034-b4f85c659d66", "parentControlId": 31798, "controlId": "PE-04", "title": "PE-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588064" }, { "id": 591618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57a1ce1f-1271-56d4-98ca-1eacdf6c7657", "parentControlId": 31798, "controlId": "SC-07(14)", "title": "SC-07(14)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588064" }, { "id": 591619, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "097a6eaf-b399-57cc-81cd-6329875c2ace", "parentControlId": 31798, "controlId": "PE-04", "title": "PE-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588064" }, { "id": 591620, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5c66198-5551-5b74-82ec-33e1a9e4ad2b", "parentControlId": 31798, "controlId": "PE-04", "title": "PE-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588064" }, { "id": 591621, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5b92ae7-5a5c-5803-8435-8517478778cb", "parentControlId": 31798, "controlId": "SC-7(14)", "title": "SC-7(14)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588064" }, { "id": 591624, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e73b3172-4c1f-596e-9085-e22a4562f590", "parentControlId": 31798, "controlId": "3.10.1", "title": "3.10.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588065" }, { "id": 591625, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588065", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0385b86-d922-5894-9a52-314add2715d9", "parentControlId": 31798, "controlId": "03.10.08", "title": "03.10.08", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588065" }, { "id": 591647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588067", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b3eefab-b559-5aa2-bd5a-486b217f2981", "parentControlId": 31798, "controlId": "CIP-006-6 1.10", "title": "CIP-006-6 1.10", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588067" }, { "controlId": "C.5.6", "title": "C.5.6 — Access Control for Transmission Medium", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "dd60f2f7-f055-5006-aaec-a997f357d10e", "isPublic": true }, { "controlId": "NEI 08-09 App E.5.6", "title": "NEI 08-09 App E.5.6 — Access Control for Transmission Medium", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.5.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "7d2b61d1-b4c5-50e5-aa9a-47d0c851e1a5", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.5.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "b6b8efdd-ddde-599c-af16-094669dbf22c", "isPublic": true }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7150de02-5ece-5372-a2f7-50b8eafc13cb", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "18ea7bec-ed0f-56a0-8b4f-ce259dc734f5", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "d7f5bfba-f006-5e3a-8ccb-3d828d280c27", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "13c29961-5cbe-507b-9591-ad25705c171c", "isPublic": true } ], "id": 31798, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73125", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73125", "catalogueId": 1062, "uuid": "52899550-57e0-57ca-be62-58ea4dc59d1b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect power and telecommunications cabling carrying data or supporting information services from interception, interference or damage?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Transmission Medium Security", "description": "

Control Description

Physical security mechanisms exist to protect power and telecommunications cabling carrying data or supporting information services from interception, interference or damage.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPhysical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Physical security controls address system component location within the facility to minimize potential damage from physical and environmental hazards and to minimize the opportunity for unauthorized access.\n▪ Physical security controls isolate information processing facilities from points such as delivery and loading areas and other points to avoid unauthorized access.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to protect power and telecommunications cabling carrying data or supporting information services from interception, interference or damage.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.5.6", "controlId": "PES-12.1", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-12.1", "references": "

Micro-Small Business (<10 staff)

∙ Lock screens and log off when stepping away

Small Business (10-49 staff)

∙ Clean screen policy\n∙ Auto-lock configured on all systems

Medium Business (50-249 staff)

∙ Formal clean screen/clear desk policy\n∙ Auto-lock enforcement via GPO

Large Business (250-999 staff)

∙ Enterprise screen lock policy enforcement\n∙ Automated compliance monitoring

Enterprise (>1,000 staff)

∙ Enterprise endpoint management with enforced screen lock (e.g., Microsoft Intune, JAMF)\n∙ Compliance reporting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73196, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590954", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590954", "securityControlId": 31799, "ccis": [], "uuid": "d2e01643-5c3c-5d35-a6a8-2954a0b8b956", "testId": "PES-12.2_A01", "test": "output devices that require physical access control to output are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-05_ODP", "defaultText": null }, { "id": 73197, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590954", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590954", "securityControlId": 31799, "ccis": [], "uuid": "542b7587-6485-5482-9c41-35a9532599e4", "testId": "PES-12.2_A02", "test": "physical access to output devices is controlled to prevent unauthorized individuals from obtaining access to sensitive / regulated data.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PE-05", "defaultText": null }, { "id": 73198, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590955", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590955", "securityControlId": 31799, "ccis": [], "uuid": "934a5665-6c54-5995-8790-70f1f4f54592", "testId": "PES-12.2_A03", "test": "physical access to output devices is controlled to prevent unauthorized individuals from obtaining access to CUI.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.10.07.e", "defaultText": null } ], "externalMappings": [ { "id": 591795, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b5739f1-b45b-50e9-b7f0-956e771c26a5", "parentControlId": 31799, "controlId": "PE-5", "title": "PE-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588084" }, { "id": 591796, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588084", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ab36af6-983a-5bf0-bfd3-fa6c7a33e6a0", "parentControlId": 31799, "controlId": "PE-05", "title": "PE-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588085" }, { "id": 591797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbe83a0a-19c8-5c74-9bf6-6681e644cb8c", "parentControlId": 31799, "controlId": "PE-05", "title": "PE-05", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588085" }, { "id": 591798, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea1ff5cc-31f7-57cb-bf64-e87923bc49c3", "parentControlId": 31799, "controlId": "PE-05", "title": "PE-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588085" }, { "id": 591799, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "868636aa-ce43-5c82-81da-7bb2b4542e3f", "parentControlId": 31799, "controlId": "PE-05", "title": "PE-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588085" }, { "id": 591800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "898b9f94-db4c-5fc1-b603-f015609d96f7", "parentControlId": 31799, "controlId": "PE-05", "title": "PE-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588085" }, { "id": 591801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68f79c68-176f-5aae-b3f4-df75f430ee94", "parentControlId": 31799, "controlId": "3.10.1", "title": "3.10.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588085" }, { "id": 591802, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588085", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4267f4f-e8df-5a7c-aefd-ab4b0ef24f30", "parentControlId": 31799, "controlId": "03.10.07.e", "title": "03.10.07.e", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588085" }, { "controlId": "C.5.7", "title": "C.5.7 — Access Control for Display Medium", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PE-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "729bb44f-1fbd-52c2-a658-36e1151641c9", "isPublic": true }, { "controlId": "NEI 08-09 App E.5.7", "title": "NEI 08-09 App E.5.7 — Access Control for Display Medium", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.5.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "3ef14480-9837-5159-af20-ae5f0ed1af3e", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.5.7", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "3c5f6897-89c2-5284-8100-e0dc0bce5d18", "isPublic": true }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7120b903-a299-5027-b46e-5215723bfea1", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "d8229f73-ba82-591e-b77c-96fe5958f394", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "387b05e6-0dd2-592d-9c05-5925e32c5b10", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "b15e7555-a475-5895-966a-72295d8cf7b6", "isPublic": true } ], "id": 31799, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73125", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73125", "catalogueId": 1062, "uuid": "2a5faf47-0935-5b74-b899-577064786465", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict access to printers and other system output devices to prevent unauthorized individuals from obtaining the output?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Access Control for Output Devices", "description": "

Control Description

Physical security mechanisms exist to restrict access to printers and other system output devices to prevent unauthorized individuals from obtaining the output.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Physical security controls address system component location within the facility to minimize potential damage from physical and environmental hazards and to minimize the opportunity for unauthorized access.\n▪ Physical security controls isolate information processing facilities from points such as delivery and loading areas and other points to avoid unauthorized access.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to restrict access to printers and other system output devices to prevent unauthorized individuals from obtaining the output.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.5.7", "controlId": "PES-12.2", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-12.2", "references": "

Micro-Small Business (<10 staff)

∙ Physical security policy\n∙ Door locks and key management

Small Business (10-49 staff)

∙ Physical security policy\n∙ Access log\n∙ Visitor procedures

Medium Business (50-249 staff)

∙ Printer management (print only when at the printer with proximity card or code)

Large Business (250-999 staff)

∙ Printer management (print only when at the printer with proximity card or code)

Enterprise (>1,000 staff)

∙ Printer management (print only when at the printer with proximity card or code)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73199, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590955", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590955", "securityControlId": 31800, "ccis": [], "uuid": "986c784a-d7e3-5863-9fb6-32a55d76ca83", "testId": "PES-13_A01", "test": "the system is protected from information leakage due to electromagnetic signal emanations.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-19", "defaultText": null } ], "externalMappings": [ { "id": 591825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e81fdd8-90c9-50ef-88e1-772c5d9acbef", "parentControlId": 31800, "controlId": "8.12", "title": "8.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588088" }, { "id": 591827, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffc06bcf-6cab-5422-b05d-d5555913a20a", "parentControlId": 31800, "controlId": "PE-19", "title": "PE-19", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588088" }, { "id": 591828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdb31b02-28e5-5f34-b686-b62211d895cd", "parentControlId": 31800, "controlId": "PE-19", "title": "PE-19", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588088" }, { "id": 591829, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588088", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "251ede72-85dd-5c90-b653-d50ea5092e98", "parentControlId": 31800, "controlId": "PE-19", "title": "PE-19", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588088" }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "09501cb4-a848-5385-9bea-ef5df75c292b", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "43b90d0b-1360-5ea5-a1ca-c62f126a70dd", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "3bf43a03-8e6a-5031-aee4-ce0b125c67b3", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "24a53292-962e-5470-94c6-1d4026c7e8c6", "isPublic": true } ], "id": 31800, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73125", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73125", "catalogueId": 1062, "uuid": "2200b959-6786-5584-98df-72a90c1856aa", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization protect the system from information leakage due to electromagnetic signals emanations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Information Leakage Due To Electromagnetic Signals Emanations", "description": "

Control Description

Facility security mechanisms exist to protect the system from information leakage due to electromagnetic signals emanations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPhysical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to protect the system from information leakage due to electromagnetic signals emanations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-13", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-13", "references": "

Micro-Small Business (<10 staff)

∙ Use a surge protector for all equipment

Small Business (10-49 staff)

∙ Power conditioning policy\n∙ UPS for critical systems\n∙ Surge protection for all equipment

Medium Business (50-249 staff)

∙ Formal power protection policy\n∙ UPS for critical equipment\n∙ Power quality monitoring

Large Business (250-999 staff)

∙ Enterprise power protection program\n∙ UPS + generator\n∙ Power quality monitoring

Enterprise (>1,000 staff)

∙ Enterprise power management platform (UPS, PDU, generator)\n∙ Power quality monitoring\n∙ N+1 redundancy\n∙ DCIM integration", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73200, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590955", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590955", "securityControlId": 31801, "ccis": [], "uuid": "e7646ba9-b147-50c7-89ba-9e2c9fcc0264", "testId": "PES-14_A01", "test": "asset location technologies to be employed to track and monitor the location and movement of assets is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-20_ODP[01]", "defaultText": null }, { "id": 73201, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590955", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590955", "securityControlId": 31801, "ccis": [], "uuid": "618b549e-c9a6-53ee-a8d9-7579b53b651c", "testId": "PES-14_A02", "test": "assets whose location and movement are to be tracked and monitored are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-20_ODP[02]", "defaultText": null }, { "id": 73202, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590955", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590955", "securityControlId": 31801, "ccis": [], "uuid": "11367791-8cfb-5bfb-ae2a-cad9cfb00a45", "testId": "PES-14_A03", "test": "controlled areas within which asset location and movement are to be tracked and monitored are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-20_ODP[03]", "defaultText": null }, { "id": 73203, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590956", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590956", "securityControlId": 31801, "ccis": [], "uuid": "fdd6cc8a-f59c-596a-9fc8-7bd94203ee45", "testId": "PES-14_A04", "test": "asset location technologies are employed to track and monitor the location and movement of assets within controlled areas.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-20", "defaultText": null } ], "externalMappings": [ { "id": 591839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09d520b6-d6ca-586d-9581-f014ec2ab7e2", "parentControlId": 31801, "controlId": "PE-20", "title": "PE-20", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588089" }, { "id": 591840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22bc3dda-95e0-5bf7-ba42-27dc4d070564", "parentControlId": 31801, "controlId": "PE-20", "title": "PE-20", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588089" }, { "id": 591841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c5b0d22-77ad-5111-905d-e1f47885b074", "parentControlId": 31801, "controlId": "PE-20", "title": "PE-20", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58809" }, { "id": 591842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15855b0f-1e68-5d72-8aee-defef50b9e74", "parentControlId": 31801, "controlId": "PE-20", "title": "PE-20", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58809" }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "f39dcc87-2b70-5eb9-8382-e0777ff4a108", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "57b3433c-645f-5ca3-a3f9-80d7b4c8bad2", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "ccdbafb8-bab2-5731-aec8-14eba3aed04a", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "7c68d257-a49b-531b-8f81-fc5fcb4f3d62", "isPublic": true } ], "id": 31801, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731251", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731251", "catalogueId": 1062, "uuid": "3ee6fd28-e253-5b3b-82e0-fbf0ae2347d5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization employ asset location technologies that track and monitor the location and movement of organization-defined assets within organization-defined controlled areas?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Asset Monitoring and Tracking", "description": "

Control Description

Physical security mechanisms exist to employ asset location technologies that track and monitor the location and movement of organization-defined assets within organization-defined controlled areas.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPhysical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to employ asset location technologies that track and monitor the location and movement of organization-defined assets within organization-defined controlled areas.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "PES-14", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-14", "references": "

Micro-Small Business (<10 staff)

∙ Physical security policy\n∙ Door locks and key management

Small Business (10-49 staff)

∙ Physical security policy\n∙ Access log\n∙ Visitor procedures

Medium Business (50-249 staff)

∙ RFID tagging

Large Business (250-999 staff)

∙ RFID tagging

Enterprise (>1,000 staff)

∙ RFID tagging", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73204, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590956", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590956", "securityControlId": 31802, "ccis": [], "uuid": "78d9d037-4679-51ea-ab40-1c64ecac52db", "testId": "PES-15_A01", "test": "protective measures to be employed against electromagnetic pulse damage are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-21_ODP[01]", "defaultText": null }, { "id": 73205, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590956", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590956", "securityControlId": 31802, "ccis": [], "uuid": "e1d07b9f-9983-5cee-87c7-f1c40e53ba5a", "testId": "PES-15_A02", "test": "system and system components requiring protection against electromagnetic pulse damage are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-21_ODP[02]", "defaultText": null }, { "id": 73206, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590956", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590956", "securityControlId": 31802, "ccis": [], "uuid": "4cd74873-8372-5b1c-81e5-3988ea5368e9", "testId": "PES-15_A03", "test": "protective measures are employed against electromagnetic pulse damage for system and system components.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-21", "defaultText": null } ], "externalMappings": [ { "id": 591846, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afc2a793-8bc5-5a0a-b643-11850184249c", "parentControlId": 31802, "controlId": "PE-21", "title": "PE-21", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58809" }, { "id": 591847, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "212859cd-15e3-5e6a-b489-03cd42a587fa", "parentControlId": 31802, "controlId": "PE-21", "title": "PE-21", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58809" }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "96ec3aae-6f9f-5cc0-8cab-15d26d7f75fd", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "332f97a9-e86f-5b57-a0e4-67e15aff269c", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "c80495ac-df1d-5c5a-ab7d-221b9e9e604c", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "a89432a7-9fd6-56a5-b2b1-683984fd8712", "isPublic": true } ], "id": 31802, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731251", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731251", "catalogueId": 1062, "uuid": "d8ed76ff-04ee-5df9-ab21-84df839e1fa2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization employ safeguards against Electromagnetic Pulse (EMP) damage for systems and system components?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Electromagnetic Pulse (EMP) Protection", "description": "

Control Description

Physical security mechanisms exist to employ safeguards against Electromagnetic Pulse (EMP) damage for systems and system components.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to employ safeguards against Electromagnetic Pulse (EMP) damage for systems and system components.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-15", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-15", "references": "

Micro-Small Business (<10 staff)

∙ Physical security policy\n∙ Door locks and key management

Small Business (10-49 staff)

∙ Physical security policy\n∙ Access log\n∙ Visitor procedures

Medium Business (50-249 staff)

∙ Formal physical security program\n∙ Card-based access control\n∙ CCTV

Large Business (250-999 staff)

∙ EMP shielding (Faraday cages)

Enterprise (>1,000 staff)

∙ EMP shielding (Faraday cages)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73207, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590956", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590956", "securityControlId": 31803, "ccis": [], "uuid": "4ddc9f3c-6756-568f-bd74-d60ec2ac320c", "testId": "PES-16_A01", "test": "system hardware components to be marked indicating the impact level or classification level of the information permitted to be processed, stored or transmitted by the hardware component are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-22_ODP", "defaultText": null }, { "id": 73208, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590957", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590957", "securityControlId": 31803, "ccis": [], "uuid": "549df2b9-c9dc-5920-9be7-9097c4fd0148", "testId": "PES-16_A02", "test": "system hardware components are marked indicating the impact level or classification level of the information permitted to be processed, stored or transmitted by the hardware component.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PE-22", "defaultText": null } ], "externalMappings": [ { "id": 591848, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7192e14f-8bb7-5f6a-8040-c3231c012d07", "parentControlId": 31803, "controlId": "PE-22", "title": "PE-22", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58809" }, { "id": 591850, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e3286f5-47a1-53c3-8f35-d2606e19e488", "parentControlId": 31803, "controlId": "PE-22", "title": "PE-22", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588091" }, { "id": 591851, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b3e84a8-5dfd-5e3a-9185-b7f4e41770e8", "parentControlId": 31803, "controlId": "PE-22", "title": "PE-22", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588091" }, { "id": 591852, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d480504e-2341-59d8-aff3-2a88c4016901", "parentControlId": 31803, "controlId": "PE-22", "title": "PE-22", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588091" }, { "controlId": "NSS-42G-Sec5", "title": "NSS-42G-Sec5 — Physical-Cyber Security Integration & Vital Area Protection", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "fafd081f-f728-5b25-a056-4b6abe26800d", "isPublic": true }, { "controlId": "IEC-62645-6.2.4", "title": "IEC-62645-6.2.4 — Physical Protection of Computer Security Zones & Pathways", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "b7679801-9286-51a3-9954-f1ff10dafca2", "isPublic": true }, { "controlId": "IEC-63096-11.1", "title": "IEC-63096-11.1 — Physical and Environmental Security of Nuclear I&C Rooms/Cabinets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "3a3626db-7d87-56c2-a3f8-b64ea8bf2afa", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP6", "title": "ONR-SyAP-FSyP6 — Physical Protection Systems & Cyber Interdependencies", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (PES Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "418f9748-dc98-555f-86fc-0ed3af67d0b2", "isPublic": true } ], "id": 31803, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731251", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731251", "catalogueId": 1062, "uuid": "bf659a39-05b5-5559-a834-57bbc8796898", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization mark system hardware components indicating the impact or classification level of the information permitted to be processed, stored or transmitted by the hardware component?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Component Marking", "description": "

Control Description

Physical security mechanisms exist to mark system hardware components indicating the impact or classification level of the information permitted to be processed, stored or transmitted by the hardware component.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPhysical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).\n▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.

Level 2 - Planned & Tracked: Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 - Well Defined: Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.\n▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation, proximity badge access, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational physical security capability exists to mark system hardware components indicating the impact or classification level of the information permitted to be processed, stored or transmitted by the hardware component.

Level 4 - Quantitatively Controlled: Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PES-16", "family": "Physical & Environmental Security", "enhancements": "", "sortId": "PES-16", "references": "

Micro-Small Business (<10 staff)

∙ Ensure facility can be secured during and after emergencies

Small Business (10-49 staff)

∙ Physical security contingency plan\n∙ Access control backup procedures

Medium Business (50-249 staff)

∙ Formal physical security contingency plan\n∙ Backup physical access controls

Large Business (250-999 staff)

∙ Enterprise physical security continuity program\n∙ Backup access control systems

Enterprise (>1,000 staff)

∙ Enterprise physical security resilience program\n∙ Backup physical security systems\n∙ Emergency response integration\n∙ Regular drills", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73213, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590969", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590969", "securityControlId": 31807, "ccis": [], "uuid": "e351ce36-9fcc-56c4-a717-c51f8172ad3c", "testId": "PRI-01_A01", "test": "an organization-wide privacy program plan that provides an overview of the agency’s privacy program is developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-18a.[01]", "defaultText": null }, { "id": 73214, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590969", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590969", "securityControlId": 31807, "ccis": [], "uuid": "fdd78475-3147-56cb-abad-5c84567971cc", "testId": "PRI-01_A02", "test": "the privacy program plan includes a description of the structure of the privacy program.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18a.01[01]", "defaultText": null }, { "id": 73215, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590969", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590969", "securityControlId": 31807, "ccis": [], "uuid": "2c4464cf-ce80-5e80-a4a4-be22ebb3c84b", "testId": "PRI-01_A03", "test": "the privacy program plan includes a description of the resources dedicated to the privacy program.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18a.01[02]", "defaultText": null }, { "id": 73216, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590969", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590969", "securityControlId": 31807, "ccis": [], "uuid": "1b4ff2e5-5964-5a94-91d4-58183459b3f4", "testId": "PRI-01_A04", "test": "the privacy program plan provides an overview of the requirements for the privacy program.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18a.02[01]", "defaultText": null }, { "id": 73217, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590969", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590969", "securityControlId": 31807, "ccis": [], "uuid": "7ae5bfc8-5658-569a-863f-27ae016dbf5e", "testId": "PRI-01_A05", "test": "the privacy program plan provides a description of the privacy program management controls in place or planned for meeting the requirements of the privacy program.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18a.02[02]", "defaultText": null }, { "id": 73218, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59097", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59097", "securityControlId": 31807, "ccis": [], "uuid": "6c035a9b-3c19-5aa7-b2d0-7130f4013a44", "testId": "PRI-01_A06", "test": "the privacy program plan provides a description of common controls in place or planned for meeting the requirements of the privacy program.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18a.02[03]", "defaultText": null }, { "id": 73219, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59097", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59097", "securityControlId": 31807, "ccis": [], "uuid": "22183561-13ef-57bf-be38-c5247e770edb", "testId": "PRI-01_A07", "test": "the privacy program plan includes the role of the senior organization official for privacy.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18a.03[01]", "defaultText": null }, { "id": 73220, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59097", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59097", "securityControlId": 31807, "ccis": [], "uuid": "77326ae0-e7a5-5287-8659-d783fbe1fc8f", "testId": "PRI-01_A08", "test": "the privacy program plan includes the identification and assignment of the roles of other privacy officials and staff and their responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18a.03[02]", "defaultText": null }, { "id": 73221, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59097", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59097", "securityControlId": 31807, "ccis": [], "uuid": "47b02660-8ba2-57d7-9f7c-97fe0b0a402d", "testId": "PRI-01_A09", "test": "the privacy program plan describes management commitment.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18a.04[01]", "defaultText": null }, { "id": 73222, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59097", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59097", "securityControlId": 31807, "ccis": [], "uuid": "151dbe9e-46e8-5b86-ad0a-afc9ffa3797b", "testId": "PRI-01_A10", "test": "the privacy program plan describes compliance.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18a.04[02]", "defaultText": null }, { "id": 73223, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59097", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59097", "securityControlId": 31807, "ccis": [], "uuid": "6a72f0f3-accf-50e6-a983-0f15d76bc450", "testId": "PRI-01_A11", "test": "the privacy program plan describes the strategic goals and objectives of the privacy program.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18a.04[03]", "defaultText": null }, { "id": 73224, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590971", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590971", "securityControlId": 31807, "ccis": [], "uuid": "3921361a-5178-5e25-8488-5de004bb3a19", "testId": "PRI-01_A12", "test": "the privacy program plan reflects coordination among organizational entities responsible for the different aspects of privacy.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18a.05", "defaultText": null }, { "id": 73225, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590971", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590971", "securityControlId": 31807, "ccis": [], "uuid": "4048b859-37b2-5444-97f9-80aad388a25d", "testId": "PRI-01_A13", "test": "the privacy program plan is approved by a senior official with responsibility and accountability for the privacy risk being incurred by organizational operations (including, mission, functions, image and reputation), organizational assets, individuals, other organizations and the Nation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18a.06", "defaultText": null }, { "id": 73226, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590971", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590971", "securityControlId": 31807, "ccis": [], "uuid": "07842c47-74e6-5b60-8d88-92ac0c098d7e", "testId": "PRI-01_A14", "test": "the privacy program plan is disseminated.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18a.[02]", "defaultText": null }, { "id": 73227, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590971", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590971", "securityControlId": 31807, "ccis": [], "uuid": "fe863dbe-6926-51b2-bf91-e117bf68cca2", "testId": "PRI-01_A15", "test": "the frequency of updates to the privacy program plan is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18_ODP", "defaultText": null }, { "id": 73228, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590972", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590972", "securityControlId": 31807, "ccis": [], "uuid": "171e1e6d-6de6-5230-87f9-7910063bc4ec", "testId": "PRI-01_A16", "test": "the privacy program plan is updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18b.[01]", "defaultText": null }, { "id": 73229, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590972", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590972", "securityControlId": 31807, "ccis": [], "uuid": "8269df5d-d48b-524e-85d6-bb2b02aa2f63", "testId": "PRI-01_A17", "test": "the privacy program plan is updated to address changes in federal privacy laws and policies.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18b.[02]", "defaultText": null }, { "id": 73230, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590972", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590972", "securityControlId": 31807, "ccis": [], "uuid": "ce1c5ce9-208b-5522-92e3-0399f91554ca", "testId": "PRI-01_A18", "test": "the privacy program plan is updated to address organizational changes.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18b.[03]", "defaultText": null }, { "id": 73231, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590972", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590972", "securityControlId": 31807, "ccis": [], "uuid": "36589ddf-1306-5264-aaf1-2ed2074d579a", "testId": "PRI-01_A19", "test": "the privacy program plan is updated to address problems identified during plan implementation or privacy control assessments.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-18b.[04]", "defaultText": null }, { "id": 73232, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590972", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590972", "securityControlId": 31807, "ccis": [], "uuid": "badd0896-3dc8-50d7-80a9-c5f0cb2de035", "testId": "PRI-01_A20", "test": "data privacy operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73233, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590972", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590972", "securityControlId": 31807, "ccis": [], "uuid": "750b3a60-c165-5d47-a5ce-71aad5bf1b61", "testId": "PRI-01_A21", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support data privacy operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73234, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590972", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590973", "securityControlId": 31807, "ccis": [], "uuid": "114be07c-2d2c-5671-b857-21ed486898d1", "testId": "PRI-01_A22", "test": "responsibility and authority for the performance of data privacy-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73235, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590973", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590973", "securityControlId": 31807, "ccis": [], "uuid": "38bcf390-ccb1-52cf-8973-fdf462d45863", "testId": "PRI-01_A23", "test": "personnel performing data privacy-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 591890, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588095", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f863252-4199-57df-b2e5-6ec9f940a866", "parentControlId": 31807, "controlId": "5.1", "title": "5.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588095" }, { "id": 591891, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36b1b8d5-e119-57d2-8deb-d5fc2a4b03cd", "parentControlId": 31807, "controlId": "5.34", "title": "5.34", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588096" }, { "id": 591934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d63b5156-de15-5241-88be-5d9efe3bd03c", "parentControlId": 31807, "controlId": "PM-18", "title": "PM-18", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588101" }, { "id": 591935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e409f3e7-4a93-5bb2-bfa1-295f33a745f2", "parentControlId": 31807, "controlId": "PT-01", "title": "PT-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588101" }, { "id": 591938, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3a328a6-d4f6-510f-a073-954fbedb0d89", "parentControlId": 31807, "controlId": "PM-18", "title": "PM-18", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588101" }, { "id": 591939, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1713ab05-f896-559e-82b8-0e29ea01d6f9", "parentControlId": 31807, "controlId": "PT-01", "title": "PT-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588101" }, { "id": 591940, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2ba1041-1d44-5a4c-8b59-4ef568ab623d", "parentControlId": 31807, "controlId": "PM-18", "title": "PM-18", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588101" }, { "id": 591941, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588112", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81200a28-d77d-5788-bc35-29e066eb4fa0", "parentControlId": 31807, "controlId": "PM-18", "title": "PM-18", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588112" }, { "id": 591942, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588112", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "658c3f24-b110-598e-b169-88f7f62b1e6f", "parentControlId": 31807, "controlId": "PM-18", "title": "PM-18", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588112" }, { "id": 591943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588112", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52688211-9b75-5bcd-b271-8be989ca0148", "parentControlId": 31807, "controlId": "PM-18", "title": "PM-18", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588112" }, { "id": 591944, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588112", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c57e3154-4e3b-510b-8bc9-af78ec0f38ba", "parentControlId": 31807, "controlId": "PT-1", "title": "PT-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588112" }, { "id": 591945, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588112", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e6ac924-62f7-5040-ac0c-e739d0bae847", "parentControlId": 31807, "controlId": "PM-18", "title": "PM-18", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588112" }, { "id": 591946, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588112", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19d794bd-fb36-5f0a-b822-93db6290727c", "parentControlId": 31807, "controlId": "PT-1", "title": "PT-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588112" }, { "id": 591952, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588113", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16d3e82e-3cb2-532a-bbe0-b6b4422eebb6", "parentControlId": 31807, "controlId": "GV.OC-03", "title": "GV.OC-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588113" } ], "id": 31807, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731253", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731253", "catalogueId": 1062, "uuid": "99d3c8c6-2b28-584c-b141-ad5ff427f4fc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Data Privacy Program", "description": "

Control Description

Mechanisms exist to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.

Evidence Request List (ERL)

E-GOV-02\nE-GOV-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Privacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.\n▪ Data/process owners are expected to take the initiative to work with Data Protection Officers (DPOs) to ensure applicable statutory, regulatory and contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data.\n▪ No formal data privacy principles are identified for the organization.\n▪ Data/process owners perform their own Data Protection Impact Assessment (DPIA).

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A qualified individual is formally assigned as the Chief Privacy Officer (CPO), or similar role, to lead the organization's data privacy program. This individual may be assigned to multiple data privacy-related roles.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation and operation of data protection controls throughout the data lifecycle to ensure all forms of Personal Data (PD) are processed lawfully, fairly and transparently.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-01", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-01", "references": "

Micro-Small Business (<10 staff)

∙ Data privacy program

Small Business (10-49 staff)

∙ Data privacy program

Medium Business (50-249 staff)

∙ Data privacy program

Large Business (250-999 staff)

∙ Data privacy program

Enterprise (>1,000 staff)

∙ Data privacy program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73236, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590973", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590973", "securityControlId": 31808, "ccis": [], "uuid": "4a127cb6-92ee-56b3-8715-fc77ba231f76", "testId": "PRI-01.1_A01", "test": "a senior organization official for privacy with authority, mission, accountability and resources is appointed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-19[01]", "defaultText": null }, { "id": 73237, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590973", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590973", "securityControlId": 31808, "ccis": [], "uuid": "63508acc-6bf8-515b-aeca-abcc367fb166", "testId": "PRI-01.1_A02", "test": "the senior organization official for privacy coordinates applicable privacy requirements.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-19[02]", "defaultText": null }, { "id": 73238, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590974", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590974", "securityControlId": 31808, "ccis": [], "uuid": "41207750-6709-5479-8e61-aa5c27daab28", "testId": "PRI-01.1_A03", "test": "the senior organization official for privacy develops applicable privacy requirements.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-19[03]", "defaultText": null }, { "id": 73239, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590974", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590974", "securityControlId": 31808, "ccis": [], "uuid": "a6032739-a909-5f5a-8d05-8f3db88a02e5", "testId": "PRI-01.1_A04", "test": "the senior organization official for privacy implements applicable privacy requirements.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-19[04]", "defaultText": null }, { "id": 73240, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590974", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590974", "securityControlId": 31808, "ccis": [], "uuid": "1007dbad-76f6-5b29-8531-fda8618cde3e", "testId": "PRI-01.1_A05", "test": "the senior organization official for privacy manages privacy risks through the organization-wide privacy program.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-19[05]", "defaultText": null } ], "externalMappings": [ { "id": 592139, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7afcd9c6-bc11-5b64-991d-6f73b1977e47", "parentControlId": 31808, "controlId": "AR-1", "title": "AR-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58814" }, { "id": 592140, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "185e301c-b889-51b1-a169-85f4649ad4c9", "parentControlId": 31808, "controlId": "PM-19", "title": "PM-19", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58814" }, { "id": 592142, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32ff5b39-6a5b-5f0d-84c5-b27e36639ff1", "parentControlId": 31808, "controlId": "PM-19", "title": "PM-19", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58814" }, { "id": 592143, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b24ea497-2faf-533e-9763-45d214105fa8", "parentControlId": 31808, "controlId": "PM-19", "title": "PM-19", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58814" }, { "id": 592144, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16e3eb7b-4ba3-5213-93cf-638a936de169", "parentControlId": 31808, "controlId": "PM-19", "title": "PM-19", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58814" }, { "id": 592145, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e7825aa-2a2c-5ccf-8be7-9f66871a1c90", "parentControlId": 31808, "controlId": "PM-19", "title": "PM-19", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588141" }, { "id": 592146, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588141", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ad3895d-b1f9-5742-97d1-290030f2ea41", "parentControlId": 31808, "controlId": "PM-19", "title": "PM-19", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588141" } ], "id": 31808, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731253", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731253", "catalogueId": 1062, "uuid": "cfa0fd4e-c809-5355-bccb-b6b8a8b9f477", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization have a Chief Privacy Officer (CPO) or similar role, with the authority, mission, accountability and resources to coordinate, develop and implement, applicable data privacy requirements and manage data privacy risks through the organization-wide data privacy program?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Chief Privacy Officer (CPO)", "description": "

Control Description

Mechanisms exist to appoints a Chief Privacy Officer (CPO) or similar role, with the authority, mission, accountability and resources to coordinate, develop and implement, applicable data privacy requirements and manage data privacy risks through the organization-wide data privacy program.

Evidence Request List (ERL)

E-HRS-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A qualified individual is formally assigned as the Chief Privacy Officer (CPO), or similar role, to lead the organization's data privacy program. This individual may be assigned to multiple data privacy-related roles.\n▪ The CPO, or similar role, identifies appropriate data privacy controls that Technology Assets, Applications and/or Services (TAAS) and third-parties must adhere to, in addition to applicable statutory, regulatory and/or contractual obligations.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ A Chief Privacy Officer (CPO) or similar role, has the authority, mission, accountability and resources to coordinate, develop and implement, applicable data privacy requirements and manage data privacy risks through the organization-wide data privacy program.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-01.1", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Privacy policy document\n∙ Data handling procedures

Small Business (10-49 staff)

∙ Written privacy policy\n∙ Data subject request procedures

Medium Business (50-249 staff)

∙ Data privacy program\n∙ Assigned Chief Privacy Officer (CPO) role

Large Business (250-999 staff)

∙ Assigned Chief Privacy Officer (CPO) role

Enterprise (>1,000 staff)

∙ Assigned Chief Privacy Officer (CPO) role", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73241, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590974", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590974", "securityControlId": 31809, "ccis": [], "uuid": "0d44dbb6-6ff9-521d-b58f-ccf104d06efa", "testId": "PRI-01.2_A01", "test": "Privacy Act statements are included on forms that collect information that will be maintained in a Privacy Act system of records or Privacy Act statements are provided on separate forms that can be retained by individuals.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "53A_R5_PT-05(02)", "defaultText": null } ], "externalMappings": [ { "id": 592180, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588144", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5ec50ae-3477-5289-9e2b-f1ca8acbd917", "parentControlId": 31809, "controlId": "TR-2", "title": "TR-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588144" }, { "id": 592181, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588145", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b09557b5-1bd1-5caf-a59f-e86976cf64cd", "parentControlId": 31809, "controlId": "PT-05(02)", "title": "PT-05(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588145" }, { "id": 592183, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588145", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e1a2847-fcfe-5ef0-b66b-94b6a1505bb6", "parentControlId": 31809, "controlId": "PT-05(02)", "title": "PT-05(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588145" } ], "id": 31809, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731254", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731254", "catalogueId": 1062, "uuid": "d8849436-a449-5b43-a784-79b522978631", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide additional formal notice to individuals from whom the information is being collected that includes:\n (1) Notice of the authority of organizations to collect Personal Data (PD); \n (2) Whether providing PD is mandatory or optional; \n (3) The principal purpose or purposes for which the PD is to be used; \n (4) The intended disclosures or routine uses of the information; and \n (5) The consequences of not providing all or some portion of the information requested?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Privacy Act Statements", "description": "

Control Description

Mechanisms exist to provide additional formal notice to individuals from whom the information is being collected that includes:\n(1) Notice of the authority of organizations to collect Personal Data (PD); \n(2) Whether providing PD is mandatory or optional; \n(3) The principal purpose or purposes for which the PD is to be used; \n(4) The intended disclosures or routine uses of the information; and \n(5) The consequences of not providing all or some portion of the information requested.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Privacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.\n▪ Data/process owners are expected to take the initiative to work with Data Protection Officers (DPOs) to ensure applicable statutory, regulatory and contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide additional formal notice to individuals from whom the information is being collected that includes:\n(1) Notice of the authority of organizations to collect Personal Data (PD); \n(2) Whether providing PD is mandatory or optional; \n(3) The principal purpose or purposes for which the PD is to be used; \n(4) The intended disclosures or routine uses of the information; and \n(5) The consequences of not providing all or some portion of the information requested.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-01.2", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-01.2", "references": "

Micro-Small Business (<10 staff)

∙ Data privacy program

Small Business (10-49 staff)

∙ Data privacy program

Medium Business (50-249 staff)

∙ Data privacy program

Large Business (250-999 staff)

∙ Data privacy program

Enterprise (>1,000 staff)

∙ Data privacy program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73242, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590974", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590974", "securityControlId": 31810, "ccis": [], "uuid": "516d64be-cd6f-55b5-8558-e2eecc1fa81e", "testId": "PRI-01.3_A01", "test": "a central resource webpage is maintained on the organization's principal public website.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-20[01]", "defaultText": null }, { "id": 73243, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590974", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590975", "securityControlId": 31810, "ccis": [], "uuid": "280242dc-2e40-5fa2-9d4f-8c6307df77e9", "testId": "PRI-01.3_A02", "test": "the webpage serves as a central source of information about the organization's privacy program.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-20[02]", "defaultText": null }, { "id": 73244, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590975", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590975", "securityControlId": 31810, "ccis": [], "uuid": "72593e5f-de76-51e7-96e1-f335974014e5", "testId": "PRI-01.3_A03", "test": "the webpage ensures that the public has access to information about organizational privacy activities.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PM-20a.[01]", "defaultText": null }, { "id": 73245, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590975", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590975", "securityControlId": 31810, "ccis": [], "uuid": "4c87ca60-4c96-5044-9d2f-afa7536b3a0e", "testId": "PRI-01.3_A04", "test": "the webpage ensures that the public can communicate with its senior organization official for privacy.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-20a.[02]", "defaultText": null }, { "id": 73246, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590975", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590975", "securityControlId": 31810, "ccis": [], "uuid": "5c1590a2-ebba-55a5-b110-18f87f241df3", "testId": "PRI-01.3_A05", "test": "the webpage ensures that organizational privacy practices are publicly available.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PM-20b.[01]", "defaultText": null }, { "id": 73247, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590975", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590975", "securityControlId": 31810, "ccis": [], "uuid": "761723dc-b429-5301-acaf-acf6b6d2a2b7", "testId": "PRI-01.3_A06", "test": "the webpage ensures that organizational privacy reports are publicly available.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PM-20b.[02]", "defaultText": null }, { "id": 73248, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590975", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590975", "securityControlId": 31810, "ccis": [], "uuid": "c7e58eba-5a70-518f-80a0-28e18828405e", "testId": "PRI-01.3_A07", "test": "the webpage employs publicly facing email addresses and/or phone numbers to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PM-20c.", "defaultText": null } ], "externalMappings": [ { "id": 592191, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588146", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3986211-cfcf-58b8-8c81-e4063ff8965d", "parentControlId": 31810, "controlId": "5.1", "title": "5.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588146" }, { "id": 592201, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588147", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "633872fd-6909-5719-9df6-990d33fa0648", "parentControlId": 31810, "controlId": "TR-3", "title": "TR-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588147" }, { "id": 592202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588147", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ae50ccb-fe98-52c9-9a95-403fb8898054", "parentControlId": 31810, "controlId": "PM-20", "title": "PM-20", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588147" }, { "id": 592204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588147", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "493a0787-3124-5e53-969a-71ba21205fed", "parentControlId": 31810, "controlId": "PM-20", "title": "PM-20", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588147" }, { "id": 592205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588147", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01d47ff1-1ce7-5244-9d77-5fc376b74faf", "parentControlId": 31810, "controlId": "PM-20", "title": "PM-20", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588147" }, { "id": 592206, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588147", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "351ab5ad-ff8f-532d-9510-880d623d3e17", "parentControlId": 31810, "controlId": "PM-20", "title": "PM-20", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588147" }, { "id": 592207, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588147", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a826653c-1ff2-54f0-9718-25bb429a64c9", "parentControlId": 31810, "controlId": "PM-20", "title": "PM-20", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588148" }, { "id": 592208, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588148", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "731de461-83d5-5ec8-93fd-e82c086ada23", "parentControlId": 31810, "controlId": "PM-20", "title": "PM-20", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588148" } ], "id": 31810, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731254", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731254", "catalogueId": 1062, "uuid": "b0c48a9a-1a59-5c38-a77c-06aa37f90aa5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization: \n (1) Ensure that the public has access to information about organizational data privacy activities and can communicate with its Chief Privacy Officer (CPO) or similar role;\n (2) Ensure that organizational data privacy practices are publicly available through organizational websites or document repositories; \n (3) Utilize publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to data privacy office(s) regarding data privacy practices; and\n (4) Inform data subjects when changes are made to the privacy notice and the nature of such changes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Dissemination of Data Privacy Program Information", "description": "

Control Description

Mechanisms exist to: \n(1) Ensure that the public has access to information about organizational data privacy activities and can communicate with its Chief Privacy Officer (CPO) or similar role;\n(2) Ensure that organizational data privacy practices are publicly available through organizational websites or document repositories; \n(3) Utilize publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to data privacy office(s) regarding data privacy practices; and\n(4) Inform data subjects when changes are made to the privacy notice and the nature of such changes.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to: \n(1) Ensure that the public has access to information about organizational data privacy activities and can communicate with its Chief Privacy Officer (CPO) or similar role;\n(2) Ensure that organizational data privacy practices are publicly available through organizational websites or document repositories; \n(3) Utilize publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to data privacy office(s) regarding data privacy practices; and\n(4) Inform data subjects when changes are made to the privacy notice and the nature of such changes.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "PRI-01.3", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-01.3", "references": "

Micro-Small Business (<10 staff)

∙ Data privacy program

Small Business (10-49 staff)

∙ Data privacy program

Medium Business (50-249 staff)

∙ Data privacy program

Large Business (250-999 staff)

∙ Data privacy program

Enterprise (>1,000 staff)

∙ Data privacy program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73252, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590976", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590976", "securityControlId": 31813, "ccis": [], "uuid": "6b9e751e-2145-53b6-8c0d-ab1ec3ef972c", "testId": "PRI-01.6_A01", "test": "Personal Data (PD) is protected by security safeguards that are sufficient and appropriately scoped to protect the confidentiality and integrity of the PD.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 592347, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc1e6496-4c36-5cac-83f1-8265fa8a78a8", "parentControlId": 31813, "controlId": "5.34", "title": "5.34", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588172" } ], "id": 31813, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731255", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731255", "catalogueId": 1062, "uuid": "4e0e2864-d9b9-587a-801f-5b739563bb68", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure Personal Data (PD) is protected by logical and physical security safeguards that are sufficient and appropriately scoped to protect the confidentiality and integrity of the PD?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Security of Personal Data (PD)", "description": "

Control Description

Mechanisms exist to ensure Personal Data (PD) is protected by logical and physical security safeguards that are sufficient and appropriately scoped to protect the confidentiality and integrity of the PD.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure Personal Data (PD) is protected by logical and physical security safeguards that are sufficient and appropriately scoped to protect the confidentiality and integrity of the PD.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-01.6", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-01.6", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73262, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59098", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59098", "securityControlId": 31819, "ccis": [], "uuid": "939011e3-e144-57b6-83a8-9e94ce2fd97b", "testId": "PRI-02_A01", "test": "privacy notice(s) are developed and posted on all external-facing websites.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PM-20(01)[01]", "defaultText": null }, { "id": 73263, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59098", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59098", "securityControlId": 31819, "ccis": [], "uuid": "72b55513-b357-572b-92fd-c9acfff9d126", "testId": "PRI-02_A02", "test": "privacy notice(s) are developed and posted on all mobile applications.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PM-20(01)[02]", "defaultText": null }, { "id": 73264, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59098", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59098", "securityControlId": 31819, "ccis": [], "uuid": "80c01e94-fca8-532a-b0c9-c5c834e3cf9a", "testId": "PRI-02_A03", "test": "privacy notice(s) are developed and posted on all other digital services.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PM-20(01)[03]", "defaultText": null }, { "id": 73265, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590981", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590981", "securityControlId": 31819, "ccis": [], "uuid": "b7643a2c-16f4-5f9a-9ce0-541ebcdf4ee5", "testId": "PRI-02_A04", "test": "the privacy notice(s) are written in plain language.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-20(01)(a)[01]", "defaultText": null }, { "id": 73266, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590981", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590981", "securityControlId": 31819, "ccis": [], "uuid": "22864018-171c-5c47-b595-ddbbbcdd7a6b", "testId": "PRI-02_A05", "test": "the privacy notice(s) are organized in a way that is easy to understand and navigate.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-20(01)(a)[02]", "defaultText": null }, { "id": 73267, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590981", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590981", "securityControlId": 31819, "ccis": [], "uuid": "ca12de88-861e-5dff-a932-4550cbd5a9d4", "testId": "PRI-02_A06", "test": "the privacy notice(s) provide the information needed by the public to make an informed decision about whether to interact with the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-20(01)(b)[01]", "defaultText": null }, { "id": 73268, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590981", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590981", "securityControlId": 31819, "ccis": [], "uuid": "80f768b1-1be0-57fc-84cf-fb4b4b70815d", "testId": "PRI-02_A07", "test": "the privacy notice(s) provide the information needed by the public to make an informed decision about how to interact with the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-20(01)(b)[02]", "defaultText": null }, { "id": 73269, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590981", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590981", "securityControlId": 31819, "ccis": [], "uuid": "2fe7c399-fd93-513c-80a0-f852ed0f0859", "testId": "PRI-02_A08", "test": "the privacy notice(s) are updated whenever the organization makes a substantive change to the practices it describes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-20(01)(c)[01]", "defaultText": null }, { "id": 73270, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590982", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590982", "securityControlId": 31819, "ccis": [], "uuid": "56feb4a6-bc6f-5ccf-99a4-167baa6ce823", "testId": "PRI-02_A09", "test": "the privacy notice(s) include a time/date stamp to inform the public of the date of the most recent changes.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PM-20(01)(c)[02]", "defaultText": null }, { "id": 73271, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590982", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590982", "securityControlId": 31819, "ccis": [], "uuid": "c17f4252-fcf6-52dc-83d6-3d4e769b693c", "testId": "PRI-02_A10", "test": "the frequency at which a notice is provided to individuals after initial interaction with an organization is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-05_ODP[01]", "defaultText": null }, { "id": 73272, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590982", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590982", "securityControlId": 31819, "ccis": [], "uuid": "e56545af-a646-579a-93fd-5c7bcc7e741e", "testId": "PRI-02_A11", "test": "information to be included with the notice about the processing of Personal Data (PD) is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-05_ODP[02]", "defaultText": null }, { "id": 73273, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590982", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590982", "securityControlId": 31819, "ccis": [], "uuid": "7ca01231-f1d8-52d1-bc0f-56fefc58bf9c", "testId": "PRI-02_A12", "test": "a notice to individuals about the processing of Personal Data (PD) is provided such that the notice is available to individuals upon first interacting with an organization.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PT-05a.[01]", "defaultText": null }, { "id": 73274, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590982", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590982", "securityControlId": 31819, "ccis": [], "uuid": "fe4d65ea-07de-513a-9dbf-e6dcc278a7f7", "testId": "PRI-02_A13", "test": "a notice to individuals about the processing of Personal Data (PD) is provided such that the notice is subsequently available to individuals frequency.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PT-05a.[02]", "defaultText": null }, { "id": 73275, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590983", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590983", "securityControlId": 31819, "ccis": [], "uuid": "32ceee74-ba39-508d-ae98-a8e9cbca97e1", "testId": "PRI-02_A14", "test": "a notice to individuals about the processing of Personal Data (PD) is provided that is clear, easy-to-understand and expresses information about Personal Data (PD) processing in plain language.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PT-05b.", "defaultText": null }, { "id": 73276, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590983", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590983", "securityControlId": 31819, "ccis": [], "uuid": "14c972d1-2a13-5777-b03b-133031942c2f", "testId": "PRI-02_A15", "test": "a notice to individuals about the processing of Personal Data (PD) that identifies the authority that authorizes the processing of Personal Data (PD) is provided.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PT-05c.", "defaultText": null }, { "id": 73277, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590983", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590983", "securityControlId": 31819, "ccis": [], "uuid": "d7be4bd2-08f8-5c81-b83d-29ff4ef317eb", "testId": "PRI-02_A16", "test": "a notice to individuals about the processing of Personal Data (PD) that identifies the purpose for which Personal Data (PD) is to be processed is provided.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PT-05d.", "defaultText": null }, { "id": 73278, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590983", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590983", "securityControlId": 31819, "ccis": [], "uuid": "51be52c6-b7fa-5178-ac2c-6706f4e9dd98", "testId": "PRI-02_A17", "test": "a notice to individuals about the processing of Personal Data (PD) which includes information is provided.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PT-05e.", "defaultText": null } ], "externalMappings": [ { "id": 592682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588221", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06447153-ae17-53ca-a86e-0d0c2e5b51cb", "parentControlId": 31819, "controlId": "5.34", "title": "5.34", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588221" }, { "id": 592687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588221", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cbc91e51-d202-5a15-bae4-e4f288394211", "parentControlId": 31819, "controlId": "TR-1", "title": "TR-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588221" }, { "id": 592688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588221", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b3c9d02-7686-55c9-b156-585da7708da0", "parentControlId": 31819, "controlId": "TR-2", "title": "TR-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588221" }, { "id": 592689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588221", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e586c4c3-7776-5831-897e-3d13359095a3", "parentControlId": 31819, "controlId": "PM-20(01)", "title": "PM-20(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588221" }, { "id": 592690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45f757e1-a46e-5073-b5ff-7566add52748", "parentControlId": 31819, "controlId": "PT-05", "title": "PT-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588222" }, { "id": 592693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18b76336-de87-57fd-9400-b9aa8abb59a1", "parentControlId": 31819, "controlId": "PM-20(01)", "title": "PM-20(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588222" }, { "id": 592694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b250e93d-34e0-533f-a973-ac1f86fb9935", "parentControlId": 31819, "controlId": "PT-05", "title": "PT-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588223" }, { "id": 592695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b8f1db1-1118-5e79-803f-97cb9cecbfed", "parentControlId": 31819, "controlId": "PM-20(01)", "title": "PM-20(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588223" }, { "id": 592696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "061a69e5-a47f-5f35-9324-7f228ad8e239", "parentControlId": 31819, "controlId": "PM-20(01)", "title": "PM-20(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588223" }, { "id": 592697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c14dd52-7b55-506b-a246-8bf9229c1d66", "parentControlId": 31819, "controlId": "PM-20(01)", "title": "PM-20(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588223" } ], "id": 31819, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731257", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731257", "catalogueId": 1062, "uuid": "557078f9-219c-5c7c-9f8e-fc7ef103c4a1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Data Privacy Notice", "description": "

Control Description

Mechanisms exist to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.

Evidence Request List (ERL)

E-PRI-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.\n▪ The CPO, or similar role, develops and ensures data privacy notices are published that include relevant purpose, notice and data privacy program information.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to:\n(1) Make data privacy notice(s) available to individuals upon first interacting with an organization and subsequently as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand, expressing relevant information about how Personal Data (PD) is collected, received, processed, stored, transmitted, shared, updated and/or disposed;\n(3) Contain all necessary notice-related criteria required by applicable statutory, regulatory and contractual obligations;\n(4) Define the scope of PD processing activities, including the geographic locations and third-party recipients that process the PD within the scope of the data privacy notice;\n(5) Periodically, review and update the content of the privacy notice, as necessary; and\n(6) Retain prior versions of the privacy notice, in accordance with data retention requirements.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "PRI-02", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-02", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73279, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590984", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590984", "securityControlId": 31820, "ccis": [], "uuid": "5877bc8e-eb09-5e79-9ad5-65e766dfb235", "testId": "PRI-02.1_A01", "test": "the purpose(s) for processing Personal Data (PD) is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-03_ODP[01]", "defaultText": null }, { "id": 73280, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590984", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590984", "securityControlId": 31820, "ccis": [], "uuid": "2e9a951c-af7d-561d-bb07-ea9f9a64c3a4", "testId": "PRI-02.1_A02", "test": "the processing of Personal Data (PD) to be restricted is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-03_ODP[02]", "defaultText": null }, { "id": 73281, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590984", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590984", "securityControlId": 31820, "ccis": [], "uuid": "aa549530-d77c-5d13-b0c2-0af3d36fd66d", "testId": "PRI-02.1_A03", "test": "mechanisms to be implemented for ensuring any changes in the processing of Personal Data (PD) are made in accordance with requirements are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-03_ODP[03]", "defaultText": null }, { "id": 73282, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590984", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590984", "securityControlId": 31820, "ccis": [], "uuid": "94ad5f28-6db8-5b6b-a9ec-f16b1a0bdf67", "testId": "PRI-02.1_A04", "test": "requirements for changing the processing of Personal Data (PD) are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-03_ODP[04]", "defaultText": null }, { "id": 73283, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590984", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590984", "securityControlId": 31820, "ccis": [], "uuid": "7fe1c4f2-eecc-5aeb-89b3-f569b3531cb4", "testId": "PRI-02.1_A05", "test": "the purpose(s) for processing Personal Data (PD) is/are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-03a.", "defaultText": null }, { "id": 73284, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590985", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590985", "securityControlId": 31820, "ccis": [], "uuid": "775a7c44-1727-54ce-9ebb-c8de0c01583e", "testId": "PRI-02.1_A06", "test": "the purpose(s) is/are described in the public privacy notices of the organization.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-03b.[01]", "defaultText": null }, { "id": 73285, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590985", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590985", "securityControlId": 31820, "ccis": [], "uuid": "f6974eb8-c3eb-5576-ac2d-05b82bc98175", "testId": "PRI-02.1_A07", "test": "the purpose(s) is/are described in the policies of the organization.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-03b.[02]", "defaultText": null }, { "id": 73286, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590985", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590985", "securityControlId": 31820, "ccis": [], "uuid": "fd1706ce-8243-5363-bfac-cf532f38c9c0", "testId": "PRI-02.1_A08", "test": "the processing of Personal Data (PD) is restricted to only that which is compatible with the identified purpose(s).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-03c.", "defaultText": null }, { "id": 73287, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590989", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590989", "securityControlId": 31820, "ccis": [], "uuid": "49907fe7-1264-53f2-b7a5-b8287a594177", "testId": "PRI-02.1_A09", "test": "changes in the processing of Personal Data (PD) are monitored.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-03d.[01]", "defaultText": null }, { "id": 73288, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590989", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590989", "securityControlId": 31820, "ccis": [], "uuid": "75d68086-f8be-5497-bc43-674c526f72df", "testId": "PRI-02.1_A10", "test": "mechanisms are implemented to ensure that any changes are made in accordance with requirements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-03d.[02]", "defaultText": null } ], "externalMappings": [ { "id": 593116, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54f8265d-8a6a-558d-98a1-cbe9a738a0bd", "parentControlId": 31820, "controlId": "5.34", "title": "5.34", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588283" }, { "id": 593121, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47d87eec-3fa4-51b7-9e23-f11b3c98c27d", "parentControlId": 31820, "controlId": "AP-2", "title": "AP-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588283" }, { "id": 593122, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588283", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56d6934f-9ab4-56f2-a4c2-50e15640e208", "parentControlId": 31820, "controlId": "PT-03", "title": "PT-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588283" }, { "id": 593124, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54682ea4-9daa-5be5-b231-41b7cecb9fab", "parentControlId": 31820, "controlId": "PT-03", "title": "PT-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588284" } ], "id": 31820, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731257", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731257", "catalogueId": 1062, "uuid": "17bacc2c-03af-58fc-a8b8-53bb8086f603", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure data privacy notices identify the purpose(s) for which Personal Data (PD) is collected, received, processed, stored, transmitted and/or shared?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Purpose Specification", "description": "

Control Description

Mechanisms exist to ensure data privacy notices identify the purpose(s) for which Personal Data (PD) is collected, received, processed, stored, transmitted and/or shared.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure data privacy notices identify the purpose(s) for which Personal Data (PD) is collected, received, processed, stored, transmitted and/or shared.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-02.1", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73289, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59099", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59099", "securityControlId": 31821, "ccis": [], "uuid": "d64f29a5-4989-50da-a88f-e77c79877fcb", "testId": "PRI-02.2_A01", "test": "automated mechanisms used to manage enforcement of the authorized processing of Personal Data (PD) are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-02(02)_ODP", "defaultText": null }, { "id": 73290, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59099", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59099", "securityControlId": 31821, "ccis": [], "uuid": "2534e137-ae9d-5aaa-87ae-b469c212aad5", "testId": "PRI-02.2_A02", "test": "enforcement of the authorized processing of Personal Data (PD) is managed using automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PT-02(02)", "defaultText": null } ], "externalMappings": [ { "id": 593245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5225bf52-be08-56ce-ae09-172553248365", "parentControlId": 31821, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588297" }, { "id": 593246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8579f181-aace-5c5d-85db-0e200a918c4a", "parentControlId": 31821, "controlId": "PT-02(02)", "title": "PT-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588298" }, { "id": 593247, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d42b2120-75a4-54c4-a51c-d9ac3ae82f7a", "parentControlId": 31821, "controlId": "PT-03(02)", "title": "PT-03(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588298" }, { "id": 593250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "747a0ee2-4597-504a-8fba-65036ad0db38", "parentControlId": 31821, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588298" }, { "id": 593251, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43a847cc-da28-5b22-8640-6b448a334fed", "parentControlId": 31821, "controlId": "PT-02(02)", "title": "PT-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588298" }, { "id": 593252, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ebacd2d-e1ab-5185-bdf2-9905337f40f1", "parentControlId": 31821, "controlId": "PT-03(02)", "title": "PT-03(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588298" }, { "id": 593253, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3062269-ea6d-5bea-8ecd-fb70cdc4fe9b", "parentControlId": 31821, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588299" }, { "id": 593254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1146854-d74d-567f-9006-102bd79d8729", "parentControlId": 31821, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588299" }, { "id": 593255, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e5cdbb5-6514-5c3b-bc3b-036c04fed3e6", "parentControlId": 31821, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588299" } ], "id": 31821, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731258", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731258", "catalogueId": 1062, "uuid": "ef7d6a71-201c-56df-a04b-aa4a5d4534c3", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to adjust data that is able tobe collected, received, processed, stored, transmitted, shared, updated and/or disposed, based on updated data subject authorization(s)?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 1.0, "title": "Automated Data Management Processes", "description": "

Control Description

Automated mechanisms exist to adjust data that is able to be collected, received, processed, stored, transmitted, shared, updated and/or disposed, based on updated data subject authorization(s).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically adjust data that is able to be collected, received, processed, stored, transmitted, shared, updated and/or disposed, based on updated data subject authorization(s).

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-02.2", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-02.2", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73291, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59099", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59099", "securityControlId": 31822, "ccis": [], "uuid": "4ebc4f29-c5c4-5840-ad44-e54b27ad3faa", "testId": "PRI-02.3_A01", "test": "approval to conduct the matching program is obtained from the data integrity board/function when a system or organization processes information for the purpose of conducting a matching program.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-08a.", "defaultText": null }, { "id": 73292, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59099", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59099", "securityControlId": 31822, "ccis": [], "uuid": "94055308-6737-5518-9787-1c24a50a008d", "testId": "PRI-02.3_A02", "test": "a computer matching agreement is developed when a system or organization processes information for the purpose of conducting a matching program.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-08b.[01]", "defaultText": null }, { "id": 73293, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590991", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590991", "securityControlId": 31822, "ccis": [], "uuid": "5ed8aee0-83af-5661-b374-bea8d6bdbfd8", "testId": "PRI-02.3_A03", "test": "a computer matching agreement is entered into when a system or organization processes information for the purpose of conducting a matching program.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-08b.[02]", "defaultText": null }, { "id": 73294, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590991", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590991", "securityControlId": 31822, "ccis": [], "uuid": "c278ab0a-846b-5284-a866-f204b509e8be", "testId": "PRI-02.3_A04", "test": "a matching notice is published in the Federal Register when a system or organization processes information for the purpose of conducting a matching program.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PT-08c.", "defaultText": null }, { "id": 73295, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590991", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590991", "securityControlId": 31822, "ccis": [], "uuid": "41b34f09-1693-5d8f-8cb6-001f8fbcb142", "testId": "PRI-02.3_A05", "test": "the information produced by the matching program is independently verified before taking adverse action against an individual, if required, when a system or organization processes information for the purpose of conducting a matching program.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-08d.", "defaultText": null }, { "id": 73296, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590991", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590991", "securityControlId": 31822, "ccis": [], "uuid": "60e2257f-252d-5520-9a20-6fa1fbb0e83f", "testId": "PRI-02.3_A06", "test": "individuals are provided with notice when a system or organization processes information for the purpose of conducting a matching program.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PT-08e.[01]", "defaultText": null }, { "id": 73297, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590991", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590991", "securityControlId": 31822, "ccis": [], "uuid": "f4d3ef4e-2e12-55f2-88b9-2495df86aa1d", "testId": "PRI-02.3_A07", "test": "individuals are provided with an opportunity to contest the findings before adverse action is taken against them when a system or organization processes information for the purpose of conducting a matching program.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-08e.[02]", "defaultText": null } ], "externalMappings": [ { "id": 593288, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0cf3571-0483-5240-ad96-74ad70adc37b", "parentControlId": 31822, "controlId": "DI-2(1)", "title": "DI-2(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588303" }, { "id": 593289, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7623177e-13f4-512a-a452-dc620bf4e0b2", "parentControlId": 31822, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588303" }, { "id": 593290, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "154e5665-b015-54c3-9abd-5f188dd96764", "parentControlId": 31822, "controlId": "PT-08", "title": "PT-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588303" }, { "id": 593293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c99a7c9a-e451-5664-bbd2-bfa35ef873d5", "parentControlId": 31822, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588303" }, { "id": 593294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfcac0b0-117b-5043-8655-35864b81eae5", "parentControlId": 31822, "controlId": "PT-08", "title": "PT-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588303" }, { "id": 593295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37611aad-5931-54c8-900e-45d3d29b173d", "parentControlId": 31822, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588304" }, { "id": 593296, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d295fd7-968c-51bd-81d8-7e6e0e4d37c9", "parentControlId": 31822, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588304" }, { "id": 593297, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7d7477c-dbe4-562c-945d-78dcced7caf6", "parentControlId": 31822, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588304" } ], "id": 31822, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731258", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731258", "catalogueId": 1062, "uuid": "367b98a3-2935-591e-b040-823fc3a77499", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization publish Computer Matching Agreements (CMA) on its public website(s)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Computer Matching Agreements (CMA)", "description": "

Control Description

Mechanisms exist to publish Computer Matching Agreements (CMA) on the organization's public website(s).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to publish Computer Matching Agreements (CMA) on the organization's public website(s).

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-02.3", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-02.3", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73298, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590992", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590992", "securityControlId": 31823, "ccis": [], "uuid": "189be0ba-8b80-5d00-9132-d5c3c8b2dd66", "testId": "PRI-02.4_A01", "test": "System of Records Notices (SORNs) are drafted in accordance with OMB guidance for systems that process information that will be maintained in a Privacy Act system of records.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-06a.[01]", "defaultText": null }, { "id": 73299, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590992", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590992", "securityControlId": 31823, "ccis": [], "uuid": "3b0cf4ca-5602-5a8e-a1fd-decfa33e288d", "testId": "PRI-02.4_A02", "test": "new and significantly modified system of records notices are submitted to the OMB and appropriate congressional committees for advance review for systems that process information that will be maintained in a Privacy Act system of records.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-06a.[02]", "defaultText": null }, { "id": 73300, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590992", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590992", "securityControlId": 31823, "ccis": [], "uuid": "3bf7a01e-b600-5a58-95cb-1d8f6e765136", "testId": "PRI-02.4_A03", "test": "System of Records Notices (SORNs) are published in the Federal Register for systems that process information that will be maintained in a Privacy Act system of records.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-06b.", "defaultText": null }, { "id": 73301, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590992", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590992", "securityControlId": 31823, "ccis": [], "uuid": "b41ce13b-f090-556f-a61a-e0df883dbc4e", "testId": "PRI-02.4_A04", "test": "System of Records Notices (SORNs) are kept accurate, up-to-date and scoped in accordance with policy for systems that process information that will be maintained in a Privacy Act system of records.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-06c.", "defaultText": null } ], "externalMappings": [ { "id": 593304, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3eed74e9-b1e5-5f85-a149-6f12e2fb5566", "parentControlId": 31823, "controlId": "TR-2(1)", "title": "TR-2(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588305" }, { "id": 593305, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd2bd8eb-caf4-5416-bcba-0f9a70ec7343", "parentControlId": 31823, "controlId": "PT-06", "title": "PT-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588305" }, { "id": 593307, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86353fe4-c2ee-58fd-b2ae-c1739b53b414", "parentControlId": 31823, "controlId": "PT-06", "title": "PT-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588305" } ], "id": 31823, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731258", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731258", "catalogueId": 1062, "uuid": "2572f469-e213-5e73-9bbe-391fe90ba5d5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization draft, publish and keep System of Records Notices (SORN) updated in accordance with regulatory guidance?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "System of Records Notice (SORN)", "description": "

Control Description

Mechanisms exist to draft, publish and keep System of Records Notices (SORN) updated in accordance with regulatory guidance.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to draft, publish and keep System of Records Notices (SORN) updated in accordance with regulatory guidance.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-02.4", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-02.4", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73302, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590993", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590993", "securityControlId": 31824, "ccis": [], "uuid": "ea8f9041-0f5d-50f4-98e3-8e402c4760e7", "testId": "PRI-02.5_A01", "test": "the frequency at which to review all routine uses published in the System of Records Notice (SORN) is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-06(01)_ODP", "defaultText": null }, { "id": 73303, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590993", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590993", "securityControlId": 31824, "ccis": [], "uuid": "52d54297-a4fa-589a-9ce2-647d00aa2acc", "testId": "PRI-02.5_A02", "test": "all routine uses published in the system of records notice are reviewed frequently to ensure continued accuracy and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-06(01)", "defaultText": null } ], "externalMappings": [ { "id": 593313, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e58da303-07fc-5cf9-b17e-73e9eb4947ed", "parentControlId": 31824, "controlId": "PT-06(01)", "title": "PT-06(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588305" }, { "id": 593315, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9914170-0cd9-5af4-a74f-559fc864b430", "parentControlId": 31824, "controlId": "PT-06(01)", "title": "PT-06(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588306" } ], "id": 31824, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731259", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731259", "catalogueId": 1062, "uuid": "d4874cb3-cd4b-5543-8cf7-96179d33dc5f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization review all routine uses of data published in the System of Records Notices (SORN) to ensure continued accuracy and to ensure that routine uses continue to be compatible with the purpose for which the information was collected?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "System of Records Notice (SORN) Review Process", "description": "

Control Description

Mechanisms exist to review all routine uses of data published in the System of Records Notices (SORN) to ensure continued accuracy and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to review all routine uses of data published in the System of Records Notices (SORN) to ensure continued accuracy and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-02.5", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-02.5", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73304, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590993", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590993", "securityControlId": 31825, "ccis": [], "uuid": "276fec62-c449-5688-82da-566fc7d9f4ed", "testId": "PRI-02.6_A01", "test": "the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-06(02)_ODP", "defaultText": null }, { "id": 73305, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590993", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590993", "securityControlId": 31825, "ccis": [], "uuid": "e0e2e54a-8d08-5b30-abe9-f138079ef3bf", "testId": "PRI-02.6_A02", "test": "all Privacy Act exemptions claimed for the system of records are reviewed frequently to ensure that they remain appropriate and necessary in accordance with law.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-06(02)[01]", "defaultText": null }, { "id": 73306, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590994", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590994", "securityControlId": 31825, "ccis": [], "uuid": "e8992515-0204-5619-9d3e-631a33b93093", "testId": "PRI-02.6_A03", "test": "all Privacy Act exemptions claimed for the system of records are reviewed frequently to ensure that they have been promulgated as regulations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-06(02)[02]", "defaultText": null }, { "id": 73307, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590994", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590994", "securityControlId": 31825, "ccis": [], "uuid": "53f971e0-c94d-54ac-bfcc-b6bf2083bdbc", "testId": "PRI-02.6_A04", "test": "all Privacy Act exemptions claimed for the system of records are reviewed frequently to ensure that they are accurately described in the system of records notice.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-06(02)[03]", "defaultText": null } ], "externalMappings": [ { "id": 593317, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588306", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a30a2440-16d9-5c60-95ab-20087af449bf", "parentControlId": 31825, "controlId": "PT-06(02)", "title": "PT-06(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588307" }, { "id": 593319, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "705c436c-7e9a-52b2-948e-f7416d7c0360", "parentControlId": 31825, "controlId": "PT-06(02)", "title": "PT-06(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588307" } ], "id": 31825, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731259", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731259", "catalogueId": 1062, "uuid": "46488e6f-8143-59dd-8b77-198d64dfc5fa", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization review all Privacy Act exemptions claimed for the System of Records Notices (SORN) to ensure they remain appropriate and accurate?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Privacy Act Exemptions", "description": "

Control Description

Mechanisms exist to review all Privacy Act exemptions claimed for the System of Records Notices (SORN) to ensure they remain appropriate and accurate.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to review all Privacy Act exemptions claimed for the System of Records Notices (SORN) to ensure they remain appropriate and accurate.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-02.6", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-02.6", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73308, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590994", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590994", "securityControlId": 31826, "ccis": [], "uuid": "462e48f4-9d52-5cc0-b9e1-02711e760573", "testId": "PRI-02.7_A01", "test": "real-time and/or layered notices are generated to provide data subjects with a summary of key points or more detailed information that is specific to the organization's privacy notice.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 593321, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "864bf07f-3a82-58f0-ab90-0d50029e7e6a", "parentControlId": 31826, "controlId": "TR-1(1)", "title": "TR-1(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588307" } ], "id": 31826, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73126", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73126", "catalogueId": 1062, "uuid": "56c8aecb-985f-5beb-b42e-986419a4c747", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide real-time and/or layered notice when Personal Data (PD) is collected that provides data subjects with a summary of key points or more detailed information that is specific to its data privacy notice?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Real-Time or Layered Notice", "description": "

Control Description

Mechanisms exist to provide real-time and/or layered notice when Personal Data (PD) is collected that provides data subjects with a summary of key points or more detailed information that is specific to the organization's data privacy notice.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide real-time and/or layered notice when Personal Data (PD) is collected that provides data subjects with a summary of key points or more detailed information that is specific to the organization's data privacy notice.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-02.7", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-02.7", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73325, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590998", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590998", "securityControlId": 31834, "ccis": [], "uuid": "e59a3d05-2051-5992-be05-2916f20d76d0", "testId": "PRI-03_A01", "test": "the tools or mechanisms to be implemented for individuals to consent to the processing of their Personal Data (PD) are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-04_ODP", "defaultText": null }, { "id": 73326, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590998", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590998", "securityControlId": 31834, "ccis": [], "uuid": "851f7459-61ca-5ae7-88cc-a8f26a78b6cb", "testId": "PRI-03_A02", "test": "tools or mechanisms are implemented for individuals to consent to the processing of their Personal Data (PD) prior to its collection that facilitates individuals’ informed decision-making.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PT-04", "defaultText": null } ], "externalMappings": [ { "id": 593365, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588313", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3dd153be-66da-5fb9-938c-4114f0f84d2f", "parentControlId": 31834, "controlId": "5.33", "title": "5.33", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588313" }, { "id": 593371, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d7c0c2a-80fe-5595-9c67-7252c8ada1ba", "parentControlId": 31834, "controlId": "IP-1", "title": "IP-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588315" }, { "id": 593372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11bedab5-547e-5c45-bd1d-de9ea4054580", "parentControlId": 31834, "controlId": "PT-04", "title": "PT-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588315" }, { "id": 593374, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e5c43d6-287f-501c-bdf1-750bd18f046b", "parentControlId": 31834, "controlId": "PT-04", "title": "PT-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588315" } ], "id": 31834, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731262", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731262", "catalogueId": 1062, "uuid": "6a7e821c-48b1-5ce9-a71c-d6be33d95766", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enable data subjects to authorize the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of their Personal Data (PD), where prior to collection the data subject is provided with:\n(1) Plain language to illustrate the potential data privacy risks of the authorization; \n(2) A means for users to decline the authorization; and\n(3) All necessary choice and consent-related criteria required by applicable statutory, regulatory and contractual obligations?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 7.0, "title": "Choice & Consent", "description": "

Control Description

Mechanisms exist to enable data subjects to authorize the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of their Personal Data (PD), where prior to collection the data subject is provided with:\n(1) Plain language to illustrate the potential data privacy risks of the authorization; \n(2) A means for users to decline the authorization; and\n(3) All necessary choice and consent-related criteria required by applicable statutory, regulatory and contractual obligations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enable data subjects to authorize the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of their Personal Data (PD), where prior to collection the data subject is provided with:\n(1) Plain language to illustrate the potential data privacy risks of the authorization; \n(2) A means for users to decline the authorization; and\n(3) All necessary choice and consent-related criteria required by applicable statutory, regulatory and contractual obligations.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-03", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-03", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73327, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590998", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590998", "securityControlId": 31835, "ccis": [], "uuid": "822e737e-809a-5f45-bebe-e1aa8cf88dbd", "testId": "PRI-03.1_A01", "test": "tailoring mechanisms for processing selected elements of Personal Data (PD) permissions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-04(01)_ODP", "defaultText": null }, { "id": 73328, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590998", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590998", "securityControlId": 31835, "ccis": [], "uuid": "70c76804-0b73-52de-8674-f19a4fc83c30", "testId": "PRI-03.1_A02", "test": "mechanisms are provided to allow individuals to tailor processing permissions to selected elements of Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-04(01)", "defaultText": null } ], "externalMappings": [ { "id": 593553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58835", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc06d1e6-1bd1-5d67-9f5b-1d12f7681fdb", "parentControlId": 31835, "controlId": "IP-(1)", "title": "IP-(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58835" }, { "id": 593554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58835", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "debe235a-c1a7-54ea-a53d-bbb307be43cd", "parentControlId": 31835, "controlId": "PT-04(01)", "title": "PT-04(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58835" }, { "id": 593555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58835", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90e3b49f-331f-59ba-ba92-ec328b1f514d", "parentControlId": 31835, "controlId": "PT-04(01)", "title": "PT-04(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58835" } ], "id": 31835, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731263", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731263", "catalogueId": 1062, "uuid": "35080803-f163-52b5-b624-d9bbf7541232", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization allow data subjects to modify permission to collect, receive, process, store, transmit, share, update and/or dispose selected attributes of their Personal Data (PD)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Tailored Consent", "description": "

Control Description

Mechanisms exist to allow data subjects to modify permission to collect, receive, process, store, transmit, share, update and/or dispose selected attributes of their Personal Data (PD).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to allow data subjects to modify permission to collect, receive, process, store, transmit, share, update and/or dispose selected attributes of their Personal Data (PD).

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-03.1", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73329, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590999", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590999", "securityControlId": 31836, "ccis": [], "uuid": "c50e0f46-7c04-53f0-8cda-598373c56f3f", "testId": "PRI-03.2_A01", "test": "consent mechanisms to be presented to individuals are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-04(02)_ODP[01]", "defaultText": null }, { "id": 73330, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590999", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590999", "securityControlId": 31836, "ccis": [], "uuid": "b609ddab-c72b-5b84-a50c-b9131e7bf46b", "testId": "PRI-03.2_A02", "test": "the frequency at which to present consent mechanisms to individuals is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-04(02)_ODP[02]", "defaultText": null }, { "id": 73331, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590999", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590999", "securityControlId": 31836, "ccis": [], "uuid": "b5188b59-dfdc-5635-8f3c-15b9f633e26c", "testId": "PRI-03.2_A03", "test": "Personal Data (PD) processing to be presented in conjunction with organization-defined consent mechanisms is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-04(02)_ODP[03]", "defaultText": null }, { "id": 73332, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.590999", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.590999", "securityControlId": 31836, "ccis": [], "uuid": "9c609b7a-1ef5-5525-9c5c-6c83aba76f5c", "testId": "PRI-03.2_A04", "test": "consent mechanisms are presented to individuals frequently and in conjunction with Personal Data (PD) processing.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-04(02)", "defaultText": null } ], "externalMappings": [ { "id": 593577, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c891c93-2b7b-557b-b511-44867c6816ae", "parentControlId": 31836, "controlId": "PT-04(02)", "title": "PT-04(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588353" }, { "id": 593578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc853221-f28f-5ca9-b4ba-e5d7e487a155", "parentControlId": 31836, "controlId": "PT-05(01)", "title": "PT-05(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588353" }, { "id": 593579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588353", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b021b948-1a1c-5a52-8877-fd47b7680449", "parentControlId": 31836, "controlId": "PT-04(02)", "title": "PT-04(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588353" }, { "id": 593580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588354", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4652ae7-cb5b-573b-b35b-615bd6f8dad0", "parentControlId": 31836, "controlId": "PT-05(01)", "title": "PT-05(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588354" } ], "id": 31836, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731263", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731263", "catalogueId": 1062, "uuid": "2ea9db2b-5c55-545f-9e00-468b8017b03b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization present data subjects with a new or updated consent request to collect, receive, process, store, transmit, share, update and/or dispose Personal Data (PD) in conjunction with the data action, when:\n(1) The original circumstances under which an individual gave consent have changed; or\n(2) A significant amount of time has passed since an individual gave consent?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Just-In-Time Notice & Updated Consent", "description": "

Control Description

Mechanisms exist to present data subjects with a new or updated consent request to collect, receive, process, store, transmit, share, update and/or dispose Personal Data (PD) in conjunction with the data action, when:\n(1) The original circumstances under which an individual gave consent have changed; or\n(2) A significant amount of time has passed since an individual gave consent.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to present data subjects with a new or updated consent request to collect, receive, process, store, transmit, share, update and/or dispose Personal Data (PD) in conjunction with the data action, when:\n(1) The original circumstances under which an individual gave consent have changed; or\n(2) A significant amount of time has passed since an individual gave consent.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-03.2", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-03.2", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73335, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591", "securityControlId": 31838, "ccis": [], "uuid": "212206cd-db88-57c4-b896-99c85c12d88a", "testId": "PRI-03.4_A01", "test": "the tools or mechanisms to be implemented for revoking consent to the processing of Personal Data (PD) are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-04(03)_ODP", "defaultText": null }, { "id": 73336, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591", "securityControlId": 31838, "ccis": [], "uuid": "9be12343-3233-5156-a22d-23e3c5923444", "testId": "PRI-03.4_A02", "test": "the tools or mechanisms are implemented for individuals to revoke consent to the processing of their Personal Data (PD).
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PT-04(03)", "defaultText": null } ], "externalMappings": [ { "id": 593632, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58836", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a13dc37-84b8-5c92-a6e8-a9124289a8bb", "parentControlId": 31838, "controlId": "PT-04(03)", "title": "PT-04(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58836" }, { "id": 593633, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58836", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "232c4362-3958-5f23-8543-27166428ec6b", "parentControlId": 31838, "controlId": "PT-04(03)", "title": "PT-04(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58836" } ], "id": 31838, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731263", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731263", "catalogueId": 1062, "uuid": "0f6641a7-5bb2-5688-9bdf-95680f7f4bac", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization allow data subjects to revoke consent to collect, receive, process, store, transmit, share and/or update their Personal Data (PD)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Revoke Consent", "description": "

Control Description

Mechanisms exist to allow data subjects to revoke consent to collect, receive, process, store, transmit, share and/or update their Personal Data (PD).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to allow data subjects to revoke consent to collect, receive, process, store, transmit, share and/or update their Personal Data (PD).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-03.4", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-03.4", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73357, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591007", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591007", "securityControlId": 31848, "ccis": [], "uuid": "239a3175-d362-5c7f-a8e7-32cf442e33a4", "testId": "PRI-04_A01", "test": "the type of processing of Personal Data (PD) is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-02_ODP[02]", "defaultText": null }, { "id": 73358, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591008", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591008", "securityControlId": 31848, "ccis": [], "uuid": "b65f5614-6cb5-5cb4-a9c0-e8a1fb4427e4", "testId": "PRI-04_A02", "test": "the type of processing of Personal Data (PD) to be restricted is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-02_ODP[03]", "defaultText": null } ], "externalMappings": [ { "id": 593838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "889beb9a-a22c-5d3e-86ef-27cb0c67bf50", "parentControlId": 31848, "controlId": "5.33", "title": "5.33", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588393" }, { "id": 593843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95c7b5c1-5bf0-54eb-b5ea-f1ad73138455", "parentControlId": 31848, "controlId": "AP-1", "title": "AP-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588393" }, { "id": 593844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2357415-8b5f-56ba-8342-4f2e9a688523", "parentControlId": 31848, "controlId": "PT-02", "title": "PT-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588394" }, { "id": 593846, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1bb67a7-5876-578c-8821-392a31adac85", "parentControlId": 31848, "controlId": "PT-02", "title": "PT-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588394" } ], "id": 31848, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731267", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731267", "catalogueId": 1062, "uuid": "696787d7-e737-57ce-bffa-6b16a3dda4b0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization minimize the collection of Personal Data (PD) to only what is adequate, relevant and limited to the purposes identified in the data privacy notice, including protections against collecting PD from minors without appropriate parental or legal guardian consent?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Restrict Collection To Identified Purpose", "description": "

Control Description

Mechanisms exist to minimize the collection of Personal Data (PD) to only what is adequate, relevant and limited to the purposes identified in the data privacy notice, including protections against collecting PD from minors without appropriate parental or legal guardian consent.

Evidence Request List (ERL)

E-PRI-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to minimize the collection of Personal Data (PD) to only what is adequate, relevant and limited to the purposes identified in the data privacy notice, including protections against collecting PD from minors without appropriate parental or legal guardian consent.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-04", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-04", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73359, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591008", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591008", "securityControlId": 31849, "ccis": [], "uuid": "284daeca-acc4-5f50-a8f3-2fc0287e8853", "testId": "PRI-04.1_A01", "test": "the authority to permit the processing of Personal Data (PD) is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-02_ODP[01]", "defaultText": null }, { "id": 73360, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591008", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591008", "securityControlId": 31849, "ccis": [], "uuid": "bdaf5bb4-8f53-5fe2-8ba6-931b8b234898", "testId": "PRI-04.1_A02", "test": "the authority that permits the processing of Personal Data (PD) is determined and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-02a.", "defaultText": null }, { "id": 73361, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591008", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591008", "securityControlId": 31849, "ccis": [], "uuid": "73620e56-dc13-5b9f-b067-8e4eb5e5ed44", "testId": "PRI-04.1_A03", "test": "the processing of Personal Data (PD) is restricted to only that which is authorized.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-02b.", "defaultText": null } ], "externalMappings": [ { "id": 593988, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ae49a8d-2998-59bb-8bc3-39214f04815b", "parentControlId": 31849, "controlId": "AP-1", "title": "AP-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58841" }, { "id": 593989, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58841", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5594c78-29c1-57be-be47-8a406cbd4143", "parentControlId": 31849, "controlId": "PT-02", "title": "PT-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58841" }, { "id": 593991, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe603113-bef4-5d80-bb55-830d61b05c6b", "parentControlId": 31849, "controlId": "PT-02", "title": "PT-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588411" } ], "id": 31849, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731268", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731268", "catalogueId": 1062, "uuid": "34168ba4-1f46-588f-bc54-9ef0a62b06a8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization determine and document the legal authority that permits the organization to collect, receive, process, store, transmit, share, update and/or dispose Personal Data (PD), either generally or in support of a specific business process?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Authority To Collect, Process, Store & Share Personal Data (PD)", "description": "

Control Description

Mechanisms exist to determine and document the legal authority that permits the organization to collect, receive, process, store, transmit, share, update and/or dispose Personal Data (PD), either generally or in support of a specific business process.

Evidence Request List (ERL)

E-PRI-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to determine and document the legal authority that permits the organization to collect, receive, process, store, transmit, share, update and/or dispose Personal Data (PD), either generally or in support of a specific business process.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-04.1", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73366, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59101", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59101", "securityControlId": 31853, "ccis": [], "uuid": "d3532848-234f-5751-ae9a-74a75cdeed6d", "testId": "PRI-04.5_A01", "test": "data subjects, or authorized representatives, are prompted to validate Personal Data (PD) during the collection process.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 594206, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588447", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d476f9de-dfb7-524e-88c4-421dea7dd3b3", "parentControlId": 31853, "controlId": "DI-1(1)", "title": "DI-1(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588447" } ], "id": 31853, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731269", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731269", "catalogueId": 1062, "uuid": "7e3423fa-2f3b-5466-a5f2-25bd3909f67f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure that the data subject, or authorized representative, validate Personal Data (PD) during the collection process?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Validate Collected Personal Data (PD)", "description": "

Control Description

Mechanisms exist to ensure that the data subject, or authorized representative, validate Personal Data (PD) during the collection process.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure that the data subject, or authorized representative, validate Personal Data (PD) during the collection process.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-04.5", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-04.5", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73367, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59101", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59101", "securityControlId": 31854, "ccis": [], "uuid": "3200e176-ee93-5104-9377-8845057ec0ec", "testId": "PRI-04.6_A01", "test": "data subjects, or authorized representatives, are prompted to re-validate that Personal Data (PD) acquired during the collection process is still accurate.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 594210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588447", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04692183-9c5c-5ba4-b6b0-ea64fde38e03", "parentControlId": 31854, "controlId": "DI-1(2)", "title": "DI-1(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588447" } ], "id": 31854, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731269", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731269", "catalogueId": 1062, "uuid": "ae2b204d-1aa7-5122-85b7-153304e3afdf", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure that the data subject, or authorized representative, re-validate that Personal Data (PD) acquired during the collection process is still accurate?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Re-Validate Collected Personal Data (PD)", "description": "

Control Description

Mechanisms exist to ensure that the data subject, or authorized representative, re-validate that Personal Data (PD) acquired during the collection process is still accurate.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure that the data subject, or authorized representative, re-validate that Personal Data (PD) acquired during the collection process is still accurate.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-04.6", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-04.6", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73370, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591011", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591011", "securityControlId": 31856, "ccis": [], "uuid": "80bd603e-d013-5cc6-9809-d11e7dc2e87f", "testId": "PRI-05_A01", "test": "techniques used to dispose of information following the retention period are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-12(03)_ODP[01]", "defaultText": null }, { "id": 73371, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591011", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591011", "securityControlId": 31856, "ccis": [], "uuid": "7dd09933-67bc-5963-b206-6963dec5d146", "testId": "PRI-05_A02", "test": "techniques used to destroy information following the retention period are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-12(03)_ODP[02]", "defaultText": null }, { "id": 73372, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591011", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591011", "securityControlId": 31856, "ccis": [], "uuid": "0535aaa0-7d0e-5a61-bff3-9507c929e9f4", "testId": "PRI-05_A03", "test": "techniques used to erase information following the retention period are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-12(03)_ODP[03]", "defaultText": null }, { "id": 73373, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591011", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591011", "securityControlId": 31856, "ccis": [], "uuid": "446f24ba-a341-564b-8410-92aacc1c184a", "testId": "PRI-05_A04", "test": "organization-defined techniques are used to dispose of information following the retention period.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-12(03)[01]", "defaultText": null }, { "id": 73374, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591011", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591011", "securityControlId": 31856, "ccis": [], "uuid": "a183b054-a85f-57db-bb6e-754f858ba0d4", "testId": "PRI-05_A05", "test": "organization-defined techniques are used to destroy information following the retention period.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-12(03)[02]", "defaultText": null }, { "id": 73375, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591012", "securityControlId": 31856, "ccis": [], "uuid": "ea3350a8-6e45-5d5d-9e1c-a7d026d8bdae", "testId": "PRI-05_A06", "test": "organization-defined techniques are used to erase information following the retention period.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-12(03)[03]", "defaultText": null }, { "id": 73376, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591012", "securityControlId": 31856, "ccis": [], "uuid": "5e3584a7-3351-5e0f-9214-fd4af4c4be28", "testId": "PRI-05_A07", "test": "information within the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines and operational requirements.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "53A_R5_SI-12[02]", "defaultText": null }, { "id": 73377, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591012", "securityControlId": 31856, "ccis": [], "uuid": "ec008d02-5a47-5a50-a4ca-ca7e2e26469e", "testId": "PRI-05_A08", "test": "information output from the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines and operational requirements.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "53A_R5_SI-12[04]", "defaultText": null }, { "id": 73378, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591012", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591012", "securityControlId": 31856, "ccis": [], "uuid": "9a4574a2-cde5-5815-b82a-0e3ba4514cb8", "testId": "PRI-05_A09", "test": "information within the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines and operational requirements.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_SI-12[01]", "defaultText": null }, { "id": 73379, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591013", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591013", "securityControlId": 31856, "ccis": [], "uuid": "046caaaf-5c36-5554-97fd-273f58f807b5", "testId": "PRI-05_A10", "test": "information output from the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines and operational requirements.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_SI-12[03]", "defaultText": null } ], "externalMappings": [ { "id": 594243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb564abb-8139-522b-a3cf-788608f9fffe", "parentControlId": 31856, "controlId": "5.33", "title": "5.33", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588451" }, { "id": 594244, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51db438c-2a7d-54e6-ba25-03e65d4115b7", "parentControlId": 31856, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588451" }, { "id": 594250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f46a8b4-af95-5dff-bba7-7f610f473202", "parentControlId": 31856, "controlId": "DM-2", "title": "DM-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588452" }, { "id": 594251, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "563e4fea-33f6-5157-ad7c-c3118c46f572", "parentControlId": 31856, "controlId": "AC-04(25)", "title": "AC-04(25)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588452" }, { "id": 594252, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7216bac4-fb6e-5093-a212-60d0badc8b9a", "parentControlId": 31856, "controlId": "SI-12", "title": "SI-12", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588452" }, { "id": 594253, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4292e7d4-2955-51f9-a756-9768f2654881", "parentControlId": 31856, "controlId": "SI-12(03)", "title": "SI-12(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588452" }, { "id": 594256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01c2c250-3c6d-5261-9675-ddd2970f1615", "parentControlId": 31856, "controlId": "SI-12", "title": "SI-12", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588453" }, { "id": 594257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d99c9125-e68b-5631-a55d-6e5f9005b6a7", "parentControlId": 31856, "controlId": "AC-04(25)", "title": "AC-04(25)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588453" }, { "id": 594258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a50785b-5580-5bde-9c12-2e2d2471dc3c", "parentControlId": 31856, "controlId": "SI-12", "title": "SI-12", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588453" }, { "id": 594259, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9f96fca-e70c-584e-93fe-bc96fe98569a", "parentControlId": 31856, "controlId": "SI-12(03)", "title": "SI-12(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588453" }, { "id": 594260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "241056d3-93ae-512d-aebe-711b9489b7fe", "parentControlId": 31856, "controlId": "SI-12", "title": "SI-12", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588453" }, { "id": 594261, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc4ef086-5e4d-5281-aac1-fa6ff36869b3", "parentControlId": 31856, "controlId": "SI-12", "title": "SI-12", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588453" }, { "id": 594262, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6eb62f7-92d1-5dc7-9099-63c96d14225f", "parentControlId": 31856, "controlId": "SI-12", "title": "SI-12", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588453" }, { "id": 594263, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8212513-f819-52ce-b90f-029cb3ff374e", "parentControlId": 31856, "controlId": "SI-12", "title": "SI-12", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588453" }, { "id": 594264, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee433bdd-d025-55bd-8ce6-98d25dfdb6c4", "parentControlId": 31856, "controlId": "SI-12", "title": "SI-12", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588453" }, { "id": 594266, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588454", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19c29fa9-dbe4-5797-adf5-99238f5b99d4", "parentControlId": 31856, "controlId": "ID.AM-07", "title": "ID.AM-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588454" }, { "controlId": "C.3.10", "title": "C.3.10 — Information Output Handling and Retention", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-12", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "0f6fb4aa-d4f6-5e3a-a38d-fb2ad537c735", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.10", "title": "NEI 08-09 App E.3.10 — Information Output Handling and Retention", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.10", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "39fe08eb-4d8e-5115-94b7-23e4d40f93d5", "isPublic": true }, { "controlId": "10 CFR 73.54(h)", "title": "10 CFR 73.54(h) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.3.10", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "276d9587-009e-5c54-9ae4-1b88d2698cc8", "isPublic": true } ], "id": 31856, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73127", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73127", "catalogueId": 1062, "uuid": "d2096476-7a5f-5b0e-b56f-ab4e4d6ad984", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization: \n (1) Retain Personal Data (PD), including metadata, for an organization-defined time period to fulfill the purpose(s) identified in the notice or as required by law;\n (2) Dispose of, destroys, erases, and/or anonymizes the PD, regardless of the method of storage; and\n (3) Use organization-defined techniques or methods to ensure secure deletion or destruction of PD (including originals, copies and archived records)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Personal Data (PD) Retention & Disposal", "description": "

Control Description

Mechanisms exist to: \n(1) Retain Personal Data (PD), including metadata, for an organization-defined time period to fulfill the purpose(s) identified in the notice or as required by law;\n(2) Dispose of, destroys, erases, and/or anonymizes the PD, regardless of the method of storage; and\n(3) Use organization-defined techniques or methods to ensure secure deletion or destruction of PD (including originals, copies and archived records).

Evidence Request List (ERL)

E-AST-11\nE-PRI-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to: \n(1) Retain Personal Data (PD), including metadata, for an organization-defined time period to fulfill the purpose(s) identified in the notice or as required by law;\n(2) Dispose of, destroys, erases, and/or anonymizes the PD, regardless of the method of storage; and\n(3) Use organization-defined techniques or methods to ensure secure deletion or destruction of PD (including originals, copies and archived records).

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.3.10", "controlId": "PRI-05", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-05", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73380, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591013", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591013", "securityControlId": 31857, "ccis": [], "uuid": "4a896c59-69d9-55e6-a67b-9a1d1cbee3f6", "testId": "PRI-05.1_A01", "test": "elements of Personal Data (PD) being processed in the information life cycle are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-12(01)_ODP", "defaultText": null }, { "id": 73381, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591013", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591013", "securityControlId": 31857, "ccis": [], "uuid": "33e77f79-e4be-5567-a403-fe74127ac6fb", "testId": "PRI-05.1_A02", "test": "techniques used to minimize the use of Personal Data (PD) for research, testing and training are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-12(02)_ODP[01]\n53A_R5_SI-12(02)_ODP[02]\n53A_R5_SI-12(02)_ODP[03]", "defaultText": null }, { "id": 73382, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591013", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591013", "securityControlId": 31857, "ccis": [], "uuid": "117e6053-98c8-5efa-bf60-a7d54ca23f8f", "testId": "PRI-05.1_A03", "test": "organization-defined techniques are used to minimize the use of Personal Data (PD) for research, testing and training.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-12(02)[01]\n53A_R5_SI-12(02)[02]\n53A_R5_SI-12(02)[03]", "defaultText": null }, { "id": 73383, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591013", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591013", "securityControlId": 31857, "ccis": [], "uuid": "7077676b-6ed9-555c-b684-a808c73dd05c", "testId": "PRI-05.1_A04", "test": "Personal Data (PD) being processed in the information life cycle is limited to organization-defined elements of Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-12(01)", "defaultText": null }, { "id": 73384, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591014", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591014", "securityControlId": 31857, "ccis": [], "uuid": "6df2206a-0f87-566f-beb9-c8b29de22e56", "testId": "PRI-05.1_A05", "test": "the frequency for reviewing policies that address the use of Personal Data (PD) for internal testing, training and research is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-25_ODP[01]", "defaultText": null }, { "id": 73385, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591014", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591014", "securityControlId": 31857, "ccis": [], "uuid": "f4feb04d-e5ff-5823-990b-02e9c0fbfe59", "testId": "PRI-05.1_A06", "test": "the frequency for updating policies that address the use of Personal Data (PD) for internal testing, training and research is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-25_ODP[02]", "defaultText": null }, { "id": 73386, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591014", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591014", "securityControlId": 31857, "ccis": [], "uuid": "5e4dd044-0b3a-50b8-8ebb-e81bf70921f5", "testId": "PRI-05.1_A07", "test": "the frequency for reviewing procedures that address the use of Personal Data (PD) for internal testing, training and research is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-25_ODP[03]", "defaultText": null }, { "id": 73387, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591016", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591016", "securityControlId": 31857, "ccis": [], "uuid": "18544568-d72e-5de4-9d32-7a019abe6653", "testId": "PRI-05.1_A08", "test": "the frequency for updating procedures that address the use of Personal Data (PD) for internal testing, training and research is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-25_ODP[04]", "defaultText": null }, { "id": 73388, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591016", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591016", "securityControlId": 31857, "ccis": [], "uuid": "47e8be5d-2da0-5b19-9cac-c20f46cadca3", "testId": "PRI-05.1_A09", "test": "policies that address the use of Personal Data (PD) for internal research, testing and training are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[01]\n53A_R5_PM-25a.[02]\n53A_R5_PM-25a.[03]", "defaultText": null }, { "id": 73389, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591016", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591016", "securityControlId": 31857, "ccis": [], "uuid": "1afe5d65-53d8-53a2-bf3c-e504d59a60f1", "testId": "PRI-05.1_A10", "test": "procedures that address the use of Personal Data (PD) for internal research, testing and training are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[04]\n53A_R5_PM-25a.[05]\n53A_R5_PM-25a.[06]", "defaultText": null }, { "id": 73390, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591016", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591016", "securityControlId": 31857, "ccis": [], "uuid": "420d490e-5c00-5ffe-9004-a36f218ddd3c", "testId": "PRI-05.1_A11", "test": "policies that address the use of Personal Data (PD) for internal research, testing and training are implemented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[07]\n53A_R5_PM-25a.[08]\n53A_R5_PM-25a.[09]", "defaultText": null }, { "id": 73391, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591017", "securityControlId": 31857, "ccis": [], "uuid": "c3937299-a4f7-5e71-b1cd-2caefa3c7b50", "testId": "PRI-05.1_A12", "test": "procedures that address the use of Personal Data (PD) for internal research, testing and training are implemented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[10]\n53A_R5_PM-25a.[11]\n53A_R5_PM-25a.[12]", "defaultText": null }, { "id": 73392, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591017", "securityControlId": 31857, "ccis": [], "uuid": "f741a8bd-48f7-5688-8ec4-0d27ec8817cb", "testId": "PRI-05.1_A13", "test": "the amount of Personal Data (PD) used for internal research, testing and training purposes is limited or minimized.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25b.[01]\n53A_R5_PM-25b.[02]\n53A_R5_PM-25b.[03]", "defaultText": null }, { "id": 73393, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591017", "securityControlId": 31857, "ccis": [], "uuid": "5809d061-d2bf-558a-a6d3-303f81d24fd7", "testId": "PRI-05.1_A14", "test": "the required use of Personal Data (PD) for internal research, testing and training is authorized.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25c.[01]\n53A_R5_PM-25c.[02]\n53A_R5_PM-25c.[03]", "defaultText": null }, { "id": 73394, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591017", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591017", "securityControlId": 31857, "ccis": [], "uuid": "1644fda0-3642-5a09-90a7-5e96542cddd3", "testId": "PRI-05.1_A15", "test": "policies are reviewed frequently.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25d.[01]", "defaultText": null }, { "id": 73395, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591018", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591018", "securityControlId": 31857, "ccis": [], "uuid": "b5849d07-c967-5e7b-bb64-a6ee27688d3c", "testId": "PRI-05.1_A16", "test": "policies are updated frequently.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25d.[02]", "defaultText": null }, { "id": 73396, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591018", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591018", "securityControlId": 31857, "ccis": [], "uuid": "e093a0ef-c0ed-5dbd-97c9-a10d4ae1037b", "testId": "PRI-05.1_A17", "test": "procedures are reviewed frequently.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25d.[03]", "defaultText": null }, { "id": 73397, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591018", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591018", "securityControlId": 31857, "ccis": [], "uuid": "4b7d9ac8-46c3-5fb8-a2cd-b2d55b6be305", "testId": "PRI-05.1_A18", "test": "procedures are updated frequently.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25d.[04]", "defaultText": null }, { "id": 73398, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591018", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591018", "securityControlId": 31857, "ccis": [], "uuid": "26a2e89f-cfe4-549d-b7f4-003001517a3f", "testId": "PRI-05.1_A19", "test": "the authority to permit the processing of Personal Data (PD) is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-02_ODP[01]", "defaultText": null }, { "id": 73399, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591018", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591019", "securityControlId": 31857, "ccis": [], "uuid": "b32d3f08-0aa9-5ac4-ad8e-4ac8081014fc", "testId": "PRI-05.1_A20", "test": "the type of processing of Personal Data (PD) is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-02_ODP[02]", "defaultText": null }, { "id": 73400, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591019", "securityControlId": 31857, "ccis": [], "uuid": "bdcbfc6e-dc38-507a-8dcd-a0bc1e06b3dc", "testId": "PRI-05.1_A21", "test": "the type of processing of Personal Data (PD) to be restricted is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-02_ODP[03]", "defaultText": null }, { "id": 73401, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591019", "securityControlId": 31857, "ccis": [], "uuid": "81c09e2d-bbab-5d2f-9426-322d835e1ecc", "testId": "PRI-05.1_A22", "test": "the authority that permits the processing of Personal Data (PD) is determined and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-02a.", "defaultText": null }, { "id": 73402, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591019", "securityControlId": 31857, "ccis": [], "uuid": "55dda6ea-e31c-58e1-8909-7a2b9b238162", "testId": "PRI-05.1_A23", "test": "the processing of Personal Data (PD) is restricted to only that which is authorized.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-02b.", "defaultText": null }, { "id": 73403, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591019", "securityControlId": 31857, "ccis": [], "uuid": "70da2aa6-c32a-57c8-ace1-952fb90501b6", "testId": "PRI-05.1_A24", "test": "the purpose(s) for processing Personal Data (PD) is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-03_ODP[01]", "defaultText": null }, { "id": 73404, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591019", "securityControlId": 31857, "ccis": [], "uuid": "a56ef568-f1b8-5d2f-a8a1-3a3b069d1db2", "testId": "PRI-05.1_A25", "test": "the processing of Personal Data (PD) to be restricted is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-03_ODP[02]", "defaultText": null }, { "id": 73405, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591019", "securityControlId": 31857, "ccis": [], "uuid": "58194088-8185-5209-a51a-bca39a351386", "testId": "PRI-05.1_A26", "test": "mechanisms to be implemented for ensuring any changes in the processing of Personal Data (PD) are made in accordance with requirements are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-03_ODP[03]", "defaultText": null }, { "id": 73406, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591019", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591019", "securityControlId": 31857, "ccis": [], "uuid": "c19825d4-1e6a-5692-b671-5825aa963646", "testId": "PRI-05.1_A27", "test": "requirements for changing the processing of Personal Data (PD) are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-03_ODP[04]", "defaultText": null }, { "id": 73407, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59102", "securityControlId": 31857, "ccis": [], "uuid": "5b970c0d-5017-5ef3-9c43-552cb613856d", "testId": "PRI-05.1_A28", "test": "the purpose(s) for processing Personal Data (PD) is/are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-03a.", "defaultText": null }, { "id": 73408, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59102", "securityControlId": 31857, "ccis": [], "uuid": "d2b0e421-11d9-5919-bbee-fc7989526e6a", "testId": "PRI-05.1_A29", "test": "the purpose(s) is/are described in the public privacy notices of the organization.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-03b.[01]", "defaultText": null }, { "id": 73409, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59102", "securityControlId": 31857, "ccis": [], "uuid": "84bf4648-d3cd-573d-b08f-59e41d287651", "testId": "PRI-05.1_A30", "test": "the purpose(s) is/are described in the policies of the organization.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-03b.[02]", "defaultText": null }, { "id": 73410, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59102", "securityControlId": 31857, "ccis": [], "uuid": "a11c893f-4867-58b0-8cee-a4501832c2b5", "testId": "PRI-05.1_A31", "test": "the processing of Personal Data (PD) is restricted to only that which is compatible with the identified purpose(s).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-03c.", "defaultText": null }, { "id": 73411, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59102", "securityControlId": 31857, "ccis": [], "uuid": "7f241b09-2453-591b-bacd-1fbd7d98ca8c", "testId": "PRI-05.1_A32", "test": "changes in the processing of Personal Data (PD) are monitored.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-03d.[01]", "defaultText": null }, { "id": 73412, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59102", "securityControlId": 31857, "ccis": [], "uuid": "2d43ea42-e955-5ecc-aabb-eb8d6a137394", "testId": "PRI-05.1_A33", "test": "mechanisms are implemented to ensure that any changes are made in accordance with requirements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-03d.[02]", "defaultText": null } ], "externalMappings": [ { "id": 594435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588481", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2a82b3e-e63a-508f-bf78-b2bcb64c8d67", "parentControlId": 31857, "controlId": "5.33", "title": "5.33", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588481" }, { "id": 594438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48d2fb4d-4aec-57f3-9a30-1fc8b2a6593a", "parentControlId": 31857, "controlId": "DM-1", "title": "DM-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588482" }, { "id": 594439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a59a9728-7336-55c3-a9b5-ec8e6735dc62", "parentControlId": 31857, "controlId": "DM-3", "title": "DM-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588482" }, { "id": 594440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84fc3a87-fd61-5c8f-86a6-eea55982073b", "parentControlId": 31857, "controlId": "DM-3(1)", "title": "DM-3(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588482" }, { "id": 594441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df0ea343-843b-5f53-83ef-ab020ec213ca", "parentControlId": 31857, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588482" }, { "id": 594442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1df5de33-ca84-5367-b25e-d63c339c514b", "parentControlId": 31857, "controlId": "PT-02", "title": "PT-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588482" }, { "id": 594443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588482", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0a3a6fb-d129-5f02-bc33-7b0dbf328e0d", "parentControlId": 31857, "controlId": "PT-03", "title": "PT-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588482" }, { "id": 594444, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588483", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b44d5b2d-581d-58e7-a5d2-68a5fab6fb32", "parentControlId": 31857, "controlId": "SI-12(01)", "title": "SI-12(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588483" }, { "id": 594445, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588483", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4423bba1-c32a-5b38-9ae3-1da44221542a", "parentControlId": 31857, "controlId": "SI-12(02)", "title": "SI-12(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588483" }, { "id": 594451, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588483", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76178718-2f42-5a0a-a99b-a964b3c12ae0", "parentControlId": 31857, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588483" }, { "id": 594452, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588483", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38585d7f-01d9-5807-91a1-cdf4902f70b8", "parentControlId": 31857, "controlId": "PT-02", "title": "PT-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588483" }, { "id": 594453, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85cac265-5db4-5d22-b3ed-caddd6063d2d", "parentControlId": 31857, "controlId": "PT-03", "title": "PT-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588484" }, { "id": 594454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6717919-8918-5ca9-867f-50c7dadd7e77", "parentControlId": 31857, "controlId": "SI-12(01)", "title": "SI-12(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588484" }, { "id": 594455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9245f795-feae-505a-8d75-fbc37497a6bc", "parentControlId": 31857, "controlId": "SI-12(02)", "title": "SI-12(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588484" }, { "id": 594456, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef840264-e18d-5281-9d69-2d71690baaf0", "parentControlId": 31857, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588484" }, { "id": 594457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "801a049d-4ab2-5c8b-91cd-74ba2d131ba6", "parentControlId": 31857, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588484" }, { "id": 594458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e94ff8e-0902-5f69-955a-5f1989781e63", "parentControlId": 31857, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588484" }, { "id": 594459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588484", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11dd209e-321b-5eeb-96d5-8a54e893ee12", "parentControlId": 31857, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588484" } ], "id": 31857, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73127", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73127", "catalogueId": 1062, "uuid": "e01371bc-b436-5c71-a41a-9ea7031303bb", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization address the use of Personal Data (PD) for internal testing, training and research that:\n (1) Takes measures to limit or minimize the amount of PD used for internal testing, training and research purposes; and\n (2) Authorizes the use of PD when such information is required for internal testing, training and research?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Internal Use of Personal Data (PD) For Testing, Training and Research", "description": "

Control Description

Mechanisms exist to address the use of Personal Data (PD) for internal testing, training and research that:\n(1) Takes measures to limit or minimize the amount of PD used for internal testing, training and research purposes; and\n(2) Authorizes the use of PD when such information is required for internal testing, training and research.

Evidence Request List (ERL)

E-PRI-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to address the use of Personal Data (PD) for internal testing, training and research that:\n(1) Takes measures to limit or minimize the amount of PD used for internal testing, training and research purposes; and\n(2) Authorizes the use of PD when such information is required for internal testing, training and research.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-05.1", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-05.1", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73413, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591021", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591021", "securityControlId": 31858, "ccis": [], "uuid": "69ea8cbd-f7f0-57de-8a82-ca7e2b440b02", "testId": "PRI-05.2_A01", "test": "a data integrity board/function is established.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-24", "defaultText": null }, { "id": 73414, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591021", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591021", "securityControlId": 31858, "ccis": [], "uuid": "f2b6438e-003f-5b9f-a192-0447c3e2fd5c", "testId": "PRI-05.2_A02", "test": "the data integrity board/function reviews proposals to conduct or participate in a matching program.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-24a.", "defaultText": null }, { "id": 73415, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591021", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591021", "securityControlId": 31858, "ccis": [], "uuid": "af2ff6e8-4917-52c8-8b31-9763db472863", "testId": "PRI-05.2_A03", "test": "the data integrity board/function conducts an annual review of all matching programs in which the agency has participated.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-24b.", "defaultText": null } ], "externalMappings": [ { "id": 594623, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588503", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "855f834b-4933-503d-a454-b7c6733cefcd", "parentControlId": 31858, "controlId": "DI-2", "title": "DI-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588503" }, { "id": 594624, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e0e5d49-a4b3-5b5d-b680-34d0d1a090b5", "parentControlId": 31858, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588504" }, { "id": 594626, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d69f7b07-825c-5334-b6e2-86e30755bbf9", "parentControlId": 31858, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588504" }, { "id": 594627, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "139d4969-0d11-5386-9d43-b5334895cc75", "parentControlId": 31858, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588504" }, { "id": 594628, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b56adefe-6440-5c31-8419-3d16649acecb", "parentControlId": 31858, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588504" }, { "id": 594629, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ae4a8b6-bac9-56df-850e-4da1874d1f98", "parentControlId": 31858, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588504" } ], "id": 31858, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731271", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731271", "catalogueId": 1062, "uuid": "22dd76e1-617e-5388-9620-d69f50ba1f19", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure the accuracy and relevance of Personal Data (PD) throughout the information lifecycle by:\n (1) Keeping PD up-to-date; and \n (2) Remediating identified inaccuracies, as necessary?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Personal Data (PD) Accuracy & Integrity", "description": "

Control Description

Mechanisms exist to ensure the accuracy and relevance of Personal Data (PD) throughout the information lifecycle by:\n(1) Keeping PD up-to-date; and \n(2) Remediating identified inaccuracies, as necessary.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure the accuracy and relevance of Personal Data (PD) throughout the information lifecycle by:\n(1) Keeping PD up-to-date; and \n(2) Remediating identified inaccuracies, as necessary.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-05.2", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-05.2", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73416, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591021", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591021", "securityControlId": 31859, "ccis": [], "uuid": "6d6d0148-c61b-532f-aa24-1a09a9198c98", "testId": "PRI-05.3_A01", "test": "direct identifiers in a dataset are removed, masked, encrypted, hashed or replaced.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "53A_R5_SI-19(04)", "defaultText": null } ], "externalMappings": [ { "id": 594665, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588508", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f8fd174-20e3-5eec-8dcd-b0fe83d9bbef", "parentControlId": 31859, "controlId": "8.11", "title": "8.11", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588508" }, { "id": 594667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588509", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20c147c7-502e-5f1e-b022-4aa3a9cff41b", "parentControlId": 31859, "controlId": "SI-19(04)", "title": "SI-19(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588509" }, { "id": 594669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588509", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8034517-3377-54a4-b767-3ba02c983513", "parentControlId": 31859, "controlId": "SI-19(04)", "title": "SI-19(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588509" } ], "id": 31859, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731271", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731271", "catalogueId": 1062, "uuid": "31173057-ea7e-510a-adbc-06f5f8c46b24", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization mask sensitive/regulated data through data anonymization, pseudonymization, redaction or de-identification?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Data Masking", "description": "

Control Description

Mechanisms exist to mask sensitive/regulated data through data anonymization, pseudonymization, redaction or de-identification.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to mask sensitive/regulated data through data anonymization, pseudonymization, redaction or de-identification.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-05.3", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-05.3", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73417, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591022", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591022", "securityControlId": 31860, "ccis": [], "uuid": "0c1ab42a-df5c-54a1-b058-11b74b96dd28", "testId": "PRI-05.4_A01", "test": "the authority to permit the processing of Personal Data (PD) is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-02_ODP[01]", "defaultText": null }, { "id": 73418, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591022", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591022", "securityControlId": 31860, "ccis": [], "uuid": "0aaa624b-80a0-5969-9011-e6548a235921", "testId": "PRI-05.4_A02", "test": "the type of processing of Personal Data (PD) is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-02_ODP[02]", "defaultText": null }, { "id": 73419, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591022", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591022", "securityControlId": 31860, "ccis": [], "uuid": "6360bd2a-2851-5443-be6e-1545207d4899", "testId": "PRI-05.4_A03", "test": "the type of processing of Personal Data (PD) to be restricted is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-02_ODP[03]", "defaultText": null }, { "id": 73420, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591022", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591022", "securityControlId": 31860, "ccis": [], "uuid": "d134480d-80b0-5766-92f7-5ef95300dc8a", "testId": "PRI-05.4_A04", "test": "the authority that permits the processing of Personal Data (PD) is determined and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-02a.", "defaultText": null }, { "id": 73421, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591022", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591022", "securityControlId": 31860, "ccis": [], "uuid": "52f0c900-7842-5037-9cb7-8e01fe7b88b3", "testId": "PRI-05.4_A05", "test": "the processing of Personal Data (PD) is restricted to only that which is authorized.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-02b.", "defaultText": null }, { "id": 73422, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591023", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591023", "securityControlId": 31860, "ccis": [], "uuid": "96adabbf-b97f-5a33-9fc6-e527d8a4e105", "testId": "PRI-05.4_A06", "test": "processing conditions to be applied for specific categories of Personal Data (PD) are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-07_ODP", "defaultText": null }, { "id": 73423, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591023", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591023", "securityControlId": 31860, "ccis": [], "uuid": "febedbf1-c4b2-52d5-8768-880e7b53fb8e", "testId": "PRI-05.4_A07", "test": "processing conditions are applied for specific categories of Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-07", "defaultText": null }, { "id": 73424, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591023", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591023", "securityControlId": 31860, "ccis": [], "uuid": "cf35992b-1843-53e9-85ab-223ecb50558c", "testId": "PRI-05.4_A08", "test": "data mining prevention and detection techniques are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-23_ODP[01]", "defaultText": null }, { "id": 73425, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591023", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591023", "securityControlId": 31860, "ccis": [], "uuid": "c40fdf7f-60e9-5e11-8a8a-11ddb4f522d5", "testId": "PRI-05.4_A09", "test": "data storage objects to be protected against unauthorized data mining are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-23_ODP[02]", "defaultText": null }, { "id": 73426, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591024", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591024", "securityControlId": 31860, "ccis": [], "uuid": "267d5bba-6521-590b-94c1-dccca0ebb612", "testId": "PRI-05.4_A10", "test": "organization-defined techniques are employed for organization-defined data storage objects to detect and protect against unauthorized data mining.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-23", "defaultText": null }, { "id": 73427, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591024", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591024", "securityControlId": 31860, "ccis": [], "uuid": "32ec5b6a-8734-59b4-8795-1ffdee4f5311", "testId": "PRI-05.4_A11", "test": "the frequency for reviewing policies that address the use of Personal Data (PD) for internal testing, training and research is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-25_ODP[01]", "defaultText": null }, { "id": 73428, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591024", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591024", "securityControlId": 31860, "ccis": [], "uuid": "0f904cd9-3fe1-5dc2-a0e4-3ac1302e40c1", "testId": "PRI-05.4_A12", "test": "the frequency for updating policies that address the use of Personal Data (PD) for internal testing, training and research is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-25_ODP[02]", "defaultText": null }, { "id": 73429, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591024", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591024", "securityControlId": 31860, "ccis": [], "uuid": "7bc0ac65-3a84-5dc3-8aca-5b8eb238539a", "testId": "PRI-05.4_A13", "test": "the frequency for reviewing procedures that address the use of Personal Data (PD) for internal testing, training and research is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-25_ODP[03]", "defaultText": null }, { "id": 73430, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591024", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591024", "securityControlId": 31860, "ccis": [], "uuid": "5ac7e6ee-00a5-5907-a8b3-584fc31a801b", "testId": "PRI-05.4_A14", "test": "the frequency for updating procedures that address the use of Personal Data (PD) for internal testing, training and research is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-25_ODP[04]", "defaultText": null }, { "id": 73431, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591024", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591024", "securityControlId": 31860, "ccis": [], "uuid": "de2dc5af-beb2-5333-9859-1e6b16e3171c", "testId": "PRI-05.4_A15", "test": "policies that address the use of Personal Data (PD) for internal testing are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[01]", "defaultText": null }, { "id": 73432, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591025", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591025", "securityControlId": 31860, "ccis": [], "uuid": "0d5733a0-9edf-5701-a3ca-529db719e3c0", "testId": "PRI-05.4_A16", "test": "policies that address the use of Personal Data (PD) for internal training are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[02]", "defaultText": null }, { "id": 73433, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591025", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591025", "securityControlId": 31860, "ccis": [], "uuid": "edc379e4-2a06-5258-a266-27b8fd3a2610", "testId": "PRI-05.4_A17", "test": "policies that address the use of Personal Data (PD) for internal research are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[03]", "defaultText": null }, { "id": 73434, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591025", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591025", "securityControlId": 31860, "ccis": [], "uuid": "4219913e-7f57-5363-bbb0-cc990e749ac3", "testId": "PRI-05.4_A18", "test": "procedures that address the use of Personal Data (PD) for internal testing are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[04]", "defaultText": null }, { "id": 73435, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591025", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591025", "securityControlId": 31860, "ccis": [], "uuid": "ad893ebb-d054-5f3b-91de-0fe2484ecb37", "testId": "PRI-05.4_A19", "test": "procedures that address the use of Personal Data (PD) for internal training are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[05]", "defaultText": null }, { "id": 73436, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591025", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591025", "securityControlId": 31860, "ccis": [], "uuid": "daf6721c-7cb6-5741-ae64-329f887e7999", "testId": "PRI-05.4_A20", "test": "procedures that address the use of Personal Data (PD) for internal research are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[06]", "defaultText": null }, { "id": 73437, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591028", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591028", "securityControlId": 31860, "ccis": [], "uuid": "6deba1af-3881-5443-881a-4eab1451a816", "testId": "PRI-05.4_A21", "test": "policies that address the use of Personal Data (PD) for internal testing are implemented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[07]", "defaultText": null }, { "id": 73438, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591028", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591028", "securityControlId": 31860, "ccis": [], "uuid": "2f3e8115-45f2-53ee-981f-8922c63b4162", "testId": "PRI-05.4_A22", "test": "policies that address the use of Personal Data (PD) for training are implemented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[08]", "defaultText": null }, { "id": 73439, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591028", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591028", "securityControlId": 31860, "ccis": [], "uuid": "53ba631f-2114-5c9a-9dfa-2a0cc2ebafde", "testId": "PRI-05.4_A23", "test": "policies that address the use of Personal Data (PD) for research are implemented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[09]", "defaultText": null }, { "id": 73440, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591028", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591029", "securityControlId": 31860, "ccis": [], "uuid": "e6e04a26-0b49-5c57-8de6-75b1ba0cab6a", "testId": "PRI-05.4_A24", "test": "procedures that address the use of Personal Data (PD) for internal testing are implemented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[10]", "defaultText": null }, { "id": 73441, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591029", "securityControlId": 31860, "ccis": [], "uuid": "e35bd47f-a6ad-5c0e-a312-555153b35659", "testId": "PRI-05.4_A25", "test": "procedures that address the use of Personal Data (PD) for training are implemented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[11]", "defaultText": null }, { "id": 73442, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591029", "securityControlId": 31860, "ccis": [], "uuid": "6b3fc96f-cec2-5bca-a42f-58c04529cb42", "testId": "PRI-05.4_A26", "test": "procedures that address the use of Personal Data (PD) for research are implemented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25a.[12]", "defaultText": null }, { "id": 73443, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591029", "securityControlId": 31860, "ccis": [], "uuid": "3ce2194d-df11-549b-8393-f6f987a36a7d", "testId": "PRI-05.4_A27", "test": "the amount of Personal Data (PD) used for internal testing purposes is limited or minimized.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_PM-25b.[01]", "defaultText": null }, { "id": 73444, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591029", "securityControlId": 31860, "ccis": [], "uuid": "6a290588-a871-51df-b9ad-49d09ff08af1", "testId": "PRI-05.4_A28", "test": "the amount of Personal Data (PD) used for internal training purposes is limited or minimized.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_PM-25b.[02]", "defaultText": null }, { "id": 73445, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591029", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591029", "securityControlId": 31860, "ccis": [], "uuid": "b6522ac8-1982-541e-b3c5-34bc986bfa5c", "testId": "PRI-05.4_A29", "test": "the amount of Personal Data (PD) used for internal research purposes is limited or minimized.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_PM-25b.[03]", "defaultText": null }, { "id": 73446, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59103", "securityControlId": 31860, "ccis": [], "uuid": "8ff72caf-dffe-5dd6-896c-f9ca32536d4c", "testId": "PRI-05.4_A30", "test": "the required use of Personal Data (PD) for internal testing is authorized.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_PM-25c.[01]", "defaultText": null }, { "id": 73447, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59103", "securityControlId": 31860, "ccis": [], "uuid": "b685b1ea-2c1e-55e8-9ee2-54d26126c528", "testId": "PRI-05.4_A31", "test": "the required use of Personal Data (PD) for internal training is authorized.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_PM-25c.[02]", "defaultText": null }, { "id": 73448, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59103", "securityControlId": 31860, "ccis": [], "uuid": "c9f5b84b-941f-56e3-98d5-11edb74ef564", "testId": "PRI-05.4_A32", "test": "the required use of Personal Data (PD) for internal research is authorized.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_PM-25c.[03]", "defaultText": null }, { "id": 73449, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59103", "securityControlId": 31860, "ccis": [], "uuid": "6c745253-04e5-505d-bf02-0d346fbada10", "testId": "PRI-05.4_A33", "test": "policies are reviewed frequently.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25d.[01]", "defaultText": null }, { "id": 73450, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59103", "securityControlId": 31860, "ccis": [], "uuid": "5e93ee7a-6e7f-59ca-88ce-11591f967e19", "testId": "PRI-05.4_A34", "test": "policies are updated frequently.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25d.[02]", "defaultText": null }, { "id": 73451, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59103", "securityControlId": 31860, "ccis": [], "uuid": "5f6be0d3-60db-5f61-aad9-50a9131a9708", "testId": "PRI-05.4_A35", "test": "procedures are reviewed frequently.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25d.[03]", "defaultText": null }, { "id": 73452, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591031", "securityControlId": 31860, "ccis": [], "uuid": "c47f2027-cea2-565a-b3ba-a9ee39bdccaa", "testId": "PRI-05.4_A36", "test": "procedures are updated frequently.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-25d.[04]", "defaultText": null } ], "externalMappings": [ { "id": 594697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588512", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61d733d2-dd5d-5707-b002-aa49ac899080", "parentControlId": 31860, "controlId": "5.33", "title": "5.33", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588512" }, { "id": 594704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96791e0d-24f0-5d4e-ba8c-5ddb1d6a883b", "parentControlId": 31860, "controlId": "DM-3(1)", "title": "DM-3(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588513" }, { "id": 594705, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3249a5f7-311a-55cb-b1a4-846ef4deba5d", "parentControlId": 31860, "controlId": "UL-1", "title": "UL-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588513" }, { "id": 594706, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f3a77e9-1b3f-5830-98c8-07aeef035b87", "parentControlId": 31860, "controlId": "AC-23", "title": "AC-23", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588513" }, { "id": 594707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95e4a946-6c08-5651-b4eb-cdf9f0a45c19", "parentControlId": 31860, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588513" }, { "id": 594708, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a624fa57-dde6-57d8-b159-923184652a5f", "parentControlId": 31860, "controlId": "PT-02", "title": "PT-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588513" }, { "id": 594709, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588513", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d170ac3f-d20e-5931-a2c5-c01025cccdb6", "parentControlId": 31860, "controlId": "PT-07", "title": "PT-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588513" }, { "id": 594714, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588514", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "932c07bb-94f4-57e3-bcba-65d62c668c6a", "parentControlId": 31860, "controlId": "AC-23", "title": "AC-23", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588514" }, { "id": 594715, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588514", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2636dbd-e92b-524b-86d5-87df5a378c8d", "parentControlId": 31860, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588514" }, { "id": 594716, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01785a70-60b4-56d8-acee-de9ce51d22a6", "parentControlId": 31860, "controlId": "PT-02", "title": "PT-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588522" }, { "id": 594717, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad37fab3-c3a2-52dd-bb00-dfa54c51651a", "parentControlId": 31860, "controlId": "PT-07", "title": "PT-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588522" }, { "id": 594718, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd3b4437-7cf4-5829-9281-e40e72b2d8b6", "parentControlId": 31860, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588522" }, { "id": 594719, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588523", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd471f2e-2a7f-5b7d-bcd6-a6763a84bde4", "parentControlId": 31860, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588523" }, { "id": 594720, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588523", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c3557d5-027c-54bd-8645-8e5c4a9f9c00", "parentControlId": 31860, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588523" }, { "id": 594722, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588523", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fc5a485-2c61-59ab-8871-011fa2ecc45f", "parentControlId": 31860, "controlId": "AC-23", "title": "AC-23", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588523" }, { "id": 594723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588523", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b348bc7b-84ae-55ef-b5f5-fcaf955873b5", "parentControlId": 31860, "controlId": "PM-25", "title": "PM-25", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588523" }, { "id": 594724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588523", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b678146-18f8-52e1-a52d-aa78a5516e96", "parentControlId": 31860, "controlId": "AC-23", "title": "AC-23", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588523" } ], "id": 31860, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731271", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731271", "catalogueId": 1062, "uuid": "7819fb9d-b845-5cbc-95a4-068cffd2e495", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict collecting, receiving, processing, storing, transmitting, sharing and/or updating Personal Data (PD) to:\n (1) The purpose(s) originally collected, consistent with the data privacy notice(s);\n (2) What is authorized by the data subject, or authorized agent; and\n (3) What is consistent with applicable laws, regulations and contractual obligations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Usage Restrictions of Personal Data (PD)", "description": "

Control Description

Mechanisms exist to restrict collecting, receiving, processing, storing, transmitting, sharing and/or updating Personal Data (PD) to:\n(1) The purpose(s) originally collected, consistent with the data privacy notice(s);\n(2) What is authorized by the data subject, or authorized agent; and\n(3) What is consistent with applicable laws, regulations and contractual obligations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict collecting, receiving, processing, storing, transmitting, sharing and/or updating Personal Data (PD) to:\n(1) The purpose(s) originally collected, consistent with the data privacy notice(s);\n(2) What is authorized by the data subject, or authorized agent; and\n(3) What is consistent with applicable laws, regulations and contractual obligations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-05.4", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-05.4", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73453, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591031", "securityControlId": 31861, "ccis": [], "uuid": "0988d55c-cc6b-57f1-9e02-913564615bf6", "testId": "PRI-05.5_A01", "test": "the frequency at which to update the inventory of systems, applications and projects that process Personal Data (PD) is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-05(01)_ODP", "defaultText": null }, { "id": 73454, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591031", "securityControlId": 31861, "ccis": [], "uuid": "1a645169-81c0-59ce-923e-e45cd2bb889b", "testId": "PRI-05.5_A02", "test": "an inventory of all systems, applications and projects that process Personal Data (PD) is established.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-05(01)[01]", "defaultText": null }, { "id": 73455, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591031", "securityControlId": 31861, "ccis": [], "uuid": "e26b5fe7-a339-50e5-9051-d81a49df1861", "testId": "PRI-05.5_A03", "test": "an inventory of all systems, applications and projects that process Personal Data (PD) is maintained.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-05(01)[02]", "defaultText": null }, { "id": 73456, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591031", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591031", "securityControlId": 31861, "ccis": [], "uuid": "d3b7d84c-6d8e-582e-8e56-5b2c8c1e6006", "testId": "PRI-05.5_A04", "test": "an inventory of all systems, applications and projects that process Personal Data (PD) is updated frequently.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-05(01)[03]", "defaultText": null } ], "externalMappings": [ { "id": 594959, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58855", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cd5ee28-cd62-5b80-b6fc-a214624925b7", "parentControlId": 31861, "controlId": "5.9", "title": "5.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58855" }, { "id": 594964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb3bc47b-5dfe-57ee-9b79-64bdaf02268f", "parentControlId": 31861, "controlId": "SE-1", "title": "SE-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588551" }, { "id": 594965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec0c31fe-d072-596b-b3c8-67951966a5c2", "parentControlId": 31861, "controlId": "PM-05(01)", "title": "PM-05(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588551" }, { "id": 594967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62db796a-591b-5ffa-8b2a-fa481f5982a2", "parentControlId": 31861, "controlId": "PM-05(01)", "title": "PM-05(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588551" }, { "id": 594969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588552", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c2eefb0-a766-53c6-9c70-5a4bd948eaf6", "parentControlId": 31861, "controlId": "ID.AM-07", "title": "ID.AM-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588552" } ], "id": 31861, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731272", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731272", "catalogueId": 1062, "uuid": "a2c4591a-1156-5084-a95b-29bb799f2696", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish and maintain a current inventory of all Technology Assets, Applications and/or Services (TAAS)that collect, receive, process, store, transmit, share, update and/or dispose Personal Data (PD)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Inventory of Personal Data (PD)", "description": "

Control Description

Mechanisms exist to establish and maintain a current inventory of all Technology Assets, Applications and/or Services (TAAS) that collect, receive, process, store, transmit, share, update and/or dispose Personal Data (PD).

Evidence Request List (ERL)

E-AST-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to establish and maintain a current inventory of all Technology Assets, Applications and/or Services (TAAS) that collect, receive, process, store, transmit, share, update and/or dispose Personal Data (PD).

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-05.5", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-05.5", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73457, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591032", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591032", "securityControlId": 31862, "ccis": [], "uuid": "26d8264c-93f3-5fa4-9b4b-8f1660cf83dd", "testId": "PRI-05.6_A01", "test": "automated mechanisms are implemented to inventory Personal Data (PD) across the organization.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 594988, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3aa32a3d-75eb-56a5-9f42-5490cdc73bd3", "parentControlId": 31862, "controlId": "PM-05(01)", "title": "PM-05(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588554" }, { "id": 594990, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588554", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a21f93c-051f-52ee-85a4-4bf442775427", "parentControlId": 31862, "controlId": "PM-05(01)", "title": "PM-05(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588554" } ], "id": 31862, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731272", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731272", "catalogueId": 1062, "uuid": "da3d3a81-9497-54b9-93eb-511a5fa3bd9e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to determine if Personal Data (PD) is maintained in electronic form?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 1.0, "title": "Personal Data (PD) Inventory Automation Support", "description": "

Control Description

Automated mechanisms exist to determine if Personal Data (PD) is maintained in electronic form.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically determine if Personal Data (PD) is maintained in electronic form.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-05.6", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-05.6", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73458, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591032", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591032", "securityControlId": 31863, "ccis": [], "uuid": "94947215-8cdf-5ba9-abe0-847da860b94d", "testId": "PRI-05.7_A01", "test": "processing conditions to be applied for specific categories of Personal Data (PD) are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-07_ODP", "defaultText": null }, { "id": 73459, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591032", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591032", "securityControlId": 31863, "ccis": [], "uuid": "c4408c4e-173b-5028-94dc-6bc5ec6622d9", "testId": "PRI-05.7_A02", "test": "processing conditions are applied for specific categories of Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-07", "defaultText": null }, { "id": 73460, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591032", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591032", "securityControlId": 31863, "ccis": [], "uuid": "7a67fa85-2bdd-5e15-a0c1-4285d0e83e43", "testId": "PRI-05.7_A03", "test": "when a system processes Social Security numbers, the unnecessary collection, maintenance and use of Social Security numbers are eliminated.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-07(01)(a)[01]", "defaultText": null }, { "id": 73461, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591033", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591033", "securityControlId": 31863, "ccis": [], "uuid": "a2b1ed02-4acb-5e83-9921-8105089353ab", "testId": "PRI-05.7_A04", "test": "when a system processes Social Security numbers, alternatives to the use of Social Security Numbers as a personal identifier are explored.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-07(01)(a)[02]", "defaultText": null }, { "id": 73462, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591033", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591033", "securityControlId": 31863, "ccis": [], "uuid": "4e2a9d83-ee4d-538c-98b2-66a393fe621e", "testId": "PRI-05.7_A05", "test": "when a system processes Social Security numbers, individual rights, benefits or privileges provided by law are not denied because of an individual’s refusal to disclose their Social Security number.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-07(01)(b)", "defaultText": null }, { "id": 73463, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591033", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591033", "securityControlId": 31863, "ccis": [], "uuid": "e46d0dbf-c72b-568d-b6bd-645355b0658c", "testId": "PRI-05.7_A06", "test": "when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited and what uses will be made of it.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-07(01)(c)[01]", "defaultText": null }, { "id": 73464, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591033", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591033", "securityControlId": 31863, "ccis": [], "uuid": "3b7d8730-8f01-562b-a8b4-c9109d0de084", "testId": "PRI-05.7_A07", "test": "when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed by what statutory or other authority the number is solicited.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-07(01)(c)[02]", "defaultText": null }, { "id": 73465, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591034", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591034", "securityControlId": 31863, "ccis": [], "uuid": "6d5fd5f7-4ef5-5443-b6bd-cc1057141ccc", "testId": "PRI-05.7_A08", "test": "when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed what uses will be made of it.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-07(01)(c)[03]", "defaultText": null }, { "id": 73466, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591034", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591034", "securityControlId": 31863, "ccis": [], "uuid": "7d13aeab-9cb0-5cf8-b6e3-e1c953b483e4", "testId": "PRI-05.7_A09", "test": "the processing of information describing how any individual exercises rights guaranteed by the First Amendment is prohibited unless expressly authorized by statute or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PT-07(02)", "defaultText": null } ], "externalMappings": [ { "id": 595003, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca6717ca-1afa-55ff-b914-9566ec1472d1", "parentControlId": 31863, "controlId": "PT-07", "title": "PT-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588556" }, { "id": 595004, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5bf7dba8-24c0-5763-a25d-da51bae79ea6", "parentControlId": 31863, "controlId": "PT-07(01)", "title": "PT-07(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588556" }, { "id": 595005, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "718ae4ae-3a44-5a06-9315-506722f6f0d7", "parentControlId": 31863, "controlId": "PT-07(02)", "title": "PT-07(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588556" }, { "id": 595009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c047043b-253d-56c4-9e97-5a4eaa11e71d", "parentControlId": 31863, "controlId": "PT-07", "title": "PT-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588556" }, { "id": 595010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6aa033fd-1d12-5716-b358-e2a0933de071", "parentControlId": 31863, "controlId": "PT-07(01)", "title": "PT-07(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588556" }, { "id": 595011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9aeaf5aa-71a7-5e71-8c23-5798bd4290f9", "parentControlId": 31863, "controlId": "PT-07(02)", "title": "PT-07(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588557" } ], "id": 31863, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731273", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731273", "catalogueId": 1062, "uuid": "b1ed91c6-d642-5a7a-a76f-98fefb69632a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define and implement data handling and protection requirements for specific categories of sensitive Personal Data (PD)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Personal Data (PD) Categories", "description": "

Control Description

Mechanisms exist to define and implement data handling and protection requirements for specific categories of sensitive Personal Data (PD).

Evidence Request List (ERL)

E-PRI-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to define and implement data handling and protection requirements for specific categories of sensitive Personal Data (PD).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-05.7", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-05.7", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73470, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591035", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591035", "securityControlId": 31865, "ccis": [], "uuid": "dd6ab812-fe52-55c4-9c27-6408c7bf3dc9", "testId": "PRI-06_A01", "test": "mechanisms enabling individuals to have access to elements of their Personal Data (PD) are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-03(14)_ODP[01]", "defaultText": null }, { "id": 73471, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591035", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591035", "securityControlId": 31865, "ccis": [], "uuid": "c9111611-88a0-51d6-9f00-727b5773e271", "testId": "PRI-06_A02", "test": "elements of Personal Data (PD) to which individuals have access are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-03(14)_ODP[02]", "defaultText": null }, { "id": 73472, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591035", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591035", "securityControlId": 31865, "ccis": [], "uuid": "ed8a6c09-5ffb-59f7-91c7-11eb7780cd49", "testId": "PRI-06_A03", "test": "organization-defined mechanisms are provided to enable individuals to have access to organization-defined elements of their Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-03(14)", "defaultText": null } ], "externalMappings": [ { "id": 595061, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b5e94f7-4315-566e-890b-fcf19feefb89", "parentControlId": 31865, "controlId": "IP-2", "title": "IP-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588571" }, { "id": 595062, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6239c783-8556-5f6f-91d9-9f1e5f18dac8", "parentControlId": 31865, "controlId": "AC-03(14)", "title": "AC-03(14)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588571" }, { "id": 595063, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f102660-6958-58d9-8e4e-4b9e8487cc39", "parentControlId": 31865, "controlId": "SI-18(04)", "title": "SI-18(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588571" }, { "id": 595066, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96863513-b6e8-5714-9924-4611a2dab0c3", "parentControlId": 31865, "controlId": "AC-03(14)", "title": "AC-03(14)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588571" }, { "id": 595067, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbeed536-5c76-5ed1-80b4-8688dbb678fe", "parentControlId": 31865, "controlId": "SI-18(04)", "title": "SI-18(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588571" } ], "id": 31865, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731273", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731273", "catalogueId": 1062, "uuid": "17d766ca-07c4-5fac-bd44-ecb636b72b10", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide authenticated data subjects the ability to:\n (1) Access their Personal Data (PD) that is being processed, stored and shared, except where the burden, risk or expense of providing access would be disproportionate to the benefit offered to the data subject through granting access;\n (2) Obtain answers on the specifics of how their PD is collected, received, processed, stored, transmitted, shared, updated and/or disposed; \n (3) Obtain the source(s) of their PD; \n (4) Obtain the categories of their PD being collected, received, processed, stored and shared; \n (5) Request correction to their PD due to inaccuracies;\n (6) Request erasure of their PD; and\n (7) Restrict the further collecting, receiving, processing, storing, transmitting, updated and/or sharing of their PD?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Data Subject Empowerment", "description": "

Control Description

Mechanisms exist to provide authenticated data subjects the ability to:\n(1) Access their Personal Data (PD) that is being processed, stored and shared, except where the burden, risk or expense of providing access would be disproportionate to the benefit offered to the data subject through granting access;\n(2) Obtain answers on the specifics of how their PD is collected, received, processed, stored, transmitted, shared, updated and/or disposed; \n(3) Obtain the source(s) of their PD; \n(4) Obtain the categories of their PD being collected, received, processed, stored and shared; \n(5) Request correction to their PD due to inaccuracies;\n(6) Request erasure of their PD; and\n(7) Restrict the further collecting, receiving, processing, storing, transmitting, updated and/or sharing of their PD.

Evidence Request List (ERL)

E-PRI-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide authenticated data subjects the ability to:\n(1) Access their Personal Data (PD) that is being processed, stored and shared, except where the burden, risk or expense of providing access would be disproportionate to the benefit offered to the data subject through granting access;\n(2) Obtain answers on the specifics of how their PD is collected, received, processed, stored, transmitted, shared, updated and/or disposed; \n(3) Obtain the source(s) of their PD; \n(4) Obtain the categories of their PD being collected, received, processed, stored and shared; \n(5) Request correction to their PD due to inaccuracies;\n(6) Request erasure of their PD; and\n(7) Restrict the further collecting, receiving, processing, storing, transmitting, updated and/or sharing of their PD.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-06", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-06", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73473, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591035", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591035", "securityControlId": 31866, "ccis": [], "uuid": "ccd9c1d2-66f3-5d81-bb7e-8588ff56d7f5", "testId": "PRI-06.1_A01", "test": "recipients of Personal Data (PD) to be notified when the Personal Data (PD) has been corrected or deleted are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-18(05)_ODP", "defaultText": null }, { "id": 73474, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591035", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591035", "securityControlId": 31866, "ccis": [], "uuid": "6a78747e-c7a8-5d19-b254-5fde125bb364", "testId": "PRI-06.1_A02", "test": "recipients and individuals are notified when the Personal Data (PD) has been corrected or deleted.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-18(05)", "defaultText": null } ], "externalMappings": [ { "id": 595326, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41ae931a-49df-591a-947a-74746e73a759", "parentControlId": 31866, "controlId": "IP-3", "title": "IP-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588601" }, { "id": 595327, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21d8a0dc-503e-5c67-b27a-afcc04f45aaa", "parentControlId": 31866, "controlId": "SI-18(04)", "title": "SI-18(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588601" }, { "id": 595328, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56a75cb9-e9ae-59e4-a032-f5105fe260fa", "parentControlId": 31866, "controlId": "SI-18(05)", "title": "SI-18(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588601" }, { "id": 595331, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "174950e1-794b-543a-b26d-6c10d8dd9cad", "parentControlId": 31866, "controlId": "SI-18(04)", "title": "SI-18(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588602" }, { "id": 595332, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03e8c4cb-4216-5c18-b5f1-b8218dfed615", "parentControlId": 31866, "controlId": "SI-18(05)", "title": "SI-18(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588602" } ], "id": 31866, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731273", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731274", "catalogueId": 1062, "uuid": "dd51545e-8472-5622-838b-c8eab3652741", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain a process for:\n (1) Data subjects to have inaccurate Personal Data (PD) maintained by the organization corrected or amended; and\n (2) Disseminating corrections or amendments of PD to other authorized users of the PD?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Correcting Inaccurate Personal Data (PD)", "description": "

Control Description

Mechanisms exist to maintain a process for:\n(1) Data subjects to have inaccurate Personal Data (PD) maintained by the organization corrected or amended; and\n(2) Disseminating corrections or amendments of PD to other authorized users of the PD.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain a process for:\n(1) Data subjects to have inaccurate Personal Data (PD) maintained by the organization corrected or amended; and\n(2) Disseminating corrections or amendments of PD to other authorized users of the PD.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-06.1", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-06.1", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73475, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591036", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591036", "securityControlId": 31867, "ccis": [], "uuid": "fd37a49c-2354-565a-a1b3-68e5ca8a3ffc", "testId": "PRI-06.2_A01", "test": "recipients of Personal Data (PD) to be notified when the Personal Data (PD) has been corrected or deleted are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-18(05)_ODP", "defaultText": null }, { "id": 73476, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591036", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591036", "securityControlId": 31867, "ccis": [], "uuid": "a0a3587d-ba6b-5de2-a9bb-0571a6b5a01c", "testId": "PRI-06.2_A02", "test": "recipients and individuals are notified when the Personal Data (PD) has been corrected or deleted.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-18(05)", "defaultText": null } ], "externalMappings": [ { "id": 595440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d3c65c7-8d6e-57f0-ad87-643917f1b5ed", "parentControlId": 31867, "controlId": "SI-18(05)", "title": "SI-18(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588622" }, { "id": 595442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34398877-8ecb-596c-80b4-a99f598cada3", "parentControlId": 31867, "controlId": "SI-18(05)", "title": "SI-18(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588623" } ], "id": 31867, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731274", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731274", "catalogueId": 1062, "uuid": "3523baca-8e4a-5283-9df3-44cddc84e68a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization notify affected data subjects if their Personal Data (PD) has been corrected, amended or deleted?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Notice of Correction or Processing Change", "description": "

Control Description

Mechanisms exist to notify affected data subjects if their Personal Data (PD) has been corrected, amended or deleted.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to notify affected data subjects if their Personal Data (PD) has been corrected, amended or deleted.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-06.2", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-06.2", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73477, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591036", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591036", "securityControlId": 31868, "ccis": [], "uuid": "a3af4421-bd55-5b2a-8232-e821622b940b", "testId": "PRI-06.3_A01", "test": "a process for receiving & acknowledging complaints, concerns or questions from individuals about organizational cybersecurity / data privacy practices is implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-26[01]", "defaultText": null }, { "id": 73478, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591036", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591036", "securityControlId": 31868, "ccis": [], "uuid": "408917f9-015e-594e-8cf1-3370ef517144", "testId": "PRI-06.3_A02", "test": "a process for responding to complaints, concerns or questions from individuals about organizational cybersecurity / data privacy practices is implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-26[02]", "defaultText": null }, { "id": 73479, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591037", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591037", "securityControlId": 31868, "ccis": [], "uuid": "ecba3f8d-a1d2-507d-b66f-8a8ef741e215", "testId": "PRI-06.3_A03", "test": "the time period in which complaints (including concerns or questions) from individuals are to be reviewed and acknowledging is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-26_ODP[01]\n53A_R5_PM-26_ODP[03]", "defaultText": null }, { "id": 73480, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591037", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591037", "securityControlId": 31868, "ccis": [], "uuid": "bd4263a5-e57c-53c9-a921-692c0ade3b53", "testId": "PRI-06.3_A04", "test": "the time period in which complaints (including concerns or questions) from individuals are to be addressed is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-26_ODP[02]\n53A_R5_PM-26_ODP[04]", "defaultText": null }, { "id": 73481, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591037", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591037", "securityControlId": 31868, "ccis": [], "uuid": "bc7de5c6-3fa3-5861-a02e-109822e480b0", "testId": "PRI-06.3_A05", "test": "the complaint management process includes mechanisms that are easy to use by the public.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-26a.[01]", "defaultText": null }, { "id": 73482, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591037", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591037", "securityControlId": 31868, "ccis": [], "uuid": "a8240632-9e7f-5ac6-80cc-09b1a5d337f8", "testId": "PRI-06.3_A06", "test": "the complaint management process includes mechanisms that are readily accessible by the public.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-26a.[02]", "defaultText": null }, { "id": 73483, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591037", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591037", "securityControlId": 31868, "ccis": [], "uuid": "d1dc1e58-adfa-50fc-adf3-f83a232272e4", "testId": "PRI-06.3_A07", "test": "the complaint management process includes all information necessary for successfully filing complaints.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-26b.", "defaultText": null }, { "id": 73484, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591037", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591037", "securityControlId": 31868, "ccis": [], "uuid": "a3acd589-ad7c-5a88-bfd4-80cf2946f441", "testId": "PRI-06.3_A08", "test": "the complaint management process includes tracking mechanisms to ensure that all complaints are reviewed within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-26c.[01]", "defaultText": null }, { "id": 73485, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591038", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591038", "securityControlId": 31868, "ccis": [], "uuid": "3e602179-d32d-57e7-95d6-46c3be001551", "testId": "PRI-06.3_A09", "test": "the complaint management process includes tracking mechanisms to ensure that all complaints are addressed within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-26c.[02]", "defaultText": null }, { "id": 73486, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591038", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591038", "securityControlId": 31868, "ccis": [], "uuid": "87902678-bbd5-5775-92f8-ac9b874dbe22", "testId": "PRI-06.3_A10", "test": "the complaint management process includes acknowledging the receipt of complaints, concerns or questions from individuals within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-26d.", "defaultText": null }, { "id": 73487, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591052", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591052", "securityControlId": 31868, "ccis": [], "uuid": "c3572b9e-049f-5339-8148-9168e5e6e8ac", "testId": "PRI-06.3_A11", "test": "the complaint management process includes responding to complaints, concerns or questions from individuals within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-26e.", "defaultText": null } ], "externalMappings": [ { "id": 595502, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58863", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7284896b-f874-57f6-a92f-c653fb7efd14", "parentControlId": 31868, "controlId": "PM-26", "title": "PM-26", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58863" }, { "id": 595504, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58863", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7853e6c8-b844-5804-9546-00b276112027", "parentControlId": 31868, "controlId": "PM-26", "title": "PM-26", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58863" }, { "id": 595505, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58863", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31924f80-3992-527e-bb3e-f5aa4217f150", "parentControlId": 31868, "controlId": "PM-26", "title": "PM-26", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58863" }, { "id": 595506, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58863", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aee32901-3d35-564d-8bf6-dc6d8e69df9b", "parentControlId": 31868, "controlId": "PM-26", "title": "PM-26", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58863" }, { "id": 595507, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58863", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19b39dfe-cf6a-5d6b-a982-b44578dd811d", "parentControlId": 31868, "controlId": "PM-26", "title": "PM-26", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58863" }, { "id": 595508, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58863", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1bc7bd9-e8fd-5fce-890e-a84a3edf8c1c", "parentControlId": 31868, "controlId": "PM-26", "title": "PM-26", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58863" } ], "id": 31868, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731274", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731274", "catalogueId": 1062, "uuid": "325f3540-56fb-5684-aa31-621928645548", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain a process for data subjects to appeal an adverse decision?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Appeal Adverse Decision", "description": "

Control Description

Mechanisms exist to maintain a process for data subjects to appeal an adverse decision.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain a process for data subjects to appeal an adverse decision.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-06.3", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-06.3", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73488, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591052", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591052", "securityControlId": 31869, "ccis": [], "uuid": "dae2ef1b-4676-5e94-9e9c-0cec7fce413a", "testId": "PRI-06.4_A01", "test": "the time period in which complaints (including concerns or questions) from individuals are to be reviewed and acknowledging is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-26_ODP[01]", "defaultText": null }, { "id": 73489, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591053", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591053", "securityControlId": 31869, "ccis": [], "uuid": "e05754c6-005c-565f-b9ed-0303eb722f9e", "testId": "PRI-06.4_A02", "test": "the time period in which complaints (including concerns or questions) from individuals are to be addressed is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-26_ODP[02]", "defaultText": null }, { "id": 73490, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591053", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591053", "securityControlId": 31869, "ccis": [], "uuid": "73529bf9-31a3-5b16-9f5e-362ea06a636b", "testId": "PRI-06.4_A03", "test": "the time period for acknowledging the receipt of complaints is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-26_ODP[03]", "defaultText": null }, { "id": 73491, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591053", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591053", "securityControlId": 31869, "ccis": [], "uuid": "f431182c-3c26-580a-8f61-2b43e592513d", "testId": "PRI-06.4_A04", "test": "the time period for responding to complaints is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-26_ODP[04]", "defaultText": null }, { "id": 73492, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591053", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591053", "securityControlId": 31869, "ccis": [], "uuid": "96b97121-3f8b-5003-acb4-100bf6f83ce3", "testId": "PRI-06.4_A05", "test": "a process for receiving & acknowledging complaints, concerns or questions from individuals about organizational cybersecurity / data privacy practices is implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-26[01]", "defaultText": null }, { "id": 73493, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591053", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591053", "securityControlId": 31869, "ccis": [], "uuid": "11ebb8ec-127d-5a20-9b98-8bd469d888e8", "testId": "PRI-06.4_A06", "test": "a process for responding to complaints, concerns or questions from individuals about organizational cybersecurity / data privacy practices is implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-26[02]", "defaultText": null }, { "id": 73494, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591054", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591054", "securityControlId": 31869, "ccis": [], "uuid": "aa4f88db-6c43-580b-bfb0-a0b857dc4f68", "testId": "PRI-06.4_A07", "test": "the complaint management process includes mechanisms that are easy to use by the public.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-26a.[01]", "defaultText": null }, { "id": 73495, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591054", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591054", "securityControlId": 31869, "ccis": [], "uuid": "1711f478-f755-59e8-af18-4e28f43b6589", "testId": "PRI-06.4_A08", "test": "the complaint management process includes mechanisms that are readily accessible by the public.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-26a.[02]", "defaultText": null }, { "id": 73496, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591054", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591054", "securityControlId": 31869, "ccis": [], "uuid": "2bd5f90f-b76a-5242-ae31-14f3e9a888e9", "testId": "PRI-06.4_A09", "test": "the complaint management process includes all information necessary for successfully filing complaints.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-26b.", "defaultText": null }, { "id": 73497, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591054", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591054", "securityControlId": 31869, "ccis": [], "uuid": "190d6c6b-73d5-5081-a5e7-88852bd13050", "testId": "PRI-06.4_A10", "test": "the complaint management process includes tracking mechanisms to ensure that all complaints are reviewed within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-26c.[01]", "defaultText": null }, { "id": 73498, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591054", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591054", "securityControlId": 31869, "ccis": [], "uuid": "9028dff1-e055-5e0e-a78f-3f09c4f3897b", "testId": "PRI-06.4_A11", "test": "the complaint management process includes tracking mechanisms to ensure that all complaints are addressed within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-26c.[02]", "defaultText": null }, { "id": 73499, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591055", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591055", "securityControlId": 31869, "ccis": [], "uuid": "4df0fce1-e009-5e91-be9e-7c7d7d7949ac", "testId": "PRI-06.4_A12", "test": "the complaint management process includes acknowledging the receipt of complaints, concerns or questions from individuals within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-26d.", "defaultText": null }, { "id": 73500, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591055", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591055", "securityControlId": 31869, "ccis": [], "uuid": "462960c1-a568-5246-a8a7-26bc22d1f8b2", "testId": "PRI-06.4_A13", "test": "the complaint management process includes responding to complaints, concerns or questions from individuals within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-26e.", "defaultText": null } ], "externalMappings": [ { "id": 595578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "636a309e-9f55-5e20-b813-cb85c7c65322", "parentControlId": 31869, "controlId": "IP-4", "title": "IP-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588638" }, { "id": 595579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "441847f1-a7d0-55f3-8609-e015bd38f789", "parentControlId": 31869, "controlId": "IP-4(1)", "title": "IP-4(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588639" }, { "id": 595580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84b5a6ef-aef6-5870-ad45-299677acfae2", "parentControlId": 31869, "controlId": "PM-26", "title": "PM-26", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588639" }, { "id": 595582, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8cb6afdf-3c08-5659-842d-eb826e02b59f", "parentControlId": 31869, "controlId": "PM-26", "title": "PM-26", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588639" }, { "id": 595583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ea44065-59fa-5ff3-aa29-4f0bc915ee95", "parentControlId": 31869, "controlId": "PM-26", "title": "PM-26", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588639" }, { "id": 595584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d1b17e0-54c8-5b54-a175-0888f53ff616", "parentControlId": 31869, "controlId": "PM-26", "title": "PM-26", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588639" }, { "id": 595585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "858d716f-05f4-5bd4-8ed8-86aa040a255a", "parentControlId": 31869, "controlId": "PM-26", "title": "PM-26", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588639" }, { "id": 595586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6477a8ba-9e6e-5c37-97b7-cc3709c9f024", "parentControlId": 31869, "controlId": "PM-26", "title": "PM-26", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588639" } ], "id": 31869, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731274", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731275", "catalogueId": 1062, "uuid": "0804b0c1-889f-53bf-86eb-bf65e34c04c0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain a process to efficiently and effectively respond to requests, complaints, concerns or questions from authenticated data subjects about Personal Data (PD) the organization collects, receives, processes, stores, transmits, shares, updates and/or disposes?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 5.0, "title": "User Feedback Management", "description": "

Control Description

Mechanisms exist to maintain a process to efficiently and effectively respond to requests, complaints, concerns or questions from authenticated data subjects about Personal Data (PD) the organization collects, receives, processes, stores, transmits, shares, updates and/or disposes.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain a process to efficiently and effectively respond to requests, complaints, concerns or questions from authenticated data subjects about Personal Data (PD) the organization collects, receives, processes, stores, transmits, shares, updates and/or disposes.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-06.4", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-06.4", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73507, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591057", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591057", "securityControlId": 31874, "ccis": [], "uuid": "678f732c-d5f9-5efd-bf9b-539ae73fbd5e", "testId": "PRI-07_A01", "test": "information-sharing circumstances where user discretion is required to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-21_ODP[01]", "defaultText": null }, { "id": 73508, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591058", "securityControlId": 31874, "ccis": [], "uuid": "3ee3aa7f-5a2c-53b6-b5b3-d168a3eca966", "testId": "PRI-07_A02", "test": "authorized users are enabled to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for information-sharing circumstances.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_AC-21a.", "defaultText": null }, { "id": 73509, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591058", "securityControlId": 31874, "ccis": [], "uuid": "189261a1-bd5a-5355-be43-200fc7f79ab3", "testId": "PRI-07_A03", "test": "automated mechanisms or manual processes that assist users in making information-sharing and collaboration decisions are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-21_ODP[02]", "defaultText": null }, { "id": 73510, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591058", "securityControlId": 31874, "ccis": [], "uuid": "55461b04-2354-54f6-92f5-44c7d5455970", "testId": "PRI-07_A04", "test": "automated mechanisms are employed to assist users in making information-sharing and collaboration decisions.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-21b.", "defaultText": null } ], "externalMappings": [ { "id": 596000, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "634e8882-9b55-57fc-8df0-cad781596070", "parentControlId": 31874, "controlId": "5.33", "title": "5.33", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588707" }, { "id": 596005, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588708", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75d60963-571a-5ed0-955c-79b27f32d711", "parentControlId": 31874, "controlId": "UL-2", "title": "UL-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588708" }, { "id": 596006, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588708", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56125b4e-288a-5091-bb00-fb0bc3193488", "parentControlId": 31874, "controlId": "AC-21", "title": "AC-21", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588708" }, { "id": 596008, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588708", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ddb9209-9115-5e33-ad58-4266fc28746e", "parentControlId": 31874, "controlId": "AC-21", "title": "AC-21", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588708" }, { "id": 596009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588708", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2546b81f-b1c1-5266-bd13-9c4940110e03", "parentControlId": 31874, "controlId": "AC-21", "title": "AC-21", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588708" }, { "id": 596010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588708", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c1e7169-8938-5760-b18f-89bd621eec19", "parentControlId": 31874, "controlId": "AC-21", "title": "AC-21", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588708" }, { "id": 596011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588708", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "513bbdbf-a1ec-56e6-8349-63ccb6df7719", "parentControlId": 31874, "controlId": "AC-21", "title": "AC-21", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588708" }, { "id": 596012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588708", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39628773-1d00-5053-a438-a7cdebbad373", "parentControlId": 31874, "controlId": "AC-21", "title": "AC-21", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588708" } ], "id": 31874, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731276", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731276", "catalogueId": 1062, "uuid": "27013d41-d049-5f0d-b584-eec6b7909b8a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization disclose Personal Data (PD) to third-parties only for the purposes identified in the data privacy notice and with the implicit or explicit consent of the data subject?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Information Sharing With Third Parties", "description": "

Control Description

Mechanisms exist to disclose Personal Data (PD) to third-parties only for the purposes identified in the data privacy notice and with the implicit or explicit consent of the data subject.

Evidence Request List (ERL)

E-PRI-05\nE-TPM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to disclose Personal Data (PD) to third-parties only for the purposes identified in the data privacy notice and with the implicit or explicit consent of the data subject.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-07", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-07", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73511, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591058", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591058", "securityControlId": 31875, "ccis": [], "uuid": "a324ab8c-7391-5423-a2b8-2e07a49d874f", "testId": "PRI-07.1_A01", "test": "includes privacy requirements in contracts and other acquisition-related documents that establish privacy roles and responsibilities for contractors and service providers.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 596145, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588728", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd340fe4-a2eb-53f1-b692-4f156b7b4430", "parentControlId": 31875, "controlId": "5.31", "title": "5.31", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588728" }, { "id": 596146, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588728", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b6b563d-618e-58ab-a8b0-41435428387a", "parentControlId": 31875, "controlId": "5.33", "title": "5.33", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588728" }, { "id": 596153, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588729", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0fc4a2ae-42d1-50a7-838f-11f8e49fe82c", "parentControlId": 31875, "controlId": "AR-3", "title": "AR-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588729" }, { "id": 596155, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588729", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0fa2f14d-5eba-5d4d-a241-bb50bc3d6413", "parentControlId": 31875, "controlId": "GV.SC-05", "title": "GV.SC-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588729" } ], "id": 31875, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731276", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731276", "catalogueId": 1062, "uuid": "1c197edd-4ff1-5bd9-9522-f962920b9fdd", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization include data privacy requirements in contracts and other acquisition-related documents that establish data privacy roles and responsibilities for contractors and service providers?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Data Privacy Requirements for Contractors & Service Providers", "description": "

Control Description

Mechanisms exist to include data privacy requirements in contracts and other acquisition-related documents that establish data privacy roles and responsibilities for contractors and service providers.

Evidence Request List (ERL)

E-PRI-05\nE-TPM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to include data privacy requirements in contracts and other acquisition-related documents that establish data privacy roles and responsibilities for contractors and service providers.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-07.1", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-07.1", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73519, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591061", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591061", "securityControlId": 31880, "ccis": [], "uuid": "1c8a57b4-a76b-530c-8cec-c61d63dc85b6", "testId": "PRI-08_A01", "test": "a process is implemented for ensuring that organizational plans for conducting cybersecurity / data privacy testing, training and monitoring activities associated with organizational systems are developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-14a.01[01]\n53A_R5_PM-14a.01[03]", "defaultText": null }, { "id": 73520, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591061", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591061", "securityControlId": 31880, "ccis": [], "uuid": "402b2490-ad10-524a-9158-eeac7ed32957", "testId": "PRI-08_A02", "test": "a process is implemented for ensuring that organizational plans for conducting cybersecurity / data privacy testing, training and monitoring activities associated with organizational systems are maintained.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-14a.01[02]\n53A_R5_PM-14a.01[04]", "defaultText": null }, { "id": 73521, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591061", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591061", "securityControlId": 31880, "ccis": [], "uuid": "56abcf77-cfad-5153-a1e7-b1b259356760", "testId": "PRI-08_A03", "test": "a process is implemented for ensuring that organizational plans for conducting cybersecurity / data privacy testing, training and monitoring activities associated with organizational systems continue to be executed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-14a.02[01]\n53A_R5_PM-14a.02[02]", "defaultText": null }, { "id": 73522, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591061", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591061", "securityControlId": 31880, "ccis": [], "uuid": "a3464c19-d004-5487-a96d-09ee042afe13", "testId": "PRI-08_A04", "test": "testing plans are reviewed for consistency with the organizational risk management strategy.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-14b.[01]", "defaultText": null }, { "id": 73523, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591061", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591061", "securityControlId": 31880, "ccis": [], "uuid": "3cbdee7a-bb13-5b41-a988-2ef3c754c779", "testId": "PRI-08_A05", "test": "training plans are reviewed for consistency with the organizational risk management strategy.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-14b.[02]", "defaultText": null }, { "id": 73524, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591061", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591062", "securityControlId": 31880, "ccis": [], "uuid": "9f920506-dee6-5199-aeb0-b7375b40e22f", "testId": "PRI-08_A06", "test": "monitoring plans are reviewed for consistency with the organizational risk management strategy.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-14b.[03]", "defaultText": null }, { "id": 73525, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591062", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591062", "securityControlId": 31880, "ccis": [], "uuid": "10cd6bfb-6eb4-53dd-a07a-12176b65f623", "testId": "PRI-08_A07", "test": "testing plans are reviewed for consistency with organization-wide priorities for risk response actions.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-14b.[04]", "defaultText": null }, { "id": 73526, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591062", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591062", "securityControlId": 31880, "ccis": [], "uuid": "3e555887-d0a5-5a7b-8763-8979c2ad5893", "testId": "PRI-08_A08", "test": "training plans are reviewed for consistency with organization-wide priorities for risk response actions.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-14b.[05]", "defaultText": null }, { "id": 73527, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591062", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591062", "securityControlId": 31880, "ccis": [], "uuid": "38f2678e-3d9f-549e-b4ae-66df0c7a4de8", "testId": "PRI-08_A09", "test": "monitoring plans are reviewed for consistency with organization-wide priorities for risk response actions.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-14b.[06]", "defaultText": null } ], "externalMappings": [ { "id": 596501, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588782", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11bd0a07-b6a9-5bf9-8298-d75505dc25e5", "parentControlId": 31880, "controlId": "5.36", "title": "5.36", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588782" }, { "id": 596502, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588782", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01c82bf6-e47e-5e35-b3ec-2b6aee74eded", "parentControlId": 31880, "controlId": "8.8", "title": "8.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588782" }, { "id": 596506, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588783", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a2b49e7-ecea-5df0-b93c-b4272d32c030", "parentControlId": 31880, "controlId": "AR-4", "title": "AR-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588783" }, { "id": 596507, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588783", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17a535c1-804c-597b-8397-c82a43b5a0d2", "parentControlId": 31880, "controlId": "PM-14", "title": "PM-14", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588783" }, { "id": 596509, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588783", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d491cf7-4406-55a3-91e8-00f00362125b", "parentControlId": 31880, "controlId": "PM-14", "title": "PM-14", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588783" }, { "id": 596510, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588783", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ae94d2b-26d2-5223-a16e-bb8a5b4bf2d5", "parentControlId": 31880, "controlId": "PM-14", "title": "PM-14", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588783" }, { "id": 596511, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588783", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15df61e5-a232-53ef-92bd-5709b589e03c", "parentControlId": 31880, "controlId": "PM-14", "title": "PM-14", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588783" }, { "id": 596512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588783", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91feda1f-388f-5602-b8a3-816a99f13cf3", "parentControlId": 31880, "controlId": "PM-14", "title": "PM-14", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588783" }, { "id": 596513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588783", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "496b4e75-5236-5679-97bd-37c5f9956ec9", "parentControlId": 31880, "controlId": "PM-14", "title": "PM-14", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588783" }, { "controlId": "C.13.3", "title": "C.13.3 — Corrective Action Program", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-5, IR-4, PM-14", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "4080370d-9ae4-563e-b79a-ac1f14132f49", "isPublic": true }, { "controlId": "NEI 08-09 App E.13.3 (CAP)", "title": "NEI 08-09 App E.13.3 (CAP) — Corrective Action Program", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.13.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "7e6eda7e-2164-56fc-ac9d-67cc53d9ac89", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3), 73.55(b)(10)", "title": "10 CFR 73.54(d)(3), 73.55(b)(10) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.13.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "8ab246f8-1bde-56ee-9766-b8648a275516", "isPublic": true } ], "id": 31880, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731278", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731278", "catalogueId": 1062, "uuid": "5f995492-f16c-5634-b00e-6b1383f6e077", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct testing, training and monitoring activities for Personal Data (PD) controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Personal Data (PD) Control Testing, Training & Monitoring", "description": "

Control Description

Mechanisms exist to conduct testing, training and monitoring activities for Personal Data (PD) controls.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conduct testing, training and monitoring activities for Personal Data (PD) controls.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.13.3", "controlId": "PRI-08", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-08", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73528, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591062", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591062", "securityControlId": 31881, "ccis": [], "uuid": "9d2746c1-7118-55fb-81cf-25453ea5015f", "testId": "PRI-09_A01", "test": "records of data disclosures and sharing are maintained.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73529, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591062", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591062", "securityControlId": 31881, "ccis": [], "uuid": "40303a07-2072-5381-abad-75ba46e3a0c9", "testId": "PRI-09_A02", "test": "records of data disclosures and sharing can be accessed for review or transmission/disclosure.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73530, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591063", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591063", "securityControlId": 31881, "ccis": [], "uuid": "29531047-e89d-50d0-9b84-88f4a154f95d", "testId": "PRI-09_A03", "test": "records of data provenance and lineage are maintained
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73531, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591063", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591063", "securityControlId": 31881, "ccis": [], "uuid": "79c79705-8124-57ad-8bf8-8c07ecdf4308", "testId": "PRI-09_A04", "test": "records of data provenance and lineage can be accessed for review or transmission/disclosure.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 596535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588786", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66357e02-d9ca-578f-804c-f061b55e488b", "parentControlId": 31881, "controlId": "SA-04(12)", "title": "SA-04(12)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588786" }, { "id": 596537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588786", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d5374b7-8f06-510c-bb35-ab97a4bbd948", "parentControlId": 31881, "controlId": "SA-04(12)", "title": "SA-04(12)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588786" }, { "id": 596538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588786", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29517422-c70b-59cf-a352-d082bbc279da", "parentControlId": 31881, "controlId": "SA-04(12)", "title": "SA-04(12)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588786" }, { "id": 596539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588786", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6febdeee-2590-5775-892e-122f7189a30f", "parentControlId": 31881, "controlId": "SA-04(12)", "title": "SA-04(12)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588786" }, { "id": 596540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588787", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56cc7c8e-9f33-5cb3-851f-1b02897bd352", "parentControlId": 31881, "controlId": "SA-04(12)", "title": "SA-04(12)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588787" } ], "id": 31881, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731278", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731278", "catalogueId": 1062, "uuid": "7ce71236-9d02-53d5-9937-9b12061354a4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization document the lineage of Personal Data (PD) by recording how the organization collects, receives, processes, stores, transmits, shares, updates and/or disposes PD?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Personal Data (PD) Lineage", "description": "

Control Description

Mechanisms exist to maintain a process to document the lineage of Personal Data (PD) by recording how the organization collects, receives, processes, stores, transmits, shares, updates and/or disposes PD.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain a process to document the lineage of Personal Data (PD) by recording how the organization collects, receives, processes, stores, transmits, shares, updates and/or disposes PD.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-09", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-09", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73532, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591063", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591063", "securityControlId": 31882, "ccis": [], "uuid": "4391a2fe-29a6-5cb2-b611-e6bfe8ab4a1a", "testId": "PRI-10_A01", "test": "the responsibilities of the organization's data governance body are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-23_ODP[02]", "defaultText": null }, { "id": 73533, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591063", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591063", "securityControlId": 31882, "ccis": [], "uuid": "fc949574-69c0-5f10-ba32-93cb561b5716", "testId": "PRI-10_A02", "test": "a data governance body is established.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-24", "defaultText": null }, { "id": 73534, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591063", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591063", "securityControlId": 31882, "ccis": [], "uuid": "1f2f73e9-8a35-54f4-9a8e-d5ad22187ddc", "testId": "PRI-10_A03", "test": "the organization's data governance body consisting of roles with responsibilities is established.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-23", "defaultText": null }, { "id": 73535, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591063", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591063", "securityControlId": 31882, "ccis": [], "uuid": "d279f1c5-134e-5d26-b0c9-3ea71b3484bb", "testId": "PRI-10_A04", "test": "the data integrity board/function reviews proposals to conduct or participate in a matching program.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-24a.", "defaultText": null }, { "id": 73536, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591064", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591064", "securityControlId": 31882, "ccis": [], "uuid": "b46f305f-89d1-56de-ba97-cdee2adc008f", "testId": "PRI-10_A05", "test": "the data integrity board/function conducts an annual review of all matching programs in which the agency has participated.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-24b.", "defaultText": null }, { "id": 73537, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591065", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591065", "securityControlId": 31882, "ccis": [], "uuid": "b7a45499-7ef4-5790-9c70-ecc20dbeddd2", "testId": "PRI-10_A06", "test": "organization-wide policies for Personal Data (PD) quality management are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22[01]", "defaultText": null }, { "id": 73538, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591065", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591065", "securityControlId": 31882, "ccis": [], "uuid": "f98a820d-cb16-5a0b-bac8-85055fab514f", "testId": "PRI-10_A07", "test": "organization-wide procedures for Personal Data (PD) quality management are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22[02]", "defaultText": null }, { "id": 73539, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591066", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591066", "securityControlId": 31882, "ccis": [], "uuid": "07e760ca-d9ae-5e2b-b5c0-7e59012d729e", "testId": "PRI-10_A08", "test": "the policies address reviewing the accuracy of Personal Data (PD) across the information life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22a.[01]", "defaultText": null }, { "id": 73540, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591066", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591066", "securityControlId": 31882, "ccis": [], "uuid": "0f465ddf-6e45-5170-bff5-8275a7029552", "testId": "PRI-10_A09", "test": "the policies address reviewing the relevance of Personal Data (PD) across the information life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22a.[02]", "defaultText": null }, { "id": 73541, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591066", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591066", "securityControlId": 31882, "ccis": [], "uuid": "3615d647-8b53-5a34-a6ed-28f5a7bbcc23", "testId": "PRI-10_A10", "test": "the policies address reviewing the timeliness of Personal Data (PD) across the information life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22a.[03]", "defaultText": null }, { "id": 73542, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591066", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591066", "securityControlId": 31882, "ccis": [], "uuid": "5ebf0af9-6e29-5e6a-9ea8-3a80cd4db4ec", "testId": "PRI-10_A11", "test": "the policies address reviewing the completeness of Personal Data (PD) across the information life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22a.[04]", "defaultText": null }, { "id": 73543, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591067", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591067", "securityControlId": 31882, "ccis": [], "uuid": "dcc31d9d-ed2d-544e-9a5a-4b036d5c1081", "testId": "PRI-10_A12", "test": "the procedures address reviewing the accuracy of Personal Data (PD) across the information life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22a.[05]", "defaultText": null }, { "id": 73544, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591067", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591067", "securityControlId": 31882, "ccis": [], "uuid": "d5a20396-b2ed-5e88-8533-09f79d902fb8", "testId": "PRI-10_A13", "test": "the procedures address reviewing the relevance of Personal Data (PD) across the information life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22a.[06]", "defaultText": null }, { "id": 73545, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591067", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591067", "securityControlId": 31882, "ccis": [], "uuid": "7ddd8c8e-0b8c-5bb6-bce8-813293bcd3b1", "testId": "PRI-10_A14", "test": "the procedures address reviewing the timeliness of Personal Data (PD) across the information life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22a.[07]", "defaultText": null }, { "id": 73546, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591067", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591067", "securityControlId": 31882, "ccis": [], "uuid": "bed2eb94-61de-54fb-a13b-41146dba4a0d", "testId": "PRI-10_A15", "test": "the procedures address reviewing the completeness of Personal Data (PD) across the information life cycle.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22a.[08]", "defaultText": null }, { "id": 73547, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591067", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591067", "securityControlId": 31882, "ccis": [], "uuid": "f0280a50-37b2-52a7-8aa8-0634d8230c6b", "testId": "PRI-10_A16", "test": "the policies address correcting or deleting inaccurate or outdated Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22b.[01]", "defaultText": null }, { "id": 73548, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591068", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591068", "securityControlId": 31882, "ccis": [], "uuid": "93393797-a878-5c42-b514-b08601c77dfe", "testId": "PRI-10_A17", "test": "the procedures address correcting or deleting inaccurate or outdated Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22b.[02]", "defaultText": null }, { "id": 73549, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591068", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591068", "securityControlId": 31882, "ccis": [], "uuid": "1313e636-daa7-5f3e-95b1-b5adb62ab945", "testId": "PRI-10_A18", "test": "the policies address disseminating notice of corrected or deleted Personal Data (PD) to individuals or other appropriate entities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22c.[01]", "defaultText": null }, { "id": 73550, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591068", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591068", "securityControlId": 31882, "ccis": [], "uuid": "39dbebb2-90f2-527a-86ed-00510e4ca394", "testId": "PRI-10_A19", "test": "the procedures address disseminating notice of corrected or deleted Personal Data (PD) to individuals or other appropriate entities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22c.[02]", "defaultText": null }, { "id": 73551, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591068", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591068", "securityControlId": 31882, "ccis": [], "uuid": "9f10d9d3-99c2-521d-9c50-519d7ff49a88", "testId": "PRI-10_A20", "test": "the policies address appeals of adverse decisions on correction or deletion requests.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22d.[01]", "defaultText": null }, { "id": 73552, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591068", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591068", "securityControlId": 31882, "ccis": [], "uuid": "db8665b5-107c-5952-846e-fca2fa0f0c38", "testId": "PRI-10_A21", "test": "the procedures address appeals of adverse decisions on correction or deletion requests.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-22d.[02]", "defaultText": null }, { "id": 73553, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591069", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591069", "securityControlId": 31882, "ccis": [], "uuid": "6ff22cbd-f116-51f5-bfba-e1b9dae7d966", "testId": "PRI-10_A22", "test": "the roles of the organization's data governance body are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-23_ODP[01]", "defaultText": null } ], "externalMappings": [ { "id": 596554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588796", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bbc16ca-b133-52de-80aa-f77c20400ddf", "parentControlId": 31882, "controlId": "PM-22", "title": "PM-22", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588796" }, { "id": 596555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588797", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25eb61d5-f4f1-5bb8-b631-5d0118e34253", "parentControlId": 31882, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588797" }, { "id": 596556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588797", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f317e9c4-f864-5498-abd3-3139693fd0d7", "parentControlId": 31882, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588797" }, { "id": 596560, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588797", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aced8f8f-1f8d-5861-b827-9f9e22bf3cac", "parentControlId": 31882, "controlId": "PM-22", "title": "PM-22", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588797" }, { "id": 596561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588797", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab8733df-e4e8-57dc-a7c1-70d99818491c", "parentControlId": 31882, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588797" }, { "id": 596562, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588797", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71ca7024-4bf7-5de9-9fb8-75e6682fe657", "parentControlId": 31882, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588797" }, { "id": 596563, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588797", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec0b6559-0b52-5e83-91ce-067a3c4ecc08", "parentControlId": 31882, "controlId": "PM-22", "title": "PM-22", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588797" }, { "id": 596564, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b6b7a13-93f2-57fb-bbb6-d43a246b35b3", "parentControlId": 31882, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588798" }, { "id": 596565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1fc3fd9-19a0-5ae1-8eb0-1130ede30afd", "parentControlId": 31882, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588798" }, { "id": 596566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea82a5d4-77c0-55c5-a235-e41477671b2a", "parentControlId": 31882, "controlId": "PM-22", "title": "PM-22", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588798" }, { "id": 596567, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c586873-d1ed-5258-91a8-f3c564ffbc54", "parentControlId": 31882, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588798" }, { "id": 596568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33ce008a-185e-5f73-af25-3d6b720630e1", "parentControlId": 31882, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588798" }, { "id": 596569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "788c84a9-965a-5d62-86a5-824fbc4abdae", "parentControlId": 31882, "controlId": "PM-22", "title": "PM-22", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588798" }, { "id": 596570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9bb553b1-6ea0-5268-8a84-ed6708b17ae0", "parentControlId": 31882, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588798" }, { "id": 596571, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32b78b85-59e2-5cd5-9ac3-430a1635abd1", "parentControlId": 31882, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588799" }, { "id": 596572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7d39213-3b15-5dab-9ce9-463792034170", "parentControlId": 31882, "controlId": "PM-22", "title": "PM-22", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588799" }, { "id": 596573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb444500-b730-5f3f-a897-59a93fb22953", "parentControlId": 31882, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588799" } ], "id": 31882, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731279", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731279", "catalogueId": 1062, "uuid": "08b1dd58-2864-5016-a1fa-426c8c400047", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization manage the quality, utility, objectivity, integrity and impact determination and de-identification of sensitive/regulated data across the information lifecycle?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Data Quality Management", "description": "

Control Description

Mechanisms exist to manage the quality, utility, objectivity, integrity and impact determination and de-identification of sensitive/regulated data across the information lifecycle.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to manage the quality, utility, objectivity, integrity and impact determination and de-identification of sensitive/regulated data across the information lifecycle.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-10", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-10", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73554, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591069", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591069", "securityControlId": 31883, "ccis": [], "uuid": "efbbb2fa-6cc2-58fa-be6d-1d5eba5decc4", "testId": "PRI-10.1_A01", "test": "automated mechanisms for tracking the processing purposes of Personal Data (PD) are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-03(02)_ODP", "defaultText": null }, { "id": 73555, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591069", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591069", "securityControlId": 31883, "ccis": [], "uuid": "217f3fb1-66d1-5a2c-b315-8350c4bc3090", "testId": "PRI-10.1_A02", "test": "the processing purposes of Personal Data (PD) are tracked using automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PT-03(02)", "defaultText": null } ], "externalMappings": [ { "id": 596603, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4afb4a1-4e48-5121-a939-4e9e3d25c179", "parentControlId": 31883, "controlId": "PT-03(02)", "title": "PT-03(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588803" }, { "id": 596605, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ab01390-e679-5ee5-accd-2cbdd5122001", "parentControlId": 31883, "controlId": "PT-03(02)", "title": "PT-03(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588803" } ], "id": 31883, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731279", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731279", "catalogueId": 1062, "uuid": "5f622a0b-6308-5f2c-9d86-9e4347dcfc71", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to support the evaluation of data quality across the information lifecycle?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 1.0, "title": "Data Quality Automation", "description": "

Control Description

Automated mechanisms exist to support the evaluation of data quality across the information lifecycle.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically support the evaluation of data quality across the information lifecycle.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-10.1", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-10.1", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73558, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591069", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59107", "securityControlId": 31885, "ccis": [], "uuid": "c4ffe6cc-31a5-540d-82dc-53d8dad498eb", "testId": "PRI-11_A01", "test": "processing purposes to be contained in data tags are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-03(01)_ODP[01]", "defaultText": null }, { "id": 73559, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59107", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59107", "securityControlId": 31885, "ccis": [], "uuid": "cd2a607d-ca28-5add-b019-20a2fa34f175", "testId": "PRI-11_A02", "test": "elements of Personal Data (PD) to be tagged are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PT-03(01)_ODP[02]", "defaultText": null }, { "id": 73560, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59107", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59107", "securityControlId": 31885, "ccis": [], "uuid": "65b4bf8f-10aa-5b93-a901-98626bbcbc88", "testId": "PRI-11_A03", "test": "data tags containing processing purposes are attached to elements of Personal Data (PD).
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_PT-03(01)", "defaultText": null } ], "externalMappings": [ { "id": 596612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "138e833d-cff4-59eb-b1e5-2762632d09ff", "parentControlId": 31885, "controlId": "PT-03(01)", "title": "PT-03(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588804" }, { "id": 596614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa495db6-2882-58d0-a0c3-15c77874690a", "parentControlId": 31885, "controlId": "PT-03(01)", "title": "PT-03(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588804" } ], "id": 31885, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73128", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73128", "catalogueId": 1062, "uuid": "e2e2b3c7-deb1-51b4-b571-fdccbab2d94a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization issue data modeling guidelines to support tagging of sensitive/regulated data?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Data Tagging", "description": "

Control Description

Mechanisms exist to issue data modeling guidelines to support tagging of sensitive/regulated data.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to issue data modeling guidelines to support tagging of sensitive/regulated data.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-11", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-11", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73565, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591071", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591071", "securityControlId": 31888, "ccis": [], "uuid": "617fbcb1-a13d-5012-a336-8e0dd7593c80", "testId": "PRI-13_A01", "test": "a data integrity board/function is established.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-24", "defaultText": null }, { "id": 73566, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591071", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591071", "securityControlId": 31888, "ccis": [], "uuid": "4bd98ddc-19a9-5aef-92ae-2d6a9bbddd5e", "testId": "PRI-13_A02", "test": "the data integrity board/function reviews proposals to conduct or participate in a matching program.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-24a.", "defaultText": null }, { "id": 73567, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591072", "securityControlId": 31888, "ccis": [], "uuid": "95e90796-2b4f-5124-a099-42cbdb3a94b2", "testId": "PRI-13_A03", "test": "the data integrity board/function conducts an annual review of all matching programs in which the agency has participated.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-24b.", "defaultText": null }, { "id": 73568, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591072", "securityControlId": 31888, "ccis": [], "uuid": "d047fec1-81cc-516a-bee0-7d75ac3f3d6e", "testId": "PRI-13_A04", "test": "the roles of the organization's data governance body are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-23_ODP[01]", "defaultText": null }, { "id": 73569, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591072", "securityControlId": 31888, "ccis": [], "uuid": "33aed2fe-f8e9-5003-b00c-7d3751cd79ab", "testId": "PRI-13_A05", "test": "the responsibilities of the organization's data governance body are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-23_ODP[02]", "defaultText": null }, { "id": 73570, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591072", "securityControlId": 31888, "ccis": [], "uuid": "9eae9108-a272-5dba-9ea8-16bfdd27d4ba", "testId": "PRI-13_A06", "test": "the organization's data governance body consisting of roles with responsibilities is established.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-23", "defaultText": null } ], "externalMappings": [ { "id": 596643, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588808", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e82a2f97-0894-5a2a-8ace-73825f104cf6", "parentControlId": 31888, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588808" }, { "id": 596644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588808", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cbb649d2-cc34-5279-aebe-e5d37f81725e", "parentControlId": 31888, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588808" }, { "id": 596647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588808", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9aa8bc4-dd29-56b3-b45f-85489a94082a", "parentControlId": 31888, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588808" }, { "id": 596648, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588808", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a080d2ce-a6a6-50f4-ae89-d1d330861f73", "parentControlId": 31888, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588808" }, { "id": 596649, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c852351c-7509-580d-9868-8f4e0ce05eb2", "parentControlId": 31888, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588809" }, { "id": 596650, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a85fe35-f95d-531b-805c-b980eee74098", "parentControlId": 31888, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588809" }, { "id": 596651, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "037bcfaf-4218-5f86-954a-811f85bc6ce0", "parentControlId": 31888, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588809" }, { "id": 596652, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82f974e4-4ec7-5dfe-865d-b73b5326e24f", "parentControlId": 31888, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588809" }, { "id": 596653, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c60b7c8-c17f-597c-8ae2-b5f276446350", "parentControlId": 31888, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588809" }, { "id": 596654, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9011083-ff7d-5634-8717-7c6321fb2e05", "parentControlId": 31888, "controlId": "PM-24", "title": "PM-24", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588809" }, { "id": 596655, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1cdc0d18-1169-54db-9e9e-4fa32ce217fb", "parentControlId": 31888, "controlId": "PM-23", "title": "PM-23", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588809" } ], "id": 31888, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731281", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731281", "catalogueId": 1062, "uuid": "523ab548-6364-5e53-9ded-26f2d5b080d8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish a written charter for a Data Management Board (DMB) and assigned organization-defined roles to the DMB?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Data Management Board", "description": "

Control Description

Mechanisms exist to establish a written charter for a Data Management Board (DMB) and assigned organization-defined roles to the DMB.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to establish a written charter for a Data Management Board (DMB) and assigned organization-defined roles to the DMB.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-13", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-13", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73571, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591072", "securityControlId": 31889, "ccis": [], "uuid": "74a526c5-5f48-5b3c-aaed-dccf0930b292", "testId": "PRI-14_A01", "test": "privacy reports are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-27_ODP[01]", "defaultText": null }, { "id": 73572, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591072", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591072", "securityControlId": 31889, "ccis": [], "uuid": "0dfb08c4-62f3-5788-96f8-26bb1781565e", "testId": "PRI-14_A02", "test": "privacy oversight bodies are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-27_ODP[02]", "defaultText": null }, { "id": 73573, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591073", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591073", "securityControlId": 31889, "ccis": [], "uuid": "098f5b5c-830d-5661-abc7-39c3503ebd03", "testId": "PRI-14_A03", "test": "officials responsible for monitoring privacy program compliance are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-27_ODP[03]", "defaultText": null }, { "id": 73574, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591073", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591073", "securityControlId": 31889, "ccis": [], "uuid": "34a42169-ab64-5ecf-99f7-a9e7250d3f5f", "testId": "PRI-14_A04", "test": "the frequency for reviewing and updating privacy reports is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-27_ODP[04]", "defaultText": null }, { "id": 73575, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591073", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591073", "securityControlId": 31889, "ccis": [], "uuid": "14282f7e-dc8b-5e36-a98c-39015cbda35d", "testId": "PRI-14_A05", "test": "privacy reports are developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-27a.", "defaultText": null }, { "id": 73576, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591073", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591073", "securityControlId": 31889, "ccis": [], "uuid": "2a58af44-04cf-5e8e-b2ec-158a64f17aa4", "testId": "PRI-14_A06", "test": "privacy reports are disseminated to oversight bodies to demonstrate accountability with statutory, regulatory and policy privacy mandates.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-27a.01", "defaultText": null }, { "id": 73577, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591073", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591073", "securityControlId": 31889, "ccis": [], "uuid": "1fa75329-bb73-59e8-9d43-768ea9f21347", "testId": "PRI-14_A07", "test": "privacy reports are disseminated to officials.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-27a.02[01]", "defaultText": null }, { "id": 73578, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591074", "securityControlId": 31889, "ccis": [], "uuid": "d28d4755-631f-54a9-8c57-77434c8239c8", "testId": "PRI-14_A08", "test": "privacy reports are disseminated to other personnel responsible for monitoring privacy program compliance.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-27a.02[02]", "defaultText": null }, { "id": 73579, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591074", "securityControlId": 31889, "ccis": [], "uuid": "7b55c574-8ef3-5a04-b8a6-dfd77e135708", "testId": "PRI-14_A09", "test": "privacy reports are reviewed / updated frequently.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-27b.", "defaultText": null } ], "externalMappings": [ { "id": 596675, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4d928e6-e7e8-5ef6-a601-5d346a427856", "parentControlId": 31889, "controlId": "AR-6", "title": "AR-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588812" }, { "id": 596676, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0692dd6-b343-5272-9883-be47228dd1a6", "parentControlId": 31889, "controlId": "PM-27", "title": "PM-27", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588812" }, { "id": 596678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47304189-8cff-58c8-8a4c-a7acf3f20c60", "parentControlId": 31889, "controlId": "PM-27", "title": "PM-27", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588812" }, { "id": 596679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb8e0a65-bed5-5574-94da-e7f212dcd0fc", "parentControlId": 31889, "controlId": "PM-27", "title": "PM-27", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588812" }, { "id": 596680, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "468de0d4-6a4a-58b7-a46c-dc954eb3262a", "parentControlId": 31889, "controlId": "PM-27", "title": "PM-27", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588812" }, { "id": 596681, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b83a33d3-b1fb-5918-9402-eddb5df71588", "parentControlId": 31889, "controlId": "PM-27", "title": "PM-27", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588812" }, { "id": 596682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588813", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8c6e6f6-268b-5c26-b97c-a7eb5810d112", "parentControlId": 31889, "controlId": "PM-27", "title": "PM-27", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588813" } ], "id": 31889, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731281", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731281", "catalogueId": 1062, "uuid": "ba5e1e0e-db70-5c00-9b7b-d455dc38182b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization document Personal Data (PD) processing activities that covers collection, receiving, processing, storage, transmission, sharing, updating and/or disposal actions with sufficient detail to demonstrate conformity with applicable statutory, regulatory and contractual requirements?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 8.0, "title": "Documenting Data Processing Activities", "description": "

Control Description

Mechanisms exist to document Personal Data (PD) processing activities that covers collection, receiving, processing, storage, transmission, sharing, updating and/or disposal actions with sufficient detail to demonstrate conformity with applicable statutory, regulatory and contractual requirements.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to document Personal Data (PD) processing activities that covers collection, receiving, processing, storage, transmission, sharing, updating and/or disposal actions with sufficient detail to demonstrate conformity with applicable statutory, regulatory and contractual requirements.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-14", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-14", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73580, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591074", "securityControlId": 31890, "ccis": [], "uuid": "61187191-9df7-5c9f-a4aa-88edca900155", "testId": "PRI-14.1_A01", "test": "an accurate accounting of disclosures of Personal Data (PD) is developed and maintained.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-21a.", "defaultText": null }, { "id": 73581, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591074", "securityControlId": 31890, "ccis": [], "uuid": "1b75391f-8a78-5278-bc8e-b927b8d39c65", "testId": "PRI-14.1_A02", "test": "the accounting includes the date of each disclosure.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-21a.01[01]", "defaultText": null }, { "id": 73582, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591074", "securityControlId": 31890, "ccis": [], "uuid": "bafcc5c1-79a6-5b0f-9316-0d2841bfce73", "testId": "PRI-14.1_A03", "test": "the accounting includes the nature of each disclosure.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-21a.01[02]", "defaultText": null }, { "id": 73583, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591074", "securityControlId": 31890, "ccis": [], "uuid": "5522c2c8-f786-5f07-9139-3964c653af50", "testId": "PRI-14.1_A04", "test": "the accounting includes the purpose of each disclosure.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-21a.01[03]", "defaultText": null }, { "id": 73584, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591074", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591074", "securityControlId": 31890, "ccis": [], "uuid": "9c482b2a-7d90-5011-aa14-4b7bdfb61eba", "testId": "PRI-14.1_A05", "test": "the accounting includes the name of the individual or organization to whom the disclosure was made.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-21a.02[01]", "defaultText": null }, { "id": 73585, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591075", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591075", "securityControlId": 31890, "ccis": [], "uuid": "0fe99aaa-85d4-51a3-8ed8-88a5e2f9e7bd", "testId": "PRI-14.1_A06", "test": "the accounting includes the address or other contact information of the individual or organization to whom the disclosure was made.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-21a.02[02]", "defaultText": null }, { "id": 73586, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591075", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591075", "securityControlId": 31890, "ccis": [], "uuid": "f8671c89-a43b-591d-b0c8-157cec147064", "testId": "PRI-14.1_A07", "test": "the accounting of disclosures is retained for the length of time that the Personal Data (PD) is maintained or five years after the disclosure is made, whichever is longer.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "53A_R5_PM-21b.", "defaultText": null }, { "id": 73587, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591076", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591076", "securityControlId": 31890, "ccis": [], "uuid": "b7a84dc9-f22f-5369-8611-ca6507474713", "testId": "PRI-14.1_A08", "test": "the accounting of disclosures is made available to the individual to whom the Personal Data (PD) relates upon request.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-21c.", "defaultText": null } ], "externalMappings": [ { "id": 596744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58882", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc4ae3f6-5bae-5cc6-87f9-2c019f352495", "parentControlId": 31890, "controlId": "AR-8", "title": "AR-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58882" }, { "id": 596745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58882", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a884cfb-a5f8-560f-9eaa-afa205408b76", "parentControlId": 31890, "controlId": "PM-21", "title": "PM-21", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58882" }, { "id": 596747, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e33b5f57-610c-5b11-ad4a-af8e71810863", "parentControlId": 31890, "controlId": "PM-21", "title": "PM-21", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588821" }, { "id": 596748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0436ae53-04f5-5e5f-9c96-e5a0f3ac7612", "parentControlId": 31890, "controlId": "PM-21", "title": "PM-21", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588821" }, { "id": 596749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04493248-8235-56ec-a94a-2d7cbf567fe0", "parentControlId": 31890, "controlId": "PM-21", "title": "PM-21", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588821" }, { "id": 596750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "527df5e9-4488-59f6-9e4d-36b8a32806fd", "parentControlId": 31890, "controlId": "PM-21", "title": "PM-21", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588821" }, { "id": 596751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ddf536fd-7dee-5940-abd4-1cb69fa49707", "parentControlId": 31890, "controlId": "PM-21", "title": "PM-21", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588821" } ], "id": 31890, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731281", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731281", "catalogueId": 1062, "uuid": "f82c68bd-2791-5bcf-84e8-e1906a4e3fd3", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide data subjects with an accounting of disclosures of their Personal Data (PD) controlled by:\n(1) The organization; and/or\n(2) Relevant third-parties that their PD was shared with?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Accounting of Disclosures", "description": "

Control Description

Mechanisms exist to provide data subjects with an accounting of disclosures of their Personal Data (PD) controlled by:\n(1) The organization; and/or\n(2) Relevant third-parties that their PD was shared with.

Evidence Request List (ERL)

E-PRI-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nPrivacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.\n▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software, customer management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide data subjects with an accounting of disclosures of their Personal Data (PD) controlled by:\n(1) The organization; and/or\n(2) Relevant third-parties that their PD was shared with.

Level 4 - Quantitatively Controlled: Privacy (PRI) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRI-14.1", "family": "Data Privacy", "enhancements": "", "sortId": "PRI-14.1", "references": "

Micro-Small Business (<10 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Small Business (10-49 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Large Business (250-999 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Data classification program\n∙ Data privacy program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73628, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591085", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591085", "securityControlId": 31909, "ccis": [], "uuid": "142b9e07-4577-5ee0-8a0f-ca4b8e5e318e", "testId": "PRM-01_A01", "test": "the organization-defined official is designated to manage the development, documentation, and dissemination of the planning policy and procedures.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_PL-01b.", "defaultText": null }, { "id": 73629, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591085", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591085", "securityControlId": 31909, "ccis": [], "uuid": "e1eb7906-827c-55ea-bdc9-3f9fbec71ad8", "testId": "PRM-01_A02", "test": "planning procedures facilitate the implementation of the planning policy and associated planning controls are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-01a.[03]", "defaultText": null }, { "id": 73630, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591085", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591085", "securityControlId": 31909, "ccis": [], "uuid": "06724246-5e12-5f58-994d-bbbe0356842b", "testId": "PRM-01_A03", "test": "personnel or roles to whom the planning policy is to be disseminated is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01_ODP[01]", "defaultText": null }, { "id": 73631, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591086", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591086", "securityControlId": 31909, "ccis": [], "uuid": "289a8d08-96e3-5a2a-985a-29709e4dc23e", "testId": "PRM-01_A04", "test": "personnel or roles to whom the planning procedures are to be disseminated is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01_ODP[02]", "defaultText": null }, { "id": 73632, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591086", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591086", "securityControlId": 31909, "ccis": [], "uuid": "49694063-ee91-501b-81a1-ae1ce3f9a666", "testId": "PRM-01_A05", "test": "one or more of the following organization-defined criteria is/are selected: mission/business process-level /system-level.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01_ODP[03]", "defaultText": null }, { "id": 73633, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591086", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591086", "securityControlId": 31909, "ccis": [], "uuid": "26d59684-9dbd-55ee-9ee5-2e849d697cc9", "testId": "PRM-01_A06", "test": "an official to manage the planning policy and procedures is defined.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_PL-01_ODP[04]", "defaultText": null }, { "id": 73634, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591086", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591086", "securityControlId": 31909, "ccis": [], "uuid": "859dd246-46ea-5f03-8127-3d9039c8f797", "testId": "PRM-01_A07", "test": "the frequency with which the current planning policy is reviewed / updated is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PL-01_ODP[05]", "defaultText": null }, { "id": 73635, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591086", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591086", "securityControlId": 31909, "ccis": [], "uuid": "86de717b-001a-5f7c-9c29-e8cd269a159c", "testId": "PRM-01_A08", "test": "events that would require the current planning policy to be reviewed / updated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01_ODP[06]", "defaultText": null }, { "id": 73636, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591086", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591086", "securityControlId": 31909, "ccis": [], "uuid": "4dd39a78-6b12-5f88-93b1-351f2d234102", "testId": "PRM-01_A09", "test": "the frequency with which the current planning procedures are reviewed / updated is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PL-01_ODP[07]", "defaultText": null }, { "id": 73637, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591088", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591088", "securityControlId": 31909, "ccis": [], "uuid": "c13a732d-aa1b-5462-b220-10ab7684f309", "testId": "PRM-01_A10", "test": "events that would require procedures to be reviewed / updated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01_ODP[08]", "defaultText": null }, { "id": 73638, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591088", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591088", "securityControlId": 31909, "ccis": [], "uuid": "1867c4c0-d4bf-525b-ab1f-c92177bf065c", "testId": "PRM-01_A11", "test": "a planning policy is developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01a.[01]", "defaultText": null }, { "id": 73639, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591088", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591088", "securityControlId": 31909, "ccis": [], "uuid": "78bf8f61-f871-5e3e-be68-66eaadfc31e5", "testId": "PRM-01_A12", "test": "the planning policy is disseminated to organization-defined personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01a.[02]", "defaultText": null }, { "id": 73640, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591088", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591088", "securityControlId": 31909, "ccis": [], "uuid": "38515200-8b91-5107-83ee-aa81085ba255", "testId": "PRM-01_A13", "test": "the planning procedures are disseminated to organization-defined personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01a.[04]", "defaultText": null }, { "id": 73641, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591088", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591088", "securityControlId": 31909, "ccis": [], "uuid": "0f180f33-0377-5f80-88a3-6031eb3f6e0e", "testId": "PRM-01_A14", "test": "the organization's planning policy addresses purpose.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01a.01(a)[01]", "defaultText": null }, { "id": 73642, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591088", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591088", "securityControlId": 31909, "ccis": [], "uuid": "e3eef08a-e6b0-5990-800f-837aa7ea60f6", "testId": "PRM-01_A15", "test": "the organization's planning policy addresses scope.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01a.01(a)[02]", "defaultText": null }, { "id": 73643, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591088", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591088", "securityControlId": 31909, "ccis": [], "uuid": "ad529ff4-670d-5a37-b752-e71826a39842", "testId": "PRM-01_A16", "test": "the organization's planning policy addresses roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01a.01(a)[03]", "defaultText": null }, { "id": 73644, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591088", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591088", "securityControlId": 31909, "ccis": [], "uuid": "b451c9a5-c8a0-5f41-8ea3-b59393b7b9a4", "testId": "PRM-01_A17", "test": "the organization's planning policy addresses responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01a.01(a)[04]", "defaultText": null }, { "id": 73645, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591089", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591089", "securityControlId": 31909, "ccis": [], "uuid": "1e15ace1-7deb-594e-88fa-363950edac31", "testId": "PRM-01_A18", "test": "the organization's planning policy addresses management commitment.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01a.01(a)[05]", "defaultText": null }, { "id": 73646, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591089", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591089", "securityControlId": 31909, "ccis": [], "uuid": "a8155403-bc41-5ac9-99f0-c5d61bdc5902", "testId": "PRM-01_A19", "test": "the organization's planning policy addresses coordination among organizational entities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01a.01(a)[06]", "defaultText": null }, { "id": 73647, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591089", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591089", "securityControlId": 31909, "ccis": [], "uuid": "5e5bda09-2c1b-5e75-970d-238616c1918c", "testId": "PRM-01_A20", "test": "the organization's planning policy addresses compliance.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01a.01(a)[07]", "defaultText": null }, { "id": 73648, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591089", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591089", "securityControlId": 31909, "ccis": [], "uuid": "3d95faa2-b172-55dc-ac49-ded8a94165b8", "testId": "PRM-01_A21", "test": "the organization's planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01a.01(b)", "defaultText": null }, { "id": 73649, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591089", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591089", "securityControlId": 31909, "ccis": [], "uuid": "c93765fd-84c4-52d5-9fee-c3e491292c5f", "testId": "PRM-01_A22", "test": "the current planning policy is reviewed / updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PL-01c.01[01]", "defaultText": null }, { "id": 73650, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591089", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591089", "securityControlId": 31909, "ccis": [], "uuid": "72ad9042-077e-555c-863a-323c02be9eb3", "testId": "PRM-01_A23", "test": "the current planning policy is reviewed / updated following organization-defined events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01c.01[02]", "defaultText": null }, { "id": 73651, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591089", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591089", "securityControlId": 31909, "ccis": [], "uuid": "aaea8410-9181-52ef-b996-219be15b5b4e", "testId": "PRM-01_A24", "test": "the current planning procedures are reviewed / updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PL-01c.02[01]", "defaultText": null }, { "id": 73652, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591089", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591089", "securityControlId": 31909, "ccis": [], "uuid": "73cb61b5-1621-5644-a2c8-e3d89ea4562c", "testId": "PRM-01_A25", "test": "the current planning procedures are reviewed / updated following organization-defined events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-01c.02[02]", "defaultText": null }, { "id": 73653, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59109", "securityControlId": 31909, "ccis": [], "uuid": "c9c44c05-6661-5177-819d-eb617ba99dd9", "testId": "PRM-01_A26", "test": "Project & Resource Management (PRM) operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73654, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59109", "securityControlId": 31909, "ccis": [], "uuid": "1f631439-f71d-54d8-b330-0c8f3c93da94", "testId": "PRM-01_A27", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support Project & Resource Management (PRM) operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73655, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59109", "securityControlId": 31909, "ccis": [], "uuid": "a18de87d-1b13-5668-92c6-9d50b1ade7e0", "testId": "PRM-01_A28", "test": "responsibility and authority for the performance of Project & Resource Management (PRM)-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73656, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59109", "securityControlId": 31909, "ccis": [], "uuid": "9aab1b1f-3ef3-5a48-b6c4-4244a1ec6721", "testId": "PRM-01_A29", "test": "personnel performing Project & Resource Management (PRM)-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 597079, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588878", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea6e3b45-f61f-5ccc-a814-0d8abfded303", "parentControlId": 31909, "controlId": "5.1(e)", "title": "5.1(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588878" }, { "id": 597080, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588878", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5dafec2f-f166-57fa-b91f-e1315fb80367", "parentControlId": 31909, "controlId": "5.4", "title": "5.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588878" }, { "id": 597081, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588878", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54d63ecf-70a4-5de0-891a-7c78553e73ff", "parentControlId": 31909, "controlId": "5.8", "title": "5.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588879" }, { "id": 597096, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5e00643-180e-50b0-aa57-ca1cee29bbee", "parentControlId": 31909, "controlId": "PL-1", "title": "PL-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588881" }, { "id": 597097, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17a9e4ab-eb34-5e33-b3d6-01a76b10aebe", "parentControlId": 31909, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588881" }, { "id": 597099, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "471bf3ca-bc37-5d03-b032-2ab3da8482f5", "parentControlId": 31909, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588881" }, { "id": 597100, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b57fb4fd-ec2c-5a83-ab3e-300cc4112796", "parentControlId": 31909, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588881" }, { "id": 597101, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eff1a592-61e6-5b64-8e63-3fd3248dc77a", "parentControlId": 31909, "controlId": "PL-1", "title": "PL-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588881" }, { "id": 597102, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43c01c69-d4a7-5297-b246-11b0115c9c19", "parentControlId": 31909, "controlId": "PL-1", "title": "PL-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588881" }, { "id": 597104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85f10158-9023-5595-aef7-9e8f34677c12", "parentControlId": 31909, "controlId": "NFO - PL-1", "title": "NFO - PL-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588881" }, { "id": 597105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09d64e49-1c4b-5fa1-9d47-5b9e299d5571", "parentControlId": 31909, "controlId": "03.16.01", "title": "03.16.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588881" }, { "id": 597106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588882", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0c320f5-3718-5017-b068-1634466a9605", "parentControlId": 31909, "controlId": "GV.RM", "title": "GV.RM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588882" }, { "id": 597107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588882", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd80a80e-e66d-5ee7-acf2-e51f32d3b38c", "parentControlId": 31909, "controlId": "GV.RR-03", "title": "GV.RR-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588882" }, { "id": 597136, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588885", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fa311f3-1097-50f2-a2ab-1258f7e9b6c1", "parentControlId": 31909, "controlId": "RISK-1f", "title": "RISK-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588885" }, { "id": 597137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588885", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ff1c2e8-7a4d-5ab4-be09-3e98cf8901d3", "parentControlId": 31909, "controlId": "ARCHITECTURE-1e", "title": "ARCHITECTURE-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588885" } ], "id": 31909, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731288", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731288", "catalogueId": 1062, "uuid": "17fd98fe-fbd2-5fd8-a6c8-b5b2da95e90a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of resource planning controls that provide a portfolio management approach to achieve security, compliance and resilience objectives?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Security, Compliance & Resilience Protection Portfolio Management", "description": "

Control Description

Mechanisms exist to facilitate the implementation of resource planning controls that provide a portfolio management approach to achieve security, compliance and resilience objectives.

Evidence Request List (ERL)

E-PRM-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Project & Resource Management (PRM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Project management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel work with data/process owners to help ensure secure practices are implemented throughout the System Development Lifecycle (SDLC) for all high-value projects.

Level 2 - Planned & Tracked: Project & Resource Management (PRM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Project & Resource Management -related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Project & Resource Management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives and resourcing of the security function, based on broader business requirements.\n▪ A Project Management Office (PMO), or project management function, enables the implementation of cybersecurity and data protection-related resource planning controls across the System Development Lifecycle (SDLC) for all high-value projects.\n▪ Quarterly Business Review (QBR), or similar status reporting, exists to provide recurring reports on the state of the cybersecurity and data protection program.

Level 3 - Well Defined: Project & Resource Management (PRM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRM domain capabilities are well-documented and kept current by process owners.\n▪ A Project Management Office (PMO), or similar function, is appropriately staffed and supported to implement and maintain PRM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of project and resource management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives and resourcing of the security function, based on broader business requirements.\n▪ An implemented and operational capability exists to facilitate the implementation of resource planning controls that provide a portfolio management approach to achieve security, compliance and resilience objectives.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRM-01", "family": "Project & Resource Management", "enhancements": "", "sortId": "PRM-01", "references": "

Micro-Small Business (<10 staff)

∙ Include security tasks in project plans

Small Business (10-49 staff)

∙ Security requirements in project planning\n∙ Project security checklist

Medium Business (50-249 staff)

∙ Security integrated into project management methodology\n∙ Security gates

Large Business (250-999 staff)

∙ Enterprise project management with security integration (e.g., Jira, MS Project)

Enterprise (>1,000 staff)

∙ Enterprise PPM platform with security integration\n∙ Dedicated security architects\n∙ Security portfolio risk management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73657, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59109", "securityControlId": 31910, "ccis": [], "uuid": "383a9607-e1cd-5de7-9e68-0eb63ea44a02", "testId": "PRM-01.1_A01", "test": "a documented strategic cybersecurity / data privacy-specific business plan exists.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73658, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59109", "securityControlId": 31910, "ccis": [], "uuid": "b616a0db-d0da-5628-8aab-1e1591b2733f", "testId": "PRM-01.1_A02", "test": "a documented set of objectives to achieve that cybersecurity and privacy-specific business plan exists.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 597204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0b19415-64dd-50f8-9c41-6c73e7a53a49", "parentControlId": 31910, "controlId": "GV", "title": "GV", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588901" }, { "id": 597205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "933fd4f3-9fe9-5f94-a1d4-bf1f36873e7d", "parentControlId": 31910, "controlId": "GV.OC-04", "title": "GV.OC-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588901" }, { "id": 597206, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7885901a-efae-5d01-b6f3-a0e39644eb6e", "parentControlId": 31910, "controlId": "GV.RM", "title": "GV.RM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588901" }, { "id": 597207, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be3c1257-9283-592a-a600-eb9a68234fe8", "parentControlId": 31910, "controlId": "GV.OV-01", "title": "GV.OV-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588901" }, { "id": 597212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588902", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1db8d8dc-c2fb-5700-854d-e8c02bd4b1f6", "parentControlId": 31910, "controlId": "RISK-1a", "title": "RISK-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588902" }, { "id": 597213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588902", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13f6643c-4f8c-5880-b26e-674690a854e1", "parentControlId": 31910, "controlId": "ARCHITECTURE-1a", "title": "ARCHITECTURE-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588902" }, { "id": 597214, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588902", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f0e7693-450a-5302-a453-2c5cafaa6def", "parentControlId": 31910, "controlId": "PROGRAM-1a", "title": "PROGRAM-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588902" }, { "id": 597215, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588902", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "499b06ab-f9ef-5e58-a9da-25f6faf7882c", "parentControlId": 31910, "controlId": "PROGRAM-1b", "title": "PROGRAM-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588902" }, { "id": 597216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588902", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89407ca8-5d1f-55c8-9794-24515d3a5df2", "parentControlId": 31910, "controlId": "PROGRAM-1c", "title": "PROGRAM-1c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588902" }, { "id": 597217, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588902", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d275b592-7f1e-53e3-9ae5-50e74d8a7a1d", "parentControlId": 31910, "controlId": "PROGRAM-1d", "title": "PROGRAM-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588902" }, { "id": 597218, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588903", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe4be49c-6486-5049-9ff2-591a5073f689", "parentControlId": 31910, "controlId": "PROGRAM-1e", "title": "PROGRAM-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588903" } ], "id": 31910, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731289", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731289", "catalogueId": 1062, "uuid": "99e9706d-c6b3-5f62-9fdd-cbd2ea4f2f4d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish a:\n(1) Strategic security, compliance and resilience-specific business plan; and \n(2) Set of objectives to achieve that plan?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Strategic Plan & Objectives", "description": "

Control Description

Mechanisms exist to establish a:\n(1) Strategic security, compliance and resilience-specific business plan; and \n(2) Set of objectives to achieve that plan.

Evidence Request List (ERL)

E-PRM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Project & Resource Management (PRM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Project & Resource Management -related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Project & Resource Management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives and resourcing of the security function, based on broader business requirements.\n▪ A Project Management Office (PMO), or project management function, enables the implementation of cybersecurity and data protection-related resource planning controls across the System Development Lifecycle (SDLC) for all high-value projects.\n▪ Quarterly Business Review (QBR), or similar status reporting, exists to provide recurring reports on the state of the cybersecurity and data protection program.

Level 3 - Well Defined: Project & Resource Management (PRM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRM domain capabilities are well-documented and kept current by process owners.\n▪ A Project Management Office (PMO), or similar function, is appropriately staffed and supported to implement and maintain PRM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of project and resource management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives and resourcing of the security function, based on broader business requirements.\n▪ An implemented and operational capability exists to establish a:\n(1) Strategic security, compliance and resilience-specific business plan; and \n(2) Set of objectives to achieve that plan.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRM-01.1", "family": "Project & Resource Management", "enhancements": "", "sortId": "PRM-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Include security tasks in project plans

Small Business (10-49 staff)

∙ Security requirements in project planning\n∙ Project security checklist

Medium Business (50-249 staff)

∙ Documented cybersecurity and data protection-specific business plan

Large Business (250-999 staff)

∙ Documented cybersecurity and data protection-specific business plan

Enterprise (>1,000 staff)

∙ Documented cybersecurity and data protection-specific business plan", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73661, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591091", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591091", "securityControlId": 31912, "ccis": [], "uuid": "82297e1f-7c60-5da5-86d8-f6e3d318165b", "testId": "PRM-02_A01", "test": "the resources needed to implement the cybersecurity / data privacy program are included in capital planning and investment requests and all exceptions are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-03a.[01]\n53A_R5_PM-03a.[02]", "defaultText": null }, { "id": 73662, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591092", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591092", "securityControlId": 31912, "ccis": [], "uuid": "268231ec-6ceb-5f95-862e-b448b5ec0398", "testId": "PRM-02_A02", "test": "the documentation required for addressing the cybersecurity / data privacy program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-03b.[01]\n53A_R5_PM-03b.[02]", "defaultText": null }, { "id": 73663, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591092", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591092", "securityControlId": 31912, "ccis": [], "uuid": "113c964a-b811-5c51-a348-c7327384f7eb", "testId": "PRM-02_A03", "test": "cybersecurity / data privacy resources are made available for expenditure as planned.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-03c.[01]\n53A_R5_PM-03c.[02]", "defaultText": null } ], "externalMappings": [ { "id": 597294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588919", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "911ed32d-c613-5f68-b3f6-308e3cd00abb", "parentControlId": 31912, "controlId": "5.1(c)", "title": "5.1(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588919" }, { "id": 597295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588919", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a15293e-e7aa-5c62-ada8-1f77c47ddc7f", "parentControlId": 31912, "controlId": "7.1", "title": "7.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588919" }, { "id": 597296, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588919", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e0d5540-cab7-5e9c-ab3d-cbfa092b584e", "parentControlId": 31912, "controlId": "5.4", "title": "5.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588919" }, { "id": 597308, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "666c381c-762e-510c-91a3-f50da7c31f94", "parentControlId": 31912, "controlId": "PM-3", "title": "PM-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58892" }, { "id": 597309, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58892", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1380cace-ca2a-5dab-88ca-3310d46868a6", "parentControlId": 31912, "controlId": "PM-03", "title": "PM-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58892" }, { "id": 597311, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3af05f51-1e13-525a-b1e6-22410d27613b", "parentControlId": 31912, "controlId": "PM-03", "title": "PM-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588921" }, { "id": 597312, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9066ece-d3d3-5254-8f1e-3046d8dc12fd", "parentControlId": 31912, "controlId": "PM-03", "title": "PM-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588921" }, { "id": 597313, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5bf5308-8232-5404-9787-4b511c66bb2c", "parentControlId": 31912, "controlId": "PM-03", "title": "PM-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588921" }, { "id": 597314, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0305d97-ff00-5557-8195-71eaadd25530", "parentControlId": 31912, "controlId": "PM-03", "title": "PM-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588921" }, { "id": 597315, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8486be1d-944e-5b58-88af-74d86a8e0110", "parentControlId": 31912, "controlId": "PM-3", "title": "PM-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588921" }, { "id": 597318, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588922", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f471a70-c2e1-5f28-bd64-b43fc17fe756", "parentControlId": 31912, "controlId": "GV.RR-03", "title": "GV.RR-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588922" }, { "id": 597354, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588928", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a1dd00b-fbca-5666-a059-34f01b835903", "parentControlId": 31912, "controlId": "§117.18(c)(1)(ii)", "title": "§117.18(c)(1)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588928" } ], "id": 31912, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731289", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731289", "catalogueId": 1062, "uuid": "1c1eec36-9f69-5248-8396-4917c68bd827", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization address all capital planning and investment requests, including the resources needed to implement the Security, Compliance & Resilience Program (SCRP) and document all exceptions to this requirement?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Security, Compliance & Resilience Resource Management", "description": "

Control Description

Mechanisms exist to address all capital planning and investment requests, including the resources needed to implement the Security, Compliance & Resilience Program (SCRP) and document all exceptions to this requirement.

Evidence Request List (ERL)

E-PRM-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Project & Resource Management (PRM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Project management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel work with data/process owners to help ensure secure practices are implemented throughout the System Development Lifecycle (SDLC) for all high-value projects.

Level 2 - Planned & Tracked: Project & Resource Management (PRM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Project & Resource Management -related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Project & Resource Management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives and resourcing of the security function, based on broader business requirements.\n▪ A Project Management Office (PMO), or project management function, enables the implementation of cybersecurity and data protection-related resource planning controls across the System Development Lifecycle (SDLC) for all high-value projects.\n▪ The PM function enables project involvement for Information Assurance Program (IAP) as part of the organization's established project management processes to ensure both cybersecurity and data protection principles are identified and implemented.\n▪ Quarterly Business Review (QBR), or similar status reporting, exists to provide recurring reports on the state of the cybersecurity and data protection program.

Level 3 - Well Defined: Project & Resource Management (PRM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRM domain capabilities are well-documented and kept current by process owners.\n▪ A Project Management Office (PMO), or similar function, is appropriately staffed and supported to implement and maintain PRM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of project and resource management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives and resourcing of the security function, based on broader business requirements.\n▪ An implemented and operational capability exists to address all capital planning and investment requests, including the resources needed to implement the Security, Compliance & Resilience Program (SCRP) and document all exceptions to this requirement.

Level 4 - Quantitatively Controlled: Project & Resource Management (PRM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRM-02", "family": "Project & Resource Management", "enhancements": "", "sortId": "PRM-02", "references": "

Micro-Small Business (<10 staff)

∙ Generic budget for IT products and services

Small Business (10-49 staff)

∙ Generic budget for IT products and services

Medium Business (50-249 staff)

∙ Dedicated cybersecurity budget\n∙ Dedicated data protection budget

Large Business (250-999 staff)

∙ Dedicated cybersecurity budget\n∙ Dedicated data protection budget

Enterprise (>1,000 staff)

∙ Dedicated cybersecurity budget\n∙ Dedicated data protection budget", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73666, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591092", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591092", "securityControlId": 31914, "ccis": [], "uuid": "9b1fb7e1-1270-5ba5-8cd0-d9215ce84046", "testId": "PRM-03_A01", "test": "the high-level cybersecurity / data privacy requirements for the system or system service are determined in mission and business process planning.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-02a.[01]\n53A_R5_SA-02a.[02]", "defaultText": null }, { "id": 73667, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591093", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591093", "securityControlId": 31914, "ccis": [], "uuid": "2510b516-dc19-59ae-b995-d0d428cc32e8", "testId": "PRM-03_A02", "test": "the resources required to protect the system or system service are determined and documented as part of the organizational capital planning and investment control process.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-02b.[01]", "defaultText": null }, { "id": 73668, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591093", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591093", "securityControlId": 31914, "ccis": [], "uuid": "0b787e57-dc57-5f73-a373-c61e03f05e67", "testId": "PRM-03_A03", "test": "the resources required to protect the system or system service are allocated as part of the organizational capital planning and investment control process.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-02b.[02]", "defaultText": null }, { "id": 73669, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591093", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591093", "securityControlId": 31914, "ccis": [], "uuid": "b7db07d1-6cfe-5ef7-850c-b6e6214194ef", "testId": "PRM-03_A04", "test": "a discrete line item for is established in organizational programming and budgeting documentation.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-02c.[01]\n53A_R5_SA-02c.[02]", "defaultText": null } ], "externalMappings": [ { "id": 597433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5cf0ad5-3ee4-5dba-9fc0-a99d9ec16a1a", "parentControlId": 31914, "controlId": "SA-2", "title": "SA-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588939" }, { "id": 597434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da673915-9d3a-5549-98b4-022a971c4f87", "parentControlId": 31914, "controlId": "SA-02", "title": "SA-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588939" }, { "id": 597436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f7080bd-5665-5ca7-8c67-b6af09a31261", "parentControlId": 31914, "controlId": "SA-02", "title": "SA-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588939" }, { "id": 597437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afc465ab-609d-5563-9b2e-22b98f996101", "parentControlId": 31914, "controlId": "SA-02", "title": "SA-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588939" }, { "id": 597438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3617d400-6338-5690-a2de-a148b9086c3a", "parentControlId": 31914, "controlId": "SA-02", "title": "SA-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588939" }, { "id": 597439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72200c73-d58a-582e-a387-9022c57a39d7", "parentControlId": 31914, "controlId": "SA-02", "title": "SA-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588939" }, { "id": 597440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dedb4d36-cbe2-5063-b2c3-6da40cf3f99e", "parentControlId": 31914, "controlId": "SA-02", "title": "SA-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588939" }, { "id": 597441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588942", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d21719d-2f63-5a6c-8f7b-7cb4780d0190", "parentControlId": 31914, "controlId": "SA-2", "title": "SA-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588942" }, { "id": 597442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588942", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fe9b3d4-e6b0-533d-84e0-f05dd99d1fb6", "parentControlId": 31914, "controlId": "SA-2", "title": "SA-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588942" }, { "id": 597445, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588942", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2567e4ab-e118-5de0-b508-6d525bd86d76", "parentControlId": 31914, "controlId": "NFO - SA-2", "title": "NFO - SA-2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588942" }, { "id": 597446, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588942", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6bd7aac-2aac-5adb-a499-da8a870ca14b", "parentControlId": 31914, "controlId": "GV.RR-03", "title": "GV.RR-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588942" }, { "id": 597449, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7a8ab4f-772a-54cb-8838-349d3673b934", "parentControlId": 31914, "controlId": "ASSET-5b", "title": "ASSET-5b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588943" }, { "id": 597450, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "deb29a76-eb31-5472-a317-aa0bf6f11d82", "parentControlId": 31914, "controlId": "THREAT-3b", "title": "THREAT-3b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588943" }, { "id": 597451, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b972ac3-d544-5414-94e0-e4a9938e0a01", "parentControlId": 31914, "controlId": "RISK-5b", "title": "RISK-5b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588943" }, { "id": 597452, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb2651ed-22a0-5fb4-814f-51981b7c48f1", "parentControlId": 31914, "controlId": "ACCESS-4b", "title": "ACCESS-4b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588943" }, { "id": 597453, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9ded5ed-2420-546c-92b3-8c079e322625", "parentControlId": 31914, "controlId": "SITUATION-4b", "title": "SITUATION-4b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588943" }, { "id": 597454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e4f1a23-1c65-5dda-a775-f4bd76815af7", "parentControlId": 31914, "controlId": "RESPONSE-5b", "title": "RESPONSE-5b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588943" }, { "id": 597455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0615022a-165a-56de-9b0a-b097b5f3ab41", "parentControlId": 31914, "controlId": "THIRD-PARTIES-3b", "title": "THIRD-PARTIES-3b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588943" }, { "id": 597456, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54bc163a-e4c5-5ecc-8586-cc18d73aea44", "parentControlId": 31914, "controlId": "WORKFORCE-5b", "title": "WORKFORCE-5b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588944" }, { "id": 597457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588944", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11daaf8e-1d43-5ac1-a3a8-d43306b78f98", "parentControlId": 31914, "controlId": "ARCHITECTURE-6b", "title": "ARCHITECTURE-6b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588944" }, { "id": 597458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588944", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76f6a6b5-0bd4-5002-a2cb-8da51969b887", "parentControlId": 31914, "controlId": "PROGRAM-3b", "title": "PROGRAM-3b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588944" } ], "id": 31914, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73129", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73129", "catalogueId": 1062, "uuid": "be368c41-8024-54df-a6d9-1ee68499b654", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify and allocate resources for management, operational, technical and data protection requirements within business process planning for projects / initiatives?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Allocation of Resources", "description": "

Control Description

Mechanisms exist to identify and allocate resources for management, operational, technical and data protection requirements within business process planning for projects / initiatives.

Evidence Request List (ERL)

E-PRM-01\nE-PRM-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Project & Resource Management (PRM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Project management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel work with data/process owners to help ensure secure practices are implemented throughout the System Development Lifecycle (SDLC) for all high-value projects.

Level 2 - Planned & Tracked: Project & Resource Management (PRM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Project & Resource Management -related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Project & Resource Management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives and resourcing of the security function, based on broader business requirements.\n▪ A Project Management Office (PMO), or project management function, enables the implementation of cybersecurity and data protection-related resource planning controls across the System Development Lifecycle (SDLC) for all high-value projects.\n▪ The PM function enables project involvement for Information Assurance Program (IAP) as part of the organization's established project management processes to ensure both cybersecurity and data protection principles are identified and implemented.\n▪ Quarterly Business Review (QBR), or similar status reporting, exists to provide recurring reports on the state of the cybersecurity and data protection program.

Level 3 - Well Defined: Project & Resource Management (PRM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRM domain capabilities are well-documented and kept current by process owners.\n▪ A Project Management Office (PMO), or similar function, is appropriately staffed and supported to implement and maintain PRM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of project and resource management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives and resourcing of the security function, based on broader business requirements.\n▪ An implemented and operational capability exists to identify and allocate resources for management, operational, technical and data protection requirements within business process planning for projects / initiatives.

Level 4 - Quantitatively Controlled: Project & Resource Management (PRM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRM-03", "family": "Project & Resource Management", "enhancements": "", "sortId": "PRM-03", "references": "

Micro-Small Business (<10 staff)

∙ Include security tasks in project plans

Small Business (10-49 staff)

∙ Security requirements in project planning\n∙ Project security checklist

Medium Business (50-249 staff)

∙ Cybersecurity road map\n∙ Prioritized list of cybersecurity expenses

Large Business (250-999 staff)

∙ Cybersecurity road map\n∙ Prioritized list of cybersecurity expenses

Enterprise (>1,000 staff)

∙ Cybersecurity road map\n∙ Prioritized list of cybersecurity expenses", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73670, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591093", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591093", "securityControlId": 31915, "ccis": [], "uuid": "868c6dfe-8da6-5caf-ae85-0a8bb030da0d", "testId": "PRM-04_A01", "test": "controls are assessed in the system and its environment of operation per an organization-defined assessment frequency to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting established cybersecurity / data privacy requirements.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-02d.[01]\n53A_R5_CA-02d.[02]", "defaultText": null }, { "id": 73671, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591093", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591093", "securityControlId": 31915, "ccis": [], "uuid": "d2c09e28-40ac-5e50-a57e-ae71603c3595", "testId": "PRM-04_A02", "test": "an appropriate assessor or assessment team is selected for the type of assessment to be conducted.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02a.", "defaultText": null }, { "id": 73672, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591094", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591094", "securityControlId": 31915, "ccis": [], "uuid": "aa88475a-1e62-5af1-94bd-d60c36b41f18", "testId": "PRM-04_A03", "test": "a control assessment report is produced that documents the results of the assessment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02e.", "defaultText": null }, { "id": 73673, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591094", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591094", "securityControlId": 31915, "ccis": [], "uuid": "2f29259d-b7dc-5b8a-b9ee-e1bae92640d5", "testId": "PRM-04_A04", "test": "the results of the control assessment are provided to individuals or roles.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-02f.", "defaultText": null }, { "id": 73674, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591094", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591094", "securityControlId": 31915, "ccis": [], "uuid": "06722402-760c-5b3f-a6b2-ca73a1f7d010", "testId": "PRM-04_A05", "test": "the frequency at which to assess controls in the system and its environment of operation is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-02_ODP[01]", "defaultText": null }, { "id": 73675, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591094", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591094", "securityControlId": 31915, "ccis": [], "uuid": "81f67afd-0360-5d73-a8f7-4d54c0806599", "testId": "PRM-04_A06", "test": "individuals or roles to whom control assessment results are to be provided are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02_ODP[02]", "defaultText": null }, { "id": 73676, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591094", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591094", "securityControlId": 31915, "ccis": [], "uuid": "f4114fc2-6574-50e0-ba3e-f3648f9d13c4", "testId": "PRM-04_A07", "test": "a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02b.01", "defaultText": null }, { "id": 73677, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591094", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591094", "securityControlId": 31915, "ccis": [], "uuid": "9887bf05-44a1-51c6-8409-66315aa00fd5", "testId": "PRM-04_A08", "test": "a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02b.02", "defaultText": null }, { "id": 73678, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591095", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591095", "securityControlId": 31915, "ccis": [], "uuid": "606ef077-0e3e-5300-98c8-1db77572bf89", "testId": "PRM-04_A09", "test": "a control assessment plan is developed that describes the scope of the assessment, including the assessment environment.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02b.03[01]", "defaultText": null }, { "id": 73679, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591095", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591095", "securityControlId": 31915, "ccis": [], "uuid": "90ce9648-6ce3-5d6c-aca6-f9b3de476240", "testId": "PRM-04_A10", "test": "a control assessment plan is developed that describes the scope of the assessment, including the assessment team.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02b.03[02]", "defaultText": null }, { "id": 73680, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591095", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591095", "securityControlId": 31915, "ccis": [], "uuid": "885e7aa6-b29e-5e15-96cd-f8f9b2eff336", "testId": "PRM-04_A11", "test": "a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02b.03[03]", "defaultText": null }, { "id": 73681, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591095", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591095", "securityControlId": 31915, "ccis": [], "uuid": "e2b378e7-c720-5361-bc2a-0b9b0d57023a", "testId": "PRM-04_A12", "test": "the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_CA-02c.", "defaultText": null } ], "externalMappings": [ { "id": 597525, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588965", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f023744-f04a-59f5-be6d-4d4246e4add0", "parentControlId": 31915, "controlId": "5.8", "title": "5.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588965" }, { "id": 597542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588972", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "319e4786-e4ac-5e41-8dc0-0de55358e4a8", "parentControlId": 31915, "controlId": "CA-2", "title": "CA-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588972" }, { "id": 597543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588972", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96554d22-f2c9-55b4-aee9-8f1b5680967e", "parentControlId": 31915, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588972" }, { "id": 597545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588972", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bcb79e16-6aa5-510b-98d3-f910066e2bb2", "parentControlId": 31915, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588972" }, { "id": 597546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588972", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7049d55e-3195-5f16-abdf-32d453528455", "parentControlId": 31915, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588972" }, { "id": 597547, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b342ab3-1e1d-56c4-af97-a89007ed24d5", "parentControlId": 31915, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588973" }, { "id": 597548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3530d392-48cb-5a32-ae6d-7a1b4b26efbb", "parentControlId": 31915, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588973" }, { "id": 597549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc436013-f974-585d-ba1a-8d9e32239afb", "parentControlId": 31915, "controlId": "CA-02", "title": "CA-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588973" }, { "id": 597550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfbe2cae-0f95-5318-ab60-3a20a46b2f0f", "parentControlId": 31915, "controlId": "CA-2", "title": "CA-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588973" }, { "id": 597551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a33d182d-c32f-5f7a-a8e2-2245593ea7e6", "parentControlId": 31915, "controlId": "CA-2", "title": "CA-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588973" } ], "id": 31915, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73129", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73129", "catalogueId": 1062, "uuid": "a1703330-f3cb-5b7d-b046-5b9d11a401db", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization assess security, compliance and resilience controls in system project development to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting the requirements?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Security, Compliance & Resilience In Project Management", "description": "

Control Description

Mechanisms exist to assess security, compliance and resilience controls in system project development to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting the requirements.

Evidence Request List (ERL)

E-PRM-03\nE-PRM-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Project & Resource Management (PRM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Project management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel work with data/process owners to help ensure secure practices are implemented throughout the System Development Lifecycle (SDLC) for all high-value projects.

Level 2 - Planned & Tracked: Project & Resource Management (PRM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Project & Resource Management -related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Project & Resource Management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives and resourcing of the security function, based on broader business requirements.\n▪ A Project Management Office (PMO), or project management function, enables the implementation of cybersecurity and data protection-related resource planning controls across the System Development Lifecycle (SDLC) for all high-value projects.\n▪ The PM function enables project involvement for Information Assurance Program (IAP) as part of the organization's established project management processes to ensure both cybersecurity and data protection principles are identified and implemented.

Level 3 - Well Defined: Project & Resource Management (PRM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRM domain capabilities are well-documented and kept current by process owners.\n▪ A Project Management Office (PMO), or similar function, is appropriately staffed and supported to implement and maintain PRM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of project and resource management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives and resourcing of the security function, based on broader business requirements.\n▪ An implemented and operational capability exists to assess security, compliance and resilience controls in system project development to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting the requirements.

Level 4 - Quantitatively Controlled: Project & Resource Management (PRM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRM-04", "family": "Project & Resource Management", "enhancements": "", "sortId": "PRM-04", "references": "

Micro-Small Business (<10 staff)

∙ Product / project management

Small Business (10-49 staff)

∙ Product / project management

Medium Business (50-249 staff)

∙ Product / project management

Large Business (250-999 staff)

∙ Product / project management\n∙ Program Management Office (PMO)

Enterprise (>1,000 staff)

∙ Product / project management\n∙ Program Management Office (PMO)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73682, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591096", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591096", "securityControlId": 31916, "ccis": [], "uuid": "0ff2d5b9-54c6-5f4f-9677-e6d26efa8fcc", "testId": "PRM-05_A01", "test": "systems, system components or system services to be analyzed for criticality are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-09_ODP[01]", "defaultText": null }, { "id": 73683, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591096", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591096", "securityControlId": 31916, "ccis": [], "uuid": "fbf29cdb-2f9e-55f9-bd2a-ecd20fc878fd", "testId": "PRM-05_A02", "test": "decision points in the system development life cycle when a criticality analysis is to be performed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-09_ODP[02]", "defaultText": null }, { "id": 73684, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591096", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591096", "securityControlId": 31916, "ccis": [], "uuid": "470d82da-9305-5ca0-81f9-6eca43e38527", "testId": "PRM-05_A03", "test": "critical system components and functions are identified by performing a criticality analysis for systems, system components or system services at decision points in the system development life cycle.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-09", "defaultText": null } ], "externalMappings": [ { "id": 597678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7566d76-8db3-5a59-9765-16f690b50f1f", "parentControlId": 31916, "controlId": "5.8", "title": "5.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588994" }, { "id": 597679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc38e2bf-339f-5f4f-8391-8ec3512a50df", "parentControlId": 31916, "controlId": "5.9", "title": "5.9", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588994" }, { "id": 597680, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0974d29c-08a0-5c22-93a9-d6e926db498d", "parentControlId": 31916, "controlId": "8.26", "title": "8.26", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588994" }, { "id": 597697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5dc417bf-6dcd-5b54-8c7a-0392dec98927", "parentControlId": 31916, "controlId": "SA-14", "title": "SA-14", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588999" }, { "id": 597698, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ac53938-5809-52c7-85a4-ca6a51f68758", "parentControlId": 31916, "controlId": "RA-09", "title": "RA-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588999" }, { "id": 597700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "348bd8c4-4f79-5f1b-a096-2971375b9a17", "parentControlId": 31916, "controlId": "RA-09", "title": "RA-09", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588999" }, { "id": 597701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.588999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "396cdca4-239a-56e6-99ab-4d47544c389c", "parentControlId": 31916, "controlId": "RA-09", "title": "RA-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.588999" }, { "id": 597703, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7251347d-e79f-58b3-94f2-0743d4fb81d4", "parentControlId": 31916, "controlId": "RA-9", "title": "RA-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589" }, { "id": 597704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a18b74c2-b644-5a71-a0e2-8e82a6919a72", "parentControlId": 31916, "controlId": "RA-9", "title": "RA-9", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589" }, { "id": 597708, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5970ab40-e27c-55ba-a7f5-685dd4f96f70", "parentControlId": 31916, "controlId": "03.16.01", "title": "03.16.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589" } ], "id": 31916, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731291", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731291", "catalogueId": 1062, "uuid": "80ae1a91-7138-523b-bdc9-32523f9f79cc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify critical system components and functions by performing a criticality analysis for critical Technology Assets, Applications and/or Services (TAAS) at pre-defined decision points in the Secure Development Life Cycle (SDLC)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Security, Compliance & Resilience Requirements Definition", "description": "

Control Description

Mechanisms exist to identify critical system components and functions by performing a criticality analysis for critical Technology Assets, Applications and/or Services (TAAS) at pre-defined decision points in the Secure Development Life Cycle (SDLC).

Evidence Request List (ERL)

E-PRM-03\nE-PRM-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Project & Resource Management (PRM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Project management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel work with data/process owners to help ensure secure practices are implemented throughout the System Development Lifecycle (SDLC) for all high-value projects.

Level 2 - Planned & Tracked: Project & Resource Management (PRM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Project & Resource Management -related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Project & Resource Management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives and resourcing of the security function, based on broader business requirements.\n▪ A Project Management Office (PMO), or project management function, enables the implementation of cybersecurity and data protection-related resource planning controls across the System Development Lifecycle (SDLC) for all high-value projects.\n▪ The PM function enables project involvement for Information Assurance Program (IAP) as part of the organization's established project management processes to ensure both cybersecurity and data protection principles are identified and implemented.

Level 3 - Well Defined: Project & Resource Management (PRM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRM domain capabilities are well-documented and kept current by process owners.\n▪ A Project Management Office (PMO), or similar function, is appropriately staffed and supported to implement and maintain PRM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of project and resource management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives and resourcing of the security function, based on broader business requirements.\n▪ An implemented and operational capability exists to identify critical system components and functions by performing a criticality analysis for critical Technology Assets, Applications and/or Services (TAAS) at pre-defined decision points in the Secure Development Life Cycle (SDLC).

Level 4 - Quantitatively Controlled: Project & Resource Management (PRM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRM-05", "family": "Project & Resource Management", "enhancements": "", "sortId": "PRM-05", "references": "

Micro-Small Business (<10 staff)

∙ Defined technical requirements\n∙ Defined business requirements

Small Business (10-49 staff)

∙ Defined technical requirements\n∙ Defined business requirements

Medium Business (50-249 staff)

∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight

Large Business (250-999 staff)

∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight

Enterprise (>1,000 staff)

∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73685, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591096", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591096", "securityControlId": 31917, "ccis": [], "uuid": "6bf4df04-5e31-5c9e-96fb-2294d38b1827", "testId": "PRM-06_A01", "test": "organizational mission and business processes are defined with consideration for cybersecurity / data privacy.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-11a.[01]\n53A_R5_PM-11a.[02]", "defaultText": null }, { "id": 73686, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591097", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591097", "securityControlId": 31917, "ccis": [], "uuid": "bfe73139-e41a-544e-996b-5c7f00ea0105", "testId": "PRM-06_A02", "test": "organizational mission and business processes are defined with consideration for the resulting risk to organizational operations, organizational assets, individuals, other organizations and the Nation.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-11a.[03]", "defaultText": null }, { "id": 73687, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591101", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591101", "securityControlId": 31917, "ccis": [], "uuid": "a2a8906c-70eb-5be3-b9c1-15d6bbac456c", "testId": "PRM-06_A03", "test": "the frequency at which to review and revise the mission and business processes is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-11_ODP", "defaultText": null }, { "id": 73688, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591102", "securityControlId": 31917, "ccis": [], "uuid": "22bc3288-ba0e-59b0-a647-6f0c19240288", "testId": "PRM-06_A04", "test": "information protection needs arising from the defined mission and business processes are determined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-11b.[01]", "defaultText": null }, { "id": 73689, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591102", "securityControlId": 31917, "ccis": [], "uuid": "23385a75-d3bb-5547-a60b-1a66d501e478", "testId": "PRM-06_A05", "test": "Personal Data (PD) processing needs arising from the defined mission and business processes are determined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-11b.[02]", "defaultText": null }, { "id": 73690, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591102", "securityControlId": 31917, "ccis": [], "uuid": "5b306b48-e506-5aab-892a-e4862f097302", "testId": "PRM-06_A06", "test": "the mission and business processes are reviewed and revised per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-11c.", "defaultText": null } ], "externalMappings": [ { "id": 597877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da0b4d9f-8a60-5376-8db9-af2f12a3b438", "parentControlId": 31917, "controlId": "PM-11", "title": "PM-11", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589036" }, { "id": 597878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0caac646-5f7e-55a5-acbd-84d8bfb44e35", "parentControlId": 31917, "controlId": "PM-11", "title": "PM-11", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589036" }, { "id": 597880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13296985-2fd3-518f-88d8-214f256288af", "parentControlId": 31917, "controlId": "PM-11", "title": "PM-11", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589036" }, { "id": 597881, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ac40ae6-1e2f-51e7-99a2-0c9e02622e25", "parentControlId": 31917, "controlId": "PM-11", "title": "PM-11", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589036" }, { "id": 597882, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5adadd9d-c0c2-5c5e-ad1b-518b0e6b76a1", "parentControlId": 31917, "controlId": "PM-11", "title": "PM-11", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589036" }, { "id": 597883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a3f6eaa-cac4-52e1-8787-25df5f0519bf", "parentControlId": 31917, "controlId": "PM-11", "title": "PM-11", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589036" }, { "id": 597884, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589036", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "187fecd3-64ef-5c07-9c81-9d3cff5b8f02", "parentControlId": 31917, "controlId": "PM-11", "title": "PM-11", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589036" }, { "id": 597924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589043", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4fb0a30-29ae-5dfc-bd2d-ccc69c41b7c5", "parentControlId": 31917, "controlId": "ASSET-2d", "title": "ASSET-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589043" } ], "id": 31917, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731291", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731291", "catalogueId": 1062, "uuid": "376eb279-ab25-50db-b5c9-1b06e3770359", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define business processes with consideration for security, compliance and resilience that determines: \n(1) The resulting risk to organizational operations, assets, individuals and other organizations; and\n(2) Information protection needs arising from the defined business processes and revises the processes as necessary, until an achievable set of protection needs is obtained?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Business Process Definition", "description": "

Control Description

Mechanisms exist to define business processes with consideration for security, compliance and resilience that determines: \n(1) The resulting risk to organizational operations, assets, individuals and other organizations; and\n(2) Information protection needs arising from the defined business processes and revises the processes as necessary, until an achievable set of protection needs is obtained.

Evidence Request List (ERL)

E-PRM-03\nE-PRM-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Project & Resource Management (PRM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with PRM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Project management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel work with data/process owners to help ensure secure practices are implemented throughout the System Development Lifecycle (SDLC) for all high-value projects.

Level 2 - Planned & Tracked: Project & Resource Management (PRM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Project & Resource Management -related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Project & Resource Management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives and resourcing of the security function, based on broader business requirements.\n▪ A Project Management Office (PMO), or project management function, enables the implementation of cybersecurity and data protection-related resource planning controls across the System Development Lifecycle (SDLC) for all high-value projects.\n▪ The PM function enables project involvement for Information Assurance Program (IAP) as part of the organization's established project management processes to ensure both cybersecurity and data protection principles are identified and implemented.

Level 3 - Well Defined: Project & Resource Management (PRM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRM domain capabilities are well-documented and kept current by process owners.\n▪ A Project Management Office (PMO), or similar function, is appropriately staffed and supported to implement and maintain PRM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of project and resource management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives and resourcing of the security function, based on broader business requirements.\n▪ An implemented and operational capability exists to define business processes with consideration for security, compliance and resilience that determines: \n(1) The resulting risk to organizational operations, assets, individuals and other organizations; and\n(2) Information protection needs arising from the defined business processes and revises the processes as necessary, until an achievable set of protection needs is obtained.

Level 4 - Quantitatively Controlled: Project & Resource Management (PRM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRM-06", "family": "Project & Resource Management", "enhancements": "", "sortId": "PRM-06", "references": "

Micro-Small Business (<10 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements

Small Business (10-49 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements

Medium Business (50-249 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight

Large Business (250-999 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight

Enterprise (>1,000 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73691, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591102", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591103", "securityControlId": 31918, "ccis": [], "uuid": "a920ef10-d4c7-5023-9cde-09ce8aec9f7d", "testId": "PRM-07_A01", "test": "system development life cycle is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-03_ODP", "defaultText": null }, { "id": 73692, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591103", "securityControlId": 31918, "ccis": [], "uuid": "325dee11-b182-5b8f-8d11-7dc74092a692", "testId": "PRM-07_A02", "test": "the system is acquired, developed and managed using organization-defined system-development life cycle that incorporates information cybersecurity / data privacy considerations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-03a.[01]\n53A_R5_SA-03a.[02]", "defaultText": null }, { "id": 73693, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591103", "securityControlId": 31918, "ccis": [], "uuid": "813d6367-36f4-5138-a26f-01fc48d6e283", "testId": "PRM-07_A03", "test": "cybersecurity / data privacy roles and responsibilities are defined and documented throughout the system development life cycle.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-03b.[01]\n53A_R5_SA-03b.[02]", "defaultText": null }, { "id": 73694, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591103", "securityControlId": 31918, "ccis": [], "uuid": "3afa75b5-9242-5fa5-9c44-47527a7d9830", "testId": "PRM-07_A04", "test": "individuals with cybersecurity / data privacy roles and responsibilities are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-03c.[01]\n53A_R5_SA-03c.[02]", "defaultText": null }, { "id": 73695, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591103", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591103", "securityControlId": 31918, "ccis": [], "uuid": "dc339b5a-cee2-5c1c-9118-de1da48ab586", "testId": "PRM-07_A05", "test": "organizational cybersecurity / data privacy risk management processes are integrated into system development life cycle activities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-03d.[01]\n53A_R5_SA-03d.[02]", "defaultText": null }, { "id": 73696, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591104", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591104", "securityControlId": 31918, "ccis": [], "uuid": "df121afb-0b25-5121-b275-4477cd52d14f", "testId": "PRM-07_A06", "test": "system pre-production environments are protected commensurate with risk throughout the system development life cycle for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-03(01)", "defaultText": null }, { "id": 73697, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591104", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591104", "securityControlId": 31918, "ccis": [], "uuid": "7de198d5-a131-5d11-9d7b-d97af77162a2", "testId": "PRM-07_A07", "test": "systems or system components that implement the security design principle of procedural rigor are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08(30)_ODP", "defaultText": null }, { "id": 73698, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591104", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591104", "securityControlId": 31918, "ccis": [], "uuid": "0d4f1b9b-2d9a-505a-b189-302951d556d0", "testId": "PRM-07_A08", "test": "systems or system components implement the security design principle of procedural rigor.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08(30)", "defaultText": null } ], "externalMappings": [ { "id": 597991, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40fb9fdf-36d6-5428-851a-2813dec5fac5", "parentControlId": 31918, "controlId": "5.8", "title": "5.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589057" }, { "id": 597992, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7cac6f7a-7755-5987-865c-9477207aa284", "parentControlId": 31918, "controlId": "8.25", "title": "8.25", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589057" }, { "id": 597993, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589057", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac197c20-4cce-5436-9c0a-f24df0977cc2", "parentControlId": 31918, "controlId": "8.32", "title": "8.32", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589057" }, { "id": 598010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6e4e86b-c86c-5210-9333-e90046fd1dee", "parentControlId": 31918, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589059" }, { "id": 598011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aed8bf90-2654-5629-bc0b-b0994d3420a9", "parentControlId": 31918, "controlId": "T1078.001", "title": "T1078.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589059" }, { "id": 598012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73361d78-0cdc-5c69-b2a6-eb1fecaaf99a", "parentControlId": 31918, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589059" }, { "id": 598013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589059", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22437362-4b84-58de-9119-7ab386e69c04", "parentControlId": 31918, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589059" }, { "id": 598014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5dfb648-6d34-53b1-a76f-6cf3e4a5130a", "parentControlId": 31918, "controlId": "T1213.003", "title": "T1213.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58906" }, { "id": 598015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8c33b57-4a7f-5558-8ef5-97249a45e43e", "parentControlId": 31918, "controlId": "T1574.002", "title": "T1574.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58906" }, { "id": 598023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25385960-d9d4-5217-8d19-adc7d00aa4a3", "parentControlId": 31918, "controlId": "SA-3", "title": "SA-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589061" }, { "id": 598024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3406452f-8a62-5589-84ab-0ac9aaf75ba1", "parentControlId": 31918, "controlId": "SA-03", "title": "SA-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589061" }, { "id": 598025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9477b61c-ebbc-53a2-8967-d971ec9072eb", "parentControlId": 31918, "controlId": "SA-03(01)", "title": "SA-03(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589061" }, { "id": 598026, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f440292c-1491-5aa5-90f5-e88d1694610d", "parentControlId": 31918, "controlId": "SA-08(30)", "title": "SA-08(30)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589061" }, { "id": 598030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eacc8932-337b-5a43-9ade-d5080369ed9e", "parentControlId": 31918, "controlId": "SA-03", "title": "SA-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589062" }, { "id": 598031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b52ce6b2-000c-584f-8c3f-424b351c9407", "parentControlId": 31918, "controlId": "SA-03", "title": "SA-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589062" }, { "id": 598032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16517f86-849d-5d24-9fcc-5b27b8752dde", "parentControlId": 31918, "controlId": "SA-03(01)", "title": "SA-03(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589062" }, { "id": 598033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b40e74cc-158d-5db5-b2a6-eaa5416b1949", "parentControlId": 31918, "controlId": "SA-08(30)", "title": "SA-08(30)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589062" }, { "id": 598034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7d1cd61-ab23-5c90-8acd-830d6c7150e3", "parentControlId": 31918, "controlId": "SA-03", "title": "SA-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589062" }, { "id": 598035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75d8fae0-42f7-59c5-915b-d5e5ca626421", "parentControlId": 31918, "controlId": "SA-03", "title": "SA-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589062" }, { "id": 598036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9afb9b9b-58b3-5feb-87e3-07584d44236b", "parentControlId": 31918, "controlId": "SA-03", "title": "SA-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589062" }, { "id": 598037, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc6c70b7-649e-57eb-b44e-9ee5f7fb01e6", "parentControlId": 31918, "controlId": "SA-3", "title": "SA-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589062" }, { "id": 598038, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0208096-6f94-56f0-88e8-e527829be30a", "parentControlId": 31918, "controlId": "SA-3", "title": "SA-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589062" }, { "id": 598042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b05ff1af-e08d-5382-bbc9-90738b72b7c9", "parentControlId": 31918, "controlId": "NFO - SA-3", "title": "NFO - SA-3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589066" }, { "id": 598044, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7bd4b23c-6b48-5749-a07c-f4d8a6c10d81", "parentControlId": 31918, "controlId": "GV.SC-09", "title": "GV.SC-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589066" }, { "id": 598045, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49861ea1-09aa-55ea-bd44-be7c08e51d8e", "parentControlId": 31918, "controlId": "ID.AM-08", "title": "ID.AM-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589066" }, { "id": 598046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589066", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be252a1b-7a4c-58a3-8a0a-a2589fc9f729", "parentControlId": 31918, "controlId": "PR.PS-02", "title": "PR.PS-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589066" }, { "id": 598047, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589067", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9571610f-d875-56c1-a600-9ad16cb3e989", "parentControlId": 31918, "controlId": "PR.PS-03", "title": "PR.PS-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589067" }, { "id": 598081, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589071", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b23fb8b5-904c-5db8-90ff-c2193eae0c27", "parentControlId": 31918, "controlId": "§117.18(d)", "title": "§117.18(d)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589071" }, { "id": 598082, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589071", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4836808-c9b6-593a-9349-8f13241d04bc", "parentControlId": 31918, "controlId": "§117.18(d)(1)", "title": "§117.18(d)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589071" }, { "id": 598083, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589071", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65781f38-da98-5d40-aa38-18be948190b8", "parentControlId": 31918, "controlId": "§117.18(d)(2)", "title": "§117.18(d)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589071" }, { "id": 598084, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589071", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09023c0a-70e3-5939-aaf6-9302beead5b7", "parentControlId": 31918, "controlId": "§117.18(d)(3)", "title": "§117.18(d)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589071" } ], "id": 31918, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731291", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731291", "catalogueId": 1062, "uuid": "8f30e7c3-7208-537e-9e11-3d30b1426e03", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure changes to Technology Assets, Applications and/or Services (TAAS) within the Secure Development Life Cycle (SDLC) are controlled through formal change control procedures?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Secure Development Life Cycle (SDLC) Management", "description": "

Control Description

Mechanisms exist to ensure changes to Technology Assets, Applications and/or Services (TAAS) within the Secure Development Life Cycle (SDLC) are controlled through formal change control procedures.

Evidence Request List (ERL)

E-PRM-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Project & Resource Management (PRM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with PRM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Project & Resource Management -related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Project & Resource Management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives and resourcing of the security function, based on broader business requirements.\n▪ A Project Management Office (PMO), or project management function, enables the implementation of cybersecurity and data protection-related resource planning controls across the System Development Lifecycle (SDLC) for all high-value projects.\n▪ The PM function enables project involvement for Information Assurance Program (IAP) as part of the organization's established project management processes to ensure both cybersecurity and data protection principles are identified and implemented.

Level 3 - Well Defined: Project & Resource Management (PRM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with PRM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with PRM domain capabilities are well-documented and kept current by process owners.\n▪ A Project Management Office (PMO), or similar function, is appropriately staffed and supported to implement and maintain PRM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of project and resource management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ The Chief Information Officer (CIO), or similar function, analyzes the organization's business strategy and prioritizes the objectives and resourcing of the security function, based on broader business requirements.\n▪ An implemented and operational capability exists to ensure changes to Technology Assets, Applications and/or Services (TAAS) within the Secure Development Life Cycle (SDLC) are controlled through formal change control procedures.

Level 4 - Quantitatively Controlled: Project & Resource Management (PRM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "PRM-07", "family": "Project & Resource Management", "enhancements": "", "sortId": "PRM-07", "references": "

Micro-Small Business (<10 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements

Small Business (10-49 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements

Medium Business (50-249 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight

Large Business (250-999 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight

Enterprise (>1,000 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73702, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591105", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591105", "securityControlId": 31920, "ccis": [], "uuid": "119eaa19-5ff8-57c2-ba81-cf5eea1b0aa3", "testId": "RSK-01_A01", "test": "a comprehensive strategy is developed to manage cybersecurity / data privacy risk to organizational operations and assets, individuals and other organizations associated with the operation and use of organizational systems.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-09a.01\n53A_R5_PM-09a.02", "defaultText": null }, { "id": 73703, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591105", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591105", "securityControlId": 31920, "ccis": [], "uuid": "79e441cd-8f1b-5eb1-a96b-883273aa3575", "testId": "RSK-01_A02", "test": "the risk management strategy is implemented consistently across the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-09b.", "defaultText": null }, { "id": 73704, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591105", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591105", "securityControlId": 31920, "ccis": [], "uuid": "121ade0b-143f-53ed-b079-345f8e1bfaec", "testId": "RSK-01_A03", "test": "a senior organizational position for Risk Management aligns cybersecurity / data privacy management processes with strategic, operational and budgetary planning processes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-29a.[02]", "defaultText": null }, { "id": 73705, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591105", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591105", "securityControlId": 31920, "ccis": [], "uuid": "600d805c-7af3-513b-beaf-b8e4fc411de7", "testId": "RSK-01_A04", "test": "for existing facilities, physical and environmental hazards are considered in the organizational risk management strategy.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-23b.", "defaultText": null }, { "id": 73706, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591106", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591106", "securityControlId": 31920, "ccis": [], "uuid": "39e899a0-4a31-55bd-bc92-dda3c4c427b2", "testId": "RSK-01_A05", "test": "the frequency at which to review / update the risk management strategy is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-09_ODP", "defaultText": null }, { "id": 73707, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591106", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591106", "securityControlId": 31920, "ccis": [], "uuid": "7e34a22f-819b-52dc-bcd6-947a67255d4e", "testId": "RSK-01_A06", "test": "the risk management strategy is reviewed / updated per an organization-defined frequency or as required to address organizational changes.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-09c.", "defaultText": null }, { "id": 73708, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591106", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591106", "securityControlId": 31920, "ccis": [], "uuid": "98664d01-f0e2-5784-a255-588e79db36e1", "testId": "RSK-01_A07", "test": "a senior organizational position for Risk Management is appointed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-29a.[01]", "defaultText": null }, { "id": 73709, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591106", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591106", "securityControlId": 31920, "ccis": [], "uuid": "85cd543e-558d-59dd-9ee4-85c51c0ed825", "testId": "RSK-01_A08", "test": "a risk executive function is established.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-29b.[01]", "defaultText": null }, { "id": 73710, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591106", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591106", "securityControlId": 31920, "ccis": [], "uuid": "f057d3aa-ec07-5759-9aa7-e9d4839a33df", "testId": "RSK-01_A09", "test": "a risk executive function views and analyzes risk from an organization-wide perspective.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-29b.[02]", "defaultText": null }, { "id": 73711, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591106", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591106", "securityControlId": 31920, "ccis": [], "uuid": "7c3460b5-db91-5004-b749-bc69158cdb6a", "testId": "RSK-01_A10", "test": "a risk executive function ensures that the management of risk is consistent across the organization.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-29b.[03]", "defaultText": null }, { "id": 73712, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591107", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591107", "securityControlId": 31920, "ccis": [], "uuid": "2d78097a-ef9b-5d5c-846c-a10b2b19ed15", "testId": "RSK-01_A11", "test": "organization-defined security requirements are enforced to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences of supply chain-related events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 73713, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591107", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591107", "securityControlId": 31920, "ccis": [], "uuid": "fe4ef680-cb60-572e-b34a-a1c49aa36f88", "testId": "RSK-01_A12", "test": "the following security requirements are enforced to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences of supply chain-related events: .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at a minimum, integrate Supply Chain Risk Management (SCRM) into acquisition/procurement policies, provide adequate SCRM resources, define the SCRM control baseline, establish processes to ensure suppliers disclose significant vulnerabilities and significant incidents", "otherId": "171A_R3_A.03.17.03.b", "defaultText": null }, { "id": 73714, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591107", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591107", "securityControlId": 31920, "ccis": [], "uuid": "6213f532-eb0b-5e3f-a900-8b0f6df1f49d", "testId": "RSK-01_A13", "test": "risk management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73715, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591107", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591107", "securityControlId": 31920, "ccis": [], "uuid": "41248a55-a1a6-560f-9eea-69aa64543774", "testId": "RSK-01_A14", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support risk management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73716, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591107", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591107", "securityControlId": 31920, "ccis": [], "uuid": "71bceafe-b2de-530f-bb0a-63b6c764d0b4", "testId": "RSK-01_A15", "test": "responsibility and authority for the performance of risk management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73717, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591108", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591108", "securityControlId": 31920, "ccis": [], "uuid": "68d321e3-f7df-5b62-8717-cc4e498bca33", "testId": "RSK-01_A16", "test": "personnel performing risk management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 598176, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589095", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e600866-2f5b-539e-976c-fe1d1e27b044", "parentControlId": 31920, "controlId": "ORG 2.1", "title": "ORG 2.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589095" }, { "id": 598179, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589095", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16993663-f8c6-5a83-8a56-ec6ebfa3b2e8", "parentControlId": 31920, "controlId": "6.1.1", "title": "6.1.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589095" }, { "id": 598180, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589095", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1f94e05-53d3-5ff6-8c08-549683b60486", "parentControlId": 31920, "controlId": "6.1.1(a)", "title": "6.1.1(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589095" }, { "id": 598181, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589095", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc0be949-fd22-5cb2-9ac1-f44941667930", "parentControlId": 31920, "controlId": "6.1.1(b)", "title": "6.1.1(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589095" }, { "id": 598182, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5528ba10-1753-559f-ace0-e1631e97a6c0", "parentControlId": 31920, "controlId": "6.1.1(c)", "title": "6.1.1(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589096" }, { "id": 598183, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de8e91e2-6723-577f-9c05-7660b580de89", "parentControlId": 31920, "controlId": "6.1.1(d)", "title": "6.1.1(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589096" }, { "id": 598184, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a97343f0-d797-533e-ae7f-1a24181e595a", "parentControlId": 31920, "controlId": "6.1.1(e)(1)", "title": "6.1.1(e)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589096" }, { "id": 598185, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "072d387c-2408-57bd-836f-91689bed82a0", "parentControlId": 31920, "controlId": "6.1.1(e)(2)", "title": "6.1.1(e)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589096" }, { "id": 598186, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d46dd39-aa41-5353-bdd0-1232312a0de2", "parentControlId": 31920, "controlId": "6.1.2", "title": "6.1.2", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589096" }, { "id": 598187, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c86d56b7-8b30-5a5c-8973-67ec605d41bb", "parentControlId": 31920, "controlId": "6.1.2(a)", "title": "6.1.2(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589096" }, { "id": 598188, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e34b656d-4c24-5d82-ae0a-9fc3d0abfd81", "parentControlId": 31920, "controlId": "6.1.2(a)(1)", "title": "6.1.2(a)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589096" }, { "id": 598189, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65bc9563-6be9-51e6-9f9b-35b813e70c03", "parentControlId": 31920, "controlId": "6.1.2(a)(2)", "title": "6.1.2(a)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589096" }, { "id": 598190, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589096", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e386160-06be-5e61-bce6-56a92c7c8ac0", "parentControlId": 31920, "controlId": "6.1.2(b)", "title": "6.1.2(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589096" }, { "id": 598191, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589098", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "484e9680-6130-5d17-9568-a2fe2295422e", "parentControlId": 31920, "controlId": "6.1.2(c)", "title": "6.1.2(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589098" }, { "id": 598192, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee2cf2ff-e860-5490-8dc0-1a6697641d21", "parentControlId": 31920, "controlId": "6.1.2(c)(1)", "title": "6.1.2(c)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589099" }, { "id": 598193, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd5c23ae-fe40-5b56-a747-e9e71f7afaf4", "parentControlId": 31920, "controlId": "6.1.2(c)(2)", "title": "6.1.2(c)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589099" }, { "id": 598194, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c3adca5-9550-5fb2-8ee9-16ec65e18238", "parentControlId": 31920, "controlId": "6.1.2(d)", "title": "6.1.2(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589099" }, { "id": 598195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "429e2ac2-1095-5d22-ac3c-0329c72a1724", "parentControlId": 31920, "controlId": "6.1.2(d)(1)", "title": "6.1.2(d)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589099" }, { "id": 598196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7dc79bc-7b82-528f-8159-fd0f7f181b9f", "parentControlId": 31920, "controlId": "6.1.2(d)(2)", "title": "6.1.2(d)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589099" }, { "id": 598197, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56ad7e7a-b509-56f2-9404-e3fdaee87367", "parentControlId": 31920, "controlId": "6.1.2(d)(3)", "title": "6.1.2(d)(3)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589099" }, { "id": 598198, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d07cd9d-aa65-5437-b1fd-8bc76e60d877", "parentControlId": 31920, "controlId": "6.1.2(e)", "title": "6.1.2(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589099" }, { "id": 598199, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2870588-0678-547d-9c49-3553b27ae5cc", "parentControlId": 31920, "controlId": "6.1.2(e)(1)", "title": "6.1.2(e)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589099" }, { "id": 598200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4297704-4019-539c-8cd0-3aea5b8ea1d6", "parentControlId": 31920, "controlId": "6.1.2(e)(2)", "title": "6.1.2(e)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5891" }, { "id": 598201, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fdce658-a68b-5e6d-852a-c4f9e619da05", "parentControlId": 31920, "controlId": "8.2", "title": "8.2", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5891" }, { "id": 598202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ed91041-2a00-5563-8674-e1eca65ec490", "parentControlId": 31920, "controlId": "7.5", "title": "7.5", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5891" }, { "id": 598259, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589108", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f75f3a7-9024-5757-a2eb-e0dbb3ba8813", "parentControlId": 31920, "controlId": "PM-9", "title": "PM-9", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589108" }, { "id": 598260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589108", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "500b53b6-aa20-5905-9e53-36910a0c2ed1", "parentControlId": 31920, "controlId": "RA-1", "title": "RA-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589108" }, { "id": 598261, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9755d9e0-c6f3-55d2-89b0-327243ffd100", "parentControlId": 31920, "controlId": "PM-09", "title": "PM-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589109" }, { "id": 598262, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ca22fea-7fc4-5c87-939d-e9d1adf2ef3f", "parentControlId": 31920, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589109" }, { "id": 598263, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fad5f5db-8a92-5661-8b3b-26d172225b20", "parentControlId": 31920, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589109" }, { "id": 598267, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df80058a-428d-54ba-9d57-12bc7096cc03", "parentControlId": 31920, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589109" }, { "id": 598268, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589109", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c71fe3af-0ecc-55d3-818b-4514e3a50eba", "parentControlId": 31920, "controlId": "PM-09", "title": "PM-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589109" }, { "id": 598269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d6866f9-64a2-5008-909a-d8ceb40e2dbb", "parentControlId": 31920, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58911" }, { "id": 598270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4799564b-dabd-5879-b38d-5331a791ed03", "parentControlId": 31920, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58911" }, { "id": 598271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe191f51-d2c8-5c66-afb9-80a2d6856b79", "parentControlId": 31920, "controlId": "PM-09", "title": "PM-09", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58911" }, { "id": 598272, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a940709d-3789-5801-990e-031a5497c86d", "parentControlId": 31920, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58911" }, { "id": 598273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6af009a-8e9d-58d6-a498-c38bad74e06f", "parentControlId": 31920, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58911" }, { "id": 598274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e08ccde7-07d3-5160-8ce9-cc42c1c6920f", "parentControlId": 31920, "controlId": "PM-09", "title": "PM-09", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58911" }, { "id": 598275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05f7d5b4-1eba-5e84-bb0e-89bfca881486", "parentControlId": 31920, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58911" }, { "id": 598276, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf152a1c-50fc-5a8f-b3fa-b1d8b7d2736a", "parentControlId": 31920, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58911" }, { "id": 598277, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40030fff-2f3d-5377-9917-760208a02ef6", "parentControlId": 31920, "controlId": "PM-09", "title": "PM-09", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58911" }, { "id": 598278, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b163cde-14af-57d4-b28c-e58d41a959be", "parentControlId": 31920, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589111" }, { "id": 598279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e064843f-6d73-5685-87ca-4ff29e8fc307", "parentControlId": 31920, "controlId": "RA-01", "title": "RA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589111" }, { "id": 598280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3368b5e-cb6d-564f-a3eb-76922294c99f", "parentControlId": 31920, "controlId": "PM-9", "title": "PM-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589111" }, { "id": 598281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "facc0490-e06f-5312-a4e2-9bb08f1f959a", "parentControlId": 31920, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589111" }, { "id": 598282, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bec0e8f6-cf9c-5b22-8102-7c85fc69152d", "parentControlId": 31920, "controlId": "RA-1", "title": "RA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589111" }, { "id": 598283, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589111", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8484269d-f8ac-5227-9431-2e7fe355f50e", "parentControlId": 31920, "controlId": "RA-1", "title": "RA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589111" }, { "id": 598289, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589112", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ea84d26-9c24-5b7f-aec5-a59b75dfad5d", "parentControlId": 31920, "controlId": "NFO - RA-1", "title": "NFO - RA-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589112" }, { "id": 598290, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589112", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc328873-50d4-56bf-8309-6f3edc8737c6", "parentControlId": 31920, "controlId": "03.11.01.a", "title": "03.11.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589112" }, { "id": 598291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589114", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73e46649-13e1-51b3-9b97-23c357ff1c59", "parentControlId": 31920, "controlId": "03.17.01.a", "title": "03.17.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589114" }, { "id": 598293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589114", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a36b77fd-5759-58f9-a858-ff9565458e8f", "parentControlId": 31920, "controlId": "GV", "title": "GV", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589114" }, { "id": 598294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589114", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc487e59-3cdf-5277-9095-adda39efd5b2", "parentControlId": 31920, "controlId": "GV.RM", "title": "GV.RM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589114" }, { "id": 598295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589114", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b22ea32c-bfce-5b6b-8209-3bcd1792bede", "parentControlId": 31920, "controlId": "GV.RM-01", "title": "GV.RM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589114" }, { "id": 598296, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589115", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6f0945b-7ad9-51fa-83d4-c330008b0a19", "parentControlId": 31920, "controlId": "GV.RM-03", "title": "GV.RM-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589115" }, { "id": 598297, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589115", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7d6ec27-8817-52bc-a898-a37920bb3ac7", "parentControlId": 31920, "controlId": "GV.RM-04", "title": "GV.RM-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589115" }, { "id": 598298, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589115", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a78d277a-311e-5036-aec5-48f8237a825d", "parentControlId": 31920, "controlId": "GV.RM-06", "title": "GV.RM-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589115" }, { "id": 598299, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589115", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14b8eb24-fb4c-5f01-9374-2b86c88eea5a", "parentControlId": 31920, "controlId": "GV.RR-01", "title": "GV.RR-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589115" }, { "id": 598300, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589115", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5e3780a-8907-5a7e-b999-e3f471bfcc65", "parentControlId": 31920, "controlId": "GV.OV-02", "title": "GV.OV-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589115" }, { "id": 598301, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589115", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ccdd0d65-9b24-5ae7-8d64-c72d7c640895", "parentControlId": 31920, "controlId": "GV.OV-03", "title": "GV.OV-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589115" }, { "id": 598302, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589115", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d78a60d2-93c3-5303-a025-112db8d3dda4", "parentControlId": 31920, "controlId": "GV.SC", "title": "GV.SC", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589115" }, { "id": 598303, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589116", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14dbbebf-0964-512c-9ebc-1c17475f7044", "parentControlId": 31920, "controlId": "GV.SC-01", "title": "GV.SC-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589116" }, { "id": 598304, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589116", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "767b22d5-7eef-553c-a38b-5cb0b794690f", "parentControlId": 31920, "controlId": "GV.SC-03", "title": "GV.SC-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589116" }, { "id": 598305, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589116", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb21f24b-0295-56e4-ba2f-ac5f1b42004c", "parentControlId": 31920, "controlId": "GV.SC-05", "title": "GV.SC-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589116" }, { "id": 598306, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589116", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5624676d-9f09-5fee-9ea4-692f70b10e57", "parentControlId": 31920, "controlId": "GV.SC-09", "title": "GV.SC-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589116" }, { "id": 598307, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589116", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d041099-aa9f-5a40-a40d-4a7158f90ef8", "parentControlId": 31920, "controlId": "ID", "title": "ID", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589116" }, { "id": 598308, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589116", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d378acf-fd66-5113-95b1-4923c42635e3", "parentControlId": 31920, "controlId": "ID.RA", "title": "ID.RA", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589116" }, { "id": 598309, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589116", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c458c991-5134-5770-b374-d8f78044e5b9", "parentControlId": 31920, "controlId": "ID.IM", "title": "ID.IM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589116" }, { "id": 598310, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589116", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4519b71-9701-5653-922c-c2eee2ce226b", "parentControlId": 31920, "controlId": "PR", "title": "PR", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589116" }, { "id": 598311, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589116", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0568fcc5-b621-56a2-b270-4317da5fdf97", "parentControlId": 31920, "controlId": "PR.IR", "title": "PR.IR", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589116" }, { "id": 598330, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589119", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f81288f5-6ddf-5d53-8412-3075973801b1", "parentControlId": 31920, "controlId": "RISK-1b", "title": "RISK-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589119" }, { "id": 598331, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589119", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "505ea95a-d8a2-5f2e-b604-242baf486029", "parentControlId": 31920, "controlId": "RISK-1c", "title": "RISK-1c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589119" }, { "id": 598332, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589119", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7e9965c-b2a5-51e9-8e95-6631d17d3199", "parentControlId": 31920, "controlId": "RISK-1d", "title": "RISK-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589119" }, { "id": 598333, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1d8289e-bfcc-58d2-854f-dde8180ec60d", "parentControlId": 31920, "controlId": "RISK-1g", "title": "RISK-1g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58912" }, { "id": 598334, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "667795ca-9114-5d2b-bf9b-b3cdd406a331", "parentControlId": 31920, "controlId": "RISK-1h", "title": "RISK-1h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58912" }, { "id": 598361, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589125", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ac541a5-3c4f-52df-ab14-629c913682f1", "parentControlId": 31920, "controlId": "CIP-013-2 1.1", "title": "CIP-013-2 1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589125" }, { "id": 598459, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589142", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "661e2636-cea7-5b5f-a9a1-7d0655df7bb7", "parentControlId": 31920, "controlId": "A2", "title": "A2", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589143" }, { "id": 598460, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589143", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f47406e6-4fc4-55fa-b6a1-ec2039dd0aad", "parentControlId": 31920, "controlId": "A2.a", "title": "A2.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589143" }, { "controlId": "NSS-17T-Sec4.2", "title": "NSS-17T-Sec4.2 — Design Basis Threat (DBT) Cyber Risk & Attack Vector Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "ba76eff4-bee8-5fec-b7aa-8c812dd1cc53", "isPublic": true }, { "controlId": "IEC-62645-5.3", "title": "IEC-62645-5.3 — Nuclear Cyber Risk Assessment & Graded Approach", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "ff100bbd-359c-5117-b6a1-9631934ff8ea", "isPublic": true }, { "controlId": "10-CFR-73.100(a)", "title": "10-CFR-73.100(a) — Risk-Informed, Consequence-Oriented Cyber Protection Standard", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "a28392ca-1f7a-5907-9fa8-963f4d6113d3", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.b", "title": "DOE-O-205.1D-4.b — Risk Management Framework (RMF) for Nuclear & High-Consequence Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "c3848529-30ce-50ae-8bbd-0e0e6d082008", "isPublic": true } ], "id": 31920, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731292", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731292", "catalogueId": 1062, "uuid": "d2311188-b220-5a3b-a8fe-36cc6010a877", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of strategic, operational and tactical risk management controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Risk Management Program", "description": "

Control Description

Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls.

Evidence Request List (ERL)

E-RSK-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Risk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of strategic, operational and tactical risk management controls.

Level 4 - Quantitatively Controlled: Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-01", "family": "Risk Management", "enhancements": "", "sortId": "RSK-01", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73718, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591108", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591108", "securityControlId": 31921, "ccis": [], "uuid": "9130df90-b990-5082-b11d-adb7779db84b", "testId": "RSK-01.1_A01", "test": "the personnel to receive the results of risk framing activities is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-28_ODP[01]", "defaultText": null }, { "id": 73719, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591108", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591108", "securityControlId": 31921, "ccis": [], "uuid": "76306400-6583-5606-b02f-16b27d57253c", "testId": "RSK-01.1_A02", "test": "the frequency for reviewing and updating risk framing considerations is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PM-28_ODP[02]", "defaultText": null }, { "id": 73720, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591108", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591108", "securityControlId": 31921, "ccis": [], "uuid": "ade47b78-abaa-5e28-8c4a-35c8236983bb", "testId": "RSK-01.1_A03", "test": "assumptions affecting risk assessments are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-28a.01[01]", "defaultText": null }, { "id": 73721, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591108", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591108", "securityControlId": 31921, "ccis": [], "uuid": "4d342598-517b-5017-8878-312f18e4a04a", "testId": "RSK-01.1_A04", "test": "assumptions affecting risk responses are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-28a.01[02]", "defaultText": null }, { "id": 73722, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591109", "securityControlId": 31921, "ccis": [], "uuid": "c5e5a8b6-dbdd-5f48-a309-d357ef9562c7", "testId": "RSK-01.1_A05", "test": "assumptions affecting risk monitoring are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-28a.01[03]", "defaultText": null }, { "id": 73723, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591109", "securityControlId": 31921, "ccis": [], "uuid": "f7d76fb0-5c2c-5d04-9a24-2976cea4e545", "testId": "RSK-01.1_A06", "test": "constraints affecting risk assessments are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-28a.02[01]", "defaultText": null }, { "id": 73724, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591109", "securityControlId": 31921, "ccis": [], "uuid": "84f39381-cf06-51e3-807f-6eb03d6251e2", "testId": "RSK-01.1_A07", "test": "constraints affecting risk responses are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-28a.02[02]", "defaultText": null }, { "id": 73725, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591109", "securityControlId": 31921, "ccis": [], "uuid": "4f12de9c-dda6-5404-a966-f63092cf0303", "testId": "RSK-01.1_A08", "test": "constraints affecting risk monitoring are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-28a.02[03]", "defaultText": null }, { "id": 73726, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591109", "securityControlId": 31921, "ccis": [], "uuid": "f146fc5b-b08d-5843-a788-9fcae8a1c493", "testId": "RSK-01.1_A09", "test": "priorities considered by the organization for managing risk are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-28a.03[01]", "defaultText": null }, { "id": 73727, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591109", "securityControlId": 31921, "ccis": [], "uuid": "8e1ab47b-cb59-52df-aa33-0cf521997174", "testId": "RSK-01.1_A10", "test": "trade-offs considered by the organization for managing risk are identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-28a.03[02]", "defaultText": null }, { "id": 73728, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591109", "securityControlId": 31921, "ccis": [], "uuid": "c1f08b6d-ca83-5562-b2d2-92f2cc8140bb", "testId": "RSK-01.1_A11", "test": "organizational risk tolerance is identified and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-28a.04", "defaultText": null }, { "id": 73729, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591109", "securityControlId": 31921, "ccis": [], "uuid": "2046015c-265c-5a7b-971c-9ba73875777d", "testId": "RSK-01.1_A12", "test": "the results of risk framing activities are distributed to personnel.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-28b.", "defaultText": null }, { "id": 73730, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591109", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591109", "securityControlId": 31921, "ccis": [], "uuid": "89543eb0-7e60-55fd-8b0c-c3f12522cc6c", "testId": "RSK-01.1_A13", "test": "risk framing considerations are reviewed / updated frequently.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-28c.", "defaultText": null }, { "id": 73731, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59111", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59111", "securityControlId": 31921, "ccis": [], "uuid": "5fc97f92-f750-5a00-be52-dc99815aa651", "testId": "RSK-01.1_A14", "test": "the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of sensitive / regulated data is assessed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 73732, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59111", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59111", "securityControlId": 31921, "ccis": [], "uuid": "071febc1-ea81-5c09-aa2d-36e0df501e10", "testId": "RSK-01.1_A15", "test": "the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI is assessed.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.11.01.a", "defaultText": null } ], "externalMappings": [ { "id": 598535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4df0481b-af19-5928-a8f8-9deca79d8e6f", "parentControlId": 31921, "controlId": "6.1.2", "title": "6.1.2", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589167" }, { "id": 598536, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ead66b6-ceb0-5182-be5b-cc7f554204ce", "parentControlId": 31921, "controlId": "6.1.2(a)", "title": "6.1.2(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589167" }, { "id": 598537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01a366e5-428b-5ef5-8d76-2b14ace7e6d2", "parentControlId": 31921, "controlId": "6.1.2(a)(1)", "title": "6.1.2(a)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589167" }, { "id": 598538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b42f15f4-ca6d-5054-a1fc-fea1ae8a2e8d", "parentControlId": 31921, "controlId": "6.1.2(a)(2)", "title": "6.1.2(a)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589167" }, { "id": 598539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a38358f-d8a0-5a78-86ea-e5a13100545c", "parentControlId": 31921, "controlId": "6.1.2(b)", "title": "6.1.2(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589167" }, { "id": 598540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589167", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "203bf8e0-0f1c-56b0-8fd7-a4967d5bc1e2", "parentControlId": 31921, "controlId": "6.1.2(c)", "title": "6.1.2(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589167" }, { "id": 598541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14f8d18d-5dc4-54fe-9298-aeef507e69df", "parentControlId": 31921, "controlId": "6.1.2(c)(1)", "title": "6.1.2(c)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58917" }, { "id": 598542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6a97479-34dd-5987-a34b-1b50131a08fd", "parentControlId": 31921, "controlId": "6.1.2(c)(2)", "title": "6.1.2(c)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58917" }, { "id": 598543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d4f842b-aee4-5851-a61c-f57aad18d20d", "parentControlId": 31921, "controlId": "6.1.2(d)", "title": "6.1.2(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58917" }, { "id": 598544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2dab7b92-7e79-5448-aaf6-996e8a12ca64", "parentControlId": 31921, "controlId": "6.1.2(d)(1)", "title": "6.1.2(d)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58917" }, { "id": 598545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cff9180-1aa3-50b8-8f1e-80e0fa3a3e59", "parentControlId": 31921, "controlId": "6.1.2(d)(2)", "title": "6.1.2(d)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58917" }, { "id": 598546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f5aac93-1398-5fe0-b40a-a3e36bda8e80", "parentControlId": 31921, "controlId": "6.1.2(d)(3)", "title": "6.1.2(d)(3)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58917" }, { "id": 598547, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "627629ec-c636-50ed-b272-92bb8c7b9414", "parentControlId": 31921, "controlId": "6.1.2(e)", "title": "6.1.2(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58917" }, { "id": 598548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55f8faa3-c1dd-551c-8895-542acd78f948", "parentControlId": 31921, "controlId": "6.1.2(e)(1)", "title": "6.1.2(e)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589171" }, { "id": 598549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "926f613b-3d19-5dd9-87df-abe60a4f53a3", "parentControlId": 31921, "controlId": "6.1.2(e)(2)", "title": "6.1.2(e)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589171" }, { "id": 598550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589171", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a5b1e14-1ddb-5a7f-9684-2987b7279ca3", "parentControlId": 31921, "controlId": "5.8", "title": "5.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589171" }, { "id": 598581, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589174", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee1c9442-9398-5891-ab8e-27c073202e8d", "parentControlId": 31921, "controlId": "PM-28", "title": "PM-28", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589174" }, { "id": 598583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589175", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbaec755-cb47-58a6-93c5-e33c5463f40d", "parentControlId": 31921, "controlId": "PM-28", "title": "PM-28", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589175" }, { "id": 598584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589175", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a25557d4-8d34-5535-b361-885986a396ca", "parentControlId": 31921, "controlId": "PM-28", "title": "PM-28", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589175" }, { "id": 598585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589175", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b221b648-8949-5122-a006-8bab5f84cbd6", "parentControlId": 31921, "controlId": "PM-28", "title": "PM-28", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589175" }, { "id": 598586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589175", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "902d4b76-118b-53b6-8191-2740d71aac0c", "parentControlId": 31921, "controlId": "PM-28", "title": "PM-28", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589175" }, { "id": 598587, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589175", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08e1718f-5791-577c-adc7-4aa1db3afe9a", "parentControlId": 31921, "controlId": "PM-28", "title": "PM-28", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589175" }, { "id": 598589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589175", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "382865d9-292d-5317-a0e1-0a7157494fb7", "parentControlId": 31921, "controlId": "03.11.01.a", "title": "03.11.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589175" }, { "id": 598591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589179", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36a310a2-1d20-54be-b7c7-e363722a2935", "parentControlId": 31921, "controlId": "GV.OC-01", "title": "GV.OC-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589179" }, { "id": 598592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589179", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6d97a4f-358b-5407-8e05-1eb7b1efa768", "parentControlId": 31921, "controlId": "GV.RM", "title": "GV.RM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58918" }, { "id": 598593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58918", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10e60196-7a20-5f4b-946a-07c282479035", "parentControlId": 31921, "controlId": "GV.RM-04", "title": "GV.RM-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58918" }, { "id": 598594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58918", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59ebe588-625b-5e0a-a7b0-fb03769f2beb", "parentControlId": 31921, "controlId": "GV.RM-06", "title": "GV.RM-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58918" }, { "id": 598595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58918", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93a06c2a-1ec6-528f-95ca-2876be05e53b", "parentControlId": 31921, "controlId": "GV.RM-07", "title": "GV.RM-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58918" }, { "id": 598596, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58918", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4867518-1d75-57bf-9f7f-f51646eb4165", "parentControlId": 31921, "controlId": "ID", "title": "ID", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58918" }, { "id": 598597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58918", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92c7652d-64ae-5da0-b4a6-86ffe829ec57", "parentControlId": 31921, "controlId": "ID.RA-05", "title": "ID.RA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58918" }, { "id": 598598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58918", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fabf01f9-45dc-5ddc-8bfd-4c11e1a9320d", "parentControlId": 31921, "controlId": "ID.RA-06", "title": "ID.RA-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58918" }, { "id": 598610, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f09f0143-55ed-537b-8c88-f21eb36f020d", "parentControlId": 31921, "controlId": "RISK-2m", "title": "RISK-2m", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589182" }, { "id": 598611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7bb0ea4f-0e63-52ed-9925-5af16396a476", "parentControlId": 31921, "controlId": "RISK-3b", "title": "RISK-3b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589182" }, { "id": 598612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c68dfc41-08b9-5b2d-86a8-82b9cf324df4", "parentControlId": 31921, "controlId": "SITUATION-2h", "title": "SITUATION-2h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589182" } ], "id": 31921, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731292", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731292", "catalogueId": 1062, "uuid": "56982e0d-fd71-5f6e-a1ac-7aac6559346b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify:\n (1) Assumptions affecting risk assessments, risk response and risk monitoring;\n (2) Constraints affecting risk assessments, risk response and risk monitoring;\n (3) The organizational risk tolerance; and\n (4) Priorities, benefits and trade-offs considered by the organization for managing risk?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Risk Framing", "description": "

Control Description

Mechanisms exist to identify:\n(1) Assumptions affecting risk assessments, risk response and risk monitoring;\n(2) Constraints affecting risk assessments, risk response and risk monitoring;\n(3) The organizational risk tolerance; and\n(4) Priorities, benefits and trade-offs considered by the organization for managing risk.

Evidence Request List (ERL)

E-RSK-01\nE-RSK-06\nE-RSK-07\nE-RSK-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify:\n(1) Assumptions affecting risk assessments, risk response and risk monitoring;\n(2) Constraints affecting risk assessments, risk response and risk monitoring;\n(3) The organizational risk tolerance; and\n(4) Priorities, benefits and trade-offs considered by the organization for managing risk.

Level 4 - Quantitatively Controlled: Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-01.1", "family": "Risk Management", "enhancements": "", "sortId": "RSK-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73736, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591111", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591111", "securityControlId": 31923, "ccis": [], "uuid": "a0d80d0a-5a7e-534f-ac5d-a6035f980029", "testId": "RSK-01.3_A01", "test": "an executive steering committee, or advisory board, defines the organization's risk tolerance.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 598657, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58919", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4247e1ce-f7ec-5be4-a6a8-7647f4270a2c", "parentControlId": 31923, "controlId": "ORG 2.1", "title": "ORG 2.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58919" }, { "id": 598667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42c4a35c-6544-5372-b538-6ffff808adee", "parentControlId": 31923, "controlId": "GV.RM", "title": "GV.RM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589191" }, { "id": 598668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fed98361-8164-58f0-9a8e-a2f9ffeb2249", "parentControlId": 31923, "controlId": "GV.RM-02", "title": "GV.RM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589191" }, { "id": 598669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589191", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e11c2617-13d1-54bb-ac0b-98791c3f7a8a", "parentControlId": 31923, "controlId": "GV.RR-01", "title": "GV.RR-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589191" } ], "id": 31923, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731293", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731293", "catalogueId": 1062, "uuid": "8b91dfbb-507d-5754-979c-1220a88c7c4e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define organizational risk tolerance, the specified range of acceptable results?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Risk Tolerance", "description": "

Control Description

Mechanisms exist to define organizational risk tolerance, the specified range of acceptable results.

Evidence Request List (ERL)

E-RSK-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to define organizational risk tolerance, the specified range of acceptable results.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-01.3", "family": "Risk Management", "enhancements": "", "sortId": "RSK-01.3", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)\n∙ Defined risk tolerance

Small Business (10-49 staff)

∙ Risk Management Program (RMP)\n∙ Defined risk tolerance

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)\n∙ Defined risk tolerance

Large Business (250-999 staff)

∙ Risk Management Program (RMP)\n∙ Defined risk tolerance

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)\n∙ Defined risk tolerance", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73737, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591113", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591113", "securityControlId": 31924, "ccis": [], "uuid": "0f24f5f2-4239-5d82-8f2a-02808aae23dd", "testId": "RSK-01.4_A01", "test": "an executive steering committee, or advisory board, defines the organization's risk threshold.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 598691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589196", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebbdbea2-b59b-5348-8f49-d018ab7566a1", "parentControlId": 31924, "controlId": "GV.RR-01", "title": "GV.RR-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589196" } ], "id": 31924, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731293", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731293", "catalogueId": 1062, "uuid": "2f44cf62-8a00-5134-b176-f970013a0bc5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define organizational risk threshold, the level of risk exposure above which risks are addressed and below which risks may be accepted?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Risk Threshold", "description": "

Control Description

Mechanisms exist to define organizational risk threshold, the level of risk exposure above which risks are addressed and below which risks may be accepted.

Evidence Request List (ERL)

E-RSK-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to define organizational risk threshold, the level of risk exposure above which risks are addressed and below which risks may be accepted.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-01.4", "family": "Risk Management", "enhancements": "", "sortId": "RSK-01.4", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)\n∙ Defined risk threshold

Small Business (10-49 staff)

∙ Risk Management Program (RMP)\n∙ Defined risk threshold

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)\n∙ Defined risk threshold

Large Business (250-999 staff)

∙ Risk Management Program (RMP)\n∙ Defined risk threshold

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)\n∙ Defined risk threshold", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73738, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591114", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591114", "securityControlId": 31925, "ccis": [], "uuid": "54a232a2-407b-5f5d-b795-9ec13830e1fa", "testId": "RSK-01.5_A01", "test": "an executive steering committee, or advisory board, defines the organization's risk appetite.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 598712, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589198", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac7a91d2-ae3a-5bf9-9bdd-aea1fbfcb1f2", "parentControlId": 31925, "controlId": "GV.RM", "title": "GV.RM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589198" }, { "id": 598713, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589198", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e6e7f28-2348-581d-be9f-b80f3c99ed87", "parentControlId": 31925, "controlId": "GV.RM-02", "title": "GV.RM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589198" }, { "id": 598714, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589198", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "088f04b5-f2b3-5998-8cd2-0a62d42fd67a", "parentControlId": 31925, "controlId": "GV.RR-01", "title": "GV.RR-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589198" } ], "id": 31925, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731294", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731294", "catalogueId": 1062, "uuid": "d1bcc3a8-0220-5c32-b134-a36b81187e5d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define organizational risk appetite, the degree of uncertainty the organization is willing to accept in anticipation of a reward?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Risk Appetite", "description": "

Control Description

Mechanisms exist to define organizational risk appetite, the degree of uncertainty the organization is willing to accept in anticipation of a reward.

Evidence Request List (ERL)

E-RSK-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Risk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to define organizational risk appetite, the degree of uncertainty the organization is willing to accept in anticipation of a reward.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-01.5", "family": "Risk Management", "enhancements": "", "sortId": "RSK-01.5", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)\n∙ Defined risk tolerance

Small Business (10-49 staff)

∙ Risk Management Program (RMP)\n∙ Defined risk tolerance

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)\n∙ Defined risk tolerance

Large Business (250-999 staff)

∙ Risk Management Program (RMP)\n∙ Defined risk tolerance

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)\n∙ Defined risk tolerance", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73739, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591114", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591114", "securityControlId": 31926, "ccis": [], "uuid": "695a7081-4d7d-50bb-82a3-714db12d01a9", "testId": "RSK-02_A01", "test": "systems, applications, services and the information processed, stored and/or transmitted are categorized.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-02a.", "defaultText": null }, { "id": 73740, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591114", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591114", "securityControlId": 31926, "ccis": [], "uuid": "9b8d1e83-dacf-5507-86c4-fef7efb5ec4a", "testId": "RSK-02_A02", "test": "the security categorization results, including supporting rationale, are documented in the security plan for the system.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-02b.", "defaultText": null }, { "id": 73741, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591115", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591115", "securityControlId": 31926, "ccis": [], "uuid": "1537de71-9617-5be4-8357-3e6e6a9afd1f", "testId": "RSK-02_A03", "test": "the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_RA-02c.", "defaultText": null } ], "externalMappings": [ { "id": 598744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e2416d6-a771-5bf5-b9a4-83cf1e5478fb", "parentControlId": 31926, "controlId": "6.1.2(d)(3)", "title": "6.1.2(d)(3)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589203" }, { "id": 598747, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "096e1783-ec6d-5850-a6b7-59b4698080e1", "parentControlId": 31926, "controlId": "RA-2", "title": "RA-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589203" }, { "id": 598748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49e1be6e-fd72-5398-a40d-b90d46b6ec89", "parentControlId": 31926, "controlId": "RA-02", "title": "RA-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589203" }, { "id": 598749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c15f7b61-7ecd-5431-b92e-06f0194535c7", "parentControlId": 31926, "controlId": "RA-02", "title": "RA-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589203" }, { "id": 598750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a9b8970-65f4-531a-a450-e11855a26310", "parentControlId": 31926, "controlId": "RA-02", "title": "RA-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589203" }, { "id": 598751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c0a82be-6be0-572c-b4ea-2627a5678b3e", "parentControlId": 31926, "controlId": "RA-02", "title": "RA-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589203" }, { "id": 598752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589203", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43b77f2b-6882-5256-8b19-51a9bd54a6a6", "parentControlId": 31926, "controlId": "RA-02", "title": "RA-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589203" }, { "id": 598753, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2853fc1c-bb62-5a66-84f5-703cfd9f1071", "parentControlId": 31926, "controlId": "RA-02", "title": "RA-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589204" }, { "id": 598754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e7ac0ed-027c-571f-8513-31056657529c", "parentControlId": 31926, "controlId": "RA-2", "title": "RA-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589204" }, { "id": 598755, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "deb6a122-4d9d-54e3-b891-a9ef8a169db9", "parentControlId": 31926, "controlId": "RA-2", "title": "RA-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589204" }, { "id": 598759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6314320b-b29f-50e1-9cac-d7a4beae6394", "parentControlId": 31926, "controlId": "03.11.01.a", "title": "03.11.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589204" }, { "id": 598760, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589204", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bec88a06-2400-503c-a042-464d6285a20e", "parentControlId": 31926, "controlId": "ID.AM", "title": "ID.AM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589204" }, { "id": 598775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589206", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "107bf5a9-eeff-5e4d-b546-6854a1f6cf7a", "parentControlId": 31926, "controlId": "RISK-2d", "title": "RISK-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589206" }, { "id": 598776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589206", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c88e4eed-0c0b-5e38-8ac1-bc479394c24e", "parentControlId": 31926, "controlId": "RISK-2i", "title": "RISK-2i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589206" }, { "id": 598777, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589206", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fce5956-3b2f-50bd-83c6-28f6880fff0c", "parentControlId": 31926, "controlId": "RISK-3a", "title": "RISK-3a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589206" }, { "controlId": "NSS-17T-Sec4.2", "title": "NSS-17T-Sec4.2 — Design Basis Threat (DBT) Cyber Risk & Attack Vector Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "c963a19c-fa44-5d82-ba0d-e7be53c0e497", "isPublic": true }, { "controlId": "IEC-62645-5.3", "title": "IEC-62645-5.3 — Nuclear Cyber Risk Assessment & Graded Approach", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "213ea925-dbb2-50e0-a6ed-b22d32dba822", "isPublic": true }, { "controlId": "10-CFR-73.100(a)", "title": "10-CFR-73.100(a) — Risk-Informed, Consequence-Oriented Cyber Protection Standard", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "4567fbf9-8193-502b-bae7-44d5025a1980", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.b", "title": "DOE-O-205.1D-4.b — Risk Management Framework (RMF) for Nuclear & High-Consequence Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "80553530-a17b-5870-a5f8-2982d1c1a250", "isPublic": true } ], "id": 31926, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731294", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731294", "catalogueId": 1062, "uuid": "06fffa96-1ba4-56ce-b1df-b8c4f8a93578", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization categorize Technology Assets, Applications, Services and/or Data (TAASD) in accordance with applicable laws, regulations and contractual obligations that:\n (1) Document the security categorization results (including supporting rationale) in the security plan for systems; and\n (2) Ensure the security categorization decision is reviewed and approved by the asset owner?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Risk-Based Security Categorization", "description": "

Control Description

Mechanisms exist to categorize Technology Assets, Applications, Services and/or Data (TAASD) in accordance with applicable laws, regulations and contractual obligations that:\n(1) Document the security categorization results (including supporting rationale) in the security plan for systems; and\n(2) Ensure the security categorization decision is reviewed and approved by the asset owner.

Evidence Request List (ERL)

E-RSK-01\nE-RSK-04\nE-BCM-08\nE-TPM-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nRisk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to categorize TAASD in accordance with applicable laws, regulations and contractual obligations that:\n(1) Document the security categorization results (including supporting rationale) in the security plan for systems; and\n(2) Ensure the security categorization decision is reviewed and approved by the asset owner.

Level 4 - Quantitatively Controlled: Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-02", "family": "Risk Management", "enhancements": "", "sortId": "RSK-02", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73742, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591115", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591115", "securityControlId": 31927, "ccis": [], "uuid": "8b7961da-b191-53c4-920e-4fe4da9743ba", "testId": "RSK-02.1_A01", "test": "an impact-level prioritization of organizational systems is conducted to obtain additional granularity on system impact levels.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-02(01)", "defaultText": null } ], "externalMappings": [ { "id": 598814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a35d7c6-9acd-5178-9022-e373f1c6b908", "parentControlId": 31927, "controlId": "RA-02(01)", "title": "RA-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58921" }, { "id": 598815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c748d8e-4048-59b8-8254-ef2cc874ba44", "parentControlId": 31927, "controlId": "RA-02(01)", "title": "RA-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58921" }, { "id": 598816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d649e95d-61cb-5446-9834-b46355f2605e", "parentControlId": 31927, "controlId": "03.11.01.a", "title": "03.11.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589211" }, { "id": 598817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97280e26-e8b7-536c-817b-f358e3a00f8e", "parentControlId": 31927, "controlId": "03.14.03.b", "title": "03.14.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589211" }, { "id": 598818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a63a7664-110a-5c4c-83ae-c6bb5ea8e698", "parentControlId": 31927, "controlId": "ID.RA-05", "title": "ID.RA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589211" }, { "id": 598819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "079acede-41f5-5140-b0aa-e11d7c5f6b8e", "parentControlId": 31927, "controlId": "ID.RA-06", "title": "ID.RA-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589211" }, { "id": 598821, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f193dcbb-fecc-5b53-acb0-881bae244ff8", "parentControlId": 31927, "controlId": "CIP-002-5.1a 1.1", "title": "CIP-002-5.1a 1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589211" }, { "id": 598822, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0daae088-ffd8-5e32-afb0-6b58b9a80a86", "parentControlId": 31927, "controlId": "CIP-002-5.1a 1.2", "title": "CIP-002-5.1a 1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589211" }, { "id": 598823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "440e8b4a-64d6-508b-97b9-c6eaf6d7e393", "parentControlId": 31927, "controlId": "CIP-002-5.1a 1.3", "title": "CIP-002-5.1a 1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589211" }, { "controlId": "CIP-002-5.1a-R1", "title": "CIP-002-5.1a-R1 — BES Cyber System Categorization Process", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b11a7253-21a3-5492-836c-ac5544b50166", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.1", "title": "CIP-002-5.1a-1.1 — Identify each of the high impact BES Cyber Systems according to Attachment 1, Section 1, if any, at each asset", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "385551cb-7e53-59a9-b8c4-e16469a6c8fc", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.2", "title": "CIP-002-5.1a-1.2 — Identify each of the medium impact BES Cyber Systems according to Attachment 1, Section 2, if any, at each asset", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7ea2ab43-2ba9-573d-8e92-d7d15c4b826b", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.3", "title": "CIP-002-5.1a-1.3 — Identify each asset that contains a low impact BES Cyber System according to Attachment 1, Section 3, if any (a discr...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "29787732-e3e2-58ac-a5da-4160dd93962a", "isPublic": true }, { "controlId": "NSS-17T-Sec4.2", "title": "NSS-17T-Sec4.2 — Design Basis Threat (DBT) Cyber Risk & Attack Vector Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "1f8af62e-314b-58af-9deb-a1a3fa83123f", "isPublic": true }, { "controlId": "IEC-62645-5.3", "title": "IEC-62645-5.3 — Nuclear Cyber Risk Assessment & Graded Approach", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "1df93350-08b5-59cd-846b-68b2e8f45477", "isPublic": true }, { "controlId": "10-CFR-73.100(a)", "title": "10-CFR-73.100(a) — Risk-Informed, Consequence-Oriented Cyber Protection Standard", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "70ad2e27-d6ea-59ed-860c-cd7622104c15", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.b", "title": "DOE-O-205.1D-4.b — Risk Management Framework (RMF) for Nuclear & High-Consequence Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "dc23cdc1-99aa-5b2d-8494-a2972d2e4964", "isPublic": true } ], "id": 31927, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731294", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731294", "catalogueId": 1062, "uuid": "1598dc1d-5212-59bd-9b07-26f21c690f01", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prioritize the impact level for Technology Assets, Applications and/or Services (TAAS) to prevent potential disruptions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Impact-Level Prioritization", "description": "

Control Description

Mechanisms exist to prioritize the impact level for Technology Assets, Applications and/or Services (TAAS) to prevent potential disruptions.

Evidence Request List (ERL)

E-BCM-08\nE-RSK-04\nE-TPM-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Risk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prioritize the impact level for Technology Assets, Applications and/or Services (TAAS) to prevent potential disruptions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

NERC-CIP (2026) Requirements: CIP-002-5.1a-R1", "controlId": "RSK-02.1", "family": "Risk Management", "enhancements": "", "sortId": "RSK-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73743, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591115", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591115", "securityControlId": 31928, "ccis": [], "uuid": "f5d1ed6e-db1b-5428-9278-3f396c0b064a", "testId": "RSK-03_A01", "test": "a process exists to identify applicable internal and external risks.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73744, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591116", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591116", "securityControlId": 31928, "ccis": [], "uuid": "58656c1e-eedd-5230-8469-5c141d0c6c82", "testId": "RSK-03_A02", "test": "applicable internal and external risks are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73745, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591116", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591116", "securityControlId": 31928, "ccis": [], "uuid": "166d2cbe-bada-5299-8ddf-0c2a6e753a58", "testId": "RSK-03_A03", "test": "the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of sensitive / regulated data is assessed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 73746, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591116", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591116", "securityControlId": 31928, "ccis": [], "uuid": "f09d4566-78cd-5218-a3d4-7dc0af9b1c97", "testId": "RSK-03_A04", "test": "the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI is assessed.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.11.01.a", "defaultText": null } ], "externalMappings": [ { "id": 598857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bac0c07c-924c-54e6-93da-4e888f7d01ba", "parentControlId": 31928, "controlId": "6.1.2(c)", "title": "6.1.2(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589215" }, { "id": 598858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac5f5b4c-eee2-5e42-81da-a76c9583dfe3", "parentControlId": 31928, "controlId": "6.1.2(c)(1)", "title": "6.1.2(c)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589215" }, { "id": 598859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc108e84-c009-562d-b1c2-012f67b7650a", "parentControlId": 31928, "controlId": "6.1.2(c)(2)", "title": "6.1.2(c)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589215" }, { "id": 598860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589216", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b3f4234-52cd-533d-abe1-3be838090431", "parentControlId": 31928, "controlId": "5.8", "title": "5.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589216" }, { "id": 598874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a792e995-7bff-5f38-82da-c6a0523cea58", "parentControlId": 31928, "controlId": "03.11.01.a", "title": "03.11.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589217" }, { "id": 598876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589217", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9479931c-1570-5681-8bf6-bb39ff54d208", "parentControlId": 31928, "controlId": "ID", "title": "ID", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589217" }, { "id": 598895, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3dbe36da-d760-510a-bbb9-510361ea59dc", "parentControlId": 31928, "controlId": "RISK-2a", "title": "RISK-2a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589281" }, { "id": 598896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589281", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ec19c67-631c-5ce7-8c27-2faa6d51c0cc", "parentControlId": 31928, "controlId": "RISK-2b", "title": "RISK-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589281" }, { "id": 598897, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9dbfeed-1ae3-54c1-8888-4349d04d6979", "parentControlId": 31928, "controlId": "RISK-2c", "title": "RISK-2c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589282" }, { "id": 598898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3e162b8-e0c6-5585-8491-f0fb11bc5c3e", "parentControlId": 31928, "controlId": "RISK-2g", "title": "RISK-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589282" }, { "id": 598899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bf4a8a6-c3e1-56d4-bfed-0ac6547e3822", "parentControlId": 31928, "controlId": "RISK-2m", "title": "RISK-2m", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589282" }, { "controlId": "A.3.1.3", "title": "A.3.1.3 — Identification of Critical Digital Assets", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-8, RA-2, PL-2, SA-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "8b35d374-569e-569b-8c54-e976925df569", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.3 / NEI 13-10", "title": "NEI 08-09 Sec 3.1.3 / NEI 13-10 — Identification of Critical Digital Assets", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "cd171d99-4299-50d7-9a0d-abffdf8cd069", "isPublic": true }, { "controlId": "10 CFR 73.54(a)(1), (b)(1)", "title": "10 CFR 73.54(a)(1), (b)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "974155f5-2d15-5648-a5ed-a954b8b99eb4", "isPublic": true }, { "controlId": "CIP-002-5.1a-R1", "title": "CIP-002-5.1a-R1 — BES Cyber System Categorization Process", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e73f355b-f70a-573c-a251-5d5e3d33bf0a", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.1", "title": "CIP-002-5.1a-1.1 — Identify each of the high impact BES Cyber Systems according to Attachment 1, Section 1, if any, at each asset", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2cfe539d-eaa5-5b9c-abbf-cef853de40b4", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.2", "title": "CIP-002-5.1a-1.2 — Identify each of the medium impact BES Cyber Systems according to Attachment 1, Section 2, if any, at each asset", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "607785ae-a1cb-5c28-ae3c-bd51f853825e", "isPublic": true }, { "controlId": "CIP-002-5.1a-1.3", "title": "CIP-002-5.1a-1.3 — Identify each asset that contains a low impact BES Cyber System according to Attachment 1, Section 3, if any (a discr...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-002-5.1a-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8c7e0d81-2ab1-53ee-88da-0d4bf24d4413", "isPublic": true }, { "controlId": "CIP-014-3-R1", "title": "CIP-014-3-R1 — Transmission Station and Substation Risk Assessment", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2277e8ff-69c9-543b-b691-332a17fdea02", "isPublic": true }, { "controlId": "CIP-014-3-1.1", "title": "CIP-014-3-1.1 — Subsequent risk assessments shall be performed", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8b07e4ee-9a89-50dc-8bdb-02f4eec78826", "isPublic": true }, { "controlId": "CIP-014-3-1.2", "title": "CIP-014-3-1.2 — The Transmission Owner shall identify the primary control center that operationally controls each Transmission statio...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8ec3ba42-a09c-5d26-9b35-77fed16c5fd0", "isPublic": true }, { "controlId": "NSS-17T-Sec4.2", "title": "NSS-17T-Sec4.2 — Design Basis Threat (DBT) Cyber Risk & Attack Vector Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "1a08d852-80b4-5109-960f-9f71e36bb8dc", "isPublic": true }, { "controlId": "IEC-62645-5.3", "title": "IEC-62645-5.3 — Nuclear Cyber Risk Assessment & Graded Approach", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "34b7f8f8-71b9-525a-bec3-dbc3a01312a8", "isPublic": true }, { "controlId": "10-CFR-73.100(a)", "title": "10-CFR-73.100(a) — Risk-Informed, Consequence-Oriented Cyber Protection Standard", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "17397af1-b8f2-5f5c-9366-4d0a57a30e9b", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.b", "title": "DOE-O-205.1D-4.b — Risk Management Framework (RMF) for Nuclear & High-Consequence Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "20872b45-418a-55dc-b232-4d66023f7435", "isPublic": true } ], "id": 31928, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731295", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731295", "catalogueId": 1062, "uuid": "5668ff48-effa-51f9-b580-fbaf2f5e4bd8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify and document risks, both internal and external?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Risk Identification", "description": "

Control Description

Mechanisms exist to identify and document risks, both internal and external.

Evidence Request List (ERL)

E-RSK-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Risk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify and document risks, both internal and external.

Level 4 - Quantitatively Controlled: Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.3
NERC-CIP (2026) Requirements: CIP-002-5.1a-R1, CIP-014-3-R1", "controlId": "RSK-03", "family": "Risk Management", "enhancements": "", "sortId": "RSK-03", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73747, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591116", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591116", "securityControlId": 31929, "ccis": [], "uuid": "3c0587f4-1fcc-5c76-b8e8-1864bfdf18ce", "testId": "RSK-03.1_A01", "test": "a risk catalog, or similar solution, exists that keeps current a catalog of applicable risks associated with the organization's business operations and technologies in use.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73748, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591117", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591117", "securityControlId": 31929, "ccis": [], "uuid": "c659aa9f-5b2d-5cc7-8ab6-ddde051161cd", "testId": "RSK-03.1_A02", "test": "the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of sensitive / regulated data is assessed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 73749, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591117", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591117", "securityControlId": 31929, "ccis": [], "uuid": "0b395e2e-c018-5122-87ce-a99327103405", "testId": "RSK-03.1_A03", "test": "the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI is assessed.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.11.01.a", "defaultText": null } ], "externalMappings": [ { "id": 598956, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "116c1f0d-8aef-5aa6-aced-248ff18f3bb9", "parentControlId": 31929, "controlId": "03.15.02.a.03", "title": "03.15.02.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589289" }, { "id": 598959, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e567686c-2a6a-5b7d-b94e-9abb928ec204", "parentControlId": 31929, "controlId": "ID", "title": "ID", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589289" }, { "id": 598964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58929", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fec35503-751b-5ba1-b738-0b87bd7b49cb", "parentControlId": 31929, "controlId": "RISK-2e", "title": "RISK-2e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58929" }, { "id": 598965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58929", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d48a6e8a-1c8e-5cea-8f4c-03eaf749514e", "parentControlId": 31929, "controlId": "RISK-2j", "title": "RISK-2j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58929" } ], "id": 31929, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731295", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731295", "catalogueId": 1062, "uuid": "974116b7-498a-5f6b-ba1c-2eed41a2dde2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization develop and keep current a catalog of applicable risks associated with its business operations and technologies in use?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Risk Catalog", "description": "

Control Description

Mechanisms exist to develop and keep current a catalog of applicable risks associated with the organization's business operations and technologies in use.

Evidence Request List (ERL)

E-RSK-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Risk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to develop and keep current a catalog of applicable risks associated with the organization's business operations and technologies in use.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-03.1", "family": "Risk Management", "enhancements": "", "sortId": "RSK-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)\n∙ Documented risk catalog

Small Business (10-49 staff)

∙ Risk Management Program (RMP)\n∙ Documented risk catalog

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)\n∙ Documented risk catalog

Large Business (250-999 staff)

∙ Risk Management Program (RMP)\n∙ Documented risk catalog

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)\n∙ Documented risk catalog", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73750, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591117", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591117", "securityControlId": 31930, "ccis": [], "uuid": "29400f10-90c8-5e0c-a139-08ece389540e", "testId": "RSK-04_A01", "test": "the frequency to assess risk to organizational operations, organizational assets and individuals is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "171A_3.11.1[a]\n172A_3.11.5e_ODP[1]", "defaultText": null }, { "id": 73751, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591117", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591117", "securityControlId": 31930, "ccis": [], "uuid": "2649acb8-26ad-55d5-b07d-c3ed8e9d5e4c", "testId": "RSK-04_A02", "test": "a document in which risk assessment results are to be documented (if not documented in the cybersecurity / data privacy plans or risk assessment report) is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-03_ODP[01]\n53A_R5_RA-03_ODP[02]", "defaultText": null }, { "id": 73752, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591117", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591118", "securityControlId": 31930, "ccis": [], "uuid": "05e460b0-eae1-5e86-a34d-aaeccda13832", "testId": "RSK-04_A03", "test": "a risk assessment is conducted to determine the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification or destruction of the system. the information it processes, stores or transmits. and any related information.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-03a.02", "defaultText": null }, { "id": 73753, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591118", "securityControlId": 31930, "ccis": [], "uuid": "d115f396-21d4-5067-9288-7af30a95a28f", "testId": "RSK-04_A04", "test": "personnel or roles to whom risk assessment results are to be disseminated is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-03_ODP[04]", "defaultText": null }, { "id": 73754, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591118", "securityControlId": 31930, "ccis": [], "uuid": "e0f50288-94f8-514b-90de-c200a58b27c4", "testId": "RSK-04_A05", "test": "risk assessment results are disseminated to personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-03e.", "defaultText": null }, { "id": 73755, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591118", "securityControlId": 31930, "ccis": [], "uuid": "25c0e8fc-d5fe-5ac8-b712-2d77deadf6d0", "testId": "RSK-04_A06", "test": "the frequency to update the risk assessment is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_RA-03_ODP[05]", "defaultText": null }, { "id": 73756, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591118", "securityControlId": 31930, "ccis": [], "uuid": "00ebf5fa-f52a-54c0-a986-27cfd7a47dc8", "testId": "RSK-04_A07", "test": "the frequency to review risk assessment results is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_RA-03_ODP[03]", "defaultText": null }, { "id": 73757, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591118", "securityControlId": 31930, "ccis": [], "uuid": "7b3e4421-4c39-5756-a6e2-45d01bf884ee", "testId": "RSK-04_A08", "test": "a risk assessment is conducted to identify threats to and vulnerabilities in the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_RA-03a.01", "defaultText": null }, { "id": 73758, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591119", "securityControlId": 31930, "ccis": [], "uuid": "7af9f375-3eab-52fc-838c-85ea1e81bb68", "testId": "RSK-04_A09", "test": "security solutions are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.11.5e[a]", "defaultText": null }, { "id": 73759, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591119", "securityControlId": 31930, "ccis": [], "uuid": "4e244f3f-68bf-55f6-a090-4c5e493763d9", "testId": "RSK-04_A10", "test": "current and accumulated threat intelligence is identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.11.5e[b]", "defaultText": null }, { "id": 73760, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591119", "securityControlId": 31930, "ccis": [], "uuid": "5d4173e0-86fe-5f37-9e96-28d8bb4bee27", "testId": "RSK-04_A11", "test": "Anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence is identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.11.5e[c]", "defaultText": null }, { "id": 73761, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591119", "securityControlId": 31930, "ccis": [], "uuid": "a4f290a5-aaf2-5ced-98a0-d38415a51434", "testId": "RSK-04_A12", "test": "the effectiveness of security solutions is assessed frequency to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "172A_3.11.5e[d]", "defaultText": null }, { "id": 73762, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59112", "securityControlId": 31930, "ccis": [], "uuid": "eeed6d7f-991b-5c25-8090-049b0d1eac10", "testId": "RSK-04_A13", "test": "a risk assessment is conducted to determine the likelihood and impact of adverse effects on individuals arising from the processing of Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_RA-03a.03", "defaultText": null }, { "id": 73763, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59112", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59112", "securityControlId": 31930, "ccis": [], "uuid": "68e24de8-d913-592d-9799-6b6ebcfd493a", "testId": "RSK-04_A14", "test": "risk assessment results and risk management decisions from the organization and mission or business process perspectives are integrated with system-level risk assessments.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_RA-03b.", "defaultText": null }, { "id": 73764, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59112", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59112", "securityControlId": 31930, "ccis": [], "uuid": "ee447b4f-3a4a-5ab9-b1b0-f7f1eed07fad", "testId": "RSK-04_A15", "test": "risk assessment results are documented per organization-defined criteria.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_RA-03c.", "defaultText": null }, { "id": 73765, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59112", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59112", "securityControlId": 31930, "ccis": [], "uuid": "f1000965-3fb5-5c66-a8ca-80654a956e31", "testId": "RSK-04_A16", "test": "risk assessment results are reviewed frequently.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually and when a significant change occurs", "otherId": "53A_R5_RA-03d.", "defaultText": null }, { "id": 73766, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59112", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59112", "securityControlId": 31930, "ccis": [], "uuid": "a3766380-a571-5c48-8d33-21525a21b15f", "testId": "RSK-04_A17", "test": "the risk assessment is updated frequently or when there are significant changes to the system, its environment of operation or other conditions that may impact the cybersecurity / data privacy state of the system.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually and when a significant change occurs", "otherId": "53A_R5_RA-03f.", "defaultText": null }, { "id": 73767, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591121", "securityControlId": 31930, "ccis": [], "uuid": "6d2b39f0-2ae6-5d5c-832e-89f82bed232f", "testId": "RSK-04_A18", "test": "risk to organizational operations, organizational assets and individuals resulting from the operation of an organizational system that processes, stores or transmits sensitive / regulated data is assessed with the defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least annually", "otherId": "171A_3.11.1[b]", "defaultText": null }, { "id": 73768, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591121", "securityControlId": 31930, "ccis": [], "uuid": "2ff98adb-00b6-523c-baf7-97e55176dfa5", "testId": "RSK-04_A19", "test": "the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of sensitive / regulated data is assessed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 73769, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591121", "securityControlId": 31930, "ccis": [], "uuid": "197e5619-c681-5369-86e4-f747ad2e6fd3", "testId": "RSK-04_A20", "test": "risk assessments are updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "SCF Created", "defaultText": null }, { "id": 73770, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591121", "securityControlId": 31930, "ccis": [], "uuid": "0cabdad3-e26b-51f4-8b8d-17d8a1081696", "testId": "RSK-04_A21", "test": "the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI is assessed.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.11.01.a", "defaultText": null }, { "id": 73771, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591121", "securityControlId": 31930, "ccis": [], "uuid": "c682e5a2-fe19-59f5-aed3-7c53c5aee024", "testId": "RSK-04_A22", "test": "risk assessments are updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "171A_R3_A.03.11.01.b", "defaultText": null } ], "externalMappings": [ { "id": 599009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6ac8bfc-8441-5b07-a04b-71cdce7d2809", "parentControlId": 31930, "controlId": "6.1.2(d)", "title": "6.1.2(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589296" }, { "id": 599010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53e30fdb-91e4-5185-a7ff-b06d4ee765f0", "parentControlId": 31930, "controlId": "6.1.2(d)(1)", "title": "6.1.2(d)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589296" }, { "id": 599011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93f38136-2e92-5aa5-9df1-a37b3d694a1f", "parentControlId": 31930, "controlId": "6.1.2(d)(2)", "title": "6.1.2(d)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589296" }, { "id": 599012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d762be32-f729-5bca-abe2-a4367a06d558", "parentControlId": 31930, "controlId": "6.1.2(d)(3)", "title": "6.1.2(d)(3)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589296" }, { "id": 599013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3dd7ed6-a926-5216-996a-e32792bcae74", "parentControlId": 31930, "controlId": "6.1.2(e)", "title": "6.1.2(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589296" }, { "id": 599014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "223b576e-5c69-5ed4-b3db-ff5447c69573", "parentControlId": 31930, "controlId": "6.1.2(e)(1)", "title": "6.1.2(e)(1)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589296" }, { "id": 599015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f730023-4877-5be9-a34c-3483ce40d4c5", "parentControlId": 31930, "controlId": "6.1.2(e)(2)", "title": "6.1.2(e)(2)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589296" }, { "id": 599016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "179dcd39-f9fd-5dac-b264-937102b6a468", "parentControlId": 31930, "controlId": "8.2", "title": "8.2", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589297" }, { "id": 599017, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6027cfcf-66dc-5b22-b1fa-a54dfd294f23", "parentControlId": 31930, "controlId": "5.8", "title": "5.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589297" }, { "id": 599018, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52ef1da3-d333-5345-9ed1-5ff7a33776f1", "parentControlId": 31930, "controlId": "7.5", "title": "7.5", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589297" }, { "id": 599063, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b99d5da6-8d09-58e3-8e93-eb51ae185b0d", "parentControlId": 31930, "controlId": "RA-3", "title": "RA-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589302" }, { "id": 599064, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589302", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61c20c28-86b0-552f-9190-297c4b764249", "parentControlId": 31930, "controlId": "RA-03", "title": "RA-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589302" }, { "id": 599066, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c874d7ce-f69c-5869-88b2-bd3844651a9f", "parentControlId": 31930, "controlId": "RA-03", "title": "RA-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589303" }, { "id": 599068, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c571438-678e-5bf7-a8e5-84e1ee693003", "parentControlId": 31930, "controlId": "RA-03", "title": "RA-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589303" }, { "id": 599069, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35c64143-b1ff-50e7-875b-73fe91090cc6", "parentControlId": 31930, "controlId": "RA-03", "title": "RA-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589303" }, { "id": 599070, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9baf24cc-e807-599a-b9dd-552591a9dbdb", "parentControlId": 31930, "controlId": "RA-03", "title": "RA-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589303" }, { "id": 599071, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b0a1249-a21c-5a71-9dde-40888b5ad813", "parentControlId": 31930, "controlId": "RA-03", "title": "RA-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589303" }, { "id": 599072, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f3723ff-cb79-5cbc-bcf6-7f964ec69c3e", "parentControlId": 31930, "controlId": "RA-3", "title": "RA-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589303" }, { "id": 599073, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589303", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7df655c6-ce8e-5b2a-8b3f-377b2e56d0ee", "parentControlId": 31930, "controlId": "RA-3", "title": "RA-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589303" }, { "id": 599077, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49464e5c-af16-5ee2-9517-1c9d9d70e8ee", "parentControlId": 31930, "controlId": "3.11.1", "title": "3.11.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589304" }, { "id": 599078, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73fe71af-1d52-5507-94f5-0d5d2f02e901", "parentControlId": 31930, "controlId": "03.11.01.a", "title": "03.11.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589304" }, { "id": 599085, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589304", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d389e0bb-4884-50a8-b0ea-3b04aa4c347f", "parentControlId": 31930, "controlId": "GV.RM-06", "title": "GV.RM-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589305" }, { "id": 599086, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abdbf3c4-98cd-55fe-9a77-c179755b49e4", "parentControlId": 31930, "controlId": "ID", "title": "ID", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589305" }, { "id": 599087, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "516b7984-6ca5-5c81-b248-11e0bb2d3a33", "parentControlId": 31930, "controlId": "ID.RA-01", "title": "ID.RA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589305" }, { "id": 599088, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589305", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b538f5c-2ccf-56e1-9c39-40c842d4dfcd", "parentControlId": 31930, "controlId": "ID.RA-05", "title": "ID.RA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589305" }, { "id": 599107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "966ea5e5-f32b-53f4-9503-5c29d971f70f", "parentControlId": 31930, "controlId": "RISK-2g", "title": "RISK-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589307" }, { "id": 599135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58931", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce1ecb8a-6774-57c9-b3eb-4659d335c59e", "parentControlId": 31930, "controlId": "CIP-004-7 R3", "title": "CIP-004-7 R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58931" }, { "controlId": "A.3.1.6", "title": "A.3.1.6 — Application of Security Controls", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PL-2, CA-2, RA-3, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "60762f16-f743-51bf-b662-d534310d38ce", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.6", "title": "NEI 08-09 Sec 3.1.6 — Application of Security Controls", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "92f843f7-6920-5ccd-b4ed-ee2be406c27c", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1), (a)(2)", "title": "10 CFR 73.54(c)(1), (a)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "44e115d4-5e9c-524d-9369-47ea472f4473", "isPublic": true }, { "controlId": "A.4.1.2", "title": "A.4.1.2 — Effectiveness Analysis", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, CA-7, RA-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "8b49b532-e391-5c06-a0db-e79cafa0cf85", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.1.2", "title": "NEI 08-09 Sec 4.1.2 — Effectiveness Analysis", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.1.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "235a5108-231f-5226-b53b-c5972088de39", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.1.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "f11d2d77-76bf-5104-81c6-c57dcf37f542", "isPublic": true }, { "controlId": "A.4.2.2", "title": "A.4.2.2 — Security Impact Analysis of Changes and Environment", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-4, RA-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "aea5f2ba-0245-50f5-a158-47bcfae10aeb", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.2", "title": "NEI 08-09 Sec 4.2.2 — Security Impact Analysis of Changes and Environment", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "8e0e9580-3206-5e78-902e-2246a175807d", "isPublic": true }, { "controlId": "10 CFR 73.54(e), 73.58", "title": "10 CFR 73.54(e), 73.58 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "438e0ba0-1462-5402-9e4b-65a6f9922dfd", "isPublic": true }, { "controlId": "A.4.2.6", "title": "A.4.2.6 — Application of Security Controls Associated with a Modification or Addition", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-3, PL-2, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "b641c271-5532-5e17-b199-df8c3553a5ca", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.6", "title": "NEI 08-09 Sec 4.2.6 — Application of Security Controls Associated with a Modification or Addition", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "a51c8163-3b22-5fb9-9b84-7f4001ae08bf", "isPublic": true }, { "controlId": "10 CFR 73.54(e)", "title": "10 CFR 73.54(e) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "ceafcaf1-0b00-572a-8ef4-27fbb705cad0", "isPublic": true }, { "controlId": "C.13.1", "title": "C.13.1 — Threat and Vulnerability Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: RA-3, RA-5, SI-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "c25fc02e-de40-5b1f-904b-2401985047ce", "isPublic": true }, { "controlId": "NEI 08-09 App E.13.1", "title": "NEI 08-09 App E.13.1 — Threat and Vulnerability Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.13.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "9973c097-9edf-519a-a28f-e0d7992e01cb", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1), (g)", "title": "10 CFR 73.54(c)(1), (g) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.13.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "fa787086-424f-5aa2-b27b-4e148dc7952f", "isPublic": true }, { "controlId": "C.13.2", "title": "C.13.2 — Risk Mitigation", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: RA-3, PM-9, CA-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ea42af07-0cb5-5428-bba1-23a57c94ef47", "isPublic": true }, { "controlId": "NEI 08-09 App E.13.2", "title": "NEI 08-09 App E.13.2 — Risk Mitigation", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.13.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "f5d82d5c-f901-5166-87a6-33759cdd8529", "isPublic": true }, { "controlId": "CIP-004-7-R3", "title": "CIP-004-7-R3 — Personnel Risk Assessment Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "843bc304-3ff6-5304-af90-f65e5f99b002", "isPublic": true }, { "controlId": "CIP-004-7-3.1", "title": "CIP-004-7-3.1 — Process to confirm identity.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "484cde35-ee50-5e35-b6dc-5f7e0a5c8a4a", "isPublic": true }, { "controlId": "CIP-004-7-3.2", "title": "CIP-004-7-3.2 — Process to perform a seven year criminal history records check as part of each personnel risk assessment that includes", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "64bfadf3-6f25-5795-bc1d-3d74d8f4ee35", "isPublic": true }, { "controlId": "CIP-004-7-3.2.1", "title": "CIP-004-7-3.2.1 — current residence, regardless of duration", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f398dd21-5970-50ff-bce0-67a28a3b7ec9", "isPublic": true }, { "controlId": "CIP-004-7-3.2.2", "title": "CIP-004-7-3.2.2 — other locations where, during the seven years immediately prior to the date of the criminal history records check, th...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "845653c5-93f0-5a15-973a-c3e2e3a197a7", "isPublic": true }, { "controlId": "CIP-004-7-3.3", "title": "CIP-004-7-3.3 — Criteria or process to evaluate criminal history records checks for authorizing access.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4d0fbe28-02e6-5870-aee8-0128c81b85b4", "isPublic": true }, { "controlId": "CIP-004-7-3.4", "title": "CIP-004-7-3.4 — Criteria or process for verifying that personnel risk assessments performed for contractors or service vendors are co...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6d52b249-3296-58d6-80ed-f8f6b04d0d41", "isPublic": true }, { "controlId": "CIP-004-7-3.5", "title": "CIP-004-7-3.5 — Process to ensure that individuals with authorized electronic or authorized unescorted physical access have had a per...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0ebdfad6-22d1-5243-950f-63e878db54a2", "isPublic": true }, { "controlId": "CIP-014-3-R1", "title": "CIP-014-3-R1 — Transmission Station and Substation Risk Assessment", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "500d10fc-2002-5899-83dd-51280503a552", "isPublic": true }, { "controlId": "CIP-014-3-1.1", "title": "CIP-014-3-1.1 — Subsequent risk assessments shall be performed", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "bb373c36-330d-5c9b-995a-c5e35ce0f031", "isPublic": true }, { "controlId": "CIP-014-3-1.2", "title": "CIP-014-3-1.2 — The Transmission Owner shall identify the primary control center that operationally controls each Transmission statio...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0205ebf1-b6e1-5edb-ac8c-6a7813555fa6", "isPublic": true }, { "controlId": "CIP-014-3-R2", "title": "CIP-014-3-R2 — Third-Party Verification of Risk Assessment", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d1a3c48e-a765-510d-ab14-f16aca9a4c74", "isPublic": true }, { "controlId": "CIP-014-3-2.1", "title": "CIP-014-3-2.1 — Each Transmission Owner shall select an unaffiliated verifying entity that is either", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "af4443c6-f981-5fe7-9a91-24ef1cce5be7", "isPublic": true }, { "controlId": "CIP-014-3-2.2", "title": "CIP-014-3-2.2 — The unaffiliated third party verification shall verify the Transmission Owner’s risk assessment performed under Requi...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "dde0412c-60fe-56af-ac3f-840bc9b4d1c2", "isPublic": true }, { "controlId": "CIP-014-3-2.3", "title": "CIP-014-3-2.3 — If the unaffiliated verifying entity recommends that the Transmission Owner add a Transmission station(s) or Transmis...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a8ab556a-3072-500c-ab41-19afc2e438f5", "isPublic": true }, { "controlId": "CIP-014-3-2.4", "title": "CIP-014-3-2.4 — Each Transmission Owner shall implement procedures, such as the use of non- disclosure agreements, for protecting sen...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "1ef42478-7b3b-5660-b4dc-197ee963e6c9", "isPublic": true }, { "controlId": "CIP-014-3-R3", "title": "CIP-014-3-R3 — Transmission Owner Notification of Risk Assessment Results", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2864fbbf-9c7e-504b-8d94-2762f4b8eff7", "isPublic": true }, { "controlId": "CIP-014-3-3.1", "title": "CIP-014-3-3.1 — If a Transmission station or Transmission substation previously identified under Requirement R1 and verified accordin...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7143bdb4-e0bc-5a2d-b67d-417c6a4de284", "isPublic": true }, { "controlId": "NSS-17T-Sec4.2", "title": "NSS-17T-Sec4.2 — Design Basis Threat (DBT) Cyber Risk & Attack Vector Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "dccf3033-1efe-5dd1-aea2-278e8a44f9c8", "isPublic": true }, { "controlId": "IEC-62645-5.3", "title": "IEC-62645-5.3 — Nuclear Cyber Risk Assessment & Graded Approach", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "a92a3a23-8266-587c-9985-3f360df6ffef", "isPublic": true }, { "controlId": "10-CFR-73.100(a)", "title": "10-CFR-73.100(a) — Risk-Informed, Consequence-Oriented Cyber Protection Standard", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "e1ff0f4b-b214-5bf8-aa18-fc0fc4828e7d", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.b", "title": "DOE-O-205.1D-4.b — Risk Management Framework (RMF) for Nuclear & High-Consequence Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "4f59fb1e-6970-5014-88c3-1df56a2a047e", "isPublic": true } ], "id": 31930, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731295", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731295", "catalogueId": 1062, "uuid": "16b17a01-be38-5b4f-b345-9b4053b60238", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of its Technology Assets, Applications, Services and/or Data (TAASD)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Risk Assessment", "description": "

Control Description

Mechanisms exist to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's Technology Assets, Applications, Services and/or Data (TAASD).

Evidence Request List (ERL)

E-RSK-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Risk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conduct recurring assessments of risk that includes the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of the organization's TAASD.

Level 4 - Quantitatively Controlled: Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.6, A.4.1.2, A.4.2.2, A.4.2.6, C.13.1, C.13.2
NERC-CIP (2026) Requirements: CIP-004-7-R3, CIP-014-3-R1, CIP-014-3-R2, CIP-014-3-R3", "controlId": "RSK-04", "family": "Risk Management", "enhancements": "", "sortId": "RSK-04", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)\n∙ Risk assessment\n∙ Business Impact Analysis (BIA)\n∙ Data Protection Impact Assessment (DPIA)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)\n∙ Risk assessment\n∙ Business Impact Analysis (BIA)\n∙ Data Protection Impact Assessment (DPIA)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)\n∙ Risk assessment\n∙ Business Impact Analysis (BIA)\n∙ Data Protection Impact Assessment (DPIA)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)\n∙ Risk assessment\n∙ Business Impact Analysis (BIA)\n∙ Data Protection Impact Assessment (DPIA)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)\n∙ Risk assessment\n∙ Business Impact Analysis (BIA)\n∙ Data Protection Impact Assessment (DPIA)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73772, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591122", "securityControlId": 31931, "ccis": [], "uuid": "b3a31d54-8381-586d-be5d-dd3ed331cc04", "testId": "RSK-04.1_A01", "test": "a risk register is maintained to facilitate the monitoring and reporting of risks.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 599242, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589335", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dae8aff7-db1e-55e8-93c0-314d50d497b2", "parentControlId": 31931, "controlId": "03.12.02.a.01", "title": "03.12.02.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589335" }, { "id": 599243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589335", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16ca3a1c-bd2f-597b-9c2d-a9fe3c7b7e75", "parentControlId": 31931, "controlId": "03.12.02.a.02", "title": "03.12.02.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589335" }, { "id": 599244, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589335", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39eddb68-2269-56aa-bd40-6080475784f8", "parentControlId": 31931, "controlId": "GV.RM-06", "title": "GV.RM-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589335" }, { "id": 599245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589335", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4dea2756-5ea4-5988-a048-1b48d8779774", "parentControlId": 31931, "controlId": "ID", "title": "ID", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589335" }, { "id": 599246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589335", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a7b5125-1758-5bcb-ac92-05a520dc0c0e", "parentControlId": 31931, "controlId": "ID.RA-01", "title": "ID.RA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589335" }, { "id": 599256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2540095-7f3b-516a-b1d8-69b6a6599b95", "parentControlId": 31931, "controlId": "RISK-2e", "title": "RISK-2e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589336" }, { "id": 599257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a78146d4-bade-5928-8be0-3216eda06700", "parentControlId": 31931, "controlId": "RISK-2f", "title": "RISK-2f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589336" }, { "id": 599258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0fab3719-ef27-53e4-bbb1-45d3a6617060", "parentControlId": 31931, "controlId": "RISK-3f", "title": "RISK-3f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589336" } ], "id": 31931, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731296", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731296", "catalogueId": 1062, "uuid": "59124b4a-f04c-5d2a-9517-e5a5132c1f5f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain a risk register that facilitates monitoring and reporting of risks?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 10.0, "title": "Risk Register", "description": "

Control Description

Mechanisms exist to maintain a risk register that facilitates monitoring and reporting of risks.

Evidence Request List (ERL)

E-RSK-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nRisk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain a risk register that facilitates monitoring and reporting of risks.

Level 4 - Quantitatively Controlled: Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "RSK-04.1", "family": "Risk Management", "enhancements": "", "sortId": "RSK-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73773, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591122", "securityControlId": 31932, "ccis": [], "uuid": "38b94e11-e563-5df7-bdbd-a3027afd157f", "testId": "RSK-04.2_A01", "test": "a risk assessment methodology that can cover the organization's components relevant for secure, compliant and resilient operations is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73774, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591122", "securityControlId": 31932, "ccis": [], "uuid": "f4dd43f2-78ba-5df1-a976-4f255aa3984c", "testId": "RSK-04.2_A02", "test": "a risk assessment methodology that covers the organization's components relevant for secure, compliant and resilient operations is implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 599311, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05f4a620-0471-5cbb-a38e-a09af0a56424", "parentControlId": 31932, "controlId": "RISK-2g", "title": "RISK-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589343" }, { "id": 599312, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac310e7a-8556-581f-b5f5-0fab2d0e7fed", "parentControlId": 31932, "controlId": "RISK-3c", "title": "RISK-3c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589343" }, { "id": 599313, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4e0d354-542d-52e1-8395-e00f9b949dcb", "parentControlId": 31932, "controlId": "RISK-3d", "title": "RISK-3d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589343" }, { "id": 599314, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90b61a7d-fccd-5340-afe8-54ebc71170de", "parentControlId": 31932, "controlId": "RISK-3e", "title": "RISK-3e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589343" }, { "id": 599315, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6dea8b91-e8fb-57f3-8e4b-ef484a3b9459", "parentControlId": 31932, "controlId": "RISK-4b", "title": "RISK-4b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589343" } ], "id": 31932, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731296", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731296", "catalogueId": 1062, "uuid": "d3b46cfd-cfc0-5cc4-9906-df9fb39b14d4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement a risk assessment methodology to ensure coverage for organizational components relevant for secure, compliant and resilient operations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Risk Assessment Methodology", "description": "

Control Description

Mechanisms exist to implement a risk assessment methodology to ensure coverage for organizational components relevant for secure, compliant and resilient operations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nRisk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement a risk assessment methodology to ensure coverage for organizational components relevant for secure, compliant and resilient operations.

Level 4 - Quantitatively Controlled: Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-04.2", "family": "Risk Management", "enhancements": "", "sortId": "RSK-04.2", "references": "

Micro-Small Business (<10 staff)

∙ Document how privacy risks are identified and managed

Small Business (10-49 staff)

∙ Privacy risk assessment process integrated with security risk management

Medium Business (50-249 staff)

∙ Formal privacy risk management integration with security risk program

Large Business (250-999 staff)

∙ Enterprise privacy risk management program (GDPR DPIA, CCPA)

Enterprise (>1,000 staff)

∙ Enterprise integrated privacy and security risk management platform\n∙ Automated DPIA workflows", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73779, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591124", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591124", "securityControlId": 31935, "ccis": [], "uuid": "0ebf3283-09b1-525e-8147-9d21e2a2353b", "testId": "RSK-05_A01", "test": "newly discovered risks are ranked based on industry-recognized practices.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 599369, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3576b02e-5c84-56a0-bd17-5da6a796dde3", "parentControlId": 31935, "controlId": "03.11.01.a", "title": "03.11.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58935" }, { "id": 599370, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73dcb727-6389-51bc-adc7-8b14bf183345", "parentControlId": 31935, "controlId": "ID", "title": "ID", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58935" }, { "id": 599371, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19954d9d-582b-56af-91e9-f619469acf13", "parentControlId": 31935, "controlId": "ID.RA-05", "title": "ID.RA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58935" }, { "id": 599372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ebf318b-599f-5e8d-b5ce-4fc922a5d9a5", "parentControlId": 31935, "controlId": "ID.RA-06", "title": "ID.RA-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58935" }, { "controlId": "C.13.2", "title": "C.13.2 — Risk Mitigation", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: RA-3, PM-9, CA-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ef4abbee-84ed-5f3e-8ca0-3c78fdeb9303", "isPublic": true }, { "controlId": "NEI 08-09 App E.13.2", "title": "NEI 08-09 App E.13.2 — Risk Mitigation", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.13.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "484e4a6b-bc47-531f-bd5d-71a36e51adad", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.13.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "d293eaad-e306-5738-89e6-ffb9be804afb", "isPublic": true }, { "controlId": "NSS-17T-Sec4.2", "title": "NSS-17T-Sec4.2 — Design Basis Threat (DBT) Cyber Risk & Attack Vector Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "e36d82c4-92dd-5181-aeee-f944e61f65a4", "isPublic": true }, { "controlId": "IEC-62645-5.3", "title": "IEC-62645-5.3 — Nuclear Cyber Risk Assessment & Graded Approach", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "8d996adc-2040-5b02-bf73-45ccbc7e75d7", "isPublic": true }, { "controlId": "10-CFR-73.100(a)", "title": "10-CFR-73.100(a) — Risk-Informed, Consequence-Oriented Cyber Protection Standard", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "bb45f44e-3b08-5ca3-8b0b-13a483280141", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.b", "title": "DOE-O-205.1D-4.b — Risk Management Framework (RMF) for Nuclear & High-Consequence Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "a663a89f-ba3a-5410-86b1-fc9c3333b62d", "isPublic": true } ], "id": 31935, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731297", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731297", "catalogueId": 1062, "uuid": "4f7edcc3-5cbf-5f35-9aa8-3d8bb5fe4ce9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify and assign a risk ranking to newly discovered security vulnerabilities that is based on industry-recognized practices?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Risk Ranking", "description": "

Control Description

Mechanisms exist to identify and assign a risk ranking to newly discovered security vulnerabilities that is based on industry-recognized practices.

Evidence Request List (ERL)

E-RSK-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Risk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify and assign a risk ranking to newly discovered security vulnerabilities that is based on industry-recognized practices.

Level 4 - Quantitatively Controlled: Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.13.2", "controlId": "RSK-05", "family": "Risk Management", "enhancements": "", "sortId": "RSK-05", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73780, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591124", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591124", "securityControlId": 31936, "ccis": [], "uuid": "ad00f236-ecbb-516a-88a5-5d5de5aa7d9a", "testId": "RSK-06_A01", "test": "a defined risk threshold exists to determine what risk is and is not acceptable.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73781, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591124", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591124", "securityControlId": 31936, "ccis": [], "uuid": "bcac4250-d296-51c3-b60f-8e089f362c90", "testId": "RSK-06_A02", "test": "data / process owners are held accountable to remediate risks to an acceptable level.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73782, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591124", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591124", "securityControlId": 31936, "ccis": [], "uuid": "c5ed9dfb-6a15-5db7-b3c8-0751207f2c86", "testId": "RSK-06_A03", "test": "the organization utilizes compensating controls to remediate control deficiencies to an acceptable level.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 599409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589354", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac33dee1-1f1c-5c07-9fa3-292d57de13ec", "parentControlId": 31936, "controlId": "ORG 2.1", "title": "ORG 2.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589354" }, { "id": 599412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "210bb95f-67ec-561d-abb9-6b91dbe508b7", "parentControlId": 31936, "controlId": "6.1.3", "title": "6.1.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589355" }, { "id": 599413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96b341e4-ca4a-597f-beae-39781a230ef8", "parentControlId": 31936, "controlId": "6.1.3(a)", "title": "6.1.3(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589355" }, { "id": 599414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2f08307-b7ac-5cd2-872f-5bcdc09cf0d6", "parentControlId": 31936, "controlId": "6.1.3(b)", "title": "6.1.3(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589355" }, { "id": 599415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2a3ad47-f8a5-5a7a-b9b8-df9141ff445d", "parentControlId": 31936, "controlId": "6.1.3(c)", "title": "6.1.3(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589355" }, { "id": 599416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4d9eed8-a627-5ba1-a72b-1c0d71aaf144", "parentControlId": 31936, "controlId": "6.1.3(d)", "title": "6.1.3(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589355" }, { "id": 599417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589356", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c807eecd-f068-5e0b-90f7-11912ac98887", "parentControlId": 31936, "controlId": "6.1.3(e)", "title": "6.1.3(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589356" }, { "id": 599418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589356", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b21edcf2-85dd-54d3-822b-ec7107e18114", "parentControlId": 31936, "controlId": "6.1.3(f)", "title": "6.1.3(f)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589356" }, { "id": 599419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589356", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "507aaeea-da9a-5376-9e0d-5dd0c4d0b57b", "parentControlId": 31936, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589356" }, { "id": 599420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589356", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9d8ff31-23cc-596c-bc06-74be95441e49", "parentControlId": 31936, "controlId": "5.8", "title": "5.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589356" }, { "id": 599452, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58936", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25ba3a2d-e5a7-51e8-a60a-aa67bcbd6e8d", "parentControlId": 31936, "controlId": "3.11.3", "title": "3.11.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58936" }, { "id": 599453, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58936", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7312990c-81b9-543d-96e8-f9ead5e24e22", "parentControlId": 31936, "controlId": "03.11.02.b", "title": "03.11.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58936" }, { "id": 599454, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58936", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78ad5445-812d-5d05-9387-2c99c7ae5ab2", "parentControlId": 31936, "controlId": "03.12.02.a.02", "title": "03.12.02.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58936" }, { "id": 599456, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58936", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d631f43e-a3ac-5844-bc67-255f838d876e", "parentControlId": 31936, "controlId": "GV.RM-04", "title": "GV.RM-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58936" }, { "id": 599457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58936", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85060a5d-4da8-59b3-a128-8342f5eada5d", "parentControlId": 31936, "controlId": "ID.RA-05", "title": "ID.RA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58936" }, { "id": 599458, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58936", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96e046e1-b65b-5765-a85b-db01c9f2493d", "parentControlId": 31936, "controlId": "ID.RA-06", "title": "ID.RA-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58936" }, { "id": 599483, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589363", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb144b1e-fb99-5bfd-b541-03c791acd18d", "parentControlId": 31936, "controlId": "RISK-4e", "title": "RISK-4e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589363" }, { "controlId": "NSS-17T-Sec4.2", "title": "NSS-17T-Sec4.2 — Design Basis Threat (DBT) Cyber Risk & Attack Vector Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "c4f9b37a-7857-5a03-89a6-fc95be6105dc", "isPublic": true }, { "controlId": "IEC-62645-5.3", "title": "IEC-62645-5.3 — Nuclear Cyber Risk Assessment & Graded Approach", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "64793965-895b-5c2d-83ce-e4d1d7239f8d", "isPublic": true }, { "controlId": "10-CFR-73.100(a)", "title": "10-CFR-73.100(a) — Risk-Informed, Consequence-Oriented Cyber Protection Standard", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "760effd0-2034-5500-95f6-520526ec12cb", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.b", "title": "DOE-O-205.1D-4.b — Risk Management Framework (RMF) for Nuclear & High-Consequence Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "ef798850-2040-55ce-a43d-832ec3d6a34b", "isPublic": true } ], "id": 31936, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731298", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731298", "catalogueId": 1062, "uuid": "b34d2d4c-1062-57ac-b21d-73dd81c13380", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization remediate risks to an acceptable level?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 10.0, "title": "Risk Remediation", "description": "

Control Description

Mechanisms exist to remediate risks to an acceptable level.

Evidence Request List (ERL)

E-RSK-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Risk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to remediate risks to an acceptable level.

Level 4 - Quantitatively Controlled: Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-06", "family": "Risk Management", "enhancements": "", "sortId": "RSK-06", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73783, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591125", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591125", "securityControlId": 31937, "ccis": [], "uuid": "e80a14d1-e339-58a1-a091-11c7b83bce7f", "testId": "RSK-06.1_A01", "test": "findings from security assessments are responded to in accordance with organizational risk tolerance.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-07[01]", "defaultText": null }, { "id": 73784, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591125", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591125", "securityControlId": 31937, "ccis": [], "uuid": "b6232701-0197-5c51-96b7-af2bb0edc43a", "testId": "RSK-06.1_A02", "test": "findings from security assessments are responded to.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_RA-07[02]\n171A_R3_A.03.11.04[01]", "defaultText": null }, { "id": 73785, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591125", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591125", "securityControlId": 31937, "ccis": [], "uuid": "2a4f1196-47a6-58e8-93a1-7637b862e2a3", "testId": "RSK-06.1_A03", "test": "findings from security monitoring are responded to.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_RA-07[03]\n171A_R3_A.03.11.04[02]", "defaultText": null }, { "id": 73786, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591125", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591125", "securityControlId": 31937, "ccis": [], "uuid": "ca3d4d77-314f-5eef-be8f-f4504b751ecf", "testId": "RSK-06.1_A04", "test": "findings from security audits are responded to.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_RA-07[04]\n171A_R3_A.03.11.04[03]", "defaultText": null } ], "externalMappings": [ { "id": 599540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bedd11f1-9556-5b4a-9670-e4dc2a70c96c", "parentControlId": 31937, "controlId": "6.1.3", "title": "6.1.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589369" }, { "id": 599541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589378", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44b5f22e-630d-5684-9176-b905952701cb", "parentControlId": 31937, "controlId": "6.1.3(a)", "title": "6.1.3(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589378" }, { "id": 599542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589378", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fae5225e-fa5c-5ac0-a304-a506436155bd", "parentControlId": 31937, "controlId": "6.1.3(b)", "title": "6.1.3(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589378" }, { "id": 599543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589378", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a418d679-5f1a-55d8-950b-5af7216884c0", "parentControlId": 31937, "controlId": "6.1.3(c)", "title": "6.1.3(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589378" }, { "id": 599544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589378", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b539d0d-a1b5-5af3-b625-40cdf9cfd0d5", "parentControlId": 31937, "controlId": "6.1.3(d)", "title": "6.1.3(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589378" }, { "id": 599545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589378", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "034a7c02-7d51-5d1d-aa63-171e3a374565", "parentControlId": 31937, "controlId": "6.1.3(e)", "title": "6.1.3(e)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589378" }, { "id": 599546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589378", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6886d92-cfd2-5456-962d-7c9365e97bf7", "parentControlId": 31937, "controlId": "6.1.3(f)", "title": "6.1.3(f)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589378" }, { "id": 599547, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589378", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df3c9a62-6d42-5de9-8c11-bfed145108ff", "parentControlId": 31937, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589378" }, { "id": 599548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589379", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1cf4f7a2-e8e9-5522-98ee-561018633bc0", "parentControlId": 31937, "controlId": "5.8", "title": "5.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589379" }, { "id": 599567, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589381", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b40bf404-7c0c-5d5f-be68-e55e2c0db4eb", "parentControlId": 31937, "controlId": "RA-07", "title": "RA-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589381" }, { "id": 599569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589381", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "339b2a9d-6fc4-5d1c-8dd8-01c1ab25aa07", "parentControlId": 31937, "controlId": "RA-07", "title": "RA-07", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589381" }, { "id": 599570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589381", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63d0167f-41d6-51e8-aa3b-0b7af494e37b", "parentControlId": 31937, "controlId": "RA-07", "title": "RA-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589381" }, { "id": 599571, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589381", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a0c9619-4f98-5011-b9f4-ecec98ddf2e2", "parentControlId": 31937, "controlId": "RA-07", "title": "RA-07", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589381" }, { "id": 599572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589381", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38920825-e148-585d-b16e-47555028db21", "parentControlId": 31937, "controlId": "RA-07", "title": "RA-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589381" }, { "id": 599573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589381", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc075f8d-c30b-5db9-8e13-4db24b9f3a4e", "parentControlId": 31937, "controlId": "RA-07", "title": "RA-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589381" }, { "id": 599574, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589381", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71769b0b-fbed-59bc-8888-e832724cf6bf", "parentControlId": 31937, "controlId": "RA-7", "title": "RA-7", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589382" }, { "id": 599575, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21697051-6636-53eb-a395-2f2e3982cf0d", "parentControlId": 31937, "controlId": "RA-7", "title": "RA-7", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589382" }, { "id": 599579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d487ae7-2e51-5775-919a-fd3367805f99", "parentControlId": 31937, "controlId": "03.11.02.b", "title": "03.11.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589382" }, { "id": 599580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589382", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c57b53f4-cff7-5f50-85ec-bd2237946ffc", "parentControlId": 31937, "controlId": "03.11.04", "title": "03.11.04", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589382" }, { "id": 599585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589383", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3e8d8a1-94e3-53d2-922f-bba1f29a13fd", "parentControlId": 31937, "controlId": "GV.RM-04", "title": "GV.RM-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589383" }, { "id": 599586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589383", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3523306-a2e4-5329-bdcc-88dd30e86ec3", "parentControlId": 31937, "controlId": "ID.RA-05", "title": "ID.RA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589383" }, { "id": 599587, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589383", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f22e00a-7e66-5c46-9aa3-27350eb3634a", "parentControlId": 31937, "controlId": "ID.RA-06", "title": "ID.RA-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589383" }, { "id": 599601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589385", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0893382d-cc64-546c-961d-100ea067d028", "parentControlId": 31937, "controlId": "RISK-4e", "title": "RISK-4e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589385" } ], "id": 31937, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731298", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731298", "catalogueId": 1062, "uuid": "8105abab-7aae-518d-a381-505861f75b68", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure proper risk response actions were performed to remediate findings from security, compliance and/or resilience-related:\n(1) Assessments;\n(2) Audits; and/or\n(3) Incidents?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Risk Response", "description": "

Control Description

Mechanisms exist to ensure proper risk response actions were performed to remediate findings from security, compliance and/or resilience-related:\n(1) Assessments;\n(2) Audits; and/or\n(3) Incidents.

Evidence Request List (ERL)

E-RSK-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nRisk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure proper risk response actions were performed to remediate findings from security, compliance and/or resilience-related:\n(1) Assessments;\n(2) Audits; and/or\n(3) Incidents.

Level 4 - Quantitatively Controlled: Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-06.1", "family": "Risk Management", "enhancements": "", "sortId": "RSK-06.1", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73787, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591127", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591127", "securityControlId": 31938, "ccis": [], "uuid": "eec284ad-90af-56af-b967-a3d268f3d167", "testId": "RSK-06.2_A01", "test": "identify and implement compensating countermeasures to reduce risk and exposure to threats.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 599647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8e7b0e3-deae-5e3a-bd54-d057a18d7bc6", "parentControlId": 31938, "controlId": "COMP 3.5", "title": "COMP 3.5", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58939" }, { "id": 599660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589392", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f860c61-3cf7-5472-9070-c3c7040583ec", "parentControlId": 31938, "controlId": "03.11.02.b", "title": "03.11.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589392" }, { "id": 599661, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589392", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f6a96ad-fe16-590b-8961-22d677d5203b", "parentControlId": 31938, "controlId": "GV.RM-04", "title": "GV.RM-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589392" }, { "id": 599662, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589392", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3873775-39b3-59f7-ba95-31dbb375070c", "parentControlId": 31938, "controlId": "ID.RA-06", "title": "ID.RA-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589392" } ], "id": 31938, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731298", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731298", "catalogueId": 1062, "uuid": "2c41589d-7cf8-5d4c-8f55-fab8107baab1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify and implement compensating countermeasures to reduce risk and exposure to threats?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Compensating Countermeasures", "description": "

Control Description

Mechanisms exist to identify and implement compensating countermeasures to reduce risk and exposure to threats.

Evidence Request List (ERL)

E-GOV-20\nE-RSK-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nRisk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify and implement compensating countermeasures to reduce risk and exposure to threats.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-06.2", "family": "Risk Management", "enhancements": "", "sortId": "RSK-06.2", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73788, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591127", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591127", "securityControlId": 31939, "ccis": [], "uuid": "ddaace06-d5f8-509f-ad9b-e9e0e459ed1a", "testId": "RSK-06.3_A01", "test": "risk treatment options are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73789, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591127", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591127", "securityControlId": 31939, "ccis": [], "uuid": "7f818ae5-e96a-5de5-8edf-8f87a9512b5a", "testId": "RSK-06.3_A02", "test": "appropriate risk treatment options, based on applicable risk assessment findings, are selected.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 599745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589402", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e74e90b-0aa4-5c4a-ad88-9c615ead4caf", "parentControlId": 31939, "controlId": "RISK-4a", "title": "RISK-4a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589402" }, { "id": 599746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589402", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20b73d4b-0c4e-5e7d-9de0-4f7dfde73523", "parentControlId": 31939, "controlId": "RISK-4b", "title": "RISK-4b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589402" } ], "id": 31939, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731299", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731299", "catalogueId": 1062, "uuid": "10263c9e-7681-51a3-82f3-e8d956cae3d7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization select appropriate risk treatment options, based on applicable risk assessment findings?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Risk Treatment Options", "description": "

Control Description

Mechanisms exist to select appropriate risk treatment options, based on applicable risk assessment findings.

Evidence Request List (ERL)

E-RSK-13

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nRisk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to select appropriate risk treatment options, based on applicable risk assessment findings.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-06.3", "family": "Risk Management", "enhancements": "", "sortId": "RSK-06.3", "references": "

Micro-Small Business (<10 staff)

∙ Risk response decision policy (accept, mitigate, transfer, avoid)

Small Business (10-49 staff)

∙ Risk response decision policy (accept, mitigate, transfer, avoid)

Medium Business (50-249 staff)

∙ Formal risk response options policy\n∙ Documented criteria for each risk response type

Large Business (250-999 staff)

∙ Enterprise risk response framework\n∙ Risk committee decision-making process

Enterprise (>1,000 staff)

∙ Enterprise GRC platform with risk response workflows\n∙ Formal risk appetite and tolerance framework", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73792, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591128", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591128", "securityControlId": 31941, "ccis": [], "uuid": "97855da6-3cfa-5089-9464-049b4ec3b601", "testId": "RSK-07_A01", "test": "the frequency at which to update the risk assessment is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "171A_R3_A.03.11.01.ODP[01]", "defaultText": null }, { "id": 73793, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591128", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591128", "securityControlId": 31941, "ccis": [], "uuid": "5acae0a2-2d6f-5a5a-af49-9ca29d760ef8", "testId": "RSK-07_A02", "test": "risk assessments are updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "SCF Created", "defaultText": null }, { "id": 73794, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591129", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591129", "securityControlId": 31941, "ccis": [], "uuid": "8f783e4a-4c92-51e9-8a11-19e8c571dbba", "testId": "RSK-07_A03", "test": "risk assessments are updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "171A_R3_A.03.11.01.b", "defaultText": null } ], "externalMappings": [ { "id": 599791, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589407", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e3919f6-22b3-5274-a6f2-e56e57b9bee7", "parentControlId": 31941, "controlId": "03.11.01.b", "title": "03.11.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589407" }, { "controlId": "NSS-17T-Sec4.2", "title": "NSS-17T-Sec4.2 — Design Basis Threat (DBT) Cyber Risk & Attack Vector Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7115826c-a5f6-5abf-96d2-51cc8a3e7c5e", "isPublic": true }, { "controlId": "IEC-62645-5.3", "title": "IEC-62645-5.3 — Nuclear Cyber Risk Assessment & Graded Approach", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "d0d369c3-1a0c-5e6b-8b4f-e6c743c02785", "isPublic": true }, { "controlId": "10-CFR-73.100(a)", "title": "10-CFR-73.100(a) — Risk-Informed, Consequence-Oriented Cyber Protection Standard", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "3128961d-9904-589b-92cf-4ebee5d63a73", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.b", "title": "DOE-O-205.1D-4.b — Risk Management Framework (RMF) for Nuclear & High-Consequence Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "96f38cc0-3dc1-5743-a97a-db551ddb4b9f", "isPublic": true } ], "id": 31941, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731299", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731299", "catalogueId": 1062, "uuid": "c667de24-5c66-5b85-8ab8-702de85e6054", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization routinely update risk assessments and react accordingly upon identifying new security vulnerabilities, including using outside sources for security vulnerability information?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Risk Assessment Update", "description": "

Control Description

Mechanisms exist to routinely update risk assessments and react accordingly upon identifying new security vulnerabilities, including using outside sources for security vulnerability information.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Risk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to routinely update risk assessments and react accordingly upon identifying new security vulnerabilities, including using outside sources for security vulnerability information.

Level 4 - Quantitatively Controlled: Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-07", "family": "Risk Management", "enhancements": "", "sortId": "RSK-07", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73795, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591129", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591129", "securityControlId": 31942, "ccis": [], "uuid": "642113b0-0230-5838-8369-1be1b64f74ff", "testId": "RSK-08_A01", "test": "a Business Impact Analysis (BIA) is conducted to identify and evaluate the impacts of possible disruptions.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 599840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589413", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "341d0ca9-a4d8-573d-b199-b70d33918b0c", "parentControlId": 31942, "controlId": "5.3", "title": "5.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589413" }, { "controlId": "NSS-17T-Sec4.2", "title": "NSS-17T-Sec4.2 — Design Basis Threat (DBT) Cyber Risk & Attack Vector Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "287d3b9d-5e7a-51e7-b158-103d4920b983", "isPublic": true }, { "controlId": "IEC-62645-5.3", "title": "IEC-62645-5.3 — Nuclear Cyber Risk Assessment & Graded Approach", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "1943c343-379d-5ea4-86d5-16a5f962344f", "isPublic": true }, { "controlId": "10-CFR-73.100(a)", "title": "10-CFR-73.100(a) — Risk-Informed, Consequence-Oriented Cyber Protection Standard", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "59c8eba2-a68d-5de8-b24f-129469f4ccd9", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.b", "title": "DOE-O-205.1D-4.b — Risk Management Framework (RMF) for Nuclear & High-Consequence Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "b72ec4c1-a5d0-5119-8ac0-e25c4280d33c", "isPublic": true } ], "id": 31942, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.7313", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.7313", "catalogueId": 1062, "uuid": "358f50c2-719e-5574-966c-055d910beb18", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct a Business Impact Analysis (BIA) to identify and assess security, compliance and resilience risks?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Business Impact Analysis (BIA)", "description": "

Control Description

Mechanisms exist to conduct a Business Impact Analysis (BIA) to identify and assess security, compliance and resilience risks.

Evidence Request List (ERL)

E-CHG-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nRisk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conduct a Business Impact Analysis (BIA) to identify and assess security, compliance and resilience risks.

Level 4 - Quantitatively Controlled: Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-08", "family": "Risk Management", "enhancements": "", "sortId": "RSK-08", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Business Impact Analysis (BIA)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Business Impact Analysis (BIA)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Business Impact Analysis (BIA)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Business Impact Analysis (BIA)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Business Impact Analysis (BIA)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73796, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591129", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591129", "securityControlId": 31943, "ccis": [], "uuid": "75ec0bbf-c31a-5989-93ca-a51e416dfa18", "testId": "RSK-09_A01", "test": "an organization-wide strategy for managing supply chain risks is developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-30a.[01]", "defaultText": null }, { "id": 73797, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591129", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591129", "securityControlId": 31943, "ccis": [], "uuid": "d1639cc6-bf21-5fe4-b76b-a20ab2ad9944", "testId": "RSK-09_A02", "test": "supply chain risks associated with organizational systems and system components are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.11.7e[a]", "defaultText": null }, { "id": 73798, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591129", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591129", "securityControlId": 31943, "ccis": [], "uuid": "84f6d272-4ada-50ed-870d-a0f485123c5e", "testId": "RSK-09_A03", "test": "the supply chain risk management strategy is implemented consistently across the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-30b.", "defaultText": null }, { "id": 73799, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59113", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59113", "securityControlId": 31943, "ccis": [], "uuid": "dddc8052-f5ed-5c93-a480-85ff3c7354c0", "testId": "RSK-09_A04", "test": "a plan for managing supply chain risks is developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.11.7e[c]\n171A_R3_A.03.17.01.a[01]\n53A_R5_SR-02a.[01]", "defaultText": null }, { "id": 73800, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59113", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59113", "securityControlId": 31943, "ccis": [], "uuid": "6eff7dc9-af1c-55a1-aabb-0ecb7b4c6528", "testId": "RSK-09_A05", "test": "security requirements to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences from supply chain-related events are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-02_ODP[01]\n172A_3.11.7e[b]\n171A_R3_A.03.17.03.ODP[01]", "defaultText": null }, { "id": 73801, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59113", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59113", "securityControlId": 31943, "ccis": [], "uuid": "31a6b319-be2c-5908-a295-ce81faaa6c73", "testId": "RSK-09_A06", "test": "the supply chain risk management strategy is reviewed / updated per an organization-defined frequency or as required to address organizational changes.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "53A_R5_PM-30c.", "defaultText": null }, { "id": 73802, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59113", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59113", "securityControlId": 31943, "ccis": [], "uuid": "62eb8444-8caf-5847-8755-4305e13e49f5", "testId": "RSK-09_A07", "test": "the frequency at which to review and update the supply chain risk management plan is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "53A_R5_PM-30_ODP\n53A_R5_SR-02_ODP[02]\n172A_3.11.7e_ODP[1]\n171A_R3_A.03.17.01.ODP[01]", "defaultText": null }, { "id": 73803, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59113", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591131", "securityControlId": 31943, "ccis": [], "uuid": "5f7d157d-8c77-580e-a091-0b2b7fcb97d7", "testId": "RSK-09_A08", "test": "the plan for managing supply chain risks is updated frequently.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.11.7e[d]", "defaultText": null }, { "id": 73804, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591131", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591131", "securityControlId": 31943, "ccis": [], "uuid": "897e7ad7-dbe9-5185-8b0e-d807b3d94c0f", "testId": "RSK-09_A09", "test": "the SCRM plan addresses risks associated with the research and development of the system, system components, or system services.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_SR-02a.[02]\n53A_R5_PM-30a.[02]\n53A_R5_PM-30a.[03]\n53A_R5_PM-30a.[04]\n171A_R3_A.03.17.01.a[02]", "defaultText": null }, { "id": 73805, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591131", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591131", "securityControlId": 31943, "ccis": [], "uuid": "de046c3b-198e-5fda-a1d2-e649de8e9470", "testId": "RSK-09_A10", "test": "the SCRM plan addresses risks associated with the design of the system, system components, or system services.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_SR-02a.[03]\n171A_R3_A.03.17.01.a[03]", "defaultText": null }, { "id": 73806, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591131", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591131", "securityControlId": 31943, "ccis": [], "uuid": "cfa38c34-d04e-5aee-a7d5-789f4754e049", "testId": "RSK-09_A11", "test": "the SCRM plan addresses risks associated with the manufacturing of the system, system components, or system services.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_SR-02a.[04]\n171A_R3_A.03.17.01.a[04]", "defaultText": null }, { "id": 73807, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591131", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591131", "securityControlId": 31943, "ccis": [], "uuid": "00956625-dd5f-5a85-91d3-a6a3228959a1", "testId": "RSK-09_A12", "test": "the SCRM plan addresses risks associated with the acquisition of the system, system components, or system services.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PM-30a.[05]\n53A_R5_PM-30a.[06]\n53A_R5_PM-30a.[07]\n53A_R5_SR-02a.[05]\n171A_R3_A.03.17.01.a[05]", "defaultText": null }, { "id": 73808, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591131", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591131", "securityControlId": 31943, "ccis": [], "uuid": "ef9c90ee-d1f4-5dd2-b91a-906dd4985aac", "testId": "RSK-09_A13", "test": "the SCRM plan addresses risks associated with the delivery of the system, system components, or system services.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_SR-02a.[06]\n171A_R3_A.03.17.01.a[06]", "defaultText": null }, { "id": 73809, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591132", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591132", "securityControlId": 31943, "ccis": [], "uuid": "e14bf726-a3dc-5ce3-a4e3-df1a01806c77", "testId": "RSK-09_A14", "test": "the SCRM plan addresses risks associated with the integration of the system, system components, or system services.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_SR-02a.[07]\n171A_R3_A.03.17.01.a[07]", "defaultText": null }, { "id": 73810, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591132", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591132", "securityControlId": 31943, "ccis": [], "uuid": "9e734f35-4bae-5b05-b2a6-a1a5225d9e48", "testId": "RSK-09_A15", "test": "the SCRM plan addresses risks associated with the operation of the system, system components, or system services.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PM-30a.[08]\n53A_R5_PM-30a.[09]\n53A_R5_PM-30a.[10]\n53A_R5_SR-02a.[08]\n171A_R3_A.03.17.01.a[08]", "defaultText": null }, { "id": 73811, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591132", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591132", "securityControlId": 31943, "ccis": [], "uuid": "1ba4f83d-41f3-58a3-ae64-aafb0589d018", "testId": "RSK-09_A16", "test": "the SCRM plan addresses risks associated with the maintenance of the system, system components, or system services.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PM-30a.[08]\n53A_R5_PM-30a.[09]\n53A_R5_PM-30a.[10]\n53A_R5_SR-02a.[08]\n171A_R3_A.03.17.01.a[09]", "defaultText": null }, { "id": 73812, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59114", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59114", "securityControlId": 31943, "ccis": [], "uuid": "dbd14940-221f-52b2-8110-da8b439040b6", "testId": "RSK-09_A17", "test": "the SCRM plan addresses risks associated with the disposal of the system, system components, or system services.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_PM-30a.[11]\n53A_R5_PM-30a.[12]\n53A_R5_PM-30a.[13]\n53A_R5_SR-02a.[09]\n171A_R3_A.03.17.01.a[10]", "defaultText": null }, { "id": 73813, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591141", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591141", "securityControlId": 31943, "ccis": [], "uuid": "775726de-e79e-5a01-ab56-1b59495dbd1b", "testId": "RSK-09_A18", "test": "the SCRM plan is reviewed per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_SR-02b.", "defaultText": null }, { "id": 73814, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591141", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591141", "securityControlId": 31943, "ccis": [], "uuid": "f86bb082-255a-51c7-a547-c52000e27435", "testId": "RSK-09_A19", "test": "the SCRM plan is updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_SR-02b.", "defaultText": null }, { "id": 73815, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591141", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591141", "securityControlId": 31943, "ccis": [], "uuid": "c276beb5-5191-58f3-8f1a-b5555d4aba2c", "testId": "RSK-09_A20", "test": "the SCRM plan is protected from unauthorized disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_SR-02c.[01]\n171A_R3_A.03.17.01.c", "defaultText": null }, { "id": 73816, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591142", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591142", "securityControlId": 31943, "ccis": [], "uuid": "904c9ab3-cac1-52fc-bc2a-a2b59a66326d", "testId": "RSK-09_A21", "test": "the supply chain risk management plan is protected from unauthorized modification.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SR-02c.[02]", "defaultText": null }, { "id": 73817, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591142", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591142", "securityControlId": 31943, "ccis": [], "uuid": "8da24dc6-3cca-5a5a-b26a-9f574445eb24", "testId": "RSK-09_A22", "test": "Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component or system service are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-07_ODP", "defaultText": null }, { "id": 73818, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591142", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591142", "securityControlId": 31943, "ccis": [], "uuid": "6346e604-1ab1-5cba-b722-b0fdf7c9d5db", "testId": "RSK-09_A23", "test": "OPSEC controls are employed to protect supply chain-related information for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-07", "defaultText": null }, { "id": 73819, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591142", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591142", "securityControlId": 31943, "ccis": [], "uuid": "78269a11-7c81-556b-8b7d-7b90472cbde1", "testId": "RSK-09_A24", "test": "the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of sensitive / regulated data is assessed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 73820, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591142", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591142", "securityControlId": 31943, "ccis": [], "uuid": "5acc03ef-ff65-552b-9ec1-9c26b762a2fd", "testId": "RSK-09_A25", "test": "a process for identifying weaknesses or deficiencies in the supply chain elements and processes is established.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.17.03.a[01]", "defaultText": null }, { "id": 73821, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591143", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591143", "securityControlId": 31943, "ccis": [], "uuid": "3ed7b421-c0d1-5fd2-ad8e-fe7839cfd15e", "testId": "RSK-09_A26", "test": "organization-defined security requirements are enforced to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences of supply chain-related events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 73822, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591143", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591143", "securityControlId": 31943, "ccis": [], "uuid": "a41d46a3-04df-5517-ac17-3629ff6fd701", "testId": "RSK-09_A27", "test": "a process for addressing weaknesses or deficiencies in the supply chain elements and processes is established.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.17.03.a[02]", "defaultText": null }, { "id": 73823, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591143", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591143", "securityControlId": 31943, "ccis": [], "uuid": "845eed94-371b-55ab-85f4-5bb8177ec275", "testId": "RSK-09_A28", "test": "the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI is assessed.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.11.01.a", "defaultText": null }, { "id": 73824, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591143", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591143", "securityControlId": 31943, "ccis": [], "uuid": "ec6cf51a-84b2-5f01-87d5-2926af26b114", "testId": "RSK-09_A29", "test": "the SCRM plan is reviewed .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months, or when there are significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.17.01.b[01]", "defaultText": null }, { "id": 73825, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591143", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591143", "securityControlId": 31943, "ccis": [], "uuid": "1a9aa665-ee11-567c-a81f-2aa04981fce0", "testId": "RSK-09_A30", "test": "the SCRM plan is updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months, or when there are significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.17.01.b[02]", "defaultText": null }, { "id": 73826, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591144", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591144", "securityControlId": 31943, "ccis": [], "uuid": "d2482f88-9f6b-57fc-9e4d-560e581e35cb", "testId": "RSK-09_A31", "test": "the following security requirements are enforced to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences of supply chain-related events: .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at a minimum, integrate Supply Chain Risk Management (SCRM) into acquisition/procurement policies, provide adequate SCRM resources, define the SCRM control baseline, establish processes to ensure suppliers disclose significant vulnerabilities and significant incidents", "otherId": "171A_R3_A.03.17.03.b", "defaultText": null } ], "externalMappings": [ { "id": 599898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589428", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc88d67c-92f9-5d83-964b-e54a473df471", "parentControlId": 31943, "controlId": "5.21", "title": "5.21", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589428" }, { "id": 599899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589428", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec081584-899e-5d3b-9334-97579fe89e10", "parentControlId": 31943, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589428" }, { "id": 599908, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589429", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50ecee3b-458b-56a2-a100-fc7621ae3a88", "parentControlId": 31943, "controlId": "SA-12", "title": "SA-12", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589429" }, { "id": 599909, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589429", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cc32fab-33fa-5026-8120-fd6ffeb31b8c", "parentControlId": 31943, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589429" }, { "id": 599910, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589429", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d87a3b6-5501-5da4-95b8-f86722eb7aa4", "parentControlId": 31943, "controlId": "PM-30", "title": "PM-30", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589429" }, { "id": 599911, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589429", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62ff6ba5-0ba7-5f67-8b15-df2d1efe4beb", "parentControlId": 31943, "controlId": "SA-09(03)", "title": "SA-09(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589429" }, { "id": 599912, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589429", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54880b17-1158-55fe-bfaf-87a0e4e4848d", "parentControlId": 31943, "controlId": "SR-02", "title": "SR-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589429" }, { "id": 599913, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3dd1f1e5-e420-59af-9a84-e1d0e06dd48c", "parentControlId": 31943, "controlId": "SR-07", "title": "SR-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58943" }, { "id": 599917, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7dc8b0f7-f03d-5dd7-bfc4-57ffc1b994f4", "parentControlId": 31943, "controlId": "SR-02", "title": "SR-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58943" }, { "id": 599918, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27cfcc55-7701-56b4-be61-fd2e8793fa1a", "parentControlId": 31943, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58943" }, { "id": 599919, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589431", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e435d839-67af-51d0-bb4b-457f0bc9064e", "parentControlId": 31943, "controlId": "PM-30", "title": "PM-30", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589431" }, { "id": 599920, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589431", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14372c9b-76eb-5ba6-954a-e65aba0beea1", "parentControlId": 31943, "controlId": "SA-09(03)", "title": "SA-09(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589431" }, { "id": 599921, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589431", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6b6f14a-a105-5526-877c-df985e5b1334", "parentControlId": 31943, "controlId": "SR-02", "title": "SR-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589431" }, { "id": 599922, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589431", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14d85d13-6c35-5bd0-bfc9-47434d699534", "parentControlId": 31943, "controlId": "SR-07", "title": "SR-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589431" }, { "id": 599923, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589431", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d70ddd99-d5e7-582f-a423-1915f25442f0", "parentControlId": 31943, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589431" }, { "id": 599924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589431", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "810d8bb4-7d5d-564b-9999-17de7ab9b4f0", "parentControlId": 31943, "controlId": "PM-30", "title": "PM-30", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589431" }, { "id": 599925, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589431", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff683419-5242-5d89-bbc1-ce71be7e14c4", "parentControlId": 31943, "controlId": "SR-02", "title": "SR-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589431" }, { "id": 599926, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589431", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "128f0fb2-9204-5d47-bb04-0f3ae3886d77", "parentControlId": 31943, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589431" }, { "id": 599927, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "086e4175-2dfd-5c32-91d3-2ab326c04fad", "parentControlId": 31943, "controlId": "PM-30", "title": "PM-30", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589432" }, { "id": 599928, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95833e10-01d7-5b6a-aa01-eab326f4ae43", "parentControlId": 31943, "controlId": "SR-02", "title": "SR-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589432" }, { "id": 599929, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53a06983-74ea-5599-8100-5961f5a73c9d", "parentControlId": 31943, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589432" }, { "id": 599930, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12035a9d-ad34-5d4b-ac19-b767f9d77173", "parentControlId": 31943, "controlId": "PM-30", "title": "PM-30", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589432" }, { "id": 599931, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65bfcdac-5c47-553e-9246-bbbdd8652705", "parentControlId": 31943, "controlId": "SR-02", "title": "SR-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589432" }, { "id": 599933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "105d0bc8-154e-55a8-9a7a-58d314aba95c", "parentControlId": 31943, "controlId": "PM-29", "title": "PM-29", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589432" }, { "id": 599934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36cbad21-39e8-5d7c-b228-1f64414718f2", "parentControlId": 31943, "controlId": "PM-30", "title": "PM-30", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589432" }, { "id": 599935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589432", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6dd0abd-99b7-5d35-8966-a318008aa04c", "parentControlId": 31943, "controlId": "SA-9(3)", "title": "SA-9(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589432" }, { "id": 599936, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "087ade4b-02ef-57b3-b61c-fe7cfc9013ca", "parentControlId": 31943, "controlId": "SR-2", "title": "SR-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589433" }, { "id": 599937, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de13818d-c08d-5a56-b72c-9c0563b52fa4", "parentControlId": 31943, "controlId": "SR-7", "title": "SR-7", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589433" }, { "id": 599938, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f703e02-fc04-59ec-80b2-0351d555e585", "parentControlId": 31943, "controlId": "PM-30", "title": "PM-30", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589433" }, { "id": 599939, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9aac1214-fc66-5b5b-9001-b9c84b1be0fe", "parentControlId": 31943, "controlId": "SR-2", "title": "SR-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589433" }, { "id": 599940, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589433", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "921dd841-3849-592b-97b4-15e4e7378a0a", "parentControlId": 31943, "controlId": "PM-30", "title": "PM-30", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589433" }, { "id": 599950, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589434", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b3921fc-bd3c-50a0-a408-f56a10fc8aac", "parentControlId": 31943, "controlId": "03.11.01.a", "title": "03.11.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589434" }, { "id": 599951, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589434", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "373ead50-a3cd-5ce4-9713-2dd414075487", "parentControlId": 31943, "controlId": "03.17.01.a", "title": "03.17.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589435" }, { "id": 599952, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f616391a-6653-58ff-bf0c-4f2a83a6df07", "parentControlId": 31943, "controlId": "03.17.01.b", "title": "03.17.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589435" }, { "id": 599953, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c36391e-ca7d-5eb8-9c76-27d110cdaf9e", "parentControlId": 31943, "controlId": "03.17.03.a", "title": "03.17.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589435" }, { "id": 599954, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589435", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2da862d9-3190-5184-9557-d2dc439ac97f", "parentControlId": 31943, "controlId": "03.17.03.b", "title": "03.17.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589435" }, { "id": 599976, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b614485-3720-5810-b992-233fa1e8fa5c", "parentControlId": 31943, "controlId": "GV.SC", "title": "GV.SC", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589437" }, { "id": 599977, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57982d68-b3a6-5c9f-a692-297935451f49", "parentControlId": 31943, "controlId": "GV.SC-01", "title": "GV.SC-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589437" }, { "id": 599978, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4c3afae-84ff-5c13-bebd-0f0e22c1b2eb", "parentControlId": 31943, "controlId": "GV.SC-03", "title": "GV.SC-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589438" }, { "id": 599979, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "754da41e-1b7d-55cc-b6b0-0e355b264412", "parentControlId": 31943, "controlId": "GV.SC-05", "title": "GV.SC-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589438" }, { "id": 599980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4378646-2b63-55b7-ad3a-640ff301a148", "parentControlId": 31943, "controlId": "GV.SC-09", "title": "GV.SC-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589438" }, { "id": 599981, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9fe4629-27a9-5f0d-a511-3a93663508ff", "parentControlId": 31943, "controlId": "GV.SC-10", "title": "GV.SC-10", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589438" }, { "id": 599982, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b2e07cb-ac8f-5b8a-83c5-b387a1c3dd45", "parentControlId": 31943, "controlId": "ID", "title": "ID", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589438" }, { "id": 599983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "913a14b1-b9cc-5a5b-ade0-ef534e548cae", "parentControlId": 31943, "controlId": "ID.RA", "title": "ID.RA", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589438" }, { "id": 599984, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b67751d-fac6-5d64-8da9-e0c05da135fb", "parentControlId": 31943, "controlId": "ID.IM", "title": "ID.IM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589438" }, { "id": 599985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589438", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69ecd24e-d59f-5985-8b05-03de054549ab", "parentControlId": 31943, "controlId": "PR", "title": "PR", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589438" }, { "id": 600012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc4b2767-98c7-5cf3-830f-1a8a013b3c01", "parentControlId": 31943, "controlId": "CIP-013-2 R1", "title": "CIP-013-2 R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589441" }, { "id": 600013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a5c84d4-a742-50db-a91c-6b6cba0e875a", "parentControlId": 31943, "controlId": "CIP-013-2 R2", "title": "CIP-013-2 R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589441" }, { "id": 600014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8b74ced-4382-5380-9363-530ebf6c6dc0", "parentControlId": 31943, "controlId": "CIP-013-2 R3", "title": "CIP-013-2 R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589442" }, { "id": 600051, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73a61eee-271c-5193-9283-91053471820b", "parentControlId": 31943, "controlId": "A4", "title": "A4", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589446" }, { "id": 600052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cef54133-5e00-52d7-87f7-9c8ae45a636a", "parentControlId": 31943, "controlId": "A4.a", "title": "A4.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589446" }, { "controlId": "CIP-013-2-R1", "title": "CIP-013-2-R1 — Supply Chain Cyber Security Risk Management Plan", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "40e13c3a-2bc9-55d9-9c33-78d882687c42", "isPublic": true }, { "controlId": "CIP-013-2-1.1", "title": "CIP-013-2-1.1 — One or more process(es) used in planning for the procurement of BES Cyber Systems and their associated EACMS and PACS...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-013-2-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2c1d36cc-0a6c-55b7-9819-ae65a3861ae3", "isPublic": true }, { "controlId": "CIP-013-2-1.2", "title": "CIP-013-2-1.2 — One or more process(es) used in procuring BES Cyber Systems, and their associated EACMS and PACS, that address the fo...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-013-2-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9205055a-d644-560c-9727-a065d4aa700e", "isPublic": true }, { "controlId": "CIP-013-2-R2", "title": "CIP-013-2-R2 — Supply Chain Risk Management Plan Implementation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ca54aa05-befd-543b-91fc-da33241b0d2e", "isPublic": true }, { "controlId": "CIP-013-2-R3", "title": "CIP-013-2-R3 — Supply Chain Risk Management Plan Review and Approval", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4092e7de-cd51-5d9b-ad76-fd239491b885", "isPublic": true }, { "controlId": "NSS-17T-Sec4.2", "title": "NSS-17T-Sec4.2 — Design Basis Threat (DBT) Cyber Risk & Attack Vector Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "51703339-3775-5301-ab03-f78415021cc7", "isPublic": true }, { "controlId": "IEC-62645-5.3", "title": "IEC-62645-5.3 — Nuclear Cyber Risk Assessment & Graded Approach", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "5be5998f-e65d-5cd1-997c-9e323dfcad16", "isPublic": true }, { "controlId": "10-CFR-73.100(a)", "title": "10-CFR-73.100(a) — Risk-Informed, Consequence-Oriented Cyber Protection Standard", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "8bfe0dd2-3d14-585d-9107-068ad04fce3e", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.b", "title": "DOE-O-205.1D-4.b — Risk Management Framework (RMF) for Nuclear & High-Consequence Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "fd06f0cf-ac36-5870-8c06-766188c67bc2", "isPublic": true } ], "id": 31943, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.7313", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.7313", "catalogueId": 1062, "uuid": "86804dae-1898-5a3d-9607-9b419655674e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization develop a plan for Supply Chain Risk Management (SCRM) associated with the development, acquisition, maintenance and disposal of Technology Assets, Applications and/or Services (TAAS), including documenting selected mitigating actions and monitoring performance against those plans?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Supply Chain Risk Management (SCRM) Plan", "description": "

Control Description

Mechanisms exist to develop a plan for Supply Chain Risk Management (SCRM) associated with the development, acquisition, maintenance and disposal of Technology Assets, Applications and/or Services (TAAS), including documenting selected mitigating actions and monitoring performance against those plans.

Evidence Request List (ERL)

E-RSK-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Risk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to develop a plan for Supply Chain Risk Management (SCRM) associated with the development, acquisition, maintenance and disposal of Technology Assets, Applications and/or Services (TAAS), including documenting selected mitigating actions and monitoring performance against those plans.

Level 4 - Quantitatively Controlled: Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

NERC-CIP (2026) Requirements: CIP-013-2-R1, CIP-013-2-R2, CIP-013-2-R3", "controlId": "RSK-09", "family": "Risk Management", "enhancements": "", "sortId": "RSK-09", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Supply Chain Risk Management (SCRM) Plan

Small Business (10-49 staff)

∙ Risk Management Program (RMP)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Supply Chain Risk Management (SCRM) Plan

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Supply Chain Risk Management (SCRM) Plan

Large Business (250-999 staff)

∙ Risk Management Program (RMP)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Supply Chain Risk Management (SCRM) Plan

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Supply Chain Risk Management (SCRM) Plan", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73827, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591144", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591144", "securityControlId": 31944, "ccis": [], "uuid": "8319aec5-0744-5858-9954-0f599448bea6", "testId": "RSK-09.1_A01", "test": "supply chain risks associated with organizational systems and system components are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.11.6e[a]\n53A_R5_RA-03(01)_ODP[01]", "defaultText": null }, { "id": 73828, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591144", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591144", "securityControlId": 31944, "ccis": [], "uuid": "9c7ffd44-ebcb-50c2-b3ee-d35d91dd3fe3", "testId": "RSK-09.1_A02", "test": "supply chain risks associated with organizational systems and system components are assessed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.11.6e[b]\n53A_R5_RA-03(01)(a)", "defaultText": null }, { "id": 73829, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591145", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591145", "securityControlId": 31944, "ccis": [], "uuid": "d2190db6-8ab7-5d04-8395-48bc725a35b7", "testId": "RSK-09.1_A03", "test": "supply chain risks associated with organizational systems and system components are responded to.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.11.6e[c]", "defaultText": null }, { "id": 73830, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591145", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591145", "securityControlId": 31944, "ccis": [], "uuid": "67fcfdbf-3a1f-59c9-b471-43397a303adb", "testId": "RSK-09.1_A04", "test": "supply chain risks associated with organizational systems and system components are monitored.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.11.6e[d]", "defaultText": null }, { "id": 73831, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591145", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591145", "securityControlId": 31944, "ccis": [], "uuid": "a5e0ea47-b75d-5311-b691-c64234646ea5", "testId": "RSK-09.1_A05", "test": "the frequency at which to update the supply chain risk assessment is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "53A_R5_RA-03(01)_ODP[02]", "defaultText": null }, { "id": 73832, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591145", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591145", "securityControlId": 31944, "ccis": [], "uuid": "cb392d32-cf5b-5183-8807-370531ea10ef", "testId": "RSK-09.1_A06", "test": "the supply chain risk assessment is updated frequently, when there are significant changes to the relevant supply chain or when changes to the system, environments of operation or other conditions may necessitate a change in the supply chain.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_RA-03(01)(b)", "defaultText": null } ], "externalMappings": [ { "id": 600104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b842912-f7bb-56c0-9f58-c91b60d07a72", "parentControlId": 31944, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589452" }, { "id": 600109, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5e4df4d-a0d0-53bf-8bc0-ec0055fd147b", "parentControlId": 31944, "controlId": "RA-03(01)", "title": "RA-03(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589452" }, { "id": 600110, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6be98e0-56fa-5e38-895d-3a981461699c", "parentControlId": 31944, "controlId": "RA-03(01)", "title": "RA-03(01)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589452" }, { "id": 600111, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc782b42-8f6f-5c35-afa7-84918f4bbb19", "parentControlId": 31944, "controlId": "RA-03(01)", "title": "RA-03(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589452" }, { "id": 600112, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f90bbbc-091b-5dce-a4d7-cf9edda74fb0", "parentControlId": 31944, "controlId": "RA-03(01)", "title": "RA-03(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589453" }, { "id": 600113, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ecf90d4e-0693-50d3-a4f9-c4a6827a7041", "parentControlId": 31944, "controlId": "RA-03(01)", "title": "RA-03(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589453" }, { "id": 600114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba646ab7-a955-5fc0-8de5-3acd8bd6b350", "parentControlId": 31944, "controlId": "RA-03(01)", "title": "RA-03(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589453" }, { "id": 600115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c27e255-69c8-516d-888d-e2c1bdd78837", "parentControlId": 31944, "controlId": "RA-3(1)", "title": "RA-3(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589453" }, { "id": 600116, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b46f8e21-15d4-535f-8f11-93e6ebc2c4eb", "parentControlId": 31944, "controlId": "RA-3(1)", "title": "RA-3(1)", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589453" }, { "id": 600117, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589453", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fc67e83-6896-572f-a34e-7142c954356c", "parentControlId": 31944, "controlId": "RA-3(1)", "title": "RA-3(1)", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589453" }, { "id": 600121, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589454", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ee9d438-e708-5e46-8dcf-0ba5ff4e9e99", "parentControlId": 31944, "controlId": "03.11.01.a", "title": "03.11.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589454" }, { "id": 600122, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589454", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77170695-1a11-52bb-b4d0-cc06eee7e978", "parentControlId": 31944, "controlId": "03.11.01.b", "title": "03.11.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589454" }, { "id": 600123, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589454", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fd06805-107e-5794-8de8-6c2ef3c61998", "parentControlId": 31944, "controlId": "03.17.03.a", "title": "03.17.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589454" }, { "id": 600125, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589454", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53279096-8d1d-5705-96b7-66936efabc7d", "parentControlId": 31944, "controlId": "GV.SC", "title": "GV.SC", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589454" }, { "id": 600126, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589454", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b6f6c43-9637-5e1b-878b-c67a7154be06", "parentControlId": 31944, "controlId": "GV.SC-09", "title": "GV.SC-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589454" } ], "id": 31944, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.7313", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.7313", "catalogueId": 1062, "uuid": "c2841438-3dd5-5de6-8a92-f8501764312c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization periodically assess supply chain risks associated with Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Supply Chain Risk Assessment", "description": "

Control Description

Mechanisms exist to periodically assess supply chain risks associated with Technology Assets, Applications and/or Services (TAAS).

Evidence Request List (ERL)

E-RSK-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nRisk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to periodically assess supply chain risks associated with Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-09.1", "family": "Risk Management", "enhancements": "", "sortId": "RSK-09.1", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Business Impact Analysis (BIA)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Business Impact Analysis (BIA)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Business Impact Analysis (BIA)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Business Impact Analysis (BIA)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Business Impact Analysis (BIA)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73834, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591146", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591146", "securityControlId": 31946, "ccis": [], "uuid": "e2051642-79c3-57a6-9c82-e5369cd94a1d", "testId": "RSK-10_A01", "test": "Data Protection Impact Assessments (DPIAs) are conducted for systems, programs or other activities before developing or procuring information technology that processes Personal Data (PD).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-08a.", "defaultText": null }, { "id": 73835, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591146", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591146", "securityControlId": 31946, "ccis": [], "uuid": "086cc075-09ee-59e4-a1f9-760af095516a", "testId": "RSK-10_A02", "test": "Data Protection Impact Assessments (DPIAs) are conducted for systems, programs or other activities before initiating a collection of Personal Data (PD) that will be processed using information technology.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-08b.[01]", "defaultText": null }, { "id": 73836, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591146", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591146", "securityControlId": 31946, "ccis": [], "uuid": "acf8b419-8754-5787-84f5-66971ffb5652", "testId": "RSK-10_A03", "test": "Data Protection Impact Assessments (DPIAs) are conducted for systems, programs or other activities before initiating a collection of Personal Data (PD) that includes Personal Data (PD) permitting the physical or virtual (online) contacting of a specific individual.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-08b.[02]", "defaultText": null } ], "externalMappings": [ { "id": 600179, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58946", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b2dfb4a-3f13-514d-86d3-bed4c8ace797", "parentControlId": 31946, "controlId": "5.33", "title": "5.33", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58946" }, { "id": 600216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fb8d2a2-ecc6-5783-b968-e05fcb3d2ff1", "parentControlId": 31946, "controlId": "AR-2", "title": "AR-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589473" }, { "id": 600217, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64bfa134-1788-5087-97c7-a22151150832", "parentControlId": 31946, "controlId": "RA-08", "title": "RA-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589473" }, { "id": 600219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589473", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09f4e563-42ae-51e9-88ba-d56c8c9c55e0", "parentControlId": 31946, "controlId": "RA-08", "title": "RA-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589473" }, { "controlId": "NSS-17T-Sec4.2", "title": "NSS-17T-Sec4.2 — Design Basis Threat (DBT) Cyber Risk & Attack Vector Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "725ef73b-05df-5eb1-b096-6a96ff8b7ffe", "isPublic": true }, { "controlId": "IEC-62645-5.3", "title": "IEC-62645-5.3 — Nuclear Cyber Risk Assessment & Graded Approach", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "1350f1e8-d75d-5524-8885-97754d44fbc4", "isPublic": true }, { "controlId": "10-CFR-73.100(a)", "title": "10-CFR-73.100(a) — Risk-Informed, Consequence-Oriented Cyber Protection Standard", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "132586e9-213f-582a-8753-fa99e7c8074f", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.b", "title": "DOE-O-205.1D-4.b — Risk Management Framework (RMF) for Nuclear & High-Consequence Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "346b618d-1d71-5488-a4da-383f50e3de26", "isPublic": true } ], "id": 31946, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731301", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731301", "catalogueId": 1062, "uuid": "e2846e54-2641-5af2-9fa3-9b90715febab", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct a Data Protection Impact Assessment (DPIA) on Technology Assets, Applications and/or Services (TAAS) that store, process and/or transmit Personal Data (PD) to identify and remediate reasonably-expected risks?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Data Protection Impact Assessment (DPIA)", "description": "

Control Description

Mechanisms exist to conduct a Data Protection Impact Assessment (DPIA) on Technology Assets, Applications and/or Services (TAAS) that store, process and/or transmit Personal Data (PD) to identify and remediate reasonably-expected risks.

Evidence Request List (ERL)

E-PRI-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nRisk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conduct a Data Protection Impact Assessment (DPIA) on Technology Assets, Applications and/or Services (TAAS) that store, process and/or transmit Personal Data (PD) to identify and remediate reasonably-expected risks.

Level 4 - Quantitatively Controlled: Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-10", "family": "Risk Management", "enhancements": "", "sortId": "RSK-10", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Privacy Impact Assessment (PIA)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Privacy Impact Assessment (PIA)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Privacy Impact Assessment (PIA)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Privacy Impact Assessment (PIA)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)\n∙ Data Protection Impact Assessment (DPIA)\n∙ Privacy Impact Assessment (PIA)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73837, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591148", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591148", "securityControlId": 31947, "ccis": [], "uuid": "50c3d811-431a-5254-be32-12709a4e31ea", "testId": "RSK-11_A01", "test": "risk monitoring is an integral part of the continuous monitoring strategy.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-07(04)", "defaultText": null }, { "id": 73838, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591148", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591148", "securityControlId": 31947, "ccis": [], "uuid": "28b91f5f-a0a6-5d19-8fd7-bbe716164165", "testId": "RSK-11_A02", "test": "effectiveness monitoring is included in risk monitoring.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-07(04)(a)", "defaultText": null }, { "id": 73839, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591149", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591149", "securityControlId": 31947, "ccis": [], "uuid": "46b4d205-841b-5594-a3f4-77d0c1b01d74", "testId": "RSK-11_A03", "test": "compliance monitoring is included in risk monitoring.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-07(04)(b)", "defaultText": null }, { "id": 73840, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591149", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591149", "securityControlId": 31947, "ccis": [], "uuid": "d8366cea-ba41-5d70-905b-b535fb0e9b55", "testId": "RSK-11_A04", "test": "change monitoring is included in risk monitoring.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-07(04)(c)", "defaultText": null } ], "externalMappings": [ { "id": 600373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36819ebe-340f-53af-9b56-77313db73e3f", "parentControlId": 31947, "controlId": "CA-07(04)", "title": "CA-07(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589491" }, { "id": 600375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0cffd84f-4780-5071-a15d-a7a206ac3400", "parentControlId": 31947, "controlId": "CA-07(04)", "title": "CA-07(04)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589491" }, { "id": 600376, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16317906-5f9b-55d0-afdb-9c600f522793", "parentControlId": 31947, "controlId": "CA-07(04)", "title": "CA-07(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589491" }, { "id": 600377, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "305a195b-7595-58d6-a83f-d1d22e0afe68", "parentControlId": 31947, "controlId": "CA-07(04)", "title": "CA-07(04)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589491" }, { "id": 600378, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc9ebc28-518e-5e2e-8d6f-cc4809b73fd2", "parentControlId": 31947, "controlId": "CA-07(04)", "title": "CA-07(04)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589491" }, { "id": 600379, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589491", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74298a53-ef8d-5862-b227-b9aada5f3ffc", "parentControlId": 31947, "controlId": "CA-07(04)", "title": "CA-07(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589491" }, { "controlId": "NSS-17T-Sec4.2", "title": "NSS-17T-Sec4.2 — Design Basis Threat (DBT) Cyber Risk & Attack Vector Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "42222628-ff7d-52e4-b8f0-14a6c13c8c4e", "isPublic": true }, { "controlId": "IEC-62645-5.3", "title": "IEC-62645-5.3 — Nuclear Cyber Risk Assessment & Graded Approach", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "e29f6ac0-d201-5c2d-b1b2-0ee3fef3bfd9", "isPublic": true }, { "controlId": "10-CFR-73.100(a)", "title": "10-CFR-73.100(a) — Risk-Informed, Consequence-Oriented Cyber Protection Standard", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "243ac8cf-413d-57b8-8b34-02d039ed010d", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.b", "title": "DOE-O-205.1D-4.b — Risk Management Framework (RMF) for Nuclear & High-Consequence Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "3ca0895a-6863-5849-931d-753b182804f7", "isPublic": true } ], "id": 31947, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731301", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731301", "catalogueId": 1062, "uuid": "97739bc5-0338-5be3-a2f4-a43a5a918ffa", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure risk monitoring as an integral part of the continuous monitoring strategy that includes monitoring the effectiveness of security, compliance and resilience controls, compliance and change management?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Risk Monitoring", "description": "

Control Description

Mechanisms exist to ensure risk monitoring as an integral part of the continuous monitoring strategy that includes monitoring the effectiveness of security, compliance and resilience controls, compliance and change management.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nRisk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.\n▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.\n▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure risk monitoring as an integral part of the continuous monitoring strategy that includes monitoring the effectiveness of security, compliance and resilience controls, compliance and change management.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-11", "family": "Risk Management", "enhancements": "", "sortId": "RSK-11", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)\n∙ Risk register\n∙ Plan of Action & Milestones (POA&M)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73841, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591149", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591149", "securityControlId": 31948, "ccis": [], "uuid": "789287f0-59fc-5e43-aaa5-233ae086fbe9", "testId": "RSK-12_A01", "test": "an executive steering committee, or advisory board, defines the organization's risk culture.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73842, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591149", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59115", "securityControlId": 31948, "ccis": [], "uuid": "65b05ef2-f75c-5342-8154-7d68da53919e", "testId": "RSK-12_A02", "test": "a Chief Risk Officer (CRO), or similar position, is tasked with operationalizing the defined risk culture criteria throughout the organization's Business As Usual (BAU) activities.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 600398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589493", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "170c21c7-00f1-57ce-851d-f37f21a1d266", "parentControlId": 31948, "controlId": "GV.RR-01", "title": "GV.RR-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589493" }, { "controlId": "NSS-17T-Sec4.2", "title": "NSS-17T-Sec4.2 — Design Basis Threat (DBT) Cyber Risk & Attack Vector Assessment", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "0c2a9827-f797-502c-a18d-961eec5ffdfb", "isPublic": true }, { "controlId": "IEC-62645-5.3", "title": "IEC-62645-5.3 — Nuclear Cyber Risk Assessment & Graded Approach", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "e4a1b66f-3bfd-5e56-a207-ec41487fb3e0", "isPublic": true }, { "controlId": "10-CFR-73.100(a)", "title": "10-CFR-73.100(a) — Risk-Informed, Consequence-Oriented Cyber Protection Standard", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "10 CFR Part 53 (Advanced Reactors / SMRs)", "uuid": "e1df263d-1963-5436-a818-07bd3a4ad5ff", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.b", "title": "DOE-O-205.1D-4.b — Risk Management Framework (RMF) for Nuclear & High-Consequence Assets", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (RSK Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "afdd8bc3-817d-5078-aee6-5b5a93faff45", "isPublic": true } ], "id": 31948, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731302", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731302", "catalogueId": 1062, "uuid": "f59ba3f4-ccb4-5ecf-bc0c-4e1a88a1524f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure teams are committed to a culture that considers and communicates technology-related risk?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Risk Culture", "description": "

Control Description

Mechanisms exist to ensure teams are committed to a culture that considers and communicates technology-related risk.

Evidence Request List (ERL)

E-RSK-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nRisk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.\n▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.\n▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.\n▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform, TPRM tool, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure teams are committed to a culture that considers and communicates technology-related risk.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "RSK-12", "family": "Risk Management", "enhancements": "", "sortId": "RSK-12", "references": "

Micro-Small Business (<10 staff)

∙ Risk Management Program (RMP)

Small Business (10-49 staff)

∙ Risk Management Program (RMP)

Medium Business (50-249 staff)

∙ Risk Management Program (RMP)

Large Business (250-999 staff)

∙ Risk Management Program (RMP)

Enterprise (>1,000 staff)

∙ Risk Management Program (RMP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73851, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591152", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591152", "securityControlId": 31952, "ccis": [], "uuid": "cb3fa191-1488-5664-8978-929f88600e90", "testId": "SEA-01_A01", "test": "secure engineering principles are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-08_ODP[01]", "defaultText": null }, { "id": 73852, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591152", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591152", "securityControlId": 31952, "ccis": [], "uuid": "1de3475c-876e-5a72-a4b3-89f1006339b6", "testId": "SEA-01_A02", "test": "data privacy engineering principles are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-08_ODP[02]", "defaultText": null }, { "id": 73853, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591152", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591152", "securityControlId": 31952, "ccis": [], "uuid": "1321412e-6a8b-5d1e-89b9-106b9a3b7f29", "testId": "SEA-01_A03", "test": "architectural designs that promote effective cybersecurity / data privacy are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.13.2[a]", "defaultText": null }, { "id": 73854, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591152", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591152", "securityControlId": 31952, "ccis": [], "uuid": "8d71dd05-fb78-5f7d-8d92-518466ffc123", "testId": "SEA-01_A04", "test": "systems engineering principles that promote effective cybersecurity / data privacy are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.13.2[c]", "defaultText": null }, { "id": 73855, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591152", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591152", "securityControlId": 31952, "ccis": [], "uuid": "1d4fff79-2f77-5c86-8d19-0f7ba631d6bc", "testId": "SEA-01_A05", "test": "identified architectural designs that promote effective cybersecurity / data privacy are employed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.13.2[d]", "defaultText": null }, { "id": 73856, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591152", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591153", "securityControlId": 31952, "ccis": [], "uuid": "302a4fd6-7e03-5a82-af9d-277a0e88e625", "testId": "SEA-01_A06", "test": "identified systems engineering principles that promote effective cybersecurity / data privacy are employed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.13.2[f]", "defaultText": null }, { "id": 73857, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591153", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591153", "securityControlId": 31952, "ccis": [], "uuid": "dacfdb95-594d-5c38-b459-2fc6932874e2", "testId": "SEA-01_A07", "test": "systems security engineering principles to be applied to the development or modification of the system and system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.16.01.ODP[01]", "defaultText": null }, { "id": 73858, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591153", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591153", "securityControlId": 31952, "ccis": [], "uuid": "67a06292-5312-5c46-ac53-d65611eaf2ca", "testId": "SEA-01_A08", "test": "systems security engineering principles are applied in the specification of the system and system components.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08[01]\n53A_R5_SA-08[06]", "defaultText": null }, { "id": 73859, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591153", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591153", "securityControlId": 31952, "ccis": [], "uuid": "c35b3aa9-3ec2-522c-8005-fb3dfc0cbc3d", "testId": "SEA-01_A09", "test": "cybersecurity / data privacy engineering principles are applied in the design of the system and system components.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08[02]\n53A_R5_SA-08[07]", "defaultText": null }, { "id": 73860, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591153", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591153", "securityControlId": 31952, "ccis": [], "uuid": "4d4406f4-b634-5873-bb76-0183c46587a6", "testId": "SEA-01_A10", "test": "cybersecurity / data privacy engineering principles are applied in the development of the system and system components.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08[03]\n53A_R5_SA-08[08]", "defaultText": null }, { "id": 73861, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591154", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591154", "securityControlId": 31952, "ccis": [], "uuid": "1354338f-caad-501b-b067-99b12b84732f", "testId": "SEA-01_A11", "test": "cybersecurity / data privacy engineering principles are applied in the implementation of the system and system components.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08[04]\n53A_R5_SA-08[09]", "defaultText": null }, { "id": 73862, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591154", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591154", "securityControlId": 31952, "ccis": [], "uuid": "451ebe5d-5d29-5a34-a906-9655a2f9bb67", "testId": "SEA-01_A12", "test": "cybersecurity / data privacy engineering principles are applied in the modification of the system and system components.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08[05]\n53A_R5_SA-08[10]", "defaultText": null }, { "id": 73863, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591154", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591154", "securityControlId": 31952, "ccis": [], "uuid": "9b1e0b22-1c70-58e0-bce1-371638bd0b22", "testId": "SEA-01_A13", "test": "thresholds to which attack surfaces are to be reduced are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-15(05)_ODP", "defaultText": null }, { "id": 73864, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591154", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591154", "securityControlId": 31952, "ccis": [], "uuid": "2f915744-d2de-5709-a9b0-136512ea2981", "testId": "SEA-01_A14", "test": "the developer of the system, system component, or system service is required to reduce attack surfaces to organization-defined thresholds.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-15(05)", "defaultText": null }, { "id": 73865, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591154", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591154", "securityControlId": 31952, "ccis": [], "uuid": "929a3702-1688-5ed6-947d-8759329f8f50", "testId": "SEA-01_A15", "test": "systems are prevented from entering unsecure states in the event of an operational failure of a boundary protection device.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-07(18)", "defaultText": null }, { "id": 73866, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591155", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591155", "securityControlId": 31952, "ccis": [], "uuid": "a8e33297-825e-5d0a-9c49-9261a347cdd5", "testId": "SEA-01_A16", "test": "Secure Engineering & Architecture (SEA) operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73867, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591155", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591155", "securityControlId": 31952, "ccis": [], "uuid": "079198a8-f143-5af3-9cac-1a19413fde24", "testId": "SEA-01_A17", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support Secure Engineering & Architecture (SEA) operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73868, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591155", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591155", "securityControlId": 31952, "ccis": [], "uuid": "4a7ba04f-7de1-5ed2-afcc-083e12249375", "testId": "SEA-01_A18", "test": "responsibility and authority for the performance of Secure Engineering & Architecture (SEA)-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73869, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591155", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591155", "securityControlId": 31952, "ccis": [], "uuid": "5c2ed359-59a8-50d7-890e-8c177c1f44cf", "testId": "SEA-01_A19", "test": "personnel performing Secure Engineering & Architecture (SEA)-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 600455, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf8a43a5-5915-5682-a870-096a369c57ff", "parentControlId": 31952, "controlId": "8.12", "title": "8.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5895" }, { "id": 600456, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2cde039a-1e9c-5fd3-9a73-6994370cc201", "parentControlId": 31952, "controlId": "8.26", "title": "8.26", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5895" }, { "id": 600457, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5895", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cccd8b9b-f783-5628-8873-215d143dec3a", "parentControlId": 31952, "controlId": "8.27", "title": "8.27", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5895" }, { "id": 600463, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589501", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f95c632-2a62-5919-9995-93c6eda088cd", "parentControlId": 31952, "controlId": "T1005", "title": "T1005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589501" }, { "id": 600464, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589501", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db752c9b-9bf5-5413-a256-abce3375a1bb", "parentControlId": 31952, "controlId": "T1025", "title": "T1025", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589501" }, { "id": 600465, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589501", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f514163-c9be-52f9-92b6-c738cf91f9f8", "parentControlId": 31952, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589501" }, { "id": 600466, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589501", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7635e824-e272-5331-b1c5-9b9ddf36b140", "parentControlId": 31952, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589501" }, { "id": 600467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589501", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59aa8e27-3949-5f38-813e-2309f3fef0cf", "parentControlId": 31952, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589501" }, { "id": 600468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589501", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8059804b-ed39-5424-90a4-f367ca74d2ae", "parentControlId": 31952, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589501" }, { "id": 600469, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97a18f65-08eb-5709-b8ca-a401d7bae50b", "parentControlId": 31952, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589502" }, { "id": 600470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7e69a24-b60d-5c99-b27f-c6fac1398d02", "parentControlId": 31952, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589502" }, { "id": 600471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4395b79-e1fa-5046-8ae8-f37440c8a824", "parentControlId": 31952, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589502" }, { "id": 600472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db4703a7-6078-5de7-ac35-22f473f62d6e", "parentControlId": 31952, "controlId": "T1078.001", "title": "T1078.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589502" }, { "id": 600473, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35afdad2-9b21-5174-8c3d-9c9d4bd69457", "parentControlId": 31952, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589502" }, { "id": 600474, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9edd4708-9ae9-5eb7-902f-ea97fe8e8eb0", "parentControlId": 31952, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589502" }, { "id": 600475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c399852-cc2d-54c1-9e4b-64d998852500", "parentControlId": 31952, "controlId": "T1134.005", "title": "T1134.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589502" }, { "id": 600476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d739e5d6-cb13-5583-9f3b-f354e0fe15b8", "parentControlId": 31952, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589502" }, { "id": 600477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0be518b5-2810-5932-bea9-83bb2a416271", "parentControlId": 31952, "controlId": "T1213.003", "title": "T1213.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589502" }, { "id": 600478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a41b02e-d839-51e4-b34c-fcb8888e00ff", "parentControlId": 31952, "controlId": "T1482", "title": "T1482", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589502" }, { "id": 600479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589503", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ccd1411-820c-54bd-8235-6b8b33579a4e", "parentControlId": 31952, "controlId": "T1559.003", "title": "T1559.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589503" }, { "id": 600480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589503", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce911a15-efd1-5f9b-b085-37c34931ce55", "parentControlId": 31952, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589503" }, { "id": 600481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589503", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd54f989-ccd4-528d-9c2b-088d7437de7f", "parentControlId": 31952, "controlId": "T1574.002", "title": "T1574.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589503" }, { "id": 600482, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589503", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8d6781d-c156-5cfc-8c83-10f8a7df2c15", "parentControlId": 31952, "controlId": "T1647", "title": "T1647", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589503" }, { "id": 600492, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae3310ac-e699-54af-9208-3e922ddd9536", "parentControlId": 31952, "controlId": "AR-7", "title": "AR-7", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589504" }, { "id": 600493, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d24f01ea-639c-54a7-a554-fb820a73af3f", "parentControlId": 31952, "controlId": "SA-8", "title": "SA-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589504" }, { "id": 600494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7f84cf7-a229-57b9-9acc-e0f96905cac6", "parentControlId": 31952, "controlId": "SA-13", "title": "SA-13", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589504" }, { "id": 600495, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "675ef108-b607-5555-ba22-4866fb35c1ad", "parentControlId": 31952, "controlId": "SC-1", "title": "SC-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589504" }, { "id": 600496, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589504", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "843ea350-2fd4-5f2a-bbd1-89fa13fa8307", "parentControlId": 31952, "controlId": "SC-7(18)", "title": "SC-7(18)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589504" }, { "id": 600497, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589505", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b02e74b5-38ce-5a0d-8366-ea81398db1c4", "parentControlId": 31952, "controlId": "SI-1", "title": "SI-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589505" }, { "id": 600498, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589505", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0bb4f023-4d79-5883-bf69-868a4d8175b7", "parentControlId": 31952, "controlId": "PT-01", "title": "PT-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589505" }, { "id": 600499, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589505", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf2f7b19-6d33-5b32-b08e-2bfaadaf8159", "parentControlId": 31952, "controlId": "SA-08", "title": "SA-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589505" }, { "id": 600500, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589505", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efe3a552-f991-5ec6-bc24-79f7c7f80464", "parentControlId": 31952, "controlId": "SA-15(05)", "title": "SA-15(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589505" }, { "id": 600501, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589505", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e9be38e-81ac-55a2-8664-4cb0e6fee407", "parentControlId": 31952, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589505" }, { "id": 600502, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589505", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a905e03b-c602-51b6-8a89-fc7ac1b83c68", "parentControlId": 31952, "controlId": "SC-07(18)", "title": "SC-07(18)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589505" }, { "id": 600503, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589505", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73d47278-1f7d-51ed-bba2-f9847b84396b", "parentControlId": 31952, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589505" }, { "id": 600509, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589506", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76503625-f704-559b-8ece-67420f560bfa", "parentControlId": 31952, "controlId": "SA-08", "title": "SA-08", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589506" }, { "id": 600510, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589506", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4374d471-3d00-51ba-9cbe-7f6664ea817d", "parentControlId": 31952, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589506" }, { "id": 600511, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589506", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ba18ae9-1806-5995-82c7-e8c4072c25ba", "parentControlId": 31952, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589506" }, { "id": 600512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589506", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be70e2ce-bcca-554c-8c2b-7bce086f1052", "parentControlId": 31952, "controlId": "SC-07(18)", "title": "SC-07(18)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589506" }, { "id": 600513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589506", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a4c6e95-bb6e-5899-ad11-7ec14f8a9aa8", "parentControlId": 31952, "controlId": "PT-01", "title": "PT-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589506" }, { "id": 600514, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589506", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77a8e23a-8ae9-5d3f-bdea-d0bf84950a51", "parentControlId": 31952, "controlId": "SA-08", "title": "SA-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589506" }, { "id": 600515, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589506", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf131f7e-80b7-52f2-aa97-d635f7e2e0a0", "parentControlId": 31952, "controlId": "SA-15(05)", "title": "SA-15(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589506" }, { "id": 600516, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5bf8c9ac-4851-5c95-81a5-8a6600475451", "parentControlId": 31952, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589515" }, { "id": 600517, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4faf65a-c971-5a0f-bbca-26a07cd1ec27", "parentControlId": 31952, "controlId": "SC-07(18)", "title": "SC-07(18)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589515" }, { "id": 600518, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "315d41a4-0905-543c-b474-783eadede330", "parentControlId": 31952, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589515" }, { "id": 600519, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb06e0d4-60c8-5a0b-94c9-fb2eaa8a86a3", "parentControlId": 31952, "controlId": "SA-08", "title": "SA-08", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589515" }, { "id": 600520, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63736411-2de0-5a6a-859f-f2ca73f8d044", "parentControlId": 31952, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589515" }, { "id": 600521, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33fb181e-d596-5bab-b11b-524a44af1b19", "parentControlId": 31952, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589516" }, { "id": 600522, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "05b4ffa7-ceb5-5ea6-9056-7377c90104ae", "parentControlId": 31952, "controlId": "SA-08", "title": "SA-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589516" }, { "id": 600523, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16ff6373-a6e1-5173-bbd8-1f7a7df08ec8", "parentControlId": 31952, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589516" }, { "id": 600524, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47ed421d-12cb-56fd-a78a-2cfea94c6a3a", "parentControlId": 31952, "controlId": "SC-07(18)", "title": "SC-07(18)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589516" }, { "id": 600525, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0bd3ca0c-6d29-5cbb-9914-17cceadf75d3", "parentControlId": 31952, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589516" }, { "id": 600526, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96cc47ea-e9d3-540b-b987-859939b1ac5b", "parentControlId": 31952, "controlId": "SA-08", "title": "SA-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589516" }, { "id": 600527, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78ce1ed6-37a5-5696-ab9f-29c80cd7bb1a", "parentControlId": 31952, "controlId": "SC-01", "title": "SC-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589516" }, { "id": 600528, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab84ed81-50b0-5e4a-a920-1318e4bc8241", "parentControlId": 31952, "controlId": "SC-07(18)", "title": "SC-07(18)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589516" }, { "id": 600529, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca81b177-406a-5f04-bbb4-2907295c75f2", "parentControlId": 31952, "controlId": "SI-01", "title": "SI-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589516" }, { "id": 600531, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea401c1e-08b9-5c2f-8729-d13e892d7fdd", "parentControlId": 31952, "controlId": "PT-1", "title": "PT-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589517" }, { "id": 600532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d8463b3-473a-54fc-8d4a-3221fb89d4fd", "parentControlId": 31952, "controlId": "SA-8", "title": "SA-8", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589517" }, { "id": 600533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2a579a6-55bc-5029-85b5-7edfeae50c6c", "parentControlId": 31952, "controlId": "SC-1", "title": "SC-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589517" }, { "id": 600534, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69873ab8-6dd8-50a6-a53e-e8f3ec257510", "parentControlId": 31952, "controlId": "SI-1", "title": "SI-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589517" }, { "id": 600535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a29c2add-bf61-5c61-81f0-76fb9c4841aa", "parentControlId": 31952, "controlId": "SA-8", "title": "SA-8", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589517" }, { "id": 600536, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "357d962b-c09a-5cbe-b652-a29d5712de6f", "parentControlId": 31952, "controlId": "SC-1", "title": "SC-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589517" }, { "id": 600537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31e1b2d9-db52-5b41-8d36-94914d71c5df", "parentControlId": 31952, "controlId": "SI-1", "title": "SI-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589517" }, { "id": 600538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589517", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "814a4a08-90e7-5ea4-9be1-173959a47bb8", "parentControlId": 31952, "controlId": "PT-1", "title": "PT-1", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589517" }, { "id": 600551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589519", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8a2f226-fbde-547c-aab5-8a6b665d78a2", "parentControlId": 31952, "controlId": "3.13.2", "title": "3.13.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589519" }, { "id": 600552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58952", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41304b6b-c952-5928-8dcd-0ab43f1dcf77", "parentControlId": 31952, "controlId": "03.01.12.a", "title": "03.01.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58952" }, { "id": 600553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58952", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d02eba59-1067-5f0b-86cf-2602ee9d893f", "parentControlId": 31952, "controlId": "03.01.16.a", "title": "03.01.16.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58952" }, { "id": 600554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a0f52c3-0674-5fd0-93ba-70cc32bf19bd", "parentControlId": 31952, "controlId": "03.01.16.b", "title": "03.01.16.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589521" }, { "id": 600555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2ef3739-2fff-5745-ab4e-0b5cf7403673", "parentControlId": 31952, "controlId": "03.01.16.c", "title": "03.01.16.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589521" }, { "id": 600556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b5bbd49-a279-515f-a5e1-01cdd54cfb90", "parentControlId": 31952, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589521" }, { "id": 600557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4aa48cd4-f353-567d-9f1c-deaf9860c729", "parentControlId": 31952, "controlId": "03.13.01.c", "title": "03.13.01.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589521" }, { "id": 600558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9582a584-247a-51e2-be97-9a616713afe9", "parentControlId": 31952, "controlId": "03.16.01", "title": "03.16.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589521" }, { "id": 600564, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4abbd989-5e02-5f01-928d-4482dcdbfdde", "parentControlId": 31952, "controlId": "PR.IR", "title": "PR.IR", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589522" }, { "id": 600565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7226fddb-cfa2-5444-9132-3d3fffd0ac4b", "parentControlId": 31952, "controlId": "PR.IR-01", "title": "PR.IR-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589522" }, { "id": 600566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589522", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33a15db0-b2c6-5b0d-8411-9a3197f33123", "parentControlId": 31952, "controlId": "PR.IR-03", "title": "PR.IR-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589522" }, { "id": 600605, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a8fb6c4-e66f-5625-b202-6ff129f6f9fb", "parentControlId": 31952, "controlId": "ARCHITECTURE-1b", "title": "ARCHITECTURE-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589529" }, { "id": 600606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cec86137-0921-5e28-a8c2-2c302d33b540", "parentControlId": 31952, "controlId": "ARCHITECTURE-1j", "title": "ARCHITECTURE-1j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589529" }, { "id": 600607, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9fd2e19-64ac-5990-9848-cc3a748d286e", "parentControlId": 31952, "controlId": "ARCHITECTURE-5g", "title": "ARCHITECTURE-5g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589529" }, { "id": 600608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d1dbe06-735a-5729-ba23-429ac7ec2d6c", "parentControlId": 31952, "controlId": "ARCHITECTURE-5h", "title": "ARCHITECTURE-5h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589529" }, { "id": 600649, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589535", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15ae681b-6f26-5974-929b-33ca779be157", "parentControlId": 31952, "controlId": "CIP-003-8 1.1.4", "title": "CIP-003-8 1.1.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589535" }, { "id": 600724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43a9c626-f474-5b1a-bc14-5797b28266a3", "parentControlId": 31952, "controlId": "B4.a", "title": "B4.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589546" }, { "id": 600725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ecfd44f5-eac3-5ad2-9766-f33416b51948", "parentControlId": 31952, "controlId": "B5.b", "title": "B5.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589546" }, { "controlId": "A.3.1.5", "title": "A.3.1.5 — Defense-in-Depth Protective Strategies", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, PL-8, PM-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "20ddb3ea-2d55-50e8-9666-033328aa85ab", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.5 / Sec 3.2", "title": "NEI 08-09 Sec 3.1.5 / Sec 3.2 — Defense-in-Depth Protective Strategies", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "baf9f46c-69f4-5e91-bf58-4570c578b03c", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(2)", "title": "10 CFR 73.54(c)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "e66dc6ce-d7a8-5e8f-b020-bf2b7e7ad539", "isPublic": true }, { "controlId": "A.4.2.2", "title": "A.4.2.2 — Security Impact Analysis of Changes and Environment", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-4, RA-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "7bed0e43-66f7-514e-9068-75359ac9a3ea", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.2", "title": "NEI 08-09 Sec 4.2.2 — Security Impact Analysis of Changes and Environment", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "17939efe-9ac4-5034-b0b2-b620fbd195ab", "isPublic": true }, { "controlId": "10 CFR 73.54(e), 73.58", "title": "10 CFR 73.54(e), 73.58 — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "31bd2caa-ef84-568d-8dba-b9ba09dda9f8", "isPublic": true }, { "controlId": "B.3.1", "title": "B.3.1 — Critical Digital Asset and Communications Protection Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "47f41948-2b96-5ba5-9c20-20ebff148fa9", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.1", "title": "NEI 08-09 App D.3.1 — Critical Digital Asset and Communications Protection Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "5835819f-5851-5da1-8e94-3d9709da609b", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "736f50d8-fd3c-5110-ae21-fa5e0c5cbb50", "isPublic": true }, { "controlId": "C.3.1", "title": "C.3.1 — System and Information Integrity Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "b074c500-4e8d-57bd-a6ce-ba5c10babf97", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.1", "title": "NEI 08-09 App E.3.1 — System and Information Integrity Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e38a8c4d-a0bc-5fd5-b3b0-5b10d5c7a609", "isPublic": true }, { "controlId": "C.6", "title": "C.6 — Defensive Strategy", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-7, PL-8, CA-9", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1db6f912-c419-5223-8261-c2d12d0b5e39", "isPublic": true }, { "controlId": "NEI 08-09 App E.6", "title": "NEI 08-09 App E.6 — Defensive Strategy", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "79384510-16ff-5e2a-8aef-c16c0b26aab3", "isPublic": true }, { "controlId": "C.12.4", "title": "C.12.4 — Integration of Security Capabilities", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SA-4, SA-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "07217e32-28c5-59d4-87af-83b0c9359dc8", "isPublic": true }, { "controlId": "NEI 08-09 App E.12.4", "title": "NEI 08-09 App E.12.4 — Integration of Security Capabilities", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.12.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "54e7c055-32bc-54d4-b653-5ccfbf835d4f", "isPublic": true }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "179333ee-aade-5f50-bb91-361b632ec623", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "626f6c42-b6a8-5bf3-a318-8e198c04201f", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "bf1736f5-7ce4-576c-ae91-bd3b0d3b8edc", "isPublic": true } ], "id": 31952, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731303", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731303", "catalogueId": 1062, "uuid": "eaeda4ab-f898-54f6-a7ad-326559f9423e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Secure Engineering Principles", "description": "

Control Description

Mechanisms exist to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of Technology Assets, Applications and/or Services (TAAS).

Evidence Request List (ERL)

E-TDA-01\nE-TDA-02\nE-TDA-04\nE-TDA-08\nE-TDA-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).\n▪ IT and/or cybersecurity personnel manage separate development, testing and operational environments to reduce the risks of unauthorized access or changes to the operational environment and to ensure no impact to production TAASD.

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to facilitate the implementation of industry-recognized security, compliance and resilience practices in the specification, design, development, implementation and modification of TAAS.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.5, A.4.2.2, B.3.1, C.3.1, C.6, C.12.4", "controlId": "SEA-01", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-01", "references": "

Micro-Small Business (<10 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)

Small Business (10-49 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)

Medium Business (50-249 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)

Large Business (250-999 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)

Enterprise (>1,000 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73870, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591155", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591155", "securityControlId": 31953, "ccis": [], "uuid": "96c9fc53-be48-54b9-8217-cac431c8d919", "testId": "SEA-01.1_A01", "test": "cybersecurity / data privacy controls and related processes to be centrally managed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-09_ODP", "defaultText": null }, { "id": 73871, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591156", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591156", "securityControlId": 31953, "ccis": [], "uuid": "900f7acf-a836-5632-a322-ef94fcf2cec5", "testId": "SEA-01.1_A02", "test": "controls and related processes are centrally managed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-09", "defaultText": null } ], "externalMappings": [ { "id": 600811, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7efe0cb4-0ab8-5095-a82e-2331d21dbaec", "parentControlId": 31953, "controlId": "8.12", "title": "8.12", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589557" }, { "id": 600815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64de9ed9-9efb-5174-a931-4bb50d471e31", "parentControlId": 31953, "controlId": "PL-9", "title": "PL-9", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589558" }, { "id": 600816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589558", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc09a7a2-6532-584e-a6f3-5612075ae7f8", "parentControlId": 31953, "controlId": "PL-09", "title": "PL-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589558" }, { "id": 600818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cef525d0-dd66-522e-a98f-831695c89958", "parentControlId": 31953, "controlId": "PL-09", "title": "PL-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589559" }, { "id": 600819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ccbfa11-bf56-58c6-bcd2-5079cdf21c02", "parentControlId": 31953, "controlId": "PL-9", "title": "PL-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589559" }, { "id": 600822, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589559", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d07dda47-f874-5439-a1c8-0c8b2a2f99c8", "parentControlId": 31953, "controlId": "PR.IR", "title": "PR.IR", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589559" }, { "id": 600838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01dfb67c-eb24-5132-b83f-4314e738648a", "parentControlId": 31953, "controlId": "RISK-2l", "title": "RISK-2l", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589561" }, { "id": 600839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "270102ed-2dca-5fcd-b390-51618119bd72", "parentControlId": 31953, "controlId": "ARCHITECTURE-1f", "title": "ARCHITECTURE-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589561" }, { "controlId": "A.3.1.6", "title": "A.3.1.6 — Application of Security Controls", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PL-2, CA-2, RA-3, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "af55837d-d69e-5568-87fc-af94bbbab6f4", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.6", "title": "NEI 08-09 Sec 3.1.6 — Application of Security Controls", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "111ab1a0-46d2-5a26-b0ee-b2248f3466c8", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1), (a)(2)", "title": "10 CFR 73.54(c)(1), (a)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "f25847e2-f54f-59ca-ae54-b1b857a4576c", "isPublic": true }, { "controlId": "A.4.2.6", "title": "A.4.2.6 — Application of Security Controls Associated with a Modification or Addition", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-3, PL-2, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "e4201528-48c3-5920-9496-417f4a68ae89", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.6", "title": "NEI 08-09 Sec 4.2.6 — Application of Security Controls Associated with a Modification or Addition", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "a2c66b14-4abd-521f-aa0e-d9ec320d8706", "isPublic": true }, { "controlId": "10 CFR 73.54(e)", "title": "10 CFR 73.54(e) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "2617738a-2433-5557-8adc-d41767bb0354", "isPublic": true }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "376696ef-4d08-5c0a-9597-575923cad62d", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "b8fed292-b94f-52eb-832f-d1c03362b3b1", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "e4623546-0c2d-5497-8386-4f121073090f", "isPublic": true } ], "id": 31953, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731304", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731304", "catalogueId": 1062, "uuid": "848215ba-f1a3-58cb-9236-ce7e24eac8bf", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization centrally-manage the organization-wide management and implementation of security, compliance and resilience controls and related processes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Centralized Management of Security, Compliance & Resilience Controls", "description": "

Control Description

Mechanisms exist to centrally-manage the organization-wide management and implementation of security, compliance and resilience controls and related processes.

Evidence Request List (ERL)

E-GOV-10\nE-GOV-12

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to centrally-manage the organization-wide management and implementation of security, compliance and resilience controls and related processes.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.6, A.4.2.6", "controlId": "SEA-01.1", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-01.1", "references": "

Micro-Small Business (<10 staff)

∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Small Business (10-49 staff)

∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Medium Business (50-249 staff)

∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Large Business (250-999 staff)

∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Enterprise (>1,000 staff)

∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73872, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591156", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591156", "securityControlId": 31954, "ccis": [], "uuid": "6b883741-c991-54eb-9048-d659e49a1911", "testId": "SEA-01.2_A01", "test": "the organization's goals for resiliency are defined for normal and adverse situations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73873, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591156", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591156", "securityControlId": 31954, "ccis": [], "uuid": "d95c343c-0de1-5d22-a18d-617da2e2c95f", "testId": "SEA-01.2_A02", "test": "solutions exist to achieve resilience requirements in normal situations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73874, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591156", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591156", "securityControlId": 31954, "ccis": [], "uuid": "b157c768-682f-53ee-b8c1-289bb8bb308f", "testId": "SEA-01.2_A03", "test": "solutions exist to achieve resilience requirements in adverse situations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 600858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b0df090-bbfe-55d9-b650-a53b8e783a0b", "parentControlId": 31954, "controlId": "PR.IR", "title": "PR.IR", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589572" }, { "id": 600859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a753d47c-273d-50ab-8c28-ece1d9232e66", "parentControlId": 31954, "controlId": "PR.IR-02", "title": "PR.IR-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589572" }, { "id": 600860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "710bd2a9-648d-533d-a148-913089b682e0", "parentControlId": 31954, "controlId": "PR.IR-03", "title": "PR.IR-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589572" }, { "id": 600864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fcb506e5-6446-56d5-8691-ef536f90d9df", "parentControlId": 31954, "controlId": "ARCHITECTURE-1j", "title": "ARCHITECTURE-1j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589572" }, { "controlId": "CIP-012-2-1.1", "title": "CIP-012-2-1.1", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e601ce36-7e34-53a7-a246-6edbdbb96734", "isPublic": true }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b170d9ba-1845-591e-b234-8d94a676abf1", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "82e29033-24fe-5629-aab4-9cf89412c939", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "d7f41ad1-c79b-5209-b171-a8ab18d4d24a", "isPublic": true } ], "id": 31954, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731304", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731304", "catalogueId": 1062, "uuid": "0b7f163d-03e9-533b-be8e-e295814c9b3f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization achieve resilience requirements in normal and adverse situations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Achieving Resilience Requirements", "description": "

Control Description

Mechanisms exist to achieve resilience requirements in normal and adverse situations.

Evidence Request List (ERL)

E-BCM-01\nE-GOV-10\nE-GOV-12

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to achieve resilience requirements in normal and adverse situations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-01.2", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-01.2", "references": "

Micro-Small Business (<10 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)

Small Business (10-49 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)

Medium Business (50-249 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)

Large Business (250-999 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)

Enterprise (>1,000 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73875, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591157", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591157", "securityControlId": 31955, "ccis": [], "uuid": "8da9131b-d4a1-555c-bde8-de7e23f4c054", "testId": "SEA-01.3_A01", "test": "cybersecurity and data protection controls are designed and implemented to provide resistance to unintentional errors (by users or software).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 73876, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591157", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591157", "securityControlId": 31955, "ccis": [], "uuid": "2d64886d-7682-5c37-b2b4-48ed87be351c", "testId": "SEA-01.3_A02", "test": "cybersecurity and data protection controls are designed and implemented to provide resistance to intentional attack or circumvention.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 600905, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "436aee45-bb3b-5427-aa07-d915252e3e50", "parentControlId": 31955, "controlId": "ARCHITECTURE-1j", "title": "ARCHITECTURE-1j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589577" }, { "id": 600906, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f2e786e-c4a2-5603-a3bc-79d1fd422dae", "parentControlId": 31955, "controlId": "B5", "title": "B5", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589577" }, { "id": 600907, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4813d397-abf1-5266-a1af-6b381451ecb2", "parentControlId": 31955, "controlId": "B5.b", "title": "B5.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589577" } ], "id": 31955, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731304", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731304", "catalogueId": 1062, "uuid": "66b8b124-4adf-535d-87c6-0768ffbefba7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure security, compliance and resilience are designed and implemented to provide resistance to:\n(1) Unintentional errors (by users or software); and \n(2) Intentional attack or circumvention?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Resilience Capabilities", "description": "

Control Description

Mechanisms exist to ensure security, compliance and resilience are designed and implemented to provide resistance to:\n(1) Unintentional errors (by users or software); and \n(2) Intentional attack or circumvention.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to ensure security, compliance and resilience are designed and implemented to provide resistance to:\n(1) Unintentional errors (by users or software); and \n(2) Intentional attack or circumvention.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-01.3", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-01.3", "references": "

Micro-Small Business (<10 staff)

∙ Document security requirements for any new systems built or purchased

Small Business (10-49 staff)

∙ Security requirements checklist for systems engineering

Medium Business (50-249 staff)

∙ Formal security requirements engineering process\n∙ Security integrated into system design

Large Business (250-999 staff)

∙ Enterprise systems security engineering program\n∙ Security architecture reviews

Enterprise (>1,000 staff)

∙ Enterprise systems security engineering program (NIST SP 800-160)\n∙ Architecture review board\n∙ Threat modeling integration", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73877, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591157", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591157", "securityControlId": 31956, "ccis": [], "uuid": "559e253d-d348-50af-b07f-252d4e315df7", "testId": "SEA-02_A01", "test": "an enterprise architecture is developed with consideration for cybersecurity / data privacy.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-07[01]\n53A_R5_PM-07[03]", "defaultText": null }, { "id": 73878, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591157", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591157", "securityControlId": 31956, "ccis": [], "uuid": "7223745e-a81b-5bb9-922e-2d7f2a0379eb", "testId": "SEA-02_A02", "test": "an enterprise architecture is maintained with consideration for cybersecurity / data privacy.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-07[02]\n53A_R5_PM-07[04]", "defaultText": null }, { "id": 73879, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591157", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591157", "securityControlId": 31956, "ccis": [], "uuid": "80db9b37-1bdb-59b8-85ee-b43caff78e60", "testId": "SEA-02_A03", "test": "an enterprise architecture is developed with consideration for the resulting risk to organizational operations and assets, individuals and other organizations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-07[05]", "defaultText": null }, { "id": 73880, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591158", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591158", "securityControlId": 31956, "ccis": [], "uuid": "af605a84-b75f-5dbf-b37d-ee3044784c80", "testId": "SEA-02_A04", "test": "an enterprise architecture is maintained with consideration for the resulting risk to organizational operations and assets, individuals and other organizations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-07[06]", "defaultText": null }, { "id": 73881, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591158", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591158", "securityControlId": 31956, "ccis": [], "uuid": "9f939200-c1ed-5d46-933c-e725e279b4d8", "testId": "SEA-02_A05", "test": "frequency for review / update to reflect changes in the enterprise architecture.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "53A_R5_PL-08_ODP", "defaultText": null }, { "id": 73882, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591158", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591158", "securityControlId": 31956, "ccis": [], "uuid": "23620211-b89e-5fd2-b56d-0a13548dbad2", "testId": "SEA-02_A06", "test": "a cybersecurity / data privacy architecture for the system describes the requirements and approach to be taken for protecting the confidentiality, integrity and availability of organizational information.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-08a.01\n53A_R5_PL-08a.02", "defaultText": null }, { "id": 73883, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591158", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591158", "securityControlId": 31956, "ccis": [], "uuid": "53210a00-4349-5293-b3e7-0a2e6b0c95cc", "testId": "SEA-02_A07", "test": "a cybersecurity / data privacy architecture for the system describes how the architecture is integrated into and supports the enterprise architecture.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-08a.03[01]\n53A_R5_PL-08a.03[02]", "defaultText": null }, { "id": 73884, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591158", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591159", "securityControlId": 31956, "ccis": [], "uuid": "f90eae1e-03ad-579c-ba8f-9e24554a9d5a", "testId": "SEA-02_A08", "test": "a cybersecurity / data privacy architecture for the system describes any assumptions about and dependencies on external systems and services.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-08a.04[01]\n53A_R5_PL-08a.04[02]", "defaultText": null }, { "id": 73885, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591159", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591159", "securityControlId": 31956, "ccis": [], "uuid": "e837775e-1944-5354-99c7-161879ff4108", "testId": "SEA-02_A09", "test": "changes in the enterprise architecture are reviewed / updated per an organization-defined frequency to reflect changes in the enterprise architecture.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually and when a significant change occurs", "otherId": "53A_R5_PL-08b.", "defaultText": null }, { "id": 73886, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591159", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591159", "securityControlId": 31956, "ccis": [], "uuid": "83a3af72-2919-5dfa-95da-883bea677576", "testId": "SEA-02_A10", "test": "planned architecture changes are reflected in the cybersecurity / data privacy plan.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-08c.[01]\n53A_R5_PL-08c.[02]", "defaultText": null }, { "id": 73887, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59116", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59116", "securityControlId": 31956, "ccis": [], "uuid": "d7186ce0-97f4-5874-ae36-003626f8e8e2", "testId": "SEA-02_A11", "test": "planned architecture changes are reflected in the Concept of Operations (CONOPS).
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-08c.[03]", "defaultText": null }, { "id": 73888, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591161", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591161", "securityControlId": 31956, "ccis": [], "uuid": "d1875a9e-79b8-5ab5-ab26-c5262f32dc32", "testId": "SEA-02_A12", "test": "planned architecture changes are reflected in criticality analysis.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-08c.[04]", "defaultText": null }, { "id": 73889, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591161", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591161", "securityControlId": 31956, "ccis": [], "uuid": "35546d66-0ed8-5d7e-ac8b-dd3d5bda52aa", "testId": "SEA-02_A13", "test": "planned architecture changes are reflected in organizational procedures.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-08c.[05]", "defaultText": null }, { "id": 73890, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591161", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591161", "securityControlId": 31956, "ccis": [], "uuid": "a13b24f5-4047-5a54-ac1d-d33bc78d59b0", "testId": "SEA-02_A14", "test": "planned architecture changes are reflected in procurements and acquisitions.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-08c.[06]", "defaultText": null } ], "externalMappings": [ { "id": 600939, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92b42d39-841c-55f6-acf3-e8f00a8d6858", "parentControlId": 31956, "controlId": "5.8", "title": "5.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589583" }, { "id": 600940, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d60d89bc-139f-5347-b553-76a2d18687e5", "parentControlId": 31956, "controlId": "8.26", "title": "8.26", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589583" }, { "id": 600946, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589583", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73c35194-b853-5aac-b2af-cea3f316412a", "parentControlId": 31956, "controlId": "PL-8", "title": "PL-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589583" }, { "id": 600947, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "249779ce-4030-5a3a-b364-d13f25fca2bb", "parentControlId": 31956, "controlId": "PM-7", "title": "PM-7", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589584" }, { "id": 600948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "509dd1e3-3360-5903-a1df-15e9d8be6e3d", "parentControlId": 31956, "controlId": "PL-08", "title": "PL-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589584" }, { "id": 600949, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ba32f0a-18f4-5763-ba83-da18edb69b23", "parentControlId": 31956, "controlId": "PM-07", "title": "PM-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589584" }, { "id": 600952, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "892dd49b-a51b-51dd-810d-7c543a7d25a3", "parentControlId": 31956, "controlId": "PL-08", "title": "PL-08", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589584" }, { "id": 600953, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "408e6073-47d9-58c2-b541-b645d7caf296", "parentControlId": 31956, "controlId": "PL-08", "title": "PL-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589584" }, { "id": 600954, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb46f3fa-d055-5e83-a214-6473a74d8194", "parentControlId": 31956, "controlId": "PM-07", "title": "PM-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589584" }, { "id": 600955, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589584", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ec3d44e-48c0-51f0-aee4-2f8944dba77d", "parentControlId": 31956, "controlId": "PM-07", "title": "PM-07", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589584" }, { "id": 600956, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0f0c3b6-a8d9-517c-b27d-c6840309b6a3", "parentControlId": 31956, "controlId": "PL-08", "title": "PL-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589585" }, { "id": 600957, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a20b70fe-9656-580b-abc5-41bb93fb0015", "parentControlId": 31956, "controlId": "PM-07", "title": "PM-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589585" }, { "id": 600958, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0fb91d27-bc6f-5bba-af45-eed7b9fe82c6", "parentControlId": 31956, "controlId": "PL-08", "title": "PL-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589585" }, { "id": 600959, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62abc3bd-82f1-5e0d-90b3-6d6f8d72ecdb", "parentControlId": 31956, "controlId": "PM-07", "title": "PM-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589585" }, { "id": 600960, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28e8d5c8-66c6-5c78-9da1-2053184dc1d3", "parentControlId": 31956, "controlId": "PL-8", "title": "PL-8", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589585" }, { "id": 600961, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589586", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7761df33-8ada-5801-8e45-c2ccd8f9059b", "parentControlId": 31956, "controlId": "PM-7", "title": "PM-7", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589586" }, { "id": 600966, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589587", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "625dde0c-b392-5493-8056-68b64bb83fbe", "parentControlId": 31956, "controlId": "NFO - PL-8", "title": "NFO - PL-8", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589587" }, { "id": 600967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589587", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d79599f8-cf64-565a-b385-204b87334931", "parentControlId": 31956, "controlId": "03.01.12.a", "title": "03.01.12.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589587" }, { "id": 600968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589587", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4abd93b3-3cd9-54bc-8943-cdc9276a5cd3", "parentControlId": 31956, "controlId": "03.01.16.a", "title": "03.01.16.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589587" }, { "id": 600969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589587", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9c5b3a4-98be-5ea2-9c1d-6357df9aabc0", "parentControlId": 31956, "controlId": "03.01.18.a", "title": "03.01.18.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589587" }, { "id": 600970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589587", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e11a977-e572-52d1-8af7-0992bf806638", "parentControlId": 31956, "controlId": "03.13.01.c", "title": "03.13.01.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589587" }, { "id": 600971, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589587", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc613fa7-37a9-5119-a6f6-a6f45a064884", "parentControlId": 31956, "controlId": "03.16.01", "title": "03.16.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589587" }, { "id": 600972, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589588", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "334d6d71-5d39-5e94-aa74-54546b37e856", "parentControlId": 31956, "controlId": "PR.IR", "title": "PR.IR", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589588" }, { "id": 600973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589588", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4602bf42-00ad-5350-8280-62cee3e849f7", "parentControlId": 31956, "controlId": "PR.IR-01", "title": "PR.IR-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589588" }, { "id": 600974, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589588", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7445427-69d4-57f4-8a32-1be461a71ccf", "parentControlId": 31956, "controlId": "PR.IR-03", "title": "PR.IR-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589588" }, { "id": 600980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589588", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c508c22d-503a-5cff-88a4-4d2165e1532f", "parentControlId": 31956, "controlId": "ARCHITECTURE-1b", "title": "ARCHITECTURE-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589588" }, { "id": 600981, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb57f80b-f9c6-5ba0-8bd8-ac9586b0e8c2", "parentControlId": 31956, "controlId": "ARCHITECTURE-1c", "title": "ARCHITECTURE-1c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589589" }, { "id": 600982, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18e87de7-de1f-5ee3-ac68-17bdab06160d", "parentControlId": 31956, "controlId": "ARCHITECTURE-1d", "title": "ARCHITECTURE-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589589" }, { "id": 600983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eabe8f95-0fed-5f44-ab3e-e744821d55a2", "parentControlId": 31956, "controlId": "ARCHITECTURE-1h", "title": "ARCHITECTURE-1h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589589" }, { "id": 600984, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d8a99d6-0ef8-5bd8-adc6-75821b87271e", "parentControlId": 31956, "controlId": "ARCHITECTURE-1j", "title": "ARCHITECTURE-1j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589589" }, { "id": 600985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589589", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7bf28a99-2098-5200-b2fb-528e0f1fcf81", "parentControlId": 31956, "controlId": "ARCHITECTURE-1k", "title": "ARCHITECTURE-1k", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589589" }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "9cebbf94-52eb-513c-8834-a5d1e82b13e3", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "9661a3df-f0f7-5a4a-8ee0-da65052b7992", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "3ee4669e-171f-53af-9e7f-8b996c232b55", "isPublic": true } ], "id": 31956, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731304", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731304", "catalogueId": 1062, "uuid": "02437b4e-bf2b-54c8-9b32-0eafcee1fbff", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization develop an enterprise architecture, aligned with industry-recognized leading practices, with consideration for security, compliance and resilience principles that addresses risk to organizational operations, assets, individuals and other organizations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Alignment With Enterprise Architecture", "description": "

Control Description

Mechanisms exist to develop an enterprise architecture, aligned with industry-recognized leading practices, with consideration for security, compliance and resilience principles that addresses risk to organizational operations, assets, individuals and other organizations.

Evidence Request List (ERL)

E-TDA-04\nE-TDA-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to develop an enterprise architecture, aligned with industry-recognized leading practices, with consideration for security, compliance and resilience principles that addresses risk to organizational operations, assets, individuals and other organizations.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-02", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-02", "references": "

Micro-Small Business (<10 staff)

∙ Follow secure coding basics\n∙ Document security decisions

Small Business (10-49 staff)

∙ Secure design checklist\n∙ Basic threat modeling

Medium Business (50-249 staff)

∙ Enterprise architecture committee

Large Business (250-999 staff)

∙ Enterprise architecture committee

Enterprise (>1,000 staff)

∙ Enterprise architecture committee", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73891, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591161", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591161", "securityControlId": 31957, "ccis": [], "uuid": "0a343a6d-2b29-5687-afdc-9ed1288d579e", "testId": "SEA-02.1_A01", "test": "technology and process terminology is standardized to reduce confusion amongst groups and departments.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 601126, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89f9b1df-977d-580d-a664-916ca8b08a82", "parentControlId": 31957, "controlId": "3.0", "title": "3.0", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589609" }, { "id": 601127, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589609", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37c89548-c06b-5f30-8ce9-16b41c1de5c8", "parentControlId": 31957, "controlId": "3.0", "title": "3.0", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589609" }, { "id": 601128, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "671d7a32-067c-5686-8eca-bcf3ccbdb090", "parentControlId": 31957, "controlId": "3.1", "title": "3.1", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58961" }, { "id": 601129, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18a0e12e-c67e-5acf-a496-6faedaefdc96", "parentControlId": 31957, "controlId": "3.2", "title": "3.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58961" } ], "id": 31957, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731305", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731305", "catalogueId": 1062, "uuid": "db87fa78-b1cd-542d-a1ea-b78bad2e6cfa", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization standardize technology and process terminology to reduce confusion amongst groups and departments?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Standardized Terminology", "description": "

Control Description

Mechanisms exist to standardize technology and process terminology to reduce confusion amongst groups and departments.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to standardize technology and process terminology to reduce confusion amongst groups and departments.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-02.1", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Follow secure coding basics when developing software

Small Business (10-49 staff)

∙ Secure coding guidelines for developers\n∙ Basic security review before release

Medium Business (50-249 staff)

∙ Formal security engineering principles\n∙ Secure design patterns\n∙ Threat modeling

Large Business (250-999 staff)

∙ Enterprise security engineering program\n∙ Formal threat modeling\n∙ Security architecture standards

Enterprise (>1,000 staff)

∙ Enterprise security architecture framework (SABSA)\n∙ Formal threat modeling program\n∙ Security design patterns library", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73892, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591161", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591161", "securityControlId": 31958, "ccis": [], "uuid": "85cd7d52-e32f-5c59-9196-2ea953b006ce", "testId": "SEA-02.2_A01", "test": "non-essential functions or services to be offloaded are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-07(01)_ODP", "defaultText": null }, { "id": 73893, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591161", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591162", "securityControlId": 31958, "ccis": [], "uuid": "31daa939-6184-5a11-8cb2-06c459823603", "testId": "SEA-02.2_A02", "test": "non-essential functions or services are offloaded to other systems, system components or an external provider.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-07(01)", "defaultText": null } ], "externalMappings": [ { "id": 601161, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7a20f45-55d6-5daf-ad58-3f5c3d27c485", "parentControlId": 31958, "controlId": "PM-07(01)", "title": "PM-07(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589613" }, { "id": 601162, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db5867fe-543b-5245-8c26-068508b1a4bb", "parentControlId": 31958, "controlId": "PM-07(01)", "title": "PM-07(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589613" } ], "id": 31958, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731305", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731305", "catalogueId": 1062, "uuid": "9484e16a-2a38-5cc4-99f1-466b97185457", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify non-essential functions or services that are capable of being outsourced to external service providers and align with its enterprise architecture and security standards?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Outsourcing Non-Essential Functions or Services", "description": "

Control Description

Mechanisms exist to identify non-essential functions or services that are capable of being outsourced to external service providers and align with the organization's enterprise architecture and security standards.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to identify non-essential functions or services that are capable of being outsourced to external service providers and align with the organization's enterprise architecture and security standards.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-02.2", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-02.2", "references": "

Micro-Small Business (<10 staff)

∙ Apply security-by-design when building/procuring systems

Small Business (10-49 staff)

∙ Security-by-design policy for new developments and acquisitions

Medium Business (50-249 staff)

∙ Formal security-by-design principles integrated into development lifecycle

Large Business (250-999 staff)

∙ Enterprise security-by-design program\n∙ Security architecture reviews at design phase

Enterprise (>1,000 staff)

∙ Enterprise security-by-design framework\n∙ Architecture review board\n∙ Automated security architecture analysis", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73896, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591163", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591163", "securityControlId": 31960, "ccis": [], "uuid": "9879caab-c483-56ec-ad89-b4564b2894a0", "testId": "SEA-03_A01", "test": "security functions are implemented as a layered structure, minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-03(05)", "defaultText": null }, { "id": 73897, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591163", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591163", "securityControlId": 31960, "ccis": [], "uuid": "24b3b998-a399-5ca3-be25-926aac0bec07", "testId": "SEA-03_A02", "test": "the cybersecurity / data privacy architecture for the system is designed using a defense-in-depth approach that allocates controls to locations and architectural layers.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-08(01)(a)[01]\n53A_R5_PL-08(01)(a)[02]", "defaultText": null }, { "id": 73898, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591164", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591164", "securityControlId": 31960, "ccis": [], "uuid": "1a6c06b4-ea35-5cad-a9fa-a843bdeda12e", "testId": "SEA-03_A03", "test": "the cybersecurity / data privacy architecture for the system is designed using a defense-in-depth approach that ensures the allocated controls operate in a coordinated and mutually reinforcing manner.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-08(01)(b)[01]\n53A_R5_PL-08(01)(b)[02]", "defaultText": null }, { "id": 73899, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591164", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591164", "securityControlId": 31960, "ccis": [], "uuid": "9a251f54-cf45-52df-8f54-fa7e2337690a", "testId": "SEA-03_A04", "test": "controls to be allocated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-08(01)_ODP[01]", "defaultText": null }, { "id": 73900, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591164", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591164", "securityControlId": 31960, "ccis": [], "uuid": "6a3997c5-0cec-55b8-b976-00e9c4ed3329", "testId": "SEA-03_A05", "test": "locations and architectural layers are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-08(01)_ODP[02]", "defaultText": null } ], "externalMappings": [ { "id": 601177, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58963", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0aea4a43-5032-565d-9631-1d527749ae44", "parentControlId": 31960, "controlId": "SD-2", "title": "SD-2", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58963" }, { "id": 601178, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58963", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "918a7233-3652-5f39-97f0-2f5edea8ee9f", "parentControlId": 31960, "controlId": "PL-8(1)", "title": "PL-8(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58963" }, { "id": 601179, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58963", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae9adee3-f5d6-5870-9926-fd33b0353477", "parentControlId": 31960, "controlId": "SC-3(5)", "title": "SC-3(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58963" }, { "id": 601180, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58963", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6eebb67-645c-5e97-bac4-957168b5c638", "parentControlId": 31960, "controlId": "PL-08(01)", "title": "PL-08(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589631" }, { "id": 601181, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589631", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af33b23a-83f0-50d2-b03b-8083c8762001", "parentControlId": 31960, "controlId": "SC-03(05)", "title": "SC-03(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589631" }, { "id": 601182, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589632", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1bfc0124-6b8b-5c92-a993-5257ed13d991", "parentControlId": 31960, "controlId": "PL-08(01)", "title": "PL-08(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589632" }, { "id": 601183, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589632", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c9efcd0-3718-597d-b1f0-96fa154662ce", "parentControlId": 31960, "controlId": "SC-03(05)", "title": "SC-03(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589632" }, { "id": 601186, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589632", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "732f5c09-f40d-5c35-9563-fa34c0d11de8", "parentControlId": 31960, "controlId": "3.13.2", "title": "3.13.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589632" }, { "id": 601198, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "933ae25c-197f-5521-ac0f-b8f316a259b9", "parentControlId": 31960, "controlId": "ARCHITECTURE-1b", "title": "ARCHITECTURE-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589634" }, { "controlId": "B.3.2", "title": "B.3.2 — Application Partitioning and Security Function Isolation", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-2, SC-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "c8b39f9f-9329-5eaf-8870-6da64c98e16f", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.2", "title": "NEI 08-09 App D.3.2 — Application Partitioning and Security Function Isolation", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "df322d02-4604-54fe-aade-3824490d019d", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "3c8be75b-a681-53b5-9ad3-3356dcd8f6f6", "isPublic": true }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "c19899ad-81be-5ced-b31b-4abc51fd3ebd", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "5c6e7764-b0f6-5db9-9973-ef7ae0ed0a29", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "98d0fa52-e4fa-573c-9d8d-04add26267a3", "isPublic": true } ], "id": 31960, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731306", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731306", "catalogueId": 1062, "uuid": "c0789bcb-02ea-5a56-a4ad-629694b57d80", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Defense-In-Depth (DiD) Architecture", "description": "

Control Description

Mechanisms exist to implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.

Evidence Request List (ERL)

E-TDA-04\nE-TDA-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).\n▪ IT and/or cybersecurity personnel manage separate development, testing and operational environments to reduce the risks of unauthorized access or changes to the operational environment and to ensure no impact to production TAASD.

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.2", "controlId": "SEA-03", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-03", "references": "

Micro-Small Business (<10 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Defense-in-depth (DiD) architecture

Small Business (10-49 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Defense-in-depth (DiD) architecture

Medium Business (50-249 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Defense-in-depth (DiD) architecture\n∙ Enterprise architecture committee

Large Business (250-999 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Defense-in-depth (DiD) architecture\n∙ Enterprise architecture committee

Enterprise (>1,000 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Defense-in-depth (DiD) architecture\n∙ Enterprise architecture committee", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73901, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591164", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591164", "securityControlId": 31961, "ccis": [], "uuid": "df75fb80-5b4a-52d8-ad7f-a20267eebbed", "testId": "SEA-03.1_A01", "test": "system components to reside in separate physical or logical domains or environments based on circumstances for the physical or logical separation of components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-32_ODP[01]", "defaultText": null }, { "id": 73902, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591164", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591164", "securityControlId": 31961, "ccis": [], "uuid": "75fd46d2-bddf-5016-b074-517cea08ef80", "testId": "SEA-03.1_A02", "test": "circumstances for the physical or logical separation of components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-32_ODP[02]\n53A_R5_SC-32_ODP[03]", "defaultText": null }, { "id": 73903, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591165", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591165", "securityControlId": 31961, "ccis": [], "uuid": "c9911cda-f6cd-5e40-822d-e6a8c57633f2", "testId": "SEA-03.1_A03", "test": "the system is partitioned into system components residing in separate organization-defined criteria domains or environments based on circumstances for the physical or logical separation of components.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-32", "defaultText": null } ], "externalMappings": [ { "id": 601318, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589657", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36d7cc57-0b59-539c-abbb-3c7e56527b9c", "parentControlId": 31961, "controlId": "T1590.002", "title": "T1590.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589657" }, { "id": 601319, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589657", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "170a9a0f-ed4b-5854-a5e4-fcb08905fa0f", "parentControlId": 31961, "controlId": "SC-32", "title": "SC-32", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589657" }, { "id": 601320, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589658", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3228b218-7dff-5c86-9b3f-25015b00de68", "parentControlId": 31961, "controlId": "SC-32", "title": "SC-32", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589658" }, { "id": 601321, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589658", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7f99117-3a85-5bb6-904c-8f53a47fd672", "parentControlId": 31961, "controlId": "SC-32", "title": "SC-32", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589658" } ], "id": 31961, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731306", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731306", "catalogueId": 1062, "uuid": "71620d13-74ec-5914-b04d-df443c6990fb", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization partition systems so that partitions reside in separate physical domains or environments?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "System Partitioning", "description": "

Control Description

Mechanisms exist to partition systems so that partitions reside in separate physical domains or environments.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to partition systems so that partitions reside in separate physical domains or environments.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-03.1", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73904, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591165", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591165", "securityControlId": 31962, "ccis": [], "uuid": "8016db02-ce31-51dd-b540-b6e6450e3d3e", "testId": "SEA-03.2_A01", "test": "user functionality is identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.13.3[a]", "defaultText": null }, { "id": 73905, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591165", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591165", "securityControlId": 31962, "ccis": [], "uuid": "593f525c-4eca-578f-9dc9-77bde94e0d1b", "testId": "SEA-03.2_A02", "test": "system management functionality is identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.13.3[b]", "defaultText": null }, { "id": 73906, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591165", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591165", "securityControlId": 31962, "ccis": [], "uuid": "51c62d96-4948-5f8b-a001-191107597530", "testId": "SEA-03.2_A03", "test": "user functionality is separated from system management functionality.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "171A_3.13.3[c]\n53A_R5_SC-02", "defaultText": null }, { "id": 73907, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591165", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591165", "securityControlId": 31962, "ccis": [], "uuid": "a64612c9-36b4-5c85-a8a7-86ec9ae97146", "testId": "SEA-03.2_A04", "test": "the presentation of system management functionality is prevented at interfaces to non-privileged users.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-02(01)", "defaultText": null }, { "id": 73908, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591166", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591166", "securityControlId": 31962, "ccis": [], "uuid": "39464a04-0cd6-520c-90de-da4a9f15f303", "testId": "SEA-03.2_A05", "test": "state information is stored separately from applications and software.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-02(02)", "defaultText": null } ], "externalMappings": [ { "id": 601330, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589659", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9ef2fa6-75d6-5b63-b605-9a8602e20edf", "parentControlId": 31962, "controlId": "SR 5.4", "title": "SR 5.4", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589659" }, { "id": 601331, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589659", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0540eee-6b94-5730-8d08-79160fc8414b", "parentControlId": 31962, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589659" }, { "id": 601332, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589659", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4aa6f9a0-f056-5370-8a1d-76019f0e345c", "parentControlId": 31962, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589659" }, { "id": 601333, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589659", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f12578fb-a9e7-5a02-8c3d-dcd685319e80", "parentControlId": 31962, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589659" }, { "id": 601334, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589659", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "968335e5-6e7e-51c1-81f7-d197ae20d636", "parentControlId": 31962, "controlId": "T1203", "title": "T1203", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589659" }, { "id": 601335, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589659", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04fab01e-04d8-591c-ac07-01187fb2d389", "parentControlId": 31962, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589659" }, { "id": 601336, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589659", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7923a4ff-9d1d-5b19-9fc6-93de815daa49", "parentControlId": 31962, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589659" }, { "id": 601337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58966", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c2f0c77-b4f0-556d-bcdb-453a773ada50", "parentControlId": 31962, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58966" }, { "id": 601338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58966", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12958459-6bf2-5e01-a089-f02eed1e0089", "parentControlId": 31962, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58966" }, { "id": 601339, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58966", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c11c6f44-e7bf-5cd0-acd8-58c94657d077", "parentControlId": 31962, "controlId": "SC-2", "title": "SC-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58966" }, { "id": 601340, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58966", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26e53116-10f3-5105-904e-685adb04bfdc", "parentControlId": 31962, "controlId": "SC-2(1)", "title": "SC-2(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58966" }, { "id": 601341, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58966", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fc9edc7-f915-5587-bf41-a248995f8d82", "parentControlId": 31962, "controlId": "SC-02", "title": "SC-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58966" }, { "id": 601342, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58966", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35e64d98-1159-5f07-87b9-5b6cce99ccf4", "parentControlId": 31962, "controlId": "SC-02(01)", "title": "SC-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58966" }, { "id": 601343, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58966", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a68c208d-b60d-58cd-b22a-6668d1b6e12b", "parentControlId": 31962, "controlId": "SC-02", "title": "SC-02", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58966" }, { "id": 601344, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589661", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fbde30d-ef5c-56ef-a86c-b63f143b3249", "parentControlId": 31962, "controlId": "SC-02", "title": "SC-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589661" }, { "id": 601345, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589661", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94bf9ce0-de0a-5493-a3d6-246a06998ebd", "parentControlId": 31962, "controlId": "SC-02(01)", "title": "SC-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589661" }, { "id": 601346, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589661", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ceb4d907-c89e-5451-aa2c-a6c1a8c55ee0", "parentControlId": 31962, "controlId": "SC-02", "title": "SC-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589661" }, { "id": 601347, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589661", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ade4209f-fc75-58e4-8275-51d171593746", "parentControlId": 31962, "controlId": "SC-02", "title": "SC-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589661" }, { "id": 601350, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589661", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a7b88ed-9970-5efa-a698-4648bdfb9299", "parentControlId": 31962, "controlId": "3.13.3", "title": "3.13.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589661" }, { "controlId": "B.3.2", "title": "B.3.2 — Application Partitioning and Security Function Isolation", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-2, SC-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "a74b8bf7-d422-5542-b1ef-dcf6f7382d1c", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.2", "title": "NEI 08-09 App D.3.2 — Application Partitioning and Security Function Isolation", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "43eee68d-586f-5430-8647-5058553fe961", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "cb3e9dfd-eadd-5334-80d3-1923f9ae8471", "isPublic": true }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "eb27902e-404b-5cb4-a537-11b8516c46ed", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "7eb8c91d-da57-501e-be18-b033bf76c200", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "7fd7af98-25e2-5158-88a0-78503bb9ad9c", "isPublic": true } ], "id": 31962, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731306", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731306", "catalogueId": 1062, "uuid": "521c793b-ab8c-52f9-a8ba-00eaac30a8ad", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization separate user functionality from system management functionality?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Application Partitioning", "description": "

Control Description

Mechanisms exist to separate user functionality from system management functionality.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to separate user functionality from system management functionality.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.2", "controlId": "SEA-03.2", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-03.2", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73909, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591166", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591166", "securityControlId": 31963, "ccis": [], "uuid": "30a360ac-6710-59e0-929b-69afda0027f0", "testId": "SEA-04_A01", "test": "a separate execution domain is maintained for each executing system process.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-39", "defaultText": null } ], "externalMappings": [ { "id": 601370, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1239e634-e357-5480-9d8e-76084cd851e2", "parentControlId": 31963, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58967" }, { "id": 601371, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da4b1068-67e6-513b-91c7-b9cad9724217", "parentControlId": 31963, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58967" }, { "id": 601372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c36d747-08b4-5a19-822f-873d301521c3", "parentControlId": 31963, "controlId": "T1003.002", "title": "T1003.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58967" }, { "id": 601373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "daaead1a-9e0c-5947-b856-88850087d096", "parentControlId": 31963, "controlId": "T1003.003", "title": "T1003.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58967" }, { "id": 601374, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "764bc537-0cc4-5383-93c7-cbf4bbcbc7b6", "parentControlId": 31963, "controlId": "T1003.004", "title": "T1003.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58967" }, { "id": 601375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c95e2fad-ec20-586e-ab3f-d75dfb096a1c", "parentControlId": 31963, "controlId": "T1003.005", "title": "T1003.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58967" }, { "id": 601376, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f1d16f7-2ae4-540b-915d-e6650316abbf", "parentControlId": 31963, "controlId": "T1003.006", "title": "T1003.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58967" }, { "id": 601377, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58967", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e83964e4-d15d-5e8c-ac52-c933084a2a13", "parentControlId": 31963, "controlId": "T1003.007", "title": "T1003.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58967" }, { "id": 601378, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589671", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1bb35a2-14fd-56f9-b5bb-b7bf5b879f0f", "parentControlId": 31963, "controlId": "T1003.008", "title": "T1003.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589671" }, { "id": 601379, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589671", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9bf52a3b-d444-55dd-be0b-46a1e48bb752", "parentControlId": 31963, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589671" }, { "id": 601380, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589671", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7dd1ec99-7ac1-5f43-b102-fb0ac400ef25", "parentControlId": 31963, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589671" }, { "id": 601381, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589671", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd994d67-0c18-52da-b11b-c434345865ab", "parentControlId": 31963, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589671" }, { "id": 601382, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589671", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ea125f1-0672-591c-b234-bc39dc5ea066", "parentControlId": 31963, "controlId": "T1203", "title": "T1203", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589671" }, { "id": 601383, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589671", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c529a7f4-7b2a-59e0-9993-eb8443341809", "parentControlId": 31963, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589671" }, { "id": 601384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589671", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "114b2f19-b30d-5873-947e-109f8927a0e9", "parentControlId": 31963, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589671" }, { "id": 601385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589671", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25aac469-c8ac-52dc-b817-37fbf6ee13a5", "parentControlId": 31963, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589671" }, { "id": 601386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589671", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25899f14-8c6d-579e-8c9e-34dcbac88acc", "parentControlId": 31963, "controlId": "T1547.002", "title": "T1547.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589671" }, { "id": 601387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589672", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e534d8d-6596-5892-83d8-8dc459f8f540", "parentControlId": 31963, "controlId": "T1547.005", "title": "T1547.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589672" }, { "id": 601388, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589672", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09cf766f-b3ac-5389-b80f-236ca56ad003", "parentControlId": 31963, "controlId": "T1547.008", "title": "T1547.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589672" }, { "id": 601389, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589672", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42ee0ea6-1630-5b5a-bdac-60cde9281643", "parentControlId": 31963, "controlId": "T1556", "title": "T1556", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589672" }, { "id": 601390, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589672", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8ea9416-7818-5038-bb8e-92ebb8f84df4", "parentControlId": 31963, "controlId": "T1556.001", "title": "T1556.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589672" }, { "id": 601391, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589672", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65125ddc-1761-5309-94ff-6eefcb6bc379", "parentControlId": 31963, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589672" }, { "id": 601392, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589672", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "787c8ed3-10ec-510b-9131-b0eb2182a351", "parentControlId": 31963, "controlId": "SC-39", "title": "SC-39", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589672" }, { "id": 601393, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589672", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a692b85-2322-5e5f-aaed-54e98123ed2f", "parentControlId": 31963, "controlId": "SC-39", "title": "SC-39", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589672" }, { "id": 601394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589672", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0bfef1ca-e293-5975-925a-bed7b6467eb9", "parentControlId": 31963, "controlId": "SC-39", "title": "SC-39", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589672" }, { "id": 601395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ad8885b-0bbc-51fb-bb5e-285faf5f8088", "parentControlId": 31963, "controlId": "SC-39", "title": "SC-39", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589673" }, { "id": 601396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d36d8570-5084-51b9-987e-d2d4e2e82b6d", "parentControlId": 31963, "controlId": "SC-39", "title": "SC-39", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589673" }, { "id": 601397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08c32428-c82b-5bac-98b0-27f0e4fed75f", "parentControlId": 31963, "controlId": "SC-39", "title": "SC-39", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589673" }, { "id": 601398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a294efb2-1c80-52f6-83ac-57adb5c07cd1", "parentControlId": 31963, "controlId": "SC-39", "title": "SC-39", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589673" }, { "id": 601400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589673", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88049290-c564-51d1-a120-74b268d11251", "parentControlId": 31963, "controlId": "NFO - SC-39", "title": "NFO - SC-39", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589673" }, { "controlId": "B.3.2", "title": "B.3.2 — Application Partitioning and Security Function Isolation", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-2, SC-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "8a5da324-9ad0-54c7-9b26-6b702d29afa8", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.2", "title": "NEI 08-09 App D.3.2 — Application Partitioning and Security Function Isolation", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "401d154c-04b2-5ba5-b523-7c4a00fee9dd", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "93843dc0-c114-59ac-801e-e47d7c37f3e0", "isPublic": true }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b0e7da67-97e3-579e-870c-2a9dabfeb2e8", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "85ebccbb-704d-51c8-b144-a4025c635c5c", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "80e9f755-20c4-5c27-bbec-db79b43717e7", "isPublic": true } ], "id": 31963, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731307", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731307", "catalogueId": 1062, "uuid": "3c6a9a91-9323-5b20-b362-1ba5d43d2526", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement a separate execution domain for each executing process?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Process Isolation", "description": "

Control Description

Mechanisms exist to implement a separate execution domain for each executing process.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to implement a separate execution domain for each executing process.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.2", "controlId": "SEA-04", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-04", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73910, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591166", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591166", "securityControlId": 31964, "ccis": [], "uuid": "d4321666-6a53-52b5-b3c1-a646aa7a617d", "testId": "SEA-04.1_A01", "test": "security functions are isolated from non-security functions.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-03", "defaultText": null } ], "externalMappings": [ { "id": 601415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589675", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8dd8f5eb-0d38-525d-a875-8e41896e23cf", "parentControlId": 31964, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589675" }, { "id": 601416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "685d59a3-f8a9-585d-96d5-7d413f8d285c", "parentControlId": 31964, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589677" }, { "id": 601417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86eaabeb-606b-5263-8693-2580104197dd", "parentControlId": 31964, "controlId": "T1047", "title": "T1047", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589677" }, { "id": 601418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "254e4ca1-deb7-559c-a23a-a01f96cbf666", "parentControlId": 31964, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589678" }, { "id": 601419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15f2efbf-dd3e-5dac-b447-1cabd7fdab1a", "parentControlId": 31964, "controlId": "T1134.005", "title": "T1134.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589678" }, { "id": 601420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "137d104e-9d7b-5f6f-821d-a01ee65d78b1", "parentControlId": 31964, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589678" }, { "id": 601421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09f74603-5a8d-5873-ac95-36eb7f19b13e", "parentControlId": 31964, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589678" }, { "id": 601422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65513cf7-f883-50f1-bf52-6bc52810d463", "parentControlId": 31964, "controlId": "T1203", "title": "T1203", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589678" }, { "id": 601423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60e848b5-d4c5-56e9-a429-ff42cd2bb524", "parentControlId": 31964, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589678" }, { "id": 601424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "132670e4-6c0a-5a54-9c04-d2c06ecca7ed", "parentControlId": 31964, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589678" }, { "id": 601425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61cde904-1937-5337-9fe4-7d39fe54c902", "parentControlId": 31964, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589678" }, { "id": 601426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae215c78-642b-5056-bc78-8709fb4ba897", "parentControlId": 31964, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589679" }, { "id": 601427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ccf5104-ca10-53ac-a7c2-655e5a6e7aaa", "parentControlId": 31964, "controlId": "T1559.001", "title": "T1559.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589679" }, { "id": 601428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df0f6b85-f3ff-52e3-8c8c-bc1de14301f5", "parentControlId": 31964, "controlId": "T1559.002", "title": "T1559.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589679" }, { "id": 601429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "923ac995-179a-59b0-86aa-28ad26aa7e1f", "parentControlId": 31964, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589679" }, { "id": 601430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88c4fd98-885e-5964-b3d8-be4106f9e7e1", "parentControlId": 31964, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589679" }, { "id": 601431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e065a161-f48e-5a50-9d79-1d57c6549148", "parentControlId": 31964, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589679" }, { "id": 601432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f95fb46d-beb4-5488-8721-4e019dfa7dd0", "parentControlId": 31964, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589679" }, { "id": 601433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d51bbbb2-031f-56f1-92f5-1fca2e3b32b3", "parentControlId": 31964, "controlId": "SC-3", "title": "SC-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589679" }, { "id": 601434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64ad1aeb-5a99-5438-8e2e-da33c742c987", "parentControlId": 31964, "controlId": "SC-03", "title": "SC-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589679" }, { "id": 601436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58968", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b94979f1-372d-5152-a5db-49ae9daed2ba", "parentControlId": 31964, "controlId": "SC-03", "title": "SC-03", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58968" }, { "id": 601437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58968", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e10a8b1f-5957-5381-b3e1-418da48314b8", "parentControlId": 31964, "controlId": "SC-03", "title": "SC-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58968" }, { "id": 601438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58968", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d58455bc-7a51-5a07-8169-83be35c248c1", "parentControlId": 31964, "controlId": "SC-03", "title": "SC-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58968" }, { "controlId": "B.3.2", "title": "B.3.2 — Application Partitioning and Security Function Isolation", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-2, SC-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "601a557f-6d25-562e-a56d-5f210f80a7f2", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.2", "title": "NEI 08-09 App D.3.2 — Application Partitioning and Security Function Isolation", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6b5b00e8-51e7-577f-8660-ad135820b52f", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "08a558da-72a0-518d-a531-393d8c8c0883", "isPublic": true }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "0cfae57d-6ac2-5277-b921-49787e819aaa", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "f8e98838-ad8c-56a3-8523-4981afa4119c", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "2d111b24-9014-52a6-bce0-6c322637e986", "isPublic": true } ], "id": 31964, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731307", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731307", "catalogueId": 1062, "uuid": "127606e3-0ef6-527f-9458-5398eb2a02fc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization isolate security functions from non-security functions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Security Function Isolation", "description": "

Control Description

Mechanisms exist to isolate security functions from non-security functions.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to isolate security functions from non-security functions.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.2", "controlId": "SEA-04.1", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73911, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591166", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591166", "securityControlId": 31965, "ccis": [], "uuid": "299d8587-0df8-52db-9677-be4323681649", "testId": "SEA-04.2_A01", "test": "hardware separation is implemented to facilitate process isolation.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-39(01)", "defaultText": null } ], "externalMappings": [ { "id": 601461, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589682", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "024200a7-42d3-539a-9868-3dab1f6976ff", "parentControlId": 31965, "controlId": "SC-39(1)", "title": "SC-39(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589683" }, { "id": 601462, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0628c6e-94d5-5b47-b3b9-6964bae973c5", "parentControlId": 31965, "controlId": "SC-39(01)", "title": "SC-39(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589683" }, { "id": 601463, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a55bc92-14a0-5867-8a47-6aa77a278ee5", "parentControlId": 31965, "controlId": "SC-39(01)", "title": "SC-39(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589683" } ], "id": 31965, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731307", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731307", "catalogueId": 1062, "uuid": "d43da50a-ae07-5986-9476-15c8ddf4b137", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement underlying hardware separation mechanisms to facilitate process separation?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Hardware Separation", "description": "

Control Description

Mechanisms exist to implement underlying hardware separation mechanisms to facilitate process separation.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to implement underlying hardware separation mechanisms to facilitate process separation.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-04.2", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-04.2", "references": "

Medium Business (50-249 staff)

∙ Formal security architecture for high-risk systems

Large Business (250-999 staff)

∙ Enterprise security architecture program\n∙ Technology-specific security architectures

Enterprise (>1,000 staff)

∙ Enterprise security architecture center of excellence\n∙ Reference architectures\n∙ Architecture governance board", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73912, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591167", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591167", "securityControlId": 31966, "ccis": [], "uuid": "581f6cb5-4397-5fba-a895-34ec49f9107f", "testId": "SEA-04.3_A01", "test": "multi-thread processing for which a separate execution domain is to be maintained for each thread is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-39(02)_ODP", "defaultText": null }, { "id": 73913, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591167", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591167", "securityControlId": 31966, "ccis": [], "uuid": "ebb03897-a98d-5f2d-869c-7e512157f11f", "testId": "SEA-04.3_A02", "test": "a separate execution domain is maintained for each thread in organization-defined multi-threaded processing.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-39(02)", "defaultText": null } ], "externalMappings": [ { "id": 601467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dce7ec6a-1abb-5d24-9f1c-8782be5bd3a7", "parentControlId": 31966, "controlId": "SC-39(2)", "title": "SC-39(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589686" }, { "id": 601468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "611bc7c6-c90c-5b15-812e-c4f405141416", "parentControlId": 31966, "controlId": "SC-39(02)", "title": "SC-39(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589686" }, { "id": 601469, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b23a9a7-ab35-56fa-a0cd-f331c0b47eb1", "parentControlId": 31966, "controlId": "SC-39(02)", "title": "SC-39(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589686" } ], "id": 31966, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731307", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731308", "catalogueId": 1062, "uuid": "84465602-66b0-5216-8b63-6d0a02a680ff", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain a separate execution domain for each thread in multi-threaded processing?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Thread Separation", "description": "

Control Description

Mechanisms exist to maintain a separate execution domain for each thread in multi-threaded processing.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to maintain a separate execution domain for each thread in multi-threaded processing.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-04.3", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-04.3", "references": "

Large Business (250-999 staff)

∙ Security architecture review for enterprise-class systems

Enterprise (>1,000 staff)

∙ Enterprise security architecture review board\n∙ Architecture patterns library\n∙ Continuous architecture governance", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73915, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591168", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591168", "securityControlId": 31968, "ccis": [], "uuid": "270b921e-27d4-53b6-82d2-346ed27b7a55", "testId": "SEA-05_A01", "test": "unauthorized information transfer via shared system resources is prevented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-04[01]\n171A_3.13.4\n171A_R3_A.03.13.04[01]", "defaultText": null }, { "id": 73916, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591168", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591168", "securityControlId": 31968, "ccis": [], "uuid": "752a12bb-ed22-5102-b855-ebe53814b2c9", "testId": "SEA-05_A02", "test": "unintended information transfer via shared system resources is prevented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-04[02]\n171A_R3_A.03.13.04[02]", "defaultText": null } ], "externalMappings": [ { "id": 601479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "012566df-e314-53f5-abc6-8e3e679ee877", "parentControlId": 31968, "controlId": "T1020.001", "title": "T1020.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589687" }, { "id": 601480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35b3fb0b-f4f6-5370-9c75-dd3b514fff1c", "parentControlId": 31968, "controlId": "T1040", "title": "T1040", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589687" }, { "id": 601481, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3363bf8e-7615-5c2f-9f2d-7f0e461d74f3", "parentControlId": 31968, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589687" }, { "id": 601482, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6643c053-1d17-5c05-8fa4-d8f075dd19d1", "parentControlId": 31968, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589687" }, { "id": 601483, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24f0a7f2-81a5-53a6-a89f-71192db1cffa", "parentControlId": 31968, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589687" }, { "id": 601484, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94f731c2-7773-5061-b1a6-c0769a8ad462", "parentControlId": 31968, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589688" }, { "id": 601485, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "041a7ff7-4a2f-569b-9e27-8f19b6e133bd", "parentControlId": 31968, "controlId": "T1080", "title": "T1080", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589688" }, { "id": 601486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f810f302-3fe6-5bb4-b3bb-6eecd0a839de", "parentControlId": 31968, "controlId": "T1119", "title": "T1119", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589688" }, { "id": 601487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd416741-6981-510a-a62a-db048fbac367", "parentControlId": 31968, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589688" }, { "id": 601488, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75ba587a-76b9-57b9-b5ab-0277ad9509a6", "parentControlId": 31968, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589688" }, { "id": 601489, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ced09646-9e55-5d9e-8346-08b062c2178c", "parentControlId": 31968, "controlId": "T1552.001", "title": "T1552.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589688" }, { "id": 601490, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a83d5e2b-c898-5798-babf-21723e51b776", "parentControlId": 31968, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589688" }, { "id": 601491, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589697", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a3418cd-03ed-537a-bb16-69e534355d73", "parentControlId": 31968, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589697" }, { "id": 601492, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589697", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28905998-ead9-5fcf-97dd-4b7b88e1d671", "parentControlId": 31968, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589697" }, { "id": 601493, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589697", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9912b54d-23e8-5e27-b1ad-8c8ee1b2a04a", "parentControlId": 31968, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589697" }, { "id": 601494, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589697", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce37624c-ea83-5861-b209-ff3399469458", "parentControlId": 31968, "controlId": "T1558", "title": "T1558", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589697" }, { "id": 601495, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589697", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51f76001-33d5-5225-acdc-1c34a8142d2d", "parentControlId": 31968, "controlId": "T1558.002", "title": "T1558.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589697" }, { "id": 601496, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a961acd4-3a11-5324-8b04-db8e5d7b3dd8", "parentControlId": 31968, "controlId": "T1558.003", "title": "T1558.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589698" }, { "id": 601497, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bfd1e7e-4ddb-5e69-a074-776c14a5101d", "parentControlId": 31968, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589698" }, { "id": 601498, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "869020f0-ef63-5847-bb25-e6e8a8bfb421", "parentControlId": 31968, "controlId": "T1558.005", "title": "T1558.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589698" }, { "id": 601499, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef25358d-7773-5e23-b6a7-e36a69ccebeb", "parentControlId": 31968, "controlId": "T1564.009", "title": "T1564.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589698" }, { "id": 601500, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fce9ff1f-b7a9-574b-84f0-5dd5cab784c5", "parentControlId": 31968, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589698" }, { "id": 601501, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "713105f7-914b-5ac6-8de0-55216dedb6ee", "parentControlId": 31968, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589698" }, { "id": 601502, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f92d81f6-6f80-5e46-84b2-3f9366efd0e2", "parentControlId": 31968, "controlId": "T1565.002", "title": "T1565.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589698" }, { "id": 601503, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b141b692-c03d-587a-b50b-73b53899a8e7", "parentControlId": 31968, "controlId": "T1565.003", "title": "T1565.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589698" }, { "id": 601504, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1528bcbb-bee8-57fb-8bc8-fb860a72987b", "parentControlId": 31968, "controlId": "T1595.003", "title": "T1595.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589698" }, { "id": 601505, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589698", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ecbcfec8-1c8a-5e0d-b7e9-2dd17c6ca12d", "parentControlId": 31968, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589699" }, { "id": 601506, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8add1af-97e6-5702-84a0-12a49e332eb8", "parentControlId": 31968, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589699" }, { "id": 601507, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fd43bcc-0ad6-5d1f-844d-f910cea44a27", "parentControlId": 31968, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589699" }, { "id": 601508, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f399a33-71e6-5616-830f-57bf748e3cac", "parentControlId": 31968, "controlId": "SC-4", "title": "SC-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589699" }, { "id": 601509, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37c65ad7-436b-57a1-8457-fcd40bdb2bfa", "parentControlId": 31968, "controlId": "SC-04", "title": "SC-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589699" }, { "id": 601510, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d8253ce-5d50-59bf-80bd-b52a74b4da95", "parentControlId": 31968, "controlId": "SC-04", "title": "SC-04", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589699" }, { "id": 601511, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d87079b-5554-58fe-93da-5a30daf9cb12", "parentControlId": 31968, "controlId": "SC-04", "title": "SC-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589699" }, { "id": 601512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97aa5404-1107-5ad7-8aaa-efa609699eaa", "parentControlId": 31968, "controlId": "SC-04", "title": "SC-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589699" }, { "id": 601513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589699", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3bff4c6-140d-5f29-b68e-e508e75ee688", "parentControlId": 31968, "controlId": "SC-04", "title": "SC-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589699" }, { "id": 601514, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5897", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "244bf0ef-f53b-5ae9-abd7-1f7ea373fa60", "parentControlId": 31968, "controlId": "SC-4", "title": "SC-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5897" }, { "id": 601517, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d30eca72-419f-577a-adf0-e6492659380f", "parentControlId": 31968, "controlId": "3.13.4", "title": "3.13.4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589703" }, { "id": 601518, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50bf3fc3-5f6b-5911-a5a1-5b2910c6155e", "parentControlId": 31968, "controlId": "03.13.04", "title": "03.13.04", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589703" }, { "controlId": "B.3.3", "title": "B.3.3 — Shared Resources", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "d8bec530-9e54-5647-9e89-f04fa47b0de8", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.3", "title": "NEI 08-09 App D.3.3 — Shared Resources", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "0fbcc2c1-b12b-58df-9c1c-3564cf19b1bc", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "e7079b0a-789c-53b8-a400-93ce85bfd57e", "isPublic": true }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "1b4447db-ddfb-5955-b5ab-0ea13e2fcdaf", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "3c857866-9b80-5a1f-94d4-f3459359b241", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "1993f575-339e-5650-ae6a-2d0486b357fd", "isPublic": true } ], "id": 31968, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731308", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731308", "catalogueId": 1062, "uuid": "ebd07264-1b66-5b7e-8443-92a4235b2f5f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prevent unauthorized and unintended information transfer via shared system resources?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Information In Shared Resources", "description": "

Control Description

Mechanisms exist to prevent unauthorized and unintended information transfer via shared system resources.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to prevent unauthorized and unintended information transfer via shared system resources.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.3", "controlId": "SEA-05", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-05", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Logical Access Control (LAC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Logical Access Control (LAC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Logical Access Control (LAC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Logical Access Control (LAC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Logical Access Control (LAC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73917, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591168", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591168", "securityControlId": 31969, "ccis": [], "uuid": "260bf3c0-a913-5b75-a241-86883085daec", "testId": "SEA-06_A01", "test": "policies, rules of behavior, and/or access agreements regarding software program usage and restrictions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-07(02)_ODP[01]\n53A_R5_CM-07(02)_ODP[02]", "defaultText": null }, { "id": 73918, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591169", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591169", "securityControlId": 31969, "ccis": [], "uuid": "03658abb-7536-5c20-8110-afeb4b524e5b", "testId": "SEA-06_A02", "test": "program execution is prevented in accordance with organization-defined criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CM-07(02)", "defaultText": null } ], "externalMappings": [ { "id": 601548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589706", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dacd0683-1b15-5482-b641-cfa04a121566", "parentControlId": 31969, "controlId": "CM-7(2)", "title": "CM-7(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589706" }, { "id": 601549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589706", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed442451-d022-5d90-b44a-0c1791c10a24", "parentControlId": 31969, "controlId": "CM-07(02)", "title": "CM-07(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589706" }, { "id": 601551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d85b9113-f285-5ccc-b540-dc9be1d31a7b", "parentControlId": 31969, "controlId": "CM-07(02)", "title": "CM-07(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589707" }, { "id": 601552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85d02def-9264-532f-bbb3-c99cd72d3931", "parentControlId": 31969, "controlId": "CM-07(02)", "title": "CM-07(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589707" }, { "id": 601553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f95be3b-9a64-5b46-8a74-77c63c938f62", "parentControlId": 31969, "controlId": "CM-07(02)", "title": "CM-07(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589707" }, { "id": 601554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8689058b-f992-5ff6-97f7-b7847a58852a", "parentControlId": 31969, "controlId": "CM-07(02)", "title": "CM-07(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589707" }, { "controlId": "B.3.8", "title": "B.3.8 — Trusted Path", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "04d1c995-990e-5c63-bdee-12e983a38516", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.8", "title": "NEI 08-09 App D.3.8 — Trusted Path", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "528cc13c-d579-5d24-85dd-570363bb2159", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "3de6ae66-f210-5545-9934-2f564b1ad6e0", "isPublic": true }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "1be4960b-3a9c-5cda-aaaf-f53d6832cc8c", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "78966d7a-521c-58d8-90b2-490afbe9db4a", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "56fc0836-fbf3-5514-a771-f085880917a1", "isPublic": true } ], "id": 31969, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731309", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731309", "catalogueId": 1062, "uuid": "0b7570bb-b75b-59f3-84a7-84fb2deb9663", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to prevent the execution of unauthorized software programs?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 8.0, "title": "Prevent Program Execution", "description": "

Control Description

Automated mechanisms exist to prevent the execution of unauthorized software programs.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to automatically prevent the execution of unauthorized software programs.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.8", "controlId": "SEA-06", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-06", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73919, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591169", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591169", "securityControlId": 31970, "ccis": [], "uuid": "fe4af8d0-71f6-518f-a002-ead274550a0c", "testId": "SEA-07_A01", "test": "system components for which Mean Time to Failure (MTTF) should be determined are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-13_ODP[01]", "defaultText": null }, { "id": 73920, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591169", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591169", "securityControlId": 31970, "ccis": [], "uuid": "a34d18b7-be3b-5b32-ab02-d8fdcd1225e6", "testId": "SEA-07_A02", "test": "Mean Time to Failure (MTTF) substitution criteria to be used as a means to exchange active and standby components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-13_ODP[02]", "defaultText": null }, { "id": 73921, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591169", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591169", "securityControlId": 31970, "ccis": [], "uuid": "2e7925a4-a640-5f34-8bdc-e8d7ad2cf990", "testId": "SEA-07_A03", "test": "Mean Time to Failure (MTTF) is determined for system components in specific environments of operation.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-13a.", "defaultText": null }, { "id": 73922, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591169", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591169", "securityControlId": 31970, "ccis": [], "uuid": "b14fab44-7092-5d2a-88be-7629ed78264c", "testId": "SEA-07_A04", "test": "substitute system components and a means to exchange active and standby components are provided in accordance with Mean Time to Failure (MTTF) substitution criteria.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-13b.", "defaultText": null } ], "externalMappings": [ { "id": 601565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589708", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "027bade3-b71e-59a8-a05f-c6e89fedef18", "parentControlId": 31970, "controlId": "SI-13", "title": "SI-13", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589708" }, { "id": 601566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6019525f-33c3-5d7a-a4a2-bdda29181ba4", "parentControlId": 31970, "controlId": "SI-13", "title": "SI-13", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589711" }, { "id": 601568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d375e9b-3734-5a28-8f1f-78d1539ccbb6", "parentControlId": 31970, "controlId": "SI-13", "title": "SI-13", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589711" }, { "id": 601569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffed75f7-2829-5d92-826e-5c23f2720ff0", "parentControlId": 31970, "controlId": "SI-13", "title": "SI-13", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589711" }, { "id": 601570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589711", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb4e3565-2ba4-508b-ac95-87d8cf8df112", "parentControlId": 31970, "controlId": "MA-8", "title": "MA-8", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589711" }, { "id": 601572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589712", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "575048f0-e294-5258-ad83-d00fe5acdb00", "parentControlId": 31970, "controlId": "NFO - SA-3", "title": "NFO - SA-3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589712" }, { "id": 601573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589712", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "416c294c-a2af-5330-a910-ef3e3f71a28e", "parentControlId": 31970, "controlId": "03.16.02.b", "title": "03.16.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589712" }, { "id": 601574, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589712", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f54c339-15b8-5101-9f6e-44497f4080b9", "parentControlId": 31970, "controlId": "ID.AM-08", "title": "ID.AM-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589712" }, { "controlId": "B.3.22", "title": "B.3.22 — Fail in Known State", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-24", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "79cffe85-9c70-540c-a1ee-69c6f93078a4", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.22", "title": "NEI 08-09 App D.3.22 — Fail in Known State", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.22", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "f63ea741-53a9-59e7-8e94-cff653cb6c82", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(2)", "title": "10 CFR 73.54(c)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.22", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "686f9a0d-f40e-5923-8408-7c3f52397437", "isPublic": true }, { "controlId": "C.3.11", "title": "C.3.11 — Anticipated Failure Response", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-13, CP-10", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "b055cc25-5fd7-581a-9c0e-8749c4ab6362", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.11", "title": "NEI 08-09 App E.3.11 — Anticipated Failure Response", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.11", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "ed923aea-b735-5b07-be46-bc5a07c49abd", "isPublic": true }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "21a937b1-f93a-5f59-bc99-a432651ab6ec", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "0bc929be-c852-5cd3-bc7d-790ffc766958", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "a8e5a175-31bc-54c4-802f-975ed06fb919", "isPublic": true } ], "id": 31970, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731309", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731309", "catalogueId": 1062, "uuid": "72b7ae34-3a1e-5603-be52-8b305982a84b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization determine the Mean Time to Failure (MTTF) for system components in specific environments of operation?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Predictable Failure Analysis", "description": "

Control Description

Mechanisms exist to determine the Mean Time to Failure (MTTF) for system components in specific environments of operation.

Evidence Request List (ERL)

E-AST-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to determine the Mean Time to Failure (MTTF) for system components in specific environments of operation.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.22, C.3.11", "controlId": "SEA-07", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-07", "references": "

Micro-Small Business (<10 staff)

∙ Computer Lifecycle Program (CLP)\n∙ IT Asset Management (ITAM) program\n∙ Defined Mean Time to Failure (MTTF) for critical assets

Small Business (10-49 staff)

∙ Computer Lifecycle Program (CLP)\n∙ IT Asset Management (ITAM) program\n∙ Defined Mean Time to Failure (MTTF) for critical assets

Medium Business (50-249 staff)

∙ Computer Lifecycle Program (CLP)\n∙ IT Asset Management (ITAM) program\n∙ Defined Mean Time to Failure (MTTF) for critical assets

Large Business (250-999 staff)

∙ Computer Lifecycle Program (CLP)\n∙ IT Asset Management (ITAM) program\n∙ Defined Mean Time to Failure (MTTF) for critical assets

Enterprise (>1,000 staff)

∙ Computer Lifecycle Program (CLP)\n∙ IT Asset Management (ITAM) program\n∙ Defined Mean Time to Failure (MTTF) for critical assets", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73923, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591169", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591169", "securityControlId": 31971, "ccis": [], "uuid": "c4726765-8f57-5ac5-a213-6b14adc26031", "testId": "SEA-07.1_A01", "test": "a technology refresh schedule is planned for the system throughout the system development life cycle.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-03(03)[01]", "defaultText": null }, { "id": 73924, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59117", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59117", "securityControlId": 31971, "ccis": [], "uuid": "51a02297-ba54-54e1-a07e-df662a5bf7b4", "testId": "SEA-07.1_A02", "test": "a technology refresh schedule is implemented for the system throughout the system development life cycle.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-03(03)[02]", "defaultText": null }, { "id": 73925, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59117", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59117", "securityControlId": 31971, "ccis": [], "uuid": "0c4e6503-1757-5f1f-90e6-3612b163d532", "testId": "SEA-07.1_A03", "test": "system pre-production environments are protected commensurate with risk throughout the system development life cycle for the system, system component or system service.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SA-03(01)", "defaultText": null } ], "externalMappings": [ { "id": 601591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589714", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2db38af2-df2f-5ff4-80a9-6f1d621b929a", "parentControlId": 31971, "controlId": "SA-3", "title": "SA-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589714" }, { "id": 601592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589714", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb41905e-fec7-561c-a050-90b5f405dcf9", "parentControlId": 31971, "controlId": "SA-03", "title": "SA-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589714" }, { "id": 601593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589714", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "747fcd06-dd3a-5e6f-a5b1-90d359056e18", "parentControlId": 31971, "controlId": "SA-03(01)", "title": "SA-03(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589714" }, { "id": 601594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589714", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea169c00-7cc2-5eed-93b7-566b2b775df3", "parentControlId": 31971, "controlId": "SA-03(03)", "title": "SA-03(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589714" }, { "id": 601595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589715", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14155a69-ff7f-550a-b4eb-bc42631ca5b2", "parentControlId": 31971, "controlId": "SA-08(30)", "title": "SA-08(30)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589715" }, { "id": 601600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589715", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57ad1dd0-5a72-58ae-91f6-38e4d82e5b79", "parentControlId": 31971, "controlId": "SA-03", "title": "SA-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589715" }, { "id": 601601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589715", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75103379-2a65-5fa7-8ae9-00f8fd12d450", "parentControlId": 31971, "controlId": "SA-03", "title": "SA-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589715" }, { "id": 601602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589715", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18b32cf2-96b6-55ab-a117-633a93d1afbf", "parentControlId": 31971, "controlId": "SA-03(01)", "title": "SA-03(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589715" }, { "id": 601603, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589715", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92d8f7ec-dfb2-5ee5-a1a2-1dc921938fd2", "parentControlId": 31971, "controlId": "SA-03(03)", "title": "SA-03(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589715" }, { "id": 601604, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589715", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "354f15c6-c497-5f0c-9f9c-da9a2442fd73", "parentControlId": 31971, "controlId": "SA-08(30)", "title": "SA-08(30)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589715" }, { "id": 601605, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88df648c-61ad-53e5-a46c-731c4cc5ebb3", "parentControlId": 31971, "controlId": "SA-03", "title": "SA-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589716" }, { "id": 601606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8251482a-b9f3-5bda-bf56-f0ecccfba22d", "parentControlId": 31971, "controlId": "SA-03", "title": "SA-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589716" }, { "id": 601607, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ade8c675-0b79-5acd-8d7c-e703351f225f", "parentControlId": 31971, "controlId": "SA-03", "title": "SA-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589716" }, { "id": 601608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7386f36-20d2-5b28-b48c-be4de4c36961", "parentControlId": 31971, "controlId": "SA-3", "title": "SA-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589716" }, { "id": 601609, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5e52b92-ef0a-5a31-97ab-96bbb94ed40b", "parentControlId": 31971, "controlId": "SA-3", "title": "SA-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589716" }, { "id": 601613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75937a84-c2c0-5122-88c4-d7a4c815762e", "parentControlId": 31971, "controlId": "NFO - SA-3", "title": "NFO - SA-3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589716" }, { "id": 601614, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589717", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5da82397-9e59-51bb-a1b0-c83dbe46e69a", "parentControlId": 31971, "controlId": "03.16.02.a", "title": "03.16.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589717" }, { "id": 601615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589717", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c1df250-9670-56ce-8030-8a86320c1cdc", "parentControlId": 31971, "controlId": "03.16.02.b", "title": "03.16.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589717" }, { "id": 601616, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589721", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df80246d-9f79-50d8-9518-504f00579f8e", "parentControlId": 31971, "controlId": "GV.SC-09", "title": "GV.SC-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589721" }, { "id": 601617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589721", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92507147-777c-5667-b696-51aeb549cd90", "parentControlId": 31971, "controlId": "ID.AM-08", "title": "ID.AM-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589721" }, { "id": 601618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589721", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c9c8760-2ee8-50da-9683-19ec6d291d08", "parentControlId": 31971, "controlId": "PR.PS-02", "title": "PR.PS-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589721" }, { "id": 601619, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589721", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b7116d2-3278-5db0-83df-a6c90d423115", "parentControlId": 31971, "controlId": "PR.PS-03", "title": "PR.PS-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589721" }, { "id": 601625, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589722", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10b8023d-00cf-512d-b01c-b37d8e0d5cde", "parentControlId": 31971, "controlId": "ASSET-1h", "title": "ASSET-1h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589722" }, { "id": 601656, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46a0661d-3831-5043-bc12-78a13efe30e1", "parentControlId": 31971, "controlId": "A3.a (point 5)", "title": "A3.a (point 5)", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589726" } ], "id": 31971, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731309", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731309", "catalogueId": 1062, "uuid": "96cd96da-66ec-577c-8555-f6f75454e1e2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization manage the usable lifecycles of Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Technology Lifecycle Management", "description": "

Control Description

Mechanisms exist to manage the usable lifecycles of Technology Assets, Applications and/or Services (TAAS).

Evidence Request List (ERL)

E-AST-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to manage the usable lifecycles of TAAS.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-07.1", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-07.1", "references": "

Micro-Small Business (<10 staff)

∙ Computer Lifecycle Program (CLP)\n∙ IT Asset Management (ITAM) program\n∙ Defined Mean Time to Failure (MTTF) for critical assets

Small Business (10-49 staff)

∙ Computer Lifecycle Program (CLP)\n∙ IT Asset Management (ITAM) program\n∙ Defined Mean Time to Failure (MTTF) for critical assets

Medium Business (50-249 staff)

∙ Computer Lifecycle Program (CLP)\n∙ IT Asset Management (ITAM) program\n∙ Defined Mean Time to Failure (MTTF) for critical assets

Large Business (250-999 staff)

∙ Computer Lifecycle Program (CLP)\n∙ IT Asset Management (ITAM) program\n∙ Defined Mean Time to Failure (MTTF) for critical assets

Enterprise (>1,000 staff)

∙ Computer Lifecycle Program (CLP)\n∙ IT Asset Management (ITAM) program\n∙ Defined Mean Time to Failure (MTTF) for critical assets", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73926, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59117", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59117", "securityControlId": 31972, "ccis": [], "uuid": "4ba04733-ba25-54fc-a918-d83895c055b3", "testId": "SEA-07.2_A01", "test": "restrictions for safe mode of operation are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-12_ODP[01]", "defaultText": null }, { "id": 73927, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59117", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59117", "securityControlId": 31972, "ccis": [], "uuid": "6331f3e8-877b-583d-93d0-f8abf8b2f458", "testId": "SEA-07.2_A02", "test": "conditions detected to enter a safe mode of operation are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CP-12_ODP[02]", "defaultText": null }, { "id": 73928, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591171", "securityControlId": 31972, "ccis": [], "uuid": "a933c9a8-10f3-5450-9d95-835279fa6cab", "testId": "SEA-07.2_A03", "test": "a safe mode of operation is entered with restrictions when conditions are detected.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_CP-12", "defaultText": null }, { "id": 73929, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591171", "securityControlId": 31972, "ccis": [], "uuid": "fb257499-1689-569a-b4e0-c8224077b183", "testId": "SEA-07.2_A04", "test": "systems or system components that implement the security design principle of secure failure are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08(24)_ODP[01]", "defaultText": null }, { "id": 73930, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591171", "securityControlId": 31972, "ccis": [], "uuid": "5fcda7fa-46bf-5146-8394-a04f78895ed8", "testId": "SEA-07.2_A05", "test": "systems or system components that implement the security design principle of secure recovery are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08(24)_ODP[02]", "defaultText": null }, { "id": 73931, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591171", "securityControlId": 31972, "ccis": [], "uuid": "1312ddbc-389b-5269-9f8a-3f961b1f80ae", "testId": "SEA-07.2_A06", "test": "systems or system components implement the security design principle of secure failure.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SA-08(24)[01]", "defaultText": null }, { "id": 73932, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591171", "securityControlId": 31972, "ccis": [], "uuid": "857af140-00d4-5a66-ac70-d064de00da5c", "testId": "SEA-07.2_A07", "test": "systems or system components implement the security design principle of secure recovery.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SA-08(24)[02]", "defaultText": null }, { "id": 73933, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591171", "securityControlId": 31972, "ccis": [], "uuid": "b9f634d5-2bc0-509f-96e5-78cb5bc5e52e", "testId": "SEA-07.2_A08", "test": "types of system failures for which the system components fail to a known state are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-24_ODP[01]", "defaultText": null }, { "id": 73934, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591171", "securityControlId": 31972, "ccis": [], "uuid": "7a41f57c-9e42-50e1-a103-1e7bbb1e20ee", "testId": "SEA-07.2_A09", "test": "known system state to which system components fail in the event of a system failure is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-24_ODP[02]", "defaultText": null }, { "id": 73935, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591171", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591171", "securityControlId": 31972, "ccis": [], "uuid": "cfd70697-b15a-5cf8-878e-cd9e411dca7e", "testId": "SEA-07.2_A10", "test": "system state information to be preserved in the event of a system failure is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-24_ODP[03]", "defaultText": null }, { "id": 73936, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591172", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591172", "securityControlId": 31972, "ccis": [], "uuid": "7a72b204-ae03-5102-b0bf-40fcdbc6f003", "testId": "SEA-07.2_A11", "test": "types of system failures on system components fail to a known system state while preserving system state information in failure.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SC-24", "defaultText": null } ], "externalMappings": [ { "id": 601668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e2d7359-d1ab-5e03-a9fb-30c9d074747d", "parentControlId": 31972, "controlId": "SR 5.2 RE 3", "title": "SR 5.2 RE 3", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58973" }, { "id": 601669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00f00173-ed5d-53a6-9386-d57f0c1585f1", "parentControlId": 31972, "controlId": "NDR 5.2(3)", "title": "NDR 5.2(3)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58973" }, { "id": 601670, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48e7b95d-cd5f-5142-a917-65abaa35764a", "parentControlId": 31972, "controlId": "CP-12", "title": "CP-12", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58973" }, { "id": 601671, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "747b4a70-9123-5ad8-80e0-993e05f4e096", "parentControlId": 31972, "controlId": "SC-24", "title": "SC-24", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58973" }, { "id": 601672, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c4ea886-71cc-5c74-b652-7303883ec078", "parentControlId": 31972, "controlId": "CP-12", "title": "CP-12", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58973" }, { "id": 601673, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "453a9bb4-76c7-5f5c-9519-813143f51d91", "parentControlId": 31972, "controlId": "SA-08(24)", "title": "SA-08(24)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589731" }, { "id": 601674, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e80eff9b-f322-5f03-a598-7f4df6c7d295", "parentControlId": 31972, "controlId": "SC-24", "title": "SC-24", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589731" }, { "id": 601675, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5cfd13d0-e0ea-5355-adf9-e5db2179d323", "parentControlId": 31972, "controlId": "SC-24", "title": "SC-24", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589731" }, { "id": 601676, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8f16126-73c7-5e48-92b2-56ed4e64fd35", "parentControlId": 31972, "controlId": "CP-12", "title": "CP-12", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589731" }, { "id": 601677, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "003cef47-072f-5bcd-b111-d34623b1847e", "parentControlId": 31972, "controlId": "SA-08(24)", "title": "SA-08(24)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589731" }, { "id": 601678, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e72284b9-167f-56dc-9cc2-131242e818ff", "parentControlId": 31972, "controlId": "SC-24", "title": "SC-24", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589731" }, { "id": 601679, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcf3ac2f-a0e1-5ac9-8c8c-540f1e09b61d", "parentControlId": 31972, "controlId": "CP-12", "title": "CP-12", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589731" }, { "id": 601680, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589731", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbabbe68-d907-563f-8dab-63b6c7233f67", "parentControlId": 31972, "controlId": "CP-12", "title": "CP-12", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589731" }, { "id": 601681, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589732", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6a22627-a3ed-5434-ad83-9f0a85c7414f", "parentControlId": 31972, "controlId": "SC-24", "title": "SC-24", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589732" }, { "id": 601682, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589732", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "242693db-49ba-5266-973f-cf195f3ac5c2", "parentControlId": 31972, "controlId": "CP-12", "title": "CP-12", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589732" }, { "id": 601683, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589732", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc290800-d375-53bd-bef4-5ad7e2855885", "parentControlId": 31972, "controlId": "SC-24", "title": "SC-24", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589732" }, { "controlId": "B.3.22", "title": "B.3.22 — Fail in Known State", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-24", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "36c3c2af-2f87-59ee-9bec-ccddbb71c7ef", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.22", "title": "NEI 08-09 App D.3.22 — Fail in Known State", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.22", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "f929a89a-75e5-52d6-bd4d-cd2e25238415", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(2)", "title": "10 CFR 73.54(c)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.22", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "6a39672d-b199-57ef-bcea-1ab2356f21d0", "isPublic": true }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "9f5b8e77-8900-5947-987c-2e66437b5626", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "9ba3ea73-2533-56db-843a-4269730f8ab5", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "587a2657-1c49-58b0-bbec-5de4776f6e5a", "isPublic": true } ], "id": 31972, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73131", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73131", "catalogueId": 1062, "uuid": "603df684-3d8b-521c-b10d-5cacd50e8933", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enable systems to fail to an organization-defined known-state for types of failures, preserving system state information in failure?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Fail Secure", "description": "

Control Description

Mechanisms exist to enable systems to fail to an organization-defined known-state for types of failures, preserving system state information in failure.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to enable systems to fail to an organization-defined known-state for types of failures, preserving system state information in failure.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.22", "controlId": "SEA-07.2", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-07.2", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73937, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591173", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591173", "securityControlId": 31973, "ccis": [], "uuid": "65b24c3a-ca78-5a58-b488-d80c0dbb5fe1", "testId": "SEA-07.3_A01", "test": "fail-safe procedures associated with failure conditions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-17_ODP[01]", "defaultText": null }, { "id": 73938, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591173", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591173", "securityControlId": 31973, "ccis": [], "uuid": "263b4f41-803a-5b37-986b-9fed6a4277f2", "testId": "SEA-07.3_A02", "test": "a list of failure conditions requiring fail-safe procedures is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-17_ODP[02]", "defaultText": null }, { "id": 73939, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591174", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591174", "securityControlId": 31973, "ccis": [], "uuid": "5743f408-8589-5c48-99da-fdd15a04b6d1", "testId": "SEA-07.3_A03", "test": "fail-safe procedures are implemented when list of failure conditions occur.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-17", "defaultText": null } ], "externalMappings": [ { "id": 601690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589733", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "286d18c7-a1ca-5c9b-8244-092f252dc5ee", "parentControlId": 31973, "controlId": "NET 1.4", "title": "NET 1.4", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589733" }, { "id": 601691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589733", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29d001f8-20ef-5f16-88bf-f7f43ecf4735", "parentControlId": 31973, "controlId": "CR 3.6", "title": "CR 3.6", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589733" }, { "id": 601692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589733", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6bf87d1-2f5b-5dba-a9c3-bc3393edd17c", "parentControlId": 31973, "controlId": "SI-17", "title": "SI-17", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589733" }, { "id": 601693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589733", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "860d21aa-8393-5b20-a261-4d342c041cb0", "parentControlId": 31973, "controlId": "SI-17", "title": "SI-17", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589733" }, { "id": 601694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589733", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3b2ae58-00f0-529c-b6e9-e3b94b036794", "parentControlId": 31973, "controlId": "SI-17", "title": "SI-17", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589733" }, { "id": 601695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589733", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e67dd38-d86c-5a34-badd-314cb539e0b0", "parentControlId": 31973, "controlId": "SI-17", "title": "SI-17", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589733" }, { "id": 601696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b152d4ad-fb64-509b-9661-e8b668cfa40e", "parentControlId": 31973, "controlId": "SI-17", "title": "SI-17", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589734" }, { "id": 601697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca68fc91-e26c-5500-a2df-f664bc3b1c64", "parentControlId": 31973, "controlId": "SI-17", "title": "SI-17", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589734" } ], "id": 31973, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73131", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73131", "catalogueId": 1062, "uuid": "a7f6eb50-c86a-5f1b-8faa-a5534b0f483d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement fail-safe procedures when failure conditions occur?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Fail Safe", "description": "

Control Description

Mechanisms exist to implement fail-safe procedures when failure conditions occur.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to implement fail-safe procedures when failure conditions occur.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "SEA-07.3", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-07.3", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73940, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591174", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591174", "securityControlId": 31974, "ccis": [], "uuid": "d24ef65f-9579-5f18-80d9-55244f3b459c", "testId": "SEA-08_A01", "test": "non-persistent system components and services to be implemented are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-14_ODP[01]", "defaultText": null }, { "id": 73941, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591174", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591174", "securityControlId": 31974, "ccis": [], "uuid": "5a14d115-659e-54ce-8801-de0f2019516f", "testId": "SEA-08_A02", "test": "the frequency at which to terminate non-persistent components and services that are initiated in a known state is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-14_ODP[02]\n53A_R5_SI-14_ODP[03]", "defaultText": null }, { "id": 73942, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591174", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591174", "securityControlId": 31974, "ccis": [], "uuid": "3ab0f073-aced-5c59-ad60-c8c6c9790573", "testId": "SEA-08_A03", "test": "non-persistent system components and services that are initiated in a known state are implemented.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-14[01]", "defaultText": null }, { "id": 73943, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591174", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591174", "securityControlId": 31974, "ccis": [], "uuid": "de94b99f-bead-5a74-ac8a-e22c9deaaa2b", "testId": "SEA-08_A04", "test": "non-persistent system components and services are terminated per organization-defined criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-14[02]", "defaultText": null } ], "externalMappings": [ { "id": 601699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef7457c6-7248-58f7-b202-023a069f9691", "parentControlId": 31974, "controlId": "SR 4.2", "title": "SR 4.2", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589734" }, { "id": 601700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9527f2c1-2305-56c3-9a14-9ccd06cd4e30", "parentControlId": 31974, "controlId": "SR 4.2 RE 1", "title": "SR 4.2 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589734" }, { "id": 601701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6446dd96-c13c-5843-bb44-cb21295fa17b", "parentControlId": 31974, "controlId": "CR 4.2", "title": "CR 4.2", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589734" }, { "id": 601702, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3788dc18-61a3-59bc-a319-82459a0a8419", "parentControlId": 31974, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589734" }, { "id": 601703, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75a29371-ce7f-5b56-a733-270adc54949e", "parentControlId": 31974, "controlId": "T1505.001", "title": "T1505.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589734" }, { "id": 601704, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "219b1d17-917a-5311-8a22-a8205b4ebf51", "parentControlId": 31974, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589735" }, { "id": 601705, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28ef23bc-c86a-5210-acb2-39cbf0fdccce", "parentControlId": 31974, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589735" }, { "id": 601706, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8dd10067-6c6f-5831-826b-848d04089998", "parentControlId": 31974, "controlId": "T1546.003", "title": "T1546.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589735" }, { "id": 601707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77763b1c-8313-5c68-85f0-fcc1dc5e2251", "parentControlId": 31974, "controlId": "T1547.004", "title": "T1547.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589735" }, { "id": 601708, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2fd38ca-4ecb-5f24-a7f5-7de2b0846096", "parentControlId": 31974, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589735" }, { "id": 601709, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e6d0369-7f3d-5df0-9c84-ee599b7df252", "parentControlId": 31974, "controlId": "SI-14", "title": "SI-14", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589735" }, { "id": 601710, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "282587d7-df17-53cb-a260-46160f93ab2f", "parentControlId": 31974, "controlId": "SI-14", "title": "SI-14", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589735" }, { "id": 601711, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589735", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9043edda-f8ab-5941-8122-cae2604862a3", "parentControlId": 31974, "controlId": "SI-14", "title": "SI-14", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589735" }, { "controlId": "C.3.6", "title": "C.3.6 — Security Functionality Verification", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "0232afbe-9b75-5e3d-a251-c75d509b7e18", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.6", "title": "NEI 08-09 App E.3.6 — Security Functionality Verification", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "4e224adb-ce5d-58a1-a9d4-ed6387607be1", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.3.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "aadaf519-a26b-5061-984a-187d87f32fb3", "isPublic": true }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "dcec3fcf-1c9a-5d4a-8b48-3ce9d9d3bde2", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "18940ded-fb2e-587e-8df7-ed9bbc4da5b7", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "18f4c67b-72d9-5b34-9aec-51631c6d1c4a", "isPublic": true } ], "id": 31974, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731311", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731311", "catalogueId": 1062, "uuid": "4dd44a2b-016c-5340-87bb-0284fb8aec78", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement non-persistent system components and services that are initiated in a known state and terminated upon the end of the session of use or periodically at an organization-defined frequency?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Non-Persistence", "description": "

Control Description

Mechanisms exist to implement non-persistent system components and services that are initiated in a known state and terminated upon the end of the session of use or periodically at an organization-defined frequency.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to implement non-persistent system components and services that are initiated in a known state and terminated upon the end of the session of use or periodically at an organization-defined frequency.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.3.6", "controlId": "SEA-08", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-08", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73944, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591175", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591175", "securityControlId": 31975, "ccis": [], "uuid": "bb21828d-388c-541f-8a5b-4a415c97a8c6", "testId": "SEA-08.1_A01", "test": "a technology refresh schedule is planned for the system throughout the system development life cycle.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-03(03)[01]", "defaultText": null }, { "id": 73945, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591175", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591175", "securityControlId": 31975, "ccis": [], "uuid": "0d8f8922-1793-5667-9254-f7795bd37348", "testId": "SEA-08.1_A02", "test": "a technology refresh schedule is implemented for the system throughout the system development life cycle.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-03(03)[02]", "defaultText": null }, { "id": 73946, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591175", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591175", "securityControlId": 31975, "ccis": [], "uuid": "daa5441e-6066-59c2-a5e5-6843a7e3ee1d", "testId": "SEA-08.1_A03", "test": "trusted sources to obtain software and data for system component and service refreshes are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-14(01)_ODP", "defaultText": null }, { "id": 73947, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591175", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591175", "securityControlId": 31975, "ccis": [], "uuid": "3c92d57d-1ad6-5e72-99fa-48100cdbe179", "testId": "SEA-08.1_A04", "test": "the software and data employed during system component and service refreshes are obtained from organization-defined trusted sources.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-14(01)", "defaultText": null }, { "id": 73948, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591175", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591175", "securityControlId": 31975, "ccis": [], "uuid": "277dcfce-2e9d-59fc-9276-f48486b56321", "testId": "SEA-08.1_A05", "test": "approved systems and system components are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.4.1e[a]", "defaultText": null }, { "id": 73949, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591175", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591175", "securityControlId": 31975, "ccis": [], "uuid": "cc537296-3288-51fd-a414-e26296b51d82", "testId": "SEA-08.1_A06", "test": "implemented system components are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.4.1e[b]", "defaultText": null }, { "id": 73950, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591175", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591175", "securityControlId": 31975, "ccis": [], "uuid": "5e467a94-cf9e-5e75-a544-8de4d9ca906c", "testId": "SEA-08.1_A07", "test": "an authoritative source and repository are established to provide a trusted source and accountability for approved and implemented system components.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.4.1e[c]", "defaultText": null }, { "id": 73951, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591175", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591175", "securityControlId": 31975, "ccis": [], "uuid": "1863b7b2-2ac6-522f-a350-5bc975c8877d", "testId": "SEA-08.1_A08", "test": "an authoritative source and repository are maintained to provide a trusted source and accountability for approved and implemented system components.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.4.1e[d]", "defaultText": null }, { "id": 73952, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591175", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591175", "securityControlId": 31975, "ccis": [], "uuid": "2cdb635b-540f-59c4-ba00-e1bc733015eb", "testId": "SEA-08.1_A09", "test": "systems and system components to refresh from a known, trusted state are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.4e_ODP[1]", "defaultText": null }, { "id": 73953, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591176", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591176", "securityControlId": 31975, "ccis": [], "uuid": "5720d9bf-7f92-5b06-b752-9b13b459d216", "testId": "SEA-08.1_A10", "test": "the frequency to refresh systems and systems components is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.4e_ODP[2]", "defaultText": null }, { "id": 73954, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591176", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591176", "securityControlId": 31975, "ccis": [], "uuid": "81ee5c60-99b0-59fd-8240-eee1ea42a6ab", "testId": "SEA-08.1_A11", "test": "a known, trusted state is identified for systems and system components.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.4e[a]", "defaultText": null }, { "id": 73955, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591176", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591176", "securityControlId": 31975, "ccis": [], "uuid": "05845a82-cf43-53cc-82d7-a8343ad54398", "testId": "SEA-08.1_A12", "test": "systems and system components are refreshed from a known, trusted state per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.4e[b]", "defaultText": null } ], "externalMappings": [ { "id": 601717, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589738", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aac43572-8a8b-516d-9fa2-ac120b161b53", "parentControlId": 31975, "controlId": "CR 3.12", "title": "CR 3.12", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589738" }, { "id": 601718, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589738", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ea9794b-9aaf-5d13-ab13-85dd9c845a5b", "parentControlId": 31975, "controlId": "CR 3.13", "title": "CR 3.13", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589738" }, { "id": 601719, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b18189c4-7601-5b17-a1d5-f7ee68886128", "parentControlId": 31975, "controlId": "SI-14(1)", "title": "SI-14(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589739" }, { "id": 601720, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "311afe54-1750-5abe-805d-0b465aef90ba", "parentControlId": 31975, "controlId": "SA-03(03)", "title": "SA-03(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589739" }, { "id": 601721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88674013-6fbf-506f-8d13-6d4769d1fb19", "parentControlId": 31975, "controlId": "SI-14(01)", "title": "SI-14(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589739" }, { "id": 601723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6a203ef-10fd-542e-9bf1-388f88478397", "parentControlId": 31975, "controlId": "SA-03(03)", "title": "SA-03(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589739" }, { "id": 601724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589739", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e43fffe-e5b3-54e0-ad48-6a66dfeb8225", "parentControlId": 31975, "controlId": "SI-14(01)", "title": "SI-14(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589739" } ], "id": 31975, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731311", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731311", "catalogueId": 1062, "uuid": "14591bfd-6fb5-5934-b0cb-807a7d8b8b88", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure that software and data needed for system component and service refreshes are obtained from trusted sources?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Refresh from Trusted Sources", "description": "

Control Description

Mechanisms exist to ensure that software and data needed for system component and service refreshes are obtained from trusted sources.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to ensure that software and data needed for system component and service refreshes are obtained from trusted sources.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-08.1", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-08.1", "references": "

Medium Business (50-249 staff)

∙ Review systems for covert channels as part of security assessment

Large Business (250-999 staff)

∙ Covert channel analysis as part of security architecture review

Enterprise (>1,000 staff)

∙ Enterprise covert channel analysis program\n∙ Formal covert channel testing for high-assurance systems", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73956, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591176", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591176", "securityControlId": 31976, "ccis": [], "uuid": "502d989e-24fb-59a5-8858-41a2346c17d0", "testId": "SEA-09_A01", "test": "software programs and/or applications whose information output requires validation are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-15_ODP", "defaultText": null }, { "id": 73957, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591176", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591176", "securityControlId": 31976, "ccis": [], "uuid": "d6d40273-07e3-57dd-8399-05e25b3ac06c", "testId": "SEA-09_A02", "test": "information output from organization-defined software programs and/or applications is validated to ensure that the information is consistent with the expected content.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-15", "defaultText": null } ], "externalMappings": [ { "id": 601733, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58974", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "410aebf5-d63a-5091-aba4-ff0c4b482448", "parentControlId": 31976, "controlId": "T1021.002", "title": "T1021.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58974" }, { "id": 601734, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58974", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d8b77e4-3ad0-563c-ac7a-c9c75598f173", "parentControlId": 31976, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58974" }, { "id": 601735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58974", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b188b0b-aeb2-582d-879b-e4bf8a2a329e", "parentControlId": 31976, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58974" }, { "id": 601736, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b29cf8ef-8b2a-5e96-8238-8849495e2e45", "parentControlId": 31976, "controlId": "T1048.001", "title": "T1048.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589741" }, { "id": 601737, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "426621e5-35fa-5814-bc59-de645dabecde", "parentControlId": 31976, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589741" }, { "id": 601738, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c916635-0735-5f3a-851e-4f1c93ac6b50", "parentControlId": 31976, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589741" }, { "id": 601739, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c8f899a-916a-55e5-af9b-bcfdf00cf4e6", "parentControlId": 31976, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589741" }, { "id": 601740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e14b03f-0176-5370-b49d-a89f7cff1ea7", "parentControlId": 31976, "controlId": "T1090", "title": "T1090", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589741" }, { "id": 601741, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "430a998d-c016-586c-b1e7-1043e1907df3", "parentControlId": 31976, "controlId": "T1090.003", "title": "T1090.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589741" }, { "id": 601742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0473770c-e375-589f-85c1-8e1a7bc0ccce", "parentControlId": 31976, "controlId": "T1095", "title": "T1095", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589741" }, { "id": 601743, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589741", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b2818b1-159d-5c19-a9a9-5e1080f0ff6b", "parentControlId": 31976, "controlId": "T1187", "title": "T1187", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589741" }, { "id": 601744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd074582-5b35-53a6-9ef0-7cec435a832a", "parentControlId": 31976, "controlId": "T1197", "title": "T1197", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589742" }, { "id": 601745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efcda8c2-6c92-533b-a13a-89bf1c68b031", "parentControlId": 31976, "controlId": "T1205", "title": "T1205", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589742" }, { "id": 601746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87dcf72d-610b-5c96-9d32-37ab85d3002f", "parentControlId": 31976, "controlId": "T1205.001", "title": "T1205.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589742" }, { "id": 601747, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4dfe4044-c186-5795-9d76-64d0315fcd77", "parentControlId": 31976, "controlId": "T1218.012", "title": "T1218.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589742" }, { "id": 601748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c96631c5-5bff-54cf-921d-c6772c2d8a96", "parentControlId": 31976, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589742" }, { "id": 601749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "078592d0-2876-5d26-a461-9602653c19d1", "parentControlId": 31976, "controlId": "T1219", "title": "T1219", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589742" }, { "id": 601750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b41a88b6-04a2-5e60-bee6-1463688f84d2", "parentControlId": 31976, "controlId": "T1498", "title": "T1498", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589742" }, { "id": 601751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c336805-291f-5aa3-9ef0-0884e9b094d4", "parentControlId": 31976, "controlId": "T1498.001", "title": "T1498.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589742" }, { "id": 601752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589742", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf125b1e-02ea-5351-a1fc-0ea7fada6cb8", "parentControlId": 31976, "controlId": "T1498.002", "title": "T1498.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589742" }, { "id": 601753, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589743", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8cedbb8-4b90-5aba-b5fe-831d14f1ea6c", "parentControlId": 31976, "controlId": "T1499", "title": "T1499", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589743" }, { "id": 601754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589743", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9f49b63-5bd9-55f1-aa41-76005c3ee147", "parentControlId": 31976, "controlId": "T1499.001", "title": "T1499.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589743" }, { "id": 601755, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589743", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d40e910-9233-5e27-97c9-27ca2be46366", "parentControlId": 31976, "controlId": "T1499.002", "title": "T1499.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589743" }, { "id": 601756, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589743", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "183a75c3-f21b-5e55-aca9-6df6050f0114", "parentControlId": 31976, "controlId": "T1499.003", "title": "T1499.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589743" }, { "id": 601757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589743", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1abc009-9b25-5dcf-a230-adc6267f90bf", "parentControlId": 31976, "controlId": "T1499.004", "title": "T1499.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589743" }, { "id": 601758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589743", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0dd0fd7d-d8e5-5541-aef8-858caffbce20", "parentControlId": 31976, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589743" }, { "id": 601759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589743", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b18b0a5-35bb-5072-9ca4-39392bcc1920", "parentControlId": 31976, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589743" }, { "id": 601760, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589743", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19009e6d-2890-5e37-a6e7-12cc424984ee", "parentControlId": 31976, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589743" }, { "id": 601761, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589743", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f3caf0e-d58b-5fba-baa3-6078147d25e8", "parentControlId": 31976, "controlId": "T1552.005", "title": "T1552.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589743" }, { "id": 601762, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589744", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d8c664c-7a54-5b29-8d87-169ac1afb23f", "parentControlId": 31976, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589744" }, { "id": 601763, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589744", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "556b4a85-5b3b-505e-97e3-93906fd77688", "parentControlId": 31976, "controlId": "T1557.001", "title": "T1557.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589744" }, { "id": 601764, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589744", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9336cb99-c2c6-56bc-899c-5cf99026cdb1", "parentControlId": 31976, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589744" }, { "id": 601765, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589744", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d52b8ce1-c467-565e-9114-295cf0104c89", "parentControlId": 31976, "controlId": "T1557.003", "title": "T1557.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589744" }, { "id": 601766, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2abac98b-4c4d-5b8c-b1ab-8b3f9014811b", "parentControlId": 31976, "controlId": "T1564.009", "title": "T1564.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589748" }, { "id": 601767, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0255993f-ccd1-5a12-bbb8-8649efde6cf0", "parentControlId": 31976, "controlId": "T1570", "title": "T1570", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589748" }, { "id": 601768, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "282c6aef-0673-5d40-b563-c9321f2c5eb3", "parentControlId": 31976, "controlId": "T1572", "title": "T1572", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589748" }, { "id": 601769, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f0d9a09-cf60-53c9-a893-3c5912aa0898", "parentControlId": 31976, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589748" }, { "id": 601770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "787c2666-5dde-5538-afcb-b3450cfb0984", "parentControlId": 31976, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589748" }, { "id": 601771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "142284ca-2bf3-5bc8-b7a5-9ec76d6981e8", "parentControlId": 31976, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589749" }, { "id": 601772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f537148-2f2a-5872-a080-ba9a6fe033b5", "parentControlId": 31976, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589749" }, { "id": 601773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8b7a9ab-174d-5fe5-8b7a-ceb63574fa88", "parentControlId": 31976, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589749" }, { "id": 601774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12b5f33b-4616-53a0-909a-9ad49bb937c7", "parentControlId": 31976, "controlId": "T1622", "title": "T1622", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589749" }, { "id": 601776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ca03d2b-e294-569a-922e-53cb9151bc44", "parentControlId": 31976, "controlId": "SI-15", "title": "SI-15", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589749" }, { "id": 601777, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "daa03107-4585-5c03-bcae-b89aae0b404e", "parentControlId": 31976, "controlId": "SI-15", "title": "SI-15", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589749" }, { "id": 601778, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d614f1f-4948-5bca-88d4-bede18fb126a", "parentControlId": 31976, "controlId": "SI-15", "title": "SI-15", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589749" }, { "controlId": "B.3.21", "title": "B.3.21 — Heterogeneity/Diversity", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-29", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "74639897-56ea-5cda-88b9-1ecec9153b8b", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.21", "title": "NEI 08-09 App D.3.21 — Heterogeneity/Diversity", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.21", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "5b7f648a-44cc-54a0-ab14-1437381d4fc2", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(2)", "title": "10 CFR 73.54(c)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.21", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "f4128e2a-4878-5cea-a92c-f25766540fd6", "isPublic": true }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "2956a78a-93b9-53f6-b61d-32d263c272e1", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "e6ce55fc-94b7-5790-b688-090ae1537096", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "21558890-d68e-5db6-90a9-5e17e7e36217", "isPublic": true } ], "id": 31976, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731311", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731311", "catalogueId": 1062, "uuid": "114b9c25-0bc7-5396-a789-b056e44f8717", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization validate information output from software programs and/or applications to ensure that the information is consistent with the expected content?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Information Output Filtering", "description": "

Control Description

Mechanisms exist to validate information output from software programs and/or applications to ensure that the information is consistent with the expected content.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to validate information output from software programs and/or applications to ensure that the information is consistent with the expected content.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.21", "controlId": "SEA-09", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-09", "references": "

Medium Business (50-249 staff)

∙ Review systems for information leakage during security assessments

Large Business (250-999 staff)

∙ Formal information leakage assessment in architecture reviews

Enterprise (>1,000 staff)

∙ Enterprise information leakage prevention program\n∙ Automated analysis for covert channels and leakage", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73959, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591177", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591177", "securityControlId": 31978, "ccis": [], "uuid": "8f179629-db72-56b5-8e7a-88821ecef82a", "testId": "SEA-10_A01", "test": "controls to be implemented to protect the system memory from unauthorized code execution are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-16_ODP", "defaultText": null }, { "id": 73960, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591177", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591177", "securityControlId": 31978, "ccis": [], "uuid": "779a8e31-a580-5bc9-a539-0e0e1423e1b6", "testId": "SEA-10_A02", "test": "controls are implemented to protect the system memory from unauthorized code execution.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-16", "defaultText": null } ], "externalMappings": [ { "id": 601786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bee316f7-1dd7-5336-b7bd-d7ea643aa655", "parentControlId": 31978, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58975" }, { "id": 601787, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db2ba8d4-895d-55b5-9279-a9d338764abb", "parentControlId": 31978, "controlId": "T1047", "title": "T1047", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58975" }, { "id": 601788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58975", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61345419-1ab6-58ff-a5fe-0347950fff1d", "parentControlId": 31978, "controlId": "T1055.009", "title": "T1055.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58975" }, { "id": 601789, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64b947f6-7285-5d8d-ad89-1ac85771eb42", "parentControlId": 31978, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589751" }, { "id": 601790, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94a9e2db-7e5e-5915-829e-1a0193bdf5da", "parentControlId": 31978, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589751" }, { "id": 601791, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5a4a462-a602-5af8-bec6-ddecdaf81313", "parentControlId": 31978, "controlId": "T1059.002", "title": "T1059.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589751" }, { "id": 601792, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d462a44e-ab0b-56e2-871c-2be90fc64c98", "parentControlId": 31978, "controlId": "T1059.003", "title": "T1059.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589751" }, { "id": 601793, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "558032f1-ccd7-568d-b8bf-1fb0310f23c7", "parentControlId": 31978, "controlId": "T1059.004", "title": "T1059.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589751" }, { "id": 601794, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7b7873d-61e7-5186-8c89-3e97d99c3cd3", "parentControlId": 31978, "controlId": "T1059.005", "title": "T1059.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589751" }, { "id": 601795, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "550afdfd-bb11-5f85-889f-d63d310fe511", "parentControlId": 31978, "controlId": "T1059.006", "title": "T1059.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589751" }, { "id": 601796, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "959efa8a-ae20-5032-b9d9-1ef7d0840a27", "parentControlId": 31978, "controlId": "T1059.007", "title": "T1059.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589751" }, { "id": 601797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e118436-0b77-57be-972c-ec6c7524e897", "parentControlId": 31978, "controlId": "T1059.008", "title": "T1059.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589752" }, { "id": 601798, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b1089dd-ab93-5e3f-b056-788953e32d2a", "parentControlId": 31978, "controlId": "T1059.011", "title": "T1059.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589752" }, { "id": 601799, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f6a7e93-aa18-5749-9c5b-bde8ba5c9a19", "parentControlId": 31978, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589752" }, { "id": 601800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf3c1b07-4447-5503-8d54-4fac1009b713", "parentControlId": 31978, "controlId": "T1218.001", "title": "T1218.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589752" }, { "id": 601801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5173892f-1781-5856-abee-6947d9962340", "parentControlId": 31978, "controlId": "T1218.002", "title": "T1218.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589752" }, { "id": 601802, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc057e11-2bc4-516f-8b51-b3e817ede967", "parentControlId": 31978, "controlId": "T1218.003", "title": "T1218.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589752" }, { "id": 601803, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbd87c9d-04a2-5267-aed2-860b7f6f1ec1", "parentControlId": 31978, "controlId": "T1218.004", "title": "T1218.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589752" }, { "id": 601804, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "930a1dcb-680e-5848-bf8e-2bf2c34b2b8c", "parentControlId": 31978, "controlId": "T1218.005", "title": "T1218.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589752" }, { "id": 601805, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93ca7a53-778e-5a11-a5fa-bbf1922b5115", "parentControlId": 31978, "controlId": "T1218.008", "title": "T1218.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589752" }, { "id": 601806, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6a67aae-dd0e-5706-8930-ce352b238b50", "parentControlId": 31978, "controlId": "T1218.009", "title": "T1218.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589752" }, { "id": 601807, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "86cd3519-bebf-52a4-bd08-023b78b6a70f", "parentControlId": 31978, "controlId": "T1218.012", "title": "T1218.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589753" }, { "id": 601808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4af5e1f8-3cb5-52ac-9c40-5689e7e7720e", "parentControlId": 31978, "controlId": "T1218.013", "title": "T1218.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589753" }, { "id": 601809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "669d52d7-57dd-553d-8108-cebd7f150e8b", "parentControlId": 31978, "controlId": "T1218.014", "title": "T1218.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589753" }, { "id": 601810, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1bd0562-71f0-5b2e-97f1-1ebe1cb6343a", "parentControlId": 31978, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589753" }, { "id": 601811, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe05c133-ce27-5a42-8783-b2cc2b1d11e6", "parentControlId": 31978, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589753" }, { "id": 601812, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe79b7d5-a487-56b6-937e-5e2d6beb957e", "parentControlId": 31978, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589753" }, { "id": 601813, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7168ea65-fbd8-533f-a2ab-6e157d670ff2", "parentControlId": 31978, "controlId": "T1543.002", "title": "T1543.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589753" }, { "id": 601814, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b034309-0f74-51a8-a41c-af78ba9929e4", "parentControlId": 31978, "controlId": "T1547.004", "title": "T1547.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589753" }, { "id": 601815, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efb818c0-d5e1-5fd7-a1cd-1cdea328d32d", "parentControlId": 31978, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589753" }, { "id": 601816, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "455339b9-03bc-57dd-96a7-a08914a55bb3", "parentControlId": 31978, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589765" }, { "id": 601817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e701babf-b293-5ef9-95f4-6926524c8e0d", "parentControlId": 31978, "controlId": "T1548.004", "title": "T1548.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589765" }, { "id": 601818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19c00130-65fc-5588-a7ad-2c6f3a1ad6b8", "parentControlId": 31978, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589765" }, { "id": 601819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e5c1a9d-4393-5af1-bbf9-802a78b06eb9", "parentControlId": 31978, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589765" }, { "id": 601820, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9b29ddb-4c2a-5b89-b23f-a0be847c3f4d", "parentControlId": 31978, "controlId": "T1565.003", "title": "T1565.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589765" }, { "id": 601821, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82d39868-3179-5aa0-b64c-da03db1bca8c", "parentControlId": 31978, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589765" }, { "id": 601822, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ccb3c65-e3fa-5ec4-9dde-e0843701f945", "parentControlId": 31978, "controlId": "SI-16", "title": "SI-16", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589765" }, { "id": 601823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7856a3fc-f3b3-5adb-8dc4-40ecbae72083", "parentControlId": 31978, "controlId": "SI-16", "title": "SI-16", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589766" }, { "id": 601824, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30dd5d50-8afd-5102-9ace-603aedd0d3d6", "parentControlId": 31978, "controlId": "SI-16", "title": "SI-16", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589766" }, { "id": 601825, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "186959b1-6c2a-50be-be7d-e6ca563d7e4d", "parentControlId": 31978, "controlId": "SI-16", "title": "SI-16", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589766" }, { "id": 601826, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a38316c-c217-5125-83db-f90ad19570dd", "parentControlId": 31978, "controlId": "SI-16", "title": "SI-16", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589766" }, { "id": 601827, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ddf736c0-70fe-56a9-bc3c-466512ee613b", "parentControlId": 31978, "controlId": "SI-16", "title": "SI-16", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589766" }, { "id": 601829, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97c771ff-c88d-5b83-8045-7742b5a5b49a", "parentControlId": 31978, "controlId": "NFO - SI-16", "title": "NFO - SI-16", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589766" }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "e80e3260-4696-5013-8265-f1c2051d4335", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "ca7d79fd-7a31-5899-9425-fa4633ec333d", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "7acc023c-f849-58f3-bc14-9dad7f2865bf", "isPublic": true } ], "id": 31978, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731312", "catalogueId": 1062, "uuid": "95b7fbb2-f37f-547b-ae65-57d4d114e5e3", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement security safeguards to protect system memory from unauthorized code execution?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Memory Protection", "description": "

Control Description

Mechanisms exist to implement security safeguards to protect system memory from unauthorized code execution.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to implement security safeguards to protect system memory from unauthorized code execution.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-10", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-10", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73961, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591177", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591177", "securityControlId": 31979, "ccis": [], "uuid": "26981dce-da8f-5664-9e23-c33098b9136f", "testId": "SEA-11_A01", "test": "environments or resources which may contain or may be related to anomalous or suspected adversarial behavior are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(13)_ODP", "defaultText": null }, { "id": 73962, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591178", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591178", "securityControlId": 31979, "ccis": [], "uuid": "a680e930-c31d-53df-8c1d-d0f4c6fb31b5", "testId": "SEA-11_A02", "test": "anomalous or suspected adversarial behavior in or related to organization-defined environments or resources are analyzed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(13)", "defaultText": null }, { "id": 73963, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591178", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591178", "securityControlId": 31979, "ccis": [], "uuid": "c7e2664c-ea4d-5402-b501-d8e94a581f47", "testId": "SEA-11_A03", "test": "components within organizational systems specifically designed to be the target of malicious attacks are included to detect such attacks.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-26[01]", "defaultText": null }, { "id": 73964, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591178", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591178", "securityControlId": 31979, "ccis": [], "uuid": "9bfdac5c-f36f-5e25-91be-8bdda8434867", "testId": "SEA-11_A04", "test": "components within organizational systems specifically designed to be the target of malicious attacks are included to deflect such attacks.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-26[02]", "defaultText": null }, { "id": 73965, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591178", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591178", "securityControlId": 31979, "ccis": [], "uuid": "1a737659-9941-54d4-91a0-e4907e783989", "testId": "SEA-11_A05", "test": "components within organizational systems specifically designed to be the target of malicious attacks are included to analyze such attacks.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-26[03]", "defaultText": null }, { "id": 73966, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591178", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591178", "securityControlId": 31979, "ccis": [], "uuid": "f22ce1f6-c6c9-5187-bfd5-61d921e89dfa", "testId": "SEA-11_A06", "test": "technical and procedural means to confuse and mislead adversaries are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.13.3e_ODP[1]", "defaultText": null }, { "id": 73967, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591178", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591178", "securityControlId": 31979, "ccis": [], "uuid": "6724e524-0ec9-5ff4-9521-fa359785f472", "testId": "SEA-11_A07", "test": "technical and procedural means are employed to confuse and mislead adversaries.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.13.3e[a]", "defaultText": null } ], "externalMappings": [ { "id": 601836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93458b65-cfe9-5c6f-89f4-431fcff8dc70", "parentControlId": 31979, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589767" }, { "id": 601837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa5d6b52-133b-5d27-a445-7ea37a33ed78", "parentControlId": 31979, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589767" }, { "id": 601838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3dcfe01a-1f92-5478-b693-f9510ddca639", "parentControlId": 31979, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589767" }, { "id": 601839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b407f5f-12f0-5c00-83cb-80e39056eadd", "parentControlId": 31979, "controlId": "SC-26", "title": "SC-26", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589767" }, { "id": 601840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e279b13-c5e5-58f5-9626-7c325998aaac", "parentControlId": 31979, "controlId": "IR-04(13)", "title": "IR-04(13)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589767" }, { "id": 601841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33f5c6c8-3703-5952-bad5-2460bac2b65f", "parentControlId": 31979, "controlId": "SC-26", "title": "SC-26", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589768" }, { "id": 601843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fae147b6-aa96-55d0-b0b8-16bf2aca3c43", "parentControlId": 31979, "controlId": "IR-04(13)", "title": "IR-04(13)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589768" }, { "id": 601844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "243696b5-7e74-5fab-b21a-dc9fe4c6155b", "parentControlId": 31979, "controlId": "SC-26", "title": "SC-26", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589768" }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "098630e3-40ab-54f1-bd43-75f8044c1815", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "f5aa45c1-d473-5a70-85d8-7b49abd4898a", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "925141dc-203f-50e4-be8d-4645232df5c4", "isPublic": true } ], "id": 31979, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731312", "catalogueId": 1062, "uuid": "c101840c-560d-581e-96f0-fdcce761805f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize honeypots that are specifically designed to be the target of malicious attacks for the purpose of detecting, deflecting and analyzing such attacks?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Honeypots", "description": "

Control Description

Mechanisms exist to utilize honeypots that are specifically designed to be the target of malicious attacks for the purpose of detecting, deflecting and analyzing such attacks.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to utilize honeypots that are specifically designed to be the target of malicious attacks for the purpose of detecting, deflecting and analyzing such attacks.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-11", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-11", "references": "

Medium Business (50-249 staff)

∙ Honeypots/deception for early threat detection in high-risk environments

Large Business (250-999 staff)

∙ Enterprise honeypot/deception technology deployment (e.g., Attivo, Illusive Networks)

Enterprise (>1,000 staff)

∙ Enterprise deception technology platform (e.g., Attivo, Illusive Networks, Thinkst Canary)\n∙ Integrated with SIEM/SOAR", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73968, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591179", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591179", "securityControlId": 31980, "ccis": [], "uuid": "1beac33d-0518-59b4-90ed-bd880d2e4e00", "testId": "SEA-12_A01", "test": "system components that proactively seek to identify network-based malicious code or malicious websites are included.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-35", "defaultText": null }, { "id": 73969, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591179", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591179", "securityControlId": 31980, "ccis": [], "uuid": "e83908a5-29ea-53af-b318-ce524c3266db", "testId": "SEA-12_A02", "test": "environments or resources which may contain or may be related to anomalous or suspected adversarial behavior are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(13)_ODP", "defaultText": null }, { "id": 73970, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591179", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591179", "securityControlId": 31980, "ccis": [], "uuid": "a98fbc60-17a9-5789-91da-32dec8fff6ea", "testId": "SEA-12_A03", "test": "anomalous or suspected adversarial behavior in or related to organization-defined environments or resources are analyzed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(13)", "defaultText": null } ], "externalMappings": [ { "id": 601854, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2585520-3420-5812-a6d8-21f1d3946229", "parentControlId": 31980, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589769" }, { "id": 601855, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06a7b182-0333-5607-b588-6adab10b96a8", "parentControlId": 31980, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589769" }, { "id": 601856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79566a7c-3828-5f63-9309-92bf630dc275", "parentControlId": 31980, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589769" }, { "id": 601857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2f1f619-c7c0-558d-8f39-c924584d4670", "parentControlId": 31980, "controlId": "SC-35", "title": "SC-35", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58977" }, { "id": 601858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58977", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da5b3e7f-ac8a-519e-a81d-ba4b00f07cce", "parentControlId": 31980, "controlId": "IR-04(13)", "title": "IR-04(13)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58977" }, { "id": 601859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58977", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f043640-3270-5c26-a473-4cca50eb2c53", "parentControlId": 31980, "controlId": "SC-35", "title": "SC-35", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58977" }, { "id": 601861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58977", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08b7f07b-e8fc-5d72-82f0-d287d805cf39", "parentControlId": 31980, "controlId": "IR-04(13)", "title": "IR-04(13)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58977" }, { "id": 601862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58977", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12092b07-b270-584b-8991-8a1fb6840cd3", "parentControlId": 31980, "controlId": "SC-35", "title": "SC-35", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58977" }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "56e0e726-31e4-5463-8c7a-7b202d61e0a2", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "65027116-c1c5-50c4-b9ae-8d863b60c907", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "3a37895b-78f6-5082-99dc-b2c2214f4608", "isPublic": true } ], "id": 31980, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731313", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731313", "catalogueId": 1062, "uuid": "44b84bdd-24a7-50f3-8d2e-81f759cd1d49", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize honeyclients that proactively seek to identify malicious websites and/or web-based malicious code?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 3.0, "title": "Honeyclients", "description": "

Control Description

Mechanisms exist to utilize honeyclients that proactively seek to identify malicious websites and/or web-based malicious code.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to utilize honeyclients that proactively seek to identify malicious websites and/or web-based malicious code.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-12", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-12", "references": "

Medium Business (50-249 staff)

∙ System isolation and domain separation for sensitive systems

Large Business (250-999 staff)

∙ Domain separation design for enterprise systems\n∙ Physical or logical isolation

Enterprise (>1,000 staff)

∙ Enterprise domain separation architecture\n∙ Formal isolation standards\n∙ Cross-domain solution governance", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73971, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591179", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591179", "securityControlId": 31981, "ccis": [], "uuid": "fec0f83b-e49c-53ad-ae3e-a6f67025d945", "testId": "SEA-13_A01", "test": "diversity in system components is created to reduce the extent of malicious code propagation.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "172A_3.13.1e[a]", "defaultText": null }, { "id": 73972, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591179", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591179", "securityControlId": 31981, "ccis": [], "uuid": "5c874dae-17fe-5ec5-8bce-d1daf7a8494c", "testId": "SEA-13_A02", "test": "system components requiring a diverse set of information technologies to be employed in the implementation of the system are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-29_ODP\n172A_3.13.1e_ODP[1]", "defaultText": null }, { "id": 73973, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591179", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591179", "securityControlId": 31981, "ccis": [], "uuid": "ccd091ff-f204-5397-b1e1-f338ed84b676", "testId": "SEA-13_A03", "test": "a diverse set of information technologies is employed for organization-defined system components in the implementation of the system.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-29", "defaultText": null } ], "externalMappings": [ { "id": 601871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589774", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a08f7fbc-d468-5652-a26a-e479e1dc554c", "parentControlId": 31981, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589774" }, { "id": 601872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589775", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fb26bb6-6a31-5197-a68a-e7335e6070e6", "parentControlId": 31981, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589775" }, { "id": 601873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589775", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a707a131-9087-5d96-8614-1a32870fcf15", "parentControlId": 31981, "controlId": "T1203", "title": "T1203", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589775" }, { "id": 601874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589775", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50b01cf7-a057-58df-9561-8b37ae1c5dca", "parentControlId": 31981, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589775" }, { "id": 601875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589775", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34405361-8729-550c-9e8c-35f6be721a8c", "parentControlId": 31981, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589775" }, { "id": 601876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589775", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cbcff424-6a13-50c7-b540-204eadda5fdd", "parentControlId": 31981, "controlId": "SC-29", "title": "SC-29", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589775" }, { "id": 601877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589775", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d7ca9a5-837b-533a-90a6-f364a8dc9579", "parentControlId": 31981, "controlId": "SC-29", "title": "SC-29", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589775" }, { "id": 601878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589775", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f4672c6-8377-5c85-8888-3205d9e73328", "parentControlId": 31981, "controlId": "SC-29", "title": "SC-29", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589775" }, { "id": 601880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589775", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e505827d-1d72-534c-9c2e-ddde5dc7de41", "parentControlId": 31981, "controlId": "SC-29", "title": "SC-29", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589776" }, { "controlId": "B.3.21", "title": "B.3.21 — Heterogeneity/Diversity", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-29", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "b2896714-c47b-59f9-9129-2e1d6ccfbe1d", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.21", "title": "NEI 08-09 App D.3.21 — Heterogeneity/Diversity", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.21", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "02f1993a-942f-5f85-bf61-791834261a65", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(2)", "title": "10 CFR 73.54(c)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.21", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "67d4bad9-7a2c-523d-9366-27f151a0c8d0", "isPublic": true }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "0552688d-553b-50ec-ae0c-065f30759df6", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "1c63be33-69ec-5ee3-b9e5-cf238e520f81", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "7fb07aaf-da64-5a14-a2e3-c1762101ca46", "isPublic": true } ], "id": 31981, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731313", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731313", "catalogueId": 1062, "uuid": "4bb6a3e1-3486-5a58-abad-f4077f4bfe46", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize a diverse set of technologies for system components to reduce the impact of technical vulnerabilities from the same Original Equipment Manufacturer (OEM)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Heterogeneity", "description": "

Control Description

Mechanisms exist to utilize a diverse set of technologies for system components to reduce the impact of technical vulnerabilities from the same Original Equipment Manufacturer (OEM).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to utilize a diverse set of technologies for system components to reduce the impact of technical vulnerabilities from the same Original Equipment Manufacturer (OEM).

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.21", "controlId": "SEA-13", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-13", "references": "

Medium Business (50-249 staff)

∙ Virtualization security controls for VM environments

Large Business (250-999 staff)

∙ Enterprise virtualization security program (e.g., VMware security hardening)

Enterprise (>1,000 staff)

∙ Enterprise virtualization security platform (e.g., VMware Carbon Black, Prisma Cloud)\n∙ VM escape prevention\n∙ Hypervisor hardening", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73974, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591179", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59118", "securityControlId": 31982, "ccis": [], "uuid": "827755eb-4bb1-56c5-896a-8c7cfb7fafe0", "testId": "SEA-13.1_A01", "test": "the frequency at which to change the diversity of operating systems and applications deployed using virtualization techniques is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-29(01)_ODP", "defaultText": null }, { "id": 73975, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59118", "securityControlId": 31982, "ccis": [], "uuid": "16e9fbd0-8b3b-512e-a894-f49fa90cb564", "testId": "SEA-13.1_A02", "test": "virtualization techniques are employed to support the deployment of a diverse range of operating systems and applications that are changed per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-29(01)", "defaultText": null } ], "externalMappings": [ { "id": 601886, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "565462f4-7044-5e5b-9bfd-a6f8c185bcd3", "parentControlId": 31982, "controlId": "SC-29(1)", "title": "SC-29(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589776" }, { "id": 601887, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57538cfb-eec3-54bc-9e58-367b159867e2", "parentControlId": 31982, "controlId": "SC-29(01)", "title": "SC-29(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589776" }, { "id": 601888, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85df9314-3f7a-575e-89c6-96d45f4362d8", "parentControlId": 31982, "controlId": "SC-29(01)", "title": "SC-29(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589776" } ], "id": 31982, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731313", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731314", "catalogueId": 1062, "uuid": "df95a994-7471-53bb-83ff-46659bf331f1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize virtualization techniques to support the employment of a diversity of operating systems and applications?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Virtualization Techniques", "description": "

Control Description

Mechanisms exist to utilize virtualization techniques to support the employment of a diversity of operating systems and applications.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to utilize virtualization techniques to support the employment of a diversity of operating systems and applications.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-13.1", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-13.1", "references": "

Medium Business (50-249 staff)

∙ Hypervisor hardening and VM isolation controls

Large Business (250-999 staff)

∙ Enterprise hypervisor hardening program\n∙ VM isolation and security policies

Enterprise (>1,000 staff)

∙ Enterprise hypervisor security program\n∙ Formal VM isolation standards\n∙ Automated hypervisor compliance checking", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73976, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59118", "securityControlId": 31983, "ccis": [], "uuid": "508f57c5-325c-56e0-8041-68f8653e56ae", "testId": "SEA-14_A01", "test": "concealment and misdirection techniques to be employed to confuse and mislead adversaries potentially targeting systems are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-30_ODP[01]\n172A_3.13.3e_ODP[1]", "defaultText": null }, { "id": 73977, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59118", "securityControlId": 31983, "ccis": [], "uuid": "09196384-67bf-5988-957b-1a5bc9962356", "testId": "SEA-14_A02", "test": "systems for which concealment and misdirection techniques are to be employed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-30_ODP[02]", "defaultText": null }, { "id": 73978, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59118", "securityControlId": 31983, "ccis": [], "uuid": "ac40f247-1416-55e4-9dbd-818baabf6f3b", "testId": "SEA-14_A03", "test": "time periods to employ concealment and misdirection techniques for systems are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-30_ODP[03]", "defaultText": null }, { "id": 73979, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59118", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59118", "securityControlId": 31983, "ccis": [], "uuid": "94b196c4-afda-5f1d-9985-79b6bf33a836", "testId": "SEA-14_A04", "test": "concealment and misdirection techniques are employed for systems for time periods to confuse and mislead adversaries.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-30\n172A_3.13.3e[a]", "defaultText": null } ], "externalMappings": [ { "id": 601924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "684130cf-6876-597e-82df-69950ae23811", "parentControlId": 31983, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589784" }, { "id": 601925, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b413ae45-9c26-53f4-8fbc-174f91b93187", "parentControlId": 31983, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589784" }, { "id": 601926, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a421a25-76ad-5c20-bed7-9c5547d27b41", "parentControlId": 31983, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589784" }, { "id": 601927, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25ed33c0-34f7-515b-a0b1-860c26446fdb", "parentControlId": 31983, "controlId": "T1203", "title": "T1203", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589784" }, { "id": 601928, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5b7e1ed-e216-5b65-9ea6-4c46d49bc0e8", "parentControlId": 31983, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589784" }, { "id": 601929, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f7492b2-660b-5c94-b282-c5b94428a369", "parentControlId": 31983, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589784" }, { "id": 601930, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d870e6e-07e5-5875-bfe6-54e78057c5ca", "parentControlId": 31983, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589784" }, { "id": 601931, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f70227ff-c12e-5ef6-a55b-d588120a8ec2", "parentControlId": 31983, "controlId": "SC-30", "title": "SC-30", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589784" }, { "id": 601932, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589784", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f93c7f97-19c2-51b6-94e9-c2e6061eb8d9", "parentControlId": 31983, "controlId": "SC-30", "title": "SC-30", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589784" }, { "id": 601933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589785", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83896ef9-8159-5e83-b171-daf9ef05fc5e", "parentControlId": 31983, "controlId": "SC-30(04)", "title": "SC-30(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589785" }, { "id": 601934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589785", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0134f94-ad20-5cd0-9d52-f7e6746eb900", "parentControlId": 31983, "controlId": "SC-30(05)", "title": "SC-30(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589785" }, { "id": 601935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589785", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4cfd1fc0-20ec-5e96-8751-5d4d025a544d", "parentControlId": 31983, "controlId": "SC-30", "title": "SC-30", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589785" }, { "id": 601936, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589785", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b21b838-6296-5e9a-b22b-02d5a13295f3", "parentControlId": 31983, "controlId": "SC-30(04)", "title": "SC-30(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589785" }, { "id": 601937, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589785", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31a1d37f-f964-5dd0-820d-0791169a0c8d", "parentControlId": 31983, "controlId": "SC-30(05)", "title": "SC-30(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589785" }, { "id": 601941, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589786", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5383d65-17ce-5df1-91da-43785c9fc3c1", "parentControlId": 31983, "controlId": "SC-30", "title": "SC-30", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589786" }, { "id": 601942, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589786", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3040747-bd9b-5465-9839-6be2a10371b6", "parentControlId": 31983, "controlId": "SC-30(4)", "title": "SC-30(4)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589786" }, { "id": 601943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589786", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea357376-b587-566a-bb2b-d309ceaa1811", "parentControlId": 31983, "controlId": "SC-30(5)", "title": "SC-30(5)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589786" }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "0033adcf-a4f1-533c-be89-d6afb0bf2ecc", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "7746e761-0242-5cfe-b603-33073f2f0f0c", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "5fadc79f-054f-52ba-b550-6567ff933511", "isPublic": true } ], "id": 31983, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731314", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731314", "catalogueId": 1062, "uuid": "243997a6-6fae-5de0-b685-e2e8f932f378", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize concealment and misdirection techniques for Technology Assets, Applications and/or Services (TAAS) to confuse and mislead adversaries?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Concealment & Misdirection", "description": "

Control Description

Mechanisms exist to utilize concealment and misdirection techniques for Technology Assets, Applications and/or Services (TAAS) to confuse and mislead adversaries.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to utilize concealment and misdirection techniques for TAAS to confuse and mislead adversaries.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-14", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-14", "references": "

Medium Business (50-249 staff)

∙ Container security controls for containerized workloads

Large Business (250-999 staff)

∙ Enterprise container security program (e.g., Docker/Kubernetes security)\n∙ Container scanning

Enterprise (>1,000 staff)

∙ Enterprise container security platform (e.g., Aqua Security, Prisma Cloud, Sysdig)\n∙ Container image scanning\n∙ Runtime protection", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73980, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591181", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591181", "securityControlId": 31984, "ccis": [], "uuid": "758a5eae-74e4-545f-b41f-6d3226ea9e36", "testId": "SEA-14.1_A01", "test": "changes to organizational systems and system components to introduce a degree of unpredictability into operations are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.13.2e_ODP[1]", "defaultText": null }, { "id": 73981, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591181", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591181", "securityControlId": 31984, "ccis": [], "uuid": "9e959653-bdbe-5de0-a16a-1fafb52daa4f", "testId": "SEA-14.1_A02", "test": "the frequency of changes by system and system components is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.13.2e_ODP[2]", "defaultText": null }, { "id": 73982, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591181", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591181", "securityControlId": 31984, "ccis": [], "uuid": "36259ef5-686d-5208-bc47-dec52c2637b1", "testId": "SEA-14.1_A03", "test": "organizational systems and system components necessitating unpredictability are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.13.2e[a]", "defaultText": null }, { "id": 73983, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591181", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591181", "securityControlId": 31984, "ccis": [], "uuid": "44ae01fe-4358-5929-b392-0f83dcfc7df4", "testId": "SEA-14.1_A04", "test": "changes to organizational systems and system components are implemented frequently to introduce a degree of unpredictability into operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.13.2e[b]", "defaultText": null }, { "id": 73984, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591181", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591181", "securityControlId": 31984, "ccis": [], "uuid": "c41f0e7d-786f-5c96-9e33-9c217ba40902", "testId": "SEA-14.1_A05", "test": "technical and procedural means to confuse and mislead adversaries are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.13.3e_ODP[1]\n53A_R5_SC-30(02)_ODP", "defaultText": null }, { "id": 73985, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591181", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591181", "securityControlId": 31984, "ccis": [], "uuid": "4265fcc8-8e19-5a17-ab0f-49a042f7c40f", "testId": "SEA-14.1_A06", "test": "technical and procedural means are employed to confuse and mislead adversaries.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.13.3e[a]\n53A_R5_SC-30(02)", "defaultText": null } ], "externalMappings": [ { "id": 601951, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589787", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a5ed5f6-1eaf-5e5e-8227-4dbe3ef63459", "parentControlId": 31984, "controlId": "SC-30(2)", "title": "SC-30(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589787" }, { "id": 601952, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589787", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27dbe117-42f3-516c-9575-5f8d1378276a", "parentControlId": 31984, "controlId": "SC-30(02)", "title": "SC-30(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589787" }, { "id": 601953, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589787", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c75df477-b0ed-5f41-997d-b3eaca78e32b", "parentControlId": 31984, "controlId": "SC-30(02)", "title": "SC-30(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589787" }, { "id": 601955, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589787", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5368f90-6f71-54c7-bb85-aba4b94d0aed", "parentControlId": 31984, "controlId": "SC-30(2)", "title": "SC-30(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589787" } ], "id": 31984, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731314", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731314", "catalogueId": 1062, "uuid": "17454583-0eca-529a-8532-6587844f77e3", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to introduce randomness into organizational operations and assets?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Randomness", "description": "

Control Description

Automated mechanisms exist to introduce randomness into organizational operations and assets.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to automatically introduce randomness into organizational operations and assets.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-14.1", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-14.1", "references": "

Medium Business (50-249 staff)

∙ Secure container image management\n∙ Use trusted base images

Large Business (250-999 staff)

∙ Enterprise container image security (scanning, signing)\n∙ Trusted registry

Enterprise (>1,000 staff)

∙ Enterprise container image management (e.g., Aqua, Twistlock)\n∙ Image signing (Notary)\n∙ Automated vulnerability scanning", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73986, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591182", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591182", "securityControlId": 31985, "ccis": [], "uuid": "8fa70770-94fb-58b8-89b3-be146cd364d9", "testId": "SEA-14.2_A01", "test": "processing and/or storage locations to be changed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-30(03)_ODP[01]", "defaultText": null }, { "id": 73987, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591187", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591187", "securityControlId": 31985, "ccis": [], "uuid": "3a42efce-65b7-5ed4-aa20-ddc4dca18d97", "testId": "SEA-14.2_A02", "test": "time frequency at which to change the location of processing and/or storage is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-30(03)_ODP[02]\n53A_R5_SC-30(03)_ODP[03]", "defaultText": null }, { "id": 73988, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591187", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591187", "securityControlId": 31985, "ccis": [], "uuid": "908c1aba-028f-5d39-aeb9-9d0788c833e4", "testId": "SEA-14.2_A03", "test": "the location of processing and/or storage is changed per an organization-defined criteria.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-30(03)", "defaultText": null } ], "externalMappings": [ { "id": 601959, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589787", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08aa1ec1-6cf2-5a77-8950-837bce9a017c", "parentControlId": 31985, "controlId": "SC-30(3)", "title": "SC-30(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589787" }, { "id": 601960, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589788", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3cc96597-e5de-5697-bffc-9977405ef5e5", "parentControlId": 31985, "controlId": "SC-30(03)", "title": "SC-30(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589788" }, { "id": 601961, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589788", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c26b0f4-a0d4-5f4b-ba68-db2b2885fc62", "parentControlId": 31985, "controlId": "SC-30(03)", "title": "SC-30(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589788" }, { "id": 601963, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589788", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "299e9974-3dcf-5481-ae77-f04e9c873ce6", "parentControlId": 31985, "controlId": "SC-30(3)", "title": "SC-30(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589788" } ], "id": 31985, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731315", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731315", "catalogueId": 1062, "uuid": "9982ccee-c3f4-5145-b4c3-9f5384e48614", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to change the location of processing and/or storage at random time intervals?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Change Processing & Storage Locations", "description": "

Control Description

Automated mechanisms exist to change the location of processing and/or storage at random time intervals.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to automatically change the location of processing and/or storage at random time intervals.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-14.2", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-14.2", "references": "

Medium Business (50-249 staff)

∙ Kubernetes/container orchestration security hardening

Large Business (250-999 staff)

∙ Enterprise Kubernetes security program (e.g., CIS Kubernetes Benchmark)

Enterprise (>1,000 staff)

∙ Enterprise Kubernetes security platform (e.g., Aqua, Prisma Cloud, NeuVector)\n∙ Network policies\n∙ RBAC enforcement\n∙ Runtime security", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73989, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591187", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591187", "securityControlId": 31986, "ccis": [], "uuid": "b732f3f8-fee2-56f2-b52f-1bd24c5bacb8", "testId": "SEA-15_A01", "test": "the logical and physical location where the system resides is planned considering physical and environmental hazards.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-23a.\n53A_R5_SC-36_ODP[04]", "defaultText": null }, { "id": 73990, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591187", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591187", "securityControlId": 31986, "ccis": [], "uuid": "e77f8c38-d664-58e4-abb7-5ef1ce54d3ad", "testId": "SEA-15_A02", "test": "for existing facilities, physical and environmental hazards are considered in the organizational risk management strategy.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-23b.", "defaultText": null }, { "id": 73991, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591187", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591187", "securityControlId": 31986, "ccis": [], "uuid": "4d893bea-e5e7-5757-8df6-6ac49605353f", "testId": "SEA-15_A03", "test": "processing components to be distributed across multiple locations/domains are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-36_ODP[01]", "defaultText": null }, { "id": 73992, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591187", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591187", "securityControlId": 31986, "ccis": [], "uuid": "53261491-064c-5ab2-9086-c8903aeb9347", "testId": "SEA-15_A04", "test": "storage components to be distributed across multiple locations/domains are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-36_ODP[02]\n53A_R5_SC-36_ODP[03]", "defaultText": null }, { "id": 73993, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591187", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591187", "securityControlId": 31986, "ccis": [], "uuid": "2fe01138-49df-57ba-9362-20c2f6659902", "testId": "SEA-15_A05", "test": "processing components are distributed across organization-defined locations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-36[01]", "defaultText": null }, { "id": 73994, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591188", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591188", "securityControlId": 31986, "ccis": [], "uuid": "a89197a2-42d1-5bb9-90f6-3a7e56bb25d0", "testId": "SEA-15_A06", "test": "storage components are distributed across organization-defined locations.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-36[02]", "defaultText": null }, { "id": 73995, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591188", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591188", "securityControlId": 31986, "ccis": [], "uuid": "dd80ac17-d087-5e5c-b2a9-5437a6d930ed", "testId": "SEA-15_A07", "test": "system functions or resources to distribute and relocate are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.13.5e_ODP[1]", "defaultText": null }, { "id": 73996, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591188", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591188", "securityControlId": 31986, "ccis": [], "uuid": "66d9abc3-95ac-5aab-ba52-26ad9e7c6914", "testId": "SEA-15_A08", "test": "frequency to distribute and relocate system functions or resources is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.13.5e_ODP[2]", "defaultText": null }, { "id": 73997, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591188", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591188", "securityControlId": 31986, "ccis": [], "uuid": "ac5106af-60c8-54a7-958a-747ba783ab98", "testId": "SEA-15_A09", "test": "system functions or resources are distributed and relocated frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.13.5e[a]", "defaultText": null } ], "externalMappings": [ { "id": 601966, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e9d967c-2ad3-577e-a9b9-3a8c2ca4e9aa", "parentControlId": 31986, "controlId": "T1070", "title": "T1070", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589791" }, { "id": 601967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4e56b80-071f-5cb8-b335-35590967f96b", "parentControlId": 31986, "controlId": "T1070.001", "title": "T1070.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589791" }, { "id": 601968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36a2bba4-8202-5238-96bd-a24179148a92", "parentControlId": 31986, "controlId": "T1070.002", "title": "T1070.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589791" }, { "id": 601969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0a88814-edb5-5725-be90-9280a61ff71c", "parentControlId": 31986, "controlId": "T1070.008", "title": "T1070.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589791" }, { "id": 601970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4c68dcf-c6a3-52ac-8a1e-04e14da32d7b", "parentControlId": 31986, "controlId": "T1119", "title": "T1119", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589791" }, { "id": 601971, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ab8734a-1ccb-5b04-95bd-110b11301a8a", "parentControlId": 31986, "controlId": "T1565", "title": "T1565", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589791" }, { "id": 601972, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589792", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29376d8c-6f56-5def-9cf6-4ed567d8782e", "parentControlId": 31986, "controlId": "T1565.001", "title": "T1565.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589792" }, { "id": 601973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589792", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c2608af-8026-535f-98c4-0e6cc21ddeef", "parentControlId": 31986, "controlId": "SC-36", "title": "SC-36", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589792" }, { "id": 601974, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589792", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7929eaa7-1094-55ef-beb1-91393bed56b4", "parentControlId": 31986, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589792" }, { "id": 601975, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589792", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3e1eeaf-0c74-52a9-afed-b31869b7bda7", "parentControlId": 31986, "controlId": "SC-36", "title": "SC-36", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589792" }, { "id": 601977, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589792", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59afbd9f-8a70-5c38-a4d2-bfaf60a5a481", "parentControlId": 31986, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589792" }, { "id": 601978, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589792", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06c44195-023c-5bbf-9f67-e7ad4191d5d8", "parentControlId": 31986, "controlId": "SC-36", "title": "SC-36", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589792" }, { "id": 601980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589792", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c819dd16-6167-5b64-985e-350d2aa4c44b", "parentControlId": 31986, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589792" }, { "id": 601981, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589793", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e7a65cd-7e8f-57e1-979f-188236d938c6", "parentControlId": 31986, "controlId": "SC-36", "title": "SC-36", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589793" }, { "id": 601982, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589793", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc4cd2d7-22a0-5fcc-8d03-4c59a265218e", "parentControlId": 31986, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589793" }, { "id": 601983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589793", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f0f5a80-4d0c-5b4d-b67e-86941cbcdfb1", "parentControlId": 31986, "controlId": "SC-36", "title": "SC-36", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589793" }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "9d0d96e3-72c6-538e-9f79-1ce19da09a91", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "b4c057da-7961-5da0-8486-968990d58bce", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "0e74ec43-6493-53cd-a43b-7272c41d50fa", "isPublic": true } ], "id": 31986, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731315", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731315", "catalogueId": 1062, "uuid": "1d058b10-92c3-5268-bfeb-8c28050cbd96", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization distribute processing and storage across multiple physical locations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Distributed Processing & Storage", "description": "

Control Description

Mechanisms exist to distribute processing and storage across multiple physical locations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to distribute processing and storage across multiple physical locations.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-15", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-15", "references": "

Medium Business (50-249 staff)

∙ Software composition analysis (SCA) for open source components

Large Business (250-999 staff)

∙ Enterprise SCA program (e.g., Snyk, Black Duck)\n∙ Open source license and vulnerability tracking

Enterprise (>1,000 staff)

∙ Enterprise SCA platform (e.g., Snyk, Mend, Black Duck)\n∙ Automated open source vulnerability detection\n∙ License compliance management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 73998, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591188", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591188", "securityControlId": 31987, "ccis": [], "uuid": "2e1c2708-69eb-5eac-9d6e-a4b0c3b547e3", "testId": "SEA-16_A01", "test": "system components for which the operating environment and applications are to be loaded and executed from hardware-enforced, read-only media are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-34_ODP[01]", "defaultText": null }, { "id": 73999, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591189", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591189", "securityControlId": 31987, "ccis": [], "uuid": "52f2282d-a20c-5c3d-b918-768329d0bc19", "testId": "SEA-16_A02", "test": "applications to be loaded and executed from hardware-enforced, read-only media are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-34_ODP[02]", "defaultText": null }, { "id": 74000, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591189", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591189", "securityControlId": 31987, "ccis": [], "uuid": "e4597182-a748-5564-8d66-0d5707b44028", "testId": "SEA-16_A03", "test": "the operating environment for system components is loaded and executed from hardware-enforced, read-only media.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-34a.", "defaultText": null }, { "id": 74001, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591189", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591189", "securityControlId": 31987, "ccis": [], "uuid": "9dcc17a1-b18b-5f97-b26d-a56a63a273ed", "testId": "SEA-16_A04", "test": "applications for system components are loaded and executed from hardware-enforced, read-only media.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SC-34b.", "defaultText": null } ], "externalMappings": [ { "id": 602019, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f35a7b20-deb2-5d8d-a22a-38fc142d6814", "parentControlId": 31987, "controlId": "T1195.003", "title": "T1195.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5898" }, { "id": 602020, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03096f52-44fb-5f08-a8aa-1de27f1539a3", "parentControlId": 31987, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5898" }, { "id": 602021, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79ea680d-1614-570e-8bc9-c14ed46e18ba", "parentControlId": 31987, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5898" }, { "id": 602022, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af03cdd0-be4a-5147-adce-5e76c905ddd8", "parentControlId": 31987, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5898" }, { "id": 602023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13fa9ebe-2960-52c6-9054-7f30f7fc88fe", "parentControlId": 31987, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5898" }, { "id": 602024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a40d91e5-f135-5b71-905f-5337abc13d59", "parentControlId": 31987, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5898" }, { "id": 602025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5898", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bfd61e2-e594-538b-9012-e0c260f53912", "parentControlId": 31987, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5898" }, { "id": 602026, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cfd48fd7-231a-5e52-b145-0a0a6da2d213", "parentControlId": 31987, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589801" }, { "id": 602027, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30f49a65-7189-5a12-bc75-e59c69fbad5b", "parentControlId": 31987, "controlId": "T1548.004", "title": "T1548.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589801" }, { "id": 602028, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e7ef48a-3754-5f9c-82d1-d416be26649e", "parentControlId": 31987, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589801" }, { "id": 602029, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f9706f1-4966-585c-9373-1e9e352212ec", "parentControlId": 31987, "controlId": "T1553.006", "title": "T1553.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589801" }, { "id": 602030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75f54739-72a0-514a-9e0c-ecdc3d2fbd4f", "parentControlId": 31987, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589801" }, { "id": 602031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa45f8fa-ed34-5c6b-8821-6a70ec6b62a7", "parentControlId": 31987, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589801" }, { "id": 602032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42604626-49b9-584f-826f-122b0ade1ddc", "parentControlId": 31987, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589801" }, { "id": 602033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9680e96-4dcc-5fae-8c6b-c22301155eee", "parentControlId": 31987, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589801" }, { "id": 602034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63ec8379-7599-5393-8392-29d0044d0eb0", "parentControlId": 31987, "controlId": "SC-34", "title": "SC-34", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589801" }, { "id": 602035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6941c62e-93a8-55d1-925b-808accfbd1e0", "parentControlId": 31987, "controlId": "SC-34", "title": "SC-34", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589801" }, { "id": 602036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45b026fc-ddfd-522e-8b2b-f7c1d37df38d", "parentControlId": 31987, "controlId": "SC-34", "title": "SC-34", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589802" }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "74055701-4ded-5cc1-a045-c7ab7a587151", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "5c76cc7e-c2b1-525a-afdd-dd5ef41150a6", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "3e56f072-7c3f-5665-ba11-9e0d371d259d", "isPublic": true } ], "id": 31987, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731315", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731315", "catalogueId": 1062, "uuid": "d69c6931-7afe-5b66-8b54-0b1ae890f426", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize non-modifiable executable programs that load and execute the operating environment and applications from hardware-enforced, read-only media?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Non-Modifiable Executable Programs", "description": "

Control Description

Mechanisms exist to utilize non-modifiable executable programs that load and execute the operating environment and applications from hardware-enforced, read-only media.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to utilize non-modifiable executable programs that load and execute the operating environment and applications from hardware-enforced, read-only media.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-16", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-16", "references": "

Medium Business (50-249 staff)

∙ Evaluate security controls for trusted systems interconnections

Large Business (250-999 staff)

∙ Enterprise trusted system interconnection security program

Enterprise (>1,000 staff)

∙ Enterprise trusted systems integration security framework\n∙ Formal interconnection security agreements (ISA)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74002, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591189", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591189", "securityControlId": 31988, "ccis": [], "uuid": "79882021-a472-5efa-839b-f06a57b23041", "testId": "SEA-17_A01", "test": "a trusted communications path is used between the user and the security functions of the system (e.g., Ctrl+Alt+Del).
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 602039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e669ab46-a622-5ec9-ae6c-aaee43865c62", "parentControlId": 31988, "controlId": "8.5", "title": "8.5", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589802" }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "05d7273a-d8f9-5d74-b502-43f483cab886", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "c5f5feaf-4250-52ad-aed1-af396158f440", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "7c9ba429-90bd-5d35-b14a-f0281e5ae639", "isPublic": true } ], "id": 31988, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731315", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731315", "catalogueId": 1062, "uuid": "b39b4f3e-499f-5a13-b318-b8434083e9ed", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize a trusted communications path between the user and the security functions of the system?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Secure Log-On Procedures", "description": "

Control Description

Mechanisms exist to utilize a trusted communications path between the user and the security functions of the system.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to utilize a trusted communications path between the user and the security functions of the system.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-17", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-17", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74003, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59119", "securityControlId": 31989, "ccis": [], "uuid": "20c6c4cd-c02f-5484-8fb7-8fe808fed37c", "testId": "SEA-18_A01", "test": "system use notification message or banner to be displayed by the system to users before granting access to the system is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-08_ODP[01]", "defaultText": null }, { "id": 74004, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59119", "securityControlId": 31989, "ccis": [], "uuid": "9e178f1c-3f1c-5fe6-b5d9-a87bdbe7a01b", "testId": "SEA-18_A02", "test": "conditions for system use to be displayed by the system before granting further access are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-08_ODP[02]", "defaultText": null }, { "id": 74005, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59119", "securityControlId": 31989, "ccis": [], "uuid": "563ed221-a5cd-5a5a-be2b-e13bb3608ccd", "testId": "SEA-18_A03", "test": "organization-defined system use notification is displayed to users before granting access to the system that provides privacy and security notices consistent with applicable laws, Executive Orders, directives, regulations, policies, standards and guidelines.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-08a.", "defaultText": null }, { "id": 74006, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59119", "securityControlId": 31989, "ccis": [], "uuid": "5fc24e39-0c7c-5b19-a5a9-b67216991481", "testId": "SEA-18_A04", "test": "the system use notification states that users are accessing a protected system.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-08a.01", "defaultText": null }, { "id": 74007, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59119", "securityControlId": 31989, "ccis": [], "uuid": "284cc671-32bb-588f-9c2a-ea76aaf0cdb5", "testId": "SEA-18_A05", "test": "the system use notification states that system usage may be monitored, recorded and subject to audit.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-08a.02", "defaultText": null }, { "id": 74008, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59119", "securityControlId": 31989, "ccis": [], "uuid": "0ae233e8-cd26-50c9-8e0b-0174cc73b814", "testId": "SEA-18_A06", "test": "the system use notification states that unauthorized use of the system is prohibited and subject to criminal and civil penalties.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-08a.03", "defaultText": null }, { "id": 74009, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59119", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59119", "securityControlId": 31989, "ccis": [], "uuid": "443d6060-d211-5e6d-b03d-bfe026ff715f", "testId": "SEA-18_A07", "test": "the system use notification states that use of the system indicates consent to monitoring and recording.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-08a.04", "defaultText": null }, { "id": 74010, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591191", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591191", "securityControlId": 31989, "ccis": [], "uuid": "c2a507d0-3ef7-5ab5-9773-c133b7954fd3", "testId": "SEA-18_A08", "test": "the notification message or banner is retained on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system.
PPTDF Applicability: Data
Assessment Rigor: 3", "otherId": "53A_R5_AC-08b.", "defaultText": null }, { "id": 74011, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591191", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591191", "securityControlId": 31989, "ccis": [], "uuid": "ce48dc21-7cc4-56e4-94af-51a508d05c05", "testId": "SEA-18_A09", "test": "for publicly accessible systems, system use information organization-defined conditions is displayed before granting further access to the publicly accessible system.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-08c.01", "defaultText": null }, { "id": 74012, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591191", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591191", "securityControlId": 31989, "ccis": [], "uuid": "bd50ffcb-5cb6-57d5-bb09-103e22b46a27", "testId": "SEA-18_A10", "test": "for publicly accessible systems, any references to monitoring, recording or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities are displayed.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-08c.02", "defaultText": null }, { "id": 74013, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591191", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591191", "securityControlId": 31989, "ccis": [], "uuid": "bfad5ea5-36dd-57a1-8f21-6991fe083168", "testId": "SEA-18_A11", "test": "for publicly accessible systems, a description of the authorized uses of the system is included.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-08c.03", "defaultText": null }, { "id": 74014, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591191", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591191", "securityControlId": 31989, "ccis": [], "uuid": "62a47930-7404-5900-a188-0542e03fbfe9", "testId": "SEA-18_A12", "test": "a system use notification message with privacy and security notices consistent with applicable CUI rules is displayed before granting access to the system.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.01.09", "defaultText": null }, { "id": 74015, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591192", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591192", "securityControlId": 31989, "ccis": [], "uuid": "b8330445-0683-5aa8-9632-89c7d6df08b3", "testId": "SEA-18_A13", "test": "privacy and security notices required by statutory/regulatory-specified rules are identified, consistent, and associated with the specific sensitive/regulated data category.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.1.9[a]", "defaultText": null }, { "id": 74016, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591192", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591192", "securityControlId": 31989, "ccis": [], "uuid": "6a7c5d66-166f-565d-9b91-337dada61a21", "testId": "SEA-18_A14", "test": "privacy and security notices are displayed.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "171A_3.1.9[b]", "defaultText": null } ], "externalMappings": [ { "id": 602048, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3284e9fa-0f50-59f0-a2eb-f75899e95ec4", "parentControlId": 31989, "controlId": "SR 1.12", "title": "SR 1.12", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589803" }, { "id": 602049, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b93e934-695c-5cc4-8e04-72fe097c4c76", "parentControlId": 31989, "controlId": "CR 1.12", "title": "CR 1.12", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589803" }, { "id": 602050, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f6bb1c7-0252-511d-8bdf-774d525ffc16", "parentControlId": 31989, "controlId": "T1199", "title": "T1199", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589803" }, { "id": 602051, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "521a6ae3-8bba-50fd-8923-2d96221c94a9", "parentControlId": 31989, "controlId": "AC-8", "title": "AC-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589803" }, { "id": 602052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a932655-7bcb-51e8-84f7-65d4df7da6a4", "parentControlId": 31989, "controlId": "AC-08", "title": "AC-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589803" }, { "id": 602053, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1382b77a-2d67-547f-a7c7-b2d18218a2ce", "parentControlId": 31989, "controlId": "AC-08", "title": "AC-08", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589804" }, { "id": 602054, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23bed48f-1754-58b4-b80b-cbe2620fc2ed", "parentControlId": 31989, "controlId": "AC-08", "title": "AC-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589804" }, { "id": 602055, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80b1ca04-4e2b-5e0e-9ceb-a5fe1c47e863", "parentControlId": 31989, "controlId": "AC-08", "title": "AC-08", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589804" }, { "id": 602056, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "279b247d-629e-5e1b-8291-60c6d48dd340", "parentControlId": 31989, "controlId": "AC-08", "title": "AC-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589804" }, { "id": 602057, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a31a26ce-6f01-5b59-9ca3-0baa8b264915", "parentControlId": 31989, "controlId": "AC-08", "title": "AC-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589804" }, { "id": 602058, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1eec106f-85f7-50e3-b718-697cf0727d21", "parentControlId": 31989, "controlId": "3.1.9", "title": "3.1.9", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589804" }, { "id": 602059, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589804", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a5cd0c9-8997-53ba-a01d-7b7e8b38a1ef", "parentControlId": 31989, "controlId": "03.01.09", "title": "03.01.09", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589804" }, { "id": 602077, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589809", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc114812-53a1-59c8-a111-ccb5f83735d6", "parentControlId": 31989, "controlId": "§117.18(b)(7)", "title": "§117.18(b)(7)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589809" }, { "controlId": "B.1.8", "title": "B.1.8 — System Use Notification", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ddcc2d41-9bb4-5f88-a173-4b7239f25d07", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.8", "title": "NEI 08-09 App D.1.8 — System Use Notification", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "07c639ff-5bc6-5916-ba2b-f3f776ada666", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "b1268492-c804-5151-87ff-119867dde3f3", "isPublic": true }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "f6acf0c4-6fb1-5d8b-a404-c6bfe510c43e", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "2f6ab89f-d373-5f55-82bb-8b41480793a6", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "18fd8b5f-5578-50d8-ac38-8b2a2ff9cc8e", "isPublic": true } ], "id": 31989, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731316", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731316", "catalogueId": 1062, "uuid": "96384f06-2d9d-5f89-9803-d488eb5f63bd", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize system use notification / logon banners that display an approved system use notification message or banner before granting access to Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "System Use Notification (Logon Banner)", "description": "

Control Description

Mechanisms exist to utilize system use notification / logon banners that display an approved system use notification message or banner before granting access to Technology Assets, Applications and/or Services (TAAS).

Evidence Request List (ERL)

E-SEA-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to utilize system use notification / logon banners that display an approved system use notification message or banner before granting access to Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.8", "controlId": "SEA-18", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-18", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74017, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591192", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591192", "securityControlId": 31990, "ccis": [], "uuid": "1b4f4b17-f9f6-572b-a841-a3537ff25595", "testId": "SEA-18.1_A01", "test": "Microsoft Windows-based systems are configured to display an approved logon banner before granting access to the system that provides privacy and security notices.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74018, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591192", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591192", "securityControlId": 31990, "ccis": [], "uuid": "138fa690-5335-54b3-8dec-3459a6a4d334", "testId": "SEA-18.1_A02", "test": "a system use notification message with privacy and security notices consistent with applicable CUI rules is displayed before granting access to the system.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.01.09", "defaultText": null } ], "externalMappings": [ { "id": 602091, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58981", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40656841-6068-5416-b6af-ed4fb0ca835a", "parentControlId": 31990, "controlId": "SR 1.12", "title": "SR 1.12", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58981" }, { "id": 602092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58981", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "161fab95-589c-56da-b9b2-58b56dbc7b3d", "parentControlId": 31990, "controlId": "CR 1.12", "title": "CR 1.12", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58981" }, { "id": 602093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589811", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7bc23d07-3bff-5a45-866e-030e6addcbdb", "parentControlId": 31990, "controlId": "3.1.9", "title": "3.1.9", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589811" }, { "id": 602094, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589811", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28e9645f-39f1-5601-b8bf-c46806a5bde1", "parentControlId": 31990, "controlId": "03.01.09", "title": "03.01.09", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589811" } ], "id": 31990, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731322", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731322", "catalogueId": 1062, "uuid": "2f4e6b05-f631-5bdc-bbc1-f6587ba63d03", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization configure Microsoft Windows-based systems to display an approved logon banner before granting access to the system?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Standardized Microsoft Windows Banner", "description": "

Control Description

Mechanisms exist to configure Microsoft Windows-based systems to display an approved logon banner before granting access to the system.

Evidence Request List (ERL)

E-SEA-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to configure Microsoft Windows-based systems to display an approved logon banner before granting access to the system.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-18.1", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-18.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74019, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591192", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591192", "securityControlId": 31991, "ccis": [], "uuid": "b5ce0ded-5edf-54f4-8656-32644b70dbdc", "testId": "SEA-18.2_A01", "test": "where technically feasible, systems utilize a truncated system use notification / logon banner on systems not capable of displaying a logon banner from a centralized source (e.g., Active Directory).
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74020, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591192", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591192", "securityControlId": 31991, "ccis": [], "uuid": "7a935554-e324-5881-ba79-4ed1da6d6f36", "testId": "SEA-18.2_A02", "test": "a system use notification message with privacy and security notices consistent with applicable CUI rules is displayed before granting access to the system.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.01.09", "defaultText": null } ], "externalMappings": [ { "id": 602104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33e0c9cf-641b-581a-985a-de5825fba228", "parentControlId": 31991, "controlId": "SR 1.12", "title": "SR 1.12", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589812" }, { "id": 602105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6384bc29-2270-5007-815f-6107ccc62ba0", "parentControlId": 31991, "controlId": "CR 1.12", "title": "CR 1.12", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589812" }, { "id": 602106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe097cf8-6dd5-5a81-8c2b-a40dd383615c", "parentControlId": 31991, "controlId": "3.1.9", "title": "3.1.9", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589812" }, { "id": 602107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589812", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aed318b8-0bb1-5a8d-ad26-a7466e2d13f9", "parentControlId": 31991, "controlId": "03.01.09", "title": "03.01.09", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589812" } ], "id": 31991, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731322", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731322", "catalogueId": 1062, "uuid": "e6e598da-b1cb-5421-87ac-e58ac8a84e70", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize a truncated system use notification / logon banner on systems not capable of displaying a logon banner from a centralized directory services technology (e.g., Active Directory, Entra ID, etc.)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Truncated Banner", "description": "

Control Description

Mechanisms exist to utilize a truncated system use notification / logon banner on systems not capable of displaying a logon banner from a centralized directory services technology (e.g., Active Directory, Entra ID, etc.).

Evidence Request List (ERL)

E-SEA-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to utilize a truncated system use notification / logon banner on systems not capable of displaying a logon banner from a centralized directory services technology (e.g., Active Directory, Entra ID, etc.).

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-18.2", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-18.2", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74021, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591193", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591193", "securityControlId": 31992, "ccis": [], "uuid": "944a7474-7cf1-52de-ae13-e43735b1d6a0", "testId": "SEA-19_A01", "test": "the user is notified, upon successful logon to the system, of the date and time of the last logon.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AC-09", "defaultText": null } ], "externalMappings": [ { "id": 602117, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4156ad45-3109-5f13-965a-d5d5db77201a", "parentControlId": 31992, "controlId": "USER 1.13", "title": "USER 1.13", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589815" }, { "id": 602118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2504191-c24c-5879-b80b-1bacc1a43bf5", "parentControlId": 31992, "controlId": "AC-9", "title": "AC-9", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589815" }, { "id": 602119, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "992d3283-1e38-5c85-909e-f2350a6d0f21", "parentControlId": 31992, "controlId": "AC-09", "title": "AC-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589815" }, { "id": 602120, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589816", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6bf06bf-8a8b-55eb-810d-1ebd5daf8aa6", "parentControlId": 31992, "controlId": "AC-09", "title": "AC-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589816" }, { "controlId": "B.1.9", "title": "B.1.9 — Previous Logon Notification", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-9", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "081050be-34c7-5a91-8861-db2b244593fc", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.9", "title": "NEI 08-09 App D.1.9 — Previous Logon Notification", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.9", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "22830987-d3dc-5495-9af4-4b673419f39b", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.9", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "d9b088e3-b949-5455-b6da-89b796d4b628", "isPublic": true }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "8ed6ae1e-6f41-5f67-ab9d-81c460257cca", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "af1d496d-386c-556f-8b43-81358e49812a", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "a7e8bee2-e1bc-5923-9118-d601034681b3", "isPublic": true } ], "id": 31992, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731322", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731322", "catalogueId": 1062, "uuid": "63b4327d-f503-5f1e-a334-2035da4d591c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization configure systems that process, store or transmit sensitive/regulated data to notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Previous Logon Notification", "description": "

Control Description

Mechanisms exist to configure systems that process, store or transmit sensitive/regulated data to notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to configure systems that process, store or transmit sensitive/regulated data to notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.9", "controlId": "SEA-19", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-19", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74022, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591193", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591193", "securityControlId": 31993, "ccis": [], "uuid": "bd84f0e4-a30e-5329-9221-e2a6a6fc046b", "testId": "SEA-20_A01", "test": "granularity of time measurement for audit record timestamps is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: one second granularity of time measurement", "otherId": "53A_R5_AU-08_ODP", "defaultText": null }, { "id": 74023, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591193", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591193", "securityControlId": 31993, "ccis": [], "uuid": "1f2ed63e-6e8b-531e-a7fe-97258f7c9255", "testId": "SEA-20_A02", "test": "internal system clocks are used to generate timestamps for audit records.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_AU-08a.", "defaultText": null } ], "externalMappings": [ { "id": 602130, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589817", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31596a02-34bb-5285-a507-c7a174bbad5f", "parentControlId": 31993, "controlId": "NET 1.9", "title": "NET 1.9", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589817" }, { "id": 602131, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589817", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd5cfe2c-a6af-58a1-a6d9-1351a0d9d904", "parentControlId": 31993, "controlId": "SR 2.11 RE 1", "title": "SR 2.11 RE 1", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589817" }, { "id": 602132, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589817", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2abecf6b-63d3-561c-9cee-42a472c744b6", "parentControlId": 31993, "controlId": "CR 2.11(2)", "title": "CR 2.11(2)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589817" }, { "id": 602133, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589817", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e33e491-90d5-520e-95c0-79f7cd2b4cfc", "parentControlId": 31993, "controlId": "8.17", "title": "8.17", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589817" }, { "id": 602137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589818", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d266c57-0612-5b45-82fe-4e15859cd203", "parentControlId": 31993, "controlId": "AU-8", "title": "AU-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589818" }, { "id": 602138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589818", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "933c0e6f-cb54-597b-8125-d5c7cfa18d4c", "parentControlId": 31993, "controlId": "AU-08", "title": "AU-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589818" }, { "id": 602140, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589818", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f67e7fe-cfa9-5376-943d-ead86e9c49c6", "parentControlId": 31993, "controlId": "AU-08", "title": "AU-08", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589818" }, { "id": 602141, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589826", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65b2f9cb-adf2-585e-a102-73009bb5151c", "parentControlId": 31993, "controlId": "AU-08", "title": "AU-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589826" }, { "id": 602142, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ce762ce-2b94-54bd-950b-19b82a925112", "parentControlId": 31993, "controlId": "AU-08", "title": "AU-08", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589827" }, { "id": 602143, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce7f8c13-a8cf-5260-afca-1919d8ee7cf8", "parentControlId": 31993, "controlId": "AU-08", "title": "AU-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589827" }, { "id": 602144, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "744946bf-554f-5118-bcd4-e6c9f554c074", "parentControlId": 31993, "controlId": "AU-08", "title": "AU-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589827" }, { "id": 602145, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "336f8b97-8ac2-54da-9f36-d08ab1c225c7", "parentControlId": 31993, "controlId": "3.3.7", "title": "3.3.7", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589827" }, { "controlId": "NSS-17T-Sec5.2", "title": "NSS-17T-Sec5.2 — Defense-in-Depth & Functional Isolation Architecture", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "4927452b-b025-5113-bfb0-60035daafc6d", "isPublic": true }, { "controlId": "IEC-62645-6.2.1", "title": "IEC-62645-6.2.1 — Security-by-Design Architecture & Redundancy/Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "4a476fc4-34e0-5a70-965b-a0a273611651", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.15", "title": "IEEE-7-4.3.2-5.15 — Defense Against Common-Cause Failure (CCF) & Diversity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SEA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "f65cf938-3a40-580e-9c8a-a4e2d8c6b4cd", "isPublic": true } ], "id": 31993, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731323", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731323", "catalogueId": 1062, "uuid": "4b25f146-3889-51e2-8362-ce732cdcba5e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize time-synchronization technology to synchronize all critical system clocks?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Clock Synchronization", "description": "

Control Description

Mechanisms exist to utilize time-synchronization technology to synchronize all critical system clocks.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 - Planned & Tracked: Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.\n▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.\n▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 - Well Defined: Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.\n▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).\n▪ An implemented and operational capability exists to utilize time-synchronization technology to synchronize all critical system clocks.

Level 4 - Quantitatively Controlled: Secure Engineering & Architecture (SEA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SEA-20", "family": "Secure Engineering & Architecture", "enhancements": "", "sortId": "SEA-20", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74028, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591195", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591195", "securityControlId": 31996, "ccis": [], "uuid": "0c618ade-3ab5-579f-8c6a-4778720779e3", "testId": "OPS-01_A01", "test": "operations security controls to be employed to protect key organizational information throughout the system development life cycle are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-38_ODP", "defaultText": null }, { "id": 74029, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591195", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591195", "securityControlId": 31996, "ccis": [], "uuid": "2b030dc4-319c-52d9-9f91-802be0a6fa4f", "testId": "OPS-01_A02", "test": "operations security controls are employed to protect key organizational information throughout the system development life cycle.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SC-38", "defaultText": null }, { "id": 74030, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591195", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591195", "securityControlId": 31996, "ccis": [], "uuid": "11a170c6-e9b4-5b91-a0e5-f53b322b634f", "testId": "OPS-01_A03", "test": "security operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74031, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591195", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591195", "securityControlId": 31996, "ccis": [], "uuid": "1b35142a-04a9-55e8-a485-d8b50df2d637", "testId": "OPS-01_A04", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support security operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74032, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591195", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591195", "securityControlId": 31996, "ccis": [], "uuid": "ae3bf7ea-5779-5170-a354-55bc9321584d", "testId": "OPS-01_A05", "test": "responsibility and authority for the performance of security operations-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74033, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591195", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591195", "securityControlId": 31996, "ccis": [], "uuid": "f49ec353-2a81-571f-a559-c8308549a822", "testId": "OPS-01_A06", "test": "personnel performing security operations-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 602193, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16145ac8-0856-5741-b12f-d1da288c735a", "parentControlId": 31996, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589837" }, { "id": 602194, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589837", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a010ce3e-fa0f-5532-ac00-3df25be8fc68", "parentControlId": 31996, "controlId": "5.37", "title": "5.37", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589837" }, { "id": 602200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97084e2f-2bb3-5762-83d4-9ac6527c4b16", "parentControlId": 31996, "controlId": "T1005", "title": "T1005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589838" }, { "id": 602201, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35d16584-c5d8-51f4-b724-7dda007f25a2", "parentControlId": 31996, "controlId": "T1025", "title": "T1025", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589838" }, { "id": 602211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4897a1ba-e700-5001-8abb-2d1a54177f0f", "parentControlId": 31996, "controlId": "SC-38", "title": "SC-38", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589839" }, { "id": 602212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13408692-1fea-55c1-9bc3-02f4f9b6b1a8", "parentControlId": 31996, "controlId": "SC-38", "title": "SC-38", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589839" }, { "id": 602213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589839", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f54ed65-fa8b-5c9d-9293-6ba5cc370282", "parentControlId": 31996, "controlId": "SR-07", "title": "SR-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589839" }, { "id": 602216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5620dd06-1a18-5aa7-9275-7bff32e8f182", "parentControlId": 31996, "controlId": "SC-38", "title": "SC-38", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589842" }, { "id": 602217, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589842", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0def10e6-9ffc-5bd5-91cd-bea02647233a", "parentControlId": 31996, "controlId": "SR-07", "title": "SR-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589842" }, { "id": 602219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "776ee804-6dc2-5359-9571-616db1348c1c", "parentControlId": 31996, "controlId": "SC-38", "title": "SC-38", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589843" }, { "id": 602220, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1cb67c5a-ef0e-5a36-8b9a-bfd63b1b2a9f", "parentControlId": 31996, "controlId": "SR-7", "title": "SR-7", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589843" }, { "id": 602225, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f75d75b5-62e3-58cb-9134-1ec624abffba", "parentControlId": 31996, "controlId": "03.15.01.a", "title": "03.15.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589843" }, { "id": 602226, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589843", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c4ce0f3-665f-515b-9da4-d068996df8ba", "parentControlId": 31996, "controlId": "03.15.01.b", "title": "03.15.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589843" }, { "id": 602227, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589844", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f162cd09-daaa-5b2e-938a-375626b5b3df", "parentControlId": 31996, "controlId": "ID.IM", "title": "ID.IM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589844" }, { "controlId": "C.3.1", "title": "C.3.1 — System and Information Integrity Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "555345c0-4f2c-55d0-a827-ca1d89d18419", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.1", "title": "NEI 08-09 App E.3.1 — System and Information Integrity Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "a1de9f78-10c0-5c16-851c-92b31ae7ce83", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.3.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "fe86e991-c339-5bbe-bb50-6a28891d36dd", "isPublic": true } ], "id": 31996, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731324", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731324", "catalogueId": 1062, "uuid": "8c93e923-d7ce-5251-bdbb-35057ef65582", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of operational security controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Operations Security", "description": "

Control Description

Mechanisms exist to facilitate the implementation of operational security controls.

Evidence Request List (ERL)

E-HRS-01\nE-HRS-03\nE-HRS-04\nE-HRS-13\nE-HRS-15\nE-HRS-27

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Security Operations (OPS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with OPS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Cybersecurity operations-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Cybersecurity operations are primarily viewed as additional duties for IT staff.\n▪ There is no Security Operations Center (SOC) with 24x7x365 operations coverage.

Level 2 - Planned & Tracked: Security Operations (OPS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with OPS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with OPS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with OPS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security operations management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security operations management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Security Operations (OPS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with OPS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with OPS domain capabilities are well-documented and kept current by process owners.\n▪ A Security Operations Center (SOC), or similar function, is appropriately staffed and supported to implement and maintain OPS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security operations management (e.g., SIEM solution, EDR/XDR tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with OPS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Cybersecurity personnel create “run books,” or SOPs, to capture operational knowledge in documentation form for critical business functions and/or for sensitive/regulated obligations.\n▪ An implemented and operational capability exists to facilitate the implementation of operational security controls.

Level 4 - Quantitatively Controlled: Security Operations (OPS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.3.1", "controlId": "OPS-01", "family": "Security Operations", "enhancements": "", "sortId": "OPS-01", "references": "

Micro-Small Business (<10 staff)

∙ Documented Standardized Operating Procedures (SOP)

Small Business (10-49 staff)

∙ Documented Standardized Operating Procedures (SOP)

Medium Business (50-249 staff)

∙ Documented Standardized Operating Procedures (SOP)\n∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)

Large Business (250-999 staff)

∙ Documented Standardized Operating Procedures (SOP)\n∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)\n∙ COBIT 2019 Framework (https://isaca.org)

Enterprise (>1,000 staff)

∙ Documented Standardized Operating Procedures (SOP)\n∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)\n∙ COBIT 2019 Framework (https://isaca.org)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74034, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591196", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591196", "securityControlId": 31997, "ccis": [], "uuid": "20a77b59-6e56-5b3a-8716-9cedcd6a69ff", "testId": "OPS-01.1_A01", "test": "procedures needed to satisfy the security requirements for the protection of sensitive / regulated data are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-01a.[03]\n53A_R5_AT-01a.[03]\n53A_R5_AU-01a.[03]\n53A_R5_CA-01a.[03]\n53A_R5_CM-01a.[03]\n53A_R5_CP-01a.[03]\n53A_R5_IA-01a.[03]\n53A_R5_IR-01a.[03]\n53A_R5_MA-01a.[03]\n53A_R5_MP-01a.[03]\n53A_R5_PE-01a.[03]\n53A_R5_PL-01a.[03]\n53A_R5_PS-01a.[03]\n53A_R5_PT-01a.[03]\n53A_R5_RA-01a.[03]\n53A_R5_SA-01a.[03]\n53A_R5_SC-01a.[03]\n53A_R5_SI-01a.[03]\n53A_R5_SR-01a.[03]", "defaultText": null }, { "id": 74035, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591196", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591196", "securityControlId": 31997, "ccis": [], "uuid": "a6052667-3851-552f-9e99-18b9c641bfa5", "testId": "OPS-01.1_A02", "test": "procedures needed to satisfy the security requirements for the protection of sensitive / regulated data are disseminated to organizational personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AC-01a.[04]\n53A_R5_AT-01a.[04]\n53A_R5_AU-01a.[04]\n53A_R5_CA-01a.[04]\n53A_R5_CM-01a.[04]\n53A_R5_CP-01a.[04]\n53A_R5_IA-01a.[04]\n53A_R5_IR-01a.[04]\n53A_R5_MA-01a.[04]\n53A_R5_MP-01a.[04]\n53A_R5_PE-01a.[04]\n53A_R5_PL-01a.[04]\n53A_R5_PS-01a.[04]\n53A_R5_PT-01a.[04]\n53A_R5_RA-01a.[04]\n53A_R5_SA-01a.[04]\n53A_R5_SC-01a.[04]\n53A_R5_SI-01a.[04]\n53A_R5_SR-01a.[04]", "defaultText": null }, { "id": 74036, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591196", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591196", "securityControlId": 31997, "ccis": [], "uuid": "65dbabce-bf25-54bc-810d-19a5047bb547", "testId": "OPS-01.1_A03", "test": "the current cybersecurity / data privacy procedures are reviewed / updated frequently.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: Review policies, standards and procedures at least annual and following significant changes", "otherId": "53A_R5_AC-01c.02[01]\n53A_R5_AT-01c.02[01]\n53A_R5_AU-01c.02[01]\n53A_R5_CA-01c.02[01]\n53A_R5_CM-01c.02[01]\n53A_R5_CP-01c.02[01]\n53A_R5_IA-01c.02[01]\n53A_R5_IR-01c.02[01]\n53A_R5_MA-01c.02[01]\n53A_R5_MP-01c.02[01]\n53A_R5_PE-01c.02[01]\n53A_R5_PL-01c.02[01]\n53A_R5_PS-01c.02[01]\n53A_R5_PT-01c.02[01]\n53A_R5_RA-01c.02[01]\n53A_R5_SA-01c.02[01]\n53A_R5_SC-01c.02[01]\n53A_R5_SI-01c.02[01]\n53A_R5_SR-01c.02[01]", "defaultText": null }, { "id": 74037, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591198", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591198", "securityControlId": 31997, "ccis": [], "uuid": "e424fb7f-9633-5ecf-929b-3053e8d3b918", "testId": "OPS-01.1_A04", "test": "the current cybersecurity / data privacy procedures are reviewed / updated following events.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: Review policies, standards and procedures at least annual and following significant changes", "otherId": "53A_R5_AC-01c.02[02]\n53A_R5_AT-01c.02[02]\n53A_R5_AU-01c.02[02]\n53A_R5_CA-01c.02[02]\n53A_R5_CM-01c.02[02]\n53A_R5_CP-01c.02[02]\n53A_R5_IA-01c.02[02]\n53A_R5_IR-01c.02[02]\n53A_R5_MA-01c.02[02]\n53A_R5_MP-01c.02[02]\n53A_R5_PE-01c.02[02]\n53A_R5_PL-01c.02[02]\n53A_R5_PS-01c.02[02]\n53A_R5_PT-01c.02[02]\n53A_R5_RA-01c.02[02]\n53A_R5_SA-01c.02[02]\n53A_R5_SC-01c.02[02]\n53A_R5_SI-01c.02[02]\n53A_R5_SR-01c.02[02]", "defaultText": null }, { "id": 74038, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591198", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591198", "securityControlId": 31997, "ccis": [], "uuid": "8e75e0fd-414c-53ec-87ca-3e9b84562fc8", "testId": "OPS-01.1_A05", "test": "personnel or roles to whom cybersecurity / data privacy procedures are to be disseminated is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-01_ODP[02]\n53A_R5_AT-01_ODP[02]\n53A_R5_AU-01_ODP[02]\n53A_R5_CA-01_ODP[02]\n53A_R5_CM-01_ODP[02]\n53A_R5_CP-01_ODP[02]\n53A_R5_IA-01_ODP[02]\n53A_R5_IR-01_ODP[02]\n53A_R5_MA-01_ODP[02]\n53A_R5_MP-01_ODP[02]\n53A_R5_PE-01_ODP[02]\n53A_R5_PL-01_ODP[02]\n53A_R5_PS-01_ODP[02]\n53A_R5_PT-01_ODP[02]\n53A_R5_RA-01_ODP[02]\n53A_R5_SA-01_ODP[02]\n53A_R5_SC-01_ODP[02]\n53A_R5_SI-01_ODP[02]\n53A_R5_SR-01_ODP[02]", "defaultText": null }, { "id": 74039, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591198", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591198", "securityControlId": 31997, "ccis": [], "uuid": "cfa710f1-8a8a-55b8-8a41-13183a09d724", "testId": "OPS-01.1_A06", "test": "events that would require procedures to be reviewed / updated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AC-01_ODP[08]\n53A_R5_AT-01_ODP[08]\n53A_R5_AU-01_ODP[08]\n53A_R5_CA-01_ODP[08]\n53A_R5_CM-01_ODP[08]\n53A_R5_CP-01_ODP[08]\n53A_R5_IA-01_ODP[08]\n53A_R5_IR-01_ODP[08]\n53A_R5_MA-01_ODP[08]\n53A_R5_MP-01_ODP[08]\n53A_R5_PE-01_ODP[08]\n53A_R5_PL-01_ODP[08]\n53A_R5_PS-01_ODP[08]\n53A_R5_PT-01_ODP[08]\n53A_R5_RA-01_ODP[08]\n53A_R5_SA-01_ODP[08]\n53A_R5_SC-01_ODP[08]\n53A_R5_SI-01_ODP[08]\n53A_R5_SR-01_ODP[08]", "defaultText": null }, { "id": 74040, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591198", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591198", "securityControlId": 31997, "ccis": [], "uuid": "ebd124b3-3b7f-5f95-bcd3-ae26d42a81d7", "testId": "OPS-01.1_A07", "test": "systems or system components that implement the security design principle of sufficient documentation are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08(32)_ODP", "defaultText": null }, { "id": 74041, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591199", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591199", "securityControlId": 31997, "ccis": [], "uuid": "dfc3d4d3-0006-5f5e-bbee-5a7265bcf2aa", "testId": "OPS-01.1_A08", "test": "systems or system components implement the security design principle of sufficient documentation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-08(32)", "defaultText": null }, { "id": 74042, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591199", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591199", "securityControlId": 31997, "ccis": [], "uuid": "3ae6227a-e564-5cb2-a6a2-4f517feeac74", "testId": "OPS-01.1_A09", "test": "policies and procedures are reviewed per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_AC-01_ODP[07]\n53A_R5_AT-01_ODP[07]\n53A_R5_AU-01_ODP[07]\n53A_R5_CA-01_ODP[07]\n53A_R5_CM-01_ODP[07]\n53A_R5_CP-01_ODP[07]\n53A_R5_IA-01_ODP[07]\n53A_R5_IR-01_ODP[07]\n53A_R5_MA-01_ODP[07]\n53A_R5_MP-01_ODP[07]\n53A_R5_PE-01_ODP[07]\n53A_R5_PL-01_ODP[07]\n53A_R5_PS-01_ODP[07]\n53A_R5_PT-01_ODP[07]\n53A_R5_RA-01_ODP[07]\n53A_R5_SA-01_ODP[07]\n53A_R5_SC-01_ODP[07]\n53A_R5_SI-01_ODP[07]\n53A_R5_SR-01_ODP[07]", "defaultText": null }, { "id": 74043, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591199", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591199", "securityControlId": 31997, "ccis": [], "uuid": "857640b4-3ebd-55e5-85f9-52cc2065281a", "testId": "OPS-01.1_A10", "test": "policies and procedures are updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_AC-01_ODP[07]\n53A_R5_AT-01_ODP[07]\n53A_R5_AU-01_ODP[07]\n53A_R5_CA-01_ODP[07]\n53A_R5_CM-01_ODP[07]\n53A_R5_CP-01_ODP[07]\n53A_R5_IA-01_ODP[07]\n53A_R5_IR-01_ODP[07]\n53A_R5_MA-01_ODP[07]\n53A_R5_MP-01_ODP[07]\n53A_R5_PE-01_ODP[07]\n53A_R5_PL-01_ODP[07]\n53A_R5_PS-01_ODP[07]\n53A_R5_PT-01_ODP[07]\n53A_R5_RA-01_ODP[07]\n53A_R5_SA-01_ODP[07]\n53A_R5_SC-01_ODP[07]\n53A_R5_SI-01_ODP[07]\n53A_R5_SR-01_ODP[07]", "defaultText": null }, { "id": 74044, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591199", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591199", "securityControlId": 31997, "ccis": [], "uuid": "28400526-3a40-5dba-977d-43cedee461cf", "testId": "OPS-01.1_A11", "test": "procedures needed to satisfy the security requirements for the protection of CUI are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.15.01.a[03]", "defaultText": null }, { "id": 74045, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591199", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591199", "securityControlId": 31997, "ccis": [], "uuid": "bdd56b79-2cd7-562a-9e6b-fa5712cfd206", "testId": "OPS-01.1_A12", "test": "procedures needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.15.01.a[04]", "defaultText": null }, { "id": 74046, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5912", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5912", "securityControlId": 31997, "ccis": [], "uuid": "c7809b11-6116-5fbe-845c-dc866a596c14", "testId": "OPS-01.1_A13", "test": "policies and procedures are reviewed .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months, or when there are significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.15.01.b[01]", "defaultText": null }, { "id": 74047, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5912", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5912", "securityControlId": 31997, "ccis": [], "uuid": "47b17c95-c7df-57a2-b786-602bf6f08ad1", "testId": "OPS-01.1_A14", "test": "policies and procedures are updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months, or when there are significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.15.01.b[02]", "defaultText": null } ], "externalMappings": [ { "id": 602347, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589861", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f760f62a-fb08-545f-81da-468a0d436d46", "parentControlId": 31997, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589861" }, { "id": 602348, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589862", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "053ce1ca-b957-5f5f-99e8-7910a457317a", "parentControlId": 31997, "controlId": "5.37", "title": "5.37", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589862" }, { "id": 602375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589866", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f33abadf-a3fb-5852-91a1-6e165b361ebd", "parentControlId": 31997, "controlId": "SA-08(32)", "title": "SA-08(32)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589866" }, { "id": 602378, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589867", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9fd0337-d49a-5db1-814a-a3e11e480e29", "parentControlId": 31997, "controlId": "SA-08(32)", "title": "SA-08(32)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589867" }, { "id": 602379, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589867", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d9e4165-1824-5c81-9391-49c9f329829c", "parentControlId": 31997, "controlId": "03.15.01.a", "title": "03.15.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589867" }, { "id": 602386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589868", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3466d079-7829-5a37-8a39-fee6ac423395", "parentControlId": 31997, "controlId": "ID.IM", "title": "ID.IM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589868" }, { "id": 602535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c72e54e2-207a-53a1-8bc7-32738b396391", "parentControlId": 31997, "controlId": "ASSET-5a", "title": "ASSET-5a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589901" }, { "id": 602536, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c04b81d8-808d-507c-bddf-a50ece06f2ce", "parentControlId": 31997, "controlId": "THREAT-3a", "title": "THREAT-3a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589901" }, { "id": 602537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589902", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3659a4b7-a01d-5faa-b12f-0f25c45ee879", "parentControlId": 31997, "controlId": "RISK-5a", "title": "RISK-5a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589902" }, { "id": 602538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589902", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31ab5acf-5e3e-5a64-adf1-59d9a94a6061", "parentControlId": 31997, "controlId": "ACCESS-4a", "title": "ACCESS-4a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589902" }, { "id": 602539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589902", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "275c96ac-5b43-5738-835e-6fcb2619d131", "parentControlId": 31997, "controlId": "SITUATION-4a", "title": "SITUATION-4a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589902" }, { "id": 602540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589902", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "054afb97-177e-5ea1-8b87-8ada0d080634", "parentControlId": 31997, "controlId": "RESPONSE-5a", "title": "RESPONSE-5a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589902" }, { "id": 602541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96cc6ccc-4f2d-5d82-869b-76a91dc37adb", "parentControlId": 31997, "controlId": "THIRD-PARTIES-3a", "title": "THIRD-PARTIES-3a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589907" }, { "id": 602542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea093eb9-419e-5dc9-b123-5cb7db619f98", "parentControlId": 31997, "controlId": "WORKFORCE-5a", "title": "WORKFORCE-5a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589907" }, { "id": 602543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "650f6db7-e118-534c-a5ce-d154d3f13d05", "parentControlId": 31997, "controlId": "ARCHITECTURE-6a", "title": "ARCHITECTURE-6a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589907" }, { "id": 602544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589907", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc56625e-d99a-55c4-a3de-4faa0e1bdd7c", "parentControlId": 31997, "controlId": "PROGRAM-3a", "title": "PROGRAM-3a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589907" }, { "id": 602575, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589911", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7051f235-8598-56ea-9571-c031af1c90d9", "parentControlId": 31997, "controlId": "CIP-006-6 1.1", "title": "CIP-006-6 1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589911" }, { "controlId": "A.3.3", "title": "A.3.3 — Policies and Implementing Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-1, PL-1, PS-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "f8ccee84-a7b2-585a-9135-79acc0e733dd", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.3", "title": "NEI 08-09 Sec 3.3 — Policies and Implementing Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "9c67cffe-f210-59b8-9dc1-45b69b691c92", "isPublic": true }, { "controlId": "10 CFR 73.54(b)(2)", "title": "10 CFR 73.54(b)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "b551db3e-c3de-5ad5-ab2f-1c6cc7136423", "isPublic": true }, { "controlId": "CIP-003-8-R1", "title": "CIP-003-8-R1 — Cyber Security Policy Development and Approval", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "465e9329-2318-58f0-8800-aa8b911a34a7", "isPublic": true }, { "controlId": "CIP-003-8-1.1", "title": "CIP-003-8-1.1 — For its high impact and medium impact BES Cyber Systems, if any: 1.1.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4826e860-8762-563a-a8aa-216831d4793d", "isPublic": true }, { "controlId": "CIP-003-8-1.2", "title": "CIP-003-8-1.2 — For its assets identified in CIP-002 containing low impact BES Cyber Systems, if any: 1.2.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "fccbb596-66b2-5c32-abff-3c3139de85e3", "isPublic": true }, { "controlId": "CIP-003-9-1.2.6", "title": "CIP-003-9-1.2.6 — Low Impact Vendor Electronic Remote Access Security Policy", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-003-8-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c44af400-3c57-5efc-973f-b26a6b917655", "isPublic": true } ], "id": 31997, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731324", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731324", "catalogueId": 1062, "uuid": "59735e28-d1bd-5ea9-9ee1-4fd5b843156f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify and document Standardized Operating Procedures (SOP), or similar documentation, to enable the proper execution of day-to-day / assigned tasks?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Standardized Operating Procedures (SOP)", "description": "

Control Description

Mechanisms exist to identify and document Standardized Operating Procedures (SOP), or similar documentation, to enable the proper execution of day-to-day / assigned tasks.

Evidence Request List (ERL)

E-GOV-11

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Security Operations (OPS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with OPS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with OPS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with OPS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security operations management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security operations management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel create “run books,” or SOPs, to capture operational knowledge in documentation form for critical business functions and/or for sensitive/regulated obligations to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.

Level 3 - Well Defined: Security Operations (OPS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with OPS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with OPS domain capabilities are well-documented and kept current by process owners.\n▪ A Security Operations Center (SOC), or similar function, is appropriately staffed and supported to implement and maintain OPS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security operations management (e.g., SIEM solution, EDR/XDR tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with OPS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Cybersecurity personnel create “run books,” or SOPs, to capture operational knowledge in documentation form for critical business functions and/or for sensitive/regulated obligations.\n▪ An implemented and operational capability exists to identify and document Standardized Operating Procedures (SOP), or similar documentation, to enable the proper execution of day-to-day / assigned tasks.

Level 4 - Quantitatively Controlled: Security Operations (OPS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.3
NERC-CIP (2026) Requirements: CIP-003-8-R1", "controlId": "OPS-01.1", "family": "Security Operations", "enhancements": "", "sortId": "OPS-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Documented Standardized Operating Procedures (SOP)\n∙ ComplianceForge - Cybersecurity Standardized Operating Procedures (CSOP)

Small Business (10-49 staff)

∙ Documented Standardized Operating Procedures (SOP)\n∙ ComplianceForge - Cybersecurity Standardized Operating Procedures (CSOP)

Medium Business (50-249 staff)

∙ Documented Standardized Operating Procedures (SOP)\n∙ ComplianceForge - Cybersecurity Standardized Operating Procedures (CSOP)

Large Business (250-999 staff)

∙ Documented Standardized Operating Procedures (SOP)\n∙ ComplianceForge - Cybersecurity Standardized Operating Procedures (CSOP)

Enterprise (>1,000 staff)

∙ Documented Standardized Operating Procedures (SOP)\n∙ ComplianceForge - Cybersecurity Standardized Operating Procedures (CSOP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74048, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5912", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5912", "securityControlId": 31998, "ccis": [], "uuid": "a7648b6f-3129-546c-914e-bc1ce0b38c59", "testId": "OPS-02_A02", "test": "a Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of cybersecurity / data privacy is developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-07a.", "defaultText": null }, { "id": 74049, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5912", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5912", "securityControlId": 31998, "ccis": [], "uuid": "317729d3-8f93-5e13-b3ac-a72f39490db8", "testId": "OPS-02_A01", "test": "frequency for review / update of the Concept of Operations (CONOPS) is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PL-07_ODP", "defaultText": null }, { "id": 74050, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591201", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591201", "securityControlId": 31998, "ccis": [], "uuid": "72deeb88-14e0-5dd9-b5d2-be4f5c553147", "testId": "OPS-02_A03", "test": "the Concept of Operations (CONOPS) is reviewed / updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_PL-07b.", "defaultText": null } ], "externalMappings": [ { "id": 602666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589926", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ecd751e6-fa5c-5ad7-a0da-8683fe3d41f5", "parentControlId": 31998, "controlId": "PL-7", "title": "PL-7", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589926" }, { "id": 602667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589926", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fc1a7f1-da7a-54c6-b49a-a59d778f6dc1", "parentControlId": 31998, "controlId": "PL-07", "title": "PL-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589926" }, { "id": 602668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589926", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75ee0f4e-b4df-5708-84a6-1afda49daa9d", "parentControlId": 31998, "controlId": "PL-07", "title": "PL-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589926" }, { "id": 602669, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589926", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1c8b703-8b9d-5911-8d0d-8ac5ee9655d1", "parentControlId": 31998, "controlId": "PL-7", "title": "PL-7", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589926" } ], "id": 31998, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731324", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731325", "catalogueId": 1062, "uuid": "8053bb46-df0e-58c9-a72b-cc76d91443f8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization develop a security Concept of Operations (CONOPS), or a similarly-defined plan for achieving cybersecurity objectives, that documents management, operational and technical measures implemented to apply defense-in-depth techniques that is communicated to all appropriate stakeholders?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Security Concept Of Operations (CONOPS)", "description": "

Control Description

Mechanisms exist to develop a security Concept of Operations (CONOPS), or a similarly-defined plan for achieving cybersecurity objectives, that documents management, operational and technical measures implemented to apply defense-in-depth techniques that is communicated to all appropriate stakeholders.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Security Operations (OPS) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with OPS domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Cybersecurity operations-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Cybersecurity operations are primarily viewed as additional duties for IT staff.\n▪ There is no Security Operations Center (SOC) with 24x7x365 operations coverage.

Level 2 - Planned & Tracked: Security Operations (OPS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with OPS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with OPS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with OPS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security operations management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security operations management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel create “run books,” or SOPs, to capture operational knowledge in documentation form for critical business functions and/or for sensitive/regulated obligations to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.

Level 3 - Well Defined: Security Operations (OPS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with OPS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with OPS domain capabilities are well-documented and kept current by process owners.\n▪ A Security Operations Center (SOC), or similar function, is appropriately staffed and supported to implement and maintain OPS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security operations management (e.g., SIEM solution, EDR/XDR tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with OPS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Cybersecurity personnel create “run books,” or SOPs, to capture operational knowledge in documentation form for critical business functions and/or for sensitive/regulated obligations.\n▪ An implemented and operational capability exists to develop a security Concept of Operations (CONOPS), or a similarly-defined plan for achieving cybersecurity objectives, that documents management, operational and technical measures implemented to apply defense-in-depth techniques that is communicated to all appropriate stakeholders.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "OPS-02", "family": "Security Operations", "enhancements": "", "sortId": "OPS-02", "references": "

Micro-Small Business (<10 staff)

∙ Document relevant policy and procedures

Small Business (10-49 staff)

∙ Written policy and procedures\n∙ Designated responsible owner\n∙ Annual review

Medium Business (50-249 staff)

∙ Cybersecurity-focused Concept of Operations (CONOPS)

Large Business (250-999 staff)

∙ Cybersecurity-focused Concept of Operations (CONOPS)

Enterprise (>1,000 staff)

∙ Cybersecurity-focused Concept of Operations (CONOPS)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74051, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591201", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591201", "securityControlId": 31999, "ccis": [], "uuid": "2628563a-3f5b-5ffd-8aa5-f79372ab8b4c", "testId": "OPS-03_A01", "test": "supporting business processes are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74052, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591201", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591201", "securityControlId": 31999, "ccis": [], "uuid": "509c0afe-3b14-584c-b90d-207c07722539", "testId": "OPS-03_A02", "test": "appropriate governance and service management is implemented to ensure appropriate planning, delivery and support of business functions, workforce, and/or customers.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 602725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589937", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a166039-4aab-5d86-8729-c4c0b5aa70a9", "parentControlId": 31999, "controlId": "8.1", "title": "8.1", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589937" }, { "id": 602726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589937", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7997d721-dc35-568e-afdc-a0c8286d370c", "parentControlId": 31999, "controlId": "5.37", "title": "5.37", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589937" }, { "id": 602738, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589938", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "883ac45e-b88e-5ef0-93b3-4d1d61fa8766", "parentControlId": 31999, "controlId": "IP-4", "title": "IP-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589938" }, { "id": 602739, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589938", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3919c1e-0d4d-5fdb-833c-44f20f83dc55", "parentControlId": 31999, "controlId": "IP-4(1)", "title": "IP-4(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589938" }, { "id": 602742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589939", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b9d2bf4-ef10-5ec0-9d86-39b18b1db50a", "parentControlId": 31999, "controlId": "03.15.01.b", "title": "03.15.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589939" } ], "id": 31999, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731325", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731325", "catalogueId": 1062, "uuid": "057f9865-6625-5e24-871a-73f197062f5e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define supporting business processes and implement appropriate governance and service management to ensure appropriate planning, delivery and support of its technology capabilities supporting business functions, workforce, and/or customers based on industry-recognized standards to achieve the specific goals of the process area?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Service Delivery\n(Business Process Support)", "description": "

Control Description

Mechanisms exist to define supporting business processes and implement appropriate governance and service management to ensure appropriate planning, delivery and support of the organization's technology capabilities supporting business functions, workforce, and/or customers based on industry-recognized standards to achieve the specific goals of the process area.

Evidence Request List (ERL)

E-TPM-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Security Operations (OPS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with OPS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with OPS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with OPS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security operations management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security operations management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel create “run books,” or SOPs, to capture operational knowledge in documentation form for critical business functions and/or for sensitive/regulated obligations to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.

Level 3 - Well Defined: Security Operations (OPS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with OPS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with OPS domain capabilities are well-documented and kept current by process owners.\n▪ A Security Operations Center (SOC), or similar function, is appropriately staffed and supported to implement and maintain OPS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security operations management (e.g., SIEM solution, EDR/XDR tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with OPS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Cybersecurity personnel create “run books,” or SOPs, to capture operational knowledge in documentation form for critical business functions and/or for sensitive/regulated obligations.\n▪ An implemented and operational capability exists to define supporting business processes and implement appropriate governance and service management to ensure appropriate planning, delivery and support of the organization's technology capabilities supporting business functions, workforce, and/or customers based on industry-recognized standards to achieve the specific goals of the process area.

Level 4 - Quantitatively Controlled: Security Operations (OPS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "OPS-03", "family": "Security Operations", "enhancements": "", "sortId": "OPS-03", "references": "

Micro-Small Business (<10 staff)

∙ Documented Standardized Operating Procedures (SOP)

Small Business (10-49 staff)

∙ Documented Standardized Operating Procedures (SOP)

Medium Business (50-249 staff)

∙ Documented Standardized Operating Procedures (SOP)\n∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)

Large Business (250-999 staff)

∙ Documented Standardized Operating Procedures (SOP)\n∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)\n∙ COBIT 2019 Framework (https://isaca.org)

Enterprise (>1,000 staff)

∙ Documented Standardized Operating Procedures (SOP)\n∙ VisibleOps (https://itpi.org) \n∙ ITIL 4 (https://axelos.com)\n∙ COBIT 2019 Framework (https://isaca.org)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74053, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591201", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591201", "securityControlId": 32000, "ccis": [], "uuid": "7b0a698c-c0a4-5af3-982e-057eb441e1e2", "testId": "OPS-04_A01", "test": "a Security Operations Center (SOC) capability is established and maintained.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.6.1e[a]\n172A_3.6.1e[c]\n53A_R5_IR-04(14)[01]\n53A_R5_IR-04(14)[02]", "defaultText": null }, { "id": 74054, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591202", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591202", "securityControlId": 32000, "ccis": [], "uuid": "a74a5542-3631-51d9-9894-1fadf247b866", "testId": "OPS-04_A02", "test": "a time period to operate a Security Operations Center (SOC) capability is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.6.1e_ODP[1]", "defaultText": null }, { "id": 74055, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591202", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591202", "securityControlId": 32000, "ccis": [], "uuid": "73bc548c-75ea-56fb-8ffe-b5d55434bd25", "testId": "OPS-04_A03", "test": "the Security Operations Center (SOC) capability operates according to an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.6.1e[b]", "defaultText": null } ], "externalMappings": [ { "id": 602779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d03cce7-ca16-5de6-8827-e1dd134dc48c", "parentControlId": 32000, "controlId": "SC-38", "title": "SC-38", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589943" }, { "id": 602780, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1030754a-5c57-5a5f-8789-e704c929f922", "parentControlId": 32000, "controlId": "IR-04(14)", "title": "IR-04(14)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589943" }, { "id": 602781, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db400f7c-6086-58d6-bebc-f7a52f683dac", "parentControlId": 32000, "controlId": "SC-38", "title": "SC-38", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589943" }, { "id": 602783, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "905ce19f-b574-5daf-92e6-c8aebd77d613", "parentControlId": 32000, "controlId": "IR-04(14)", "title": "IR-04(14)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589943" }, { "id": 602784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589943", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d8dc6ca-f7e9-5edd-a520-949b65050576", "parentControlId": 32000, "controlId": "SC-38", "title": "SC-38", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589943" }, { "id": 602785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589944", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96d35ae2-a5d5-51a7-a5d6-b6d07674c92e", "parentControlId": 32000, "controlId": "SC-38", "title": "SC-38", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589944" } ], "id": 32000, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731325", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731325", "catalogueId": 1062, "uuid": "ad4052dd-9f21-50c3-bf0e-8aef9426d9fc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish and maintain a Security Operations Center (SOC) that facilitates a 24x7 response capability?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Security Operations Center (SOC)", "description": "

Control Description

Mechanisms exist to establish and maintain a Security Operations Center (SOC) that facilitates a 24x7 response capability.

Evidence Request List (ERL)

E-OPS-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Security Operations (OPS) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with OPS domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with OPS domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with OPS domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security operations management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security operations management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel create “run books,” or SOPs, to capture operational knowledge in documentation form for critical business functions and/or for sensitive/regulated obligations to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD.

Level 3 - Well Defined: Security Operations (OPS) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with OPS domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with OPS domain capabilities are well-documented and kept current by process owners.\n▪ A Security Operations Center (SOC), or similar function, is appropriately staffed and supported to implement and maintain OPS domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security operations management (e.g., SIEM solution, EDR/XDR tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with OPS domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ Cybersecurity personnel create “run books,” or SOPs, to capture operational knowledge in documentation form for critical business functions and/or for sensitive/regulated obligations.\n▪ An implemented and operational capability exists to establish and maintain a Security Operations Center (SOC) that facilitates a 24x7 response capability.

Level 4 - Quantitatively Controlled: Security Operations (OPS) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "OPS-04", "family": "Security Operations", "enhancements": "", "sortId": "OPS-04", "references": "

Micro-Small Business (<10 staff)

∙ Outsourced 24x7 Security Operations Center (SOC) through a Managed Security Services Provider (MSSP).

Small Business (10-49 staff)

∙ Outsourced 24x7 Security Operations Center (SOC) through a Managed Security Services Provider (MSSP).

Medium Business (50-249 staff)

∙ Outsourced 24x7 Security Operations Center (SOC) through a Managed Security Services Provider (MSSP).\n∙ Internal 8x5 staff augmentation

Large Business (250-999 staff)

∙ In-house 24x7 Security Operations Center (SOC)

Enterprise (>1,000 staff)

∙ In-house 24x7 Security Operations Center (SOC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74062, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591207", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591207", "securityControlId": 32004, "ccis": [], "uuid": "1f352bb1-6745-5da0-b939-0e81dbd39eeb", "testId": "SAT-01_A01", "test": "a cybersecurity / data privacy workforce development and improvement program is established.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-13[01]\n53A_R5_PM-13[02]", "defaultText": null }, { "id": 74063, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591207", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591207", "securityControlId": 32004, "ccis": [], "uuid": "298d63c6-c985-53ed-94e0-3509dafee97e", "testId": "SAT-01_A02", "test": "the cybersecurity / data privacy education and awareness program is organization-wide.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AT-01_ODP[03]", "defaultText": null }, { "id": 74064, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591207", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591207", "securityControlId": 32004, "ccis": [], "uuid": "8b48b202-0e1b-5fbe-b554-ce5de44a4896", "testId": "SAT-01_A03", "test": "the frequency at which to provide security literacy training to system users after initial training is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "171A_R3_A.03.02.01.ODP[01]", "defaultText": null }, { "id": 74065, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591208", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591208", "securityControlId": 32004, "ccis": [], "uuid": "de5ea901-0c59-577a-8e94-7bd6734b2c70", "testId": "SAT-01_A04", "test": "events that require security literacy training for system users are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.02.01.ODP[02]", "defaultText": null }, { "id": 74066, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591208", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591208", "securityControlId": 32004, "ccis": [], "uuid": "5b19c059-bb2e-591f-9e13-f15a79523f92", "testId": "SAT-01_A05", "test": "security literacy training is provided to system users as part of initial training for new users.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "171A_R3_A.03.02.01.a.01[01]", "defaultText": null }, { "id": 74067, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591208", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591208", "securityControlId": 32004, "ccis": [], "uuid": "574bda77-9b2c-5932-b576-26ea310e0bca", "testId": "SAT-01_A06", "test": "security literacy training is provided to system users after initial training.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months", "otherId": "171A_R3_A.03.02.01.a.01[02]", "defaultText": null }, { "id": 74068, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591208", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591208", "securityControlId": 32004, "ccis": [], "uuid": "93ed1ad1-e4c1-5f39-8f6a-c165a2da99c6", "testId": "SAT-01_A07", "test": "Security Awareness & Training (SAT) operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74069, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591208", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591208", "securityControlId": 32004, "ccis": [], "uuid": "33a2bfc8-38f3-5a71-bc92-95908639578d", "testId": "SAT-01_A08", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support Security Awareness & Training (SAT) operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74070, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591208", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591208", "securityControlId": 32004, "ccis": [], "uuid": "512537e0-65b9-532a-a7fb-0f337116e502", "testId": "SAT-01_A09", "test": "responsibility and authority for the performance of Security Awareness & Training (SAT)-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74071, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591209", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591209", "securityControlId": 32004, "ccis": [], "uuid": "fbd3ef25-5616-5fdc-bb93-0d7ca626f2a1", "testId": "SAT-01_A10", "test": "personnel performing Security Awareness & Training (SAT)-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 602837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589949", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03c011c1-ced0-5070-af5e-a278abe1b2a5", "parentControlId": 32004, "controlId": "7.4", "title": "7.4", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589949" }, { "id": 602838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b13fb75b-8929-555a-8214-d4c2962837bd", "parentControlId": 32004, "controlId": "7.4(a)", "title": "7.4(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58995" }, { "id": 602839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bb4384b-558f-5cb7-a886-f20f1f38014d", "parentControlId": 32004, "controlId": "7.4(b)", "title": "7.4(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58995" }, { "id": 602840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77d716d6-52f8-54d6-9bcb-06d7f38e222b", "parentControlId": 32004, "controlId": "7.4(c)", "title": "7.4(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58995" }, { "id": 602841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2913a2a4-bb71-5aab-b513-7151915a797f", "parentControlId": 32004, "controlId": "7.4(d)", "title": "7.4(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58995" }, { "id": 602842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.58995", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46b79b88-d749-5a83-aec8-e8a776d2c75b", "parentControlId": 32004, "controlId": "6.3", "title": "6.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.58995" }, { "id": 602854, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589951", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2caa564-b94a-528f-8822-75d503e0f3b4", "parentControlId": 32004, "controlId": "AT-1", "title": "AT-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589952" }, { "id": 602855, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589952", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91cf1a8d-c436-5406-8b05-67faaf920803", "parentControlId": 32004, "controlId": "PM-13", "title": "PM-13", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589952" }, { "id": 602856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589952", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc6cff79-3994-5721-b516-24bd47d641bb", "parentControlId": 32004, "controlId": "AT-01", "title": "AT-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589952" }, { "id": 602857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589952", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55b44952-3663-5f76-811d-bf2aeb452cf7", "parentControlId": 32004, "controlId": "PM-13", "title": "PM-13", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589952" }, { "id": 602860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589952", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "095f31ad-24fa-5e73-8485-176857b75f77", "parentControlId": 32004, "controlId": "AT-01", "title": "AT-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589952" }, { "id": 602862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589952", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbd9a2d7-f9c3-586e-b14b-e52088d75b3b", "parentControlId": 32004, "controlId": "AT-01", "title": "AT-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589952" }, { "id": 602863, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589952", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b666901b-7109-5998-9f86-b081d2c1d78d", "parentControlId": 32004, "controlId": "PM-13", "title": "PM-13", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589952" }, { "id": 602864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589953", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5bdcec3-186d-5eda-b2a9-c316280330bd", "parentControlId": 32004, "controlId": "PM-13", "title": "PM-13", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589953" }, { "id": 602865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589953", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45c5fea4-2a12-50b4-8ee1-8662cf6dc14c", "parentControlId": 32004, "controlId": "PM-13", "title": "PM-13", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589953" }, { "id": 602866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f41e28ef-1e3c-5460-8f6f-b37b859b854f", "parentControlId": 32004, "controlId": "PM-13", "title": "PM-13", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589961" }, { "id": 602867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589961", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5b5f51d-a6cb-56c8-b1b8-2666ea12012a", "parentControlId": 32004, "controlId": "AT-1", "title": "AT-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589961" }, { "id": 602868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589962", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4f1c311-73f4-5e65-aebe-9b12ccb14ef1", "parentControlId": 32004, "controlId": "PM-13", "title": "PM-13", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589962" }, { "id": 602869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589962", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2cf96406-f37c-5a51-a06f-b6f41efc6237", "parentControlId": 32004, "controlId": "AT-1", "title": "AT-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589962" }, { "id": 602874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589962", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d349397b-f515-5fb1-bb92-c7cd3e7f5423", "parentControlId": 32004, "controlId": "NFO - AT-1", "title": "NFO - AT-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589962" }, { "id": 602875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589962", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fbc8bcb7-f392-5736-b2ad-58b69fab6622", "parentControlId": 32004, "controlId": "03.02.01.a", "title": "03.02.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589962" }, { "id": 602880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589963", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5992067e-e352-561f-93ce-884277257934", "parentControlId": 32004, "controlId": "PR.AT", "title": "PR.AT", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589963" }, { "id": 602943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589971", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2906ad8d-16a6-5a72-a406-1155a990b8ea", "parentControlId": 32004, "controlId": "WORKFORCE-2a", "title": "WORKFORCE-2a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589971" }, { "id": 602944, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589971", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48459ac1-6ad3-5e34-a22d-80e240605732", "parentControlId": 32004, "controlId": "WORKFORCE-2b", "title": "WORKFORCE-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589971" }, { "id": 602945, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589971", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10696c07-a239-57e5-b9f0-f714def8e52d", "parentControlId": 32004, "controlId": "WORKFORCE-2c", "title": "WORKFORCE-2c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589971" }, { "id": 602946, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589971", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79a6dc62-9dba-5e78-bd10-91c59fa798a1", "parentControlId": 32004, "controlId": "WORKFORCE-4f", "title": "WORKFORCE-4f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589971" }, { "id": 602966, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "117e95fb-9ac3-5143-9b69-3420c8625af6", "parentControlId": 32004, "controlId": "CIP-003-8 1.2.1", "title": "CIP-003-8 1.2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589973" }, { "id": 602967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589973", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75da1a9f-72ff-5d6d-8e62-ba11a9aca7a7", "parentControlId": 32004, "controlId": "§117.18(b)(3)", "title": "§117.18(b)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589973" }, { "id": 602999, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589977", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fd8906e-871e-52bd-98e8-d440f7017373", "parentControlId": 32004, "controlId": "B6.a", "title": "B6.a", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589977" }, { "controlId": "C.10.1", "title": "C.10.1 — Cyber Security Awareness and Training", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AT-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "38355cba-35e7-5418-aa67-eb7630dfd3b2", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.1", "title": "NEI 08-09 App E.10.1 — Cyber Security Awareness and Training", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "ba3c9a7b-3a7a-590e-b6d5-1583b062882e", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(2)", "title": "10 CFR 73.54(d)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.10.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "9b0df0da-49b7-5117-b01d-305bb9c5fc59", "isPublic": true }, { "controlId": "CIP-004-7-R1", "title": "CIP-004-7-R1 — Security Awareness Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0900694e-9845-5caa-a3e1-2a04337838ca", "isPublic": true }, { "controlId": "CIP-004-7-1.1", "title": "CIP-004-7-1.1 — Security awareness that, at least once each calendar quarter, reinforces cyber security practices (which may include...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "64d4cf19-60e3-54ba-b627-b656db95223e", "isPublic": true }, { "controlId": "NSS-17T-Sec4.4", "title": "NSS-17T-Sec4.4 — Nuclear Computer Security Culture, Awareness & Specialized Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "5da2a016-c7ba-59e7-af9c-10bba659ac1b", "isPublic": true }, { "controlId": "IEC-62645-5.2.3", "title": "IEC-62645-5.2.3 — Competence, Awareness, and Role-Based I&C Security Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "2589b170-3fda-5943-b096-abb089aafb39", "isPublic": true }, { "controlId": "IEC-63096-7.2", "title": "IEC-63096-7.2 — Cyber Security Awareness, Education, and Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "14722f75-ed6d-5f9d-a407-5cfb0e43ea04", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3.4", "title": "REGDOC-2.12.1-Sec3.4 — Security Awareness and Technical Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "66077dc6-2dc6-52ca-ba62-83ae2f1533f3", "isPublic": true } ], "id": 32004, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731327", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731327", "catalogueId": 1062, "uuid": "ad385f66-6fec-59a9-a927-2d9e825405ed", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of security workforce development and awareness controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Security, Compliance & Resilience-Minded Workforce", "description": "

Control Description

Mechanisms exist to facilitate the implementation of security workforce development and awareness controls.

Evidence Request List (ERL)

E-SAT-02\nE-SAT-04\nE-SAT-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Security Awareness & Training (SAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security awareness and training-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Security awareness and training methods are often generic, without organization-specific content.

Level 2 - Planned & Tracked: Security Awareness & Training (SAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security Awareness & Training-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security Awareness & Training may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Users are educated on their responsibilities to protect TAASD assigned to them or under their supervision.\n▪ IT and/or cybersecurity personnel create/govern security and awareness training to meet specific statutory, regulatory and/or contractual compliance obligations.\n▪ Privileged users receive formal security and/or data privacy awareness training to ensure they understand their unique roles and responsibilities.\n▪ The responsibility for training users and enforcing policies may be assigned to user’s immediate supervisor(s)/manager(s), including the definition and enforcement of the user’s specific role(s) and responsibilities.

Level 3 - Well Defined: Security Awareness & Training (SAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are well-documented and kept current by process owners.\n▪ A security awareness & training team, or similar function, is appropriately staffed and supported to implement and maintain SAT domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security awareness and training management (e.g., Computer Based Learning (CBL) solutions, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of security workforce development and awareness controls.

Level 4 - Quantitatively Controlled: Security Awareness & Training (SAT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.10.1
NERC-CIP (2026) Requirements: CIP-004-7-R1", "controlId": "SAT-01", "family": "Security Awareness & Training", "enhancements": "", "sortId": "SAT-01", "references": "

Micro-Small Business (<10 staff)

∙ Third-party advisors (e.g., virtual CISO, Managed Security Services Provider (MSSP), etc.)

Small Business (10-49 staff)

∙ Third-party advisors (e.g., virtual CISO, Managed Security Services Provider (MSSP), etc.)

Medium Business (50-249 staff)

∙ Chief Information Security Officer (CISO)

Large Business (250-999 staff)

∙ Chief Information Security Officer (CISO)

Enterprise (>1,000 staff)

∙ Chief Information Security Officer (CISO)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74072, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591209", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591209", "securityControlId": 32005, "ccis": [], "uuid": "2db1a6c9-5bdc-545a-a0ac-803bd827f353", "testId": "SAT-01.1_A01", "test": "security workforce development and awareness training is periodically reviewed to account for changes to organizational policies, standards and procedures.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74073, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591209", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591209", "securityControlId": 32005, "ccis": [], "uuid": "87f40077-5388-5caf-bc34-eba87d526d6a", "testId": "SAT-01.1_A02", "test": "security workforce development and awareness training is periodically reviewed to account for changes to assigned roles and responsibilities.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74074, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591209", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591209", "securityControlId": 32005, "ccis": [], "uuid": "481218ad-c24d-5eb4-a6e0-2bb6e8240472", "testId": "SAT-01.1_A03", "test": "security workforce development and awareness training is periodically reviewed to account for changes to relevant threats and risks.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74075, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591209", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591209", "securityControlId": 32005, "ccis": [], "uuid": "563a2a38-a50e-534c-b2d2-901629ac62f9", "testId": "SAT-01.1_A04", "test": "security workforce development and awareness training is periodically reviewed to account for changes to technological developments.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 603032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589981", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39f88f6c-3a4b-5c73-b32c-01d41d1f53a2", "parentControlId": 32005, "controlId": "WORKFORCE-2g", "title": "WORKFORCE-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589981" }, { "id": 603033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589981", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e05ce30-6140-53e9-9a34-943b8e741525", "parentControlId": 32005, "controlId": "WORKFORCE-4e", "title": "WORKFORCE-4e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589981" }, { "controlId": "C.10.6", "title": "C.10.6 — Situation Awareness", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-5, PM-16", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "9e0addf6-951a-5420-837c-cc1f75443f23", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.6", "title": "NEI 08-09 App E.10.6 — Situation Awareness", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "66ab3af3-06bb-5ebd-8636-50eb08094f98", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(2)", "title": "10 CFR 73.54(d)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.10.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "f781d85f-2e86-5b84-bade-1cdfc1def3ce", "isPublic": true }, { "controlId": "C.10.7", "title": "C.10.7 — Feedback", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AT-2, AT-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "bd4d24b4-de9e-5dfe-b17e-8c7501ada9dd", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.7", "title": "NEI 08-09 App E.10.7 — Feedback", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e1798b1c-b5be-599c-82f4-a0434ffc0f4a", "isPublic": true }, { "controlId": "NSS-17T-Sec4.4", "title": "NSS-17T-Sec4.4 — Nuclear Computer Security Culture, Awareness & Specialized Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "afeb3407-c303-56ad-9056-5614b990474c", "isPublic": true }, { "controlId": "IEC-62645-5.2.3", "title": "IEC-62645-5.2.3 — Competence, Awareness, and Role-Based I&C Security Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "dcc996fa-744e-5b6a-a1cf-cd8424aaef77", "isPublic": true }, { "controlId": "IEC-63096-7.2", "title": "IEC-63096-7.2 — Cyber Security Awareness, Education, and Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "46e2f7d9-fdc6-524c-8226-d973b910a98f", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3.4", "title": "REGDOC-2.12.1-Sec3.4 — Security Awareness and Technical Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "66fb6174-a85c-5dc1-906a-7c50a3c798b0", "isPublic": true } ], "id": 32005, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731327", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731327", "catalogueId": 1062, "uuid": "0a1a0365-8c99-5c5e-9a58-a47e6be25e4d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization periodically review security workforce development and awareness training to account for changes to:\n(1) Organizational policies, standards and procedures;\n(2) Assigned roles and responsibilities;\n(3) Relevant threats and risks; and\n(4) Technological developments?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Maintaining Workforce Development Relevancy", "description": "

Control Description

Mechanisms exist to periodically review security workforce development and awareness training to account for changes to:\n(1) Organizational policies, standards and procedures;\n(2) Assigned roles and responsibilities;\n(3) Relevant threats and risks; and\n(4) Technological developments.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Security Awareness & Training (SAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security awareness and training-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Security awareness and training methods are often generic, without organization-specific content.

Level 2 - Planned & Tracked: Security Awareness & Training (SAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security Awareness & Training-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security Awareness & Training may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Business process owners are required to incorporate vendor-specific security training in support of new technology initiatives.

Level 3 - Well Defined: Security Awareness & Training (SAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are well-documented and kept current by process owners.\n▪ A security awareness & training team, or similar function, is appropriately staffed and supported to implement and maintain SAT domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security awareness and training management (e.g., Computer Based Learning (CBL) solutions, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to periodically review security workforce development and awareness training to account for changes to:\n(1) Organizational policies, standards and procedures;\n(2) Assigned roles and responsibilities;\n(3) Relevant threats and risks; and\n(4) Technological developments.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.10.6, C.10.7", "controlId": "SAT-01.1", "family": "Security Awareness & Training", "enhancements": "", "sortId": "SAT-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Provide role-specific security guidance for IT/admin roles

Small Business (10-49 staff)

∙ Role-based security training for IT personnel

Medium Business (50-249 staff)

∙ Formal role-based security training program\n∙ IT/admin-specific cybersecurity curriculum

Large Business (250-999 staff)

∙ Enterprise role-based security training platform\n∙ Technical security training for IT/admin roles

Enterprise (>1,000 staff)

∙ Enterprise role-based security training program (e.g., KnowBe4, SANS)\n∙ Technical training paths by role\n∙ Certification support", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74076, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59121", "securityControlId": 32006, "ccis": [], "uuid": "052befff-d742-529b-9949-b4e856145b37", "testId": "SAT-02_A01", "test": "cybersecurity / data privacy literacy training is provided to system users (including managers, senior executives and contractors) as part of initial training for new users.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_AT-02a.01[01]\n53A_R5_AT-02a.01[02]", "defaultText": null }, { "id": 74077, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59121", "securityControlId": 32006, "ccis": [], "uuid": "65c58f4a-bf60-5306-94be-bf926784904f", "testId": "SAT-02_A02", "test": "cybersecurity / data privacy literacy training is provided to system users (including managers, senior executives and contractors) organization-defined frequency thereafter.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AT-02a.01[03]\n53A_R5_AT-02a.01[04]", "defaultText": null }, { "id": 74078, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59121", "securityControlId": 32006, "ccis": [], "uuid": "762d5219-016d-590f-976c-15757a75c54d", "testId": "SAT-02_A03", "test": "cybersecurity / data privacy literacy training is provided to system users (including managers, senior executives and contractors) when required by system changes or following organization-defined events.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "53A_R5_AT-02a.02[01]\n53A_R5_AT-02a.02[02]", "defaultText": null }, { "id": 74079, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59121", "securityControlId": 32006, "ccis": [], "uuid": "19ae3f34-0241-5fd2-9ce8-5261e02b7a39", "testId": "SAT-02_A04", "test": "security risks associated with organizational activities involving sensitive / regulated data are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.2.1[a]", "defaultText": null }, { "id": 74080, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59121", "securityControlId": 32006, "ccis": [], "uuid": "08117ca2-4816-5aef-b8ad-4207f9955f5c", "testId": "SAT-02_A05", "test": "policies, standards and procedures related to the security of the system are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.2.1[b]", "defaultText": null }, { "id": 74081, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59121", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59121", "securityControlId": 32006, "ccis": [], "uuid": "a1355d5b-73d8-52ae-b5a3-1f22f01422c8", "testId": "SAT-02_A06", "test": "managers, systems administrators and users of the system are made aware of the security risks associated with their activities.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "171A_3.2.1[c]", "defaultText": null }, { "id": 74082, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591211", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591211", "securityControlId": 32006, "ccis": [], "uuid": "78b9ab5a-f50c-51ee-8bb4-9a6c24b3aa81", "testId": "SAT-02_A07", "test": "managers, systems administrators and users of the system are made aware of the applicable policies, standards and procedures related to the security of the system.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.2.1[d]", "defaultText": null }, { "id": 74083, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591211", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591211", "securityControlId": 32006, "ccis": [], "uuid": "7041219f-2415-537f-9c05-499643641abf", "testId": "SAT-02_A08", "test": "the frequency at which to provide cybersecurity / data privacy literacy training to system users (including managers, senior executives and contractors) after initial training is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "53A_R5_AT-02_ODP[01]\n53A_R5_AT-02_ODP[02]\nAT-02_ODP[01]", "defaultText": null }, { "id": 74084, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591211", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591211", "securityControlId": 32006, "ccis": [], "uuid": "682526ab-3a9e-51aa-ac9e-2cad712ca96b", "testId": "SAT-02_A09", "test": "events that require cybersecurity / data privacy literacy training for system users are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AT-02_ODP[03]\n53A_R5_AT-02_ODP[04]", "defaultText": null }, { "id": 74085, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591211", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591211", "securityControlId": 32006, "ccis": [], "uuid": "b2558255-7fcb-502e-bc96-a264c89ffe5d", "testId": "SAT-02_A10", "test": "techniques to be employed to increase the cybersecurity / data privacy awareness of system users are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AT-02_ODP[05]", "defaultText": null }, { "id": 74086, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591211", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591211", "securityControlId": 32006, "ccis": [], "uuid": "4dfc5f8d-ccad-57a2-bec5-9e3b500f1446", "testId": "SAT-02_A11", "test": "events that require security literacy training for system users are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_AT-02_ODP[06]\n172A_3.2.1e_ODP[2]\n171A_R3_A.03.02.01.ODP[03]", "defaultText": null }, { "id": 74087, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591212", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591212", "securityControlId": 32006, "ccis": [], "uuid": "11834393-db6d-531b-ba6b-ec029dbb07e6", "testId": "SAT-02_A12", "test": "events that require security literacy training content updates are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_AT-02_ODP[07]\n171A_R3_A.03.02.01.ODP[04]", "defaultText": null }, { "id": 74088, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591212", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591212", "securityControlId": 32006, "ccis": [], "uuid": "c2191655-294b-53f8-b4ff-84d48c16cbfd", "testId": "SAT-02_A13", "test": "awareness training is updated frequently or when there are significant changes to the threat.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.2.1e[d]", "defaultText": null }, { "id": 74089, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591212", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591212", "securityControlId": 32006, "ccis": [], "uuid": "6b55486f-2122-52dd-ae68-f14a5e3e9dd8", "testId": "SAT-02_A14", "test": "organization-defined awareness techniques are employed to increase the cybersecurity / data privacy awareness of system users.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AT-02b.", "defaultText": null }, { "id": 74090, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591212", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591212", "securityControlId": 32006, "ccis": [], "uuid": "2ebd26bc-2b7e-5e47-8e09-d3bdbd6f3cdd", "testId": "SAT-02_A15", "test": "literacy training and awareness content is updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "53A_R5_AT-02c.[01]", "defaultText": null }, { "id": 74091, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591212", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591212", "securityControlId": 32006, "ccis": [], "uuid": "7d263956-8b8f-5f74-a8f5-ba28bbb0247d", "testId": "SAT-02_A16", "test": "literacy training and awareness content is updated following organization-defined events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AT-02c.[02]", "defaultText": null }, { "id": 74092, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591213", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591213", "securityControlId": 32006, "ccis": [], "uuid": "ac4b20f8-95ab-5a6a-bf44-0883e6f71008", "testId": "SAT-02_A17", "test": "lessons learned from internal or external security incidents or breaches are incorporated into literacy training and awareness techniques.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AT-02d.", "defaultText": null } ], "externalMappings": [ { "id": 603060, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b804da1e-12b6-5943-adf8-7d7cf739d283", "parentControlId": 32006, "controlId": "ORG 1.4", "title": "ORG 1.4", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589984" }, { "id": 603065, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8267735-2b13-537e-ba64-5abac148f947", "parentControlId": 32006, "controlId": "7.4", "title": "7.4", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589984" }, { "id": 603066, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589984", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a969306-32da-50ab-8417-f36c901f6e97", "parentControlId": 32006, "controlId": "7.4(a)", "title": "7.4(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589984" }, { "id": 603067, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "127a479a-0dba-5478-b907-be9eec60bef6", "parentControlId": 32006, "controlId": "7.4(b)", "title": "7.4(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589985" }, { "id": 603068, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a482bb8-5899-5fb1-8785-8a21848e157e", "parentControlId": 32006, "controlId": "7.4(c)", "title": "7.4(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589985" }, { "id": 603069, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0954c96d-6e2e-5420-b778-8736b2a46ddb", "parentControlId": 32006, "controlId": "7.4(d)", "title": "7.4(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589985" }, { "id": 603070, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589985", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8550ac4c-0b00-5fd3-b964-041cdd713fec", "parentControlId": 32006, "controlId": "6.3", "title": "6.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589985" }, { "id": 603079, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eac702f8-f9d2-5cb6-8570-6320ee572655", "parentControlId": 32006, "controlId": "AT-2", "title": "AT-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589986" }, { "id": 603080, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "006cfc27-fc33-53f1-83a2-8d2d9ee5e473", "parentControlId": 32006, "controlId": "AT-02", "title": "AT-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589986" }, { "id": 603082, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19adcecb-8641-5293-ae0e-335cf81d5326", "parentControlId": 32006, "controlId": "AT-02", "title": "AT-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589986" }, { "id": 603084, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fbe6c75-70af-533d-9a0e-b45b9c079e8f", "parentControlId": 32006, "controlId": "AT-02", "title": "AT-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589986" }, { "id": 603085, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0c64c95-dcc5-5fbd-871f-912331359b79", "parentControlId": 32006, "controlId": "AT-02", "title": "AT-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589986" }, { "id": 603086, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589986", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37d8ac61-0757-548e-bc9a-8e8bfdf2686f", "parentControlId": 32006, "controlId": "AT-02", "title": "AT-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589987" }, { "id": 603087, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fe6ef3a-243d-5fc3-b1c1-78cd2a5abda3", "parentControlId": 32006, "controlId": "AT-02", "title": "AT-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589987" }, { "id": 603088, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f91c596-e9a5-55e8-87d7-6f2dc8652cb4", "parentControlId": 32006, "controlId": "AT-2", "title": "AT-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589987" }, { "id": 603089, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "deafb608-3580-5b3b-8141-bf5f35a6e2cc", "parentControlId": 32006, "controlId": "3.2.1", "title": "3.2.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589987" }, { "id": 603090, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b41ff37-1b91-5e78-9e4f-f2d9e9416a37", "parentControlId": 32006, "controlId": "03.01.22.a", "title": "03.01.22.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589987" }, { "id": 603091, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "655513cd-0896-5a93-a65b-41025c445abb", "parentControlId": 32006, "controlId": "03.02.01.a.01", "title": "03.02.01.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589987" }, { "id": 603092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4392bc55-4dbb-5a32-a02e-558de8b0019c", "parentControlId": 32006, "controlId": "03.02.01.a.02", "title": "03.02.01.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589987" }, { "id": 603093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589987", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ade3d0f-23d8-546f-a863-6b751a5565e5", "parentControlId": 32006, "controlId": "03.02.01.a.03", "title": "03.02.01.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589987" }, { "id": 603094, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589988", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1de5ab8-7d51-5ff9-aa4f-528ccad08a4f", "parentControlId": 32006, "controlId": "03.02.01.b", "title": "03.02.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589988" }, { "id": 603095, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589988", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d801d878-1dac-51d7-97f7-fdbabda88474", "parentControlId": 32006, "controlId": "03.06.04.a.03", "title": "03.06.04.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589988" }, { "id": 603106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589989", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2274cb7b-5a94-5c3c-b0ad-f51501fd31e2", "parentControlId": 32006, "controlId": "PR.AT", "title": "PR.AT", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589989" }, { "id": 603107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589989", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11402231-5d0d-50c0-b105-7813d68342de", "parentControlId": 32006, "controlId": "PR.AT-01", "title": "PR.AT-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589989" }, { "id": 603153, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d0af92c-bc30-540e-8d15-364e5929898f", "parentControlId": 32006, "controlId": "WORKFORCE-2a", "title": "WORKFORCE-2a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589994" }, { "id": 603154, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ea5d7c0-2dad-546d-883b-c269067813b9", "parentControlId": 32006, "controlId": "WORKFORCE-2b", "title": "WORKFORCE-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589994" }, { "id": 603155, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b0fcd11-b3c1-5efa-ac48-f062d7df23ab", "parentControlId": 32006, "controlId": "WORKFORCE-2c", "title": "WORKFORCE-2c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589994" }, { "id": 603156, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2eb752d5-b637-5978-9c10-7678fe5421a4", "parentControlId": 32006, "controlId": "WORKFORCE-2d", "title": "WORKFORCE-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589994" }, { "id": 603157, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589994", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a45b37b-0444-5a59-9cb8-44ba0f7f24e4", "parentControlId": 32006, "controlId": "WORKFORCE-4d", "title": "WORKFORCE-4d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589995" }, { "id": 603181, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22ddbaed-8cfd-5e25-8280-d7acaee8d94a", "parentControlId": 32006, "controlId": "CIP-004-7 1.1", "title": "CIP-004-7 1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589998" }, { "id": 603182, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ed0625c-9746-590e-8b04-7a7afb338675", "parentControlId": 32006, "controlId": "CIP-004-7 R2", "title": "CIP-004-7 R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589998" }, { "id": 603183, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9388b91e-63c2-554e-a6c5-1c589be72dcf", "parentControlId": 32006, "controlId": "CIP-004-7 2.1.1", "title": "CIP-004-7 2.1.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589998" }, { "id": 603184, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cfbed08-c32e-5067-b977-8eaa35895099", "parentControlId": 32006, "controlId": "CIP-004-7 2.1.2", "title": "CIP-004-7 2.1.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589998" }, { "id": 603185, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "587703e6-6712-55f9-8c6e-a30f643ad851", "parentControlId": 32006, "controlId": "CIP-004-7 2.1.3", "title": "CIP-004-7 2.1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589998" }, { "id": 603186, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d6beee3-fe68-5f34-ba06-6198191deb36", "parentControlId": 32006, "controlId": "CIP-004-7 2.1.4", "title": "CIP-004-7 2.1.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589998" }, { "id": 603187, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6577afdc-1a25-5ab7-9bfa-9a79b12fea68", "parentControlId": 32006, "controlId": "CIP-004-7 2.1.5", "title": "CIP-004-7 2.1.5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589998" }, { "id": 603188, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3436cda2-f980-5555-aac0-06d572ed90b8", "parentControlId": 32006, "controlId": "CIP-004-7 2.1.6", "title": "CIP-004-7 2.1.6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589998" }, { "id": 603189, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589998", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d17ec1d-1930-55f1-b2ea-d5b499efddea", "parentControlId": 32006, "controlId": "CIP-004-7 2.1.7", "title": "CIP-004-7 2.1.7", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589998" }, { "id": 603190, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.589999", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4665897c-bdbc-5d4f-8288-edc1d24629e4", "parentControlId": 32006, "controlId": "CIP-004-7 2.1.8", "title": "CIP-004-7 2.1.8", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.589999" }, { "id": 603191, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "089366de-a0d6-57b7-ab71-74bf845f3e8f", "parentControlId": 32006, "controlId": "CIP-004-7 2.1.9", "title": "CIP-004-7 2.1.9", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590007" }, { "id": 603192, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e01b53a-c938-54b9-b1e0-4e1a4f6426a1", "parentControlId": 32006, "controlId": "CIP-004-7 2.2", "title": "CIP-004-7 2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590007" }, { "id": 603193, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75c5b4fa-c741-5151-9da2-93524811a03f", "parentControlId": 32006, "controlId": "§117.12(e)", "title": "§117.12(e)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590007" }, { "id": 603194, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9af04c4-6f2c-5f27-8bfb-19fe85b1b633", "parentControlId": 32006, "controlId": "§117.12(i)", "title": "§117.12(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590007" }, { "id": 603195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5473aabe-2783-57f3-aa9a-0d48b99c35fc", "parentControlId": 32006, "controlId": "§117.12(j)", "title": "§117.12(j)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590007" }, { "id": 603196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "412d876a-9256-5a02-9800-269f2e1a3edd", "parentControlId": 32006, "controlId": "§117.12(k)", "title": "§117.12(k)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590007" }, { "id": 603197, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590008", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f87ae777-beea-5a1e-8130-ae97c10a64ea", "parentControlId": 32006, "controlId": "§117.12(l)", "title": "§117.12(l)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590008" }, { "id": 603228, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590011", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd152613-f6d5-5dbc-9125-b2d18eaa9ab7", "parentControlId": 32006, "controlId": "B6", "title": "B6", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590011" }, { "controlId": "C.10.2", "title": "C.10.2 — Awareness Training", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AT-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "141675b0-8e18-56f5-ae2e-c77e035d618f", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.2", "title": "NEI 08-09 App E.10.2 — Awareness Training", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "067161d5-db88-5494-ba47-f945e7a77592", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(2)", "title": "10 CFR 73.54(d)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.10.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "a9269d7c-9532-5092-a02c-d59be853bda8", "isPublic": true }, { "controlId": "C.10.7", "title": "C.10.7 — Feedback", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AT-2, AT-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "f1f1191c-2a60-51bd-a12d-05357561fbdd", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.7", "title": "NEI 08-09 App E.10.7 — Feedback", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "dff6d01f-ccee-5a41-9e26-841f96a61a53", "isPublic": true }, { "controlId": "CIP-004-7-R1", "title": "CIP-004-7-R1 — Security Awareness Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "65fc87e5-1b16-527d-bbad-c33445a48bad", "isPublic": true }, { "controlId": "CIP-004-7-1.1", "title": "CIP-004-7-1.1 — Security awareness that, at least once each calendar quarter, reinforces cyber security practices (which may include...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a7448eef-9e04-5049-b875-ba30054a257b", "isPublic": true }, { "controlId": "CIP-004-7-R2", "title": "CIP-004-7-R2 — Cyber Security Training Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3572781e-fcb7-5281-ac16-bf8d3b65b2bb", "isPublic": true }, { "controlId": "CIP-004-7-2.1", "title": "CIP-004-7-2.1 — Training content on: 2.1.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6c56ef0c-9edd-5fcf-aa72-98ac5decc3c5", "isPublic": true }, { "controlId": "CIP-004-7-2.1.1", "title": "CIP-004-7-2.1.1 — Cyber security policies", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "235dedc3-72fe-53c5-92f9-890f6f6b84e8", "isPublic": true }, { "controlId": "CIP-004-7-2.1.2", "title": "CIP-004-7-2.1.2 — Physical access controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "77016e02-0315-5f0e-b095-35049c7bb616", "isPublic": true }, { "controlId": "CIP-004-7-2.1.3", "title": "CIP-004-7-2.1.3 — Electronic access controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9d9e656c-6e4e-5529-b547-508a23f62401", "isPublic": true }, { "controlId": "CIP-004-7-2.1.4", "title": "CIP-004-7-2.1.4 — The visitor control program", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "69af7d09-628b-5bd8-8524-eec0174cceec", "isPublic": true }, { "controlId": "CIP-004-7-2.1.5", "title": "CIP-004-7-2.1.5 — Handling of BES Cyber System Information and its storage", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b245e3b9-b0aa-57d5-9da0-6b9332a4972b", "isPublic": true }, { "controlId": "CIP-004-7-2.1.6", "title": "CIP-004-7-2.1.6 — Identification of a Cyber Security Incident and initial notifications in accordance with the entity’s incident respon...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "50bb99d6-deb8-5a8b-b7a1-8141a90909ab", "isPublic": true }, { "controlId": "CIP-004-7-2.1.7", "title": "CIP-004-7-2.1.7 — Recovery plans for BES Cyber Systems", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3fa4db56-dd6d-52e0-9256-d8b0e0442d9c", "isPublic": true }, { "controlId": "CIP-004-7-2.1.8", "title": "CIP-004-7-2.1.8 — Response to Cyber Security Incidents", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "975c0cda-37a0-59ea-aeaf-ce886b595c7c", "isPublic": true }, { "controlId": "CIP-004-7-2.1.9", "title": "CIP-004-7-2.1.9 — Cyber security risks associated with a BES Cyber System’s electronic interconnectivity and interoperability with othe...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "43d693f0-f618-5f3e-8eee-29cc56ec139e", "isPublic": true }, { "controlId": "CIP-004-7-2.2", "title": "CIP-004-7-2.2 — Require completion of the training specified in Part 2.1 prior to granting authorized electronic access and authorize...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a30c30c5-4f85-58f9-a493-08f783b87e88", "isPublic": true }, { "controlId": "CIP-004-7-2.3", "title": "CIP-004-7-2.3 — Require completion of the training specified in Part 2.1 at least once every 15 calendar months.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ea075cb9-5f2b-50d4-b0da-bcdad6a92041", "isPublic": true }, { "controlId": "NSS-17T-Sec4.4", "title": "NSS-17T-Sec4.4 — Nuclear Computer Security Culture, Awareness & Specialized Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7a8c70b0-c674-52c3-babd-7d777b99bbd2", "isPublic": true }, { "controlId": "IEC-62645-5.2.3", "title": "IEC-62645-5.2.3 — Competence, Awareness, and Role-Based I&C Security Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "d967ca74-8adf-5e30-aa79-54fc25fec6e2", "isPublic": true }, { "controlId": "IEC-63096-7.2", "title": "IEC-63096-7.2 — Cyber Security Awareness, Education, and Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "fe1e88c7-daa2-5b5d-8074-b0ff0af8b47e", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3.4", "title": "REGDOC-2.12.1-Sec3.4 — Security Awareness and Technical Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "7f51de36-1468-5c0a-8163-b16bc803e72a", "isPublic": true } ], "id": 32006, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731327", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731327", "catalogueId": 1062, "uuid": "e2aed6a9-8845-5736-8a8a-17c4504cd712", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Security, Compliance & Resilience Awareness Training", "description": "

Control Description

Mechanisms exist to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.

Evidence Request List (ERL)

E-SAT-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Security Awareness & Training (SAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security awareness and training-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Security awareness and training methods are often generic, without organization-specific content.

Level 2 - Planned & Tracked: Security Awareness & Training (SAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security Awareness & Training-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security Awareness & Training may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Users are educated on their responsibilities to protect TAASD assigned to them or under their supervision.\n▪ IT and/or cybersecurity personnel create/govern security and awareness training to meet specific statutory, regulatory and/or contractual compliance obligations.

Level 3 - Well Defined: Security Awareness & Training (SAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are well-documented and kept current by process owners.\n▪ A security awareness & training team, or similar function, is appropriately staffed and supported to implement and maintain SAT domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security awareness and training management (e.g., Computer Based Learning (CBL) solutions, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide all employees and contractors appropriate security, compliance and resilience awareness education and training that is relevant for their job function.

Level 4 - Quantitatively Controlled: Security Awareness & Training (SAT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.10.2, C.10.7
NERC-CIP (2026) Requirements: CIP-004-7-R1, CIP-004-7-R2", "controlId": "SAT-02", "family": "Security Awareness & Training", "enhancements": "", "sortId": "SAT-02", "references": "

Micro-Small Business (<10 staff)

∙ Initial & annual security, compliance and resilience awareness training\n∙ KnowB4 (https://knowbe4.com)

Small Business (10-49 staff)

∙ Initial & annual security, compliance and resilience awareness training\n∙ KnowB4 (https://knowbe4.com)

Medium Business (50-249 staff)

∙ Initial & annual security, compliance and resilience awareness training\n∙ KnowB4 (https://knowbe4.com)

Large Business (250-999 staff)

∙ Initial & annual security, compliance and resilience awareness training\n∙ KnowB4 (https://knowbe4.com)

Enterprise (>1,000 staff)

∙ Initial & annual security, compliance and resilience awareness training\n∙ KnowB4 (https://knowbe4.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74093, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591213", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591213", "securityControlId": 32007, "ccis": [], "uuid": "3f2ba5b8-526a-543d-8ad5-dac0229239b9", "testId": "SAT-02.1_A01", "test": "practical exercises are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.2.2e[a]", "defaultText": null }, { "id": 74094, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591213", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591213", "securityControlId": 32007, "ccis": [], "uuid": "33948e03-4091-5d2c-9db3-e1a52fdf6d7c", "testId": "SAT-02.1_A02", "test": "current threat scenarios are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.2.2e[b]", "defaultText": null }, { "id": 74095, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591213", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591213", "securityControlId": 32007, "ccis": [], "uuid": "a06ccc8e-3f82-5f1d-baa5-9f7e5c765666", "testId": "SAT-02.1_A03", "test": "practical exercises in literacy training that simulate events and incidents are provided.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_AT-02(01)", "defaultText": null }, { "id": 74096, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591214", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591214", "securityControlId": 32007, "ccis": [], "uuid": "0680e484-b9e4-5cc9-b8a8-50ddc9924da9", "testId": "SAT-02.1_A04", "test": "individuals involved in training and their supervisors are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.2.2e[c]", "defaultText": null }, { "id": 74097, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591214", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591214", "securityControlId": 32007, "ccis": [], "uuid": "fa58882e-c980-5e49-ba08-652a9dc6dc01", "testId": "SAT-02.1_A05", "test": "practical exercises that are aligned with current threat scenarios are included in awareness training for roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.2.2e[d]", "defaultText": null }, { "id": 74098, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591214", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591214", "securityControlId": 32007, "ccis": [], "uuid": "f7691f1e-0b17-5348-bd7f-9e81bb048690", "testId": "SAT-02.1_A06", "test": "frequency at which to provide feedback on organizational training results is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AT-06_ODP[01]", "defaultText": null }, { "id": 74099, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591214", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591214", "securityControlId": 32007, "ccis": [], "uuid": "947ea478-a522-5a24-9c11-0f70ab1111d1", "testId": "SAT-02.1_A07", "test": "personnel to whom feedback on organizational training results will be provided is/are assigned.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AT-06_ODP[02]", "defaultText": null }, { "id": 74100, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591214", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591214", "securityControlId": 32007, "ccis": [], "uuid": "e3aba953-154f-5db2-833b-01724f7e0c02", "testId": "SAT-02.1_A08", "test": "feedback on organizational training results is provided organization-defined frequency to organization-defined personnel.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AT-06\n172A_3.2.2e[e]", "defaultText": null } ], "externalMappings": [ { "id": 603271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "339830cc-8cc3-5d24-8bdb-e75defce5dfc", "parentControlId": 32007, "controlId": "AT-2(1)", "title": "AT-2(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590017" }, { "id": 603272, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ba328e3-f1ea-515c-a11b-838add8f2565", "parentControlId": 32007, "controlId": "AT-02(01)", "title": "AT-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590017" }, { "id": 603273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8cfc850a-d29f-57de-b3c7-ad08ebbeb670", "parentControlId": 32007, "controlId": "AT-06", "title": "AT-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590017" }, { "id": 603274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "afc108e9-da25-533c-b341-e31a68c7edac", "parentControlId": 32007, "controlId": "AT-02(01)", "title": "AT-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590018" }, { "id": 603275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "840b7aed-7ac7-512d-8c6c-34f223a57703", "parentControlId": 32007, "controlId": "AT-06", "title": "AT-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590018" }, { "id": 603277, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590018", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07f3184c-5d4c-553d-8c71-de94b21df0b6", "parentControlId": 32007, "controlId": "AT-2(1)", "title": "AT-2(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590018" } ], "id": 32007, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731328", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731328", "catalogueId": 1062, "uuid": "2d49fe3a-1f59-5888-b9e3-956110438940", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization include simulated actual cyber-attacks through practical exercises that are aligned with current threat scenarios?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Simulated Cyber Attack Scenario Training", "description": "

Control Description

Mechanisms exist to include simulated actual cyber-attacks through practical exercises that are aligned with current threat scenarios.

Evidence Request List (ERL)

E-SAT-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Security Awareness & Training (SAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security awareness and training-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Security awareness and training methods are often generic, without organization-specific content.

Level 2 - Planned & Tracked: Security Awareness & Training (SAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security Awareness & Training-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security Awareness & Training may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Security Awareness & Training (SAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are well-documented and kept current by process owners.\n▪ A security awareness & training team, or similar function, is appropriately staffed and supported to implement and maintain SAT domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security awareness and training management (e.g., Computer Based Learning (CBL) solutions, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to include simulated actual cyber-attacks through practical exercises that are aligned with current threat scenarios.

Level 4 - Quantitatively Controlled: Security Awareness & Training (SAT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SAT-02.1", "family": "Security Awareness & Training", "enhancements": "", "sortId": "SAT-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Provide basic insider threat awareness information to staff

Small Business (10-49 staff)

∙ Insider threat awareness training module

Medium Business (50-249 staff)

∙ Formal insider threat awareness program\n∙ Annual training for all staff

Large Business (250-999 staff)

∙ Enterprise insider threat awareness and behavior monitoring program

Enterprise (>1,000 staff)

∙ Enterprise insider threat program (NITTF-aligned)\n∙ Dedicated insider threat team\n∙ UEBA for behavioral monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74101, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591214", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591214", "securityControlId": 32008, "ccis": [], "uuid": "f0388e6e-13b2-5807-bdb6-ff7362dbaae0", "testId": "SAT-02.2_A01", "test": "threats from social engineering, advanced persistent threat actors, breaches and suspicious behaviors are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.2.1e[a]", "defaultText": null }, { "id": 74102, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591215", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591215", "securityControlId": 32008, "ccis": [], "uuid": "62183c6c-8e3c-59cb-836f-e3aed7dc8c8f", "testId": "SAT-02.2_A02", "test": "security literacy training is provided to system users on recognizing indicators of social engineering.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_AT-02(03)[01]\n172A_3.2.1e[b]\n171A_R3_A.03.02.01.a.03[03]", "defaultText": null }, { "id": 74103, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591215", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591215", "securityControlId": 32008, "ccis": [], "uuid": "7f9ecb4e-0dcf-555c-900e-9179fd18e293", "testId": "SAT-02.2_A03", "test": "security literacy training is provided to system users on reporting indicators of social engineering.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_AT-02(03)[02]\n172A_3.2.1e[b]\n171A_R3_A.03.02.01.a.03[04]", "defaultText": null }, { "id": 74104, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591215", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591215", "securityControlId": 32008, "ccis": [], "uuid": "6ec9fa4f-2c0b-5db3-b47f-29c6f5fb9208", "testId": "SAT-02.2_A04", "test": "security literacy training is provided to system users on recognizing indicators of social mining.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_AT-02(03)[03]\n172A_3.2.1e[b]\n171A_R3_A.03.02.01.a.03[05]", "defaultText": null }, { "id": 74105, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591215", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591215", "securityControlId": 32008, "ccis": [], "uuid": "67325b9c-b2ab-5770-9b0a-8f319af9c081", "testId": "SAT-02.2_A05", "test": "security literacy training is provided to system users on reporting indicators of social mining.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_AT-02(03)[04]\n172A_3.2.1e[b]\n171A_R3_A.03.02.01.a.03[06]", "defaultText": null }, { "id": 74106, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591215", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591215", "securityControlId": 32008, "ccis": [], "uuid": "da7f26b8-44aa-5807-b28c-5ae23b0e410f", "testId": "SAT-02.2_A06", "test": "significant changes to the threats from social engineering, advanced persistent threat actors, breaches and suspicious behaviors are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.2.1e[c]", "defaultText": null }, { "id": 74107, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591215", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591215", "securityControlId": 32008, "ccis": [], "uuid": "e580e067-897a-5c42-a61a-2bd405b9b405", "testId": "SAT-02.2_A07", "test": "awareness training is updated per an organization-defined frequency or when there are significant changes to the threat.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "172A_3.2.1e[d]", "defaultText": null } ], "externalMappings": [ { "id": 603291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c123690-356b-5bc4-a2b6-a4687f2e1f44", "parentControlId": 32008, "controlId": "AT-02(03)", "title": "AT-02(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59002" }, { "id": 603292, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "973689fe-5ad3-5d9a-9f02-1b8f5f1aa89b", "parentControlId": 32008, "controlId": "AT-02(03)", "title": "AT-02(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59002" }, { "id": 603293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ac15aac-21de-5259-9973-fc23c02f4ba1", "parentControlId": 32008, "controlId": "AT-02(03)", "title": "AT-02(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59002" }, { "id": 603294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ff8770a-2a67-54e1-a7a3-fc2433ebe4eb", "parentControlId": 32008, "controlId": "AT-02(03)", "title": "AT-02(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59002" }, { "id": 603295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45b2bf01-275b-5b31-827b-0703a3fe576b", "parentControlId": 32008, "controlId": "AT-02(03)", "title": "AT-02(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59002" }, { "id": 603297, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "294ab20c-6400-5fa4-af78-0fba01bb9f1b", "parentControlId": 32008, "controlId": "AT-2(3)", "title": "AT-2(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59002" }, { "id": 603299, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59002", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3cbb747b-a977-567f-86df-a149d9075ecc", "parentControlId": 32008, "controlId": "03.02.01.a.03", "title": "03.02.01.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59002" } ], "id": 32008, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731328", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731328", "catalogueId": 1062, "uuid": "786e683e-d9ad-542b-97a7-944cd4bc4b35", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization include awareness training on recognizing and reporting potential and actual instances of social engineering and social mining?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Social Engineering & Mining", "description": "

Control Description

Mechanisms exist to include awareness training on recognizing and reporting potential and actual instances of social engineering and social mining.

Evidence Request List (ERL)

E-SAT-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Security Awareness & Training (SAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security awareness and training-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Security awareness and training methods are often generic, without organization-specific content.

Level 2 - Planned & Tracked: Security Awareness & Training (SAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security Awareness & Training-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security Awareness & Training may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Users are educated on their responsibilities to protect TAASD assigned to them or under their supervision.\n▪ IT and/or cybersecurity personnel create/govern security and awareness training to meet specific statutory, regulatory and/or contractual compliance obligations.\n▪ Privileged users receive formal security and/or data privacy awareness training to ensure they understand their unique roles and responsibilities.\n▪ The responsibility for training users and enforcing policies may be assigned to user’s immediate supervisor(s)/manager(s), including the definition and enforcement of the user’s specific role(s) and responsibilities.\n▪ Security awareness and training methods are role-based (e.g., handling sensitive/regulated data).

Level 3 - Well Defined: Security Awareness & Training (SAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are well-documented and kept current by process owners.\n▪ A security awareness & training team, or similar function, is appropriately staffed and supported to implement and maintain SAT domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security awareness and training management (e.g., Computer Based Learning (CBL) solutions, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to include awareness training on recognizing and reporting potential and actual instances of social engineering and social mining.

Level 4 - Quantitatively Controlled: Security Awareness & Training (SAT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SAT-02.2", "family": "Security Awareness & Training", "enhancements": "", "sortId": "SAT-02.2", "references": "

Micro-Small Business (<10 staff)

∙ Train staff to recognize and report suspicious behavior

Small Business (10-49 staff)

∙ Security awareness training including insider threat recognition

Medium Business (50-249 staff)

∙ Formal security awareness program including insider threat indicators

Large Business (250-999 staff)

∙ Enterprise security awareness program with insider threat focus\n∙ Reporting hotline

Enterprise (>1,000 staff)

∙ Enterprise security culture program\n∙ Anonymous reporting hotline\n∙ Insider threat training integration\n∙ Regular awareness campaigns", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74108, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591216", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591216", "securityControlId": 32009, "ccis": [], "uuid": "b1e66f01-16d2-5071-bcc4-cbf2c68cff2d", "testId": "SAT-03_A01", "test": "roles and responsibilities for role-based cybersecurity / data privacy training are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AT-03_ODP[01]\n53A_R5_AT-03_ODP[02]\n171A_3.2.2[a]\n171A_3.2.2[b]", "defaultText": null }, { "id": 74109, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591216", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591216", "securityControlId": 32009, "ccis": [], "uuid": "9b2f05e6-2ead-529a-af0a-3d0c5d1a834d", "testId": "SAT-03_A02", "test": "events that require role-based security training content updates are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AT-03_ODP[05]\n171A_R3_A.03.02.02.ODP[04]", "defaultText": null }, { "id": 74110, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591216", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591216", "securityControlId": 32009, "ccis": [], "uuid": "344e25f0-b249-5763-8db8-31a28e22047f", "testId": "SAT-03_A03", "test": "role-based cybersecurity / data privacy training is provided to organizational personnel before authorizing access to the system or sensitive / regulated data.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_AT-03a.01[01]\n171A_3.2.2[c]", "defaultText": null }, { "id": 74111, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591216", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591216", "securityControlId": 32009, "ccis": [], "uuid": "467677be-8b76-5719-9350-01d81f048b57", "testId": "SAT-03_A04", "test": "role-based security training is provided to organizational personnel before performing assigned duties.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_AT-03a.01[02]\n171A_R3_A.03.02.02.a.01[02]", "defaultText": null }, { "id": 74112, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591216", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591216", "securityControlId": 32009, "ccis": [], "uuid": "0f664ce9-7c17-55eb-afba-afe7d5b371bb", "testId": "SAT-03_A05", "test": "role-based cybersecurity / data privacy training is provided to organizational personnel per an organization-defined frequency after initial training.
PPTDF Applicability: People
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_AT-03a.01[03]\n53A_R5_AT-03a.01[04]\n171A_3.2.2[c]", "defaultText": null }, { "id": 74113, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591217", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591217", "securityControlId": 32009, "ccis": [], "uuid": "4bd2794c-9e91-5dd0-8c0f-a6f0acde0712", "testId": "SAT-03_A06", "test": "role-based cybersecurity / data privacy training is provided to organizational personnel when required by system changes or following organization-defined events.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_AT-03a.02[01]\n53A_R5_AT-03a.02[02]\n171A_3.2.2[c]", "defaultText": null }, { "id": 74114, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591217", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591217", "securityControlId": 32009, "ccis": [], "uuid": "45babfb4-4b13-5c83-93d0-8fd13b03d498", "testId": "SAT-03_A07", "test": "the frequency at which to provide role-based security training to assigned personnel after initial training is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least annually", "otherId": "53A_R5_AT-03_ODP[03]\n171A_R3_A.03.02.02.ODP[01]", "defaultText": null }, { "id": 74115, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591217", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591217", "securityControlId": 32009, "ccis": [], "uuid": "bfe20b73-442d-5829-9089-4dd02d1e13b9", "testId": "SAT-03_A08", "test": "the frequency at which to update role-based security training content is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least annually", "otherId": "53A_R5_AT-03_ODP[04]\n171A_R3_A.03.02.02.ODP[03]", "defaultText": null }, { "id": 74116, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591217", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591217", "securityControlId": 32009, "ccis": [], "uuid": "96bbd7f3-b021-57eb-a941-1f83be491d46", "testId": "SAT-03_A09", "test": "role-based security training content is updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_AT-03b.[01]", "defaultText": null }, { "id": 74117, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591218", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591218", "securityControlId": 32009, "ccis": [], "uuid": "03c9e218-1c75-53be-b66f-40243e069b9f", "testId": "SAT-03_A10", "test": "role-based security training content is updated following organization-defined events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AT-03b.[02]", "defaultText": null }, { "id": 74118, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591218", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591218", "securityControlId": 32009, "ccis": [], "uuid": "d283e5f4-2791-549f-8d8f-b719393a6605", "testId": "SAT-03_A11", "test": "lessons learned from internal or external security incidents or breaches are incorporated into role-based training.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AT-03c.", "defaultText": null }, { "id": 74119, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591218", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591218", "securityControlId": 32009, "ccis": [], "uuid": "4bbe84a8-8a91-504a-bfd0-a354d19e1be8", "testId": "SAT-03_A12", "test": "events that require role-based security training are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.02.02.ODP[02]", "defaultText": null }, { "id": 74120, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591218", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591218", "securityControlId": 32009, "ccis": [], "uuid": "dcbff7f3-815e-5eca-bbc3-46c57e6788f8", "testId": "SAT-03_A13", "test": "incident response training for system users consistent with assigned roles and responsibilities is provided within an organization-defined time period of assuming an incident response role or responsibility or acquiring system access.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 74121, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591218", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591218", "securityControlId": 32009, "ccis": [], "uuid": "554b86e7-d817-55ca-9ba6-39f8fa02465e", "testId": "SAT-03_A14", "test": "incident response training for system users consistent with assigned roles and responsibilities is provided when required by system changes.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "171A_R3_A.03.06.04.a.02", "defaultText": null }, { "id": 74122, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591218", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591218", "securityControlId": 32009, "ccis": [], "uuid": "b4e6926f-47b6-5864-81b0-a5cdb15d4363", "testId": "SAT-03_A15", "test": "incident response training for system users consistent with assigned roles and responsibilities is provided per an organization-defined frequency thereafter.
PPTDF Applicability: People
Assessment Rigor: 3
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "SCF Created", "defaultText": null }, { "id": 74123, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591219", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591219", "securityControlId": 32009, "ccis": [], "uuid": "5ec7345a-6215-5247-a70d-322804e893d0", "testId": "SAT-03_A16", "test": "role-based security training is provided to organizational personnel before authorizing access to the system or CUI.
PPTDF Applicability: People
Assessment Rigor: NIST 800-171", "otherId": "171A_R3_A.03.02.02.a.01[01]", "defaultText": null }, { "id": 74124, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591219", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591219", "securityControlId": 32009, "ccis": [], "uuid": "4cbe3e40-579a-5bc7-bf87-bba18f4327a5", "testId": "SAT-03_A17", "test": "role-based security training is provided to organizational personnel after initial training.
PPTDF Applicability: People
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months", "otherId": "171A_R3_A.03.02.02.a.01[03]", "defaultText": null }, { "id": 74125, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591219", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591219", "securityControlId": 32009, "ccis": [], "uuid": "571dcd6f-a4b4-504b-8946-5374830ec951", "testId": "SAT-03_A18", "test": "role-based security training is provided to organizational personnel when required by system changes or following .
PPTDF Applicability: People
Assessment Rigor: NIST 800-171
SCF Defined Parameters: significant, novel incidents, or significant changes to risks", "otherId": "171A_R3_A.03.02.02.a.02", "defaultText": null }, { "id": 74126, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591219", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591219", "securityControlId": 32009, "ccis": [], "uuid": "c7ded085-2d7c-5541-b52a-5989ac3cc099", "testId": "SAT-03_A19", "test": "role-based security training content is updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months", "otherId": "A.03.02.02.b[01]", "defaultText": null }, { "id": 74127, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591219", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591219", "securityControlId": 32009, "ccis": [], "uuid": "05b4b049-be80-52e5-8f74-0ad4f3a8792d", "testId": "SAT-03_A20", "test": "role-based security training content is updated following .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: significant, novel incidents, or significant changes to risks", "otherId": "A.03.02.02.b[02]", "defaultText": null }, { "id": 74128, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59122", "securityControlId": 32009, "ccis": [], "uuid": "0cf5f14b-a3b3-5aad-9e05-88105304632f", "testId": "SAT-03_A21", "test": "incident response training for system users consistent with assigned roles and responsibilities is provided within of assuming an incident response role or responsibility or acquiring system access.
PPTDF Applicability: People
Assessment Rigor: NIST 800-171
SCF Defined Parameters: ten (10) days for privileged users, thirty (30) days for all other roles", "otherId": "171A_R3_A.03.06.04.a.01", "defaultText": null }, { "id": 74129, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59122", "securityControlId": 32009, "ccis": [], "uuid": "1ad6a5bb-28b3-59a2-89cc-6030b07b4361", "testId": "SAT-03_A22", "test": "incident response training for system users consistent with assigned roles and responsibilities is provided thereafter.
PPTDF Applicability: People
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months", "otherId": "171A_R3_A.03.06.04.a.03", "defaultText": null } ], "externalMappings": [ { "id": 603357, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590027", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09b8c79b-1eee-50ed-91e9-d17f21acb727", "parentControlId": 32009, "controlId": "ORG 1.5", "title": "ORG 1.5", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590027" }, { "id": 603358, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590027", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c664b209-0e6f-5b5f-bc1e-858914bddc13", "parentControlId": 32009, "controlId": "SM-4", "title": "SM-4", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590027" }, { "id": 603362, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590028", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4dfa1f78-532f-55e7-8a0d-79b2d236d263", "parentControlId": 32009, "controlId": "5.4", "title": "5.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590028" }, { "id": 603363, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590028", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b39e93c3-a40a-567c-8995-2a1c2f55915c", "parentControlId": 32009, "controlId": "6.3", "title": "6.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590028" }, { "id": 603375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "295ff8d1-e7b2-5fdb-9145-8b356e1a3e13", "parentControlId": 32009, "controlId": "AT-3", "title": "AT-3", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590029" }, { "id": 603376, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590029", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4319f07-201b-5ec9-8730-383490570fb7", "parentControlId": 32009, "controlId": "AT-03", "title": "AT-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590029" }, { "id": 603377, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4feeba40-a72a-5a29-9beb-9ef756442674", "parentControlId": 32009, "controlId": "AT-03(02)", "title": "AT-03(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59003" }, { "id": 603379, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f02ab963-c7ec-5a67-b3b4-ba7b367ca643", "parentControlId": 32009, "controlId": "AT-03", "title": "AT-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59003" }, { "id": 603381, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23dcc121-9fa0-57d2-a2f8-b6edbc1d1ca8", "parentControlId": 32009, "controlId": "AT-03", "title": "AT-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59003" }, { "id": 603382, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1039ad7-2749-54af-bdfd-09f866889807", "parentControlId": 32009, "controlId": "AT-03(02)", "title": "AT-03(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59003" }, { "id": 603383, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6acc4492-f236-546f-8808-2989d438f2a6", "parentControlId": 32009, "controlId": "AT-03", "title": "AT-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59003" }, { "id": 603384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b45c1a0-0934-584c-8052-c53b1f4ee7d3", "parentControlId": 32009, "controlId": "AT-03", "title": "AT-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59003" }, { "id": 603385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59003", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6161ac8b-05b0-593f-a323-37654a47b2de", "parentControlId": 32009, "controlId": "AT-03", "title": "AT-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59003" }, { "id": 603386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "718ebe04-4a82-56df-870a-e17c3673ffee", "parentControlId": 32009, "controlId": "AT-3", "title": "AT-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590031" }, { "id": 603387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4efd835-dc52-5ad5-87eb-361988994b69", "parentControlId": 32009, "controlId": "AT-3(2)", "title": "AT-3(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590031" }, { "id": 603388, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35eaca56-081d-514b-9f1b-ddfb4d91e058", "parentControlId": 32009, "controlId": "AT-3(6)", "title": "AT-3(6)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590031" }, { "id": 603389, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45a848bd-030c-5dbd-b259-2e55f043a0a7", "parentControlId": 32009, "controlId": "AT-3", "title": "AT-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590031" }, { "id": 603390, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79a1eacd-4043-5dbb-a8ad-2e6b75e3b502", "parentControlId": 32009, "controlId": "AT-3", "title": "AT-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590031" }, { "id": 603394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590031", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30352d9b-61a5-596a-9b1c-4d7a842144b3", "parentControlId": 32009, "controlId": "3.2.2", "title": "3.2.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590032" }, { "id": 603395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c2f6c2bc-fba9-5687-8fd3-ae2cab2c9eff", "parentControlId": 32009, "controlId": "03.01.22.a", "title": "03.01.22.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590032" }, { "id": 603396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87a4dd66-a15f-5bf9-bd99-83977ef3fcf4", "parentControlId": 32009, "controlId": "03.02.01.a.01", "title": "03.02.01.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590032" }, { "id": 603397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12a4e0ef-b3d1-5178-9665-7623b04216e3", "parentControlId": 32009, "controlId": "03.02.01.a.02", "title": "03.02.01.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590032" }, { "id": 603398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e726308-4657-58fa-804a-6cb7a1c3f713", "parentControlId": 32009, "controlId": "03.02.02.a", "title": "03.02.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590032" }, { "id": 603399, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "349fe750-1b8a-5384-8874-9d8a5f298c91", "parentControlId": 32009, "controlId": "03.02.02.a.01", "title": "03.02.02.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590032" }, { "id": 603400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "098571c6-b260-55a0-ad6a-7300b2b01ed9", "parentControlId": 32009, "controlId": "03.02.02.a.02", "title": "03.02.02.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590032" }, { "id": 603401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a07f2b0-5b1f-5e4c-9149-7b8664bcd001", "parentControlId": 32009, "controlId": "03.02.02.b", "title": "03.02.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590032" }, { "id": 603402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd3a3224-59b7-5184-ab71-f27d8406140c", "parentControlId": 32009, "controlId": "03.06.04.a", "title": "03.06.04.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590032" }, { "id": 603403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b82ffee-d02a-533a-9962-7611d2b60af6", "parentControlId": 32009, "controlId": "03.06.04.a.01", "title": "03.06.04.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590032" }, { "id": 603404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590033", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "795b7da7-59c3-5a77-99b1-936e52e4d06b", "parentControlId": 32009, "controlId": "03.06.04.a.02", "title": "03.06.04.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590033" }, { "id": 603405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590033", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1adb7d61-1ed9-54e1-88a6-00c425673ba2", "parentControlId": 32009, "controlId": "03.06.04.b", "title": "03.06.04.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590033" }, { "id": 603424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0634ea20-db0f-56ab-bd02-b5e927d20a1e", "parentControlId": 32009, "controlId": "PR.AT", "title": "PR.AT", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590035" }, { "id": 603425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1f5fec2-495d-5732-b8e3-f747e0dd3dcb", "parentControlId": 32009, "controlId": "PR.AT-01", "title": "PR.AT-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590035" }, { "id": 603426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db413742-b5e7-5edc-bc1d-780b10e28ac2", "parentControlId": 32009, "controlId": "PR.AT-02", "title": "PR.AT-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590035" }, { "id": 603512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d53407f4-1bf1-5d44-9361-0098826fdc20", "parentControlId": 32009, "controlId": "WORKFORCE-2e", "title": "WORKFORCE-2e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590045" }, { "id": 603513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c617b456-ab30-5817-9361-146f0d6158da", "parentControlId": 32009, "controlId": "WORKFORCE-2f", "title": "WORKFORCE-2f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590045" }, { "id": 603514, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fc3c233-8c5a-5804-ac43-1a12d21b0e2a", "parentControlId": 32009, "controlId": "WORKFORCE-4a", "title": "WORKFORCE-4a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590045" }, { "id": 603537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0999b6a-295b-5be9-8115-f94ac6dd0bee", "parentControlId": 32009, "controlId": "CIP-004-7 2.2", "title": "CIP-004-7 2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590056" }, { "id": 603538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "47136931-5267-51e9-9246-34ae5d2f6366", "parentControlId": 32009, "controlId": "CIP-004-7 2.3", "title": "CIP-004-7 2.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590056" }, { "id": 603539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17db1cd4-eaf6-5ef1-b9b3-1419d8f74bb9", "parentControlId": 32009, "controlId": "§117.12(a)", "title": "§117.12(a)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590056" }, { "id": 603540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f045311-be3f-567d-8bef-ca0b28de3e75", "parentControlId": 32009, "controlId": "§117.12(b)", "title": "§117.12(b)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590056" }, { "id": 603541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590056", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3900d248-2881-5977-a736-ed821366f092", "parentControlId": 32009, "controlId": "§117.12(e)(6)", "title": "§117.12(e)(6)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590056" }, { "id": 603582, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590061", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba55d565-4055-5dec-8b17-9cf42e2caac0", "parentControlId": 32009, "controlId": "B6.b", "title": "B6.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590061" }, { "controlId": "A.3.1.2", "title": "A.3.1.2 — Cyber Security Team", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-2, PS-2, AT-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "7d4c1268-5aaa-5558-a006-cddb28654b1d", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.2", "title": "NEI 08-09 Sec 3.1.2 — Cyber Security Team", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "715a14d3-228f-531c-92da-c08df574ac59", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(1)", "title": "10 CFR 73.54(d)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "a315cdc2-708c-57b1-bdef-cfd91ab94412", "isPublic": true }, { "controlId": "C.8.2", "title": "C.8.2 — Incident Response Training", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: IR-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "214ecaf0-c9ce-5462-8b72-c86b460437d4", "isPublic": true }, { "controlId": "NEI 08-09 App E.8.2", "title": "NEI 08-09 App E.8.2 — Incident Response Training", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.8.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "1047405d-90b4-59f2-b2e0-0b4731bcd657", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(2)", "title": "10 CFR 73.54(d)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.8.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "dc44f4d3-79fd-5047-90ef-00a0521002c0", "isPublic": true }, { "controlId": "C.10.3", "title": "C.10.3 — Technical Training", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AT-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "db8c14b5-1c57-51a8-a595-ace4b727be3a", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.3", "title": "NEI 08-09 App E.10.3 — Technical Training", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "536185d0-46f3-53a4-91fa-e1f5aae317e6", "isPublic": true }, { "controlId": "C.10.4", "title": "C.10.4 — Specialized Cyber Security Training", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AT-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "f2d41e0f-4a13-5ffe-8a45-97d674d9dced", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.4", "title": "NEI 08-09 App E.10.4 — Specialized Cyber Security Training", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e1b82de8-bba9-530d-a75b-a46a29ea2cc2", "isPublic": true }, { "controlId": "C.10.5", "title": "C.10.5 — Cross-Functional Cyber Security Team", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-2, AT-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "2466253e-ec9e-57e8-836e-42b20e1137e7", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.5", "title": "NEI 08-09 App E.10.5 — Cross-Functional Cyber Security Team", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "03e8de53-73f5-5f9a-9520-cd1a37608431", "isPublic": true }, { "controlId": "C.10.7", "title": "C.10.7 — Feedback", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AT-2, AT-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "77b361fc-6fad-5355-a9d9-fa519df27f89", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.7", "title": "NEI 08-09 App E.10.7 — Feedback", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "99d00463-d9c9-5998-b84b-ac11cdcf18a5", "isPublic": true }, { "controlId": "CIP-004-7-R2", "title": "CIP-004-7-R2 — Cyber Security Training Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "fdd24b45-276a-5b47-bead-ff7790ffe7f8", "isPublic": true }, { "controlId": "CIP-004-7-2.1", "title": "CIP-004-7-2.1 — Training content on: 2.1.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "cfd571d1-0233-5a69-84af-f0c9e755837a", "isPublic": true }, { "controlId": "CIP-004-7-2.1.1", "title": "CIP-004-7-2.1.1 — Cyber security policies", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "445fe453-e9f9-5339-b6ac-fe6ab282f875", "isPublic": true }, { "controlId": "CIP-004-7-2.1.2", "title": "CIP-004-7-2.1.2 — Physical access controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d1e5c6d8-78ed-5c4f-8b91-490988b09973", "isPublic": true }, { "controlId": "CIP-004-7-2.1.3", "title": "CIP-004-7-2.1.3 — Electronic access controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e3d6e390-ccec-5668-b7c9-6bc894170b1f", "isPublic": true }, { "controlId": "CIP-004-7-2.1.4", "title": "CIP-004-7-2.1.4 — The visitor control program", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "979c22ee-ce05-532a-bd4c-944895da89ce", "isPublic": true }, { "controlId": "CIP-004-7-2.1.5", "title": "CIP-004-7-2.1.5 — Handling of BES Cyber System Information and its storage", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0b3ed525-5634-5c0f-ae0e-3ddbe17d32e6", "isPublic": true }, { "controlId": "CIP-004-7-2.1.6", "title": "CIP-004-7-2.1.6 — Identification of a Cyber Security Incident and initial notifications in accordance with the entity’s incident respon...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3d76c082-8d49-59b2-a041-f3e8c6181b6f", "isPublic": true }, { "controlId": "CIP-004-7-2.1.7", "title": "CIP-004-7-2.1.7 — Recovery plans for BES Cyber Systems", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ad125960-f0b1-501c-9cea-ca348104ea05", "isPublic": true }, { "controlId": "CIP-004-7-2.1.8", "title": "CIP-004-7-2.1.8 — Response to Cyber Security Incidents", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4f56c689-2566-539b-bb67-69e7dc5af3cd", "isPublic": true }, { "controlId": "CIP-004-7-2.1.9", "title": "CIP-004-7-2.1.9 — Cyber security risks associated with a BES Cyber System’s electronic interconnectivity and interoperability with othe...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "64282169-6c83-5b5d-af58-a10534a63c01", "isPublic": true }, { "controlId": "CIP-004-7-2.2", "title": "CIP-004-7-2.2 — Require completion of the training specified in Part 2.1 prior to granting authorized electronic access and authorize...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ceaa5ecb-a894-54a9-bbfc-9dd068e7d081", "isPublic": true }, { "controlId": "CIP-004-7-2.3", "title": "CIP-004-7-2.3 — Require completion of the training specified in Part 2.1 at least once every 15 calendar months.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8f994911-287c-55c9-a4bb-190a544613bd", "isPublic": true }, { "controlId": "NSS-17T-Sec4.4", "title": "NSS-17T-Sec4.4 — Nuclear Computer Security Culture, Awareness & Specialized Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "5d83ec04-147e-5751-8569-4750addc31df", "isPublic": true }, { "controlId": "IEC-62645-5.2.3", "title": "IEC-62645-5.2.3 — Competence, Awareness, and Role-Based I&C Security Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "fbb5eca7-ff20-5b67-af6b-56863f91ffcc", "isPublic": true }, { "controlId": "IEC-63096-7.2", "title": "IEC-63096-7.2 — Cyber Security Awareness, Education, and Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "dfd39528-0469-52b9-acab-5737716b90ba", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3.4", "title": "REGDOC-2.12.1-Sec3.4 — Security Awareness and Technical Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "7eb3d3de-cf7b-52f4-a52a-87e5d248811b", "isPublic": true } ], "id": 32009, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731328", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731328", "catalogueId": 1062, "uuid": "cca41821-8001-5835-9845-d15d18d77917", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafterystem changes; and \n (3) Annually thereafter?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Role-Based Security, Compliance & Resilience Training", "description": "

Control Description

Mechanisms exist to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.

Evidence Request List (ERL)

E-SAT-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Security Awareness & Training (SAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security awareness and training-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Security awareness and training methods are often generic, without organization-specific content.\n▪ IT/cybersecurity personnel self-manage their professional certification requirements to support their assigned duties.

Level 2 - Planned & Tracked: Security Awareness & Training (SAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security Awareness & Training-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security Awareness & Training may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Users are educated on their responsibilities to protect TAASD assigned to them or under their supervision.\n▪ IT and/or cybersecurity personnel create/govern security and awareness training to meet specific statutory, regulatory and/or contractual compliance obligations.\n▪ Privileged users receive formal security and/or data privacy awareness training to ensure they understand their unique roles and responsibilities.\n▪ The responsibility for training users and enforcing policies may be assigned to user’s immediate supervisor(s)/manager(s), including the definition and enforcement of the user’s specific role(s) and responsibilities.\n▪ Security awareness and training methods are role-based (e.g., handling sensitive/regulated data).

Level 3 - Well Defined: Security Awareness & Training (SAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are well-documented and kept current by process owners.\n▪ A security awareness & training team, or similar function, is appropriately staffed and supported to implement and maintain SAT domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security awareness and training management (e.g., Computer Based Learning (CBL) solutions, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide role-based security, compliance and resilience-related training: \n(1) Before authorizing access to the system or performing assigned duties; \n(2) When required by system changes; and \n(3) Annually thereafter.

Level 4 - Quantitatively Controlled: Security Awareness & Training (SAT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.2, C.8.2, C.10.3, C.10.4, C.10.5, C.10.7
NERC-CIP (2026) Requirements: CIP-004-7-R2", "controlId": "SAT-03", "family": "Security Awareness & Training", "enhancements": "", "sortId": "SAT-03", "references": "

Micro-Small Business (<10 staff)

∙ KnowB4 (https://knowbe4.com)

Small Business (10-49 staff)

∙ KnowB4 (https://knowbe4.com)

Medium Business (50-249 staff)

∙ KnowB4 (https://knowbe4.com)

Large Business (250-999 staff)

∙ KnowB4 (https://knowbe4.com)

Enterprise (>1,000 staff)

∙ KnowB4 (https://knowbe4.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74130, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59122", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59122", "securityControlId": 32010, "ccis": [], "uuid": "46b0382f-6e2d-562b-8797-7045a765ded2", "testId": "SAT-03.1_A01", "test": "practical exercises in cybersecurity / data privacy training that reinforce training objectives are provided.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AT-03(03)[01]\n53A_R5_AT-03(03)[02]", "defaultText": null } ], "externalMappings": [ { "id": 603627, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590067", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4059ab38-f1d8-5309-bdcc-9af404764f19", "parentControlId": 32010, "controlId": "AT-3(3)", "title": "AT-3(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590067" }, { "id": 603628, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590067", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "163c4045-9fb3-5591-babf-4697f025afd5", "parentControlId": 32010, "controlId": "AT-03(03)", "title": "AT-03(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590067" }, { "id": 603629, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590067", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ddebed5-ec1b-5a4c-bf78-77faacb79a66", "parentControlId": 32010, "controlId": "AT-03(03)", "title": "AT-03(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590067" }, { "controlId": "C.10.4", "title": "C.10.4 — Specialized Cyber Security Training", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AT-3", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "82235bad-2940-58d9-9c93-190ec267332d", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.4", "title": "NEI 08-09 App E.10.4 — Specialized Cyber Security Training", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d2243556-6ed9-5249-908b-efe302014beb", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(2)", "title": "10 CFR 73.54(d)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.10.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "8f2629aa-65c5-5ec3-bcf0-853accfe2907", "isPublic": true }, { "controlId": "NSS-17T-Sec4.4", "title": "NSS-17T-Sec4.4 — Nuclear Computer Security Culture, Awareness & Specialized Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "450a52ae-4023-5678-9fa8-842d47f4734c", "isPublic": true }, { "controlId": "IEC-62645-5.2.3", "title": "IEC-62645-5.2.3 — Competence, Awareness, and Role-Based I&C Security Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "a6882c14-d423-5f63-a95f-ef1234629abd", "isPublic": true }, { "controlId": "IEC-63096-7.2", "title": "IEC-63096-7.2 — Cyber Security Awareness, Education, and Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "846678a5-d384-5330-9cda-d0c4277c9dbb", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3.4", "title": "REGDOC-2.12.1-Sec3.4 — Security Awareness and Technical Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "5d8213c8-6731-5cba-8545-0d6b55abf905", "isPublic": true } ], "id": 32010, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731329", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731329", "catalogueId": 1062, "uuid": "50bbf641-0310-567b-a93b-a32beec6e3da", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization include practical exercises in security, compliance and resilience training that reinforce training objectives?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Practical Exercises", "description": "

Control Description

Mechanisms exist to include practical exercises in security, compliance and resilience training that reinforce training objectives.

Evidence Request List (ERL)

E-SAT-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Security Awareness & Training (SAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security awareness and training-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Security awareness and training methods are often generic, without organization-specific content.

Level 2 - Planned & Tracked: Security Awareness & Training (SAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security Awareness & Training-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security Awareness & Training may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Security Awareness & Training (SAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are well-documented and kept current by process owners.\n▪ A security awareness & training team, or similar function, is appropriately staffed and supported to implement and maintain SAT domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security awareness and training management (e.g., Computer Based Learning (CBL) solutions, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to include practical exercises in security, compliance and resilience training that reinforce training objectives.

Level 4 - Quantitatively Controlled: Security Awareness & Training (SAT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.10.4", "controlId": "SAT-03.1", "family": "Security Awareness & Training", "enhancements": "", "sortId": "SAT-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Provide security training specific to developers

Small Business (10-49 staff)

∙ Developer-specific secure coding training

Medium Business (50-249 staff)

∙ Formal secure coding training program for developers (e.g., OWASP training)

Large Business (250-999 staff)

∙ Enterprise developer security training (e.g., Secure Code Warrior, Checkmarx)\n∙ Security champions program

Enterprise (>1,000 staff)

∙ Enterprise developer security training platform (e.g., Secure Code Warrior, Veracode eLearning)\n∙ Security champions\n∙ Gamified training", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74131, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591221", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591221", "securityControlId": 32011, "ccis": [], "uuid": "9304703d-f9ed-5b52-b470-1e8813e0b42a", "testId": "SAT-03.2_A01", "test": "indicators of malicious code are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AT-02(04)_ODP", "defaultText": null }, { "id": 74132, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591221", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591221", "securityControlId": 32011, "ccis": [], "uuid": "98ca6164-f015-5b66-8d6a-448e911daad9", "testId": "SAT-03.2_A02", "test": "literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using organization-defined indicators of malicious code is provided.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AT-02(04)", "defaultText": null }, { "id": 74133, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591221", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591221", "securityControlId": 32011, "ccis": [], "uuid": "3a61df7c-7d0c-5cd1-9520-19f9f7bd07a0", "testId": "SAT-03.2_A03", "test": "literacy training on the advanced persistent threat is provided.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AT-02(05)", "defaultText": null } ], "externalMappings": [ { "id": 603646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76d3f110-cf84-5552-bbf1-2776ad89b990", "parentControlId": 32011, "controlId": "AT-3(4)", "title": "AT-3(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590069" }, { "id": 603647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9747ab03-20ec-5d9a-a585-891a27330e4d", "parentControlId": 32011, "controlId": "AT-02(04)", "title": "AT-02(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590069" }, { "id": 603648, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11ca004d-cdf1-5501-835e-38811b4ea5df", "parentControlId": 32011, "controlId": "AT-02(05)", "title": "AT-02(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590069" }, { "id": 603650, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "775db48d-4b30-56ab-aa87-bfa2e4c0edad", "parentControlId": 32011, "controlId": "AT-02(04)", "title": "AT-02(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590069" }, { "id": 603651, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5341ae4e-a87f-5ead-8f42-4d25a4fc26fd", "parentControlId": 32011, "controlId": "AT-02(05)", "title": "AT-02(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590069" }, { "id": 603652, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "492b61a1-1312-5d5a-bcc2-c29f9b4e5cd9", "parentControlId": 32011, "controlId": "AT-02(04)", "title": "AT-02(04)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59007" }, { "id": 603653, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8470e49-4667-55d1-9784-9bb212bf6b0d", "parentControlId": 32011, "controlId": "AT-02(04)", "title": "AT-02(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59007" }, { "id": 603655, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2cadcf6b-b8b4-5187-a46b-4f7be597db10", "parentControlId": 32011, "controlId": "AT-2(4)", "title": "AT-2(4)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59007" }, { "id": 603656, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59007", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0681bbda-7040-59c4-92ca-7427141be791", "parentControlId": 32011, "controlId": "AT-2(5)", "title": "AT-2(5)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59007" } ], "id": 32011, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731329", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731329", "catalogueId": 1062, "uuid": "e33a14a7-17f2-54bc-9667-9dfc95c12235", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide training to personnel on organization-defined indicators of malware to recognize suspicious communications and anomalous behavior?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Suspicious Communications & Anomalous System Behavior", "description": "

Control Description

Mechanisms exist to provide training to personnel on organization-defined indicators of malware to recognize suspicious communications and anomalous behavior.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Security Awareness & Training (SAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security awareness and training-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Security awareness and training methods are often generic, without organization-specific content.

Level 2 - Planned & Tracked: Security Awareness & Training (SAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security Awareness & Training-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security Awareness & Training may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Users are educated on their responsibilities to protect TAASD assigned to them or under their supervision.\n▪ IT and/or cybersecurity personnel create/govern security and awareness training to meet specific statutory, regulatory and/or contractual compliance obligations.\n▪ Privileged users receive formal security and/or data privacy awareness training to ensure they understand their unique roles and responsibilities.\n▪ The responsibility for training users and enforcing policies may be assigned to user’s immediate supervisor(s)/manager(s), including the definition and enforcement of the user’s specific role(s) and responsibilities.\n▪ Security awareness and training methods are role-based (e.g., handling sensitive/regulated data).\n▪ Security awareness training covers reporting of unauthorized alterations and evidence of tampering of equipment

Level 3 - Well Defined: Security Awareness & Training (SAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are well-documented and kept current by process owners.\n▪ A security awareness & training team, or similar function, is appropriately staffed and supported to implement and maintain SAT domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security awareness and training management (e.g., Computer Based Learning (CBL) solutions, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide training to personnel on organization-defined indicators of malware to recognize suspicious communications and anomalous behavior.

Level 4 - Quantitatively Controlled: Security Awareness & Training (SAT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SAT-03.2", "family": "Security Awareness & Training", "enhancements": "", "sortId": "SAT-03.2", "references": "

Micro-Small Business (<10 staff)

∙ Provide security training for system administrators

Small Business (10-49 staff)

∙ Role-specific security training for system administrators

Medium Business (50-249 staff)

∙ Formal privileged user security training program

Large Business (250-999 staff)

∙ Enterprise privileged user security training program\n∙ Regular refresher training

Enterprise (>1,000 staff)

∙ Enterprise role-based technical security training (e.g., SANS courses)\n∙ Privileged user training tracks\n∙ Annual recertification", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74134, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591221", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591221", "securityControlId": 32012, "ccis": [], "uuid": "af1c155e-956a-54ff-b276-3a3147b38224", "testId": "SAT-03.3_A01", "test": "personnel or roles to be provided with initial and refresher training in the employment and operation of sensitive / regulated data processing and transparency controls is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_AT-03(05)_ODP[01]", "defaultText": null }, { "id": 74135, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591222", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591222", "securityControlId": 32012, "ccis": [], "uuid": "338b243d-50bd-5fd2-b736-1171b10d575a", "testId": "SAT-03.3_A02", "test": "the frequency at which to provide refresher training in the employment and operation of sensitive / regulated data processing and transparency controls is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_AT-03(05)_ODP[02]", "defaultText": null }, { "id": 74136, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591222", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591222", "securityControlId": 32012, "ccis": [], "uuid": "d6276e07-e0a8-5b09-bd92-3aa43736a8e1", "testId": "SAT-03.3_A03", "test": "organization-defined personnel or roles are provided with initial and refresher training organization-defined frequency in the employment and operation of sensitive / regulated data processing and transparency controls.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_AT-03(05)", "defaultText": null } ], "externalMappings": [ { "id": 603706, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96025d1d-21ab-577f-a7b0-45720bf19a0f", "parentControlId": 32012, "controlId": "AR-5", "title": "AR-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590075" }, { "id": 603707, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24013e8d-6f54-5d22-95d3-612137808a37", "parentControlId": 32012, "controlId": "AT-03(05)", "title": "AT-03(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590076" }, { "id": 603709, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8bcb2a0-0333-5c38-a5a8-02d39e89f503", "parentControlId": 32012, "controlId": "AT-03(05)", "title": "AT-03(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590076" }, { "id": 603710, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "292f17c8-7a51-5f91-8726-97092f42eb75", "parentControlId": 32012, "controlId": "03.01.22.a", "title": "03.01.22.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590076" }, { "id": 603711, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "866980fe-b3fb-52bd-a4bf-3532ef9c13bf", "parentControlId": 32012, "controlId": "03.02.01.a.01", "title": "03.02.01.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590076" }, { "id": 603712, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590076", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a3d665b-353c-5a50-bbb3-83f1335b07c4", "parentControlId": 32012, "controlId": "03.02.02.a.01", "title": "03.02.02.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590076" }, { "id": 603759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590081", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c16b9e2-3dd5-54ee-ad8d-ec1d9f05851e", "parentControlId": 32012, "controlId": "§117.12(a)", "title": "§117.12(a)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590081" }, { "id": 603760, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8f1bb8c-c924-53e8-a099-9cf968c20839", "parentControlId": 32012, "controlId": "§117.12(d)", "title": "§117.12(d)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590082" }, { "id": 603761, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e7f04db-bc6f-5e89-93e7-3b06b2c8ad67", "parentControlId": 32012, "controlId": "§117.12(e)(3)", "title": "§117.12(e)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590082" }, { "id": 603762, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ab35b87-f214-52bf-ac12-1738591157a2", "parentControlId": 32012, "controlId": "§117.12(e)(4)", "title": "§117.12(e)(4)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590082" }, { "id": 603763, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fd01b09-5896-57ca-a3d2-41c78763519c", "parentControlId": 32012, "controlId": "§117.12(e)(5)", "title": "§117.12(e)(5)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590082" }, { "id": 603764, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc70c6af-fbd7-5ff5-9564-db87d1715cc4", "parentControlId": 32012, "controlId": "§117.12(f)", "title": "§117.12(f)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590082" }, { "id": 603765, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "873bfeff-5cb1-5e32-8811-a1fb1de69e74", "parentControlId": 32012, "controlId": "§117.12(h)", "title": "§117.12(h)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590082" }, { "id": 603766, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ba7c42d-d698-50f9-86fa-a6fc55cb44aa", "parentControlId": 32012, "controlId": "§117.12(h)(1)", "title": "§117.12(h)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590082" }, { "id": 603767, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590082", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e074591-e043-5390-9a55-eb163999b08d", "parentControlId": 32012, "controlId": "§117.12(h)(2)", "title": "§117.12(h)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590082" }, { "id": 603768, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d03996e4-a86e-5e0f-b916-c1973e91b94b", "parentControlId": 32012, "controlId": "§117.12(h)(2)(i)", "title": "§117.12(h)(2)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590083" }, { "id": 603769, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d719a4e1-9cab-54ee-8b45-b66af640dbfe", "parentControlId": 32012, "controlId": "§117.12(h)(2)(ii)", "title": "§117.12(h)(2)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590083" }, { "id": 603770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78c051e5-5f92-584d-8dfb-a3394d346825", "parentControlId": 32012, "controlId": "§117.12(h)(2)(iii)", "title": "§117.12(h)(2)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590083" }, { "id": 603771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a0844ed-62b0-59c2-b0ae-c20f7617bba9", "parentControlId": 32012, "controlId": "§117.12(h)(2)(iv)", "title": "§117.12(h)(2)(iv)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590083" }, { "id": 603772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9fec8ba-a1c1-5f4e-a7c1-b6db7023bd50", "parentControlId": 32012, "controlId": "§117.12(h)(2)(v)", "title": "§117.12(h)(2)(v)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590083" }, { "id": 603773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8a35ff3-7186-5e3b-8674-b190e6f5f973", "parentControlId": 32012, "controlId": "§117.12(h)(2)(vi)", "title": "§117.12(h)(2)(vi)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590083" }, { "id": 603774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e1767d0-fbbc-58f3-a30b-1bf3e3f6dc4a", "parentControlId": 32012, "controlId": "§117.12(h)(2)(vii)", "title": "§117.12(h)(2)(vii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590083" }, { "id": 603775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69703bf3-07b0-54ac-a79e-85ec3aba9a36", "parentControlId": 32012, "controlId": "12-2.b", "title": "12-2.b", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590083" } ], "id": 32012, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731329", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731329", "catalogueId": 1062, "uuid": "b10f350a-064b-5636-ad5f-5fb5a0e3db6e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure that every user accessing a system processing, storing or transmitting sensitive/regulated data is formally trained in data handling requirements?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Sensitive / Regulated Data Storage, Handling & Processing", "description": "

Control Description

Mechanisms exist to ensure that every user accessing a system processing, storing or transmitting sensitive/regulated data is formally trained in data handling requirements.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Security Awareness & Training (SAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security awareness and training-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Security awareness and training methods are often generic, without organization-specific content.

Level 2 - Planned & Tracked: Security Awareness & Training (SAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security Awareness & Training-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security Awareness & Training may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Users are educated on their responsibilities to protect TAASD assigned to them or under their supervision.\n▪ IT and/or cybersecurity personnel create/govern security and awareness training to meet specific statutory, regulatory and/or contractual compliance obligations.\n▪ Privileged users receive formal security and/or data privacy awareness training to ensure they understand their unique roles and responsibilities.\n▪ The responsibility for training users and enforcing policies may be assigned to user’s immediate supervisor(s)/manager(s), including the definition and enforcement of the user’s specific role(s) and responsibilities.\n▪ Security awareness and training methods are role-based (e.g., handling sensitive/regulated data).

Level 3 - Well Defined: Security Awareness & Training (SAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are well-documented and kept current by process owners.\n▪ A security awareness & training team, or similar function, is appropriately staffed and supported to implement and maintain SAT domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security awareness and training management (e.g., Computer Based Learning (CBL) solutions, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure that every user accessing a system processing, storing or transmitting sensitive/regulated data is formally trained in data handling requirements.

Level 4 - Quantitatively Controlled: Security Awareness & Training (SAT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SAT-03.3", "family": "Security Awareness & Training", "enhancements": "", "sortId": "SAT-03.3", "references": "

Micro-Small Business (<10 staff)

∙ Provide security training for executives and leadership

Small Business (10-49 staff)

∙ Executive security awareness briefing

Medium Business (50-249 staff)

∙ Formal executive security awareness program\n∙ Board-level cybersecurity briefings

Large Business (250-999 staff)

∙ Enterprise executive security program\n∙ Board cybersecurity education\n∙ Executive threat briefings

Enterprise (>1,000 staff)

∙ Enterprise board and executive security education program\n∙ Regular threat briefings\n∙ Tabletop exercises for leadership", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74138, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591223", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591223", "securityControlId": 32014, "ccis": [], "uuid": "5c1a4e05-a9e9-56b4-bb33-674c3bd232db", "testId": "SAT-03.5_A01", "test": "specific training for privileged users is provided to ensure privileged users understand their unique roles and responsibilities
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 603807, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d95cf6b0-ccb1-5069-a652-2239becb88e7", "parentControlId": 32014, "controlId": "03.02.01.a.01", "title": "03.02.01.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590087" }, { "id": 603808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59c65c09-40a0-5e2f-9f30-3d51cec235d3", "parentControlId": 32014, "controlId": "03.02.02.a.01", "title": "03.02.02.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590087" }, { "id": 603810, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0720e6c2-50f9-595c-bdb8-322a8199703a", "parentControlId": 32014, "controlId": "PR.AT-02", "title": "PR.AT-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590087" } ], "id": 32014, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73133", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73133", "catalogueId": 1062, "uuid": "ce75784a-5635-5db0-8327-428b4de2f78a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide specific training for privileged users to ensure privileged users understand their unique roles and responsibilities

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Privileged Users", "description": "

Control Description

Mechanisms exist to provide specific training for privileged users to ensure privileged users understand their unique roles and responsibilities

Evidence Request List (ERL)

E-SAT-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Security Awareness & Training (SAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security Awareness & Training-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security Awareness & Training may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Users are educated on their responsibilities to protect TAASD assigned to them or under their supervision.\n▪ IT and/or cybersecurity personnel create/govern security and awareness training to meet specific statutory, regulatory and/or contractual compliance obligations.\n▪ Privileged users receive formal security and/or data privacy awareness training to ensure they understand their unique roles and responsibilities.\n▪ The responsibility for training users and enforcing policies may be assigned to user’s immediate supervisor(s)/manager(s), including the definition and enforcement of the user’s specific role(s) and responsibilities.\n▪ Security awareness and training methods are role-based (e.g., handling sensitive/regulated data).

Level 3 - Well Defined: Security Awareness & Training (SAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are well-documented and kept current by process owners.\n▪ A security awareness & training team, or similar function, is appropriately staffed and supported to implement and maintain SAT domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security awareness and training management (e.g., Computer Based Learning (CBL) solutions, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide specific training for privileged users to ensure privileged users understand their unique roles and responsibilities

Level 4 - Quantitatively Controlled: Security Awareness & Training (SAT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SAT-03.5", "family": "Security Awareness & Training", "enhancements": "", "sortId": "SAT-03.5", "references": "

Micro-Small Business (<10 staff)

∙ Provide security training for physical security personnel

Small Business (10-49 staff)

∙ Physical security staff security training

Medium Business (50-249 staff)

∙ Formal physical security personnel security training program

Large Business (250-999 staff)

∙ Enterprise physical security training program\n∙ Specialized training for physical security roles

Enterprise (>1,000 staff)

∙ Enterprise physical security training and certification program\n∙ Regular exercises and drills", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74139, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591223", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591223", "securityControlId": 32015, "ccis": [], "uuid": "c15d0766-a6a7-5398-b044-4c933cbfa8c9", "testId": "SAT-03.6_A01", "test": "literacy training on the cyber threat environment is provided.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AT-02(06)(a)", "defaultText": null }, { "id": 74140, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591223", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591223", "securityControlId": 32015, "ccis": [], "uuid": "3bc339c9-51ad-52a8-98e7-cc8a02ba665c", "testId": "SAT-03.6_A02", "test": "system operations reflect current cyber threat information.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AT-02(06)(b)", "defaultText": null }, { "id": 74141, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591223", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591223", "securityControlId": 32015, "ccis": [], "uuid": "550c2a3a-1a36-522d-9130-f67f5bef3801", "testId": "SAT-03.6_A03", "test": "the frequency of providing awareness training is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "172A_3.2.1e_ODP[1]", "defaultText": null }, { "id": 74142, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591224", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591224", "securityControlId": 32015, "ccis": [], "uuid": "33c24f4c-9055-597d-a3ae-ef41bc47f91a", "testId": "SAT-03.6_A04", "test": "the frequency of updating awareness training is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "172A_3.2.1e_ODP[2]", "defaultText": null }, { "id": 74143, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591224", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591224", "securityControlId": 32015, "ccis": [], "uuid": "436251bf-67bd-506d-bf08-7f303d89de24", "testId": "SAT-03.6_A05", "test": "security literacy training is provided to system users when required by system changes or following .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: significant, novel incidents, or significant changes to risks", "otherId": "171A_R3_A.03.02.01.a.02", "defaultText": null }, { "id": 74144, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591224", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591224", "securityControlId": 32015, "ccis": [], "uuid": "2ae23ef7-dbcd-5a2a-9769-b918a6c3650b", "testId": "SAT-03.6_A06", "test": "security literacy training content is updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least every 12 months", "otherId": "171A_R3_A.03.02.01.b[01]", "defaultText": null }, { "id": 74145, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591224", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591224", "securityControlId": 32015, "ccis": [], "uuid": "dd453c16-23e0-5ba4-9e21-ca805280bc3c", "testId": "SAT-03.6_A07", "test": "security literacy training content is updated following .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: significant, novel incidents, or significant changes to risks", "otherId": "171A_R3_A.03.02.01.b[02]", "defaultText": null } ], "externalMappings": [ { "id": 603837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59009", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d2c5af3-2c54-533d-a5fc-b52d7c7d5846", "parentControlId": 32015, "controlId": "AT-02(06)", "title": "AT-02(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59009" }, { "id": 603839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59009", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "499c8ac2-fa75-5c03-be28-1870b4dfe1ae", "parentControlId": 32015, "controlId": "AT-02(06)", "title": "AT-02(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590091" }, { "id": 603840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590091", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87b338d2-0dc3-5055-a97e-74589ea0c630", "parentControlId": 32015, "controlId": "AT-2(6)", "title": "AT-2(6)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590091" }, { "id": 603842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9522cc95-9286-56ad-b468-741ee7eb8458", "parentControlId": 32015, "controlId": "3.2.3", "title": "3.2.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590099" }, { "id": 603843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6decaf8e-8da3-5860-8737-c3420a56316c", "parentControlId": 32015, "controlId": "03.02.01.a.01", "title": "03.02.01.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590099" }, { "id": 603844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4406bbb-7c45-56ef-9487-1b7807d25ca7", "parentControlId": 32015, "controlId": "03.02.01.a.02", "title": "03.02.01.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590099" }, { "id": 603845, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590099", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc567c5d-813e-58e9-8bb8-17bbac9dd6c0", "parentControlId": 32015, "controlId": "03.02.01.a.03", "title": "03.02.01.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590099" }, { "id": 603846, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f489676-da2e-5084-bc2a-eecbbbbd5b1b", "parentControlId": 32015, "controlId": "03.02.01.b", "title": "03.02.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5901" }, { "id": 603847, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7137075a-fec7-5637-9170-966994639f9c", "parentControlId": 32015, "controlId": "03.02.02.a.01", "title": "03.02.02.a.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5901" }, { "id": 603848, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d8e3a0e-b12c-5b99-ab1b-da70ab5819d3", "parentControlId": 32015, "controlId": "03.02.02.a.02", "title": "03.02.02.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5901" }, { "id": 603849, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d7c7e6d-bd84-57a0-8b90-87b12268345a", "parentControlId": 32015, "controlId": "03.02.02.b", "title": "03.02.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5901" }, { "id": 603850, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5901", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5bbbcf0-f680-5afc-adeb-f3d4b1354fb6", "parentControlId": 32015, "controlId": "03.06.04.a.02", "title": "03.06.04.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5901" }, { "id": 603857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bf2f835-8e3c-5f90-82c7-2988b4d23692", "parentControlId": 32015, "controlId": "PR.AT-01", "title": "PR.AT-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590101" }, { "id": 603858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590101", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27008e2e-64a1-535c-a76b-ce19efd58bf6", "parentControlId": 32015, "controlId": "PR.AT-02", "title": "PR.AT-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590101" }, { "id": 603898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ecb16c3-f0a9-5831-89cc-32d2fe488af7", "parentControlId": 32015, "controlId": "§117.12(e)(1)", "title": "§117.12(e)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590107" }, { "id": 603899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20b30cfd-81f6-56c8-8929-6a5b59c7810b", "parentControlId": 32015, "controlId": "§117.12(e)(2)", "title": "§117.12(e)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590107" } ], "id": 32015, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73133", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73133", "catalogueId": 1062, "uuid": "63cf96dd-74ff-5ccb-af85-473063e73fb2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide role-based security, compliance and resilience awareness training that is current and relevant to the cyber threats that users might encounter in day-to-day business operations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Cyber Threat Environment", "description": "

Control Description

Mechanisms exist to provide role-based security, compliance and resilience awareness training that is current and relevant to the cyber threats that users might encounter in day-to-day business operations.

Evidence Request List (ERL)

E-SAT-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Security Awareness & Training (SAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security Awareness & Training-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security Awareness & Training may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Users are educated on their responsibilities to protect TAASD assigned to them or under their supervision.\n▪ IT and/or cybersecurity personnel create/govern security and awareness training to meet specific statutory, regulatory and/or contractual compliance obligations.\n▪ Privileged users receive formal security and/or data privacy awareness training to ensure they understand their unique roles and responsibilities.\n▪ The responsibility for training users and enforcing policies may be assigned to user’s immediate supervisor(s)/manager(s), including the definition and enforcement of the user’s specific role(s) and responsibilities.\n▪ Security awareness and training methods are role-based (e.g., handling sensitive/regulated data).\n▪ Business process owners are required to incorporate vendor-specific security training in support of new technology initiatives.\n▪ Security awareness training covers recommended practices for securing laptops and mobile devices while traveling.\n▪ Security awareness training covers reporting of unauthorized alterations and evidence of tampering of equipment

Level 3 - Well Defined: Security Awareness & Training (SAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are well-documented and kept current by process owners.\n▪ A security awareness & training team, or similar function, is appropriately staffed and supported to implement and maintain SAT domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security awareness and training management (e.g., Computer Based Learning (CBL) solutions, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide role-based security, compliance and resilience awareness training that is current and relevant to the cyber threats that users might encounter in day-to-day business operations.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SAT-03.6", "family": "Security Awareness & Training", "enhancements": "", "sortId": "SAT-03.6", "references": "

Micro-Small Business (<10 staff)

∙ US-CERT mailing lists & feeds\n∙ Internal newsletters

Small Business (10-49 staff)

∙ US-CERT mailing lists & feeds\n∙ Internal newsletters

Medium Business (50-249 staff)

∙ US-CERT mailing lists & feeds\n∙ Internal newsletters\n∙ InfraGard (https://infragard.org)

Large Business (250-999 staff)

∙ US-CERT mailing lists & feeds\n∙ Internal newsletters\n∙ InfraGard (https://infragard.org)

Enterprise (>1,000 staff)

∙ US-CERT mailing lists & feeds\n∙ Internal newsletters\n∙ InfraGard (https://infragard.org)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74146, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591224", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591224", "securityControlId": 32016, "ccis": [], "uuid": "c14dbe50-5b30-5fcf-a454-7beb64ffad3f", "testId": "SAT-03.7_A01", "test": "cybersecurity / data privacy personnel receive Continuing Professional Education (CPE) training to maintain currency and proficiency with industry-recognized secure practices that are pertinent to their assigned roles and responsibilities.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 603942, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590112", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e8ed219-e5e3-5bc1-8f48-599a511ea7a5", "parentControlId": 32016, "controlId": "03.06.04.b", "title": "03.06.04.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590112" }, { "id": 603943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590112", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85ed70a3-751a-5659-bad9-ad9e76b391c9", "parentControlId": 32016, "controlId": "PR.AT-02", "title": "PR.AT-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590112" } ], "id": 32016, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731331", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731331", "catalogueId": 1062, "uuid": "4be04fde-bad0-5ec4-a94c-c0a73ac8db81", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure security, compliance and resilience personnel receive Continuing Professional Education (CPE) training to maintain currency and proficiency with industry-recognized secure practices that are pertinent to their assigned roles and responsibilities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Continuing Professional Education (CPE) - Security, Compliance & Resilience Personnel", "description": "

Control Description

Mechanisms exist to ensure security, compliance and resilience personnel receive Continuing Professional Education (CPE) training to maintain currency and proficiency with industry-recognized secure practices that are pertinent to their assigned roles and responsibilities.

Evidence Request List (ERL)

E-SAT-01\nE-SAT-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Security Awareness & Training (SAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are well-documented and kept current by process owners.\n▪ A security awareness & training team, or similar function, is appropriately staffed and supported to implement and maintain SAT domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security awareness and training management (e.g., Computer Based Learning (CBL) solutions, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure security, compliance and resilience personnel receive Continuing Professional Education (CPE) training to maintain currency and proficiency with industry-recognized secure practices that are pertinent to their assigned roles and responsibilities.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "SAT-03.7", "family": "Security Awareness & Training", "enhancements": "", "sortId": "SAT-03.7", "references": "

Micro-Small Business (<10 staff)

∙ Annual security awareness training

Small Business (10-49 staff)

∙ Security awareness training platform (e.g., KnowBe4 free tier)\n∙ Annual completion tracking

Medium Business (50-249 staff)

∙ Minimum requirements for Continuing Professional Education (CPE)

Large Business (250-999 staff)

∙ Minimum requirements for Continuing Professional Education (CPE)

Enterprise (>1,000 staff)

∙ Minimum requirements for Continuing Professional Education (CPE)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74149, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591225", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591225", "securityControlId": 32019, "ccis": [], "uuid": "a56b7f47-8385-57a7-b0df-8cf083d5d34c", "testId": "SAT-04_A01", "test": "cybersecurity / data privacy training activities, including cybersecurity / data privacy awareness training and specific role-based cybersecurity / data privacy training, are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AT-04a.[01]", "defaultText": null }, { "id": 74150, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591226", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591226", "securityControlId": 32019, "ccis": [], "uuid": "ff86f0d0-dad2-5866-997b-4843bf6f74a4", "testId": "SAT-04_A02", "test": "time period for retaining individual training records is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_AT-04_ODP", "defaultText": null }, { "id": 74151, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591226", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591226", "securityControlId": 32019, "ccis": [], "uuid": "389195b9-c3af-5bae-8c83-dfdfbd0d44f3", "testId": "SAT-04_A03", "test": "individual training records are retained for organization-defined time period.
PPTDF Applicability: Data
Assessment Rigor: 1
SCF Defined Parameters: five (5) years or 5 years after completion of a specific training program", "otherId": "53A_R5_AT-04b.", "defaultText": null }, { "id": 74152, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591226", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591226", "securityControlId": 32019, "ccis": [], "uuid": "ce16f530-3846-5ffc-9739-9fa9f1d34dca", "testId": "SAT-04_A04", "test": "cybersecurity / data privacy training activities, including cybersecurity / data privacy awareness training and specific role-based cybersecurity / data privacy training, are monitored.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_AT-04a.[02]", "defaultText": null } ], "externalMappings": [ { "id": 603964, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590114", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0e4f22a-faa4-541a-812e-aead7f1414a0", "parentControlId": 32019, "controlId": "AT-4", "title": "AT-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590114" }, { "id": 603965, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590114", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5536042f-180d-5a44-ad82-e67826811c47", "parentControlId": 32019, "controlId": "AT-04", "title": "AT-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590114" }, { "id": 603967, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590115", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb97f140-4c73-5e90-b68a-86cb931e4719", "parentControlId": 32019, "controlId": "AT-04", "title": "AT-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590115" }, { "id": 603968, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590115", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6636267d-629e-5dbc-bd5f-5a8e078101a5", "parentControlId": 32019, "controlId": "AT-04", "title": "AT-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590115" }, { "id": 603969, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590115", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4a3ae01-1c33-5ef0-aa2c-c0c199b16a25", "parentControlId": 32019, "controlId": "AT-04", "title": "AT-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590115" }, { "id": 603970, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590115", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a911541-200f-5eae-9a21-79c3a6b81caf", "parentControlId": 32019, "controlId": "AT-04", "title": "AT-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590115" }, { "id": 603971, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590115", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e7640f4-cad0-5ab3-857c-03499a3dbf6f", "parentControlId": 32019, "controlId": "AT-04", "title": "AT-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590115" }, { "id": 603972, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590115", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd3f13b9-632b-5e46-ba57-156a259da248", "parentControlId": 32019, "controlId": "AT-4", "title": "AT-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590115" }, { "id": 603973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590115", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b79016ba-e611-59fa-923a-7b99084c0d67", "parentControlId": 32019, "controlId": "AT-4", "title": "AT-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590115" }, { "id": 603975, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590116", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da677788-0c0b-5b52-9250-461fc861f60e", "parentControlId": 32019, "controlId": "NFO - AT-4", "title": "NFO - AT-4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590116" }, { "id": 604000, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590118", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ea79371-794c-5e09-b31b-a1e3160d0b62", "parentControlId": 32019, "controlId": "§117.12(g)(3)", "title": "§117.12(g)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590118" }, { "id": 604001, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590119", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b3690b7-ae99-511e-95de-817058409bc0", "parentControlId": 32019, "controlId": "§117.12(h)(3)", "title": "§117.12(h)(3)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590119" }, { "controlId": "C.10.8", "title": "C.10.8 — Security Training Records", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AT-4", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "5def429a-9bb9-551a-948e-72f38e9a123f", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.8", "title": "NEI 08-09 App E.10.8 — Security Training Records", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "88ef013a-d095-56fa-9c32-02ac1ab381a5", "isPublic": true }, { "controlId": "10 CFR 73.54(h)", "title": "10 CFR 73.54(h) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.10.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "9b6c8e9b-44b5-5cf9-a5c5-cdc6bc98bb11", "isPublic": true }, { "controlId": "CIP-004-7-R2", "title": "CIP-004-7-R2 — Cyber Security Training Program", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4d9ef279-4c68-5467-8c73-2714bf21a822", "isPublic": true }, { "controlId": "CIP-004-7-2.1", "title": "CIP-004-7-2.1 — Training content on: 2.1.1", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b8188b14-1308-519c-8f0c-9e1ca066b0ca", "isPublic": true }, { "controlId": "CIP-004-7-2.1.1", "title": "CIP-004-7-2.1.1 — Cyber security policies", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f95dc4e5-bc8a-55ee-901c-3aebc96e65ae", "isPublic": true }, { "controlId": "CIP-004-7-2.1.2", "title": "CIP-004-7-2.1.2 — Physical access controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "91443401-cb42-597d-add6-6f63d01d83ae", "isPublic": true }, { "controlId": "CIP-004-7-2.1.3", "title": "CIP-004-7-2.1.3 — Electronic access controls", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6250027f-ba2f-5693-8082-5ff88039cd5d", "isPublic": true }, { "controlId": "CIP-004-7-2.1.4", "title": "CIP-004-7-2.1.4 — The visitor control program", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "79e50872-a36f-59c5-baf3-bbccc7c6583a", "isPublic": true }, { "controlId": "CIP-004-7-2.1.5", "title": "CIP-004-7-2.1.5 — Handling of BES Cyber System Information and its storage", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d8e9dc6e-7bcd-5d95-bb1c-f1078fc91283", "isPublic": true }, { "controlId": "CIP-004-7-2.1.6", "title": "CIP-004-7-2.1.6 — Identification of a Cyber Security Incident and initial notifications in accordance with the entity’s incident respon...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a4be0d7b-9a8b-5688-9db3-13c3d5e9000c", "isPublic": true }, { "controlId": "CIP-004-7-2.1.7", "title": "CIP-004-7-2.1.7 — Recovery plans for BES Cyber Systems", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d780ab0f-3e4a-5e4e-b73d-869993397bb4", "isPublic": true }, { "controlId": "CIP-004-7-2.1.8", "title": "CIP-004-7-2.1.8 — Response to Cyber Security Incidents", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d090501d-5beb-5c03-8b8b-6dc69b0e749b", "isPublic": true }, { "controlId": "CIP-004-7-2.1.9", "title": "CIP-004-7-2.1.9 — Cyber security risks associated with a BES Cyber System’s electronic interconnectivity and interoperability with othe...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4e2768d7-1081-55b9-a73b-b682f0a05f71", "isPublic": true }, { "controlId": "CIP-004-7-2.2", "title": "CIP-004-7-2.2 — Require completion of the training specified in Part 2.1 prior to granting authorized electronic access and authorize...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4ef7601f-964d-5250-98cd-d4e4b8074152", "isPublic": true }, { "controlId": "CIP-004-7-2.3", "title": "CIP-004-7-2.3 — Require completion of the training specified in Part 2.1 at least once every 15 calendar months.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-004-7-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3a817544-6bd6-5b41-bac7-b4964ec2fe58", "isPublic": true }, { "controlId": "NSS-17T-Sec4.4", "title": "NSS-17T-Sec4.4 — Nuclear Computer Security Culture, Awareness & Specialized Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "973cb88c-be53-5ef9-b63d-f2a99b256408", "isPublic": true }, { "controlId": "IEC-62645-5.2.3", "title": "IEC-62645-5.2.3 — Competence, Awareness, and Role-Based I&C Security Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "18b71b02-9b54-52b9-a655-4a50b456f4e8", "isPublic": true }, { "controlId": "IEC-63096-7.2", "title": "IEC-63096-7.2 — Cyber Security Awareness, Education, and Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "4de7afde-2b40-5d19-bc15-61fa2c96f8b7", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec3.4", "title": "REGDOC-2.12.1-Sec3.4 — Security Awareness and Technical Training", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (SAT Domain)", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "52194752-4fe7-53f8-8aab-04208e34ba27", "isPublic": true } ], "id": 32019, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731332", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731332", "catalogueId": 1062, "uuid": "f870e08e-f401-5f49-b806-f2522cd8284b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization document, retain and monitor individual training activities, including:\n(1) Initial security, compliance and resilience awareness training;\n(2) Recurring awareness training; and\n(3) Technology Assets, Applications and/or Services (TAAS)-specific training?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Security, Compliance & Resilience Training Records", "description": "

Control Description

Mechanisms exist to document, retain and monitor individual training activities, including:\n(1) Initial security, compliance and resilience awareness training;\n(2) Recurring awareness training; and\n(3) Technology Assets, Applications and/or Services (TAAS)-specific training.

Evidence Request List (ERL)

E-SAT-02\nE-SAT-03\nE-SAT-04\nE-SAT-05\nE-SAT-06\nE-SAT-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Security Awareness & Training (SAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with SAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Security awareness and training-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Security awareness and training methods are often generic, without organization-specific content.\n▪ IT/cybersecurity personnel self-manage their professional certification requirements to support their assigned duties.

Level 2 - Planned & Tracked: Security Awareness & Training (SAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Security Awareness & Training-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Security Awareness & Training may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel self-manage their professional certification requirements to support their assigned duties.

Level 3 - Well Defined: Security Awareness & Training (SAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with SAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with SAT domain capabilities are well-documented and kept current by process owners.\n▪ A security awareness & training team, or similar function, is appropriately staffed and supported to implement and maintain SAT domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of security awareness and training management (e.g., Computer Based Learning (CBL) solutions, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to document, retain and monitor individual training activities, including:\n(1) Initial security, compliance and resilience awareness training;\n(2) Recurring awareness training; and\n(3) Technology Assets, Applications and/or Services (TAAS)-specific training.

Level 4 - Quantitatively Controlled: Security Awareness & Training (SAT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.10.8
NERC-CIP (2026) Requirements: CIP-004-7-R2", "controlId": "SAT-04", "family": "Security Awareness & Training", "enhancements": "", "sortId": "SAT-04", "references": "

Micro-Small Business (<10 staff)

∙ KnowB4 (https://knowbe4.com)

Small Business (10-49 staff)

∙ KnowB4 (https://knowbe4.com)

Medium Business (50-249 staff)

∙ KnowB4 (https://knowbe4.com)

Large Business (250-999 staff)

∙ KnowB4 (https://knowbe4.com)

Enterprise (>1,000 staff)

∙ KnowB4 (https://knowbe4.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74155, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591227", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591227", "securityControlId": 32021, "ccis": [], "uuid": "20c9df49-a2dc-5bcc-b416-97431a0dfe09", "testId": "TDA-01_A01", "test": "a system and services acquisition policy is developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-01a.[01]", "defaultText": null }, { "id": 74156, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591227", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591227", "securityControlId": 32021, "ccis": [], "uuid": "df266fb6-8d12-5608-9d1e-8512dc252ed5", "testId": "TDA-01_A02", "test": "system and services acquisition procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are developed and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-01a.[03]", "defaultText": null }, { "id": 74157, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591227", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591227", "securityControlId": 32021, "ccis": [], "uuid": "cd1fcf6b-8e9f-549c-a993-6592f267cf7f", "testId": "TDA-01_A03", "test": "acquisition strategies, contract tools, and procurement methods are implemented to identify supply chain risks.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.17.02[04]", "defaultText": null }, { "id": 74158, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591227", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591227", "securityControlId": 32021, "ccis": [], "uuid": "4835dd14-5c26-5af1-a868-a778cb1ae87d", "testId": "TDA-01_A04", "test": "acquisition strategies, contract tools, and procurement methods are implemented to protect against supply chain risks.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.17.02[05]", "defaultText": null }, { "id": 74159, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591227", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591227", "securityControlId": 32021, "ccis": [], "uuid": "331953d3-a32a-5c3e-b28f-cd62ef5d2aca", "testId": "TDA-01_A05", "test": "acquisition strategies, contract tools, and procurement methods are implemented to mitigate supply chain risks.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.17.02[06]", "defaultText": null }, { "id": 74160, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591227", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591227", "securityControlId": 32021, "ccis": [], "uuid": "09f8cf06-7db4-5dd0-81ea-f672e3937354", "testId": "TDA-01_A06", "test": "personnel or roles to whom the system and services acquisition policy is to be disseminated is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01_ODP[01]", "defaultText": null }, { "id": 74161, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591228", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591228", "securityControlId": 32021, "ccis": [], "uuid": "08f82303-c3f7-5f53-bb4d-aad80ef1bcb4", "testId": "TDA-01_A07", "test": "personnel or roles to whom the system and services acquisition procedures are to be disseminated is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01_ODP[02]", "defaultText": null }, { "id": 74162, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591228", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591228", "securityControlId": 32021, "ccis": [], "uuid": "3c76a0f4-a7e7-5c21-a276-a07b65e7e059", "testId": "TDA-01_A08", "test": "one or more of the following organization-defined criteria is/are selected: {organization-level. mission/business process-level. system-level}.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01_ODP[03]", "defaultText": null }, { "id": 74163, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591228", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591228", "securityControlId": 32021, "ccis": [], "uuid": "a253d481-a0eb-5b06-9c0a-db5b4e9c68c8", "testId": "TDA-01_A09", "test": "an official to manage the system and services acquisition policy and procedures is defined.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_SA-01_ODP[04]", "defaultText": null }, { "id": 74164, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591228", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591228", "securityControlId": 32021, "ccis": [], "uuid": "c3f95795-7e7d-5c3e-abbf-0999947e5c09", "testId": "TDA-01_A10", "test": "the frequency at which the current system and services acquisition policy is reviewed / updated is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01_ODP[05]", "defaultText": null }, { "id": 74165, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591228", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591228", "securityControlId": 32021, "ccis": [], "uuid": "d026b843-f97b-5c57-89f6-49ed8edba39b", "testId": "TDA-01_A11", "test": "events that would require the current system and services acquisition policy to be reviewed / updated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01_ODP[06]", "defaultText": null }, { "id": 74166, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591228", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591228", "securityControlId": 32021, "ccis": [], "uuid": "611ff09a-aac6-51bc-b13c-160328d38240", "testId": "TDA-01_A12", "test": "the frequency at which the current system and services acquisition procedures are reviewed / updated is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01_ODP[07]", "defaultText": null }, { "id": 74167, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591228", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591228", "securityControlId": 32021, "ccis": [], "uuid": "8298203c-1eec-5c60-8757-5d3b85f255f6", "testId": "TDA-01_A13", "test": "events that would require the system and services acquisition procedures to be reviewed / updated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01_ODP[08]", "defaultText": null }, { "id": 74168, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591229", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591229", "securityControlId": 32021, "ccis": [], "uuid": "93963855-c24a-5b13-957e-09d11d0ff3f2", "testId": "TDA-01_A14", "test": "the system and services acquisition policy is disseminated to organization-defined personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01a.[02]", "defaultText": null }, { "id": 74169, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591229", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591229", "securityControlId": 32021, "ccis": [], "uuid": "e0e043cd-7fc7-5c65-9a52-9f41b77cb6dc", "testId": "TDA-01_A15", "test": "the system and services acquisition procedures are disseminated to organization-defined personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01a.[04]", "defaultText": null }, { "id": 74170, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591229", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591229", "securityControlId": 32021, "ccis": [], "uuid": "f8392a90-8387-5a8f-af93-c6efb7d46343", "testId": "TDA-01_A16", "test": "the organization's system and services acquisition policy addresses purpose.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01a.01(a)[01]", "defaultText": null }, { "id": 74171, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591229", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591229", "securityControlId": 32021, "ccis": [], "uuid": "9b3d2840-8304-5be5-aaff-abf3e2b35304", "testId": "TDA-01_A17", "test": "the organization's system and services acquisition policy addresses scope.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01a.01(a)[02]", "defaultText": null }, { "id": 74172, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591229", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591229", "securityControlId": 32021, "ccis": [], "uuid": "94cede34-6190-5905-a4ce-741e1cc3f6d0", "testId": "TDA-01_A18", "test": "the organization's system and services acquisition policy addresses roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01a.01(a)[03]", "defaultText": null }, { "id": 74173, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591229", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591229", "securityControlId": 32021, "ccis": [], "uuid": "bb062347-12e6-5ca1-9c7c-44885eb1194b", "testId": "TDA-01_A19", "test": "the organization's system and services acquisition policy addresses responsibilities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01a.01(a)[04]", "defaultText": null }, { "id": 74174, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591229", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591229", "securityControlId": 32021, "ccis": [], "uuid": "d2a1e75e-95d8-5d03-b2db-34861b57d81f", "testId": "TDA-01_A20", "test": "the organization's system and services acquisition policy addresses management commitment.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01a.01(a)[05]", "defaultText": null }, { "id": 74175, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591229", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591229", "securityControlId": 32021, "ccis": [], "uuid": "c0499f2f-d32a-50b5-853b-d064f24f7252", "testId": "TDA-01_A21", "test": "the organization's system and services acquisition policy addresses coordination among organizational entities.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01a.01(a)[06]", "defaultText": null }, { "id": 74176, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591229", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591229", "securityControlId": 32021, "ccis": [], "uuid": "87ae739d-32a5-5849-811d-37d0c081c706", "testId": "TDA-01_A22", "test": "the organization's system and services acquisition policy addresses compliance.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01a.01(a)[07]", "defaultText": null }, { "id": 74177, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59123", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59123", "securityControlId": 32021, "ccis": [], "uuid": "5675e3c1-ec7f-529c-b205-63b153036245", "testId": "TDA-01_A23", "test": "the organization's system and services acquisition policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01a.01(b)", "defaultText": null }, { "id": 74178, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59123", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59123", "securityControlId": 32021, "ccis": [], "uuid": "46167b40-314d-5316-b4a9-ea34c9c28540", "testId": "TDA-01_A24", "test": "the organization-defined official is designated to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures.
PPTDF Applicability: People
Assessment Rigor: 3", "otherId": "53A_R5_SA-01b.", "defaultText": null }, { "id": 74179, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59123", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59123", "securityControlId": 32021, "ccis": [], "uuid": "05152b3c-7c59-5387-a3e5-1c04f7958e78", "testId": "TDA-01_A25", "test": "the system and services acquisition policy is reviewed / updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01c.01[01]", "defaultText": null }, { "id": 74180, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59123", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59123", "securityControlId": 32021, "ccis": [], "uuid": "e2555155-1b02-526d-9abf-6481a918a059", "testId": "TDA-01_A26", "test": "the current system and services acquisition policy is reviewed / updated following organization-defined events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01c.01[02]", "defaultText": null }, { "id": 74181, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59123", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59123", "securityControlId": 32021, "ccis": [], "uuid": "34732b80-e392-571d-965c-0f951437c9f3", "testId": "TDA-01_A27", "test": "the current system and services acquisition procedures are reviewed / updated organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01c.02[01]", "defaultText": null }, { "id": 74182, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59123", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59123", "securityControlId": 32021, "ccis": [], "uuid": "49d506f5-3664-5cc1-9740-006358d09ec6", "testId": "TDA-01_A28", "test": "the current system and services acquisition procedures are reviewed / updated following organization-defined events.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-01c.02[02]", "defaultText": null }, { "id": 74183, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59123", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59123", "securityControlId": 32021, "ccis": [], "uuid": "e5716add-e627-53f4-8641-d0ba2fc766c1", "testId": "TDA-01_A29", "test": "systems or system components supporting mission-essential services or functions are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-23_ODP[01]\n53A_R5_SA-23_ODP[02]", "defaultText": null }, { "id": 74184, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591231", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591231", "securityControlId": 32021, "ccis": [], "uuid": "98115b87-ce52-5fd2-8404-19ecc4276237", "testId": "TDA-01_A30", "test": "organization's is employed on organization-defined systems or system components supporting essential services or functions to increase the trustworthiness in those systems or components.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-23", "defaultText": null }, { "id": 74185, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591231", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591231", "securityControlId": 32021, "ccis": [], "uuid": "fd23f39d-986c-599e-8a7e-ce9e89ba7610", "testId": "TDA-01_A31", "test": "systems security engineering principles to be applied to the development or modification of the system and system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.16.01.ODP[01]", "defaultText": null }, { "id": 74186, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591231", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591231", "securityControlId": 32021, "ccis": [], "uuid": "d59357d7-3252-5428-b4e2-51af6a725d7c", "testId": "TDA-01_A32", "test": "Technology Development & Acquisition (TDA) operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74187, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591231", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591231", "securityControlId": 32021, "ccis": [], "uuid": "b9f5a752-a21c-5c8f-a2c0-ca14e19dbcc6", "testId": "TDA-01_A33", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support Technology Development & Acquisition (TDA) operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74188, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591231", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591231", "securityControlId": 32021, "ccis": [], "uuid": "35a006c4-9752-53bb-ad19-3f9e532716b0", "testId": "TDA-01_A34", "test": "responsibility and authority for the performance of Technology Development & Acquisition (TDA)-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74189, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591231", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591231", "securityControlId": 32021, "ccis": [], "uuid": "b8c611ad-4fb4-53ea-8ecb-55d237134771", "testId": "TDA-01_A35", "test": "personnel performing Technology Development & Acquisition (TDA)-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 604039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590123", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c1485ec-e517-52d3-baf7-e7e1839d3a27", "parentControlId": 32021, "controlId": "ORG 2.3", "title": "ORG 2.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590123" }, { "id": 604041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590123", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44b4d5ec-6825-5ee9-82e7-7d4defbc8342", "parentControlId": 32021, "controlId": "8.25", "title": "8.25", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590123" }, { "id": 604042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590123", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0c661d3-954f-50d5-977b-ffbc92039ebe", "parentControlId": 32021, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590123" }, { "id": 604051, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590124", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50b5a94b-04eb-5447-b14b-421ce481220f", "parentControlId": 32021, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590124" }, { "id": 604052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590124", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f04ff2d-086e-5893-9d71-134d1dd66456", "parentControlId": 32021, "controlId": "T1078.001", "title": "T1078.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590124" }, { "id": 604053, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590125", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8a016ae-f48a-5808-b24b-596a4e3e5f11", "parentControlId": 32021, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590125" }, { "id": 604054, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590125", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c86c2983-80f6-501d-a22e-6f48a3850e42", "parentControlId": 32021, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590125" }, { "id": 604055, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590125", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98772a9a-fdb9-5ce9-bbbf-5f4af7f6af11", "parentControlId": 32021, "controlId": "T1134.005", "title": "T1134.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590125" }, { "id": 604056, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590125", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "042ce79c-42eb-5f05-8b2c-b313cf189c74", "parentControlId": 32021, "controlId": "T1574.002", "title": "T1574.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590125" }, { "id": 604062, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590125", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3bfdbb8-b3a3-575a-8198-00c6de32bf19", "parentControlId": 32021, "controlId": "PL-1", "title": "PL-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590126" }, { "id": 604063, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590126", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b0c28dc-ab9c-5c27-864a-960ead8a545c", "parentControlId": 32021, "controlId": "SA-1", "title": "SA-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590126" }, { "id": 604064, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590126", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68eafd5c-b06c-56ce-b06c-d13e2bd33cfc", "parentControlId": 32021, "controlId": "SA-4", "title": "SA-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590126" }, { "id": 604065, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590126", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6837773b-d2e5-5bea-81ec-6e9a505db1ff", "parentControlId": 32021, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590126" }, { "id": 604066, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590126", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7a4217d-1273-57f3-9dd9-d8d7c93b9db5", "parentControlId": 32021, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590126" }, { "id": 604067, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590126", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13b66b64-1284-5947-b965-76c1af6a80a4", "parentControlId": 32021, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590126" }, { "id": 604068, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590126", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "367dfe1f-0119-5c59-96e5-9dbadf1cce52", "parentControlId": 32021, "controlId": "SA-23", "title": "SA-23", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590126" }, { "id": 604073, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590127", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a01eccd-bb52-56d0-826c-68e491a4316f", "parentControlId": 32021, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590127" }, { "id": 604074, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590127", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aaa791e1-3cd8-512e-8dd3-fda4c7413007", "parentControlId": 32021, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590127" }, { "id": 604075, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590127", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66d9fcd2-0c0f-5cc5-a632-2cb9183c1648", "parentControlId": 32021, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590127" }, { "id": 604076, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590127", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1654332-d866-5476-8803-4cee9106857c", "parentControlId": 32021, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590127" }, { "id": 604077, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590127", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71aadba1-b4c0-5d97-8cf2-9a9dbb63f618", "parentControlId": 32021, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590127" }, { "id": 604078, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590127", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18c54f97-fad2-52c8-b7c2-c8726865c44f", "parentControlId": 32021, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590127" }, { "id": 604079, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1f9b663-fd05-5d41-9fa2-159591b58115", "parentControlId": 32021, "controlId": "SA-23", "title": "SA-23", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590128" }, { "id": 604080, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe1dbffb-5478-563a-a577-1f5e85224204", "parentControlId": 32021, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590128" }, { "id": 604081, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58c94486-0262-5c32-89fe-c01581e3139b", "parentControlId": 32021, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590128" }, { "id": 604082, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94ebe316-3469-5348-95f1-244d059af058", "parentControlId": 32021, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590128" }, { "id": 604083, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5e515d3-a6a2-5720-9352-24a76a7a5e02", "parentControlId": 32021, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590128" }, { "id": 604084, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e23fb367-449b-5eac-86a1-e1a76fc27af7", "parentControlId": 32021, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590128" }, { "id": 604085, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fcda8567-55fd-5d8d-b339-54e5e6e6a57e", "parentControlId": 32021, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590128" }, { "id": 604086, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13b2d8a4-fcbf-566a-990d-d6d7987d5955", "parentControlId": 32021, "controlId": "PL-01", "title": "PL-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590128" }, { "id": 604087, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d24c649-9366-5d38-b824-fdbb47592c37", "parentControlId": 32021, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590128" }, { "id": 604088, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf51ae29-6fc3-5641-becb-a88d409df4ce", "parentControlId": 32021, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590128" }, { "id": 604090, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590129", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0590197-5161-5223-ab82-4f16fc7dab85", "parentControlId": 32021, "controlId": "PL-1", "title": "PL-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590129" }, { "id": 604091, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590129", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5fb6786c-c72c-566f-aed7-658a733a6b7e", "parentControlId": 32021, "controlId": "SA-1", "title": "SA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590129" }, { "id": 604092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590129", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad3c402d-a3e9-577b-a0ab-f3cacaad995b", "parentControlId": 32021, "controlId": "SA-4", "title": "SA-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590129" }, { "id": 604093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590129", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0c040e2-749e-5e9f-bc86-8f05db3afdb5", "parentControlId": 32021, "controlId": "PL-1", "title": "PL-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590129" }, { "id": 604094, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590129", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5285682d-2a0d-548f-bb4e-7d2639ee2cba", "parentControlId": 32021, "controlId": "SA-1", "title": "SA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590129" }, { "id": 604095, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590129", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60d49f80-58e4-5716-96ae-fca9023e25d1", "parentControlId": 32021, "controlId": "SA-4", "title": "SA-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590129" }, { "id": 604103, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54ad1cda-3958-5482-8487-8382758591ad", "parentControlId": 32021, "controlId": "NFO - SA-4", "title": "NFO - SA-4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59013" }, { "id": 604104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30e7f2ff-f56c-543e-8dfa-b1454a855af7", "parentControlId": 32021, "controlId": "03.12.01", "title": "03.12.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59013" }, { "id": 604105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a378c1ef-358e-5b39-a05f-04da8190fe60", "parentControlId": 32021, "controlId": "03.12.03", "title": "03.12.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59013" }, { "id": 604106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590131", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0594c76c-9f9f-5511-8a22-4d210b96045e", "parentControlId": 32021, "controlId": "03.14.01.a", "title": "03.14.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590131" }, { "id": 604107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590131", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cdbb20b5-5585-5a8e-b061-a48f2b379c1f", "parentControlId": 32021, "controlId": "03.16.01", "title": "03.16.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590131" }, { "id": 604108, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590131", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c7a8c3c-a310-56e8-ac29-14168d833b26", "parentControlId": 32021, "controlId": "03.17.02", "title": "03.17.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590131" }, { "id": 604117, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590132", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2190079b-fce1-53c6-89c9-64238b67f969", "parentControlId": 32021, "controlId": "ID.RA-09", "title": "ID.RA-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590132" }, { "id": 604118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590132", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74054ebe-defb-57a8-aa68-344a55110564", "parentControlId": 32021, "controlId": "PR.PS-06", "title": "PR.PS-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590132" }, { "id": 604141, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69d0f81f-7a87-5ba8-824e-a6491fb0f8e0", "parentControlId": 32021, "controlId": "ARCHITECTURE-4a", "title": "ARCHITECTURE-4a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590135" }, { "id": 604142, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8039896c-0dc8-58f5-9b6f-ed4cf005b077", "parentControlId": 32021, "controlId": "ARCHITECTURE-4b", "title": "ARCHITECTURE-4b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590135" }, { "id": 604143, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590135", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d7bc29f-6d1d-52f3-826c-ffd3656d9e4b", "parentControlId": 32021, "controlId": "ARCHITECTURE-4e", "title": "ARCHITECTURE-4e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590135" }, { "controlId": "C.12.1", "title": "C.12.1 — System and Services Acquisition Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SA-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "760a04d3-8306-5cd4-9d1e-25dc0fb132c3", "isPublic": true }, { "controlId": "NEI 08-09 App E.12.1 / NEI 10-08", "title": "NEI 08-09 App E.12.1 / NEI 10-08 — System and Services Acquisition Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.12.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "805d6669-4fc5-5d4e-b854-cdb70ae768dd", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(4)", "title": "10 CFR 73.54(d)(4) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.12.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "f125d3d4-4d4a-5eb0-b9e0-6483965ae85b", "isPublic": true }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "c6f1143c-3d5b-5c00-aa09-65bc11919f14", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "b6051cb3-ecc6-5100-9173-e01d555d31e4", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "6fa7711a-c42f-5e6f-b61c-5fd461c990f3", "isPublic": true } ], "id": 32021, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731332", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731332", "catalogueId": 1062, "uuid": "4dae5130-96fe-5487-8028-b025cf87ad88", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of tailored development and acquisition strategies, contract tools and procurement methods to meet unique business needs?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Technology Development & Acquisition", "description": "

Control Description

Mechanisms exist to facilitate the implementation of tailored development and acquisition strategies, contract tools and procurement methods to meet unique business needs.

Evidence Request List (ERL)

E-TDA-01\nE-TDA-02\nE-TDA-08\nE-TDA-17

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Technology Development & Acquisition (TDA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TDA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Technology development & acquisition-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Secure development practices loosely conform to industry-recognized standards for secure engineering (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.\n▪ Development and acquisition management is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of tailored development and acquisition strategies, contract tools and procurement methods to meet unique business needs.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.12.1", "controlId": "TDA-01", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-01", "references": "

Micro-Small Business (<10 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements

Small Business (10-49 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements

Medium Business (50-249 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight

Large Business (250-999 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight

Enterprise (>1,000 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74190, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591232", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591232", "securityControlId": 32022, "ccis": [], "uuid": "55138ab2-ac78-545a-94fb-491646029732", "testId": "TDA-01.1_A01", "test": "product management processes are designed and implemented to ensure products, including systems, software and services, are routinely updated to improve functionality and correct security deficiencies.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74191, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591232", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591232", "securityControlId": 32022, "ccis": [], "uuid": "30eae1ee-2659-57f1-9550-8a46669cba03", "testId": "TDA-01.1_A02", "test": "systems or system components supporting mission-essential services or functions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-23_ODP[01]\n53A_R5_SA-23_ODP[02]", "defaultText": null }, { "id": 74192, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591232", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591232", "securityControlId": 32022, "ccis": [], "uuid": "5419da57-4529-55de-b460-5958de46725e", "testId": "TDA-01.1_A03", "test": "organization-defined criteria are employed on systems or system components supporting essential services or functions to increase the trustworthiness in those systems or components.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-23", "defaultText": null } ], "externalMappings": [ { "id": 604318, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "635bba01-9dfa-5273-b599-0faa54839f5f", "parentControlId": 32022, "controlId": "DM-6", "title": "DM-6", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590164" }, { "id": 604319, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4dd5891c-92d8-5627-b6cd-88c5cd892fbd", "parentControlId": 32022, "controlId": "SG-1", "title": "SG-1", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590164" }, { "id": 604320, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4df29e9a-f13d-5d91-aaae-501386f78505", "parentControlId": 32022, "controlId": "SG-1(a)", "title": "SG-1(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590164" }, { "id": 604321, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ebcaba4-44b7-5914-b25d-74e13e11a55f", "parentControlId": 32022, "controlId": "SG-1(b)", "title": "SG-1(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590164" }, { "id": 604322, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19b8bb36-0527-5acb-bfa7-4116cb034c90", "parentControlId": 32022, "controlId": "SG-1(c)", "title": "SG-1(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590164" }, { "id": 604323, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "adf5eab3-58fe-5c5c-ac92-f26db17d225a", "parentControlId": 32022, "controlId": "SG-2", "title": "SG-2", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590164" }, { "id": 604324, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "60b32791-963b-5e1c-baf0-ce74f7dda03f", "parentControlId": 32022, "controlId": "SG-7", "title": "SG-7", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590165" }, { "id": 604325, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa8ba19a-720f-5d13-b5e0-d80ec3d540bd", "parentControlId": 32022, "controlId": "SG-7(a)", "title": "SG-7(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590165" }, { "id": 604326, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa3625fd-c4f4-52a1-99c7-025b7fb02ef6", "parentControlId": 32022, "controlId": "SG-7(b)", "title": "SG-7(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590165" }, { "id": 604327, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d1c4fb6-be21-5386-b25d-b4ac2ac785f1", "parentControlId": 32022, "controlId": "SG-7(c)", "title": "SG-7(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590165" }, { "id": 604328, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b901b070-0d52-54fb-88f6-3a9f9101ae90", "parentControlId": 32022, "controlId": "CR 3.10", "title": "CR 3.10", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590165" }, { "id": 604329, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82dbd6fe-89cf-5d34-a2e0-db659c10b8db", "parentControlId": 32022, "controlId": "EDR 3.10", "title": "EDR 3.10", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590165" }, { "id": 604330, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d7b4329-219b-512e-b57c-1ef9be2b0bf3", "parentControlId": 32022, "controlId": "HDR 3.10", "title": "HDR 3.10", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590165" }, { "id": 604331, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d15dc46-1da9-5f1d-9310-c9c7e19dc276", "parentControlId": 32022, "controlId": "NDR 3.10", "title": "NDR 3.10", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590165" }, { "id": 604373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb6c7bd8-8d14-5f99-8aec-663f3d2b716c", "parentControlId": 32022, "controlId": "SA-23", "title": "SA-23", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59017" }, { "id": 604375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b682857-72b3-54ff-a865-f9970a5ccf8f", "parentControlId": 32022, "controlId": "SA-23", "title": "SA-23", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59017" }, { "id": 604377, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59017", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a8ca31f3-1c5f-559d-8ff2-18bd76c76ef6", "parentControlId": 32022, "controlId": "03.12.03", "title": "03.12.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59017" }, { "id": 604393, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69b1cc63-99ef-527c-8238-edbb899ce831", "parentControlId": 32022, "controlId": "GV.SC-09", "title": "GV.SC-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590172" }, { "id": 604394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590172", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5385d61-af67-548d-b35a-efdd595a89e5", "parentControlId": 32022, "controlId": "PR.PS-06", "title": "PR.PS-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590172" }, { "id": 604551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30474a66-f72a-55bf-81be-63f0654ab121", "parentControlId": 32022, "controlId": "ARCHITECTURE-4c", "title": "ARCHITECTURE-4c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590201" } ], "id": 32022, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731333", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731333", "catalogueId": 1062, "uuid": "0c945562-a17f-5445-8c89-7e9155a53a89", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization design and implement product management processes to proactively govern the design, development and production of Technology Assets, Applications and/or Services (TAAS) across the System Development Life Cycle (SDLC) to:\n(1) Improve functionality;\n(2) Enhance security and resiliency capabilities; \n(3) Correct security deficiencies; and\n(4) Conform with applicable statutory, regulatory and/or contractual obligations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Product Management", "description": "

Control Description

Mechanisms exist to design and implement product management processes to proactively govern the design, development and production of Technology Assets, Applications and/or Services (TAAS) across the System Development Life Cycle (SDLC) to:\n(1) Improve functionality;\n(2) Enhance security and resiliency capabilities; \n(3) Correct security deficiencies; and\n(4) Conform with applicable statutory, regulatory and/or contractual obligations.

Evidence Request List (ERL)

E-CPL-06\nE-TDA-05\nE-TDA-06\nE-TDA-07\nE-TDA-15\nE-TDA-17

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Technology Development & Acquisition (TDA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TDA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Technology development & acquisition-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Secure development practices loosely conform to industry-recognized standards for secure engineering (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.). \n▪ IT and/or cybersecurity personnel use an informal process to govern changes to the software library to prevent unauthorized changes and create an audit trail of changes made.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.\n▪ Development and acquisition management is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to design and implement product management processes to proactively govern the design, development and production of Technology Assets, Applications and/or Services (TAAS) across the System Development Life Cycle (SDLC) to:\n(1) Improve functionality;\n(2) Enhance security and resiliency capabilities; \n(3) Correct security deficiencies; and\n(4) Conform with applicable statutory, regulatory and/or contractual obligations.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-01.1", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements

Small Business (10-49 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements

Medium Business (50-249 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight

Large Business (250-999 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight

Enterprise (>1,000 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74193, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591232", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591232", "securityControlId": 32023, "ccis": [], "uuid": "84a4f0c9-0b6f-5fd2-a94c-9ecde499e7f7", "testId": "TDA-01.2_A01", "test": "integrity validation mechanisms are utilized for security updates.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 604681, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590216", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "732a1047-4f94-5ef8-9af5-23943166e1c6", "parentControlId": 32023, "controlId": "ID.RA-09", "title": "ID.RA-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590216" }, { "controlId": "B.5.5", "title": "B.5.5 — Installing Operating Systems, Applications, and Third-Party Software Updates", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-11, SI-7, CM-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "9d2b0cd4-03b5-5678-8cc6-cc6fb7114aee", "isPublic": true }, { "controlId": "NEI 08-09 App D.5.5", "title": "NEI 08-09 App D.5.5 — Installing Operating Systems, Applications, and Third-Party Software Updates", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.5.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "970cac6c-31b3-55f0-a28a-179f69d6117d", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.5.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "0988dd15-b533-588a-bdb0-1baf3052f75f", "isPublic": true }, { "controlId": "C.3.7", "title": "C.3.7 — Software and Information Integrity", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "3c8e9d60-f59a-571c-99b5-865d5867d6aa", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.7", "title": "NEI 08-09 App E.3.7 — Software and Information Integrity", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.7", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "7752d37f-be32-597a-ab27-3e66ff205099", "isPublic": true }, { "controlId": "CIP-013-2-R1", "title": "CIP-013-2-R1 — Supply Chain Cyber Security Risk Management Plan", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4098c41e-d0a2-550b-a388-71ef6835c995", "isPublic": true }, { "controlId": "CIP-013-2-1.1", "title": "CIP-013-2-1.1 — One or more process(es) used in planning for the procurement of BES Cyber Systems and their associated EACMS and PACS...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-013-2-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9a03b401-5637-5322-9fcf-979a1aa621a1", "isPublic": true }, { "controlId": "CIP-013-2-1.2", "title": "CIP-013-2-1.2 — One or more process(es) used in procuring BES Cyber Systems, and their associated EACMS and PACS, that address the fo...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-013-2-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "807018a7-a94b-555d-8359-7b011c3177d6", "isPublic": true }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "e6a5d21b-7fe4-5a24-a762-29279f745a11", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "4b1b6c2f-58b2-50e4-803e-fe3e24b7b304", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "e31cae81-2e2f-58c9-8c18-d9acdd85f68b", "isPublic": true } ], "id": 32023, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731333", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731333", "catalogueId": 1062, "uuid": "c26c42fa-fb68-54d3-b65b-683a3d629bc6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize integrity validation mechanisms for security updates?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 5.0, "title": "Integrity Mechanisms for Software / Firmware Updates", "description": "

Control Description

Mechanisms exist to utilize integrity validation mechanisms for security updates.

Evidence Request List (ERL)

E-TDA-15

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Technology Development & Acquisition (TDA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TDA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Technology development & acquisition-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Secure development practices loosely conform to industry-recognized standards for secure engineering (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize integrity validation mechanisms for security updates.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.5.5, C.3.7
NERC-CIP (2026) Requirements: CIP-013-2-R1", "controlId": "TDA-01.2", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-01.2", "references": "

Micro-Small Business (<10 staff)

∙ Checksum comparison

Small Business (10-49 staff)

∙ Checksum comparison

Medium Business (50-249 staff)

∙ Checksum comparison\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Large Business (250-999 staff)

∙ Checksum comparison\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)

Enterprise (>1,000 staff)

∙ Checksum comparison\n∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak)\n∙ Netwrix Auditor (https://netrix.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74196, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591233", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591233", "securityControlId": 32026, "ccis": [], "uuid": "d77beace-a5f6-53a3-a8bd-342a7d7ba078", "testId": "TDA-02_A01", "test": "cybersecurity / data privacy functional requirements, descriptions and criteria are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04a.[01]\n53A_R5_SA-04a.[02]", "defaultText": null }, { "id": 74197, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591233", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591233", "securityControlId": 32026, "ccis": [], "uuid": "5d9932dc-9e37-561f-ac48-968b7d358e86", "testId": "TDA-02_A02", "test": "strength of mechanism requirements, descriptions and criteria are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04b.", "defaultText": null }, { "id": 74198, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591233", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591233", "securityControlId": 32026, "ccis": [], "uuid": "7656818d-6cd9-5208-8f74-623c09664635", "testId": "TDA-02_A03", "test": "cybersecurity / data privacy assurance requirements, descriptions and criteria are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04c.[01]\n53A_R5_SA-04c.[02]", "defaultText": null }, { "id": 74199, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591233", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591234", "securityControlId": 32026, "ccis": [], "uuid": "11a7d2b0-0242-5288-b32f-0cc2acdd3500", "testId": "TDA-02_A04", "test": "controls needed to satisfy the cybersecurity / data requirements, descriptions and criteria are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04d.[01]\n53A_R5_SA-04d.[02]", "defaultText": null }, { "id": 74200, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591234", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591234", "securityControlId": 32026, "ccis": [], "uuid": "669819e3-9c4e-57c4-856f-56d289d78a60", "testId": "TDA-02_A05", "test": "cybersecurity / data privacy documentation requirements, descriptions and criteria are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-04e.[01]\n53A_R5_SA-04e.[02]", "defaultText": null }, { "id": 74201, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591234", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591234", "securityControlId": 32026, "ccis": [], "uuid": "639dc67a-54fe-5f27-a42f-61041f8e0819", "testId": "TDA-02_A06", "test": "requirements for protecting cybersecurity / data privacy documentation, descriptions and criteria are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-04f.[01]\n53A_R5_SA-04f.[02]", "defaultText": null }, { "id": 74202, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591234", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591234", "securityControlId": 32026, "ccis": [], "uuid": "79797d63-0633-5a2f-9d3b-942bd8ced314", "testId": "TDA-02_A07", "test": "the description of the system development environment and environment in which the system is intended to operate, requirements and criteria are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-04g.", "defaultText": null }, { "id": 74203, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591234", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591234", "securityControlId": 32026, "ccis": [], "uuid": "f49939e7-1bff-5f04-9a60-f0b2dc744f38", "testId": "TDA-02_A08", "test": "the allocation of responsibility or identification of parties responsible for cybersecurity / data privacy requirements, descriptions and criteria are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-04h.[01]\n53A_R5_SA-04h.[02]", "defaultText": null }, { "id": 74204, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591234", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591234", "securityControlId": 32026, "ccis": [], "uuid": "66e92870-09b1-527a-9820-22278f447e0b", "testId": "TDA-02_A09", "test": "the allocation of responsibility or identification of parties responsible for supply chain risk management requirements, descriptions and criteria are included explicitly or by reference using organization-defined criteria.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-04h.[03]", "defaultText": null }, { "id": 74205, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591234", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591234", "securityControlId": 32026, "ccis": [], "uuid": "47c69bd8-951f-53b2-9d54-04ff3cbc0a1e", "testId": "TDA-02_A10", "test": "acceptance criteria requirements and descriptions are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-04i.", "defaultText": null } ], "externalMappings": [ { "id": 604708, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590219", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "deb786f0-b2ce-52af-b400-f54337e8494b", "parentControlId": 32026, "controlId": "SM-11", "title": "SM-11", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59022" }, { "id": 604709, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e945f17-655a-5673-a097-bd980f983f97", "parentControlId": 32026, "controlId": "SR-1", "title": "SR-1", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59022" }, { "id": 604710, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eab45aa6-31e9-54a3-8e52-8214159ea78e", "parentControlId": 32026, "controlId": "SR-4", "title": "SR-4", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59022" }, { "id": 604711, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e57712b2-7880-5ea0-9d2c-582e5d5b2835", "parentControlId": 32026, "controlId": "SR-4(a)", "title": "SR-4(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59022" }, { "id": 604712, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27f88208-48a6-5bdd-b0ea-c76b02b85f97", "parentControlId": 32026, "controlId": "SR-4(b)", "title": "SR-4(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59022" }, { "id": 604713, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c52b25b0-8524-5560-9e63-73db2cf3a32e", "parentControlId": 32026, "controlId": "8.25", "title": "8.25", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59022" }, { "id": 604714, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb9ac534-3333-5f50-a7ef-0e58a23036a7", "parentControlId": 32026, "controlId": "8.29", "title": "8.29", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59022" }, { "id": 604715, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f09c37be-152b-5723-bd4c-d2567c90734a", "parentControlId": 32026, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59022" }, { "id": 604721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590221", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "980536e2-3f3e-5967-95a5-83e13995e6ac", "parentControlId": 32026, "controlId": "SA-4", "title": "SA-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590221" }, { "id": 604722, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590221", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a56c306-63b1-54cb-a95f-a76f6d3d661d", "parentControlId": 32026, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590221" }, { "id": 604724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fd999a2-6344-5ea2-845d-fb6b2c044b88", "parentControlId": 32026, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590222" }, { "id": 604725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96e7963d-1df6-5274-bfdf-2fa0b3185900", "parentControlId": 32026, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590222" }, { "id": 604726, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e27e1eb-6923-58bc-9b60-dfcf00a39b8a", "parentControlId": 32026, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590222" }, { "id": 604727, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d53c344-46f2-5e47-acbe-f3bba4c9cb9b", "parentControlId": 32026, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590222" }, { "id": 604728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebfb6542-7e27-5267-87ed-2d18174e721b", "parentControlId": 32026, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590222" }, { "id": 604729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c26f042a-954d-5c69-bf76-5d5f71198b46", "parentControlId": 32026, "controlId": "SA-4", "title": "SA-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590222" }, { "id": 604730, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590222", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ffcd7054-60ae-51be-afae-c84ccfe69641", "parentControlId": 32026, "controlId": "SA-4", "title": "SA-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590222" }, { "id": 604734, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f708720-3336-57c2-9a46-d88130783207", "parentControlId": 32026, "controlId": "NFO - SA-4", "title": "NFO - SA-4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590223" }, { "id": 604735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590223", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f825a33a-a0ef-5681-994a-949a480be4be", "parentControlId": 32026, "controlId": "03.16.01", "title": "03.16.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590223" }, { "id": 604761, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d394088-345f-599c-9adb-b42be47b4a9d", "parentControlId": 32026, "controlId": "ARCHITECTURE-4b", "title": "ARCHITECTURE-4b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590226" }, { "id": 604762, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d829e51f-9560-5872-9b3e-2f7b6b85290c", "parentControlId": 32026, "controlId": "ARCHITECTURE-4c", "title": "ARCHITECTURE-4c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590226" }, { "id": 604763, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590226", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a14df73-6566-5804-905c-e6992e1fe3cd", "parentControlId": 32026, "controlId": "ARCHITECTURE-4e", "title": "ARCHITECTURE-4e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590226" }, { "controlId": "C.12.4", "title": "C.12.4 — Integration of Security Capabilities", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SA-4, SA-8", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "85dfb7ce-18fa-559b-b967-fbaffb0a8516", "isPublic": true }, { "controlId": "NEI 08-09 App E.12.4", "title": "NEI 08-09 App E.12.4 — Integration of Security Capabilities", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.12.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "1913952c-dab9-5aba-92cd-50c3ac40c0b4", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.12.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "0350e0e3-37e4-5bdb-9efa-46fa363141c8", "isPublic": true }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "ca7fa138-7152-5dc1-b154-892d97c2deab", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "096cc58e-5971-592a-9853-6a8f7f31c7f2", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "9b26be50-ae29-5aa4-846c-e8ccd0b1a417", "isPublic": true } ], "id": 32026, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731335", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731335", "catalogueId": 1062, "uuid": "ab12a83a-4498-557b-bdbb-0583a079f211", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization design, develop and produce Technology Assets, Applications and/or Services (TAAS) in such a way that risk-based technical and functional specifications ensure Minimum Viable Product (MVP) criteria establish an appropriate level of security and resiliency based on applicable risks and threats?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Minimum Viable Product (MVP) Security Requirements", "description": "

Control Description

Mechanisms exist to design, develop and produce Technology Assets, Applications and/or Services (TAAS) in such a way that risk-based technical and functional specifications ensure Minimum Viable Product (MVP) criteria establish an appropriate level of security and resiliency based on applicable risks and threats.

Evidence Request List (ERL)

E-TDA-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to design, develop and produce Technology Assets, Applications and/or Services (TAAS) in such a way that risk-based technical and functional specifications ensure Minimum Viable Product (MVP) criteria establish an appropriate level of security and resiliency based on applicable risks and threats.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.12.4", "controlId": "TDA-02", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-02", "references": "

Micro-Small Business (<10 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements

Small Business (10-49 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements

Medium Business (50-249 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight

Large Business (250-999 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight

Enterprise (>1,000 staff)

∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74206, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591235", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591235", "securityControlId": 32027, "ccis": [], "uuid": "beae6221-7a63-587d-b7c0-6dcdefe692c8", "testId": "TDA-02.1_A01", "test": "the developer of the system, system component or system service is required to identify the functions intended for organizational use.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(09)[01]", "defaultText": null }, { "id": 74207, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591235", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591235", "securityControlId": 32027, "ccis": [], "uuid": "1e0e4949-55f0-56d7-b1c9-3ef5fe43e701", "testId": "TDA-02.1_A02", "test": "the developer of the system, system component or system service is required to identify the ports intended for organizational use.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(09)[02]", "defaultText": null }, { "id": 74208, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591235", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591235", "securityControlId": 32027, "ccis": [], "uuid": "58cc5bf7-ad30-51da-ba58-0f3c606a9f89", "testId": "TDA-02.1_A03", "test": "the developer of the system, system component or system service is required to identify the protocols intended for organizational use.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(09)[03]", "defaultText": null }, { "id": 74209, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591235", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591235", "securityControlId": 32027, "ccis": [], "uuid": "030a9ab9-299f-54c8-9c8e-3f5006cfc0ba", "testId": "TDA-02.1_A04", "test": "the developer of the system, system component or system service is required to identify the services intended for organizational use.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(09)[04]", "defaultText": null } ], "externalMappings": [ { "id": 604817, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59024", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9c9eefc-01d6-5e20-b0bc-130cc334e122", "parentControlId": 32027, "controlId": "SA-4(9)", "title": "SA-4(9)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59024" }, { "id": 604818, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59024", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b92e2f2-7731-5607-9031-ba199e2ec760", "parentControlId": 32027, "controlId": "SA-04(09)", "title": "SA-04(09)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59024" }, { "id": 604819, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590241", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7bfb2939-2613-5ec1-8043-c764bfa36bcf", "parentControlId": 32027, "controlId": "SA-04(09)", "title": "SA-04(09)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590241" }, { "id": 604820, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590241", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5adb78a-e981-5e6f-972d-80a8756e75a3", "parentControlId": 32027, "controlId": "SA-04(09)", "title": "SA-04(09)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590241" }, { "id": 604821, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590241", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21b9d4b0-ff7e-5adb-bda3-544e16217c07", "parentControlId": 32027, "controlId": "SA-04(09)", "title": "SA-04(09)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590241" }, { "id": 604822, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590241", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c31b70b1-d561-550d-b4e9-20de9cfa0fb0", "parentControlId": 32027, "controlId": "SA-04(09)", "title": "SA-04(09)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590241" }, { "id": 604823, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590241", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f1e913e-6f91-5483-af12-038edb3ed642", "parentControlId": 32027, "controlId": "NFO - SA-4(9)", "title": "NFO - SA-4(9)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590241" } ], "id": 32027, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731335", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731335", "catalogueId": 1062, "uuid": "083d029f-4131-5aec-9243-6d757fd861cf", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require the developers of Technology Assets, Applications and/or Services (TAAS) to identify early in the Secure Development Life Cycle (SDLC), the functions, ports, protocols and services intended for use?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Ports, Protocols & Services In Use", "description": "

Control Description

Mechanisms exist to require the developers of Technology Assets, Applications and/or Services (TAAS) to identify early in the Secure Development Life Cycle (SDLC), the functions, ports, protocols and services intended for use.

Evidence Request List (ERL)

E-CPL-06\nE-TDA-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Technology Development & Acquisition (TDA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TDA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Technology development & acquisition-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Secure development practices loosely conform to industry-recognized standards for secure engineering (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require the developers of Technology Assets, Applications and/or Services (TAAS) to identify early in the Secure Development Life Cycle (SDLC), the functions, ports, protocols and services intended for use.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-02.1", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-02.1", "references": "

Micro-Small Business (<10 staff)

∙ Defined & documented Ports, Protocols & Services (PPS) to support \"least functionality\" governance

Small Business (10-49 staff)

∙ Defined & documented Ports, Protocols & Services (PPS) to support \"least functionality\" governance

Medium Business (50-249 staff)

∙ Defined & documented Ports, Protocols & Services (PPS) to support \"least functionality\" governance

Large Business (250-999 staff)

∙ Defined & documented Ports, Protocols & Services (PPS) to support \"least functionality\" governance

Enterprise (>1,000 staff)

∙ Defined & documented Ports, Protocols & Services (PPS) to support \"least functionality\" governance", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74210, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591236", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591236", "securityControlId": 32028, "ccis": [], "uuid": "cad026af-c170-57ff-8d62-f7e0a19e9654", "testId": "TDA-02.2_A01", "test": "as required per statutory, regulatory or contractual obligations, only information technology products on the FIPS 201-approved products list for the Personal Identity Verification (PIV) capability implemented within organizational systems are employed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(10)", "defaultText": null } ], "externalMappings": [ { "id": 604856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9276b157-e832-5a94-9582-6e9ab269b209", "parentControlId": 32028, "controlId": "SA-4(10)", "title": "SA-4(10)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590245" }, { "id": 604857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6220079f-c5cc-5870-acf7-da7cba17b1d5", "parentControlId": 32028, "controlId": "IA-5(11)", "title": "IA-5(11)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590245" }, { "id": 604858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a42746f5-5955-50bf-8139-d455930a602b", "parentControlId": 32028, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590245" }, { "id": 604859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9357e1c-fba6-53b3-b98b-a14d7cc9aa25", "parentControlId": 32028, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590245" }, { "id": 604860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "105608ff-5c94-5f0d-8c5e-5e769749435c", "parentControlId": 32028, "controlId": "SA-04(07)", "title": "SA-04(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590245" }, { "id": 604861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590245", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e02fdfa-6403-558f-9142-ca38adf3ec83", "parentControlId": 32028, "controlId": "SA-04(10)", "title": "SA-04(10)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590245" }, { "id": 604864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f385b8e5-a1a1-588e-8bed-27b939b9549d", "parentControlId": 32028, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590246" }, { "id": 604865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3936b29-09eb-5630-b8af-ff54c4d40f89", "parentControlId": 32028, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590246" }, { "id": 604866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0abb9e25-7fac-5377-8777-64e05c23a5d5", "parentControlId": 32028, "controlId": "SA-04(10)", "title": "SA-04(10)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590246" }, { "id": 604867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67f4e9a2-6750-5c2d-8688-d54c80fdde42", "parentControlId": 32028, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590246" }, { "id": 604868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43bb09b4-d8fc-556e-b3c5-e8386776e854", "parentControlId": 32028, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590246" }, { "id": 604869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b41abbce-24f7-536e-a0e0-3dd78765487e", "parentControlId": 32028, "controlId": "SA-04(07)", "title": "SA-04(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590247" }, { "id": 604870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93e4fa66-753b-59a8-9061-554947b6ea42", "parentControlId": 32028, "controlId": "SA-04(10)", "title": "SA-04(10)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590247" }, { "id": 604871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7bf65fd9-6da6-512e-8fc5-557644a6b1d9", "parentControlId": 32028, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590247" }, { "id": 604872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8799313a-1ced-59cb-ad31-25902fa2ec81", "parentControlId": 32028, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590247" }, { "id": 604873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b52e6dc-1d92-5042-99a8-fd51cdc85a8f", "parentControlId": 32028, "controlId": "SA-04(10)", "title": "SA-04(10)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590247" }, { "id": 604874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d15a97ac-94f7-54c7-b3a2-8b3894053911", "parentControlId": 32028, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590247" }, { "id": 604875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e4f0c22-e030-5942-9fa0-59ff678137e3", "parentControlId": 32028, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590247" }, { "id": 604876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cfb9f3b6-4b1c-5eaf-87f6-495b073c7194", "parentControlId": 32028, "controlId": "SA-04(10)", "title": "SA-04(10)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590247" }, { "id": 604877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ed59a02-cdc4-563e-9cad-2b672cf5a799", "parentControlId": 32028, "controlId": "IA-02(01)", "title": "IA-02(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590247" }, { "id": 604878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590248", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11eee1ed-fd26-52fd-b446-2d1ffb52ed4c", "parentControlId": 32028, "controlId": "IA-02(02)", "title": "IA-02(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590248" }, { "id": 604879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590248", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b47ca3b-973a-5e55-89fd-eec493bc9c58", "parentControlId": 32028, "controlId": "SA-04(10)", "title": "SA-04(10)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590248" }, { "id": 604880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590248", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1212b4af-b340-5473-b74d-8df653c9eb40", "parentControlId": 32028, "controlId": "SA-4(7)", "title": "SA-4(7)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590248" }, { "id": 604883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590248", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a00e5959-b8ea-555f-a5f0-07117741eafa", "parentControlId": 32028, "controlId": "NFO - SA-4(10)", "title": "NFO - SA-4(10)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590248" } ], "id": 32028, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731335", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731335", "catalogueId": 1062, "uuid": "8244be48-4904-5478-a664-2e9e0a51dbcc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization limit the use of commercially-provided Information Assurance (IA) and IA-enabled IT products to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile or the cryptographic module is FIPS-validated or NSA-approved?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Information Assurance Enabled Products", "description": "

Control Description

Mechanisms exist to limit the use of commercially-provided Information Assurance (IA) and IA-enabled IT products to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile or the cryptographic module is FIPS-validated or NSA-approved.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to limit the use of commercially-provided Information Assurance (IA) and IA-enabled IT products to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile or the cryptographic module is FIPS-validated or NSA-approved.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-02.2", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-02.2", "references": "

Micro-Small Business (<10 staff)

∙ Review code for obvious security issues before release

Small Business (10-49 staff)

∙ Basic code review with security focus before release

Medium Business (50-249 staff)

∙ Formal secure code review process (manual + automated SAST)

Large Business (250-999 staff)

∙ Enterprise SAST program (e.g., Checkmarx, Veracode)\n∙ Mandatory code reviews with security gates

Enterprise (>1,000 staff)

∙ Enterprise DevSecOps with SAST/DAST automation (e.g., Veracode, Checkmarx)\n∙ Security gates in CI/CD pipeline", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74211, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591236", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591236", "securityControlId": 32029, "ccis": [], "uuid": "561ade43-754f-5f49-b56d-228571286afc", "testId": "TDA-02.3_A01", "test": "cybersecurity / data privacy systems engineering methods are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(03)_ODP[01]\n53A_R5_SA-04(03)_ODP[02]\n53A_R5_SA-04(03)_ODP[03]\n53A_R5_SA-04(03)_ODP[04]", "defaultText": null }, { "id": 74212, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591244", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591244", "securityControlId": 32029, "ccis": [], "uuid": "778bbfac-2d7f-5e71-9950-69f8ac6c72eb", "testId": "TDA-02.3_A02", "test": "software development methods are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(03)_ODP[05]\n53A_R5_SA-04(03)_ODP[06]", "defaultText": null }, { "id": 74213, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591245", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591245", "securityControlId": 32029, "ccis": [], "uuid": "0c726825-6ef8-5de2-8d04-6fde7487d6b5", "testId": "TDA-02.3_A03", "test": "testing, evaluation, assessment, verification and validation methods are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(03)_ODP[07]", "defaultText": null }, { "id": 74214, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591245", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591245", "securityControlId": 32029, "ccis": [], "uuid": "63742fed-9277-5c41-9ab4-ed399d4ad663", "testId": "TDA-02.3_A04", "test": "quality control processes are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(03)_ODP[08]", "defaultText": null }, { "id": 74215, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591245", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591245", "securityControlId": 32029, "ccis": [], "uuid": "605584ae-16ca-5b7e-835b-9ae45a145cf4", "testId": "TDA-02.3_A05", "test": "the developer of the system, system component or system service is required to demonstrate the use of a system development life cycle process that includes organization-defined system security engineering methods.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(03)(a)\n53A_R5_SA-04(03)(b)\n53A_R5_SA-04(03)(c)", "defaultText": null }, { "id": 74216, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591245", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591245", "securityControlId": 32029, "ccis": [], "uuid": "cf4c9814-9546-5c2f-8c36-0c39e2497fdb", "testId": "TDA-02.3_A06", "test": "systems security engineering principles to be applied to the development or modification of the system and system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.16.01.ODP[01]", "defaultText": null }, { "id": 74217, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591245", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591245", "securityControlId": 32029, "ccis": [], "uuid": "accb674b-bd58-580e-8fcc-9e01dc2f7b8c", "testId": "TDA-02.3_A07", "test": " are applied to the development or modification of the system and system components.
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: Guidance: At a minimum, documentation that provides user and administrator guidance for the implementation and operation of controls. The level of detail required in such documentation should be based on the degree to which organizations depend on the capabilities, functions, or mechanisms to meet risk response expectations. Requirements can include mandated configuration settings that specify allowed functions, ports, protocols, and services. Acceptance criteria for systems, system components, and system services are defined in the same manner as the criteria for any organizational acquisition or procurement.", "otherId": "171A_R3_A.03.16.01", "defaultText": null } ], "externalMappings": [ { "id": 604913, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590251", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1cc65f3b-b554-59b1-bd73-d8e1444a326d", "parentControlId": 32029, "controlId": "8.25", "title": "8.25", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590252" }, { "id": 604914, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590252", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be788ed2-563d-5d4a-b40c-c8f09dd0406d", "parentControlId": 32029, "controlId": "8.29", "title": "8.29", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590252" }, { "id": 604922, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb621bfa-3311-5dfb-82b5-978f5114dd0e", "parentControlId": 32029, "controlId": "SA-4(3)", "title": "SA-4(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590253" }, { "id": 604923, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64a784e5-26ee-5f3e-b339-3757a4d194b5", "parentControlId": 32029, "controlId": "SA-04(03)", "title": "SA-04(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590253" }, { "id": 604924, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e44b69c-3a35-5ae8-a76f-05dd2ceac40d", "parentControlId": 32029, "controlId": "SR-03(01)", "title": "SR-03(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590253" }, { "id": 604927, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "223491ea-5c74-590f-93f8-2df25d2a0687", "parentControlId": 32029, "controlId": "SA-04(03)", "title": "SA-04(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590253" }, { "id": 604928, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590253", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b59a732-aeff-5067-971c-2db035294bb9", "parentControlId": 32029, "controlId": "SR-03(01)", "title": "SR-03(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590253" }, { "id": 604930, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42adad6d-77d0-5936-8824-441cb364335d", "parentControlId": 32029, "controlId": "SR-3(1)", "title": "SR-3(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590254" }, { "id": 604933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a390a709-727d-5907-a118-1989aaa851e0", "parentControlId": 32029, "controlId": "03.16.01", "title": "03.16.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590254" } ], "id": 32029, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731335", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731335", "catalogueId": 1062, "uuid": "5be9b05c-878d-5f89-80c2-2aecb39cf742", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require software developers to ensure that their software development processes employ industry-recognized secure practices for secure programming, engineering methods, quality control processes and validation techniques to minimize flawed and/or malformed software?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Development Methods, Techniques & Processes", "description": "

Control Description

Mechanisms exist to require software developers to ensure that their software development processes employ industry-recognized secure practices for secure programming, engineering methods, quality control processes and validation techniques to minimize flawed and/or malformed software.

Evidence Request List (ERL)

E-TDA-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require software developers to ensure that their software development processes employ industry-recognized secure practices for secure programming, engineering methods, quality control processes and validation techniques to minimize flawed and/or malformed software.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-02.3", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-02.3", "references": "

Micro-Small Business (<10 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Product / project management

Small Business (10-49 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Product / project management

Large Business (250-999 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight

Enterprise (>1,000 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74218, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591246", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591246", "securityControlId": 32030, "ccis": [], "uuid": "2f2db2ab-d32b-5a75-b564-f812f6723b42", "testId": "TDA-02.4_A01", "test": "pre-established security configurations for the system, component or service are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(05)_ODP", "defaultText": null }, { "id": 74219, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591246", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591246", "securityControlId": 32030, "ccis": [], "uuid": "5c547c5c-e7b8-5bca-aa0f-e63768ddb08c", "testId": "TDA-02.4_A02", "test": "the developer of the system, system component or system service is required to deliver the system, component or service with pre-established security configurations implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(05)(a)", "defaultText": null }, { "id": 74220, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591246", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591246", "securityControlId": 32030, "ccis": [], "uuid": "b6e3e347-e4f2-5a0b-8001-c172ade3c6a8", "testId": "TDA-02.4_A03", "test": "the pre-established configurations are used as the default for any subsequent system, component or service reinstallation or upgrade.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(05)(b)", "defaultText": null } ], "externalMappings": [ { "id": 604977, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25b5cc71-cf79-5b3f-92b3-2d76d368d28b", "parentControlId": 32030, "controlId": "SA-04(05)", "title": "SA-04(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590259" }, { "id": 604978, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85326da7-783d-55b6-a1cf-acbaf133e2cf", "parentControlId": 32030, "controlId": "SA-04(05)", "title": "SA-04(05)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590259" }, { "id": 604979, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69444a5f-6a09-5cfe-a2c3-45170b972588", "parentControlId": 32030, "controlId": "SA-04(05)", "title": "SA-04(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590259" }, { "id": 604980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c1a2b80-f61b-5026-ad54-5cf98c9bae40", "parentControlId": 32030, "controlId": "SA-04(05)", "title": "SA-04(05)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590259" }, { "id": 604981, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590259", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c1e6d47-cddf-587e-943f-6ac2d3feda25", "parentControlId": 32030, "controlId": "SA-4(5)", "title": "SA-4(5)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590259" }, { "id": 604983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59026", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54604689-ecdc-5c67-a135-c77df8804e1e", "parentControlId": 32030, "controlId": "03.16.01", "title": "03.16.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59026" } ], "id": 32030, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731336", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731336", "catalogueId": 1062, "uuid": "87982246-5f07-5399-b694-4151f769b776", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure vendors / manufacturers:\n (1) Deliver the Technology Asset, Application and/or Service (TAAS) with a pre-established, secure configuration implemented; and\n (2) Use the pre-established, secure configuration as the default for any subsequent TAAS reinstallation or upgrade?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Pre-Established Secure Configurations", "description": "

Control Description

Mechanisms exist to ensure vendors / manufacturers:\n(1) Deliver the Technology Asset, Application and/or Service (TAAS) with a pre-established, secure configuration implemented; and\n(2) Use the pre-established, secure configuration as the default for any subsequent TAAS reinstallation or upgrade.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure vendors / manufacturers:\n(1) Deliver the Technology Asset, Application and/or Service (TAAS) with a pre-established, secure configuration implemented; and\n(2) Use the pre-established, secure configuration as the default for any subsequent TAAS reinstallation or upgrade.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-02.4", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-02.4", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Product / project management

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Product / project management

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Product / project management\n∙ System Development Lifecycle (SDLC) governance / oversight

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Product / project management\n∙ System Development Lifecycle (SDLC) governance / oversight", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74224, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591247", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591247", "securityControlId": 32033, "ccis": [], "uuid": "a923ef9a-7ccc-570b-b57c-326f83a76cb8", "testId": "TDA-02.7_A01", "test": "cybersecurity / data privacy representatives to be included in the configuration change management and control process are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-10(07)_ODP[01]\n53A_R5_SA-10(07)_ODP[02]", "defaultText": null }, { "id": 74225, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591247", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591247", "securityControlId": 32033, "ccis": [], "uuid": "184f678e-2d78-5adb-9256-ab61d5dce51e", "testId": "TDA-02.7_A02", "test": "configuration change management and control processes in which cybersecurity / data privacy representatives are required to be included are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-10(07)_ODP[03]\n53A_R5_SA-10(07)_ODP[04]", "defaultText": null }, { "id": 74226, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591248", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591248", "securityControlId": 32033, "ccis": [], "uuid": "45e04dfb-acb1-507b-b69e-1e4373d04a2c", "testId": "TDA-02.7_A03", "test": "organization-defined cybersecurity / data privacy representatives are required to be included in the organization-defined configuration change management and control processes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-10(07)[01]\n53A_R5_SA-10(07)[02]", "defaultText": null } ], "externalMappings": [ { "id": 605028, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bad7eedf-2ec9-5dae-bb7a-60a1655e9ee3", "parentControlId": 32033, "controlId": "SR-5", "title": "SR-5", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590265" }, { "id": 605029, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b729056-2733-502c-a03d-891c603b6ba9", "parentControlId": 32033, "controlId": "SR-5(a)", "title": "SR-5(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590265" }, { "id": 605030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a44bb59-a0a6-5953-8953-f18fe74696e6", "parentControlId": 32033, "controlId": "SR-5(b)", "title": "SR-5(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590265" }, { "id": 605031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9b4073e-64b9-5353-838a-f1aaa6916847", "parentControlId": 32033, "controlId": "SR-5(c)", "title": "SR-5(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590265" }, { "id": 605032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1902ee88-1dc7-5f86-9021-ecb4ba485b87", "parentControlId": 32033, "controlId": "SR-5(d)", "title": "SR-5(d)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590265" }, { "id": 605033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13b737a6-6b66-5d77-8f7d-f5163083a635", "parentControlId": 32033, "controlId": "SA-10(07)", "title": "SA-10(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590265" }, { "id": 605034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0536c0fc-bc5b-52cb-a9bd-e8f504726761", "parentControlId": 32033, "controlId": "SA-10(07)", "title": "SA-10(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590265" } ], "id": 32033, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731337", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731337", "catalogueId": 1062, "uuid": "a2a1ee99-e537-592b-99a5-0cb5aab585e1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization include appropriate security, compliance and resilience representatives in the product feature and/or functionality change control review process?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Security, Compliance & Resilience Representatives For Product Changes", "description": "

Control Description

Mechanisms exist to include appropriate security, compliance and resilience representatives in the product feature and/or functionality change control review process.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to include appropriate security, compliance and resilience representatives in the product feature and/or functionality change control review process.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-02.7", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-02.7", "references": "

Micro-Small Business (<10 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements

Small Business (10-49 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements

Medium Business (50-249 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight

Large Business (250-999 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight

Enterprise (>1,000 staff)

∙ Data Protection Impact Assessment (DPIA)\n∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74228, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591248", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591248", "securityControlId": 32035, "ccis": [], "uuid": "ad9234bb-29e6-564b-be77-9635f512cdf9", "testId": "TDA-02.9_A01", "test": "security updates are delivered to products and/or services, where applicable, through automatic updates.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74229, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591248", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591248", "securityControlId": 32035, "ccis": [], "uuid": "1bb894e7-753a-5e24-9b21-cd2db13c7645", "testId": "TDA-02.9_A02", "test": "security updates are delivered to products and/or services, where applicable, through notification of available updates to affected users.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 605046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590267", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a53e50e-e373-534d-9af5-a2663e54852c", "parentControlId": 32035, "controlId": "SUM-2", "title": "SUM-2", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590267" }, { "id": 605047, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590267", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d60afb0-579f-5da6-b258-3585111f223d", "parentControlId": 32035, "controlId": "SUM-2(a)", "title": "SUM-2(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590267" }, { "id": 605048, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590267", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46673c17-6716-573d-8781-a7648724d8bb", "parentControlId": 32035, "controlId": "SUM-2(b)", "title": "SUM-2(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590267" }, { "id": 605049, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590267", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3382cccb-58a1-5d91-bd61-e0051c447d27", "parentControlId": 32035, "controlId": "SUM-2(c)", "title": "SUM-2(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590267" }, { "id": 605050, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590267", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9ba146c-31f2-5b60-be2e-30646e4ec8c3", "parentControlId": 32035, "controlId": "SUM-2(d)", "title": "SUM-2(d)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590267" }, { "id": 605051, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590267", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99faadee-0693-58a6-9fea-cfab4ba0dd3f", "parentControlId": 32035, "controlId": "SUM-2(e)", "title": "SUM-2(e)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590267" }, { "id": 605052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590267", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cbae9611-0b2e-527a-ba86-a51449bceba7", "parentControlId": 32035, "controlId": "SUM-4", "title": "SUM-4", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590267" }, { "id": 605053, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2868253e-9ead-5b4b-b97f-d681626c610f", "parentControlId": 32035, "controlId": "SUM-5", "title": "SUM-5", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590268" }, { "id": 605054, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8aa3fa14-d7cb-5c82-afc9-50e93a450ccb", "parentControlId": 32035, "controlId": "SUM-5(a)", "title": "SUM-5(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590268" }, { "id": 605055, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0eac2313-66b3-588c-aee4-277c8eb1b24c", "parentControlId": 32035, "controlId": "SUM-5(b)", "title": "SUM-5(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590268" }, { "id": 605056, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fb0e745-c483-56c1-82d1-b458cec88d03", "parentControlId": 32035, "controlId": "SUM-5(c)", "title": "SUM-5(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590268" }, { "id": 605057, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e3cebd4-1c7f-520a-95e4-c7632e724b4a", "parentControlId": 32035, "controlId": "SUM-5(d)", "title": "SUM-5(d)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590268" }, { "id": 605058, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "351d2bcb-4f0b-5072-b6a1-72e075464417", "parentControlId": 32035, "controlId": "SUM-5(e)", "title": "SUM-5(e)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590268" } ], "id": 32035, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731338", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731338", "catalogueId": 1062, "uuid": "3dc76c9c-a6a9-51bf-8daa-6b3c7d959766", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization deliver security updates to Technology Assets, Applications and/or Services (TAAS), where applicable, through:\n(1) Automatic updates; and\n(2) Notification of available updates to affected users?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Ongoing Product Security Support", "description": "

Control Description

Mechanisms exist to deliver security updates to Technology Assets, Applications and/or Services (TAAS), where applicable, through:\n(1) Automatic updates; and\n(2) Notification of available updates to affected users.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to deliver security updates to Technology Assets, Applications and/or Services (TAAS), where applicable, through:\n(1) Automatic updates; and\n(2) Notification of available updates to affected users.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-02.9", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-02.9", "references": "

Large Business (250-999 staff)

∙ Formal threat modeling for enterprise applications

Enterprise (>1,000 staff)

∙ Enterprise threat modeling program (e.g., Microsoft Threat Modeling Tool)\n∙ Automated threat model generation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74230, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591249", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591249", "securityControlId": 32036, "ccis": [], "uuid": "4ae5bf91-3aa7-5645-a4fd-592f5f2b6a77", "testId": "TDA-02.10_A01", "test": "an appropriate level of security and resiliency for products and/or services is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74231, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591249", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591249", "securityControlId": 32036, "ccis": [], "uuid": "0101cc90-2e3c-53a1-b7be-1a30209e93f6", "testId": "TDA-02.10_A02", "test": "products and/or services are regularly reviewed for an appropriate level of security and resiliency based on applicable risks and threats.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 605067, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75430588-a9ca-51b0-9971-25e0bb5b35b8", "parentControlId": 32036, "controlId": "SM-11(a)", "title": "SM-11(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590269" }, { "id": 605068, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b43e006-1810-51a7-8c2a-3c7de8ef2173", "parentControlId": 32036, "controlId": "SM-11(b)", "title": "SM-11(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590269" }, { "id": 605069, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb628c77-d60e-5dff-8010-de78273f9514", "parentControlId": 32036, "controlId": "SM-11(c)", "title": "SM-11(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590269" }, { "id": 605070, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59027", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70f61ad3-2050-5007-aded-219d980698ac", "parentControlId": 32036, "controlId": "SM-11(d)", "title": "SM-11(d)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59027" }, { "id": 605071, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59027", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd3c65bc-5c86-581d-8aa9-145569bbe912", "parentControlId": 32036, "controlId": "SM-11(e)", "title": "SM-11(e)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59027" }, { "id": 605072, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59027", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e76c3c2-c7a1-54e7-8184-e7cbb27003e9", "parentControlId": 32036, "controlId": "SM-12", "title": "SM-12", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59027" }, { "id": 605073, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59027", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04b7f477-fdde-5d62-afdb-46b05a1ee92d", "parentControlId": 32036, "controlId": "SUM-1", "title": "SUM-1", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59027" }, { "id": 605074, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59027", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a500f392-5828-55bf-8d00-e9a22da244b9", "parentControlId": 32036, "controlId": "SUM-1(1)", "title": "SUM-1(1)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59027" }, { "id": 605075, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59027", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a339f85-ec89-5ce6-a02c-16a980d28082", "parentControlId": 32036, "controlId": "SUM-1(2)", "title": "SUM-1(2)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59027" }, { "id": 605076, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59027", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e203c834-3967-5cc9-9ba0-34caad081f0d", "parentControlId": 32036, "controlId": "SUM-1(2)(a)", "title": "SUM-1(2)(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59027" }, { "id": 605077, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59027", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "454e152c-aef2-528f-8b68-b3694af632a6", "parentControlId": 32036, "controlId": "SUM-1(2)(b)", "title": "SUM-1(2)(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59027" }, { "id": 605078, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59027", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16100907-b391-5536-a7e4-59ccd1624cb2", "parentControlId": 32036, "controlId": "SUM-1(2)(c)", "title": "SUM-1(2)(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59027" } ], "id": 32036, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731338", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731338", "catalogueId": 1062, "uuid": "2c4f8b2c-6cc4-5475-940b-4848a8c48c68", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization regularly review Technology Assets, Applications and/or Services (TAAS) for an appropriate level of security and resiliency based on applicable risks and threats?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Product Testing & Reviews", "description": "

Control Description

Mechanisms exist to regularly review Technology Assets, Applications and/or Services (TAAS) for an appropriate level of security and resiliency based on applicable risks and threats.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to regularly review Technology Assets, Applications and/or Services (TAAS) for an appropriate level of security and resiliency based on applicable risks and threats.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-02.10", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-02.10", "references": "

Large Business (250-999 staff)

∙ Formal security architecture review for enterprise technology

Enterprise (>1,000 staff)

∙ Enterprise security architecture review board\n∙ Automated architecture analysis tools", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74232, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591249", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591249", "securityControlId": 32037, "ccis": [], "uuid": "7b59708a-e127-5688-a93a-71979bb1a2ca", "testId": "TDA-02.11_A01", "test": "stakeholder vulnerability disclosures contain a description of the vulnerability(ies).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74233, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591249", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591249", "securityControlId": 32037, "ccis": [], "uuid": "b2f03970-7bbd-5098-86fa-66e2529b93a1", "testId": "TDA-02.11_A02", "test": "stakeholder vulnerability disclosures contain information about affected product(s) and/or service(s).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74234, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591249", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591249", "securityControlId": 32037, "ccis": [], "uuid": "bdfa9d17-74cd-50dc-92ff-a9cfa1ea1bea", "testId": "TDA-02.11_A03", "test": "stakeholder vulnerability disclosures contain information about potential impact of the vulnerability(ies).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74235, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591249", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591249", "securityControlId": 32037, "ccis": [], "uuid": "a9cc8d98-0320-5105-ae8f-82d90ca526ce", "testId": "TDA-02.11_A04", "test": "stakeholder vulnerability disclosures contain information about the severity of the vulnerability(ies).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74236, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591249", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591249", "securityControlId": 32037, "ccis": [], "uuid": "dea91a99-27ca-5219-8c4a-74d01119fb4f", "testId": "TDA-02.11_A05", "test": "stakeholder vulnerability disclosures contain information about guidance to remediate the vulnerability(ies).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 605082, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66e79cb1-2d12-59c7-826b-f5ac56550f99", "parentControlId": 32037, "controlId": "DM-5", "title": "DM-5", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590271" }, { "id": 605083, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad3f29f0-58a6-59fe-9a14-afc3ec8506d7", "parentControlId": 32037, "controlId": "DM-5(a)", "title": "DM-5(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590271" }, { "id": 605084, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0f8de29-b670-56b8-8c9b-dfa54288e9bb", "parentControlId": 32037, "controlId": "DM-5(b)", "title": "DM-5(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590271" }, { "id": 605086, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4af0a7de-493c-532b-9c73-2c92b19bf3a7", "parentControlId": 32037, "controlId": "CIP-013-2 1.2.4", "title": "CIP-013-2 1.2.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590271" } ], "id": 32037, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731338", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731338", "catalogueId": 1062, "uuid": "237c2aea-37b3-5d34-9943-68b1689a9740", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization disclose information about vulnerabilities to relevant stakeholders, including:\n(1) A description of the vulnerability(ies);\n(2) Affected product(s) and/or service(s);\n(3) Potential impact of the vulnerability(ies);\n(4) Severity of the vulnerability(ies); and\n(5) Guidance to remediate the vulnerability(ies)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Disclosure of Vulnerabilities", "description": "

Control Description

Mechanisms exist to disclose information about vulnerabilities to relevant stakeholders, including:\n(1) A description of the vulnerability(ies);\n(2) Affected product(s) and/or service(s);\n(3) Potential impact of the vulnerability(ies);\n(4) Severity of the vulnerability(ies); and\n(5) Guidance to remediate the vulnerability(ies).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to disclose information about vulnerabilities to relevant stakeholders, including:\n(1) A description of the vulnerability(ies);\n(2) Affected product(s) and/or service(s);\n(3) Potential impact of the vulnerability(ies);\n(4) Severity of the vulnerability(ies); and\n(5) Guidance to remediate the vulnerability(ies).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-02.11", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-02.11", "references": "

Large Business (250-999 staff)

∙ Red team exercises for critical applications

Enterprise (>1,000 staff)

∙ Enterprise red team program\n∙ Regular adversarial simulation exercises", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74240, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59125", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59125", "securityControlId": 32040, "ccis": [], "uuid": "06ecb29b-5d23-5307-849f-f7bfd0be5017", "testId": "TDA-02.14_A01", "test": "industry-defined secure logging formats are used to generate event logs.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 605134, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4ffc2cd-9a93-563a-96f0-a256b6f86018", "parentControlId": 32040, "controlId": "SA-15(13)", "title": "SA-15(13)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590277" }, { "id": 605135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c096b99-2f57-5d9b-8703-aca847270ee2", "parentControlId": 32040, "controlId": "SA-15(13)", "title": "SA-15(13)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590277" } ], "id": 32040, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731339", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731339", "catalogueId": 1062, "uuid": "25598fb2-af7d-513c-97e4-2335e6b11d9b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require system developers to use an industry-defined secure logging format to generate event logs for specified event types at organization-defined level of detail?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Logging Syntax", "description": "

Control Description

Mechanisms exist to require system developers to use an industry-defined secure logging format to generate event logs for specified event types at organization-defined level of detail.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Technology Development & Acquisition (TDA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TDA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Technology development & acquisition-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Secure development practices loosely conform to industry-recognized standards for secure engineering (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require system developers to use an industry-defined secure logging format to generate event logs for specified event types at organization-defined level of detail.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-02.14", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-02.14", "references": "

Enterprise (>1,000 staff)

∙ Enterprise assurance case development for highest-assurance systems", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74241, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591251", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591251", "securityControlId": 32041, "ccis": [], "uuid": "cbdb8fee-63f2-5db7-a8f0-190a19ff580a", "testId": "TDA-03_A01", "test": "the organization only uses Commercial Off-the-Shelf (COTS) security products.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74242, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591251", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591251", "securityControlId": 32041, "ccis": [], "uuid": "bd6e2c45-8432-5553-86c3-44f9da810a14", "testId": "TDA-03_A02", "test": "for classified environments, only Government Off-The-Shelf (GOTS)or Commercial Off-The-Shelf (COTS) information assurance and information assurance-enabled information technology products that compose an NSA-approved solution are employed.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SA-04(06)(a)", "defaultText": null }, { "id": 74243, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591251", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591251", "securityControlId": 32041, "ccis": [], "uuid": "56374d43-f5ef-5bb5-a4ce-e34691045562", "testId": "TDA-03_A03", "test": "for classified environments, GOTS and COTS products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-04(06)(b)", "defaultText": null } ], "externalMappings": [ { "id": 605139, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590277", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ca517ee-dd8b-526f-b021-dc4585ef8a6c", "parentControlId": 32041, "controlId": "SA-4(6)", "title": "SA-4(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590277" }, { "id": 605140, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590278", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6bc5304-7d86-5423-8a71-69e9094f8b32", "parentControlId": 32041, "controlId": "SA-04(06)", "title": "SA-04(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590278" }, { "id": 605141, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "082944d9-ecc2-589d-8d7a-5dd3f9136753", "parentControlId": 32041, "controlId": "SA-04(06)", "title": "SA-04(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590287" }, { "id": 605142, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c58f0969-1fde-53d9-91da-b90254b7c24d", "parentControlId": 32041, "controlId": "03.16.01", "title": "03.16.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590287" }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "7e6e08b2-55e7-53dc-86d1-d8b9a7fb8a04", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "83c1a723-a6ac-59cd-85ce-8e21db60f07e", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "156f81a0-7d60-5f3b-b059-d47741b8b19d", "isPublic": true } ], "id": 32041, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73134", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73134", "catalogueId": 1062, "uuid": "2be3762c-488c-5f48-b43e-c8d624690f5d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize only Commercial Off-the-Shelf (COTS) security products?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Commercial Off-The-Shelf (COTS) Security Solutions", "description": "

Control Description

Mechanisms exist to utilize only Commercial Off-the-Shelf (COTS) security products.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Technology Development & Acquisition (TDA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TDA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Technology development & acquisition-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Secure development practices loosely conform to industry-recognized standards for secure engineering (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.\n▪ An application development team, or similar function, custom-develops business-critical TAAS, when Commercial Off The Shelf (COTS) solutions are unavailable.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize only Commercial Off-the-Shelf (COTS) security products.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-03", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-03", "references": "

Micro-Small Business (<10 staff)

∙ Product / project management\n∙ Data Protection Impact Assessment (DPIA)

Small Business (10-49 staff)

∙ Product / project management\n∙ Data Protection Impact Assessment (DPIA)

Medium Business (50-249 staff)

∙ Product / project management\n∙ Data Protection Impact Assessment (DPIA)

Large Business (250-999 staff)

∙ Product / project management\n∙ Data Protection Impact Assessment (DPIA)\n∙ Data governance program

Enterprise (>1,000 staff)

∙ Product / project management\n∙ Data Protection Impact Assessment (DPIA)\n∙ Data governance program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74244, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591251", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591251", "securityControlId": 32042, "ccis": [], "uuid": "dfb3d7e0-7033-5464-8a1c-461f8fea91bb", "testId": "TDA-03.1_A01", "test": "system components with a diverse set of sources are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-03(01)_ODP[01]", "defaultText": null }, { "id": 74245, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591251", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591251", "securityControlId": 32042, "ccis": [], "uuid": "a19f0d21-767e-5429-99b6-ef4437a797c9", "testId": "TDA-03.1_A02", "test": "services with a diverse set of sources are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-03(01)_ODP[02]", "defaultText": null }, { "id": 74246, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591251", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591251", "securityControlId": 32042, "ccis": [], "uuid": "b3f3ff98-0c38-58e8-9c40-633c79fad0cf", "testId": "TDA-03.1_A03", "test": "a diverse set of sources is employed for system components.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-03(01)[01]", "defaultText": null }, { "id": 74247, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591252", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591252", "securityControlId": 32042, "ccis": [], "uuid": "770e3e0b-067f-51c0-8430-a43f2a30eda4", "testId": "TDA-03.1_A04", "test": "a diverse set of sources is employed for services.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-03(01)[02]", "defaultText": null }, { "id": 74248, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591252", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591252", "securityControlId": 32042, "ccis": [], "uuid": "21bf3fd5-b672-553a-9578-59d19b065426", "testId": "TDA-03.1_A05", "test": "controls to be allocated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-08(02)_ODP[01]", "defaultText": null }, { "id": 74249, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591252", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591252", "securityControlId": 32042, "ccis": [], "uuid": "8d336371-3141-516b-93b0-e2f34162b4f4", "testId": "TDA-03.1_A06", "test": "locations and architectural layers are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-08(02)_ODP[02]", "defaultText": null }, { "id": 74250, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591252", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591252", "securityControlId": 32042, "ccis": [], "uuid": "402cc75c-fd57-5fbf-9af9-9730243a263d", "testId": "TDA-03.1_A07", "test": "controls that are allocated to locations and architectural layers are required to be obtained from different suppliers.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PL-08(02)", "defaultText": null } ], "externalMappings": [ { "id": 605149, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66be4a51-6533-519b-9104-ba58c8617a4c", "parentControlId": 32042, "controlId": "PL-8(2)", "title": "PL-8(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590288" }, { "id": 605150, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52668990-6181-5e9f-b798-2e8ad2b15128", "parentControlId": 32042, "controlId": "PL-08(02)", "title": "PL-08(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590288" }, { "id": 605151, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11682cb0-267e-52f5-af35-125e88d1e94b", "parentControlId": 32042, "controlId": "SR-03(01)", "title": "SR-03(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590288" }, { "id": 605153, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f798a633-2a57-576e-bb5a-79e17b57f439", "parentControlId": 32042, "controlId": "PL-08(02)", "title": "PL-08(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590288" }, { "id": 605154, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "728b0cb7-4d48-5a3c-9a3e-98670f658716", "parentControlId": 32042, "controlId": "SR-03(01)", "title": "SR-03(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590288" }, { "id": 605157, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e7b34b5-8fb5-5a6d-af64-480e067ae705", "parentControlId": 32042, "controlId": "PL-8(2)", "title": "PL-8(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590289" }, { "id": 605158, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590289", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b05f9444-8cd7-53b1-883c-22a1c66b91a9", "parentControlId": 32042, "controlId": "SR-3(1)", "title": "SR-3(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590289" } ], "id": 32042, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73134", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73134", "catalogueId": 1062, "uuid": "5efbdfa6-c542-55cd-91f6-8651ed6f761d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization obtain security, compliance and resilience technologies from different suppliers to minimize supply chain risk?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Supplier Diversity", "description": "

Control Description

Mechanisms exist to obtain security, compliance and resilience technologies from different suppliers to minimize supply chain risk.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to obtain security, compliance and resilience technologies from different suppliers to minimize supply chain risk.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-03.1", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74251, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591252", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591252", "securityControlId": 32043, "ccis": [], "uuid": "103ba284-fe77-5d50-abda-970d1ae303ca", "testId": "TDA-04_A01", "test": "administrator documentation for the system, system component or system service that describes the secure configuration of the system, component or service is obtained or developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-05a.01[01]", "defaultText": null }, { "id": 74252, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591253", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591253", "securityControlId": 32043, "ccis": [], "uuid": "14dfdd36-fae0-582a-951d-f84c4c4fe0af", "testId": "TDA-04_A02", "test": "administrator documentation for the system, system component or system service that describes the secure installation of the system, component or service is obtained or developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-05a.01[02]", "defaultText": null }, { "id": 74253, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591253", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591253", "securityControlId": 32043, "ccis": [], "uuid": "7aacc7c0-a96a-5f47-97a7-b1e7ffa9ee69", "testId": "TDA-04_A03", "test": "administrator documentation for the system, system component or system service that describes the secure operation of the system, component or service is obtained or developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-05a.01[03]", "defaultText": null }, { "id": 74254, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591253", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591253", "securityControlId": 32043, "ccis": [], "uuid": "89ac110c-d920-5800-8e13-6a24c8021be2", "testId": "TDA-04_A04", "test": "administrator documentation for the system, system component or system service that describes the effective use of cybersecurity / data privacy functions and mechanisms is obtained or developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-05a.02[01]\n53A_R5_SA-05a.02[03]", "defaultText": null }, { "id": 74255, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591253", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591253", "securityControlId": 32043, "ccis": [], "uuid": "a326c65f-9a2a-5da1-879f-8b0c86a4c5ad", "testId": "TDA-04_A05", "test": "administrator documentation for the system, system component or system service that describes the effective maintenance of cybersecurity / data privacy functions and mechanisms is obtained or developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-05a.02[02]\n53A_R5_SA-05a.02[04]", "defaultText": null }, { "id": 74256, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591253", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591253", "securityControlId": 32043, "ccis": [], "uuid": "0984751d-a924-59fe-bf56-59b01c8a3876", "testId": "TDA-04_A06", "test": "user documentation for the system, system component or system service that describes user-accessible cybersecurity / data privacy functions and mechanisms is obtained or developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-05b.01[01]\n53A_R5_SA-05b.01[03]", "defaultText": null }, { "id": 74257, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591254", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591254", "securityControlId": 32043, "ccis": [], "uuid": "c29725d6-de19-5a18-a2aa-970eaa654827", "testId": "TDA-04_A07", "test": "user documentation for the system, system component or system service that describes how to effectively use those (user-accessible cybersecurity / data privacy) functions and mechanisms is obtained or developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-05b.01[02]\n53A_R5_SA-05b.01[04]", "defaultText": null }, { "id": 74258, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591254", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591254", "securityControlId": 32043, "ccis": [], "uuid": "4129782c-a040-5ee3-80b5-e50a073ba74d", "testId": "TDA-04_A08", "test": "user documentation for the system, system component or system service that describes methods for user interaction, which enable individuals to use the system, component or service in a more secure manner is obtained or developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-05b.02[01]", "defaultText": null }, { "id": 74259, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591254", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591254", "securityControlId": 32043, "ccis": [], "uuid": "de276274-6a23-5584-9e2c-91e6795fc3fd", "testId": "TDA-04_A09", "test": "user documentation for the system, system component or system service that describes methods for user interaction, which enable individuals to use the system, component or service to protect individual privacy is obtained or developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-05b.02[02]", "defaultText": null }, { "id": 74260, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591254", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591254", "securityControlId": 32043, "ccis": [], "uuid": "1179d6f8-0241-5fe9-af9d-5c9b9f7dfcfb", "testId": "TDA-04_A10", "test": "user documentation for the system, system component or system service that describes user responsibilities for maintaining the cybersecurity / data privacy of the system, component or service is obtained or developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-05b.03[01]\n53A_R5_SA-05b.03[02]", "defaultText": null }, { "id": 74261, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591254", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591254", "securityControlId": 32043, "ccis": [], "uuid": "681b1c06-edf6-595d-9866-d4f3959c77c8", "testId": "TDA-04_A11", "test": "actions to take when system, system component or system service documentation is either unavailable or nonexistent are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-05_ODP[01]", "defaultText": null }, { "id": 74262, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591255", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591255", "securityControlId": 32043, "ccis": [], "uuid": "8f558ef1-f8bc-52bc-b5a3-70620b282bb4", "testId": "TDA-04_A12", "test": "personnel or roles to distribute system documentation to is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-05_ODP[02]", "defaultText": null }, { "id": 74263, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591255", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591255", "securityControlId": 32043, "ccis": [], "uuid": "14d7916d-d300-5ccf-8f2a-cb4601d8eb91", "testId": "TDA-04_A13", "test": "administrator documentation for the system, system component or system service that describes known vulnerabilities regarding the configuration of administrative or privileged functions is obtained or developed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-05a.03[01]", "defaultText": null }, { "id": 74264, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591255", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591255", "securityControlId": 32043, "ccis": [], "uuid": "10203622-4cb2-5eeb-bff0-291704bbac0a", "testId": "TDA-04_A14", "test": "administrator documentation for the system, system component or system service that describes known vulnerabilities regarding the use of administrative or privileged functions is obtained or developed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-05a.03[02]", "defaultText": null }, { "id": 74265, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591256", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591256", "securityControlId": 32043, "ccis": [], "uuid": "7a58d5b1-2451-561f-99a8-865912869643", "testId": "TDA-04_A15", "test": "attempts to obtain system, system component or system service documentation when such documentation is either unavailable or nonexistent is documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-05c.[01]", "defaultText": null }, { "id": 74266, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591256", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591256", "securityControlId": 32043, "ccis": [], "uuid": "a8a29b81-f40e-5c4c-a3f0-80c74270e2f4", "testId": "TDA-04_A16", "test": "after attempts to obtain system, system component or system service documentation when such documentation is either unavailable or nonexistent, actions are taken in response.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-05c.[02]", "defaultText": null }, { "id": 74267, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591256", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591256", "securityControlId": 32043, "ccis": [], "uuid": "1a0b2e64-8a03-551d-91cb-0634b8fabb87", "testId": "TDA-04_A17", "test": "documentation is distributed to personnel or roles.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-05d.", "defaultText": null } ], "externalMappings": [ { "id": 605194, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a26f66c5-a66c-50af-b072-ae62d37ba276", "parentControlId": 32043, "controlId": "SG-3", "title": "SG-3", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590294" }, { "id": 605195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25e9ded7-4623-514c-a44c-a5655e4b08e4", "parentControlId": 32043, "controlId": "SG-3(a)", "title": "SG-3(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590294" }, { "id": 605196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ede09de-accc-5b5d-9c32-788a79e4f64c", "parentControlId": 32043, "controlId": "SG-3(b)", "title": "SG-3(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590294" }, { "id": 605197, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be0d640b-8a60-5b4e-b2e1-3701ee88b4d9", "parentControlId": 32043, "controlId": "SG-3(c)", "title": "SG-3(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590294" }, { "id": 605198, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590294", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82765152-9ffd-5bed-bbad-3072a14a306f", "parentControlId": 32043, "controlId": "SG-3(d)", "title": "SG-3(d)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590294" }, { "id": 605199, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d7234e5-3a46-50bc-99e0-3407aa12c05b", "parentControlId": 32043, "controlId": "SG-3(d)(1)", "title": "SG-3(d)(1)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590295" }, { "id": 605200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b64b4f5-11fc-59e3-b2d7-d4f3c79450dd", "parentControlId": 32043, "controlId": "SG-3(d)(2)", "title": "SG-3(d)(2)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590295" }, { "id": 605201, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "502c9bf1-9fd0-56d9-bb33-816eebe16278", "parentControlId": 32043, "controlId": "SG-3(d)(3)", "title": "SG-3(d)(3)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590295" }, { "id": 605202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c6db50b-429b-538f-b874-98dc81cbc30f", "parentControlId": 32043, "controlId": "SG-3(e)", "title": "SG-3(e)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590295" }, { "id": 605203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3bb9426-696d-5039-a577-b0a2cda66a05", "parentControlId": 32043, "controlId": "SG-3(f)", "title": "SG-3(f)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590295" }, { "id": 605204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ede5b47-5a88-5b1f-a792-17b37df38ecf", "parentControlId": 32043, "controlId": "SG-3(g)", "title": "SG-3(g)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590295" }, { "id": 605205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fe33117-21b9-57b2-a7e7-b0cdadc3fe61", "parentControlId": 32043, "controlId": "SG-3(h)", "title": "SG-3(h)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590295" }, { "id": 605206, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "caec2b5e-cfd7-506e-a30a-4bda3a1b4385", "parentControlId": 32043, "controlId": "SG-4", "title": "SG-4", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590295" }, { "id": 605207, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9691e17-c852-5513-99b9-bb987060144a", "parentControlId": 32043, "controlId": "SG-4(a)", "title": "SG-4(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590295" }, { "id": 605208, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590295", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83d9d42b-7052-58c4-a8ef-87247b8fe235", "parentControlId": 32043, "controlId": "SG-4(b)", "title": "SG-4(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590295" }, { "id": 605209, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64d44ffc-4011-5e8a-8aba-ad11a2c74fd0", "parentControlId": 32043, "controlId": "SG-4(c)", "title": "SG-4(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590296" }, { "id": 605210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54975f4d-96dd-5ec1-99fe-4a84c662ef14", "parentControlId": 32043, "controlId": "SG-4(d)", "title": "SG-4(d)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590296" }, { "id": 605211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ec433bb-9264-5c54-95dd-5c8e234ba121", "parentControlId": 32043, "controlId": "SG-5", "title": "SG-5", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590296" }, { "id": 605212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "466f7d95-87d2-52d5-9832-9d7f98e96e2a", "parentControlId": 32043, "controlId": "SG-5(a)", "title": "SG-5(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590296" }, { "id": 605213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6aea4ff-6614-53aa-afa0-32c023aa91d5", "parentControlId": 32043, "controlId": "SG-5(b)", "title": "SG-5(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590296" }, { "id": 605214, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7093c76f-cef3-5567-8d6a-72ba581d8167", "parentControlId": 32043, "controlId": "SG-6", "title": "SG-6", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590296" }, { "id": 605215, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590296", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f81b51c-6794-5a4c-a78b-bd750a2fc68a", "parentControlId": 32043, "controlId": "SG-6(a)", "title": "SG-6(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590296" }, { "id": 605216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb7d335d-872e-577c-97d8-589e6714fe22", "parentControlId": 32043, "controlId": "SG-6(b)", "title": "SG-6(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590297" }, { "id": 605223, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38775151-305f-5119-98f0-cea135872e3d", "parentControlId": 32043, "controlId": "SA-5", "title": "SA-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590297" }, { "id": 605224, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43d2e430-d7d2-5da6-af4f-e08f230b87d3", "parentControlId": 32043, "controlId": "SA-05", "title": "SA-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590297" }, { "id": 605226, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "933dd092-e47e-5018-8293-bf7f6f8ca131", "parentControlId": 32043, "controlId": "SA-05", "title": "SA-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590298" }, { "id": 605227, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5be25ece-1df3-5f3e-84d3-3d14ece17ad5", "parentControlId": 32043, "controlId": "SA-05", "title": "SA-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590298" }, { "id": 605228, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e54ec5d-2741-56b2-a437-8f2f59ded927", "parentControlId": 32043, "controlId": "SA-05", "title": "SA-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590298" }, { "id": 605229, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2efe18c6-9a85-5f5c-a40a-37495fa7520e", "parentControlId": 32043, "controlId": "SA-05", "title": "SA-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590298" }, { "id": 605230, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df86616f-5620-54c3-bdc6-560707e77eb0", "parentControlId": 32043, "controlId": "SA-05", "title": "SA-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590298" }, { "id": 605231, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "660d3b4e-9c28-5551-8593-50ed951a6b87", "parentControlId": 32043, "controlId": "CM-8(10)", "title": "CM-8(10)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590298" }, { "id": 605232, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "550ec770-3dfa-5628-a240-1ba5de413a51", "parentControlId": 32043, "controlId": "SA-5", "title": "SA-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590298" }, { "id": 605233, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c896c10a-916b-5c85-93a6-0c939228a6d9", "parentControlId": 32043, "controlId": "SA-5", "title": "SA-5", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590298" }, { "id": 605236, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff7c841e-50d4-589c-98f8-e6430ac5ea6d", "parentControlId": 32043, "controlId": "NFO - SA-5", "title": "NFO - SA-5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590299" }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "5032ca1d-acfc-55e0-9ec7-27b1db32a848", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "996bbdf6-e442-5ddf-b076-1d8a0b4d06b7", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "a565052d-9efe-59b7-92f7-c5f3e658399f", "isPublic": true } ], "id": 32043, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73134", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73134", "catalogueId": 1062, "uuid": "9218dee4-2a5f-5c35-93ff-47b457fa4dc5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization obtain, protect and distribute administrator documentation for Technology Assets, Applications and/or Services (TAAS) that describe:\n (1) Secure configuration, installation and operation of the TAAS;\n (2) Effective use and maintenance of security features/functions; and\n (3) Known vulnerabilities regarding configuration and use of administrative (e.g., privileged) functions?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Documentation Requirements", "description": "

Control Description

Mechanisms exist to obtain, protect and distribute administrator documentation for Technology Assets, Applications and/or Services (TAAS) that describe:\n(1) Secure configuration, installation and operation of the TAAS;\n(2) Effective use and maintenance of security features/functions; and\n(3) Known vulnerabilities regarding configuration and use of administrative (e.g., privileged) functions.

Evidence Request List (ERL)

E-CPL-06\nE-TDA-06\nE-TDA-10

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Technology Development & Acquisition (TDA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TDA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Technology development & acquisition-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Secure development practices loosely conform to industry-recognized standards for secure engineering (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to obtain, protect and distribute administrator documentation for Technology Assets, Applications and/or Services (TAAS) that describe:\n(1) Secure configuration, installation and operation of the TAAS;\n(2) Effective use and maintenance of security features/functions; and\n(3) Known vulnerabilities regarding configuration and use of administrative (e.g., privileged) functions.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-04", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-04", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74268, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591256", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591256", "securityControlId": 32044, "ccis": [], "uuid": "cf8e709c-1129-51cc-970c-77015a6aa85e", "testId": "TDA-04.1_A01", "test": "the developer of the system, system component or system service is required to provide a description of the functional properties of the controls to be implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(01)", "defaultText": null }, { "id": 74269, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591256", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591256", "securityControlId": 32044, "ccis": [], "uuid": "ef1e7741-26eb-528b-8323-617880391f35", "testId": "TDA-04.1_A02", "test": "organization-defined criteria for security-relevant information pertaining to external system interfaces, high-level design, low-level design, source code or hardware schematics and design and implementation information are documented in a System Security & Privacy Plan (SSPP), or similar document.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at a minimum to include security-relevant external system interfaces; high-level design; low-level design; source code or network and data flow diagram", "otherId": "53A_R5_SA-04(02)_ODP[01]", "defaultText": null }, { "id": 74270, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591257", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591257", "securityControlId": 32044, "ccis": [], "uuid": "f8fef8f4-8c68-5ea3-badb-f077b0a16e9e", "testId": "TDA-04.1_A03", "test": "design and implementation information is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(02)_ODP[02]", "defaultText": null }, { "id": 74271, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591257", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591257", "securityControlId": 32044, "ccis": [], "uuid": "3f268c4f-e991-5dd7-8b57-36b062ce1c74", "testId": "TDA-04.1_A04", "test": "level of detail is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(02)_ODP[03]", "defaultText": null }, { "id": 74272, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591257", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591257", "securityControlId": 32044, "ccis": [], "uuid": "d6176d53-8338-56b6-8b0f-b273c516c25c", "testId": "TDA-04.1_A05", "test": "the developer of the system, system component or system service is required to provide design and implementation information for the controls that includes using at level of detail.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(02)", "defaultText": null } ], "externalMappings": [ { "id": 605305, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53a1c35e-9a04-57d6-97a7-550ba8a6fdfe", "parentControlId": 32044, "controlId": "SR-3", "title": "SR-3", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590307" }, { "id": 605306, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84dea7b7-f8d9-5ee3-af9e-72b501db3d3b", "parentControlId": 32044, "controlId": "SA-4(1)", "title": "SA-4(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590307" }, { "id": 605307, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a163d7b1-088c-5422-a711-0342ab1b50c1", "parentControlId": 32044, "controlId": "SA-4(2)", "title": "SA-4(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590307" }, { "id": 605308, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae1c7e74-7db1-5366-be2e-a88f1c83c367", "parentControlId": 32044, "controlId": "SA-04(01)", "title": "SA-04(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590307" }, { "id": 605309, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70f4ae7f-8d99-5b4d-855b-6e200e42a661", "parentControlId": 32044, "controlId": "SA-04(02)", "title": "SA-04(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590307" }, { "id": 605312, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590307", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e01df54d-3575-5edf-8826-e6dff6f0fc84", "parentControlId": 32044, "controlId": "SA-04(01)", "title": "SA-04(01)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590307" }, { "id": 605313, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d861e229-e165-5f8f-847b-b175ab3bf03e", "parentControlId": 32044, "controlId": "SA-04(02)", "title": "SA-04(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590308" }, { "id": 605314, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "789b7076-d346-5f12-bf3f-4d2617e946e6", "parentControlId": 32044, "controlId": "SA-04(01)", "title": "SA-04(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590308" }, { "id": 605315, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32749c73-8f7b-5c11-8fc9-ad66dffdc2ce", "parentControlId": 32044, "controlId": "SA-04(02)", "title": "SA-04(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590308" }, { "id": 605316, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f042baa-d918-5a2a-868a-64123d4b2b29", "parentControlId": 32044, "controlId": "SA-04(01)", "title": "SA-04(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590308" }, { "id": 605317, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "357cdf6e-e9f7-5c0c-845a-58651e4cdf55", "parentControlId": 32044, "controlId": "SA-04(02)", "title": "SA-04(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590308" }, { "id": 605318, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c78aa48-88c3-5687-9a70-2df78b88b7d3", "parentControlId": 32044, "controlId": "SA-04(01)", "title": "SA-04(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590308" }, { "id": 605319, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590308", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21cfaf59-2829-5026-8e06-6bd5e776f9c0", "parentControlId": 32044, "controlId": "SA-04(02)", "title": "SA-04(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590308" }, { "id": 605320, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0309b570-1783-5e36-a454-707f548163bf", "parentControlId": 32044, "controlId": "CM-8(10)", "title": "CM-8(10)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590309" }, { "id": 605322, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "744cd273-4bd4-5a6d-9e31-61679d8221ea", "parentControlId": 32044, "controlId": "NFO - SA-4(1)", "title": "NFO - SA-4(1)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590309" }, { "id": 605323, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590309", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0fdbb39e-b17a-5cf8-becb-88d2b0daca32", "parentControlId": 32044, "controlId": "NFO - SA-4(2)", "title": "NFO - SA-4(2)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590309" } ], "id": 32044, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73134", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73134", "catalogueId": 1062, "uuid": "98739193-d715-5e80-b809-620d38f58f2e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require software developers to provide information describing the functional properties of the security, compliance and resilience controls to be utilized within Technology Assets, Applications and/or Services (TAAS) in sufficient detail to permit analysis and testing of the controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Functional Properties", "description": "

Control Description

Mechanisms exist to require software developers to provide information describing the functional properties of the security, compliance and resilience controls to be utilized within Technology Assets, Applications and/or Services (TAAS) in sufficient detail to permit analysis and testing of the controls.

Evidence Request List (ERL)

E-CPL-06\nE-TDA-06\nE-TDA-10\nE-TDA-15

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require software developers to provide information describing the functional properties of the security, compliance and resilience controls to be utilized within Technology Assets, Applications and/or Services (TAAS) in sufficient detail to permit analysis and testing of the controls.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-04.1", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74273, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591257", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591257", "securityControlId": 32045, "ccis": [], "uuid": "45921b13-1084-59f4-931f-d2a3e818fbe3", "testId": "TDA-04.2_A01", "test": "a Software Bill of Materials (SBOM) for systems, applications and services lists software packages in use, including versions and applicable licenses.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 605372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590314", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72987b3a-3d61-5b88-8584-8796811289ed", "parentControlId": 32045, "controlId": "SUM-3", "title": "SUM-3", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590314" }, { "id": 605373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b59434a-c7b7-50dd-b8c3-6cce28976411", "parentControlId": 32045, "controlId": "SUM-3(a)", "title": "SUM-3(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590315" }, { "id": 605374, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ce26a0f-defc-5c79-9f1e-e7203bf2ad9d", "parentControlId": 32045, "controlId": "SUM-3(b)", "title": "SUM-3(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590315" }, { "id": 605375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee4222e8-2ca1-5977-bc9a-7a4796be68c0", "parentControlId": 32045, "controlId": "CM-8(10)", "title": "CM-8(10)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590315" }, { "id": 605380, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590315", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c56f796-0d68-5345-a393-e4cf93dc30a4", "parentControlId": 32045, "controlId": "GV.OC-05", "title": "GV.OC-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590315" } ], "id": 32045, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731341", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731341", "catalogueId": 1062, "uuid": "9add43a5-17cc-59fb-a3c3-516d8c925866", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization generate, or obtain, a Software Bill of Materials (SBOM) for Technology Assets, Applications and/or Services (TAAS) that lists software packages in use, including versions and applicable licenses?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Software Bill of Materials (SBOM)", "description": "

Control Description

Mechanisms exist to generate, or obtain, a Software Bill of Materials (SBOM) for Technology Assets, Applications and/or Services (TAAS) that lists software packages in use, including versions and applicable licenses.

Evidence Request List (ERL)

E-TDA-12

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to generate, or obtain, a Software Bill of Materials (SBOM) for Technology Assets, Applications and/or Services (TAAS) that lists software packages in use, including versions and applicable licenses.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-04.2", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-04.2", "references": "

Micro-Small Business (<10 staff)

∙ Software Bill of Materials (SBOM)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Small Business (10-49 staff)

∙ Software Bill of Materials (SBOM)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Medium Business (50-249 staff)

∙ Software Bill of Materials (SBOM)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Large Business (250-999 staff)

∙ Software Bill of Materials (SBOM)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Software Bill of Materials (SBOM)\n∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74274, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591257", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591258", "securityControlId": 32046, "ccis": [], "uuid": "999dd00f-60ee-56f1-b1ab-c0bc62ad32d6", "testId": "TDA-05_A01", "test": "the developer of the system, system component or system service is required to produce a design specification and cybersecurity / data privacy architecture that are consistent with the organization's security architecture, which is an integral part the organization's enterprise architecture.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-17(a)[01]\n53A_R5_SA-17(a)[02]", "defaultText": null }, { "id": 74275, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591258", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591258", "securityControlId": 32046, "ccis": [], "uuid": "e9935578-fd89-500b-9518-81ea061dd313", "testId": "TDA-05_A02", "test": "the developer of the system, system component or system service is required to produce a design specification and cybersecurity / data privacy architecture that accurately and completely describe the required security functionality and the allocation of controls among physical and logical components.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-17(b)[01]\n53A_R5_SA-17(b)[02]", "defaultText": null }, { "id": 74276, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591258", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591258", "securityControlId": 32046, "ccis": [], "uuid": "b596ea4d-41e5-5a87-b9e1-10cc8c398523", "testId": "TDA-05_A03", "test": "the developer of the system, system component or system service is required to produce a design specification and cybersecurity / data privacy architecture that express how individual security functions, mechanisms and services work together to provide required security capabilities and a unified approach to protection.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-17(c)[01]\n53A_R5_SA-17(c)[02]", "defaultText": null } ], "externalMappings": [ { "id": 605407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2105f09b-0fe6-50cc-9d73-505eba457f9a", "parentControlId": 32046, "controlId": "SD-1", "title": "SD-1", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590318" }, { "id": 605408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590318", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ebfdc80-481d-5462-9e76-081f79d95b23", "parentControlId": 32046, "controlId": "SD-1(a)", "title": "SD-1(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590318" }, { "id": 605409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b71c455-bf05-5a4a-b0e9-e6d2550930a5", "parentControlId": 32046, "controlId": "SD-1(b)", "title": "SD-1(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590319" }, { "id": 605410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f45a229-5b48-5d26-9c9f-3fdbc067fa6a", "parentControlId": 32046, "controlId": "SD-1(c)", "title": "SD-1(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590319" }, { "id": 605411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9ff5950-25f1-513c-9562-c4a87467cdec", "parentControlId": 32046, "controlId": "SD-1(d)", "title": "SD-1(d)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590319" }, { "id": 605412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7410f8fc-8806-5058-bec9-283f16fce18e", "parentControlId": 32046, "controlId": "SD-1(e)", "title": "SD-1(e)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590319" }, { "id": 605413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fb25b5a-d237-5322-b46d-1ddb0681faae", "parentControlId": 32046, "controlId": "SD-1(f)", "title": "SD-1(f)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590319" }, { "id": 605414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5dc266d9-d345-5f55-8079-ed3d4c88894b", "parentControlId": 32046, "controlId": "SD-1(g)", "title": "SD-1(g)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590319" }, { "id": 605415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6365711e-2eee-5796-9399-cca781fbddd9", "parentControlId": 32046, "controlId": "SD-1(h)", "title": "SD-1(h)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590319" }, { "id": 605416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590319", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8edec3fe-3cd1-5284-866c-38c9157f098d", "parentControlId": 32046, "controlId": "SD-1(i)", "title": "SD-1(i)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590319" }, { "id": 605417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5095bdf2-68e3-5fd9-84d9-960b162b2a58", "parentControlId": 32046, "controlId": "SD-1(j)", "title": "SD-1(j)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59032" }, { "id": 605419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d03a68d9-6d64-56e1-8066-e73b8d5db8fc", "parentControlId": 32046, "controlId": "8.27", "title": "8.27", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59032" }, { "id": 605420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8b3a24e-4877-5989-bc7b-842b2b54d4e8", "parentControlId": 32046, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59032" }, { "id": 605423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d20ba726-d218-52e3-8a0c-ab76d60fd100", "parentControlId": 32046, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59032" }, { "id": 605424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59794366-b958-5373-a978-520846be42c0", "parentControlId": 32046, "controlId": "T1078.001", "title": "T1078.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59032" }, { "id": 605425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59032", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ffc785b-1637-5147-9fd2-e600966fe5c4", "parentControlId": 32046, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59032" }, { "id": 605426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a48562eb-ad8a-538e-a179-02ee7800bdcc", "parentControlId": 32046, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590321" }, { "id": 605427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7e854057-b5cc-5187-a841-77adb0a85bc8", "parentControlId": 32046, "controlId": "T1134.005", "title": "T1134.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590321" }, { "id": 605428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "320295c4-43fd-545f-98b0-08e34dd423fc", "parentControlId": 32046, "controlId": "T1482", "title": "T1482", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590321" }, { "id": 605429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d24f873-9a50-59a1-b72a-6223c55e9959", "parentControlId": 32046, "controlId": "T1574.002", "title": "T1574.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590321" }, { "id": 605431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53821388-398d-5a4c-ae4a-e97e0ed15f3c", "parentControlId": 32046, "controlId": "SA-17", "title": "SA-17", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590321" }, { "id": 605432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38de4100-2cfe-5824-a269-92b714a37397", "parentControlId": 32046, "controlId": "SA-17", "title": "SA-17", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590321" }, { "id": 605433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe41aeee-03b4-5812-a6d7-47c2c3ed271e", "parentControlId": 32046, "controlId": "SA-17", "title": "SA-17", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590321" }, { "id": 605434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fec3509a-c922-513e-8e7b-065b63cf5ab5", "parentControlId": 32046, "controlId": "SA-17", "title": "SA-17", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590321" }, { "id": 605435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590321", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfe23542-3279-5f8c-9a26-6164ffbd49f2", "parentControlId": 32046, "controlId": "SA-17", "title": "SA-17", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590321" }, { "id": 605436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "257aaf4b-66b9-5354-9219-aa74915f9293", "parentControlId": 32046, "controlId": "CM-8(10)", "title": "CM-8(10)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590322" }, { "id": 605437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9303bf23-2e30-5811-8c63-028ba11eaea5", "parentControlId": 32046, "controlId": "SA-17", "title": "SA-17", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590322" }, { "id": 605441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590322", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbc2cf60-082b-589f-94ec-1a3e3e00ee8f", "parentControlId": 32046, "controlId": "03.16.01", "title": "03.16.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590322" }, { "id": 605452, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590323", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "609fdf60-0da1-519b-9d04-94d9ef86668c", "parentControlId": 32046, "controlId": "ARCHITECTURE-4f", "title": "ARCHITECTURE-4f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590323" }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "905dcf63-b2ce-5994-abc7-531e67d697be", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "04ef1c36-78f9-5d2e-aa09-ad6fa44f4420", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "8ddb88a0-a7ff-5031-bc70-fccfdd031f4d", "isPublic": true } ], "id": 32046, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731341", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731341", "catalogueId": 1062, "uuid": "8cd91a4a-7838-50fa-bb19-16db0dbb1ed4", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require the developers of Technology Assets, Applications and/or Services (TAAS) to produce a design specification and security architecture that: \n(1) Is consistent with and supportive of the organization's security architecture which is established within and is an integrated part of the organization's enterprise architecture;\n(2) Accurately and completely describes the required security functionality and the allocation of security, compliance and resilience controls among physical and logical components; and\n(3) Expresses how individual security functions, mechanisms and services work together to provide required security capabilities and a unified approach to protection?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Developer Architecture & Design", "description": "

Control Description

Mechanisms exist to require the developers of Technology Assets, Applications and/or Services (TAAS) to produce a design specification and security architecture that: \n(1) Is consistent with and supportive of the organization's security architecture which is established within and is an integrated part of the organization's enterprise architecture;\n(2) Accurately and completely describes the required security functionality and the allocation of security, compliance and resilience controls among physical and logical components; and\n(3) Expresses how individual security functions, mechanisms and services work together to provide required security capabilities and a unified approach to protection.

Evidence Request List (ERL)

E-TDA-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require the developers of Technology Assets, Applications and/or Services (TAAS) to produce a design specification and security architecture that: \n(1) Is consistent with and supportive of the organization's security architecture which is established within and is an integrated part of the organization's enterprise architecture;\n(2) Accurately and completely describes the required security functionality and the allocation of security, compliance and resilience controls among physical and logical components; and\n(3) Expresses how individual security functions, mechanisms and services work together to provide required security capabilities and a unified approach to protection.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-05", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-05", "references": "

Micro-Small Business (<10 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Product / project management

Small Business (10-49 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Product / project management

Medium Business (50-249 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Product / project management

Large Business (250-999 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight

Enterprise (>1,000 staff)

∙ Defined \"secure engineering principles\" (e.g., alignment with NIST 800-160)\n∙ Defined business processes\n∙ Product / project management\n∙ Defined technical requirements\n∙ Defined business requirements\n∙ System Development Lifecycle (SDLC) governance / oversight", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74277, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591258", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591258", "securityControlId": 32047, "ccis": [], "uuid": "499f4835-4cc9-58f4-80d6-452f7f12d660", "testId": "TDA-05.1_A01", "test": "physical diagnostic and test interfaces are secured to prevent misuse.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 605477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590335", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1b9694a-70de-56a2-86c0-a1e6f0a73030", "parentControlId": 32047, "controlId": "EDR 2.13", "title": "EDR 2.13", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590335" }, { "id": 605478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590335", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b07331a-7371-5475-8105-1f9abe0168bb", "parentControlId": 32047, "controlId": "HDR 2.13", "title": "HDR 2.13", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590335" }, { "id": 605479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590335", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d437e2c7-7e1c-5dde-a4a2-b85f05e2ba95", "parentControlId": 32047, "controlId": "NDR 2.13", "title": "NDR 2.13", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590335" } ], "id": 32047, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731342", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731342", "catalogueId": 1062, "uuid": "86c2d2dc-4f14-50ad-9b01-fba74de2b4d2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization secure physical diagnostic and test interfaces to prevent misuse?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Physical Diagnostic & Test Interfaces", "description": "

Control Description

Mechanisms exist to secure physical diagnostic and test interfaces to prevent misuse.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to secure physical diagnostic and test interfaces to prevent misuse.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-05.1", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-05.1", "references": "

Micro-Small Business (<10 staff)

∙ Secure Baseline Configurations (SBC)

Small Business (10-49 staff)

∙ Secure Baseline Configurations (SBC)

Medium Business (50-249 staff)

∙ Secure Baseline Configurations (SBC)

Large Business (250-999 staff)

∙ Secure Baseline Configurations (SBC)

Enterprise (>1,000 staff)

∙ Secure Baseline Configurations (SBC)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74278, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591259", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591259", "securityControlId": 32048, "ccis": [], "uuid": "6b883fb7-25b4-56d7-b933-d2d172b9275d", "testId": "TDA-05.2_A01", "test": "endpoint devices are configured to log events and generate alerts for attempts to access diagnostic and test interfaces.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 605486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a71bd13b-5368-5163-a023-5e38b70da51c", "parentControlId": 32048, "controlId": "EDR 2.13(1)", "title": "EDR 2.13(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590336" }, { "id": 605487, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7e4e553-f1df-593a-9678-d3b6530138b1", "parentControlId": 32048, "controlId": "HDR 2.13(1)", "title": "HDR 2.13(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590336" }, { "id": 605488, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590336", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20aa1058-91d8-5aa5-aa22-26078e1dff02", "parentControlId": 32048, "controlId": "NDR 2.13(1)", "title": "NDR 2.13(1)", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590336" } ], "id": 32048, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731342", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731342", "catalogueId": 1062, "uuid": "fa874490-e00a-56fe-a62d-5d1a212ca09f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization enable endpoint devices to log events and generate alerts for attempts to access diagnostic and test interfaces?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Diagnostic & Test Interface Monitoring", "description": "

Control Description

Mechanisms exist to enable endpoint devices to log events and generate alerts for attempts to access diagnostic and test interfaces.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to enable endpoint devices to log events and generate alerts for attempts to access diagnostic and test interfaces.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-05.2", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-05.2", "references": "

Micro-Small Business (<10 staff)

∙ Review software for known vulnerabilities before purchase/deployment

Small Business (10-49 staff)

∙ Third-party software security assessment before deployment

Medium Business (50-249 staff)

∙ Formal third-party software security review process\n∙ SCA for open source

Large Business (250-999 staff)

∙ Enterprise third-party software security program (SCA, TPRM)\n∙ Vendor security assessments

Enterprise (>1,000 staff)

∙ Enterprise software supply chain security program\n∙ SCA (e.g., Snyk, Black Duck)\n∙ Vendor security audits\n∙ SBOM management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74279, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591259", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591259", "securityControlId": 32049, "ccis": [], "uuid": "2828e880-6f15-5b4b-a4f9-74280cfb33f4", "testId": "TDA-06_A01", "test": "software development techniques that promote effective cybersecurity / data privacy are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.13.2[b]\n53A_R5_SA-04(03)_ODP[01]\n53A_R5_SA-04(03)_ODP[02]\n53A_R5_SA-04(03)_ODP[03]\n53A_R5_SA-04(03)_ODP[04]\n53A_R5_SA-04(03)_ODP[05]\n53A_R5_SA-04(03)_ODP[06]", "defaultText": null }, { "id": 74280, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591259", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591259", "securityControlId": 32049, "ccis": [], "uuid": "641e4639-5efa-597d-902b-938e043aea76", "testId": "TDA-06_A02", "test": "testing, evaluation, assessment, verification and validation methods are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(03)_ODP[07]", "defaultText": null }, { "id": 74281, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591259", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591259", "securityControlId": 32049, "ccis": [], "uuid": "463673ad-1ca3-5935-b888-304a5a09ff44", "testId": "TDA-06_A03", "test": "cybersecurity / data privacy requirements to be satisfied by the process, standards, tools, tool options and tool configurations are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-15_ODP[02]\n53A_R5_SA-15_ODP[03]", "defaultText": null }, { "id": 74282, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591259", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591259", "securityControlId": 32049, "ccis": [], "uuid": "f84d2643-de8c-542f-9084-a03b692e3a3e", "testId": "TDA-06_A04", "test": "identified software development techniques that promote effective cybersecurity / data privacy are employed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.13.2[e]", "defaultText": null }, { "id": 74283, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591259", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591259", "securityControlId": 32049, "ccis": [], "uuid": "eae02026-a756-59d4-825b-132e1b4f1435", "testId": "TDA-06_A05", "test": "quality control processes are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-04(03)_ODP[08]", "defaultText": null }, { "id": 74284, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59126", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59126", "securityControlId": 32049, "ccis": [], "uuid": "7237f359-9cc6-5ee6-ad94-79614dea3409", "testId": "TDA-06_A06", "test": "frequency at which to review the development process, standards, tools, tool options and tool configurations is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "53A_R5_SA-15_ODP[01]", "defaultText": null }, { "id": 74285, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59126", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59126", "securityControlId": 32049, "ccis": [], "uuid": "a3ceeea5-2008-58ce-acd8-ab99bcd20ffb", "testId": "TDA-06_A07", "test": "the developer of the system, system component or system service is required to follow a documented development process that explicitly addresses security requirements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-15a.01[01]", "defaultText": null }, { "id": 74286, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59126", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59126", "securityControlId": 32049, "ccis": [], "uuid": "853ef380-91a6-5a8e-9d1b-968dc62363a6", "testId": "TDA-06_A08", "test": "the developer of the system, system component or system service is required to follow a documented development process that explicitly addresses privacy requirements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-15a.01[02]", "defaultText": null }, { "id": 74287, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591261", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591261", "securityControlId": 32049, "ccis": [], "uuid": "e8ab764d-b1b1-58ef-8dda-da3752f2a8b5", "testId": "TDA-06_A09", "test": "the developer of the system, system component or system service is required to follow a documented development process that identifies the standards used in the development process.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-15a.02[01]", "defaultText": null }, { "id": 74288, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591261", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591261", "securityControlId": 32049, "ccis": [], "uuid": "2851cdb2-3443-50f3-8ec4-e5557dc728dc", "testId": "TDA-06_A10", "test": "the developer of the system, system component or system service is required to follow a documented development process that identifies the tools used in the development process.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-15a.02[02]", "defaultText": null }, { "id": 74289, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591261", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591261", "securityControlId": 32049, "ccis": [], "uuid": "ea295b74-3115-5090-aa63-c115ee0fd828", "testId": "TDA-06_A11", "test": "the developer of the system, system component or system service is required to follow a documented development process that documents the specific tool used in the development process.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-15a.03[01]", "defaultText": null }, { "id": 74290, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591261", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591261", "securityControlId": 32049, "ccis": [], "uuid": "b1a42d31-c555-5d02-a1e2-3dc3341c3c96", "testId": "TDA-06_A12", "test": "the developer of the system, system component or system service is required to follow a documented development process that documents the specific tool configurations used in the development process.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-15a.03[02]", "defaultText": null }, { "id": 74291, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591261", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591261", "securityControlId": 32049, "ccis": [], "uuid": "06daf8eb-0f54-59b9-953d-ad1a757e1506", "testId": "TDA-06_A13", "test": "the developer of the system, system component or system service is required to follow a documented development process that documents, manages and ensures the integrity of changes to the process and/or tools used in development.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-15a.04", "defaultText": null }, { "id": 74292, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591262", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591262", "securityControlId": 32049, "ccis": [], "uuid": "5d86710e-c146-5567-afee-804214b7c88d", "testId": "TDA-06_A14", "test": "the developer of the system, system component or system service is required to follow a documented development process in which the development process, standards, tools, tool options and tool configurations are reviewed frequently to determine that the process, standards, tools, tool options and tool configurations selected and employed satisfy security requirements.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_SA-15b.[01]", "defaultText": null }, { "id": 74293, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591262", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591262", "securityControlId": 32049, "ccis": [], "uuid": "a65ff8f2-be7b-5d17-badd-a6c8361c5df7", "testId": "TDA-06_A15", "test": "the developer of the system, system component or system service is required to follow a documented development process in which the development process, standards, tools, tool options and tool configurations are reviewed frequently to determine that the process, standards, tools, tool options and tool configurations selected and employed satisfy privacy requirements.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_SA-15b.[02]", "defaultText": null }, { "id": 74294, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591262", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591262", "securityControlId": 32049, "ccis": [], "uuid": "0c5d6fb7-f535-51c5-af58-4c923adbdb47", "testId": "TDA-06_A16", "test": "the developer of the system, system component or system service is required to demonstrate the use of a system development life cycle process that includes organization-defined system security engineering methods.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-04(03)(a)\n53A_R5_SA-04(03)(b)\n53A_R5_SA-04(03)(c)", "defaultText": null } ], "externalMappings": [ { "id": 605532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590341", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d431972-db88-5399-933f-fe7e42cf14d2", "parentControlId": 32049, "controlId": "ORG 2.3", "title": "ORG 2.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590341" }, { "id": 605533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7754aa2a-394d-5587-9b9a-4d21a2e45dec", "parentControlId": 32049, "controlId": "SD-4", "title": "SD-4", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590342" }, { "id": 605534, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a137ad67-c086-5e7e-a65d-35654e971bec", "parentControlId": 32049, "controlId": "SD-4(a)", "title": "SD-4(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590342" }, { "id": 605535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e4e508b-6c8b-526b-9fa1-90ecd1fa8422", "parentControlId": 32049, "controlId": "SD-4(b)", "title": "SD-4(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590342" }, { "id": 605536, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d3ea08d-1360-5ffa-bc93-ae587df38c82", "parentControlId": 32049, "controlId": "SD-4(c)", "title": "SD-4(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590342" }, { "id": 605537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54ed62fe-2f3b-5afb-97fd-5163fe69d414", "parentControlId": 32049, "controlId": "SD-4(d)", "title": "SD-4(d)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590342" }, { "id": 605538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b5a74ae-bb0c-5e62-9d21-af52df71e45a", "parentControlId": 32049, "controlId": "SD-4(e)", "title": "SD-4(e)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590342" }, { "id": 605539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7649b09-0f2b-5d89-ad50-087f9077d823", "parentControlId": 32049, "controlId": "SD-4(f)", "title": "SD-4(f)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590342" }, { "id": 605540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1805573f-3ec7-5bd1-a929-83eabab95d62", "parentControlId": 32049, "controlId": "SD-4(g)", "title": "SD-4(g)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590342" }, { "id": 605541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590342", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4231bddd-c366-549b-b9ff-ea6937d67975", "parentControlId": 32049, "controlId": "SI-2", "title": "SI-2", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590343" }, { "id": 605542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "111d9cb2-8997-5d55-89aa-dad82b8b4f2e", "parentControlId": 32049, "controlId": "SI-2(a)", "title": "SI-2(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590343" }, { "id": 605543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f861c02-03b2-5154-935e-ba852f022327", "parentControlId": 32049, "controlId": "SI-2(b)", "title": "SI-2(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590343" }, { "id": 605544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a11a7586-f880-560a-a74d-18dd0fd4455b", "parentControlId": 32049, "controlId": "SI-2(c)", "title": "SI-2(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590343" }, { "id": 605545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7ca7d7b-c21e-5331-96b4-ffba5ed0f1ee", "parentControlId": 32049, "controlId": "SI-2(d)", "title": "SI-2(d)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590343" }, { "id": 605546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "009cf75d-042e-57ab-a41a-b3fd70591674", "parentControlId": 32049, "controlId": "SI-2(e)", "title": "SI-2(e)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590343" }, { "id": 605547, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec687f48-7d40-5ec9-97fd-d674f8f1e962", "parentControlId": 32049, "controlId": "SI-2(f)", "title": "SI-2(f)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590343" }, { "id": 605549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7dd20893-6b03-51f3-819e-5d51a4781857", "parentControlId": 32049, "controlId": "8.25", "title": "8.25", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590343" }, { "id": 605550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590343", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6dae1904-3466-5a6f-adee-40190d62b1c8", "parentControlId": 32049, "controlId": "8.26", "title": "8.26", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590343" }, { "id": 605551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590344", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5fed3f9a-14a4-5a46-8b6d-165f283b22dc", "parentControlId": 32049, "controlId": "8.27", "title": "8.27", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590344" }, { "id": 605552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590344", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b266bfde-a2c0-5cef-a8e6-753ed9625895", "parentControlId": 32049, "controlId": "8.28", "title": "8.28", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590344" }, { "id": 605553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590344", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d38cd5ca-c299-5465-9dc6-cc31340c653e", "parentControlId": 32049, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590344" }, { "id": 605563, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2551b0d-f6a3-54bf-98b3-21e46cb26bf5", "parentControlId": 32049, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590345" }, { "id": 605564, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "510dfc0e-1863-5941-862d-5ba14e50cdf2", "parentControlId": 32049, "controlId": "T1078.001", "title": "T1078.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590345" }, { "id": 605565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df74d881-f3fd-5509-a5e4-d9c56df0f5d6", "parentControlId": 32049, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590345" }, { "id": 605566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f669d2b4-62e8-52a4-b0f7-bbf47be9ad11", "parentControlId": 32049, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590345" }, { "id": 605567, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e4136ca-c9b7-5a34-9f4b-eefc51c65786", "parentControlId": 32049, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590345" }, { "id": 605568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590345", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8dc63498-cbea-53ee-8d18-73be1590ebd6", "parentControlId": 32049, "controlId": "T1213.003", "title": "T1213.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590345" }, { "id": 605569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "711d24dc-4a6d-5fd8-91ab-94a500a88015", "parentControlId": 32049, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590346" }, { "id": 605570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db913d2e-6624-5465-83dd-3031e398eb3d", "parentControlId": 32049, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590346" }, { "id": 605571, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f364cda6-250e-515b-8ec0-2081bef9adec", "parentControlId": 32049, "controlId": "T1552.001", "title": "T1552.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590346" }, { "id": 605572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0da5e821-1ab7-5b30-9206-5709ea74e7ba", "parentControlId": 32049, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590346" }, { "id": 605573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "912ef389-f499-5661-80fe-ec812094b9d5", "parentControlId": 32049, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590346" }, { "id": 605574, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6332d371-ad2a-597a-9305-bda6cac26828", "parentControlId": 32049, "controlId": "T1552.006", "title": "T1552.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590346" }, { "id": 605575, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "350d5fd7-8cb9-5f3c-916b-eefb51da3daf", "parentControlId": 32049, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590346" }, { "id": 605576, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590346", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76d035cd-cdee-53ff-bba3-3a006d31ee09", "parentControlId": 32049, "controlId": "T1574.002", "title": "T1574.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590346" }, { "id": 605581, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b07aef2d-ccb3-5bcf-93c4-5af433990dff", "parentControlId": 32049, "controlId": "SA-1", "title": "SA-1", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590347" }, { "id": 605582, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18d38bdc-a6de-5671-9de3-60e5dc19ca19", "parentControlId": 32049, "controlId": "SA-15", "title": "SA-15", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590347" }, { "id": 605583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4eae36f6-0e7c-565e-8b25-d1815b04b592", "parentControlId": 32049, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590347" }, { "id": 605584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cac09e3f-6450-55d1-999c-fb71f414bbad", "parentControlId": 32049, "controlId": "SA-04(03)", "title": "SA-04(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590347" }, { "id": 605585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590347", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7430377-a392-5f83-b3b1-6178c90c9c00", "parentControlId": 32049, "controlId": "SA-15", "title": "SA-15", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590347" }, { "id": 605588, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7da36929-87f7-57a3-9149-06dad71802fe", "parentControlId": 32049, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590348" }, { "id": 605589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91f1e62d-ab2b-5dd0-a7a8-5502e75933d0", "parentControlId": 32049, "controlId": "SA-15", "title": "SA-15", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590348" }, { "id": 605590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "240a4cb6-12db-5d7e-898a-31fb5d79947d", "parentControlId": 32049, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590348" }, { "id": 605591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bbf8ed1c-b452-519c-aae6-2f4cbcaedfd8", "parentControlId": 32049, "controlId": "SA-04(03)", "title": "SA-04(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590348" }, { "id": 605592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "012be840-fc0e-5b32-9c84-2cae60be4c1c", "parentControlId": 32049, "controlId": "SA-15", "title": "SA-15", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590348" }, { "id": 605593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46afdbe8-371f-5892-bd65-3c91f53f0cec", "parentControlId": 32049, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590348" }, { "id": 605594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a98dd3c3-17d4-5198-8ea4-80ac9e680f65", "parentControlId": 32049, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590348" }, { "id": 605595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590348", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84f2a5b9-0a0f-58ef-9ca4-13a18cf76dd0", "parentControlId": 32049, "controlId": "SA-15", "title": "SA-15", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590348" }, { "id": 605596, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79f34272-3138-59e6-b95b-6600f462df58", "parentControlId": 32049, "controlId": "SA-01", "title": "SA-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590349" }, { "id": 605597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e4fccaa1-dc43-5936-a29d-eb418960f67f", "parentControlId": 32049, "controlId": "SA-15", "title": "SA-15", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590349" }, { "id": 605598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a15eb5e-9c91-5912-8dc1-b8f2f20b7258", "parentControlId": 32049, "controlId": "SA-1", "title": "SA-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590349" }, { "id": 605599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85e00754-0505-5581-8d9a-db93531e2a3f", "parentControlId": 32049, "controlId": "SA-15", "title": "SA-15", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590349" }, { "id": 605600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590349", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14168be2-94ed-5d3e-9660-4833b90a2101", "parentControlId": 32049, "controlId": "SA-1", "title": "SA-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590349" }, { "id": 605606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe70b8e4-1ba1-575a-8083-6b2ddcad18f5", "parentControlId": 32049, "controlId": "NFO - SA-1", "title": "NFO - SA-1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59035" }, { "id": 605607, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59035", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4dfa925d-3231-54e4-9aec-d3f00c4bbc82", "parentControlId": 32049, "controlId": "03.16.01", "title": "03.16.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59035" }, { "id": 605619, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590351", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed1c4a83-21cd-5e81-80eb-c349906dd1f9", "parentControlId": 32049, "controlId": "PR.PS-06", "title": "PR.PS-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590351" }, { "id": 605658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e13d9a21-f00e-5f1d-b516-c2e7ccf604bc", "parentControlId": 32049, "controlId": "ARCHITECTURE-4a", "title": "ARCHITECTURE-4a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590355" }, { "id": 605659, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590355", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77db0a99-6d59-5c95-94a5-ba11485673d5", "parentControlId": 32049, "controlId": "ARCHITECTURE-4d", "title": "ARCHITECTURE-4d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590355" }, { "id": 605710, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590361", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a79422da-6e3b-5534-baa6-4aa15fa24b9f", "parentControlId": 32049, "controlId": "A4.b", "title": "A4.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590361" }, { "controlId": "A.4.2.5", "title": "A.4.2.5 — Review and Validation Testing of a Modification or Addition of a Critical Digital Asset", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, CM-3, SA-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "b0d51cb6-4cd5-5208-937c-74a50d2ca4ab", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.5", "title": "NEI 08-09 Sec 4.2.5 — Review and Validation Testing of a Modification or Addition of a Critical Digital Asset", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d4a18a33-9c83-5b74-9a3b-3312f14efb79", "isPublic": true }, { "controlId": "10 CFR 73.54(e)", "title": "10 CFR 73.54(e) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "dd5dac61-54f5-5d65-996a-bd2fddeb8552", "isPublic": true }, { "controlId": "C.12.5", "title": "C.12.5 — Developer Security Testing", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SA-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "c7c8861c-3c77-5acb-aa8e-507883b56ad1", "isPublic": true }, { "controlId": "NEI 08-09 App E.12.5", "title": "NEI 08-09 App E.12.5 — Developer Security Testing", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.12.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "9bf892b9-2e60-5df8-9a34-40ef786e275d", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.12.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "53b6f7fe-9fb0-53fe-bf91-0f99d79d19e1", "isPublic": true }, { "controlId": "C.12.6", "title": "C.12.6 — Licensee/Applicant testing", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, SA-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "77357ed7-082a-5440-9515-18164e9fc282", "isPublic": true }, { "controlId": "NEI 08-09 App E.12.6", "title": "NEI 08-09 App E.12.6 — Licensee/Applicant testing", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.12.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d92398b4-7f8c-5ede-b149-4a7c3ce72d9e", "isPublic": true }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "30e42b8b-608e-589f-84c3-9d12e1c368ab", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "13734746-5920-5fae-9a9e-769015d53708", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "0ffe2769-a45d-57f5-b02a-de4fc47decf3", "isPublic": true } ], "id": 32049, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731342", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731342", "catalogueId": 1062, "uuid": "141722f3-5bd8-5f3a-891f-f86969598a21", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization develop applications based on Secure Software Development Practices (SSDP)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Secure Software Development Practices (SSDP)", "description": "

Control Description

Mechanisms exist to develop applications based on Secure Software Development Practices (SSDP).

Evidence Request List (ERL)

E-TDA-08\nE-TDA-11

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to develop applications based on Secure Software Development Practices (SSDP).

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.2.5, C.12.5, C.12.6", "controlId": "TDA-06", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-06", "references": "

Micro-Small Business (<10 staff)

∙ Microsoft Security Development Lifecycle (SDL) practices\n∙ OWASP's Application Security Verification Standard (ASVS) \n∙ Mobile Application Security Verification Standard (MASVS)

Small Business (10-49 staff)

∙ Microsoft Security Development Lifecycle (SDL) practices\n∙ OWASP's Application Security Verification Standard (ASVS) \n∙ Mobile Application Security Verification Standard (MASVS)

Medium Business (50-249 staff)

∙ Microsoft Security Development Lifecycle (SDL) practices\n∙ OWASP's Application Security Verification Standard (ASVS) \n∙ Mobile Application Security Verification Standard (MASVS)

Large Business (250-999 staff)

∙ Microsoft Security Development Lifecycle (SDL) practices\n∙ OWASP's Application Security Verification Standard (ASVS) \n∙ Mobile Application Security Verification Standard (MASVS)

Enterprise (>1,000 staff)

∙ Microsoft Security Development Lifecycle (SDL) practices\n∙ OWASP's Application Security Verification Standard (ASVS) \n∙ Mobile Application Security Verification Standard (MASVS)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74295, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591262", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591262", "securityControlId": 32050, "ccis": [], "uuid": "467b3c47-dc66-5784-a403-07d13632e034", "testId": "TDA-06.1_A01", "test": "decision points in the system development life cycle are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-15(03)_ODP[01]", "defaultText": null }, { "id": 74296, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591263", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591263", "securityControlId": 32050, "ccis": [], "uuid": "5efc8fe8-a2da-510f-912c-5326ae90396b", "testId": "TDA-06.1_A02", "test": "the breadth of criticality analysis is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-15(03)_ODP[02]", "defaultText": null }, { "id": 74297, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591263", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591263", "securityControlId": 32050, "ccis": [], "uuid": "04a129cc-8e69-5968-992d-c1654aa49ac2", "testId": "TDA-06.1_A03", "test": "the depth of criticality analysis is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-15(03)_ODP[03]", "defaultText": null }, { "id": 74298, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591263", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591263", "securityControlId": 32050, "ccis": [], "uuid": "b108846f-3785-584a-ab52-5a2d17650736", "testId": "TDA-06.1_A04", "test": "the developer of the system, system component, or system service is required to perform a criticality analysis at organization-defined decision points in the system development life cycle.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-15(03)(a)", "defaultText": null }, { "id": 74299, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591263", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591263", "securityControlId": 32050, "ccis": [], "uuid": "714ce6a2-27fd-5183-8b70-1bb11eae6cc8", "testId": "TDA-06.1_A05", "test": "the developer of the system, system component, or system service is required to perform a criticality analysis per an organization-defined breadth.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-15(03)(b)[01]", "defaultText": null }, { "id": 74300, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591263", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591263", "securityControlId": 32050, "ccis": [], "uuid": "b97aa72a-db2e-54df-b638-1c31b77f4b28", "testId": "TDA-06.1_A06", "test": "the developer of the system, system component, or system service is required to perform a criticality analysis per an organization-defined depth.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-15(03)(b)[02]", "defaultText": null }, { "id": 74301, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591264", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591264", "securityControlId": 32050, "ccis": [], "uuid": "4134f619-a886-5d2a-ad6a-f5141520d55f", "testId": "TDA-06.1_A07", "test": "suppliers of critical or mission-essential technologies, products and services are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-30(01)[01]", "defaultText": null }, { "id": 74302, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591264", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591264", "securityControlId": 32050, "ccis": [], "uuid": "e4b0553a-3a2c-5eff-84af-56cd51e67549", "testId": "TDA-06.1_A08", "test": "suppliers of critical or mission-essential technologies, products and services are prioritized.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-30(01)[02]", "defaultText": null }, { "id": 74303, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591264", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591264", "securityControlId": 32050, "ccis": [], "uuid": "f717ff9c-043b-5cd0-ac2f-2d8b55df471b", "testId": "TDA-06.1_A09", "test": "suppliers of critical or mission-essential technologies, products and services are assessed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-30(01)[03]", "defaultText": null } ], "externalMappings": [ { "id": 605748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6c54c8c-7ce5-50c6-a9ae-6df1bd1f0f98", "parentControlId": 32050, "controlId": "8.29", "title": "8.29", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590366" }, { "id": 605750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42af9404-d9fa-5a87-a073-156fc9935079", "parentControlId": 32050, "controlId": "T1195.003", "title": "T1195.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590366" }, { "id": 605751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf8e45b8-987c-5e91-a1ca-71f085935a76", "parentControlId": 32050, "controlId": "T1495", "title": "T1495", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590366" }, { "id": 605752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a43088f-1d46-500d-a236-3bb5f81455cf", "parentControlId": 32050, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590366" }, { "id": 605753, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b4522a1-4745-5d3c-9883-dbb9a4c318c6", "parentControlId": 32050, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590366" }, { "id": 605754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "686ba2ca-fa11-5bec-9684-75b691b4edc9", "parentControlId": 32050, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590366" }, { "id": 605755, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590366", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4315e1c7-c770-5ce5-99f6-7778f9afd172", "parentControlId": 32050, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590366" }, { "id": 605756, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0dd663d-5934-515b-8f60-a6ee75f9effe", "parentControlId": 32050, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590367" }, { "id": 605757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "467efdf3-c858-5cd7-a792-4ce4ea53ad3a", "parentControlId": 32050, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590367" }, { "id": 605758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdeb30e2-8d09-5c4d-9662-122e74a9e483", "parentControlId": 32050, "controlId": "T1553.006", "title": "T1553.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590367" }, { "id": 605759, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0be9a77f-32d4-5aa2-86c5-06744fc74d31", "parentControlId": 32050, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590367" }, { "id": 605760, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dee6a2cd-a73e-5462-b179-493c444bdfa5", "parentControlId": 32050, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590367" }, { "id": 605761, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c0dc749-6e84-54d6-99c2-a13e80ce8336", "parentControlId": 32050, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590367" }, { "id": 605763, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6178d4c-a838-59dd-990f-9b1990e52a82", "parentControlId": 32050, "controlId": "PM-30(01)", "title": "PM-30(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590367" }, { "id": 605764, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e7dcbefb-cf2a-53e4-9d02-69de253ab173", "parentControlId": 32050, "controlId": "RA-09", "title": "RA-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590367" }, { "id": 605765, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590367", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "683f84c9-7c25-5203-8518-93f1cc840673", "parentControlId": 32050, "controlId": "SA-15(03)", "title": "SA-15(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590367" }, { "id": 605768, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64a75296-9fa3-53bd-823e-fe62e1f950bd", "parentControlId": 32050, "controlId": "RA-09", "title": "RA-09", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590368" }, { "id": 605769, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd805431-b5f6-5dbc-b6e6-1c5650c571cb", "parentControlId": 32050, "controlId": "SA-15(03)", "title": "SA-15(03)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590368" }, { "id": 605770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa483cf5-7edf-5bee-91af-5503caf350d0", "parentControlId": 32050, "controlId": "PM-30(01)", "title": "PM-30(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590368" }, { "id": 605771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "17c0eebf-0674-598b-bcda-1e766203d136", "parentControlId": 32050, "controlId": "RA-09", "title": "RA-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590368" }, { "id": 605772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ed25b65-d647-5be4-969d-e0a63e99db18", "parentControlId": 32050, "controlId": "SA-15(03)", "title": "SA-15(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590368" }, { "id": 605773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590368", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75bd89fe-42ac-5c59-a3d2-003c771fc78c", "parentControlId": 32050, "controlId": "PM-30(01)", "title": "PM-30(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590368" }, { "id": 605774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7814a4df-b74e-5857-aa99-6356ddecbf14", "parentControlId": 32050, "controlId": "PM-30(01)", "title": "PM-30(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590369" }, { "id": 605775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d14f6b1-e730-55e7-a868-540281d81aac", "parentControlId": 32050, "controlId": "SA-15(03)", "title": "SA-15(03)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590369" }, { "id": 605776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e59319e5-2b30-5423-aeb2-4bf6d678e062", "parentControlId": 32050, "controlId": "PM-30(01)", "title": "PM-30(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590369" }, { "id": 605777, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "824e2a0b-27c5-5861-b11d-0a589fe12c3e", "parentControlId": 32050, "controlId": "SA-15(03)", "title": "SA-15(03)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590369" }, { "id": 605780, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5fc46bb9-e06a-515e-ab51-a4202f4df321", "parentControlId": 32050, "controlId": "RA-9", "title": "RA-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590369" }, { "id": 605781, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "290096ce-f971-57b8-917a-cc6e480a236a", "parentControlId": 32050, "controlId": "SA-15(3)", "title": "SA-15(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590369" }, { "id": 605782, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590369", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5427a6c-6097-5d4f-95fc-b9490f8a848d", "parentControlId": 32050, "controlId": "RA-9", "title": "RA-9", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590369" }, { "id": 605789, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7718d00c-2cf9-5c65-a523-5acfb6f1d5c6", "parentControlId": 32050, "controlId": "PR.PS-06", "title": "PR.PS-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59037" }, { "id": 605794, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590379", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb4dee9a-e1a6-58bb-8a91-288d307760f3", "parentControlId": 32050, "controlId": "ASSET-1c", "title": "ASSET-1c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590379" }, { "id": 605795, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590379", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e93bd48c-86a8-5fd7-a428-9ba9cdf33453", "parentControlId": 32050, "controlId": "ASSET-1d", "title": "ASSET-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590379" }, { "id": 605796, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590379", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "550fbad9-79d8-5c43-ae3e-dd198be3172a", "parentControlId": 32050, "controlId": "ASSET-2c", "title": "ASSET-2c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590379" }, { "id": 605797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590379", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04e67a7b-284d-57c6-baae-a428aba309da", "parentControlId": 32050, "controlId": "ASSET-2d", "title": "ASSET-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590379" } ], "id": 32050, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731343", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731343", "catalogueId": 1062, "uuid": "e2cb5380-c0f0-5eaa-a192-57a0524bba6b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require the developer of the Technology Asset, Application and/or Service (TAAS) to perform a criticality analysis at organization-defined decision points in the Secure Development Life Cycle (SDLC)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Criticality Analysis During Development", "description": "

Control Description

Mechanisms exist to require the developer of the Technology Asset, Application and/or Service (TAAS) to perform a criticality analysis at organization-defined decision points in the Secure Development Life Cycle (SDLC).

Evidence Request List (ERL)

E-BCM-08\nE-CHG-01\nE-TPM-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require the developer of the Technology Asset, Application and/or Service (TAAS) to perform a criticality analysis at organization-defined decision points in the Secure Development Life Cycle (SDLC).

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-06.1", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-06.1", "references": "

Medium Business (50-249 staff)

∙ Formal test environment security policy (separate from production)

Large Business (250-999 staff)

∙ Enterprise test environment management with security controls

Enterprise (>1,000 staff)

∙ Enterprise test environment security program\n∙ Test data management\n∙ Production/test environment separation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74304, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591264", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591264", "securityControlId": 32051, "ccis": [], "uuid": "2b60fe08-0af7-5212-ace9-ba577a6dfe13", "testId": "TDA-06.2_A01", "test": "threat modelling and other secure design techniques are used to ensure that threats to software and solutions are identified and accounted for.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 605830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70229247-18bd-5e9c-9721-e009bc8bfa99", "parentControlId": 32051, "controlId": "SM-13", "title": "SM-13", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590388" }, { "id": 605831, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50429e40-c0b1-52e1-ba85-f1bf2fd0a540", "parentControlId": 32051, "controlId": "SR-2", "title": "SR-2", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590388" }, { "id": 605832, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d24f79ee-4e67-5af2-bc14-3ef731653953", "parentControlId": 32051, "controlId": "SR-2(a)", "title": "SR-2(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590388" }, { "id": 605833, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0dc8a6d5-eed0-5669-b08d-47361a6c762b", "parentControlId": 32051, "controlId": "SR-2(b)", "title": "SR-2(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590388" }, { "id": 605834, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590388", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a2de799-4c57-5276-9933-1b5ea37d533d", "parentControlId": 32051, "controlId": "SR-2(c)", "title": "SR-2(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590388" }, { "id": 605835, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590389", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67588dea-fc39-5cb7-8721-79f53038da01", "parentControlId": 32051, "controlId": "SR-2(d)", "title": "SR-2(d)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590389" }, { "id": 605836, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590389", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71cb51cc-eab8-56ee-8619-b67ac3d252f7", "parentControlId": 32051, "controlId": "SR-2(e)", "title": "SR-2(e)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590389" }, { "id": 605837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590389", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d032cf4-21ca-505e-9b1b-1e0dddfed6a6", "parentControlId": 32051, "controlId": "SR-2(f)", "title": "SR-2(f)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590389" }, { "id": 605838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590389", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9dc885ec-1de7-5d26-abd7-33160cf33aba", "parentControlId": 32051, "controlId": "SR-2(g)", "title": "SR-2(g)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590389" }, { "id": 605839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590389", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce27938c-4dc7-547b-b29f-35aacfcc7eee", "parentControlId": 32051, "controlId": "SR-2(h)", "title": "SR-2(h)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590389" }, { "id": 605840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590389", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2d2b224-c711-57c0-afc3-2295abdbabba", "parentControlId": 32051, "controlId": "SR-2(i)", "title": "SR-2(i)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590389" }, { "id": 605841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590389", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a776271-d528-58a1-998e-5eb9c6830ca5", "parentControlId": 32051, "controlId": "SR-2(j)", "title": "SR-2(j)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590389" }, { "id": 605842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590389", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28d333c6-b5fd-53a7-bdd5-67651c455759", "parentControlId": 32051, "controlId": "SR-2(k)", "title": "SR-2(k)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590389" }, { "id": 605843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82a93c4a-e85c-57f8-9633-7876588c77ad", "parentControlId": 32051, "controlId": "SR-2(l)", "title": "SR-2(l)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59039" }, { "id": 605844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59039", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46d79089-a531-52b3-be56-2ff3cc1a4cc4", "parentControlId": 32051, "controlId": "SR-2(m)", "title": "SR-2(m)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59039" }, { "id": 605872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f049dd8a-4f01-5e63-b5a7-968a564f1d23", "parentControlId": 32051, "controlId": "SA-11(02)", "title": "SA-11(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590393" }, { "id": 605873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ecd4168-f187-5713-8c47-7ac00252b201", "parentControlId": 32051, "controlId": "SA-15(08)", "title": "SA-15(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590393" }, { "id": 605875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52ea3340-1e8f-5580-b394-81794b165133", "parentControlId": 32051, "controlId": "SA-11(02)", "title": "SA-11(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590393" }, { "id": 605876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590393", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8cba4df-0217-5fb8-9f83-f1d78f4e4d7d", "parentControlId": 32051, "controlId": "SA-15(08)", "title": "SA-15(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590393" }, { "id": 605878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdce97f7-d65c-56a3-b13d-fbb40ad30965", "parentControlId": 32051, "controlId": "SA-15(4)", "title": "SA-15(4)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590394" }, { "id": 605879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c46cf96-6120-5927-907a-8c1bd4aa8dbb", "parentControlId": 32051, "controlId": "SA-15(8)", "title": "SA-15(8)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590394" }, { "id": 605886, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590394", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97375443-abe2-5406-9362-11b17a28777a", "parentControlId": 32051, "controlId": "GV.OC-01", "title": "GV.OC-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590394" }, { "id": 605887, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590395", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1db735e0-fe3e-57e3-91e1-a0ade1a4bd46", "parentControlId": 32051, "controlId": "PR.PS-06", "title": "PR.PS-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590395" } ], "id": 32051, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731343", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731343", "catalogueId": 1062, "uuid": "9009280b-b82d-5c21-8954-b09c688d75ee", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization perform threat modelling and other secure design techniques, to ensure that threats to software and solutions are identified and accounted for?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Threat Modeling", "description": "

Control Description

Mechanisms exist to perform threat modelling and other secure design techniques, to ensure that threats to software and solutions are identified and accounted for.

Evidence Request List (ERL)

E-TDA-03\nE-TDA-10\nE-THR-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to perform threat modelling and other secure design techniques, to ensure that threats to software and solutions are identified and accounted for.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-06.2", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-06.2", "references": "

Medium Business (50-249 staff)

∙ Anonymize/mask production data before use in test environments

Large Business (250-999 staff)

∙ Enterprise test data management (masking/anonymization)

Enterprise (>1,000 staff)

∙ Enterprise test data management platform (e.g., Informatica TDM, Delphix)\n∙ Automated data masking", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74305, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591265", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591265", "securityControlId": 32052, "ccis": [], "uuid": "5c021801-e94d-5839-aa56-b8eeba1422f5", "testId": "TDA-06.3_A01", "test": "a Software Assurance Maturity Model (SAMM) governs a secure development lifecycle for the development of systems, applications and services.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 605925, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590399", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69d2b564-3d9d-5e25-9622-b4eb96eb5418", "parentControlId": 32052, "controlId": "PR.PS-06", "title": "PR.PS-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590399" } ], "id": 32052, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731343", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731343", "catalogueId": 1062, "uuid": "ec83da5f-9b35-57b4-8e54-1e2b410c0506", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize a Software Assurance Maturity Model (SAMM) to govern a secure development lifecycle for the development of Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Software Assurance Maturity Model (SAMM)", "description": "

Control Description

Mechanisms exist to utilize a Software Assurance Maturity Model (SAMM) to govern a secure development lifecycle for the development of Technology Assets, Applications and/or Services (TAAS).

Evidence Request List (ERL)

E-TDA-04\nE-TDA-11

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize a Software Assurance Maturity Model (SAMM) to govern a secure development lifecycle for the development of Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-06.3", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-06.3", "references": "

Micro-Small Business (<10 staff)

∙ Security requirements checklist for new technology

Small Business (10-49 staff)

∙ Security review checklist for technology acquisitions

Medium Business (50-249 staff)

∙ Defined Software Assurance Maturity Model (SAMM)

Large Business (250-999 staff)

∙ Defined Software Assurance Maturity Model (SAMM)

Enterprise (>1,000 staff)

∙ Defined Software Assurance Maturity Model (SAMM)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74307, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591265", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591265", "securityControlId": 32054, "ccis": [], "uuid": "1fb97e97-2e09-51be-9cde-8d98d64eef17", "testId": "TDA-06.5_A01", "test": "an independent review of the software design confirms that all cybersecurity / data privacy requirements are met and that any identified risks are satisfactorily addressed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 605988, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590406", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e73b68fb-3b4a-5b63-a6ce-c92cf5e26e12", "parentControlId": 32054, "controlId": "ARCHITECTURE-4f", "title": "ARCHITECTURE-4f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590406" } ], "id": 32054, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731344", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731344", "catalogueId": 1062, "uuid": "d1a50a61-8c1a-53ce-9e98-bac66d1219d0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization have an independent review of the software design to validate:\n(1) Applicable security, compliance and resilience requirements are met; and\n(2) Identified risks are remediated?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Software Design Review", "description": "

Control Description

Mechanisms exist to have an independent review of the software design to validate:\n(1) Applicable security, compliance and resilience requirements are met; and\n(2) Identified risks are remediated.

Evidence Request List (ERL)

E-TDA-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to have an independent review of the software design to validate:\n(1) Applicable security, compliance and resilience requirements are met; and\n(2) Identified risks are remediated.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-06.5", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-06.5", "references": "

Large Business (250-999 staff)

∙ Formal system integration testing with security focus

Enterprise (>1,000 staff)

∙ Enterprise integration testing program with security validation\n∙ Automated integration security testing", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74308, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591266", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591266", "securityControlId": 32055, "ccis": [], "uuid": "52d094d4-e1d2-58b5-ae2e-4e2ef8e42e2b", "testId": "TDA-06.6_A01", "test": "software design processes include conducting Root Cause Analysis (RCA) to identify the underlying causes of issues or failures.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74309, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591266", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591266", "securityControlId": 32055, "ccis": [], "uuid": "c1a101af-20ff-58e0-baaa-e656828bb97e", "testId": "TDA-06.6_A02", "test": "software design processes include developing actions to address the root cause of the issue or failure.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74310, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591266", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591266", "securityControlId": 32055, "ccis": [], "uuid": "2f98cc29-ca7d-5a92-8650-d4baf8e0e3c6", "testId": "TDA-06.6_A03", "test": "software design processes include implementing the actions and monitor the implementation for effectiveness.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 606003, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "46e2c9ea-ed86-589e-bad3-de7a1bf5cfa9", "parentControlId": 32055, "controlId": "DM-4", "title": "DM-4", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590408" }, { "id": 606004, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d2fb7ca-7b85-5602-a610-1875048d65eb", "parentControlId": 32055, "controlId": "DM-4(a-1)", "title": "DM-4(a-1)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590408" }, { "id": 606005, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5298253-d0c6-57e2-b5d2-f9b52eebd3ba", "parentControlId": 32055, "controlId": "DM-4(a-1)(1)", "title": "DM-4(a-1)(1)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590408" }, { "id": 606006, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71d1bfc7-e418-56d4-85fa-20a3b9da6157", "parentControlId": 32055, "controlId": "DM-4(a-1)(2)", "title": "DM-4(a-1)(2)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590408" }, { "id": 606007, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98c98d90-fe43-5fbf-9be7-30f98d62a641", "parentControlId": 32055, "controlId": "DM-4(a-1)(3)", "title": "DM-4(a-1)(3)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590408" }, { "id": 606008, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a888bd2-d2e6-5870-8640-58a711e38a44", "parentControlId": 32055, "controlId": "DM-4(a-1)(4)", "title": "DM-4(a-1)(4)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590408" }, { "id": 606009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "367201bc-01c4-5242-bab7-044a533f77dc", "parentControlId": 32055, "controlId": "DM-4(b-1)", "title": "DM-4(b-1)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590408" }, { "id": 606010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a36c132-10fb-5ffc-bc09-ed1c2da2b30e", "parentControlId": 32055, "controlId": "DM-4(c)", "title": "DM-4(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590408" }, { "id": 606011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a28eaba4-c873-56a4-b234-548ba5bdca3a", "parentControlId": 32055, "controlId": "DM-4(d)", "title": "DM-4(d)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590408" }, { "id": 606012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590408", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d051035-eab2-5e8b-a895-3bbd0b27bc5e", "parentControlId": 32055, "controlId": "DM-4(a-2)", "title": "DM-4(a-2)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590409" }, { "id": 606013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc373911-ceb6-5ef2-9097-5f6db6dde4ff", "parentControlId": 32055, "controlId": "DM-4(b-2)", "title": "DM-4(b-2)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590409" }, { "id": 606015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1baa9896-bbf1-5a3c-a975-2704d2ae9a58", "parentControlId": 32055, "controlId": "SI-02(07)", "title": "SI-02(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590409" }, { "id": 606016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590409", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80457e08-ad21-5686-8360-85e68711f412", "parentControlId": 32055, "controlId": "SI-02(07)", "title": "SI-02(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590409" } ], "id": 32055, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731344", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731344", "catalogueId": 1062, "uuid": "7b6c2f72-8a11-5559-b8ab-faba8a582277", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization assess software design processes that includes: \n(1) Conducting Root Cause Analysis (RCA) to identify the underlying causes of issues or failures;\n(2) Developing actions to address the root cause of the issue or failure; and\n(3) Implementing the actions and monitoring the implementation for effectiveness?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Software Design Root Cause Analysis", "description": "

Control Description

Mechanisms exist to assess software design processes that includes: \n(1) Conducting Root Cause Analysis (RCA) to identify the underlying causes of issues or failures;\n(2) Developing actions to address the root cause of the issue or failure; and\n(3) Implementing the actions and monitoring the implementation for effectiveness.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Technology Development & Acquisition (TDA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TDA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Technology development & acquisition-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Secure development practices loosely conform to industry-recognized standards for secure engineering (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to assess software design processes that includes: \n(1) Conducting Root Cause Analysis (RCA) to identify the underlying causes of issues or failures;\n(2) Developing actions to address the root cause of the issue or failure; and\n(3) Implementing the actions and monitoring the implementation for effectiveness.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-06.6", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-06.6", "references": "

Enterprise (>1,000 staff)

∙ Enterprise acceptance testing program with formal security criteria", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74311, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591267", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591267", "securityControlId": 32056, "ccis": [], "uuid": "de92bc00-4e14-597d-b627-473a22154861", "testId": "TDA-07_A01", "test": "system pre-production environments are protected commensurate with risk throughout the system development life cycle for the system, system component or system service.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SA-03(01)", "defaultText": null } ], "externalMappings": [ { "id": 606023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d9f6709-1d79-5737-97b4-03b49110db19", "parentControlId": 32056, "controlId": "SM-7", "title": "SM-7", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59041" }, { "id": 606024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "930d14d9-3646-5ecb-bb66-a3e20512c73b", "parentControlId": 32056, "controlId": "8.25", "title": "8.25", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59041" }, { "id": 606025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59041", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac837978-c392-54d1-8a7d-3e533be4d252", "parentControlId": 32056, "controlId": "8.31", "title": "8.31", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59041" }, { "id": 606031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b94ff9ef-b7fa-5d5c-a870-098f1701ed50", "parentControlId": 32056, "controlId": "SA-03(01)", "title": "SA-03(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590411" }, { "id": 606033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590411", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "158c0070-7fb9-52f5-b79c-16995a6ea1c5", "parentControlId": 32056, "controlId": "SA-03(01)", "title": "SA-03(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590411" }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "f0edd498-3d78-53ec-9e4a-f94fd08dc0c7", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "1d41007d-2018-5a7f-b5cb-17999b7e6651", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "47217bc2-33d7-599c-9cbd-5d2b55c7e26c", "isPublic": true } ], "id": 32056, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731345", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731345", "catalogueId": 1062, "uuid": "bd2f8fe8-3e04-5f59-8be6-ae4692205655", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain a segmented development network to ensure a secure development environment?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Secure Development Environments", "description": "

Control Description

Mechanisms exist to maintain a segmented development network to ensure a secure development environment.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Technology Development & Acquisition (TDA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TDA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Technology development & acquisition-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Secure development practices loosely conform to industry-recognized standards for secure engineering (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain a segmented development network to ensure a secure development environment.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "TDA-07", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-07", "references": "

Micro-Small Business (<10 staff)

∙ Keep software development tools secure and updated

Small Business (10-49 staff)

∙ Secure development environment policy\n∙ Control access to dev tools

Medium Business (50-249 staff)

∙ Formal secure development environment standards\n∙ Dev tool security controls

Large Business (250-999 staff)

∙ Enterprise secure development environment program\n∙ Dev tool access controls and monitoring

Enterprise (>1,000 staff)

∙ Enterprise secure development environment platform\n∙ DevSecOps toolchain security\n∙ Dev tool lifecycle management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74312, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591267", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591267", "securityControlId": 32057, "ccis": [], "uuid": "a187dcda-cf0e-5fb5-a65e-8d87208c3d70", "testId": "TDA-08_A01", "test": "changes to the system are analyzed in a separate test environment before implementation in an operational environment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-04(01)[01]", "defaultText": null }, { "id": 74313, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591267", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591267", "securityControlId": 32057, "ccis": [], "uuid": "9b04b481-f7df-50fa-8bd5-863de6f20797", "testId": "TDA-08_A02", "test": "changes to the system are analyzed for cybersecurity / data privacy impacts due to flaws.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-04(01)[02]\n53A_R5_CM-04(01)[03]", "defaultText": null }, { "id": 74314, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591268", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591268", "securityControlId": 32057, "ccis": [], "uuid": "e82e3383-55ef-50e6-bcc4-6b91903ee53c", "testId": "TDA-08_A03", "test": "changes to the system are analyzed for cybersecurity / data privacy impacts due to weaknesses.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-04(01)[04]\n53A_R5_CM-04(01)[05]", "defaultText": null }, { "id": 74315, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591268", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591268", "securityControlId": 32057, "ccis": [], "uuid": "f28178a7-1c19-50a5-b97e-a39669cb744c", "testId": "TDA-08_A04", "test": "changes to the system are analyzed for cybersecurity / data privacy impacts due to incompatibility.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-04(01)[06]\n53A_R5_CM-04(01)[07]", "defaultText": null }, { "id": 74316, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591268", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591268", "securityControlId": 32057, "ccis": [], "uuid": "800a25f7-0c97-5cbd-86c8-673649abbd8d", "testId": "TDA-08_A05", "test": "changes to the system are analyzed for cybersecurity / data privacy impacts due to intentional malice.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CM-04(01)[08]\n53A_R5_CM-04(01)[09]", "defaultText": null } ], "externalMappings": [ { "id": 606093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590418", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c737be1-8820-56cc-9abe-6d35a5482822", "parentControlId": 32057, "controlId": "8.25", "title": "8.25", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590418" }, { "id": 606094, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590418", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed49d30f-c35c-58e6-964e-a24b66f1e205", "parentControlId": 32057, "controlId": "8.31", "title": "8.31", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590418" }, { "id": 606100, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62c25abe-60bd-5184-8f7a-6b11e9d490c3", "parentControlId": 32057, "controlId": "CM-4(1)", "title": "CM-4(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590419" }, { "id": 606101, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89b7f117-5370-5b7f-9761-61a86498c0df", "parentControlId": 32057, "controlId": "CM-04(01)", "title": "CM-04(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590419" }, { "id": 606102, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d878610-fbc8-512d-903f-0878497df0f3", "parentControlId": 32057, "controlId": "CM-04(01)", "title": "CM-04(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590419" }, { "id": 606103, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "104e5360-8c2f-5d2d-bc10-8e8d817568bd", "parentControlId": 32057, "controlId": "CM-04(01)", "title": "CM-04(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590419" }, { "id": 606104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53ed72a8-52fc-5728-949d-b07d74e621ee", "parentControlId": 32057, "controlId": "CM-04(01)", "title": "CM-04(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590419" }, { "id": 606106, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590419", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0302125-46e1-5675-9b07-362615ab00a5", "parentControlId": 32057, "controlId": "CM-4(1)", "title": "CM-4(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590419" }, { "id": 606108, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14e86a7c-175c-5987-a104-d909827bc156", "parentControlId": 32057, "controlId": "3.4.5", "title": "3.4.5", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59042" }, { "controlId": "C.3.8", "title": "C.3.8 — Information Input Restrictions", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-10", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "534c0be8-6947-5f2d-b612-53f11321733b", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.8", "title": "NEI 08-09 App E.3.8 — Information Input Restrictions", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "c7872f83-eabb-5fbc-8b3e-9f4a753e4bb7", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.3.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "4a54b6e3-ff57-516e-9412-9d2cdeccbca1", "isPublic": true }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "8a8d696b-d7af-5ce1-adc4-01fbfaafc037", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "333a85bd-0395-55a6-984d-6adf167696a1", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "fd81dfaf-5baa-5f46-9477-ed71129490d1", "isPublic": true } ], "id": 32057, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731345", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731345", "catalogueId": 1062, "uuid": "0bfc52d9-3c04-5744-a4ae-ec28cead26f2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization manage separate development, testing and operational environments to reduce the risks of unauthorized access or changes to the operational environment and to ensure no impact to production Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Separation of Development, Testing and Operational Environments", "description": "

Control Description

Mechanisms exist to manage separate development, testing and operational environments to reduce the risks of unauthorized access or changes to the operational environment and to ensure no impact to production Technology Assets, Applications and/or Services (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to manage separate development, testing and operational environments to reduce the risks of unauthorized access or changes to the operational environment and to ensure no impact to production Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.3.8", "controlId": "TDA-08", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-08", "references": "

Micro-Small Business (<10 staff)

∙ Use version control for all code

Small Business (10-49 staff)

∙ Version control system (e.g., Git, GitHub)\n∙ Version control policy

Medium Business (50-249 staff)

∙ Formal configuration management for software (version control, branching)

Large Business (250-999 staff)

∙ Enterprise software configuration management program (e.g., GitLab, GitHub Enterprise)

Enterprise (>1,000 staff)

∙ Enterprise SCM platform (e.g., GitHub Enterprise, GitLab)\n∙ Automated version control enforcement\n∙ SBOM generation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74318, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591269", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591269", "securityControlId": 32059, "ccis": [], "uuid": "c5a410a2-c0e2-5995-9183-513c7410c93b", "testId": "TDA-09_A01", "test": "the developer of the system, system component or system service is required to demonstrate the use of a system development life cycle process that includes organization-defined system security engineering methods.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(03)(a)\n53A_R5_SA-04(03)(b)\n53A_R5_SA-04(03)(c)", "defaultText": null }, { "id": 74319, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591269", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591269", "securityControlId": 32059, "ccis": [], "uuid": "1cf0f06f-6862-5bcc-ae2e-82b06aaa381c", "testId": "TDA-09_A02", "test": "the developer of the system, system component or system service is required to perform attack surface reviews.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(06)", "defaultText": null }, { "id": 74320, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591269", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591269", "securityControlId": 32059, "ccis": [], "uuid": "27d41362-7f83-5038-b56f-46916c7f80b2", "testId": "TDA-09_A03", "test": "the breadth of testing and evaluation of required controls is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(07)_ODP[01]\n53A_R5_SA-11_ODP[03]\n53A_R5_SA-11_ODP[01]", "defaultText": null }, { "id": 74321, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591269", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591269", "securityControlId": 32059, "ccis": [], "uuid": "96b6bd86-766b-58d9-bc11-8fd610bda4de", "testId": "TDA-09_A04", "test": "the depth of testing and evaluation of required controls is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(07)_ODP[02]\n53A_R5_SA-11_ODP[03]\n53A_R5_SA-11_ODP[01]", "defaultText": null }, { "id": 74322, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59127", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59127", "securityControlId": 32059, "ccis": [], "uuid": "f395025e-fc82-5d43-b2ea-44643d58f27c", "testId": "TDA-09_A05", "test": "frequency at which to conduct testing/evaluation is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11_ODP[02]\n53A_R5_SA-11_ODP[01]", "defaultText": null }, { "id": 74323, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59127", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59127", "securityControlId": 32059, "ccis": [], "uuid": "c9cb4eca-91cb-5f4b-99c9-5702ac73db5f", "testId": "TDA-09_A06", "test": "the developer of the system, system component or system service is required at all post-design stages of the system development life cycle to develop a plan for ongoing security assessments.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11a.[01]", "defaultText": null }, { "id": 74324, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59127", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59127", "securityControlId": 32059, "ccis": [], "uuid": "4031b2ba-6348-51d1-9aae-dddc5edd0647", "testId": "TDA-09_A07", "test": "the developer of the system, system component or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing security assessments.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11a.[02]", "defaultText": null }, { "id": 74325, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59127", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59127", "securityControlId": 32059, "ccis": [], "uuid": "156f3814-0940-5552-993b-df5301daf787", "testId": "TDA-09_A08", "test": "the developer of the system, system component or system service is required at all post-design stages of the system development life cycle to develop a plan for privacy assessments.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11a.[03]", "defaultText": null }, { "id": 74326, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591271", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591271", "securityControlId": 32059, "ccis": [], "uuid": "5b6fbdf6-7cae-5636-85ac-42390d8f25da", "testId": "TDA-09_A09", "test": "the developer of the system, system component or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing privacy assessments.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11a.[04]", "defaultText": null }, { "id": 74327, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591271", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591271", "securityControlId": 32059, "ccis": [], "uuid": "8a7d9639-f8f4-57e1-9ce8-e36c6bda9583", "testId": "TDA-09_A10", "test": "the developer of the system, system component or system service is required at all post-design stages of the system development life cycle to perform testing/evaluation frequency to conduct at depth and coverage.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11b.", "defaultText": null }, { "id": 74328, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591271", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591271", "securityControlId": 32059, "ccis": [], "uuid": "da444853-5d6a-5c5a-a6b7-d29af97ae658", "testId": "TDA-09_A11", "test": "the developer of the system, system component or system service is required at all post-design stages of the system development life cycle to produce evidence of the execution of the assessment plan.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11c.[01]", "defaultText": null }, { "id": 74329, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591271", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591271", "securityControlId": 32059, "ccis": [], "uuid": "3a37a9e8-63fb-56a8-8de4-d9e38859af64", "testId": "TDA-09_A12", "test": "the developer of the system, system component or system service is required at all post-design stages of the system development life cycle to produce the results of the testing and evaluation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11c.[02]", "defaultText": null }, { "id": 74330, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591272", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591272", "securityControlId": 32059, "ccis": [], "uuid": "42548216-ee7d-55d3-8e5a-f16a4c9d95e2", "testId": "TDA-09_A13", "test": "the developer of the system, system component or system service is required at all post-design stages of the system development life cycle to implement a verifiable flaw remediation process.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11d.", "defaultText": null }, { "id": 74331, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591272", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591272", "securityControlId": 32059, "ccis": [], "uuid": "2a0357d2-cbe9-5db3-aa2b-fa66622b3f95", "testId": "TDA-09_A14", "test": "the developer of the system, system component or system service is required at all post-design stages of the system development life cycle to correct flaws identified during testing and evaluation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11e.", "defaultText": null }, { "id": 74332, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591272", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591272", "securityControlId": 32059, "ccis": [], "uuid": "3c5c347c-fb51-5c33-86e7-f37f70ee5349", "testId": "TDA-09_A15", "test": "the developer of the system, system component, or system service is required to verify that the scope of testing and evaluation provides complete coverage of the required controls per an organization-defined breadth.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(07)[01]", "defaultText": null }, { "id": 74333, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591272", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591272", "securityControlId": 32059, "ccis": [], "uuid": "831cfc91-2ea5-541f-ac7f-9cddd7fac9c6", "testId": "TDA-09_A16", "test": "the developer of the system, system component, or system service is required to verify that the scope of testing and evaluation provides complete coverage of the required controls per an organization-defined depth.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(07)[02]", "defaultText": null } ], "externalMappings": [ { "id": 606186, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79b85d5b-5ba8-55b6-91cc-75240e93ea12", "parentControlId": 32059, "controlId": "SM-9", "title": "SM-9", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590437" }, { "id": 606187, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9d114c3-fe22-5731-ac54-540e585ff192", "parentControlId": 32059, "controlId": "SM-10", "title": "SM-10", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590437" }, { "id": 606188, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bb4c9c3-1dd6-5d59-9d71-651f30a686e8", "parentControlId": 32059, "controlId": "SM-10(a)", "title": "SM-10(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590437" }, { "id": 606189, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b65084d-8dc9-5268-af46-6c978d9668f2", "parentControlId": 32059, "controlId": "SM-10(b)", "title": "SM-10(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590437" }, { "id": 606190, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590437", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0489b874-7875-52ff-8e3c-adbaade1c6a7", "parentControlId": 32059, "controlId": "SD-3", "title": "SD-3", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590437" }, { "id": 606191, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a2fef17-2248-5460-a039-c8ae3152cc0e", "parentControlId": 32059, "controlId": "SD-3(a)", "title": "SD-3(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590441" }, { "id": 606192, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "843d651b-01cb-5b45-8be2-4351084661ee", "parentControlId": 32059, "controlId": "SD-3(b)", "title": "SD-3(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590441" }, { "id": 606193, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45d2a577-484c-5037-aba8-4465e51057d8", "parentControlId": 32059, "controlId": "SD-3(c)", "title": "SD-3(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590441" }, { "id": 606194, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5645c4a8-f329-5fb3-be5f-913dab7e0fe3", "parentControlId": 32059, "controlId": "SI-1", "title": "SI-1", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590441" }, { "id": 606195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e392f938-ba8f-5739-8929-a29cb6b4a79e", "parentControlId": 32059, "controlId": "SI-1(a)", "title": "SI-1(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590441" }, { "id": 606196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590441", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6ccecad-e416-5d42-8e7c-06cbcef3f4f9", "parentControlId": 32059, "controlId": "SI-1(b)", "title": "SI-1(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590441" }, { "id": 606197, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e02f139a-4ed7-5b9b-994a-46f9b3e751a0", "parentControlId": 32059, "controlId": "SI-1(d)", "title": "SI-1(d)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590442" }, { "id": 606198, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f7244e5-0c02-5bea-842b-21c0f0410674", "parentControlId": 32059, "controlId": "SI-1(e)", "title": "SI-1(e)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590442" }, { "id": 606199, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "443ab722-7626-5ef0-aa99-2577c9d79910", "parentControlId": 32059, "controlId": "SVV-1", "title": "SVV-1", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590442" }, { "id": 606200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7d0043f-38d8-53cc-b126-5b3262ecf019", "parentControlId": 32059, "controlId": "SVV-1(a)", "title": "SVV-1(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590442" }, { "id": 606201, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "550e10b4-c764-5d41-8616-18f4248a6cc5", "parentControlId": 32059, "controlId": "SVV-1(b)", "title": "SVV-1(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590442" }, { "id": 606202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a51d7c92-36b6-5389-8d69-7874b5657701", "parentControlId": 32059, "controlId": "SVV-1(c)", "title": "SVV-1(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590442" }, { "id": 606203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8b610b9-8dd3-5f52-914e-51576fd670e6", "parentControlId": 32059, "controlId": "SVV-2", "title": "SVV-2", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590442" }, { "id": 606204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ace7cc45-38b6-5fcf-97bd-645a4ea8317e", "parentControlId": 32059, "controlId": "SVV-2(a)", "title": "SVV-2(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590442" }, { "id": 606205, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590442", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd38fa9a-4afa-5e51-aaaf-b57a4df002fb", "parentControlId": 32059, "controlId": "SVV-2(b)", "title": "SVV-2(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590442" }, { "id": 606206, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b8a5a73-274f-574a-90aa-0f6ed1f5571f", "parentControlId": 32059, "controlId": "SVV-3", "title": "SVV-3", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590443" }, { "id": 606207, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8db412b2-7b8c-535e-987f-f22a91861af5", "parentControlId": 32059, "controlId": "SVV-3(a)", "title": "SVV-3(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590443" }, { "id": 606208, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e7e9813-b6c7-5c5e-9ccc-41cbb59f1935", "parentControlId": 32059, "controlId": "SVV-3(b)", "title": "SVV-3(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590443" }, { "id": 606209, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac2a548b-37e7-54e4-b075-00315381054b", "parentControlId": 32059, "controlId": "SVV-3(c)", "title": "SVV-3(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590443" }, { "id": 606210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09de690f-eccf-5728-9fc7-b5f4a2e482d8", "parentControlId": 32059, "controlId": "SVV-3(d)", "title": "SVV-3(d)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590443" }, { "id": 606211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14f5c14d-0329-5f31-b49d-b74ef3cc8f98", "parentControlId": 32059, "controlId": "SVV-3(d)(1)", "title": "SVV-3(d)(1)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590443" }, { "id": 606212, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8e46798-b3ab-5dd6-b052-72cc129b450a", "parentControlId": 32059, "controlId": "SVV-3(d)(2)", "title": "SVV-3(d)(2)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590443" }, { "id": 606213, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "485ec834-5a42-575f-b831-aaffda3eb3be", "parentControlId": 32059, "controlId": "SVV-3(d)(3)", "title": "SVV-3(d)(3)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590443" }, { "id": 606214, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a73f00c8-2db6-5608-a777-c78708aaf436", "parentControlId": 32059, "controlId": "SVV-3(d)(4)", "title": "SVV-3(d)(4)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590443" }, { "id": 606215, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590443", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01ee5bb3-33e7-5f46-85b2-245eb5b78990", "parentControlId": 32059, "controlId": "SVV-3(e)", "title": "SVV-3(e)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590443" }, { "id": 606216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590444", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c6623f3-2b0e-5f43-bc83-1dd2216282df", "parentControlId": 32059, "controlId": "SVV-5", "title": "SVV-5", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590444" }, { "id": 606217, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590444", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "300445df-c323-5f25-a33f-a8ad280eb23d", "parentControlId": 32059, "controlId": "DM-1", "title": "DM-1", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590444" }, { "id": 606218, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590444", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4849cbba-cd94-59f3-9b81-0e5bf2f61098", "parentControlId": 32059, "controlId": "DM-1(a)", "title": "DM-1(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590444" }, { "id": 606219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590444", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf26f0c2-ee30-5c77-8d5f-99db2c9846fe", "parentControlId": 32059, "controlId": "DM-1(b)", "title": "DM-1(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590444" }, { "id": 606220, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590444", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8183b5e2-354b-585a-a299-7c5ae9c59f54", "parentControlId": 32059, "controlId": "DM-1(c)", "title": "DM-1(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590444" }, { "id": 606221, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590444", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e1476c0c-a638-5913-bea9-555c8a3a332b", "parentControlId": 32059, "controlId": "DM-1(d)", "title": "DM-1(d)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590444" }, { "id": 606222, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590444", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57998335-f516-5db2-b2f6-23c3633fcc96", "parentControlId": 32059, "controlId": "DM-3", "title": "DM-3", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590444" }, { "id": 606223, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "711e3503-e733-51df-bd4e-81decac37e03", "parentControlId": 32059, "controlId": "DM-3(a)", "title": "DM-3(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590445" }, { "id": 606224, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "167e91da-6328-5234-a26b-4c95e6932fa5", "parentControlId": 32059, "controlId": "DM-3(a)(1)", "title": "DM-3(a)(1)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590445" }, { "id": 606225, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c1f38b6-46d9-58d7-b35d-01f30e0bf35c", "parentControlId": 32059, "controlId": "DM-3(a)(2)", "title": "DM-3(a)(2)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590445" }, { "id": 606226, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ad21e20-4eaa-53fb-8288-98aef8542d87", "parentControlId": 32059, "controlId": "DM-3(a)(3)", "title": "DM-3(a)(3)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590445" }, { "id": 606227, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02695e5f-7852-5cc5-87ce-95097c13a116", "parentControlId": 32059, "controlId": "DM-3(b)", "title": "DM-3(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590445" }, { "id": 606228, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb7067a5-f207-59e8-bf60-34ff564202cd", "parentControlId": 32059, "controlId": "DM-3(c)", "title": "DM-3(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590445" }, { "id": 606229, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "292c8410-5f3f-588d-9627-4b455bafde70", "parentControlId": 32059, "controlId": "DM-3(d)", "title": "DM-3(d)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590445" }, { "id": 606230, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "67da9dcb-a3a4-5141-8e3a-7de311e62ab0", "parentControlId": 32059, "controlId": "DM-3(e)", "title": "DM-3(e)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590445" }, { "id": 606231, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590445", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb12393e-afa5-5ad1-a328-63964eceef82", "parentControlId": 32059, "controlId": "8.25", "title": "8.25", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590445" }, { "id": 606232, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84122f8d-69a7-53da-95cb-5a8fba60f688", "parentControlId": 32059, "controlId": "8.29", "title": "8.29", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590446" }, { "id": 606233, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590446", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27a54e7c-897f-5427-9df1-6a90548ffd54", "parentControlId": 32059, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590446" }, { "id": 606240, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590447", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9236aa8f-bf59-5c30-9d86-eda67b4c7137", "parentControlId": 32059, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590447" }, { "id": 606241, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f2ac26d-d598-5b38-82be-771c8e3c7b28", "parentControlId": 32059, "controlId": "T1078.001", "title": "T1078.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590448" }, { "id": 606242, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f0f75d0-eff9-51a9-aaa8-71350f17af7e", "parentControlId": 32059, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590448" }, { "id": 606243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06df68c1-796b-5b61-815c-8b0d9b68a508", "parentControlId": 32059, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590448" }, { "id": 606244, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad93f83e-8e0c-5143-af2f-ef78e7baaa5b", "parentControlId": 32059, "controlId": "T1134.005", "title": "T1134.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590448" }, { "id": 606245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22d8d1c6-3eb0-5c21-bb42-fd734959794b", "parentControlId": 32059, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590448" }, { "id": 606246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f311d39-9422-5ef0-b2c7-72d7d30913b2", "parentControlId": 32059, "controlId": "T1195.003", "title": "T1195.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590448" }, { "id": 606247, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73b50204-4c83-59ce-b0ef-22fff4f3ae76", "parentControlId": 32059, "controlId": "T1213.003", "title": "T1213.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590448" }, { "id": 606248, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "835087a9-7dec-53cb-aaae-c1f70e9106a1", "parentControlId": 32059, "controlId": "T1495", "title": "T1495", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590448" }, { "id": 606249, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590448", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd4382f3-cb09-54a8-9e69-462c6e4b3977", "parentControlId": 32059, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590449" }, { "id": 606250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92979f25-6bd9-5680-bcee-cbb33787c2fe", "parentControlId": 32059, "controlId": "T1505.001", "title": "T1505.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590449" }, { "id": 606251, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af2a3a93-f9ed-5df7-8d53-86147b926565", "parentControlId": 32059, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590449" }, { "id": 606252, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf93a448-99b3-52a9-814a-323906713637", "parentControlId": 32059, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590449" }, { "id": 606253, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08ce014d-f468-51a7-99a1-bdc2d9fffbdb", "parentControlId": 32059, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590449" }, { "id": 606254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3346983-541b-5b1d-9f33-a0ac736288fb", "parentControlId": 32059, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590449" }, { "id": 606255, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9d826eb-8aff-56c1-a940-ebdad879eb22", "parentControlId": 32059, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590449" }, { "id": 606256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "983cf627-3d25-5e80-8bf9-08d847961158", "parentControlId": 32059, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590449" }, { "id": 606257, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14a0cea7-ac1d-5f1c-a1f1-2f23f8466d42", "parentControlId": 32059, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590449" }, { "id": 606258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590449", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d0b2eb4-c3f9-533e-a207-71fa8205f550", "parentControlId": 32059, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590449" }, { "id": 606259, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75ccfee7-e0c3-5d3c-b0ce-5deeea504a15", "parentControlId": 32059, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59045" }, { "id": 606260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "526b42c7-0b0f-5140-886b-6617c28a34c6", "parentControlId": 32059, "controlId": "T1552.001", "title": "T1552.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59045" }, { "id": 606261, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1b5bab1-b340-58f5-bdad-7b4ef9b90daf", "parentControlId": 32059, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59045" }, { "id": 606262, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2db3b0df-466d-5973-955e-3598de0f5a9d", "parentControlId": 32059, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59045" }, { "id": 606263, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16de9fd8-ca2a-5b6d-a974-7e2fb1928fa1", "parentControlId": 32059, "controlId": "T1552.006", "title": "T1552.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59045" }, { "id": 606264, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81aa8f96-b75f-57ca-b9aa-4399238864e3", "parentControlId": 32059, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59045" }, { "id": 606265, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "665cfefe-ba0d-5b85-8e2a-abe422bafe2f", "parentControlId": 32059, "controlId": "T1553.006", "title": "T1553.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59045" }, { "id": 606266, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59045", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc8883b3-7d6c-5e5c-8901-a2c5320b6aa2", "parentControlId": 32059, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59045" }, { "id": 606267, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "753974b5-4b52-5bed-8449-e316a1b479dc", "parentControlId": 32059, "controlId": "T1559.003", "title": "T1559.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590451" }, { "id": 606268, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6275f8d7-2025-5341-934b-8cdd3cb540f3", "parentControlId": 32059, "controlId": "T1574.002", "title": "T1574.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590451" }, { "id": 606269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "589f1db3-51cc-5ecb-9967-bdd601e46b1d", "parentControlId": 32059, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590451" }, { "id": 606270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26878a71-ed4c-53d6-9903-81277d438fd0", "parentControlId": 32059, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590451" }, { "id": 606271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61a0c2c2-8533-5b08-95e3-2946d70d9698", "parentControlId": 32059, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590451" }, { "id": 606272, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24eb25b1-b6bf-591a-b300-5885d535e6bd", "parentControlId": 32059, "controlId": "T1612", "title": "T1612", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590451" }, { "id": 606273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590451", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0dc50eb-cf8e-5372-9458-78144af08d35", "parentControlId": 32059, "controlId": "T1647", "title": "T1647", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590451" }, { "id": 606277, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "774c3d60-229f-5620-9508-dd437f28b8e2", "parentControlId": 32059, "controlId": "SA-11", "title": "SA-11", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590452" }, { "id": 606278, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35ebbd4c-ba48-5c97-83f2-f9812a6f583a", "parentControlId": 32059, "controlId": "SA-11", "title": "SA-11", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590452" }, { "id": 606279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590452", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af2eb9cf-f073-5280-8d4d-85b6767830ad", "parentControlId": 32059, "controlId": "SA-11(05)", "title": "SA-11(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590452" }, { "id": 606280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590458", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5024900-0e23-51fc-aa86-ac0dc79fc457", "parentControlId": 32059, "controlId": "SA-11(06)", "title": "SA-11(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590458" }, { "id": 606281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590458", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9ea2824-2a6d-534a-9f8e-1b18b7741746", "parentControlId": 32059, "controlId": "SA-11(07)", "title": "SA-11(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590458" }, { "id": 606286, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f25d94ee-d8bd-508f-94a6-a6ae398dd48b", "parentControlId": 32059, "controlId": "SA-11", "title": "SA-11", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590459" }, { "id": 606287, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa0e625e-70dd-502e-9fd8-2bafcb5898e0", "parentControlId": 32059, "controlId": "SA-11", "title": "SA-11", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590459" }, { "id": 606288, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eafff7f0-a0ee-571d-b72e-b4633cb8593a", "parentControlId": 32059, "controlId": "SA-11(05)", "title": "SA-11(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590459" }, { "id": 606289, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c899dd2f-f6fb-5331-a021-ee6c0c365e63", "parentControlId": 32059, "controlId": "SA-11(06)", "title": "SA-11(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590459" }, { "id": 606290, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9eb50e04-8af9-5133-b788-75f516c77651", "parentControlId": 32059, "controlId": "SA-11(07)", "title": "SA-11(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590459" }, { "id": 606291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590459", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca831b0f-0a77-5208-9352-50eb57932ef4", "parentControlId": 32059, "controlId": "SA-11", "title": "SA-11", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590459" }, { "id": 606292, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85a8d9e3-7cb3-538f-8e99-e384c5416dd1", "parentControlId": 32059, "controlId": "SA-11", "title": "SA-11", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59046" }, { "id": 606295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53a5f017-41ed-5d52-a3f6-b8180f939ae4", "parentControlId": 32059, "controlId": "SA-11", "title": "SA-11", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59046" }, { "id": 606299, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d26daf7-e21d-5bce-ac31-cf0e9d4003f4", "parentControlId": 32059, "controlId": "NFO - SA-11", "title": "NFO - SA-11", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59046" }, { "id": 606300, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f45cf4d-8933-5596-a775-33d3f65ae70e", "parentControlId": 32059, "controlId": "03.12.01", "title": "03.12.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59046" }, { "id": 606301, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59046", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30b35400-08fa-50c5-a29e-6efd4d304307", "parentControlId": 32059, "controlId": "03.12.03", "title": "03.12.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590461" }, { "id": 606302, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590461", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2115264-2f1a-5008-a63b-42adffa63d34", "parentControlId": 32059, "controlId": "03.14.01.a", "title": "03.14.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590461" }, { "id": 606318, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c7a782a-e6bf-57d0-8a89-18f408859602", "parentControlId": 32059, "controlId": "ID.RA-01", "title": "ID.RA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590463" }, { "id": 606319, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ba2ae46-7248-5fc1-bb3e-d99cd32e99d5", "parentControlId": 32059, "controlId": "ID.IM-01", "title": "ID.IM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590463" }, { "id": 606320, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f67bb1c-378f-5701-88cd-bdc440cdcc6d", "parentControlId": 32059, "controlId": "ID.IM-02", "title": "ID.IM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590463" }, { "id": 606321, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590463", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2e955a0-fe5b-5a39-b46f-b8abe5b71269", "parentControlId": 32059, "controlId": "PR.PS-06", "title": "PR.PS-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590463" }, { "id": 606380, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590471", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cedbd8d5-4cb9-54bc-b5da-0f49a3d28df1", "parentControlId": 32059, "controlId": "ARCHITECTURE-4h", "title": "ARCHITECTURE-4h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590471" }, { "controlId": "A.4.2.5", "title": "A.4.2.5 — Review and Validation Testing of a Modification or Addition of a Critical Digital Asset", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, CM-3, SA-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "fa2915dc-43b4-5cdc-ab9e-8d02a68bc733", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.5", "title": "NEI 08-09 Sec 4.2.5 — Review and Validation Testing of a Modification or Addition of a Critical Digital Asset", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "8d399801-f58a-58a8-8d83-5aa22306cf61", "isPublic": true }, { "controlId": "10 CFR 73.54(e)", "title": "10 CFR 73.54(e) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "324d9309-19f1-5a05-ab72-18df165caf2d", "isPublic": true }, { "controlId": "C.3.9", "title": "C.3.9 — Error Handling", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "c0561fa2-7900-5c2f-98e0-2f0962283e26", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.9", "title": "NEI 08-09 App E.3.9 — Error Handling", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.9", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "cb612223-a206-5133-8db6-74dfd239755e", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.3.9", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "5e72e89f-9e59-53a4-895c-a0db246a35dd", "isPublic": true }, { "controlId": "C.12.5", "title": "C.12.5 — Developer Security Testing", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SA-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "797dee0e-8185-579b-bbd4-72b253386551", "isPublic": true }, { "controlId": "NEI 08-09 App E.12.5", "title": "NEI 08-09 App E.12.5 — Developer Security Testing", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.12.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "5f64ca5f-54fd-5387-9f67-bb44c9489e2c", "isPublic": true }, { "controlId": "C.12.6", "title": "C.12.6 — Licensee/Applicant testing", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-2, SA-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "75685f47-84a8-53df-b6d4-9422b15239c0", "isPublic": true }, { "controlId": "NEI 08-09 App E.12.6", "title": "NEI 08-09 App E.12.6 — Licensee/Applicant testing", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.12.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6870470d-5c21-51d0-adf2-dfcdd245a27a", "isPublic": true }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "c6ddae87-1ea9-5d93-88fa-6f2f30c89021", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "60b20c52-ef59-5b16-b062-c7018f09c85d", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "4804c18b-1979-5f47-968e-e223e6198e97", "isPublic": true } ], "id": 32059, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731346", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731346", "catalogueId": 1062, "uuid": "7db8b2ee-50d7-5396-b226-f95557bb2bb7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Security, Compliance & Resilience Testing Throughout Development", "description": "

Control Description

Mechanisms exist to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.

Evidence Request List (ERL)

E-TDA-03\nE-TDA-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Technology Development & Acquisition (TDA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TDA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Technology development & acquisition-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Secure development practices loosely conform to industry-recognized standards for secure engineering (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require system developers/integrators consult with security, compliance and/or resilience personnel to: \n(1) Create and implement a Security Testing and Evaluation (ST&E) plan, or similar capability;\n(2) Implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the control testing and evaluation process; and\n(3) Document the results.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.2.5, C.3.9, C.12.5, C.12.6", "controlId": "TDA-09", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-09", "references": "

Micro-Small Business (<10 staff)

∙ Security Testing and Evaluation (ST&E)

Small Business (10-49 staff)

∙ Security Testing and Evaluation (ST&E)

Medium Business (50-249 staff)

∙ Security Testing and Evaluation (ST&E)

Large Business (250-999 staff)

∙ Security Testing and Evaluation (ST&E)

Enterprise (>1,000 staff)

∙ Security Testing and Evaluation (ST&E)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74334, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591273", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591273", "securityControlId": 32060, "ccis": [], "uuid": "b774d28e-07cc-5b9a-8698-f8a520ae7ca4", "testId": "TDA-09.1_A01", "test": "the developer of the system, system component or system service is required to produce a plan for the continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(08)", "defaultText": null } ], "externalMappings": [ { "id": 606477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590493", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89ba4654-78b7-5dc6-a97b-35dca069bef2", "parentControlId": 32060, "controlId": "SA-4(8)", "title": "SA-4(8)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590493" }, { "id": 606478, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590493", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8844079-2fb5-54d2-9307-a418d2e65c95", "parentControlId": 32060, "controlId": "SA-04(08)", "title": "SA-04(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590493" }, { "id": 606479, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590493", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "083838e4-fb76-5fe7-abb6-726983326283", "parentControlId": 32060, "controlId": "SA-04(08)", "title": "SA-04(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590493" }, { "id": 606480, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590494", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1df75ccb-edb6-55bd-8c89-af5ad30f24d3", "parentControlId": 32060, "controlId": "SA-4(8)", "title": "SA-4(8)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590494" }, { "id": 606483, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590494", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4406deae-9065-5d45-8081-c53c4c3c14c1", "parentControlId": 32060, "controlId": "03.12.03", "title": "03.12.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590494" }, { "id": 606485, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590494", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d51e719-6292-534d-8297-6adaf9f6572e", "parentControlId": 32060, "controlId": "ID.IM-01", "title": "ID.IM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590494" }, { "id": 606486, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590494", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed2fd497-7de8-5f27-8914-f0d98ddd26d1", "parentControlId": 32060, "controlId": "ID.IM-02", "title": "ID.IM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590494" } ], "id": 32060, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731346", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731346", "catalogueId": 1062, "uuid": "da91862b-3066-50cf-93f2-586f037a330a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require the developers of Technology Assets, Applications and/or Services (TAAS) to produce a plan for the continuous monitoring of security, compliance and/or resilience control effectiveness?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Continuous Monitoring Plan", "description": "

Control Description

Mechanisms exist to require the developers of Technology Assets, Applications and/or Services (TAAS) to produce a plan for the continuous monitoring of security, compliance and/or resilience control effectiveness.

Evidence Request List (ERL)

E-TDA-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require the developers of Technology Assets, Applications and/or Services (TAAS) to produce a plan for the continuous monitoring of security, compliance and/or resilience control effectiveness.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-09.1", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-09.1", "references": "

Medium Business (50-249 staff)

∙ Formal SDLC process with security gates

Large Business (250-999 staff)

∙ Enterprise SDLC with integrated security checkpoints

Enterprise (>1,000 staff)

∙ Enterprise DevSecOps SDLC (e.g., NIST SSDF, OWASP SAMM)\n∙ Automated security gates in CI/CD", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74335, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591273", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591273", "securityControlId": 32061, "ccis": [], "uuid": "c9759830-98b2-52d7-b88d-05f2a7c00016", "testId": "TDA-09.2_A01", "test": "the developer of the system, system component or system service is required to employ static code analysis tools to identify common flaws.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(01)[01]", "defaultText": null }, { "id": 74336, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591273", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591273", "securityControlId": 32061, "ccis": [], "uuid": "e3426012-5044-5dfe-9b7d-198b4dd6b3dd", "testId": "TDA-09.2_A02", "test": "the developer of the system, system component or system service is required to employ static code analysis tools to document the results of the analysis.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(01)[02]", "defaultText": null } ], "externalMappings": [ { "id": 606509, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590498", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26d1fd5f-5ce7-5d73-a8ad-3bf7487e7e00", "parentControlId": 32061, "controlId": "SI-1(c)", "title": "SI-1(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590498" }, { "id": 606511, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590498", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68cb94fd-b86c-522b-b2f1-042e63377e4e", "parentControlId": 32061, "controlId": "SA-11(1)", "title": "SA-11(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590498" }, { "id": 606512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590498", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64de928e-3239-511d-ba41-40bc0a2a4999", "parentControlId": 32061, "controlId": "SA-11(01)", "title": "SA-11(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590498" }, { "id": 606513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590499", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d71fe067-b8a6-5526-b0de-481ccd3d9236", "parentControlId": 32061, "controlId": "SA-11(01)", "title": "SA-11(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590499" }, { "id": 606542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590502", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c942a61-fb5b-540c-9e2e-e4703ee8a83e", "parentControlId": 32061, "controlId": "ARCHITECTURE-4h", "title": "ARCHITECTURE-4h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590502" } ], "id": 32061, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731346", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731346", "catalogueId": 1062, "uuid": "0965a15b-5397-5423-99a9-857804541a79", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require the developers of Technology Assets, Applications and/or Services (TAAS) to employ static code analysis tools to identify and remediate common flaws and document the results of the analysis?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Static Code Analysis", "description": "

Control Description

Mechanisms exist to require the developers of Technology Assets, Applications and/or Services (TAAS) to employ static code analysis tools to identify and remediate common flaws and document the results of the analysis.

Evidence Request List (ERL)

E-TDA-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.\n▪ Developers of TAAS are required to employ static code analysis tools to identify and remediate common flaws, documenting the results of the analysis before the application is cleared for production usage.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require the developers of Technology Assets, Applications and/or Services (TAAS) to employ static code analysis tools to identify and remediate common flaws and document the results of the analysis.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-09.2", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-09.2", "references": "

Large Business (250-999 staff)

∙ Agile security integration in sprint planning and reviews

Enterprise (>1,000 staff)

∙ Enterprise agile security program (DevSecOps)\n∙ Security backlog integration\n∙ Security in definition of done", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74337, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591274", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591274", "securityControlId": 32062, "ccis": [], "uuid": "fbbfa31a-6e88-50db-ab3a-c0c85c71dcbb", "testId": "TDA-09.3_A01", "test": "the developer of the system, system component or system service is required to employ dynamic code analysis tools to identify common flaws.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(08)[01]", "defaultText": null }, { "id": 74338, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591274", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591274", "securityControlId": 32062, "ccis": [], "uuid": "cc7c708d-572c-5f2c-b5a2-0fe114e4387b", "testId": "TDA-09.3_A02", "test": "the developer of the system, system component or system service is required to document the results of the analysis.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(08)[02]", "defaultText": null } ], "externalMappings": [ { "id": 606568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590505", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54525a3e-0985-5353-9cb9-e0b169a9f1c5", "parentControlId": 32062, "controlId": "SA-11(8)", "title": "SA-11(8)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590505" }, { "id": 606569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590506", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "914ac647-7ea7-50ff-b38b-24f8344da928", "parentControlId": 32062, "controlId": "SA-11(08)", "title": "SA-11(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590506" }, { "id": 606570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590506", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9488168b-0d77-579e-9c66-d1662b5a8c36", "parentControlId": 32062, "controlId": "SA-11(08)", "title": "SA-11(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590506" }, { "id": 606592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590508", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8d54870-adc5-550c-8484-376b5e1ee455", "parentControlId": 32062, "controlId": "ARCHITECTURE-4h", "title": "ARCHITECTURE-4h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590508" } ], "id": 32062, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731346", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731346", "catalogueId": 1062, "uuid": "ce5e728b-dd15-5b67-8375-bf6382275200", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require the developers of Technology Assets, Applications and/or Services (TAAS) to employ dynamic code analysis tools to identify and remediate common flaws and document the results of the analysis?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Dynamic Code Analysis", "description": "

Control Description

Mechanisms exist to require the developers of Technology Assets, Applications and/or Services (TAAS) to employ dynamic code analysis tools to identify and remediate common flaws and document the results of the analysis.

Evidence Request List (ERL)

E-TDA-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.\n▪ Developers of TAAS are to employ dynamic code analysis tools to identify and remediate common flaws, documenting the results of the analysis before the application is cleared for production usage.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require the developers of Technology Assets, Applications and/or Services (TAAS) to employ dynamic code analysis tools to identify and remediate common flaws and document the results of the analysis.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-09.3", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-09.3", "references": "

Enterprise (>1,000 staff)

∙ Enterprise DevSecOps pipeline with full automation (CI/CD security gates, SAST, DAST, SCA)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74340, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591275", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591275", "securityControlId": 32064, "ccis": [], "uuid": "92bd95ee-882e-5902-8de0-e3a56c179c51", "testId": "TDA-09.5_A01", "test": "the developer of the system, system component, or system service is required to perform penetration testing per an organization-defined breadth.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(05)(a)[01]", "defaultText": null }, { "id": 74341, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591275", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591275", "securityControlId": 32064, "ccis": [], "uuid": "92d01f10-ddb7-5ad1-86c9-6a9c7e234ee1", "testId": "TDA-09.5_A02", "test": "the developer of the system, system component, or system service is required to perform penetration testing per an organization-defined depth.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(05)(a)[02]", "defaultText": null }, { "id": 74342, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591275", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591275", "securityControlId": 32064, "ccis": [], "uuid": "f1bc50b1-791c-5316-9e73-ebf9372150bf", "testId": "TDA-09.5_A03", "test": "the developer of the system, system component, or system service is required to perform penetration testing under organization-defined constraints.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(05)(b)", "defaultText": null }, { "id": 74343, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591275", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591275", "securityControlId": 32064, "ccis": [], "uuid": "92072792-bd53-5173-8019-842e1d6b389b", "testId": "TDA-09.5_A04", "test": "the developer of the system, system component or system service is required to perform attack surface reviews.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(06)", "defaultText": null } ], "externalMappings": [ { "id": 606657, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590515", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54c1bc40-5613-5d1e-aef6-09c0e069bc2f", "parentControlId": 32064, "controlId": "SVV-4", "title": "SVV-4", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590515" }, { "id": 606658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06d635fb-ac2c-5026-b727-42dc5e1a76df", "parentControlId": 32064, "controlId": "SA-11(05)", "title": "SA-11(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590516" }, { "id": 606660, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590516", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3bb6295-d4a9-5ab6-9e99-33fb105973b8", "parentControlId": 32064, "controlId": "SA-11(05)", "title": "SA-11(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590516" }, { "id": 606694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "117dd83c-2e6c-5a71-b148-b52d04a2cd12", "parentControlId": 32064, "controlId": "ARCHITECTURE-4h", "title": "ARCHITECTURE-4h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59052" } ], "id": 32064, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731347", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731347", "catalogueId": 1062, "uuid": "00695c81-99ff-538e-8866-c318d2e34204", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization perform application-level penetration testing of custom-made Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Application Penetration Testing", "description": "

Control Description

Mechanisms exist to perform application-level penetration testing of custom-made Technology Assets, Applications and/or Services (TAAS).

Evidence Request List (ERL)

E-TDA-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to perform application-level penetration testing of custom-made Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-09.5", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-09.5", "references": "

Enterprise (>1,000 staff)

∙ Enterprise site reliability engineering (SRE) with security integration", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74344, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591276", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591276", "securityControlId": 32065, "ccis": [], "uuid": "4d768649-1abc-5f7c-99a7-41890a5eeda3", "testId": "TDA-09.6_A01", "test": "default secure configuration settings reduce the likelihood of software being deployed with weak security settings that would put the asset at a greater risk of compromise.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 606724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590523", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5acb9949-5b47-528e-9ad8-7324d8970d42", "parentControlId": 32065, "controlId": "ARCHITECTURE-4c", "title": "ARCHITECTURE-4c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590523" } ], "id": 32065, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731348", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731348", "catalogueId": 1062, "uuid": "462acfe5-e63e-5483-a57c-cc7e1f9a6425", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement secure configuration settings by default to reduce the likelihood of Technology Assets, Applications and/or Services (TAAS) being deployed with weak security settings that would put the TAAS at a greater risk of compromise?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Secure Settings By Default", "description": "

Control Description

Mechanisms exist to implement secure configuration settings by default to reduce the likelihood of Technology Assets, Applications and/or Services (TAAS) being deployed with weak security settings that would put the TAAS at a greater risk of compromise.

Evidence Request List (ERL)

E-TDA-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement secure configuration settings by default to reduce the likelihood of Technology Assets, Applications and/or Services (TAAS) being deployed with weak security settings that would put the TAAS at a greater risk of compromise.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-09.6", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-09.6", "references": "

Enterprise (>1,000 staff)

∙ Enterprise security orchestration in CI/CD pipelines\n∙ Policy-as-code enforcement", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74345, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591276", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591276", "securityControlId": 32066, "ccis": [], "uuid": "47077c56-f7f8-5e9d-863e-6d6fbdabaa9e", "testId": "TDA-09.7_A01", "test": "specific code requiring manual code review is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(04)_ODP[01]", "defaultText": null }, { "id": 74346, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591276", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591276", "securityControlId": 32066, "ccis": [], "uuid": "c6ae33a6-e04e-59d1-a74a-831a4fe7122f", "testId": "TDA-09.7_A02", "test": "processes, procedures, and/or techniques used for manual code reviews are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(04)_ODP[02]", "defaultText": null }, { "id": 74347, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591276", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591276", "securityControlId": 32066, "ccis": [], "uuid": "65f1ac1e-f7dd-51cd-b58b-0b0243837f53", "testId": "TDA-09.7_A03", "test": "the developer of the system, system component, or system service is required to perform a manual code review of organization-defined specific code using organization-defined processes, procedures, and/or techniques.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(04)", "defaultText": null } ], "externalMappings": [ { "id": 606730, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590524", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd4f0369-0f14-5ef4-a9d7-28ca794272a2", "parentControlId": 32066, "controlId": "SA-11(4)", "title": "SA-11(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590524" }, { "id": 606731, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590524", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "075fe067-cdba-51fd-b29b-80307641b3f3", "parentControlId": 32066, "controlId": "SA-11(04)", "title": "SA-11(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590524" }, { "id": 606732, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590524", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2377cab4-081e-5346-b031-f1d45b9370f0", "parentControlId": 32066, "controlId": "SA-11(04)", "title": "SA-11(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590524" } ], "id": 32066, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731348", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731348", "catalogueId": 1062, "uuid": "4ed9270b-0cbe-5db7-bb84-07a0f3842892", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require the developers of Technology Assets, Applications and/or Services (TAAS) to employ a manual code review process to identify and remediate unique flaws that require knowledge of the application’s requirements and design?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Manual Code Review", "description": "

Control Description

Mechanisms exist to require the developers of Technology Assets, Applications and/or Services (TAAS) to employ a manual code review process to identify and remediate unique flaws that require knowledge of the application’s requirements and design.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require the developers of Technology Assets, Applications and/or Services (TAAS) to employ a manual code review process to identify and remediate unique flaws that require knowledge of the application’s requirements and design.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-09.7", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-09.7", "references": "

Enterprise (>1,000 staff)

∙ Enterprise policy-as-code program\n∙ Automated compliance in CI/CD (e.g., OPA, Checkov)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74348, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591277", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591277", "securityControlId": 32067, "ccis": [], "uuid": "fee12913-e219-5d38-85d6-35b30178dfa4", "testId": "TDA-10_A01", "test": "the use of live data in pre-production environments is approved for the system, system component or system service.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "53A_R5_SA-03(02)a.[01]", "defaultText": null }, { "id": 74349, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591277", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591277", "securityControlId": 32067, "ccis": [], "uuid": "89419d34-4a76-5e8b-bed8-9994908a8a19", "testId": "TDA-10_A02", "test": "the use of live data in pre-production environments is documented for the system, system component or system service.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "53A_R5_SA-03(02)a.[02]", "defaultText": null }, { "id": 74350, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591277", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591277", "securityControlId": 32067, "ccis": [], "uuid": "6fa8a569-4c3f-5e90-920e-6f020d54c271", "testId": "TDA-10_A03", "test": "the use of live data in pre-production environments is controlled for the system, system component or system service.
PPTDF Applicability: Data
Assessment Rigor: 1", "otherId": "53A_R5_SA-03(02)a.[03]", "defaultText": null }, { "id": 74351, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591277", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591277", "securityControlId": 32067, "ccis": [], "uuid": "acbbc71d-fb99-5f79-9ce6-39f6efe9490c", "testId": "TDA-10_A04", "test": "pre-production environments for the system, system component or system service are protected at the same impact or classification level as any live data in use within the pre-production environments.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SA-03(02)b.", "defaultText": null } ], "externalMappings": [ { "id": 606735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590524", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b12883a-ca90-59bf-bb61-81102ec1ec8d", "parentControlId": 32067, "controlId": "8.33", "title": "8.33", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590524" }, { "id": 606738, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590525", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41d7355a-8c5d-5dc6-8aa1-62737bfecda4", "parentControlId": 32067, "controlId": "SA-15(9)", "title": "SA-15(9)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590525" }, { "id": 606739, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590525", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a5e9ad5-d78e-5908-b797-35bb0a098500", "parentControlId": 32067, "controlId": "SA-03(02)", "title": "SA-03(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590525" }, { "id": 606740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590525", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1dcadfe9-08ec-5ee2-af8c-83cbb6111346", "parentControlId": 32067, "controlId": "SA-03(02)", "title": "SA-03(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590525" }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "8ef68d0b-b5b3-514f-a961-1bef9ac8e062", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "2319a75f-1ba0-5e04-ba70-3d65d513c3be", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "e2b33f2b-1af0-5e81-9714-e691ff07448c", "isPublic": true } ], "id": 32067, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731348", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731348", "catalogueId": 1062, "uuid": "39ebbc02-32c5-5886-aa73-01946d0ee1ae", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization approve, document and control the use of live data in development and test environments?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Use of Live Data", "description": "

Control Description

Mechanisms exist to approve, document and control the use of live data in development and test environments.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Technology Development & Acquisition (TDA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TDA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Technology development & acquisition-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Secure development practices loosely conform to industry-recognized standards for secure engineering (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to approve, document and control the use of live data in development and test environments.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-10", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-10", "references": "

Medium Business (50-249 staff)

∙ Formal software testing policy with security test cases

Large Business (250-999 staff)

∙ Enterprise software testing program with security integration

Enterprise (>1,000 staff)

∙ Enterprise software testing platform with security integration (SAST, DAST, IAST)\n∙ Automated security test execution", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74353, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591278", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591278", "securityControlId": 32069, "ccis": [], "uuid": "c2f7a538-7212-5205-83de-82ffff685f65", "testId": "TDA-11_A01", "test": "controls to validate that the system or system component received is genuine are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-04(03)_ODP[01]", "defaultText": null }, { "id": 74354, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591278", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591278", "securityControlId": 32069, "ccis": [], "uuid": "8eb7bf87-a2ce-5289-b1b9-4f1ef478cb27", "testId": "TDA-11_A02", "test": "controls to validate that the system or system component received has not been altered are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-04(03)_ODP[02]", "defaultText": null }, { "id": 74355, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591278", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591278", "securityControlId": 32069, "ccis": [], "uuid": "11735912-9d03-52e9-942f-0ee1e7dea4e9", "testId": "TDA-11_A03", "test": "controls are employed to validate that the system or system component received is genuine.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SR-04(03)[01]", "defaultText": null }, { "id": 74356, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591278", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591279", "securityControlId": 32069, "ccis": [], "uuid": "0be8580d-b179-5e10-91a6-9b056a8e9a29", "testId": "TDA-11_A04", "test": "controls are employed to validate that the system or system component received has not been altered.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SR-04(03)[02]", "defaultText": null }, { "id": 74357, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591279", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591279", "securityControlId": 32069, "ccis": [], "uuid": "14b47465-1881-5768-8b94-f564bd781eaf", "testId": "TDA-11_A05", "test": "controls employed to ensure that the integrity of the system and system component are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-04(04)_ODP[01]", "defaultText": null }, { "id": 74358, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591279", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591279", "securityControlId": 32069, "ccis": [], "uuid": "7540cd20-8087-56b1-80ee-6a549d2057f8", "testId": "TDA-11_A06", "test": "an analysis method to be conducted to validate the internal composition and provenance of critical or mission-essential technologies, products and services to ensure the integrity of the system and system component is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-04(04)_ODP[02]", "defaultText": null }, { "id": 74359, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591279", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591279", "securityControlId": 32069, "ccis": [], "uuid": "fd059e21-fe44-5eef-9cc4-f82523470411", "testId": "TDA-11_A07", "test": "controls are employed to ensure the integrity of the system and system components.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SR-04(04)[01]", "defaultText": null }, { "id": 74360, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591279", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591279", "securityControlId": 32069, "ccis": [], "uuid": "1b62c46b-f8aa-5379-92f6-5da90ce345b5", "testId": "TDA-11_A08", "test": "analysis method is conducted to ensure the integrity of the system and system components.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-04(04)[02]", "defaultText": null }, { "id": 74361, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591279", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591279", "securityControlId": 32069, "ccis": [], "uuid": "68d462b6-72fa-5e9d-993b-bbaf49ca21ff", "testId": "TDA-11_A09", "test": "systems or system components that require inspection are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-10_ODP[01]", "defaultText": null }, { "id": 74362, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59128", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59128", "securityControlId": 32069, "ccis": [], "uuid": "784d6afd-400e-5376-a82a-1e0f6e2ea146", "testId": "TDA-11_A10", "test": "frequency at which to inspect systems or system components is defined.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least every 12 months, or when there are significant\nincidents or significant changes to risks", "otherId": "53A_R5_SR-10_ODP[02]\n53A_R5_SR-10_ODP[03]", "defaultText": null }, { "id": 74363, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59128", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59128", "securityControlId": 32069, "ccis": [], "uuid": "5d83ddf3-7164-5085-8737-20f9abcd88ec", "testId": "TDA-11_A11", "test": "indications of the need for an inspection of systems or system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-10_ODP[04]", "defaultText": null }, { "id": 74364, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59128", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59128", "securityControlId": 32069, "ccis": [], "uuid": "ce4d36cc-2ce1-5b46-afc2-b5912d3afdeb", "testId": "TDA-11_A12", "test": "systems or system components are inspected to detect tampering.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-10", "defaultText": null }, { "id": 74365, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59128", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59128", "securityControlId": 32069, "ccis": [], "uuid": "9f838bd9-0dbb-5e4f-b04d-92fea9390f30", "testId": "TDA-11_A13", "test": "external reporting organizations to whom counterfeit system components are to be reported is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-11_ODP[01]\n53A_R5_SR-11_ODP[02]", "defaultText": null }, { "id": 74366, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59128", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59128", "securityControlId": 32069, "ccis": [], "uuid": "f2ac1d4c-b1bc-5b82-8364-c2227e74cdfb", "testId": "TDA-11_A14", "test": "personnel or roles to whom counterfeit system components are to be reported is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-11_ODP[03]", "defaultText": null }, { "id": 74367, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59128", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59128", "securityControlId": 32069, "ccis": [], "uuid": "d0298497-468e-5ec1-a14a-e67979a868a5", "testId": "TDA-11_A15", "test": "anti-counterfeit procedures are developed and implemented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-11a.[02]", "defaultText": null }, { "id": 74368, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591281", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591281", "securityControlId": 32069, "ccis": [], "uuid": "2b402ddd-4a87-5b7b-9f0c-5a3c0c5bea06", "testId": "TDA-11_A16", "test": "the anti-counterfeit procedures include the means to detect counterfeit components entering the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-11a.[03]", "defaultText": null }, { "id": 74369, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591281", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591281", "securityControlId": 32069, "ccis": [], "uuid": "3173392c-713f-5b24-a16d-a6838e11142c", "testId": "TDA-11_A17", "test": "the anti-counterfeit procedures include the means to prevent counterfeit components from entering the system.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-11a.[04]", "defaultText": null }, { "id": 74370, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591281", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591281", "securityControlId": 32069, "ccis": [], "uuid": "40ef276b-a888-5dde-a834-5228e1807109", "testId": "TDA-11_A18", "test": "counterfeit system components are reported per organization-defined criteria.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-11b.", "defaultText": null }, { "id": 74371, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591281", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591281", "securityControlId": 32069, "ccis": [], "uuid": "b312bebb-19d8-5bae-bf03-d338466153ed", "testId": "TDA-11_A19", "test": "the frequency at which to scan for counterfeit system components is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-11(03)_ODP", "defaultText": null }, { "id": 74372, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591282", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591282", "securityControlId": 32069, "ccis": [], "uuid": "476bd677-44d6-5bf4-827c-e68b7db32595", "testId": "TDA-11_A20", "test": "scanning for counterfeit system components is conducted per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: continuous", "otherId": "53A_R5_SR-11(03)", "defaultText": null } ], "externalMappings": [ { "id": 606766, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590537", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3fe92b0f-9372-5775-8635-e31ac6b6c378", "parentControlId": 32069, "controlId": "T1059.002", "title": "T1059.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590537" }, { "id": 606767, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590537", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5163c120-e2d7-54e1-ad8b-4151f8a6ce04", "parentControlId": 32069, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590537" }, { "id": 606768, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590537", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd74c623-2aea-54ba-8e55-b500290d3e76", "parentControlId": 32069, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590537" }, { "id": 606769, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590537", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8d0d0fd-2e7c-5092-a5bd-ea68787c47d9", "parentControlId": 32069, "controlId": "T1195.002", "title": "T1195.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590537" }, { "id": 606770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d60553fd-e308-535a-bc07-99a683122cb6", "parentControlId": 32069, "controlId": "T1195.003", "title": "T1195.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590538" }, { "id": 606771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2eda880-691a-5c19-b18d-46d25516adc8", "parentControlId": 32069, "controlId": "T1204.003", "title": "T1204.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590538" }, { "id": 606772, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c50d3521-a27d-50b6-8633-b0dd5136b73f", "parentControlId": 32069, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590538" }, { "id": 606773, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "973d7755-fe45-5bd6-9d45-5bc7df0ee887", "parentControlId": 32069, "controlId": "T1505.001", "title": "T1505.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590538" }, { "id": 606774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78ac8cea-5668-51f9-b52d-ef119d940a05", "parentControlId": 32069, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590538" }, { "id": 606775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7988f0aa-7975-5163-a648-37a88e53c807", "parentControlId": 32069, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590538" }, { "id": 606776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f193179-9275-5cf5-8b53-4a9aa063ec7c", "parentControlId": 32069, "controlId": "T1546.006", "title": "T1546.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590538" }, { "id": 606777, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d4c56839-0b77-5c16-a182-5a9034b25940", "parentControlId": 32069, "controlId": "T1554", "title": "T1554", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590538" }, { "id": 606778, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b22b86d-74f1-5f64-b46b-995ecb3bbe33", "parentControlId": 32069, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590539" }, { "id": 606779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e99a7e57-6a8e-50b8-ba4d-d20a8c269e0a", "parentControlId": 32069, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590539" }, { "id": 606780, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f4c583a-e178-5778-9f49-cb0f7c78c0d1", "parentControlId": 32069, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590539" }, { "id": 606781, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6f47332-2090-5e72-b3e0-00a7e310970b", "parentControlId": 32069, "controlId": "SA-12(10)", "title": "SA-12(10)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590539" }, { "id": 606782, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "571d5e15-42fd-5f68-8067-5220a22f7fbf", "parentControlId": 32069, "controlId": "SA-19", "title": "SA-19", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590539" }, { "id": 606783, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4da7c934-de7f-5092-b567-33fbb0ecc1a9", "parentControlId": 32069, "controlId": "SR-04(03)", "title": "SR-04(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590539" }, { "id": 606784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aff66750-5970-5f59-a89d-15ac3c207462", "parentControlId": 32069, "controlId": "SR-04(04)", "title": "SR-04(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590539" }, { "id": 606785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c6d4e1f-2605-5538-9394-b3e7423c59d9", "parentControlId": 32069, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590539" }, { "id": 606786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0707a56-b59b-5994-8cfa-69e1e2ef8e6a", "parentControlId": 32069, "controlId": "SR-11", "title": "SR-11", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590539" }, { "id": 606787, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb7bcc3c-9036-5843-929f-e1db58298d5a", "parentControlId": 32069, "controlId": "SR-11(03)", "title": "SR-11(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590539" }, { "id": 606789, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84f6485f-cc02-5649-8534-81d6705f9f57", "parentControlId": 32069, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59054" }, { "id": 606790, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "629149bb-0672-5234-81d6-fbd51e796c89", "parentControlId": 32069, "controlId": "SR-11", "title": "SR-11", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59054" }, { "id": 606791, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f48a2553-021b-568f-9fd0-1740ee268dfd", "parentControlId": 32069, "controlId": "SR-04(03)", "title": "SR-04(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59054" }, { "id": 606792, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0101506-987b-5586-a855-8e75b713cf28", "parentControlId": 32069, "controlId": "SR-04(04)", "title": "SR-04(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59054" }, { "id": 606793, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ddfb753e-310d-58c2-b5de-92c67a0332c3", "parentControlId": 32069, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59054" }, { "id": 606794, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c7f837c0-d56e-5f6e-86d1-c65054f6338b", "parentControlId": 32069, "controlId": "SR-11", "title": "SR-11", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590541" }, { "id": 606795, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590541", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b958c6ab-2124-58ee-9b97-0cd415bee498", "parentControlId": 32069, "controlId": "SR-11(03)", "title": "SR-11(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590541" }, { "id": 606796, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590541", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0fd8c062-6c5b-5523-b242-2925b414af5c", "parentControlId": 32069, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590541" }, { "id": 606797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590541", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4f82b1e-642c-51f1-afb0-b91bb5867290", "parentControlId": 32069, "controlId": "SR-11", "title": "SR-11", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590541" }, { "id": 606798, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590541", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ab54900-153a-569e-bcf7-9331fb333d91", "parentControlId": 32069, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590541" }, { "id": 606799, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590541", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d9122e9-d845-57df-b110-c98f004e560d", "parentControlId": 32069, "controlId": "SR-11", "title": "SR-11", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590541" }, { "id": 606800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590541", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cfb25d13-4979-5e86-a063-6104c29f3afb", "parentControlId": 32069, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590541" }, { "id": 606801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590541", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2338163f-aac7-5b7b-9e0c-237ca84a39d9", "parentControlId": 32069, "controlId": "SR-11", "title": "SR-11", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590541" }, { "id": 606807, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76a6256a-d2ca-524e-824b-e6d513f4f6cd", "parentControlId": 32069, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590542" }, { "id": 606808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f557675f-d37f-5999-85e2-97b189acd5fe", "parentControlId": 32069, "controlId": "SR-11", "title": "SR-11", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590542" }, { "id": 606809, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04156b5c-5e90-583a-abd0-3cb67ede1423", "parentControlId": 32069, "controlId": "SR-11(3)", "title": "SR-11(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590542" }, { "id": 606810, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97eaedc9-d0ee-510d-a42c-eb7f855a7aa0", "parentControlId": 32069, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590542" }, { "id": 606811, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21479b50-541e-5e32-adf2-108a6e5774e1", "parentControlId": 32069, "controlId": "SR-11", "title": "SR-11", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590542" }, { "id": 606812, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590542", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "84ec7c84-32b7-51a3-994f-dd37f90e2763", "parentControlId": 32069, "controlId": "SR-10", "title": "SR-10", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590543" }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "6a27122b-7d57-50b6-8c45-2ccd0c9e7d78", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "337d7169-07a1-5a5b-baf1-e5e027e98f83", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "99d77e2d-544c-5cd5-b05c-c6b3f150bf68", "isPublic": true } ], "id": 32069, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731349", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731349", "catalogueId": 1062, "uuid": "9d9c8754-3a0b-59c9-ba64-fdf2e69b8f44", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain awareness of component authenticity by developing and implementing Product Tampering and Counterfeiting (PTC) practices that include the means to detect and prevent counterfeit components?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Product Tampering and Counterfeiting (PTC)", "description": "

Control Description

Mechanisms exist to maintain awareness of component authenticity by developing and implementing Product Tampering and Counterfeiting (PTC) practices that include the means to detect and prevent counterfeit components.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Technology Development & Acquisition (TDA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TDA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Technology development & acquisition-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Secure development practices loosely conform to industry-recognized standards for secure engineering (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain awareness of component authenticity by developing and implementing Product Tampering and Counterfeiting (PTC) practices that include the means to detect and prevent counterfeit components.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-11", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-11", "references": "

Micro-Small Business (<10 staff)

∙ Test software in isolated environment before production deployment

Small Business (10-49 staff)

∙ Pre-production testing and staging environment

Medium Business (50-249 staff)

∙ Formal pre-production acceptance testing process\n∙ Separate staging environment

Large Business (250-999 staff)

∙ Enterprise pre-production testing program\n∙ Formal acceptance criteria

Enterprise (>1,000 staff)

∙ Enterprise software release management platform\n∙ Formal acceptance testing process\n∙ Blue/green or canary deployments", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74373, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591282", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591282", "securityControlId": 32070, "ccis": [], "uuid": "aa67cf4f-2895-5f04-a5c1-c62b9b50d810", "testId": "TDA-11.1_A01", "test": "personnel or roles requiring training to detect counterfeit system components (including hardware, software and firmware) is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-11(01)_ODP", "defaultText": null }, { "id": 74374, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591282", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591282", "securityControlId": 32070, "ccis": [], "uuid": "694eaff9-d3c1-5976-933c-0c94d2f736e1", "testId": "TDA-11.1_A02", "test": "personnel or roles are trained to detect counterfeit system components (including hardware, software and firmware).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-11(01)", "defaultText": null } ], "externalMappings": [ { "id": 606837, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe1b037b-1187-5473-8a09-50b65de7af9c", "parentControlId": 32070, "controlId": "SA-19(1)", "title": "SA-19(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590546" }, { "id": 606838, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f3f813b-51b8-5815-8cbc-5eb9a0d6a3f8", "parentControlId": 32070, "controlId": "SR-11(01)", "title": "SR-11(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590546" }, { "id": 606839, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69779d8e-dd6d-5b6d-973b-9873413bd07f", "parentControlId": 32070, "controlId": "SR-11(01)", "title": "SR-11(01)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590546" }, { "id": 606840, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "597c157f-31e4-5c6e-8819-27c3e6c85ded", "parentControlId": 32070, "controlId": "SR-11(01)", "title": "SR-11(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590546" }, { "id": 606841, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590546", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f736db2-d2ba-51ba-bfc8-a9229048e198", "parentControlId": 32070, "controlId": "SR-11(01)", "title": "SR-11(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590547" }, { "id": 606842, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "528e7edf-50b4-519e-a5df-d18926f9204f", "parentControlId": 32070, "controlId": "SR-11(01)", "title": "SR-11(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590547" }, { "id": 606843, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11356412-ad20-5cae-acc0-94959b89d91a", "parentControlId": 32070, "controlId": "SR-11(01)", "title": "SR-11(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590547" }, { "id": 606844, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b81da02-d84a-5978-a8ff-a6fdceacbea5", "parentControlId": 32070, "controlId": "SR-11(1)", "title": "SR-11(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590547" }, { "id": 606845, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590547", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8717d7ff-3915-50a5-9e74-11de9eea7424", "parentControlId": 32070, "controlId": "SR-11(1)", "title": "SR-11(1)", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590547" } ], "id": 32070, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731349", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731349", "catalogueId": 1062, "uuid": "65fae5af-082f-5e35-bd7d-b19d2bb09ffe", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization train personnel to detect counterfeit system components, including hardware, software and firmware?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Anti-Counterfeit Training", "description": "

Control Description

Mechanisms exist to train personnel to detect counterfeit system components, including hardware, software and firmware.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to train personnel to detect counterfeit system components, including hardware, software and firmware.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-11.1", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-11.1", "references": "

Medium Business (50-249 staff)

∙ Regression testing for security after code changes

Large Business (250-999 staff)

∙ Enterprise security regression testing program

Enterprise (>1,000 staff)

∙ Enterprise automated security regression testing in CI/CD pipeline", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74375, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591282", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591282", "securityControlId": 32071, "ccis": [], "uuid": "9d11ac0c-6a6c-5154-8d53-fbf80a710068", "testId": "TDA-11.2_A01", "test": "N/A [deprecated – incorporated into AST-09]
Assessment Rigor: 3", "otherId": "", "defaultText": null } ], "externalMappings": [ { "id": 606855, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590548", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c7819b0-a0b4-5880-b01e-e864ef92ab3d", "parentControlId": 32071, "controlId": "SR-12", "title": "SR-12", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590548" }, { "id": 606856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590548", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d916f6b7-3f92-5f19-a948-e179559be315", "parentControlId": 32071, "controlId": "SR-12", "title": "SR-12", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590548" } ], "id": 32071, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731349", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731349", "catalogueId": 1062, "uuid": "761d76fc-4951-500c-8449-c9c678a58657", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

[deprecated - incorporated into AST-09]\nDoes the organization dispose of system components using organization-defined techniques and methods to prevent such components from entering the gray market?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 0.0, "title": "Component Disposal", "description": "

Control Description

[deprecated - incorporated into AST-09]\nMechanisms exist to dispose of system components using organization-defined techniques and methods to prevent such components from entering the gray market.

SCR-CMM Maturity Model

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ [deprecated - incorporated into AST-09]\nAn implemented and operational capability exists to dispose of system components using organization-defined techniques and methods to prevent such components from entering the gray market.", "controlId": "TDA-11.2", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-11.2", "references": "

Large Business (250-999 staff)

∙ Fuzz testing for critical applications

Enterprise (>1,000 staff)

∙ Enterprise fuzz testing program (e.g., AFL, libFuzzer, Google OSS-Fuzz)\n∙ Automated fuzzing in CI/CD", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74376, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591282", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591282", "securityControlId": 32072, "ccis": [], "uuid": "53fed087-01de-52cd-bb15-438d7b017cbf", "testId": "TDA-12_A01", "test": "suppliers of critical or mission-essential technologies, products and services are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-30(01)[01]", "defaultText": null }, { "id": 74377, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591283", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591283", "securityControlId": 32072, "ccis": [], "uuid": "650ff421-3f0d-5ccf-9369-e6fff869bddd", "testId": "TDA-12_A02", "test": "suppliers of critical or mission-essential technologies, products and services are prioritized.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-30(01)[02]", "defaultText": null }, { "id": 74378, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591283", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591283", "securityControlId": 32072, "ccis": [], "uuid": "60837b70-973c-5dc8-b4fe-d0a83138af46", "testId": "TDA-12_A03", "test": "suppliers of critical or mission-essential technologies, products and services are assessed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-30(01)[03]", "defaultText": null }, { "id": 74379, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591283", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591283", "securityControlId": 32072, "ccis": [], "uuid": "387dbf09-1ddc-57d8-aa2c-152abe3c8ecd", "testId": "TDA-12_A04", "test": "critical system components to be reimplemented or custom-developed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-20_ODP", "defaultText": null }, { "id": 74380, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591283", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591283", "securityControlId": 32072, "ccis": [], "uuid": "959bda07-0aa8-528e-aaf2-1102231c62fc", "testId": "TDA-12_A05", "test": "critical systems are reimplemented or custom-developed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SA-20", "defaultText": null }, { "id": 74381, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591283", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591283", "securityControlId": 32072, "ccis": [], "uuid": "2efb142e-db47-5d1c-8e4c-4eead77bffb4", "testId": "TDA-12_A06", "test": "systems or system components supporting mission-essential services or functions are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-23_ODP[01]\n53A_R5_SA-23_ODP[02]", "defaultText": null }, { "id": 74382, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591283", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591283", "securityControlId": 32072, "ccis": [], "uuid": "4ef2f8f9-e3bc-5ed1-8ddf-a5030c72ea71", "testId": "TDA-12_A07", "test": "organization-defined criteria are employed on systems or system components supporting essential services or functions to increase the trustworthiness in those systems or components.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SA-23", "defaultText": null } ], "externalMappings": [ { "id": 606867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590549", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a92e42d8-9d28-5f6e-8e5a-efb76b7b76c9", "parentControlId": 32072, "controlId": "SA-20", "title": "SA-20", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590549" }, { "id": 606868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68d062c4-eb43-5fd3-a284-509af707efd0", "parentControlId": 32072, "controlId": "PM-30(01)", "title": "PM-30(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59055" }, { "id": 606869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d68b30ec-308a-5154-b454-b0787724e3d9", "parentControlId": 32072, "controlId": "SA-20", "title": "SA-20", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59055" }, { "id": 606870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b351953-5c67-5dbf-ad5b-a3667e2b7beb", "parentControlId": 32072, "controlId": "SA-23", "title": "SA-23", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59055" }, { "id": 606873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "913e050b-fd9d-5fb9-b264-dce68fdc1f83", "parentControlId": 32072, "controlId": "PM-30(01)", "title": "PM-30(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59055" }, { "id": 606874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e40a24b9-76b2-5cbb-b3f1-eafe56ab1f31", "parentControlId": 32072, "controlId": "SA-20", "title": "SA-20", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59055" }, { "id": 606875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "725968a2-a8f5-59d9-8e4a-f4b5348737e5", "parentControlId": 32072, "controlId": "SA-23", "title": "SA-23", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59055" }, { "id": 606876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59055", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ff5136d-3eba-55c0-a4a9-617cc2fade08", "parentControlId": 32072, "controlId": "PM-30(01)", "title": "PM-30(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59055" }, { "id": 606877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e25be210-5ffa-546b-b812-568f18ba582e", "parentControlId": 32072, "controlId": "PM-30(01)", "title": "PM-30(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590551" }, { "id": 606878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a363723b-c1c5-55a7-8c55-d35a274709f3", "parentControlId": 32072, "controlId": "PM-30(01)", "title": "PM-30(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590551" }, { "id": 606882, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49fc0cc5-bbaa-542c-b14f-898ddb8f2734", "parentControlId": 32072, "controlId": "SA-20", "title": "SA-20", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590551" }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "95702337-cd05-595f-a82d-c83661bbf0de", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "7cf97c46-ebef-57da-9def-1504c886af68", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "e183f729-d940-587d-b12e-e05622c772fc", "isPublic": true } ], "id": 32072, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73135", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73135", "catalogueId": 1062, "uuid": "00320b27-5133-5f18-b64e-c3e68e24cf61", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization custom-develop critical system components, when Commercial Off The Shelf (COTS) solutions are unavailable?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Customized Development of Critical Components", "description": "

Control Description

Mechanisms exist to custom-develop critical system components, when Commercial Off The Shelf (COTS) solutions are unavailable.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to custom-develop critical system components, when Commercial Off The Shelf (COTS) solutions are unavailable.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-12", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-12", "references": "

Micro-Small Business (<10 staff)

∙ Perform basic security testing before deploying new software

Small Business (10-49 staff)

∙ Security testing checklist before software deployment

Medium Business (50-249 staff)

∙ Formal security testing program for software releases

Large Business (250-999 staff)

∙ Enterprise DAST/SAST program integrated with deployment process

Enterprise (>1,000 staff)

∙ Enterprise DevSecOps security testing automation (SAST, DAST, SCA, IAST)\n∙ Full CI/CD integration", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74383, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591284", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591284", "securityControlId": 32073, "ccis": [], "uuid": "23791186-914c-5472-83fb-093788042d7c", "testId": "TDA-13_A01", "test": "the system, systems component or system service that the developer has access to is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-21_ODP[01]", "defaultText": null }, { "id": 74384, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591284", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591284", "securityControlId": 32073, "ccis": [], "uuid": "cc8f7ec1-ebaf-5b86-9ca6-76063daa8e7a", "testId": "TDA-13_A02", "test": "official duties assigned to the developer are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-21_ODP[02]", "defaultText": null }, { "id": 74385, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591284", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591284", "securityControlId": 32073, "ccis": [], "uuid": "9387085c-abb9-55c4-b127-9bb8c349bfaf", "testId": "TDA-13_A03", "test": "additional personnel screening criteria for the developer are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-21_ODP[03]\n172A_3.9.1e_ODP[1]", "defaultText": null } ], "externalMappings": [ { "id": 606893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8db0e2d1-447f-5ef7-9796-a47b8115e50e", "parentControlId": 32073, "controlId": "SA-21", "title": "SA-21", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590553" }, { "id": 606894, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22f575bf-b3ec-55df-b48a-48a36a970ae0", "parentControlId": 32073, "controlId": "SA-21", "title": "SA-21", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590553" }, { "id": 606895, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba7f7fb6-b00c-5048-acc7-8f110b3ec9a2", "parentControlId": 32073, "controlId": "SA-21", "title": "SA-21", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590553" }, { "id": 606896, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c17b33f8-22d5-5e53-a2ce-5e1852d779da", "parentControlId": 32073, "controlId": "SA-21", "title": "SA-21", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590553" }, { "id": 606897, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d907a0fa-97ce-5e82-a1b4-19e95419c621", "parentControlId": 32073, "controlId": "SA-21", "title": "SA-21", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590553" }, { "id": 606898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2655bee9-a848-5bfb-a320-62179d537215", "parentControlId": 32073, "controlId": "SA-21", "title": "SA-21", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590553" }, { "id": 606899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03c34592-565b-5df7-bfe4-79ac612d67f7", "parentControlId": 32073, "controlId": "SA-21(1)", "title": "SA-21(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590553" }, { "id": 606900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590553", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8f255fd5-0c21-5e55-a24e-be696b060ac1", "parentControlId": 32073, "controlId": "SA-21", "title": "SA-21", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590553" }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "6f76af4b-b672-5a64-9899-ae9918cd359f", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "40f48106-b659-59fa-8b8b-2531068dd2d3", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "a83c9c21-7c49-5803-92cd-4256a0c73702", "isPublic": true } ], "id": 32073, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73135", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73135", "catalogueId": 1062, "uuid": "8ecfeb21-6704-5cff-8956-4800bef46e93", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure that the developers of Technology Assets, Applications and/or Services (TAAS) have the requisite skillset and appropriate access authorizations?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Developer Screening", "description": "

Control Description

Mechanisms exist to ensure that the developers of Technology Assets, Applications and/or Services (TAAS) have the requisite skillset and appropriate access authorizations.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure that the developers of Technology Assets, Applications and/or Services (TAAS) have the requisite skillset and appropriate access authorizations.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-13", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-13", "references": "

Micro-Small Business (<10 staff)

∙ Document and communicate security vulnerabilities in released software

Small Business (10-49 staff)

∙ Document and communicate security vulnerabilities in released software

Medium Business (50-249 staff)

∙ Formal coordinated vulnerability disclosure (CVD) policy and process

Large Business (250-999 staff)

∙ Enterprise vulnerability disclosure program (VDP)\n∙ CNA enrollment if applicable

Enterprise (>1,000 staff)

∙ Enterprise vulnerability disclosure program (VDP)\n∙ Bug bounty integration (e.g., HackerOne, Bugcrowd)\n∙ CVE/CNA participation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74386, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591284", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591284", "securityControlId": 32074, "ccis": [], "uuid": "f1634eab-5d8d-5bfc-adf6-813082a753b6", "testId": "TDA-14_A01", "test": "the developer of system, systems component or system service is required to have appropriate access authorizations as determined by assigned official duties.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "53A_R5_SA-21a.", "defaultText": null }, { "id": 74387, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591284", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591284", "securityControlId": 32074, "ccis": [], "uuid": "9db312a4-0cb2-5c13-b876-1692bdea9d25", "testId": "TDA-14_A02", "test": "configuration items under configuration management are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-10_ODP[01]\n53A_R5_SA-10_ODP[02]", "defaultText": null }, { "id": 74388, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591285", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591285", "securityControlId": 32074, "ccis": [], "uuid": "0fd9962b-1c13-509d-8f3e-15c5fa521072", "testId": "TDA-14_A03", "test": "personnel to whom security flaws and flaw resolutions within the system, component or service are reported is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-10_ODP[03]", "defaultText": null }, { "id": 74389, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591285", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591285", "securityControlId": 32074, "ccis": [], "uuid": "6ecf3acc-5f73-54ff-b8e7-f6188aaf2ca9", "testId": "TDA-14_A04", "test": "the developer of the system, system component or system service is required to perform configuration management during system, component or service per organization-defined criteria.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: development, implementation, AND operation", "otherId": "53A_R5_SA-10a.", "defaultText": null }, { "id": 74390, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591285", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591285", "securityControlId": 32074, "ccis": [], "uuid": "1a22f8ca-5dcb-584d-8ed8-763792323c20", "testId": "TDA-14_A05", "test": "the developer of the system, system component or system service is required to document the integrity of changes to configuration items.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-10b.[01]", "defaultText": null }, { "id": 74391, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591285", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591285", "securityControlId": 32074, "ccis": [], "uuid": "140eacfa-4ca8-5afc-ad32-b4d48ae2ec08", "testId": "TDA-14_A06", "test": "the developer of the system, system component or system service is required to manage the integrity of changes to configuration items.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-10b.[02]", "defaultText": null }, { "id": 74392, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591285", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591285", "securityControlId": 32074, "ccis": [], "uuid": "d1f666d5-7280-50f8-9e64-75ee754b1be7", "testId": "TDA-14_A07", "test": "the developer of the system, system component or system service is required to control the integrity of changes to configuration items.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-10b.[03]", "defaultText": null }, { "id": 74393, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591286", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591286", "securityControlId": 32074, "ccis": [], "uuid": "3a6bc882-dbfb-5186-afa2-51fd275dfe99", "testId": "TDA-14_A08", "test": "the developer of the system, system component or system service is required to implement only organization-approved changes to the system, component or service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-10c.", "defaultText": null }, { "id": 74394, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591286", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591286", "securityControlId": 32074, "ccis": [], "uuid": "3d138b65-d119-5008-95cb-577c7c8a2cd1", "testId": "TDA-14_A09", "test": "the developer of the system, system component or system service is required to document approved changes to the system, component or service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-10d.[01]", "defaultText": null }, { "id": 74395, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591286", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591286", "securityControlId": 32074, "ccis": [], "uuid": "f65aabef-64b7-529d-8a58-5beca1fce960", "testId": "TDA-14_A10", "test": "the developer of the system, system component or system service is required to document the potential security impacts of approved changes.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-10d.[02]", "defaultText": null }, { "id": 74396, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591286", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591286", "securityControlId": 32074, "ccis": [], "uuid": "665a004d-0912-5e09-9395-1833acf16f14", "testId": "TDA-14_A11", "test": "the developer of the system, system component or system service is required to document the potential privacy impacts of approved changes.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-10d.[03]", "defaultText": null }, { "id": 74397, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591286", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591286", "securityControlId": 32074, "ccis": [], "uuid": "9ca1152d-baaf-51e5-88eb-7bbab02c7068", "testId": "TDA-14_A12", "test": "the developer of the system, system component or system service is required to track security flaws within the system, component or service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-10e.[01]", "defaultText": null }, { "id": 74398, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591287", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591287", "securityControlId": 32074, "ccis": [], "uuid": "445c2640-7d3a-51fe-8016-015464e32847", "testId": "TDA-14_A13", "test": "the developer of the system, system component or system service is required to track security flaw resolutions within the system, component or service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-10e.[02]", "defaultText": null }, { "id": 74399, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591287", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591287", "securityControlId": 32074, "ccis": [], "uuid": "8911e470-a0ed-5161-b179-c7b68dfe4083", "testId": "TDA-14_A14", "test": "the developer of the system, system component or system service is required to report findings to personnel.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-10e.[03]", "defaultText": null }, { "id": 74400, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591287", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591287", "securityControlId": 32074, "ccis": [], "uuid": "f69cd52d-bf35-56b3-ba83-afe0c9a5fbfb", "testId": "TDA-14_A15", "test": "an alternate configuration management process has been provided using organizational personnel in the absence of a dedicated developer configuration management team.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-10(02)", "defaultText": null }, { "id": 74401, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591287", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591287", "securityControlId": 32074, "ccis": [], "uuid": "93ce096f-81a1-5d20-9c25-34739a030801", "testId": "TDA-14_A16", "test": "the frequency with which to reassess individual positions and access to sensitive / regulated data is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.9.1e_ODP[2]", "defaultText": null }, { "id": 74402, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591287", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591287", "securityControlId": 32074, "ccis": [], "uuid": "d58d68f1-7b22-5c44-9866-24cf331c623a", "testId": "TDA-14_A17", "test": "individuals that require enhanced personnel screening are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.9.1e[a]", "defaultText": null }, { "id": 74403, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591287", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591287", "securityControlId": 32074, "ccis": [], "uuid": "5d2cacb4-074d-5ec7-8e97-c49d07f508b6", "testId": "TDA-14_A18", "test": "positions that require access to sensitive / regulated data are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.9.1e[b]", "defaultText": null }, { "id": 74404, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591288", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591288", "securityControlId": 32074, "ccis": [], "uuid": "149aa17b-be7c-58b2-8934-d2b3bc34210b", "testId": "TDA-14_A19", "test": "organization-defined enhanced personnel screening is conducted for individuals.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-21b.\n172A_3.9.1e_ODP[1]\n172A_3.9.1e[c]", "defaultText": null }, { "id": 74405, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591288", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591288", "securityControlId": 32074, "ccis": [], "uuid": "a708dac4-4bf5-546e-a0c4-c3d71eae1b05", "testId": "TDA-14_A20", "test": "individual positions and access to sensitive / regulated data is reassessed per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.9.1e[d]", "defaultText": null }, { "id": 74406, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591288", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591288", "securityControlId": 32074, "ccis": [], "uuid": "4ad3778b-39a2-5552-a9fa-31205adc8e11", "testId": "TDA-14_A21", "test": "individuals with access to sensitive / regulated data are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.9.2e[a]", "defaultText": null }, { "id": 74407, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591288", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591288", "securityControlId": 32074, "ccis": [], "uuid": "3031b62e-5861-5666-affe-78630aa3ed9b", "testId": "TDA-14_A22", "test": "adverse information about individuals with access to sensitive / regulated data is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.9.2e[b]", "defaultText": null }, { "id": 74408, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591289", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591289", "securityControlId": 32074, "ccis": [], "uuid": "5a9cd447-77f2-5c68-accc-105d11bff3f5", "testId": "TDA-14_A23", "test": "organizational systems to which individuals have access are identified.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.9.2e[c]", "defaultText": null }, { "id": 74409, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591289", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591289", "securityControlId": 32074, "ccis": [], "uuid": "06c5d680-fd1f-5643-bc37-b6c1eddfc213", "testId": "TDA-14_A24", "test": "mechanisms are in place to protect organizational systems if adverse information develops or is obtained about individuals with access to sensitive / regulated data.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.9.2e[d]", "defaultText": null } ], "externalMappings": [ { "id": 606919, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9259a7ab-2186-53a0-8be1-b82b8b5c5ecb", "parentControlId": 32074, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590556" }, { "id": 606920, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80dde7e2-495d-5b67-9cf1-f7b374aba651", "parentControlId": 32074, "controlId": "8.32", "title": "8.32", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590556" }, { "id": 606925, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea4a76c9-064c-597c-812b-43bc873d727a", "parentControlId": 32074, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590556" }, { "id": 606926, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fb5adce-d5f5-5925-8d5a-2dd36311b5de", "parentControlId": 32074, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590556" }, { "id": 606927, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590556", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3de47963-f29c-5c56-96af-2ae9ccf3b1f7", "parentControlId": 32074, "controlId": "T1078.001", "title": "T1078.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590556" }, { "id": 606928, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73670847-95aa-5e44-93f6-e786f111ae4c", "parentControlId": 32074, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590557" }, { "id": 606929, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89250394-d30f-5879-855b-0e4c4fa66fb1", "parentControlId": 32074, "controlId": "T1078.004", "title": "T1078.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590557" }, { "id": 606930, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b5fc322-95a8-5fa4-bd38-5380d5084564", "parentControlId": 32074, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590557" }, { "id": 606931, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21acd16e-c944-5996-888c-822b2e65e7f1", "parentControlId": 32074, "controlId": "T1195.003", "title": "T1195.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590557" }, { "id": 606932, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb34df21-39e8-5cb4-973f-eeb693a5274e", "parentControlId": 32074, "controlId": "T1213.003", "title": "T1213.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590557" }, { "id": 606933, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a21a02aa-68e5-59da-9766-843b91d600ce", "parentControlId": 32074, "controlId": "T1495", "title": "T1495", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590557" }, { "id": 606934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "14c1e013-16d5-5b85-afaf-d5391e78cf28", "parentControlId": 32074, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590557" }, { "id": 606935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590557", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29c5bc58-ef6f-5b12-bf04-ef0f842577e0", "parentControlId": 32074, "controlId": "T1505.001", "title": "T1505.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590557" }, { "id": 606936, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "748f69d7-8483-57e3-a52b-9609cd144510", "parentControlId": 32074, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590561" }, { "id": 606937, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9abf608-af46-5870-9f82-7b03942a9692", "parentControlId": 32074, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590561" }, { "id": 606938, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c87c37b-5a0c-5799-a4db-0fb3e9b8485d", "parentControlId": 32074, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590561" }, { "id": 606939, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c505221a-5c82-53dd-b07e-500bb47c1b40", "parentControlId": 32074, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590561" }, { "id": 606940, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590561", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be7fbeba-f9cb-564b-b3cb-0392364c7f70", "parentControlId": 32074, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590561" }, { "id": 606941, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d97f97d-a4d3-5f15-9982-2e44a8c7da58", "parentControlId": 32074, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590562" }, { "id": 606942, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "208e3a54-c52b-572b-ba96-857bb03b2df2", "parentControlId": 32074, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590562" }, { "id": 606943, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c56fe1af-195b-52e5-92cf-610407a0fcdd", "parentControlId": 32074, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590562" }, { "id": 606944, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f61c8cfa-e1ce-5f0d-ac49-78508c444c21", "parentControlId": 32074, "controlId": "T1553.006", "title": "T1553.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590562" }, { "id": 606945, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d090142a-b6f6-5534-a0a6-749064f5584b", "parentControlId": 32074, "controlId": "T1559.003", "title": "T1559.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590562" }, { "id": 606946, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3868701-2687-5e3d-9c68-64f73b31b194", "parentControlId": 32074, "controlId": "T1564.009", "title": "T1564.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590562" }, { "id": 606947, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44f9d9cb-79d1-58a9-8a94-38f6e2d6d564", "parentControlId": 32074, "controlId": "T1574.002", "title": "T1574.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590562" }, { "id": 606948, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1e7f0be7-4531-571a-88e5-3469d8d61d06", "parentControlId": 32074, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590562" }, { "id": 606949, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590562", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37f5198f-005a-586e-8e59-1fdcc4a3641b", "parentControlId": 32074, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590562" }, { "id": 606950, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2591059-6c93-5cfd-b240-c803ce0b437e", "parentControlId": 32074, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590563" }, { "id": 606951, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7bc505a-3615-5ae3-b896-e6bbb6f0f086", "parentControlId": 32074, "controlId": "T1647", "title": "T1647", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590563" }, { "id": 606952, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41f67cb8-60a4-5c67-bf40-af4a4f21467e", "parentControlId": 32074, "controlId": "SA-10", "title": "SA-10", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590563" }, { "id": 606953, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "236d9f7b-9d67-5d6e-926b-3f3ec9bf4966", "parentControlId": 32074, "controlId": "SA-10", "title": "SA-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590563" }, { "id": 606954, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dac854df-9436-5cd0-a85c-a00910ef9c79", "parentControlId": 32074, "controlId": "SA-10", "title": "SA-10", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590563" }, { "id": 606955, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d424b49-1fcd-560d-a4ae-0c6e93091f8b", "parentControlId": 32074, "controlId": "SA-10", "title": "SA-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590563" }, { "id": 606956, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f24bf8b9-9d1f-56ae-8b6b-b256149b7f5a", "parentControlId": 32074, "controlId": "SA-10", "title": "SA-10", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590563" }, { "id": 606957, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df1f00cf-6381-5554-a4f0-c562c71f82a1", "parentControlId": 32074, "controlId": "SA-10", "title": "SA-10", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590563" }, { "id": 606958, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590563", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c965bd12-7841-55f9-8c80-7eb98283907d", "parentControlId": 32074, "controlId": "SA-10", "title": "SA-10", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590563" }, { "id": 606961, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590564", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3ea61ea-2c20-5f5a-a6cc-3d48cc784a8a", "parentControlId": 32074, "controlId": "NFO - SA-10", "title": "NFO - SA-10", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590564" }, { "id": 606962, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590564", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b583122a-a4ab-5ab8-9e13-111fe49b0ef1", "parentControlId": 32074, "controlId": "ID.RA-09", "title": "ID.RA-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590564" }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "490a9e91-0ca1-53aa-b6cc-ee9d480ce5d5", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "476a849a-2ef2-5f97-aa30-2aa331c95929", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "4feb8202-9570-5383-96fc-948acc2baf5b", "isPublic": true } ], "id": 32074, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73135", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73135", "catalogueId": 1062, "uuid": "e0d4cd6b-97b3-5c7a-ba29-f03e9de64676", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require system developers and integrators to perform configuration management during system design, development, implementation and operation?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Developer Configuration Management", "description": "

Control Description

Mechanisms exist to require system developers and integrators to perform configuration management during system design, development, implementation and operation.

Evidence Request List (ERL)

E-TDA-01\nE-TDA-02\nE-TDA-04\nE-TDA-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require system developers and integrators to perform configuration management during system design, development, implementation and operation.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-14", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-14", "references": "

Medium Business (50-249 staff)

∙ Basic malware protection in development environments

Large Business (250-999 staff)

∙ Enterprise malware protection for development environments\n∙ Code scanning for malicious patterns

Enterprise (>1,000 staff)

∙ Enterprise malware protection in DevSecOps pipelines\n∙ Automated malware scanning in CI/CD", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74410, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591289", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591289", "securityControlId": 32075, "ccis": [], "uuid": "5582a400-c39d-5e8c-99ac-fa68bba56bea", "testId": "TDA-14.1_A01", "test": "the developer of the system, system component or system service is required to enable integrity verification of software and firmware components.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-10(01)", "defaultText": null } ], "externalMappings": [ { "id": 606988, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590567", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83d3e9e5-ca1a-5132-9786-8eb168eda6fe", "parentControlId": 32075, "controlId": "SA-10(1)", "title": "SA-10(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590567" }, { "id": 606989, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590567", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c7a5d5d-34e8-5124-b09a-2622e1d1b136", "parentControlId": 32075, "controlId": "SA-10(01)", "title": "SA-10(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590567" }, { "id": 606990, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590567", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "278c44e5-5e9a-5d55-a41c-a8862fcdaa3f", "parentControlId": 32075, "controlId": "SA-10(01)", "title": "SA-10(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590567" }, { "id": 606992, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590568", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29e94577-3cfd-5630-8533-702cd70338a7", "parentControlId": 32075, "controlId": "ID.RA-09", "title": "ID.RA-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590568" }, { "id": 606994, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590568", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d43363ca-4ecd-5248-aa99-4fff29d37c21", "parentControlId": 32075, "controlId": "ARCHITECTURE-4g", "title": "ARCHITECTURE-4g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590568" } ], "id": 32075, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731351", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731351", "catalogueId": 1062, "uuid": "490111d7-21f0-561f-ac73-6748039d2ecf", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require developers of Technology Assets, Applications and/or Services (TAAS) to enable integrity verification of software and firmware components?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Software / Firmware Integrity Verification", "description": "

Control Description

Mechanisms exist to require developers of Technology Assets, Applications and/or Services (TAAS) to enable integrity verification of software and firmware components.

Evidence Request List (ERL)

E-TDA-01\nE-TDA-02\nE-TDA-04\nE-TDA-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require developers of Technology Assets, Applications and/or Services (TAAS) to enable integrity verification of software and firmware components.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "TDA-14.1", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-14.1", "references": "

Enterprise (>1,000 staff)

∙ Enterprise anti-malware protection in development environments\n∙ Automated malware scanning of build artifacts", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74411, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591289", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591289", "securityControlId": 32076, "ccis": [], "uuid": "0a73db63-d24d-55d7-b623-c6fdbd41d1bb", "testId": "TDA-14.2_A01", "test": "the developer of the system, system component or system service is required to enable integrity verification of hardware components.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74412, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59129", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59129", "securityControlId": 32076, "ccis": [], "uuid": "29c07484-266d-5740-8e03-867766498be5", "testId": "TDA-14.2_A02", "test": "the integrity of hardware components is verified.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74413, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59129", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59129", "securityControlId": 32076, "ccis": [], "uuid": "6bcb6142-ca69-539f-85f2-05224d92093f", "testId": "TDA-14.2_A03", "test": "independence criteria to be satisfied by an independent agent are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(03)_ODP", "defaultText": null }, { "id": 74414, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59129", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59129", "securityControlId": 32076, "ccis": [], "uuid": "4748dc26-ea02-5124-a4e4-224e52ba142d", "testId": "TDA-14.2_A04", "test": "an independent agent is required to satisfy organization-defined independence criteria to verify the correct implementation of the developer security assessment plan and the evidence produced during testing and evaluation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(03)(a)[01]", "defaultText": null }, { "id": 74415, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59129", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59129", "securityControlId": 32076, "ccis": [], "uuid": "14cfc4e7-6219-5776-9213-d176010210c8", "testId": "TDA-14.2_A05", "test": "an independent agent is required to satisfy organization-defined independence criteria to verify the correct implementation of the developer privacy assessment plan and the evidence produced during testing and evaluation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(03)(a)[02]", "defaultText": null }, { "id": 74416, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59129", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59129", "securityControlId": 32076, "ccis": [], "uuid": "36cc2289-6cee-5c16-bf74-97d24e8f7978", "testId": "TDA-14.2_A06", "test": "the independent agent is provided with sufficient information to complete the verification process or granted the authority to obtain such information.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(03)(b)", "defaultText": null } ], "externalMappings": [ { "id": 607000, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590568", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "debf23f3-dd4c-5e5d-95e4-c56ee9140747", "parentControlId": 32076, "controlId": "SA-10(3)", "title": "SA-10(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590569" }, { "id": 607001, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590569", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "701eed9a-e5cd-5851-ac18-17878e187ab5", "parentControlId": 32076, "controlId": "SA-10(03)", "title": "SA-10(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590569" }, { "id": 607002, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590569", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d46cdcda-ab01-53aa-970c-902f1940e7ba", "parentControlId": 32076, "controlId": "SA-10(03)", "title": "SA-10(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590569" }, { "id": 607004, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590569", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c294d4a3-398b-5709-8ce7-5840dafafc0c", "parentControlId": 32076, "controlId": "ID.RA-09", "title": "ID.RA-09", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590569" } ], "id": 32076, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731351", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731351", "catalogueId": 1062, "uuid": "e50e7f58-7243-57e2-a513-413b215aed77", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require developers of Technology Assets, Applications and/or Services (TAAS) to enable integrity verification of hardware components?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Hardware Integrity Verification", "description": "

Control Description

Mechanisms exist to require developers of Technology Assets, Applications and/or Services (TAAS) to enable integrity verification of hardware components.

Evidence Request List (ERL)

E-TDA-01\nE-TDA-02\nE-TDA-04\nE-TDA-08

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require developers of Technology Assets, Applications and/or Services (TAAS) to enable integrity verification of hardware components.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-14.2", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-14.2", "references": "

Enterprise (>1,000 staff)

∙ Enterprise malicious code protection across all development environments\n∙ SAST for malicious code detection", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74417, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591291", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591291", "securityControlId": 32077, "ccis": [], "uuid": "cf88a501-94ce-51f2-b65d-ff9c02dda063", "testId": "TDA-15_A01", "test": "information concerning impact, environment of operations, known or assumed threats and acceptable risk levels to be used as contextual information for threat modeling and vulnerability analyses is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(02)_ODP[01]", "defaultText": null }, { "id": 74418, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591291", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591291", "securityControlId": 32077, "ccis": [], "uuid": "6988cf75-d9f8-5ee2-bfdd-90d27cf4c744", "testId": "TDA-15_A02", "test": "the tools and methods to be employed for threat modeling and vulnerability analyses are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(02)_ODP[02]", "defaultText": null }, { "id": 74419, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591291", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591291", "securityControlId": 32077, "ccis": [], "uuid": "31528084-b5dd-5e20-be3b-525bdf1932d1", "testId": "TDA-15_A03", "test": "the breadth and depth of threat modeling to be conducted is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(02)_ODP[03]", "defaultText": null }, { "id": 74420, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591291", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591291", "securityControlId": 32077, "ccis": [], "uuid": "73e08845-9578-5bb6-8101-96800ed84155", "testId": "TDA-15_A04", "test": "the breadth and depth of vulnerability analyses to be conducted is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(02)_ODP[04]", "defaultText": null }, { "id": 74421, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591291", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591291", "securityControlId": 32077, "ccis": [], "uuid": "179d238a-a011-5f99-b32f-2ac38aab02fc", "testId": "TDA-15_A05", "test": "acceptance criteria to be met by produced evidence for threat modeling are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(02)_ODP[05]", "defaultText": null }, { "id": 74422, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591291", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591291", "securityControlId": 32077, "ccis": [], "uuid": "b975cb13-c0ed-5154-aa89-20693a801dc5", "testId": "TDA-15_A06", "test": "acceptance criteria to be met by produced evidence for vulnerability analyses are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(02)_ODP[06]", "defaultText": null }, { "id": 74423, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591291", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591291", "securityControlId": 32077, "ccis": [], "uuid": "7da1d3bc-bf8c-5173-8400-c3b5651908b2", "testId": "TDA-15_A07", "test": "the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that uses organization-defined information.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(02)(a)[01]", "defaultText": null }, { "id": 74424, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591292", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591292", "securityControlId": 32077, "ccis": [], "uuid": "2f4637a8-2ae8-5065-bc0c-b0706607fb91", "testId": "TDA-15_A08", "test": "the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that uses organization-defined information.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(02)(a)[02]", "defaultText": null }, { "id": 74425, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591292", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591292", "securityControlId": 32077, "ccis": [], "uuid": "232fa27e-a002-5a71-b731-1a1dd2237717", "testId": "TDA-15_A09", "test": "the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that uses organization-defined information.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(02)(a)[03]", "defaultText": null }, { "id": 74426, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591292", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591292", "securityControlId": 32077, "ccis": [], "uuid": "fb1a121d-82a0-594f-97e2-8166a8698d3d", "testId": "TDA-15_A10", "test": "the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that uses organization-defined information.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(02)(a)[04]", "defaultText": null }, { "id": 74427, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591292", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591292", "securityControlId": 32077, "ccis": [], "uuid": "645d2b55-c0c4-57a8-a895-69d4ec11dc41", "testId": "TDA-15_A11", "test": "the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that employs organization-defined tools and methods.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(02)(b)[01]", "defaultText": null }, { "id": 74428, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591292", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591292", "securityControlId": 32077, "ccis": [], "uuid": "fe15fa0a-8cd9-58cb-9457-1281720c5bb9", "testId": "TDA-15_A12", "test": "the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that employs organization-defined tools and methods.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(02)(b)[02]", "defaultText": null }, { "id": 74429, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591293", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591293", "securityControlId": 32077, "ccis": [], "uuid": "0ce564d0-a15a-5f55-a3fd-1ff1851d1cc4", "testId": "TDA-15_A13", "test": "the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that employs organization-defined tools and methods.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(02)(b)[03]", "defaultText": null }, { "id": 74430, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591293", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591293", "securityControlId": 32077, "ccis": [], "uuid": "dfd6f4ef-47eb-5854-83d2-e8998ae64a96", "testId": "TDA-15_A14", "test": "the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that employs organization-defined tools and methods.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(02)(b)[04]", "defaultText": null }, { "id": 74431, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591293", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591293", "securityControlId": 32077, "ccis": [], "uuid": "a66ddb03-9aee-5753-963d-e360fc3a61bb", "testId": "TDA-15_A15", "test": "the developer of the system, system component, or system service is required to perform threat modeling per an organization-defined breadth and depth during development of the system, component or service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(02)(c)[01]", "defaultText": null }, { "id": 74432, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591293", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591293", "securityControlId": 32077, "ccis": [], "uuid": "d3e06f3d-001c-5e63-a8f9-b5c4ee8dfd4d", "testId": "TDA-15_A16", "test": "the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that conducts modeling and analyses per an organization-defined breadth and depth.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(02)(c)[02]", "defaultText": null }, { "id": 74433, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591294", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591294", "securityControlId": 32077, "ccis": [], "uuid": "14a7e173-42b3-5cb4-9360-336dad894a6e", "testId": "TDA-15_A17", "test": "the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that produces evidence that meets organization-defined acceptance criteria.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(02)(d)[01]", "defaultText": null }, { "id": 74434, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591294", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591294", "securityControlId": 32077, "ccis": [], "uuid": "7146abc9-aa8b-5b2a-986b-eaf8544e222b", "testId": "TDA-15_A18", "test": "the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets organization-defined acceptance criteria.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(02)(d)[02]", "defaultText": null }, { "id": 74435, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591294", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591294", "securityControlId": 32077, "ccis": [], "uuid": "87f2fec3-1149-5bc4-a5d4-6713eb1ab392", "testId": "TDA-15_A19", "test": "the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that produces evidence that meets organization-defined acceptance criteria.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(02)(d)[03]", "defaultText": null }, { "id": 74436, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591294", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591294", "securityControlId": 32077, "ccis": [], "uuid": "b8ad9683-b224-54e4-a5ae-6590a7a3d709", "testId": "TDA-15_A20", "test": "the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets organization-defined acceptance criteria.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(02)(d)[04]", "defaultText": null } ], "externalMappings": [ { "id": 607017, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5809bf3c-530c-5ffb-b0ab-d216b5e152c2", "parentControlId": 32077, "controlId": "DM-2", "title": "DM-2", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590571" }, { "id": 607018, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c52af87-edc8-5038-9079-8ff7cc48a665", "parentControlId": 32077, "controlId": "DM-2(a)", "title": "DM-2(a)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590571" }, { "id": 607019, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18f348e7-09a5-5c74-8a09-afcfef095303", "parentControlId": 32077, "controlId": "DM-2(b)", "title": "DM-2(b)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590571" }, { "id": 607020, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8d06c11-f397-5be2-97b8-7edecd10bcd4", "parentControlId": 32077, "controlId": "DM-2(c)", "title": "DM-2(c)", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590571" }, { "id": 607032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31ab225b-efec-513f-ac5a-9ab39fec5d14", "parentControlId": 32077, "controlId": "SA-11(2)", "title": "SA-11(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590573" }, { "id": 607033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd94d373-0fe9-59fa-b854-e50efb802774", "parentControlId": 32077, "controlId": "SA-11(02)", "title": "SA-11(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590573" }, { "id": 607035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2cb0ea69-2ada-50dc-941d-a692b8d8da5b", "parentControlId": 32077, "controlId": "SA-11(02)", "title": "SA-11(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590574" }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "cf553b77-c546-5d9c-8d2c-816c20fe32a9", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "a24bf09d-3756-5b4f-b2a4-b0e723948b22", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "52ad32d4-aac8-5e41-bad0-7a6ae9611c64", "isPublic": true } ], "id": 32077, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731351", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731351", "catalogueId": 1062, "uuid": "2139f2aa-0525-518e-93b8-1807e686db8d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require system developers and integrators to create a Security Testing and Evaluation (ST&E) plan and implement the plan under the witness of an independent party?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Developer Threat Analysis & Flaw Remediation", "description": "

Control Description

Mechanisms exist to require system developers and integrators to develop and implement an ongoing Security Testing and Evaluation (ST&E) plan, or similar process, to objectively identify and remediate vulnerabilities prior to release to production.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Technology Development & Acquisition (TDA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TDA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Technology development & acquisition-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Secure development practices loosely conform to industry-recognized standards for secure engineering (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require system developers and integrators to develop and implement an ongoing Security Testing and Evaluation (ST&E) plan, or similar process, to objectively identify and remediate vulnerabilities prior to release to production.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-15", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-15", "references": "

Micro-Small Business (<10 staff)

∙ Security Testing and Evaluation (ST&E)

Small Business (10-49 staff)

∙ Security Testing and Evaluation (ST&E)

Medium Business (50-249 staff)

∙ Security Testing and Evaluation (ST&E)

Large Business (250-999 staff)

∙ Security Testing and Evaluation (ST&E)

Enterprise (>1,000 staff)

∙ Security Testing and Evaluation (ST&E)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74437, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591295", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591295", "securityControlId": 32078, "ccis": [], "uuid": "0359e632-6a31-5c1b-a512-c2bfe23c7961", "testId": "TDA-16_A01", "test": "training on the correct use and operation of the implemented cybersecurity / data privacy functions, controls, and/or mechanisms provided by the developer of the system, system component or system service is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-16_ODP", "defaultText": null }, { "id": 74438, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591295", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591295", "securityControlId": 32078, "ccis": [], "uuid": "67b1b94a-aab4-5fce-91b1-e9659f597578", "testId": "TDA-16_A02", "test": "the developer of the system, system component, or system service is required to provide training on the correct use and operation of the implemented cybersecurity / data privacy functions , controls, and/or mechanisms.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-16", "defaultText": null } ], "externalMappings": [ { "id": 607117, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a758cd60-4e02-52cf-aa94-09e9c37ea7a9", "parentControlId": 32078, "controlId": "T1078.001", "title": "T1078.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590596" }, { "id": 607118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6073cd85-7ba7-5c20-b2c4-8d63edacb549", "parentControlId": 32078, "controlId": "T1078.003", "title": "T1078.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590596" }, { "id": 607119, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f71d232-616a-5f3a-88c4-b292ece281dd", "parentControlId": 32078, "controlId": "T1574.002", "title": "T1574.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590596" }, { "id": 607120, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12ec0d3d-ffd2-5fae-9576-bd7a86325ed4", "parentControlId": 32078, "controlId": "SA-16", "title": "SA-16", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590596" }, { "id": 607121, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f0b89247-632b-513b-8ffd-c8ac6094b792", "parentControlId": 32078, "controlId": "SA-16", "title": "SA-16", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590596" }, { "id": 607122, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "936f29ed-7b27-5d73-96fd-3eefa996238d", "parentControlId": 32078, "controlId": "SA-16", "title": "SA-16", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590596" }, { "id": 607123, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6481aa08-9ec0-50b7-bad3-f8cb6ee0f773", "parentControlId": 32078, "controlId": "SA-16", "title": "SA-16", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590596" }, { "id": 607124, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e02a1a9-4ba4-584d-9858-3064844322f2", "parentControlId": 32078, "controlId": "SA-16", "title": "SA-16", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590596" }, { "id": 607125, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b26b4656-e68a-5fa7-bcae-3fd677358182", "parentControlId": 32078, "controlId": "SA-16", "title": "SA-16", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590596" }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "efe20910-c0a7-586a-a61e-cece25365897", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "0f9075b8-393c-5b3b-a7f7-81cda346ab75", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "29f900a5-c15c-5d32-ae72-3202ae09f249", "isPublic": true } ], "id": 32078, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731352", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731352", "catalogueId": 1062, "uuid": "b23a0adc-89a0-5ce5-bf69-c6f65b0c4b11", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require the developers of Technology Assets, Applications and/or Services (TAAS) to provide training on the correct use and operation of the Technology Asset, Application and/or Service (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Developer-Provided Training", "description": "

Control Description

Mechanisms exist to require the developers of Technology Assets, Applications and/or Services (TAAS) to provide training on the correct use and operation of the Technology Asset, Application and/or Service (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require the developers of Technology Assets, Applications and/or Services (TAAS) to provide training on the correct use and operation of the Technology Asset, Application and/or Service (TAAS).

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-16", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-16", "references": "

Large Business (250-999 staff)

∙ Formal privacy engineering practices in development lifecycle

Enterprise (>1,000 staff)

∙ Enterprise privacy engineering program\n∙ Privacy-by-design in SDLC\n∙ Privacy design patterns", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74439, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591295", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591295", "securityControlId": 32079, "ccis": [], "uuid": "0e09dabe-f17e-5867-b7c1-b02033884550", "testId": "TDA-17_A01", "test": "support from external providers is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-22_ODP[01]\n53A_R5_SA-22_ODP[02]", "defaultText": null }, { "id": 74440, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591295", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591295", "securityControlId": 32079, "ccis": [], "uuid": "fe9dba2c-4514-5516-8de6-de0faddfa0bb", "testId": "TDA-17_A02", "test": "system components are replaced when support for the components is no longer available from the developer, vendor, or manufacturer.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-22a.\n171A_R3_A.03.16.02.a", "defaultText": null } ], "externalMappings": [ { "id": 607134, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0afda9c-16af-5275-b69b-437048c5253c", "parentControlId": 32079, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590598" }, { "id": 607135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac85f7cf-57e7-5af3-a8ae-49e4e94a4db4", "parentControlId": 32079, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590598" }, { "id": 607136, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6fc854d3-e7ef-50ee-9713-97da8e646bd5", "parentControlId": 32079, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590598" }, { "id": 607137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9262a8e1-626a-509f-b9ee-62f01a56cc07", "parentControlId": 32079, "controlId": "T1195.002", "title": "T1195.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590598" }, { "id": 607138, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4bb3f139-efeb-5f07-b26c-61a18da2c5a2", "parentControlId": 32079, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590598" }, { "id": 607139, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590598", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6c05ecc-1512-552c-b186-387019ad6ef0", "parentControlId": 32079, "controlId": "T1543.002", "title": "T1543.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590598" }, { "id": 607142, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590599", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28ee888e-c253-5974-a426-9dbf6932e603", "parentControlId": 32079, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590599" }, { "id": 607143, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590599", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "293032cf-af04-50df-bc77-ca35ccb881a6", "parentControlId": 32079, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590599" }, { "id": 607145, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590599", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cef2165d-9b8e-5f37-8521-5d9a5de256f3", "parentControlId": 32079, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590599" }, { "id": 607146, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590599", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f16ab06-f231-563d-bb15-b824f6f6f647", "parentControlId": 32079, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590599" }, { "id": 607147, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590599", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd387123-311f-5e7e-a8d0-6f76763806b0", "parentControlId": 32079, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590599" }, { "id": 607148, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590599", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fcf7e600-c763-5e2a-bc4a-90ae77d7c24e", "parentControlId": 32079, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590599" }, { "id": 607149, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590599", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d805fea-23e9-52e8-bd9d-17b2988b228c", "parentControlId": 32079, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5906" }, { "id": 607150, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8949a1da-c9d9-5864-ad1c-2d67cf63c927", "parentControlId": 32079, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5906" }, { "id": 607151, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96f8bdf1-a5ec-5555-9402-2be45c84363f", "parentControlId": 32079, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5906" }, { "id": 607154, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43828d9d-f6c6-5f68-a38a-12ae6096a88f", "parentControlId": 32079, "controlId": "03.16.02.a", "title": "03.16.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5906" }, { "id": 607156, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "064275df-fd64-5be4-9d3f-cbe985417fcb", "parentControlId": 32079, "controlId": "PR.PS-02", "title": "PR.PS-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5906" }, { "id": 607157, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5906", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d588d3bf-c4be-50ae-9b81-8533ced3fc0c", "parentControlId": 32079, "controlId": "PR.PS-03", "title": "PR.PS-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5906" }, { "id": 607161, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8b582d8-48a6-521c-81df-7cf52993ec2b", "parentControlId": 32079, "controlId": "THIRD-PARTIES-2i", "title": "THIRD-PARTIES-2i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590601" }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "d4734514-33ec-5d7a-a1fa-999164c3592f", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "13f14fd4-0779-5285-b956-7624ddca4a35", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "94403bca-b47a-5edb-ab3f-4b8c64d3a3a5", "isPublic": true } ], "id": 32079, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731352", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731352", "catalogueId": 1062, "uuid": "89775c17-80c1-52a1-bfae-68f6651ab1ff", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prevent unsupported Technology Assets, Applications and/or Services (TAAS) by:\n(1) Removing and/or replacing TAAS when support for the components is no longer available from the developer, vendor or manufacturer; and\n(2) Requiring justification and documented approval for the continued use of unsupported TAAS required to satisfy mission/business needs?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Unsupported Technology Assets, Applications and/or Services (TAAS)", "description": "

Control Description

Mechanisms exist to prevent unsupported Technology Assets, Applications and/or Services (TAAS) by:\n(1) Removing and/or replacing TAAS when support for the components is no longer available from the developer, vendor or manufacturer; and\n(2) Requiring justification and documented approval for the continued use of unsupported TAAS required to satisfy mission/business needs.

Evidence Request List (ERL)

E-AST-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Technology Development & Acquisition (TDA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TDA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Technology development & acquisition-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Secure development practices loosely conform to industry-recognized standards for secure engineering (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.\n▪ An application development team, or similar function, provides in-house support or contract external providers for support with unsupported system components.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prevent unsupported Technology Assets, Applications and/or Services (TAAS) by:\n(1) Removing and/or replacing TAAS when support for the components is no longer available from the developer, vendor or manufacturer; and\n(2) Requiring justification and documented approval for the continued use of unsupported TAAS required to satisfy mission/business needs.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-17", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-17", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management\n∙ Computer Lifecycle Program (CLP)\n∙ IT Asset Management (ITAM) program\n∙ Risk Management Program (RMP)

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management\n∙ Computer Lifecycle Program (CLP)\n∙ IT Asset Management (ITAM) program\n∙ Risk Management Program (RMP)

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management\n∙ Computer Lifecycle Program (CLP)\n∙ IT Asset Management (ITAM) program\n∙ Risk Management Program (RMP)

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management\n∙ Computer Lifecycle Program (CLP)\n∙ IT Asset Management (ITAM) program\n∙ Risk Management Program (RMP)

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management\n∙ Computer Lifecycle Program (CLP)\n∙ IT Asset Management (ITAM) program\n∙ Risk Management Program (RMP)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74441, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591296", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591296", "securityControlId": 32080, "ccis": [], "uuid": "6a532eb2-cec1-5f25-949d-00714707587e", "testId": "TDA-17.1_A01", "test": "options for risk mitigation or alternative sources for continued support for unsupported components that cannot be replaced are provided.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-22b.\n171A_R3_A.03.16.02.b", "defaultText": null } ], "externalMappings": [ { "id": 607195, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ae64eb5-ef33-55b4-966b-7e1199547d07", "parentControlId": 32080, "controlId": "SA-22(1)", "title": "SA-22(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590605" }, { "id": 607196, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2b3f8a3-607a-5d3d-9040-9c698ae1b7bf", "parentControlId": 32080, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590605" }, { "id": 607198, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54fff4d9-7b49-5863-a116-7188c2b143dc", "parentControlId": 32080, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590605" }, { "id": 607199, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7bfb491e-2a5e-5b35-befa-77bb1065d8af", "parentControlId": 32080, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590605" }, { "id": 607200, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97eb0d01-24fb-56d7-aa2a-dec81327d993", "parentControlId": 32080, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590605" }, { "id": 607201, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590605", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "775516ec-2e48-5953-8b32-a062879a6232", "parentControlId": 32080, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590605" }, { "id": 607202, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6c66d50-b073-5c96-8dcf-7d0b7eb82309", "parentControlId": 32080, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590606" }, { "id": 607203, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "738b3211-a543-5eaa-ab83-92078a22a9e0", "parentControlId": 32080, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590606" }, { "id": 607204, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87c9af3a-cc0f-574d-a5d9-b63b35a1e3f9", "parentControlId": 32080, "controlId": "SA-22", "title": "SA-22", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590606" }, { "id": 607207, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d85bfe45-e055-5fa7-a85a-419ee5819d0e", "parentControlId": 32080, "controlId": "03.16.02.b", "title": "03.16.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590606" }, { "id": 607210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590606", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "346847ab-7590-59c3-95ed-a9da4938ab2d", "parentControlId": 32080, "controlId": "THIRD-PARTIES-2i", "title": "THIRD-PARTIES-2i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590606" } ], "id": 32080, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731352", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731352", "catalogueId": 1062, "uuid": "c104b40b-784b-51ee-9d56-227eeb235f85", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization provide in-house support or contract external providers for support with unsupported Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Alternate Sources for Continued Support", "description": "

Control Description

Mechanisms exist to provide in-house support or contract external providers for support with unsupported Technology Assets, Applications and/or Services (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to provide in-house support or contract external providers for support with unsupported Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-17.1", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-17.1", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74442, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591296", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591296", "securityControlId": 32081, "ccis": [], "uuid": "30da8cf7-e13e-55ec-9995-52e97517fc7c", "testId": "TDA-18_A01", "test": "information inputs to the system requiring validity checks are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-10_ODP", "defaultText": null }, { "id": 74443, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591296", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591296", "securityControlId": 32081, "ccis": [], "uuid": "a4277aee-e7b7-59f6-a38e-8a4f5b03f387", "testId": "TDA-18_A02", "test": "the validity of the organization-defined information inputs is checked.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-10", "defaultText": null }, { "id": 74444, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591296", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591296", "securityControlId": 32081, "ccis": [], "uuid": "bac3a320-0476-503d-ad39-46a6fc313537", "testId": "TDA-18_A03", "test": "approved authorizations for logical access to information and system resources are enforced in accordance with applicable access control policies.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_AC-03", "defaultText": null } ], "externalMappings": [ { "id": 607267, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d766320a-332c-5320-a2e1-1bf5d4b11436", "parentControlId": 32081, "controlId": "SR 3.5", "title": "SR 3.5", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590613" }, { "id": 607268, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fd53d1d-34ef-522b-970d-0c7d62eaf776", "parentControlId": 32081, "controlId": "CR 3.5", "title": "CR 3.5", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590613" }, { "id": 607269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db61318a-7dc4-51ff-b9e2-23877736a0da", "parentControlId": 32081, "controlId": "T1021.002", "title": "T1021.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590613" }, { "id": 607270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a503f2c-bd46-5613-b77e-710683072eaf", "parentControlId": 32081, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590613" }, { "id": 607271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9aaa3e02-c896-5cf4-bf3f-70be4300a195", "parentControlId": 32081, "controlId": "T1027.010", "title": "T1027.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590613" }, { "id": 607272, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb6b1a54-e50d-5dbe-a01f-8362f7f17381", "parentControlId": 32081, "controlId": "T1036", "title": "T1036", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590613" }, { "id": 607273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590613", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "144e573e-252a-5e5d-8ccf-a606b114291b", "parentControlId": 32081, "controlId": "T1036.005", "title": "T1036.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590614" }, { "id": 607274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acca23cc-ea26-5bab-b445-22b949a33111", "parentControlId": 32081, "controlId": "T1036.008", "title": "T1036.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590614" }, { "id": 607275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b373f73-1219-5a43-8c0d-7d52a419d7c2", "parentControlId": 32081, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590614" }, { "id": 607276, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53c60cde-833b-56df-b0d5-6cf5e8a11897", "parentControlId": 32081, "controlId": "T1048.001", "title": "T1048.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590614" }, { "id": 607277, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba921573-4257-5109-a0c2-221e32c61565", "parentControlId": 32081, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590614" }, { "id": 607278, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cbdf35bd-6fa5-5afd-ad11-f43dba717d1c", "parentControlId": 32081, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590614" }, { "id": 607279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab784473-eb05-58a1-b73c-46519e68f4c0", "parentControlId": 32081, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590614" }, { "id": 607280, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49349c63-55cc-52a8-9fc6-cddf48dd4c3f", "parentControlId": 32081, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590614" }, { "id": 607281, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f49dc6f2-86dd-5218-990c-2a19516dea8b", "parentControlId": 32081, "controlId": "T1059.002", "title": "T1059.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590614" }, { "id": 607282, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590614", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "25c97164-d3c4-52e0-a116-0d63697f632d", "parentControlId": 32081, "controlId": "T1059.003", "title": "T1059.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590614" }, { "id": 607283, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40c3b2ed-7902-56bf-90ba-e00dc95d50cd", "parentControlId": 32081, "controlId": "T1059.004", "title": "T1059.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590615" }, { "id": 607284, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "730af7cd-2dbb-565f-a83a-9421b45edb07", "parentControlId": 32081, "controlId": "T1059.005", "title": "T1059.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590615" }, { "id": 607285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "223b92f7-eea6-556e-b26c-48bf9443405f", "parentControlId": 32081, "controlId": "T1059.006", "title": "T1059.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590615" }, { "id": 607286, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "485db8b4-1c59-5c09-97cf-010ff558585a", "parentControlId": 32081, "controlId": "T1059.007", "title": "T1059.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590615" }, { "id": 607287, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e56a673-6fea-5d77-b9f7-570a2efe43d1", "parentControlId": 32081, "controlId": "T1059.008", "title": "T1059.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590615" }, { "id": 607288, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e3b5ef7-df5d-5cba-aad3-b2b2caf494e6", "parentControlId": 32081, "controlId": "T1071.004", "title": "T1071.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590615" }, { "id": 607289, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b99e4e49-fe23-5efe-ac2c-4f6e9f490264", "parentControlId": 32081, "controlId": "T1080", "title": "T1080", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590615" }, { "id": 607290, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590615", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f7521af-6ba4-572d-a171-f6495ec0de78", "parentControlId": 32081, "controlId": "T1090", "title": "T1090", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590615" }, { "id": 607291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d677204-1295-5fc8-b607-19e78be91866", "parentControlId": 32081, "controlId": "T1090.003", "title": "T1090.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590616" }, { "id": 607292, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bfd43ee-c92d-5571-b6a8-fcfd63867bc2", "parentControlId": 32081, "controlId": "T1095", "title": "T1095", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590616" }, { "id": 607293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45f943ef-a4a8-5590-b925-775066fceded", "parentControlId": 32081, "controlId": "T1127", "title": "T1127", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590616" }, { "id": 607294, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e8526f0-5249-5813-9139-bb11d8c821df", "parentControlId": 32081, "controlId": "T1127.002", "title": "T1127.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590616" }, { "id": 607295, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e58c99c-6108-5423-b4db-1ce8e97ac5a8", "parentControlId": 32081, "controlId": "T1129", "title": "T1129", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590616" }, { "id": 607296, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ff6ebfb-115f-5a05-aa51-7e11e1cd90dc", "parentControlId": 32081, "controlId": "T1176", "title": "T1176", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590616" }, { "id": 607297, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68b1e108-4095-5880-b967-799cc346384d", "parentControlId": 32081, "controlId": "T1187", "title": "T1187", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590616" }, { "id": 607298, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "021ec15d-374b-5b6e-b8d3-c5cc1b73f853", "parentControlId": 32081, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590616" }, { "id": 607299, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68507cb6-7d64-580a-89a8-8e085c27846c", "parentControlId": 32081, "controlId": "T1197", "title": "T1197", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590616" }, { "id": 607300, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590616", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fc7e0eb-57fd-59b1-9e24-0ade42725f03", "parentControlId": 32081, "controlId": "T1204", "title": "T1204", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590616" }, { "id": 607301, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5dad06b8-bc49-53a6-b8fa-5e72255da70c", "parentControlId": 32081, "controlId": "T1204.002", "title": "T1204.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590617" }, { "id": 607302, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7dc82ac5-7915-55cd-b787-64933ae70f29", "parentControlId": 32081, "controlId": "T1216", "title": "T1216", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590617" }, { "id": 607303, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92f53493-32b8-53eb-a817-f48d9d9960ec", "parentControlId": 32081, "controlId": "T1216.001", "title": "T1216.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590617" }, { "id": 607304, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dffe637a-055d-583d-940e-29aefe39a6ef", "parentControlId": 32081, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590617" }, { "id": 607305, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "71846d13-46cd-581f-9adf-4fb1b35b7f58", "parentControlId": 32081, "controlId": "T1218.001", "title": "T1218.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590617" }, { "id": 607306, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "833cd338-a49a-5c79-b90f-6a743df35535", "parentControlId": 32081, "controlId": "T1218.002", "title": "T1218.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590617" }, { "id": 607307, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e98f1132-a2eb-5b30-abb3-6ab1a5f699eb", "parentControlId": 32081, "controlId": "T1218.003", "title": "T1218.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590617" }, { "id": 607308, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fba91e4a-3c3e-5e7b-82f4-6a68f58d797b", "parentControlId": 32081, "controlId": "T1218.004", "title": "T1218.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590617" }, { "id": 607309, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39978959-96bf-5261-b9e1-47ea304449f2", "parentControlId": 32081, "controlId": "T1218.005", "title": "T1218.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590617" }, { "id": 607310, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50f2b919-72a9-5be0-8c7d-ca40061603df", "parentControlId": 32081, "controlId": "T1218.008", "title": "T1218.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590618" }, { "id": 607311, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ad76b96-bfd9-5ba8-997f-f67e95468db4", "parentControlId": 32081, "controlId": "T1218.009", "title": "T1218.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590618" }, { "id": 607312, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bd59d16-a71b-5867-84a5-ed45072250ec", "parentControlId": 32081, "controlId": "T1218.010", "title": "T1218.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590618" }, { "id": 607313, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a97a4fb-6d2d-556c-aac2-a277fed67de3", "parentControlId": 32081, "controlId": "T1218.011", "title": "T1218.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590618" }, { "id": 607314, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d14ffd2-3c55-5210-8235-393f762868fd", "parentControlId": 32081, "controlId": "T1218.012", "title": "T1218.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590618" }, { "id": 607315, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9aebda7c-90b9-57a2-bcaa-253cb5b8dc7b", "parentControlId": 32081, "controlId": "T1218.013", "title": "T1218.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590618" }, { "id": 607316, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83afabbe-872f-57ef-8cca-b3a0728f1d4b", "parentControlId": 32081, "controlId": "T1218.014", "title": "T1218.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590618" }, { "id": 607317, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d7bd4cf-eee7-590d-a8c2-90326192e2b9", "parentControlId": 32081, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590619" }, { "id": 607318, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d61286b2-c394-5354-97f9-05ed237b077d", "parentControlId": 32081, "controlId": "T1219", "title": "T1219", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590619" }, { "id": 607319, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa0da07a-d160-5ae9-8d86-3f5ed29b1dcb", "parentControlId": 32081, "controlId": "T1220", "title": "T1220", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590619" }, { "id": 607320, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b752545d-eb6a-5e84-84e0-00358062d80d", "parentControlId": 32081, "controlId": "T1221", "title": "T1221", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590619" }, { "id": 607321, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "941c87ba-d79a-52dd-adc4-c81128b5deaa", "parentControlId": 32081, "controlId": "T1498", "title": "T1498", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590619" }, { "id": 607322, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6408ace7-2c29-5bb3-817e-fd61da5a43e7", "parentControlId": 32081, "controlId": "T1498.001", "title": "T1498.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590619" }, { "id": 607323, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7021f19c-bc03-5ea1-bf05-9a3cf455d6af", "parentControlId": 32081, "controlId": "T1498.002", "title": "T1498.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590619" }, { "id": 607324, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc99d589-0dd7-5ec2-acc4-54957de97d24", "parentControlId": 32081, "controlId": "T1499", "title": "T1499", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590619" }, { "id": 607325, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88a1535e-eae4-502c-9ff8-a12d724261cd", "parentControlId": 32081, "controlId": "T1499.001", "title": "T1499.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590619" }, { "id": 607326, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "876c4ec1-221b-524e-b36a-3922009d804c", "parentControlId": 32081, "controlId": "T1499.002", "title": "T1499.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590619" }, { "id": 607327, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7ee21cc-06ff-597a-8336-a93d315a8e7d", "parentControlId": 32081, "controlId": "T1499.003", "title": "T1499.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59062" }, { "id": 607328, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e604c01d-dd31-5709-ae0a-dede608ef4ca", "parentControlId": 32081, "controlId": "T1499.004", "title": "T1499.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59062" }, { "id": 607329, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8811142d-56ed-56d8-a88e-997a29a5df0c", "parentControlId": 32081, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59062" }, { "id": 607330, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a0c6ae9-2d89-583b-a325-62cdb91edd63", "parentControlId": 32081, "controlId": "T1537", "title": "T1537", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59062" }, { "id": 607331, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5a3704d-fc67-517d-8387-1c8aaf1c5c60", "parentControlId": 32081, "controlId": "T1546.002", "title": "T1546.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59062" }, { "id": 607332, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7cf49f3d-f4dd-5457-8b2f-9228135a6bbc", "parentControlId": 32081, "controlId": "T1546.006", "title": "T1546.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59062" }, { "id": 607333, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94de82fa-b92a-52f9-810d-197925e978f2", "parentControlId": 32081, "controlId": "T1546.008", "title": "T1546.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59062" }, { "id": 607334, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "772ffc6b-973c-5f68-a709-6ebf619d3cba", "parentControlId": 32081, "controlId": "T1546.009", "title": "T1546.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59062" }, { "id": 607335, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a93c1a09-39c6-5078-a557-03b6136734a3", "parentControlId": 32081, "controlId": "T1546.010", "title": "T1546.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59062" }, { "id": 607336, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59062", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95859863-755c-5ec9-9beb-6f37c28273f9", "parentControlId": 32081, "controlId": "T1547.004", "title": "T1547.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590621" }, { "id": 607337, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aed3b265-b369-5ccf-885d-843920d9b2b7", "parentControlId": 32081, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590621" }, { "id": 607338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "456d8e35-b329-5e3f-a950-f85d5454cf66", "parentControlId": 32081, "controlId": "T1548.006", "title": "T1548.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590621" }, { "id": 607339, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c684fa0-5022-552b-bb41-fa77afb59b20", "parentControlId": 32081, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590621" }, { "id": 607340, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f442da1-eac3-5f15-97c7-22807910d7df", "parentControlId": 32081, "controlId": "T1552.005", "title": "T1552.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590621" }, { "id": 607341, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "552fa74e-9646-5cd3-8cac-dce0985aff34", "parentControlId": 32081, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590621" }, { "id": 607342, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c8e4234-543b-5708-a032-85b088b1467f", "parentControlId": 32081, "controlId": "T1553.001", "title": "T1553.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590621" }, { "id": 607343, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b088771a-394a-5039-921e-762e0cb01efd", "parentControlId": 32081, "controlId": "T1553.003", "title": "T1553.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590621" }, { "id": 607344, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "59c44df4-2837-5ab5-946d-7ceef0e59b1c", "parentControlId": 32081, "controlId": "T1553.005", "title": "T1553.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590622" }, { "id": 607345, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9c4cd07-6d28-5103-bb48-5e9078568317", "parentControlId": 32081, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590622" }, { "id": 607346, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc872a11-724b-5821-b92d-5a51c81dc982", "parentControlId": 32081, "controlId": "T1557.001", "title": "T1557.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590622" }, { "id": 607347, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "174e8e7f-d6cd-50ac-9cda-9d40ad0d99e0", "parentControlId": 32081, "controlId": "T1557.002", "title": "T1557.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590622" }, { "id": 607348, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6141525-8982-5a67-9ba2-98dc11eae4ad", "parentControlId": 32081, "controlId": "T1557.003", "title": "T1557.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590622" }, { "id": 607349, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b6abe51-544b-5202-b0c6-28f441c5ab53", "parentControlId": 32081, "controlId": "T1564.003", "title": "T1564.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590622" }, { "id": 607350, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5890cebc-107a-52c8-aefa-c4fc32fa5f51", "parentControlId": 32081, "controlId": "T1564.006", "title": "T1564.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590622" }, { "id": 607351, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "529670b6-557f-5aae-a9fb-44114ff1e3d1", "parentControlId": 32081, "controlId": "T1564.009", "title": "T1564.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590622" }, { "id": 607352, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f707b1d0-97f1-5d97-a7ee-4cd76183aa49", "parentControlId": 32081, "controlId": "T1570", "title": "T1570", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590622" }, { "id": 607353, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c5578158-3e4c-58d5-9598-1e9dc8eb512f", "parentControlId": 32081, "controlId": "T1572", "title": "T1572", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590622" }, { "id": 607354, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "726a88b4-e9fb-51f7-892f-f901a6508290", "parentControlId": 32081, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590623" }, { "id": 607355, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eec522a5-4d4a-5181-93b6-026aaa86c070", "parentControlId": 32081, "controlId": "T1574.001", "title": "T1574.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590623" }, { "id": 607356, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4cb328e-a21f-5e9c-ac06-cf961267a093", "parentControlId": 32081, "controlId": "T1574.006", "title": "T1574.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590623" }, { "id": 607357, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1741d8f7-e158-563a-ba6b-6071ef5a4d65", "parentControlId": 32081, "controlId": "T1574.007", "title": "T1574.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590623" }, { "id": 607358, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0659c9e1-e3a1-5aca-82e2-85605e4bcb51", "parentControlId": 32081, "controlId": "T1574.008", "title": "T1574.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590623" }, { "id": 607359, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7db2d474-1bce-5330-8bf4-71515db8f791", "parentControlId": 32081, "controlId": "T1574.009", "title": "T1574.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590623" }, { "id": 607360, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db5218f6-36d2-56c7-97d7-91c5af2ed007", "parentControlId": 32081, "controlId": "T1574.012", "title": "T1574.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590623" }, { "id": 607361, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0de95a0d-b14d-528b-bb10-ccbc69cf5897", "parentControlId": 32081, "controlId": "T1574.013", "title": "T1574.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590623" }, { "id": 607362, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eac555f4-e24b-54e2-8adf-fe2da4fe8151", "parentControlId": 32081, "controlId": "T1574.014", "title": "T1574.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590623" }, { "id": 607363, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "160f0860-50a8-5be6-ab8d-8a1381f78faf", "parentControlId": 32081, "controlId": "T1599", "title": "T1599", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590624" }, { "id": 607364, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d8c675b-de53-5106-97c0-1ac812b852d6", "parentControlId": 32081, "controlId": "T1599.001", "title": "T1599.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590624" }, { "id": 607365, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "427378d6-870f-5deb-9fee-d44c59de60c4", "parentControlId": 32081, "controlId": "T1602", "title": "T1602", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590624" }, { "id": 607366, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a15b46f-7490-57c2-937e-1aac0c2d91e8", "parentControlId": 32081, "controlId": "T1602.001", "title": "T1602.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590624" }, { "id": 607367, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "670f5031-bcff-5e90-aa65-5998bf3b4ac6", "parentControlId": 32081, "controlId": "T1602.002", "title": "T1602.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590624" }, { "id": 607368, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a96f4ad-409f-54b8-8bff-0bef989c08f1", "parentControlId": 32081, "controlId": "T1609", "title": "T1609", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590624" }, { "id": 607369, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b160a30d-26b5-5b8c-97f5-493e171923cf", "parentControlId": 32081, "controlId": "T1622", "title": "T1622", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590624" }, { "id": 607370, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590624", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c0dbcca-606c-5c82-93f4-bde59c929237", "parentControlId": 32081, "controlId": "SI-10", "title": "SI-10", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590624" }, { "id": 607371, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c8a085a-eb23-51c5-8604-aaafc854624a", "parentControlId": 32081, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590625" }, { "id": 607372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c432419-7cff-5a5f-99e4-ac40caec5b0f", "parentControlId": 32081, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590625" }, { "id": 607373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "209a6195-61fd-514b-ac61-a089ff86a9b9", "parentControlId": 32081, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590625" }, { "id": 607374, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72165315-c879-58ef-ac2d-798e8a452b06", "parentControlId": 32081, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590625" }, { "id": 607375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39ef08a8-0699-555a-a962-8a7cc14c08bf", "parentControlId": 32081, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590625" }, { "id": 607376, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "751c77f1-2f0d-503c-a718-8a1932a3c5f7", "parentControlId": 32081, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590625" }, { "id": 607377, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "feda8ffa-66cd-54ee-a48e-d439d8456d65", "parentControlId": 32081, "controlId": "SI-07", "title": "SI-07", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590625" }, { "id": 607378, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e136c49-d662-515d-9268-1f9e9e527a89", "parentControlId": 32081, "controlId": "SI-10", "title": "SI-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590625" }, { "id": 607387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c5c338f-c0bf-5263-b4e9-f13794db1b4c", "parentControlId": 32081, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590626" }, { "id": 607388, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fab10ee7-f782-533a-935f-d25f94226bfd", "parentControlId": 32081, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590626" }, { "id": 607389, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15b19f4a-ee68-5971-8851-62f4b05638de", "parentControlId": 32081, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590627" }, { "id": 607390, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3f3c809-7843-56d7-9b0b-039f59f10f77", "parentControlId": 32081, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590627" }, { "id": 607391, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3eddfa6a-8e68-5cd0-8787-787e765e3a76", "parentControlId": 32081, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590627" }, { "id": 607392, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2b3a2da-070a-5f31-956f-3db661e00324", "parentControlId": 32081, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590627" }, { "id": 607393, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d36a9127-09ee-5f05-9012-61ea8503dc21", "parentControlId": 32081, "controlId": "SI-07", "title": "SI-07", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590627" }, { "id": 607394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af8c37ef-7a5f-5830-83ae-26c7094efbae", "parentControlId": 32081, "controlId": "SI-10", "title": "SI-10", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590627" }, { "id": 607395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82deec6c-0fab-5803-b96e-39f105c5747f", "parentControlId": 32081, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590627" }, { "id": 607396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4decd16-21f5-5b69-80af-b6006bda23fd", "parentControlId": 32081, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590627" }, { "id": 607397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c46e30a8-078a-5283-9c9d-b08e09010e81", "parentControlId": 32081, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590628" }, { "id": 607398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d9df90e-5049-533d-ae5d-34c2bb9a6d7a", "parentControlId": 32081, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590628" }, { "id": 607399, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12ad7674-be03-5c9d-a56b-c57f2e585788", "parentControlId": 32081, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590628" }, { "id": 607400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9605e0d5-2bd5-5f7b-af43-02dcd6f11181", "parentControlId": 32081, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590628" }, { "id": 607401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e46dcf3e-2a7a-54a4-a1d2-5aedaccebf28", "parentControlId": 32081, "controlId": "SI-07", "title": "SI-07", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590628" }, { "id": 607402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "689baf73-8db7-5d9c-9ffa-bc6a8b800dc1", "parentControlId": 32081, "controlId": "SI-10", "title": "SI-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590628" }, { "id": 607403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b8471ab-4432-5dc3-9dc8-86c6461535ad", "parentControlId": 32081, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590628" }, { "id": 607404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83b73a39-b9bb-54bb-9417-250a1e11841e", "parentControlId": 32081, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590628" }, { "id": 607405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e86725ea-44e2-5b90-b8bb-f380b87e5256", "parentControlId": 32081, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590628" }, { "id": 607406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8dacf986-27a0-5bc2-8e57-74c8d5f5a6c7", "parentControlId": 32081, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590629" }, { "id": 607407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f97b0f5-a112-5938-91c5-6a3b74d23200", "parentControlId": 32081, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590629" }, { "id": 607408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31534da5-7b6e-55a6-b1b8-2d302004b2a4", "parentControlId": 32081, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590629" }, { "id": 607409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ecac3ac-d99f-525f-8404-cff5bafa3315", "parentControlId": 32081, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590629" }, { "id": 607410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33985374-891a-5581-b3b3-7cc5ebe456e5", "parentControlId": 32081, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590629" }, { "id": 607411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da5ed24a-3260-5097-96a0-5b63e5cf1e82", "parentControlId": 32081, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590629" }, { "id": 607412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32c950a5-99a1-5c4e-9598-4fc1e8a479d5", "parentControlId": 32081, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590629" }, { "id": 607413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f3cea6a3-9360-5194-a384-9f03551c08ef", "parentControlId": 32081, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590629" }, { "id": 607414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd5fc2fd-3130-5231-ac12-9bb59a9f4b3d", "parentControlId": 32081, "controlId": "SI-07", "title": "SI-07", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590629" }, { "id": 607415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590629", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "299d816b-5668-5902-ad80-dd12bd6f5325", "parentControlId": 32081, "controlId": "SI-10", "title": "SI-10", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590629" }, { "id": 607416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f9e580f3-77fa-5c97-9604-4c194b1bb174", "parentControlId": 32081, "controlId": "AC-02", "title": "AC-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590638" }, { "id": 607417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2dcc96a7-fe7d-55d6-bf1b-699c53ebbf3f", "parentControlId": 32081, "controlId": "AC-03", "title": "AC-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590638" }, { "id": 607418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc81939b-be2f-5071-9356-02421b4433bf", "parentControlId": 32081, "controlId": "AC-05", "title": "AC-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590638" }, { "id": 607419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3b8ee32-0f14-52ee-a6b4-8e87487f9828", "parentControlId": 32081, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590638" }, { "id": 607420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13ef8178-7353-56b6-88a1-e3727800240d", "parentControlId": 32081, "controlId": "SI-04", "title": "SI-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590638" }, { "id": 607421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "870e5292-9b77-52d2-9bec-8db7d4482b99", "parentControlId": 32081, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590638" }, { "id": 607422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "495b9ff2-cc7d-5160-be47-ece03d25d511", "parentControlId": 32081, "controlId": "SI-07", "title": "SI-07", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590638" }, { "id": 607423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21a9c6ef-1254-5fce-a0ba-44dcd4c04b9f", "parentControlId": 32081, "controlId": "SI-10", "title": "SI-10", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590639" }, { "id": 607425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90f9dddf-199d-5f7c-86e2-08644ddcaa28", "parentControlId": 32081, "controlId": "AC-2", "title": "AC-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590639" }, { "id": 607426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "336d7e25-f4a5-5004-9d31-feb2de611751", "parentControlId": 32081, "controlId": "AC-3", "title": "AC-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590639" }, { "id": 607427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c2687c4-818f-5605-ace3-dc6acdc3bad1", "parentControlId": 32081, "controlId": "AC-5", "title": "AC-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590639" }, { "id": 607428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d53fef2-27c6-59ea-a851-bb2b1fb19049", "parentControlId": 32081, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590639" }, { "id": 607429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9cfc35d4-fc97-5918-b784-2a0f47ff26b5", "parentControlId": 32081, "controlId": "SI-4", "title": "SI-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590639" }, { "id": 607430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23eb7bfa-25c7-539e-9b0f-66541ba40712", "parentControlId": 32081, "controlId": "SI-5", "title": "SI-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590639" }, { "id": 607431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be294cc2-6d8e-5c3e-9db9-2a2099ad9272", "parentControlId": 32081, "controlId": "SI-7", "title": "SI-7", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590639" }, { "id": 607432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "311454bc-e5c7-515d-a8c6-ce75e3703775", "parentControlId": 32081, "controlId": "AC-2", "title": "AC-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59064" }, { "id": 607433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "31661562-c4c7-599c-a7f0-ae49f783bc26", "parentControlId": 32081, "controlId": "AC-3", "title": "AC-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59064" }, { "id": 607434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ecc1562-6015-59ba-a983-1f81191a9265", "parentControlId": 32081, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59064" }, { "id": 607435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b8cab9d-6776-5dbd-996f-afa0a21b8527", "parentControlId": 32081, "controlId": "SI-4", "title": "SI-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59064" }, { "id": 607436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2308fc5-0e64-5756-a713-6ff8d28ae5d7", "parentControlId": 32081, "controlId": "SI-5", "title": "SI-5", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59064" }, { "id": 607437, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eaf44717-d1d9-5531-95d4-bae187e6fded", "parentControlId": 32081, "controlId": "SI-7", "title": "SI-7", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59064" }, { "id": 607438, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02582488-307d-5d36-a7ec-3eb268fd5f6b", "parentControlId": 32081, "controlId": "AC-2", "title": "AC-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59064" }, { "id": 607439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef185fbe-b405-5d4b-bbda-8a014d974031", "parentControlId": 32081, "controlId": "AC-3", "title": "AC-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59064" }, { "id": 607440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59064", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc16aaf0-0044-58d8-be1d-f31c463cb65d", "parentControlId": 32081, "controlId": "AC-5", "title": "AC-5", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59064" }, { "id": 607441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590641", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a455142e-4b67-5ba0-9f1d-f36b4f2234a4", "parentControlId": 32081, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590641" }, { "id": 607442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590641", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41932896-70d3-58fa-9ede-0d7e05e07599", "parentControlId": 32081, "controlId": "SI-4", "title": "SI-4", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590641" }, { "id": 607443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590641", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a5ecc6f-7672-5557-bfbc-7566f0dfdfc7", "parentControlId": 32081, "controlId": "SI-5", "title": "SI-5", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590641" }, { "id": 607444, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590641", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b690ffe-f367-5f79-b134-a627437c4565", "parentControlId": 32081, "controlId": "SI-7", "title": "SI-7", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590641" }, { "controlId": "C.3.8", "title": "C.3.8 — Information Input Restrictions", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-10", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "f5fe8e94-c95d-536e-b1aa-e35983fa3cbe", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.8", "title": "NEI 08-09 App E.3.8 — Information Input Restrictions", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.8", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "79a5fc66-d97f-56dc-8949-7848dac32ed0", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.3.8", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "60e1c83a-c185-5ce5-bcb8-854f4856ac0a", "isPublic": true }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "b7bd020d-4367-5a6f-914c-4149515c5857", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "c9063f5a-e067-50f8-9ba3-e915c1432be6", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "aae962eb-3d01-567d-a444-8ec34a4512a2", "isPublic": true } ], "id": 32081, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731353", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731353", "catalogueId": 1062, "uuid": "a6c04889-890f-539c-8849-7c87116dba25", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization check the validity of information inputs?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Input Data Validation", "description": "

Control Description

Mechanisms exist to check the validity of information inputs.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Technology Development & Acquisition (TDA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TDA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Technology development & acquisition-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Secure development practices loosely conform to industry-recognized standards for secure engineering (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to check the validity of information inputs.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.3.8", "controlId": "TDA-18", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-18", "references": "

Enterprise (>1,000 staff)

∙ Enterprise formal methods or model-based design for highest-assurance systems", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74445, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591297", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591297", "securityControlId": 32082, "ccis": [], "uuid": "81481d1a-b881-560e-b62b-7c5edae48b00", "testId": "TDA-19_A01", "test": "personnel or roles to whom error messages are to be revealed is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-11_ODP", "defaultText": null }, { "id": 74446, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591297", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591297", "securityControlId": 32082, "ccis": [], "uuid": "9725c09f-f5f0-5ebf-9b43-7a891c3ed294", "testId": "TDA-19_A02", "test": "error messages that provide the information necessary for corrective actions are generated without revealing information that could be exploited.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-11a.", "defaultText": null }, { "id": 74447, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591297", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591297", "securityControlId": 32082, "ccis": [], "uuid": "b8eb3ebe-9c99-51cd-9fc2-87178bfb271a", "testId": "TDA-19_A03", "test": "error messages are revealed only to organization-defined personnel or roles.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-11b.", "defaultText": null } ], "externalMappings": [ { "id": 607545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "265d71aa-715c-5cea-a654-49d77797b7e6", "parentControlId": 32082, "controlId": "SR 3.7", "title": "SR 3.7", "catalog": "IEC 62443-3-3 (2013)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590653" }, { "id": 607546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf346ed3-c4e5-5f01-b645-caacbba68008", "parentControlId": 32082, "controlId": "CR 3.7", "title": "CR 3.7", "catalog": "IEC 62443-4-2 (2019)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590653" }, { "id": 607548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8924cb46-cdd3-5b33-96e6-c043ccb3054f", "parentControlId": 32082, "controlId": "SI-11", "title": "SI-11", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590653" }, { "id": 607549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa293a2e-953c-53fc-8ad5-ed13d9255125", "parentControlId": 32082, "controlId": "SI-11", "title": "SI-11", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590653" }, { "id": 607550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "588b2848-54f8-5d39-a8a4-f44efa4960c1", "parentControlId": 32082, "controlId": "SI-11", "title": "SI-11", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590653" }, { "id": 607551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590653", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "368f48f4-9c55-5bea-9056-b2986b168f46", "parentControlId": 32082, "controlId": "SI-11", "title": "SI-11", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590653" }, { "id": 607552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590654", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "635c7abb-7b65-5d6b-a0af-cf521c35792b", "parentControlId": 32082, "controlId": "SI-11", "title": "SI-11", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590654" }, { "id": 607553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590654", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "002b66f3-0be6-587d-af1e-d0babdf94a75", "parentControlId": 32082, "controlId": "SI-11", "title": "SI-11", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590654" }, { "controlId": "C.3.9", "title": "C.3.9 — Error Handling", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-11", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "35138a93-f7f0-5ed5-9272-8e63ebb87b90", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.9", "title": "NEI 08-09 App E.3.9 — Error Handling", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.9", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "ed1086e4-b6b1-54a6-bada-1fc9e957a601", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.3.9", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "bf7d0e37-c856-5c20-aae2-fdce540c2b86", "isPublic": true }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "7bce98db-bc78-56d0-9de6-e26ae0a32979", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "bd630e78-6d6d-5aa3-af2c-2614bb12e20a", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "81690a10-1685-54b9-956d-6e2e0fc1454d", "isPublic": true } ], "id": 32082, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731353", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731353", "catalogueId": 1062, "uuid": "b9140674-56fc-5b9a-a2a6-1ca3e932a7e3", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization handle error conditions by: \n (1) Identifying potentially security-relevant error conditions;\n (2) Generating error messages that provide information necessary for corrective actions without revealing sensitive or potentially harmful information in error logs and administrative messages that could be exploited; and\n (3) Revealing error messages only to authorized personnel?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Error Handling", "description": "

Control Description

Mechanisms exist to handle error conditions by: \n(1) Identifying potentially security-relevant error conditions;\n(2) Generating error messages that provide information necessary for corrective actions without revealing sensitive or potentially harmful information in error logs and administrative messages that could be exploited; and\n(3) Revealing error messages only to authorized personnel.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to handle error conditions by: \n(1) Identifying potentially security-relevant error conditions;\n(2) Generating error messages that provide information necessary for corrective actions without revealing sensitive or potentially harmful information in error logs and administrative messages that could be exploited; and\n(3) Revealing error messages only to authorized personnel.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.3.9", "controlId": "TDA-19", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-19", "references": "

Enterprise (>1,000 staff)

∙ Enterprise reverse engineering controls for high-assurance systems\n∙ Code obfuscation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74448, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591298", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591298", "securityControlId": 32083, "ccis": [], "uuid": "1c152b4f-caec-5399-8209-b516a9b97725", "testId": "TDA-20_A01", "test": "organization-defined criteria for security-relevant information pertaining to external system interfaces, high-level design, low-level design, source code or hardware schematics and design and implementation information are documented in a System Security Plan (SSP).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(02)_ODP[01]", "defaultText": null }, { "id": 74449, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591298", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591298", "securityControlId": 32083, "ccis": [], "uuid": "e0ccbf10-5e24-5c84-9b87-72d319022da1", "testId": "TDA-20_A04", "test": "the developer of the system, system component or system service is required to provide design and implementation information for the controls that includes using at level of detail.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04(02)", "defaultText": null } ], "externalMappings": [ { "id": 607569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590655", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fce65969-d2db-5d3e-8d11-d8d1531776b6", "parentControlId": 32083, "controlId": "8.4", "title": "8.4", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590655" }, { "id": 607570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "267d58b8-7ff2-5259-919d-1fe86107ea40", "parentControlId": 32083, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590656" }, { "id": 607576, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b191f1fa-d82c-53a9-a110-7aa88524ea05", "parentControlId": 32083, "controlId": "SA-04(02)", "title": "SA-04(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590656" }, { "id": 607578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a85ace13-778c-5e29-a227-425574f3e5a3", "parentControlId": 32083, "controlId": "SA-04(02)", "title": "SA-04(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590656" }, { "id": 607579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590656", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ea882a2-396f-59bf-8131-af67d22376ff", "parentControlId": 32083, "controlId": "SA-04(02)", "title": "SA-04(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590657" }, { "id": 607580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590657", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "273fc54b-3d70-5669-8131-73d4a1d8c792", "parentControlId": 32083, "controlId": "SA-04(02)", "title": "SA-04(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590657" }, { "id": 607581, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590657", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "673180b1-7b37-52ed-b5da-4cf736636426", "parentControlId": 32083, "controlId": "SA-04(02)", "title": "SA-04(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590657" }, { "controlId": "IEC-62645-6.1", "title": "IEC-62645-6.1 — Secure Development Lifecycle & Factory Acceptance Testing (FAT) / SAT", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "eecdf0be-c7d3-510c-87bf-3508afa4ac1e", "isPublic": true }, { "controlId": "IEC-63096-14.1", "title": "IEC-63096-14.1 — Security Requirements of Nuclear Information & I&C Systems", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "9ae0f428-9736-5dbd-9314-df734dba11c6", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.4", "title": "IEEE-7-4.3.2-5.4 — Independent Verification & Validation (IV&V) and Software Testing", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TDA Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "48e6cc4e-7383-53c7-9db6-1e2c60d5db16", "isPublic": true } ], "id": 32083, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731353", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731353", "catalogueId": 1062, "uuid": "3e7d7fcf-a718-5315-8a11-573af6654316", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization limit privileges to change software resident within software libraries?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Access to Program Source Code", "description": "

Control Description

Mechanisms exist to limit privileges to change software resident within software libraries.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.\n▪ An application development team, or similar function, uses a Source Code Manager (SCM) solution to govern modifying, copying, deleting, moving and renaming items in the software library.\n▪ SCM supports integrity checking on the source code repository.\n▪ SCM uses Role-Based Access Controls (RBAC) to limit the logical access and permissions for users in the software library.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to limit privileges to change software resident within software libraries.

Level 4 - Quantitatively Controlled: Technology Development & Acquisition (TDA) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-20", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-20", "references": "

Large Business (250-999 staff)

∙ Enterprise managed development interfaces\n∙ API governance for development tools

Enterprise (>1,000 staff)

∙ Enterprise development interface management platform\n∙ API gateway for development tools\n∙ Automated interface governance", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74453, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591299", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591299", "securityControlId": 32087, "ccis": [], "uuid": "6f43ecab-43d7-5ee4-a911-2637aa6939b4", "testId": "TDA-20.4_A01", "test": "approval of binaries and code for production use is governed through organizational change control processes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 607631, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590662", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23377f10-2002-538e-95f0-68ed367a7ccc", "parentControlId": 32087, "controlId": "SM-8", "title": "SM-8", "catalog": "IEC 62443-4-1 (2018)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590662" } ], "id": 32087, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731355", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731355", "catalogueId": 1062, "uuid": "de4f538f-f874-5f3e-ae56-baf51152400d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization govern the approval of binaries and code for production use?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Approved Code", "description": "

Control Description

Mechanisms exist to govern the approval of binaries and code for production use.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218, NIST SP 800-160, etc.).\n▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 - Well Defined: Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.\n▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution, software testing tools, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to govern the approval of binaries and code for production use.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TDA-20.4", "family": "Technology Development & Acquisition", "enhancements": "", "sortId": "TDA-20.4", "references": "

Enterprise (>1,000 staff)

∙ Enterprise development interface security program\n∙ Formal access governance for all development interfaces", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74458, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591301", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591301", "securityControlId": 32091, "ccis": [], "uuid": "2960e508-013e-5a36-b5b6-6c91160ce1b4", "testId": "TPM-01_A01", "test": "security requirements to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences from supply chain-related events are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.17.03.ODP[01]", "defaultText": null }, { "id": 74459, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591301", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591301", "securityControlId": 32091, "ccis": [], "uuid": "857d5707-ad26-5c48-9282-9343564ec0ba", "testId": "TPM-01_A02", "test": "cybersecurity / data privacy functional requirements, descriptions and criteria are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04a.[01]\n53A_R5_SA-04a.[02]", "defaultText": null }, { "id": 74460, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591301", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591301", "securityControlId": 32091, "ccis": [], "uuid": "56d3bc29-54d3-542c-9e50-b2cd0b3d349c", "testId": "TPM-01_A03", "test": "requirements for protecting cybersecurity / data privacy documentation, descriptions and criteria are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04f.[01]\n53A_R5_SA-04f.[02]", "defaultText": null }, { "id": 74461, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591302", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591302", "securityControlId": 32091, "ccis": [], "uuid": "2a3c278c-858d-5d8c-80c6-2f091cffb492", "testId": "TPM-01_A04", "test": "strength of mechanism requirements, descriptions and criteria are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04b.", "defaultText": null }, { "id": 74462, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591302", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591302", "securityControlId": 32091, "ccis": [], "uuid": "77f0c534-50ec-51d1-9bda-cde85e1275cf", "testId": "TPM-01_A05", "test": "cybersecurity / data privacy assurance requirements, descriptions and criteria are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04c.[01]\n53A_R5_SA-04c.[02]", "defaultText": null }, { "id": 74463, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591302", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591302", "securityControlId": 32091, "ccis": [], "uuid": "44bdcf00-528d-588f-9985-4f3aca8f02a8", "testId": "TPM-01_A06", "test": "controls needed to satisfy the cybersecurity / data privacy requirements, descriptions and criteria are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04d.[01]\n53A_R5_SA-04d.[02]", "defaultText": null }, { "id": 74464, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591302", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591302", "securityControlId": 32091, "ccis": [], "uuid": "40856625-1499-5755-9481-2d35d7056ddd", "testId": "TPM-01_A07", "test": "cybersecurity / data privacy documentation requirements, descriptions and criteria are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-04e.[01]\n53A_R5_SA-04e.[02]", "defaultText": null }, { "id": 74465, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591303", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591303", "securityControlId": 32091, "ccis": [], "uuid": "4a13cfe1-d74d-504c-ae8a-29a068a68064", "testId": "TPM-01_A08", "test": "the description of the system development environment and environment in which the system is intended to operate, requirements and criteria are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-04g.", "defaultText": null }, { "id": 74466, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591303", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591303", "securityControlId": 32091, "ccis": [], "uuid": "2fef6ba4-8291-55a1-b46d-21d0c445bc48", "testId": "TPM-01_A09", "test": "the allocation of responsibility or identification of parties responsible for cybersecurity / data privacy requirements, descriptions and criteria are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-04h.[01]\n53A_R5_SA-04h.[02]", "defaultText": null }, { "id": 74467, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591303", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591303", "securityControlId": 32091, "ccis": [], "uuid": "eba0e27f-a4c9-5a8c-a438-5596088a0f39", "testId": "TPM-01_A10", "test": "the allocation of responsibility or identification of parties responsible for supply chain risk management requirements, descriptions and criteria are included explicitly or by reference using organization-defined criteria.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-04h.[03]", "defaultText": null }, { "id": 74468, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591303", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591303", "securityControlId": 32091, "ccis": [], "uuid": "5b350dfe-3363-504a-bc80-4932f3588e7c", "testId": "TPM-01_A11", "test": "acceptance criteria requirements and descriptions are included explicitly or by reference using in the acquisition contract for the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-04i.", "defaultText": null }, { "id": 74469, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591303", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591303", "securityControlId": 32091, "ccis": [], "uuid": "0cc4c914-7a7e-5547-8bf7-2b2d5d80a1a3", "testId": "TPM-01_A12", "test": "contract language is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-04_ODP[01]\n53A_R5_SA-04_ODP[02]", "defaultText": null }, { "id": 74470, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591303", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591303", "securityControlId": 32091, "ccis": [], "uuid": "86c762af-fcf8-59fd-af54-51866c51ef3f", "testId": "TPM-01_A13", "test": "third-party management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74471, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591304", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591304", "securityControlId": 32091, "ccis": [], "uuid": "76f2bcbe-89d3-531b-86c0-3103179f5fcc", "testId": "TPM-01_A14", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support third-party management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74472, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591304", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591304", "securityControlId": 32091, "ccis": [], "uuid": "77d2072d-8172-5a54-8167-5daebab07800", "testId": "TPM-01_A15", "test": "responsibility and authority for the performance of third-party management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74473, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591304", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591304", "securityControlId": 32091, "ccis": [], "uuid": "a18a4f0f-e729-58db-9e07-4bafdb21b78f", "testId": "TPM-01_A16", "test": "personnel performing third-party management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 607742, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "261e29ab-6f9c-5559-8bc7-081072d330d0", "parentControlId": 32091, "controlId": "ORG 1.6", "title": "ORG 1.6", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590683" }, { "id": 607744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bd02587-df1e-5692-b561-9fca2467ab9f", "parentControlId": 32091, "controlId": "5.19", "title": "5.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590683" }, { "id": 607745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09426b82-9089-5fc1-89a1-4b216e1301da", "parentControlId": 32091, "controlId": "5.2", "title": "5.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590683" }, { "id": 607746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590683", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e059f80f-65ff-5f0e-a354-57b2f3d677e3", "parentControlId": 32091, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590684" }, { "id": 607765, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e48e8d0-854a-5801-8111-be0ae80ecfad", "parentControlId": 32091, "controlId": "SA-4", "title": "SA-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590686" }, { "id": 607766, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4aee13a9-7512-51b0-a598-055541b43151", "parentControlId": 32091, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590686" }, { "id": 607767, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a8339fc-f43a-53c6-b585-f0f2762b5a3c", "parentControlId": 32091, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590686" }, { "id": 607770, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69bf2131-ce2f-55f8-9001-08966940cd0c", "parentControlId": 32091, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590686" }, { "id": 607771, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9995c427-a6c9-553d-badc-a89ff5e444f2", "parentControlId": 32091, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590686" }, { "id": 607774, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b1f8d73d-ff67-5efb-b327-5002a95e17a3", "parentControlId": 32091, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590687" }, { "id": 607775, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f38be85-a927-515d-bcaa-862e94fec540", "parentControlId": 32091, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590687" }, { "id": 607776, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "241c1d2b-cf7e-5dcd-a39f-620456aa656c", "parentControlId": 32091, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590687" }, { "id": 607777, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85648759-f7ed-559d-8219-c0c21e5574d8", "parentControlId": 32091, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590687" }, { "id": 607778, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "45989b7f-8e12-5c9d-96ba-d02b6f5a6093", "parentControlId": 32091, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590687" }, { "id": 607779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33976cb7-5cc0-54c8-b69e-7644069394cb", "parentControlId": 32091, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590687" }, { "id": 607780, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4e83719-5be9-5703-a51b-2884a8906318", "parentControlId": 32091, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590687" }, { "id": 607781, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7b3607b1-f6cd-5746-bdbc-403d8f8defdd", "parentControlId": 32091, "controlId": "SR-01", "title": "SR-01", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590687" }, { "id": 607782, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "93518d20-5a35-5cca-b6e1-578fe4feb73c", "parentControlId": 32091, "controlId": "SA-4", "title": "SA-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590688" }, { "id": 607783, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49f46af7-4b17-592d-b709-d74e0d3c4967", "parentControlId": 32091, "controlId": "SR-1", "title": "SR-1", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590688" }, { "id": 607784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4bc1ab9f-6e87-575a-ab9e-a04cc270640b", "parentControlId": 32091, "controlId": "SA-4", "title": "SA-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590688" }, { "id": 607785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62f754e1-bfd6-5574-b2e5-d4e2cfe9cfae", "parentControlId": 32091, "controlId": "SR-1", "title": "SR-1", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590688" }, { "id": 607792, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c21d13bf-b982-5969-be4a-c920bd0fdc82", "parentControlId": 32091, "controlId": "3.1.1", "title": "3.1.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590689" }, { "id": 607793, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b94fa0d2-3e94-5dad-897a-a19b6d95a5b7", "parentControlId": 32091, "controlId": "NFO - SA-4", "title": "NFO - SA-4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590689" }, { "id": 607794, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bb5eaa84-5ea2-5fd0-a24e-9ba83a7c59bf", "parentControlId": 32091, "controlId": "03.01.20.a", "title": "03.01.20.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590689" }, { "id": 607795, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b563e985-bbe6-558c-b5ca-a367e619edda", "parentControlId": 32091, "controlId": "03.01.20.b", "title": "03.01.20.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590689" }, { "id": 607796, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f1d211c-4184-55e5-98da-bd3d2c8c0a0c", "parentControlId": 32091, "controlId": "03.01.20.c.01", "title": "03.01.20.c.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590689" }, { "id": 607797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20706499-fac6-5f73-8ddb-cf1173f77876", "parentControlId": 32091, "controlId": "03.07.06.a", "title": "03.07.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590689" }, { "id": 607798, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f94972e5-9679-5526-8acc-9b3ecc0018be", "parentControlId": 32091, "controlId": "03.16.01", "title": "03.16.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59069" }, { "id": 607799, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80faad6f-0e62-5755-988f-cbcced853cc4", "parentControlId": 32091, "controlId": "03.16.03.a", "title": "03.16.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59069" }, { "id": 607801, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abf38c8b-bdce-5f2e-915d-4ebce56f5ddb", "parentControlId": 32091, "controlId": "GV.SC-04", "title": "GV.SC-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59069" }, { "id": 607802, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8227fd31-240b-5a48-9b09-4e4521af0035", "parentControlId": 32091, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59069" }, { "id": 607803, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "266d1fa0-f4e5-5a2a-b7cb-7fb66d2f7657", "parentControlId": 32091, "controlId": "GV.SC-07", "title": "GV.SC-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59069" }, { "id": 607804, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9a978308-584e-535e-88e7-fb91670ac957", "parentControlId": 32091, "controlId": "GV.SC-08", "title": "GV.SC-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59069" }, { "id": 607805, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c024cfce-bd0c-5d00-9c1c-738036aed570", "parentControlId": 32091, "controlId": "GV.SC-10", "title": "GV.SC-10", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59069" }, { "id": 607806, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f8e8a61-a2d3-5940-bc4f-3dc1c9d60c3e", "parentControlId": 32091, "controlId": "ID.AM", "title": "ID.AM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59069" }, { "id": 607927, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f12a509-60a0-5928-875b-37be16c4dfc7", "parentControlId": 32091, "controlId": "A4", "title": "A4", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590704" }, { "controlId": "C.12.1", "title": "C.12.1 — System and Services Acquisition Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SA-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "e3736b2a-3fc8-58dd-9c9d-103a22d50f79", "isPublic": true }, { "controlId": "NEI 08-09 App E.12.1 / NEI 10-08", "title": "NEI 08-09 App E.12.1 / NEI 10-08 — System and Services Acquisition Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.12.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "5031d5a5-8bc6-570d-b415-1ce75b8cdee7", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(4)", "title": "10 CFR 73.54(d)(4) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.12.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "4cc34f83-4913-54d1-8aa9-a022f238d40e", "isPublic": true }, { "controlId": "NSS-17T-Sec4.6", "title": "NSS-17T-Sec4.6 — Supply Chain & Vendor Computer Security Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "7fae70dd-224f-53a7-a2ce-dc08cbe8e4b0", "isPublic": true }, { "controlId": "IEC-62645-6.3", "title": "IEC-62645-6.3 — Supplier & Acquisition Cybersecurity Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "008920ee-6e3b-5c8a-a787-0d4fea957570", "isPublic": true }, { "controlId": "IEC-63096-15.1", "title": "IEC-63096-15.1 — Information Security in Nuclear Supplier Relationships", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "ec88c925-70ec-5c80-b904-d4846b04e3d2", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.2", "title": "IEEE-7-4.3.2-5.3.2 — Commercial Grade Dedication (CGD) & Supply Chain Integrity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "fc84f108-c874-5e9f-982f-8c068a237c0d", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.e", "title": "DOE-O-205.1D-4.e — Cybersecurity Supply Chain Risk Management (C-SCRM)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "1436aa9e-88d3-5323-b610-0da42e7b2eab", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SCRM", "title": "ONR-SyAP-FSyP7-SCRM — Supply Chain Integrity & Vendor Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "2e364596-14a5-5c8c-967a-78733ca286dd", "isPublic": true } ], "id": 32091, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731356", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731356", "catalogueId": 1062, "uuid": "02d28876-21b2-5a8f-ae19-5ce0d0794db5", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of third-party management controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Third-Party Management", "description": "

Control Description

Mechanisms exist to facilitate the implementation of third-party management controls.

Evidence Request List (ERL)

E-TPM-03\nE-TPM-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No centralized inventory of External Service Providers (ESP) is maintained.\n▪ ESP are not formally managed according to criticality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of third-party management controls.

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.12.1", "controlId": "TPM-01", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-01", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Product / project management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74474, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591304", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591304", "securityControlId": 32092, "ccis": [], "uuid": "c944c9fa-4841-5b81-bcd1-420a35d394e0", "testId": "TPM-01.1_A01", "test": "a current, accurate and complete list of Third-Party Service Providers (TSP) that can potentially impact the Sensitivity, Integrity, Availability and/or Safety (CIAS) of the organization's systems, applications, services and data is maintained.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 608028, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590724", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf5de783-6ec6-5e92-ba08-4ddf4cee81d2", "parentControlId": 32092, "controlId": "5.19", "title": "5.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590724" }, { "id": 608032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590724", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cc1e615-1cab-51b3-b1e0-e0efa58c194e", "parentControlId": 32092, "controlId": "SR-13", "title": "SR-13", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590724" }, { "id": 608035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590724", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bad92990-f373-5a55-9a85-0371aef561b6", "parentControlId": 32092, "controlId": "03.07.06.a", "title": "03.07.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590724" }, { "id": 608037, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "071c1c88-0586-565e-9bcb-cc0113bddcb8", "parentControlId": 32092, "controlId": "GV.SC-04", "title": "GV.SC-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590725" }, { "id": 608038, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a435b4b2-0dcb-5aa5-a5dc-de69e9cb31a3", "parentControlId": 32092, "controlId": "GV.SC-07", "title": "GV.SC-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590725" }, { "id": 608039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56a1771a-608b-50d7-b8c5-4511555d4421", "parentControlId": 32092, "controlId": "GV.SC-08", "title": "GV.SC-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590725" }, { "id": 608040, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "35c2be46-2aba-51a9-9193-e3c0e507ed59", "parentControlId": 32092, "controlId": "ID.AM", "title": "ID.AM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590725" }, { "id": 608041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "912bccd8-9c80-5ec9-acb6-3eed6eae100d", "parentControlId": 32092, "controlId": "ID.AM-01", "title": "ID.AM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590725" }, { "id": 608042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e57403b6-75ac-5933-8ee2-8b415e7b6f0c", "parentControlId": 32092, "controlId": "ID.AM-02", "title": "ID.AM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590725" }, { "id": 608043, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a238465-f1fc-5655-830b-4a0337f871be", "parentControlId": 32092, "controlId": "ID.AM-04", "title": "ID.AM-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590725" }, { "id": 608044, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590725", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0b5ffcc-ac7b-5621-9ece-f5bb10e1112a", "parentControlId": 32092, "controlId": "ID.RA-10", "title": "ID.RA-10", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590725" }, { "id": 608063, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f37c696-8930-5371-a2ce-1c75fb924c58", "parentControlId": 32092, "controlId": "THIRD-PARTIES-1b", "title": "THIRD-PARTIES-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590727" }, { "id": 608064, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590728", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7115ddd-81bb-5bb4-a0d2-9954e01c19d2", "parentControlId": 32092, "controlId": "THIRD-PARTIES-1d", "title": "THIRD-PARTIES-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590728" } ], "id": 32092, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731356", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731356", "catalogueId": 1062, "uuid": "9005325e-7e78-5a83-9b64-d4e0e905ad9c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain a current, accurate and complete list of External Service Providers (ESPs) that can potentially impact the Confidentiality, Integrity, Availability and/or Safety (CIAS) of its Technology Assets, Applications, Services and/or Data (TAASD)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Third-Party Inventories", "description": "

Control Description

Mechanisms exist to maintain a current, accurate and complete list of External Service Providers (ESPs) that can potentially impact the Confidentiality, Integrity, Availability and/or Safety (CIAS) of the organization's Technology Assets, Applications, Services and/or Data (TAASD).

Evidence Request List (ERL)

E-AST-06\nE-DCH-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ A procurement function maintains a list of all active External Service Providers (ESPs), including pertinent contract information that will assist in a risk assessment.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain a current, accurate and complete list of External Service Providers (ESPs) that can potentially impact the Confidentiality, Integrity, Availability and/or Safety (CIAS) of the organization's TAASD.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-01.1", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74475, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591305", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591305", "securityControlId": 32093, "ccis": [], "uuid": "3851b346-5d0a-5fad-ba44-1cc3d70a6a6c", "testId": "TPM-02_A01", "test": "systems, system components or system services to be analyzed for criticality are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-09_ODP[01]", "defaultText": null }, { "id": 74476, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591305", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591305", "securityControlId": 32093, "ccis": [], "uuid": "b95e4eec-2988-5faf-8852-cf35c838817c", "testId": "TPM-02_A02", "test": "decision points in the system development life cycle when a criticality analysis is to be performed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-09_ODP[02]", "defaultText": null }, { "id": 74477, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591305", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591305", "securityControlId": 32093, "ccis": [], "uuid": "66ad240b-15c4-5ede-9f06-9a2556c6b474", "testId": "TPM-02_A03", "test": "critical system components and functions are identified by performing a criticality analysis for systems, system components or system services at decision points in the system development life cycle.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-09", "defaultText": null }, { "id": 74478, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591305", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591305", "securityControlId": 32093, "ccis": [], "uuid": "bf5fb366-1d27-5eeb-89d7-61ce2612a6b7", "testId": "TPM-02_A04", "test": "suppliers of critical or mission-essential technologies, products and services are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-30(01)[01]", "defaultText": null }, { "id": 74479, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591305", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591305", "securityControlId": 32093, "ccis": [], "uuid": "d6a24dc4-4ad2-56e3-8dbf-422e217c6faa", "testId": "TPM-02_A05", "test": "suppliers of critical or mission-essential technologies, products and services are prioritized.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-30(01)[02]", "defaultText": null }, { "id": 74480, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591306", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591306", "securityControlId": 32093, "ccis": [], "uuid": "5b22aea7-a2a7-59c5-9078-6c339f572290", "testId": "TPM-02_A06", "test": "suppliers of critical or mission-essential technologies, products and services are assessed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-30(01)[03]", "defaultText": null } ], "externalMappings": [ { "id": 608114, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590744", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e52783a-1f5c-548d-83e4-c138ab2c7fd1", "parentControlId": 32093, "controlId": "5.19", "title": "5.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590744" }, { "id": 608117, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590747", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6a7bed9-faab-5b09-930c-6a6f5bf09659", "parentControlId": 32093, "controlId": "SA-14", "title": "SA-14", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590747" }, { "id": 608118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590747", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9c43fff7-d14f-5eda-8402-b8c14e198bbb", "parentControlId": 32093, "controlId": "PM-30(01)", "title": "PM-30(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590747" }, { "id": 608119, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590747", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abf7aff7-44b2-5427-b14f-80bdf2a8f1bb", "parentControlId": 32093, "controlId": "RA-09", "title": "RA-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590747" }, { "id": 608120, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590747", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f549832-7dbb-54ee-ac2d-5e65f70f77d7", "parentControlId": 32093, "controlId": "SA-09(03)", "title": "SA-09(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590748" }, { "id": 608123, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04b23c75-78ff-5ba3-9dd7-c0b3dbbf60b9", "parentControlId": 32093, "controlId": "RA-09", "title": "RA-09", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590748" }, { "id": 608125, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7efeb6ea-895f-5387-976e-49354676a861", "parentControlId": 32093, "controlId": "PM-30(01)", "title": "PM-30(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590748" }, { "id": 608126, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "606f6c5a-0d81-56a7-9339-3d31a2b31eb8", "parentControlId": 32093, "controlId": "RA-09", "title": "RA-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590748" }, { "id": 608127, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8899bd5e-8e80-5740-880a-070be5236155", "parentControlId": 32093, "controlId": "SA-09(03)", "title": "SA-09(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590748" }, { "id": 608128, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f94ea7dc-05e4-5959-abbf-32eb797f7d10", "parentControlId": 32093, "controlId": "PM-30(01)", "title": "PM-30(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590748" }, { "id": 608129, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4da386dc-0323-543b-a1e2-415c794e5c4e", "parentControlId": 32093, "controlId": "PM-30(01)", "title": "PM-30(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590749" }, { "id": 608130, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c48a597c-f666-52ac-818c-e97382f0d257", "parentControlId": 32093, "controlId": "RA-09", "title": "RA-09", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590749" }, { "id": 608131, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94777adb-63c9-5e93-8f69-6df94020f75a", "parentControlId": 32093, "controlId": "PM-30(01)", "title": "PM-30(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590749" }, { "id": 608132, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac75f3dc-8a6b-5509-ba89-3e96c60a1550", "parentControlId": 32093, "controlId": "RA-09", "title": "RA-09", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590749" }, { "id": 608135, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9927512d-776b-522f-bbb3-c8369510aa31", "parentControlId": 32093, "controlId": "RA-9", "title": "RA-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590749" }, { "id": 608136, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "131b7682-3c7f-53e6-8b6c-3ceebc2b8dc3", "parentControlId": 32093, "controlId": "SA-9(3)", "title": "SA-9(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590749" }, { "id": 608137, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4bd314fa-b878-57c7-b8bf-e140609eb717", "parentControlId": 32093, "controlId": "RA-9", "title": "RA-9", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590749" }, { "id": 608144, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74902f23-2784-50bd-bc6a-bd12b75cd812", "parentControlId": 32093, "controlId": "03.11.01.a", "title": "03.11.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59075" }, { "id": 608145, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59075", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12a754e3-df4a-5ad0-9b0e-b6df6848dfdd", "parentControlId": 32093, "controlId": "03.17.03.a", "title": "03.17.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59075" }, { "id": 608146, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c885d2c2-5967-5ab7-8db9-cf587807fc33", "parentControlId": 32093, "controlId": "GV.OC-04", "title": "GV.OC-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590751" }, { "id": 608147, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f6eab50-062f-5151-bb26-7348a673e048", "parentControlId": 32093, "controlId": "GV.OC-05", "title": "GV.OC-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590751" }, { "id": 608148, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8c49466-d8be-589f-bf36-c347fac25b02", "parentControlId": 32093, "controlId": "GV.SC-04", "title": "GV.SC-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590751" }, { "id": 608149, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a274fdb-8d7e-5779-93fb-1fcee1addc2c", "parentControlId": 32093, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590751" }, { "id": 608150, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99f6f934-c988-58d3-ba38-193d14fe600d", "parentControlId": 32093, "controlId": "GV.SC-07", "title": "GV.SC-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590751" }, { "id": 608151, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90bfa41b-88ca-53a9-aed4-4b44e3859187", "parentControlId": 32093, "controlId": "GV.SC-08", "title": "GV.SC-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590751" }, { "id": 608152, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b47321f2-08f0-56cb-a41f-3646bf0cc837", "parentControlId": 32093, "controlId": "ID.AM-05", "title": "ID.AM-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590751" }, { "id": 608153, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590751", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5717274b-0734-59ea-a7c0-d4ff457916ad", "parentControlId": 32093, "controlId": "ID.RA-10", "title": "ID.RA-10", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590751" }, { "id": 608162, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db8745db-5141-5b9d-aea3-4a50867451e4", "parentControlId": 32093, "controlId": "THIRD-PARTIES-1c", "title": "THIRD-PARTIES-1c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590752" }, { "id": 608163, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590752", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c44848b8-05bb-5554-b236-30dd58172f17", "parentControlId": 32093, "controlId": "THIRD-PARTIES-1d", "title": "THIRD-PARTIES-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590752" }, { "id": 608164, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "921ab563-0aaf-53ba-97c8-9ae69fa15b12", "parentControlId": 32093, "controlId": "THIRD-PARTIES-1e", "title": "THIRD-PARTIES-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590753" }, { "id": 608165, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590753", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d983e689-572d-5686-a4ef-9fcd461e045a", "parentControlId": 32093, "controlId": "THIRD-PARTIES-1f", "title": "THIRD-PARTIES-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590753" }, { "controlId": "NSS-17T-Sec4.6", "title": "NSS-17T-Sec4.6 — Supply Chain & Vendor Computer Security Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "a62b3a2a-5b3e-510f-90ba-bf93225c0a13", "isPublic": true }, { "controlId": "IEC-62645-6.3", "title": "IEC-62645-6.3 — Supplier & Acquisition Cybersecurity Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "f366c125-1f2e-54b9-8223-5d6f881a5c85", "isPublic": true }, { "controlId": "IEC-63096-15.1", "title": "IEC-63096-15.1 — Information Security in Nuclear Supplier Relationships", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "9fa4e1b2-4f87-5dac-9191-a40007a42ce5", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.2", "title": "IEEE-7-4.3.2-5.3.2 — Commercial Grade Dedication (CGD) & Supply Chain Integrity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "a0fa155c-f246-5f43-b3dc-6835df1b7352", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.e", "title": "DOE-O-205.1D-4.e — Cybersecurity Supply Chain Risk Management (C-SCRM)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "1092dd47-2621-5fe8-8445-53bd584f7108", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SCRM", "title": "ONR-SyAP-FSyP7-SCRM — Supply Chain Integrity & Vendor Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "cebae51c-4af3-5db9-a5c8-c71409ae7365", "isPublic": true } ], "id": 32093, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731357", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731357", "catalogueId": 1062, "uuid": "e419e8b9-71c0-5df1-8d3f-1917dbf40bb8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify, prioritize and assess suppliers and partners of critical Technology Assets, Applications and/or Services (TAAS) using a supply chain risk assessment process relative to their importance in supporting the delivery of high-value services?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Third-Party Criticality Assessments", "description": "

Control Description

Mechanisms exist to identify, prioritize and assess suppliers and partners of critical Technology Assets, Applications and/or Services (TAAS) using a supply chain risk assessment process relative to their importance in supporting the delivery of high-value services.

Evidence Request List (ERL)

E-TPM-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify, prioritize and assess suppliers and partners of critical Technology Assets, Applications and/or Services (TAAS) using a supply chain risk assessment process relative to their importance in supporting the delivery of high-value services.

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-02", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-02", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74481, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591306", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591306", "securityControlId": 32094, "ccis": [], "uuid": "3c649ee8-ef6d-5634-b168-40a0b54ca784", "testId": "TPM-03_A01", "test": "the personnel, roles and responsibilities of the supply chain risk management team are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-02(01)_ODP[01]", "defaultText": null }, { "id": 74482, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591306", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591306", "securityControlId": 32094, "ccis": [], "uuid": "cbe17035-81f7-5a5e-a399-3f626d3d5e74", "testId": "TPM-03_A02", "test": "supply chain risk management activities are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-02(01)_ODP[02]", "defaultText": null }, { "id": 74483, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591306", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591306", "securityControlId": 32094, "ccis": [], "uuid": "6bc4f1f1-fb4a-5ee3-a336-b5bc3a74350d", "testId": "TPM-03_A03", "test": "a supply chain risk management team consisting of personnel, roles and responsibilities is established to lead and support supply chain risk management activities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-02(01)", "defaultText": null }, { "id": 74484, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591306", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591306", "securityControlId": 32094, "ccis": [], "uuid": "dfee3f13-def4-5c62-89ca-5da81adbd992", "testId": "TPM-03_A04", "test": "the supply chain risk management plan addresses risks associated with the research and development of systems, system components or system services.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-02a.[02]", "defaultText": null }, { "id": 74485, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591307", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591307", "securityControlId": 32094, "ccis": [], "uuid": "2420884c-4f2f-569e-a334-90ec4a6e40aa", "testId": "TPM-03_A05", "test": "the supply chain risk management plan addresses risks associated with the design of systems, system components or system services.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-02a.[03]", "defaultText": null }, { "id": 74486, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591307", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591307", "securityControlId": 32094, "ccis": [], "uuid": "9e8dd729-7ae2-5524-916e-776c45116250", "testId": "TPM-03_A06", "test": "the supply chain risk management plan addresses risks associated with the manufacturing of systems, system components or system services.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-02a.[04]", "defaultText": null }, { "id": 74487, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591307", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591307", "securityControlId": 32094, "ccis": [], "uuid": "1cc962dc-026f-5b2d-9db4-3eee4034572b", "testId": "TPM-03_A07", "test": "the supply chain risk management plan addresses risks associated with the acquisition of systems, system components or system services.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-02a.[05]", "defaultText": null }, { "id": 74488, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591307", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591307", "securityControlId": 32094, "ccis": [], "uuid": "c195f109-baf4-585b-b363-05a37cb2b790", "testId": "TPM-03_A08", "test": "the supply chain risk management plan addresses risks associated with the delivery of systems, system components or system services.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-02a.[06]", "defaultText": null }, { "id": 74489, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591307", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591307", "securityControlId": 32094, "ccis": [], "uuid": "bb40d3c3-bce4-519c-9711-eda299b7be8a", "testId": "TPM-03_A09", "test": "the supply chain risk management plan addresses risks associated with the integration of systems, system components or system services.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-02a.[07]", "defaultText": null }, { "id": 74490, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591308", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591308", "securityControlId": 32094, "ccis": [], "uuid": "faffa1aa-d7f3-5495-bc89-14ce777088a9", "testId": "TPM-03_A10", "test": "the supply chain risk management plan addresses risks associated with the operation and maintenance of systems, system components or system services.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-02a.[08]", "defaultText": null }, { "id": 74491, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591308", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591308", "securityControlId": 32094, "ccis": [], "uuid": "1d474c44-bca1-5795-8d3f-3a5e17e43f0c", "testId": "TPM-03_A11", "test": "the supply chain risk management plan addresses risks associated with the disposal of systems, system components or system services.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-02a.[09]", "defaultText": null }, { "id": 74492, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591308", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591308", "securityControlId": 32094, "ccis": [], "uuid": "dded8a1a-b1cb-5692-8637-e722deca8946", "testId": "TPM-03_A12", "test": "systems, system components or system services for which a supply chain risk management plan is developed are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-02_ODP[01]", "defaultText": null }, { "id": 74493, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591308", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591308", "securityControlId": 32094, "ccis": [], "uuid": "d0263d8d-015e-50d6-8453-403f7135621a", "testId": "TPM-03_A13", "test": "the frequency at which to review / update the supply chain risk management plan is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-02_ODP[02]", "defaultText": null }, { "id": 74494, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591308", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591308", "securityControlId": 32094, "ccis": [], "uuid": "c3b95581-5bf1-54c7-b71b-8613977966b0", "testId": "TPM-03_A14", "test": "a plan for managing supply chain risks is developed.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-02a.[01]", "defaultText": null }, { "id": 74495, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591309", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591309", "securityControlId": 32094, "ccis": [], "uuid": "ab01f8a8-6b07-5ab4-a413-7ce1346dc251", "testId": "TPM-03_A15", "test": "the supply chain risk management plan is reviewed / updated frequently or as required to address threat, organizational or environmental changes.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least annually", "otherId": "53A_R5_SR-02b.", "defaultText": null }, { "id": 74496, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591309", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591309", "securityControlId": 32094, "ccis": [], "uuid": "8b5847df-70b4-5f86-a335-5271857676ba", "testId": "TPM-03_A16", "test": "the supply chain risk management plan is protected from unauthorized disclosure.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SR-02c.[01]", "defaultText": null }, { "id": 74497, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591309", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591309", "securityControlId": 32094, "ccis": [], "uuid": "7774b86a-02e5-5ba3-b5c3-494a8be40954", "testId": "TPM-03_A17", "test": "the supply chain risk management plan is protected from unauthorized modification.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SR-02c.[02]", "defaultText": null } ], "externalMappings": [ { "id": 608222, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590764", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f018c225-88be-5ac4-82c3-7c27c978f177", "parentControlId": 32094, "controlId": "ORG 2.1", "title": "ORG 2.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590764" }, { "id": 608224, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b1099e8-9a3a-5a7d-97e9-25d133700a4c", "parentControlId": 32094, "controlId": "5.19", "title": "5.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590765" }, { "id": 608225, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "528bf413-7aca-5e96-8de4-3ada8a6b57dd", "parentControlId": 32094, "controlId": "5.21", "title": "5.21", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590765" }, { "id": 608226, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6205c943-95f3-577c-8477-19358c3ea32a", "parentControlId": 32094, "controlId": "5.22", "title": "5.22", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590765" }, { "id": 608227, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590765", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92f7c084-a378-5f7b-82ad-2fe0b81bc31c", "parentControlId": 32094, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590765" }, { "id": 608236, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a584ec7-4dc8-5a88-b18c-7213036e5d7b", "parentControlId": 32094, "controlId": "SA-12", "title": "SA-12", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590766" }, { "id": 608237, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5290e95-5c57-5fca-80b6-6a73e02f24eb", "parentControlId": 32094, "controlId": "SA-09(03)", "title": "SA-09(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590766" }, { "id": 608238, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27044c83-e8e4-50ea-8d17-452358a085e9", "parentControlId": 32094, "controlId": "SR-02", "title": "SR-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590766" }, { "id": 608239, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590766", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f8364e3a-18a2-51fc-a29d-f3f6db6dc544", "parentControlId": 32094, "controlId": "SR-02(01)", "title": "SR-02(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590766" }, { "id": 608241, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2a1dc54-27cc-5d98-801c-9106d8b60e27", "parentControlId": 32094, "controlId": "SR-02", "title": "SR-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590767" }, { "id": 608242, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bec0f9f8-2ec5-55a8-aac8-9a9ab0830319", "parentControlId": 32094, "controlId": "SR-02(01)", "title": "SR-02(01)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590767" }, { "id": 608243, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b2e48d7f-635c-596f-b808-1c084886aaf1", "parentControlId": 32094, "controlId": "SA-09(03)", "title": "SA-09(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590767" }, { "id": 608244, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7442a535-69b6-5b18-9282-2f4d6eb32e73", "parentControlId": 32094, "controlId": "SR-02", "title": "SR-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590767" }, { "id": 608245, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ee851cd-b00e-5d73-a75c-357bb07b7b84", "parentControlId": 32094, "controlId": "SR-02(01)", "title": "SR-02(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590767" }, { "id": 608246, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ba94e2b8-f031-51bb-8862-f900a835d4ed", "parentControlId": 32094, "controlId": "SR-02", "title": "SR-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590767" }, { "id": 608247, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "50c4da3b-04ea-51f2-a78d-8363bf26c631", "parentControlId": 32094, "controlId": "SR-02(01)", "title": "SR-02(01)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590767" }, { "id": 608248, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590767", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9402c8c5-cd52-5afb-8cd9-cfa0a02b5d54", "parentControlId": 32094, "controlId": "SR-02", "title": "SR-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590767" }, { "id": 608249, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ccbdb93d-160b-5bdb-a749-215a76c48f38", "parentControlId": 32094, "controlId": "SR-02(01)", "title": "SR-02(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590768" }, { "id": 608250, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e0ef8808-54c8-5684-9e51-7671bb9043c9", "parentControlId": 32094, "controlId": "SR-02", "title": "SR-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590768" }, { "id": 608251, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28119337-de75-5437-8317-833c784d886f", "parentControlId": 32094, "controlId": "SR-02(01)", "title": "SR-02(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590768" }, { "id": 608252, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "70dbc4ff-66d9-52fe-9de7-e1b1180570db", "parentControlId": 32094, "controlId": "SA-9(3)", "title": "SA-9(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590768" }, { "id": 608253, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4aa1cd24-f252-5532-a50d-16082ac6e16e", "parentControlId": 32094, "controlId": "SR-2", "title": "SR-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590768" }, { "id": 608254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590768", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0afdf643-6ae4-52a7-a786-61c50c1c0b1b", "parentControlId": 32094, "controlId": "SR-2", "title": "SR-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590768" }, { "id": 608259, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66c2c25d-b1af-5eda-9058-e784fbb7d5c4", "parentControlId": 32094, "controlId": "03.11.01.a", "title": "03.11.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590769" }, { "id": 608260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c53f5027-1ad9-5d30-9f48-9157fa50e3b7", "parentControlId": 32094, "controlId": "03.17.01.a", "title": "03.17.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590769" }, { "id": 608261, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6db2f4d-c2cc-5494-b133-77246d83c77c", "parentControlId": 32094, "controlId": "03.17.03.a", "title": "03.17.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590769" }, { "id": 608262, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fae2ea70-8fbb-5892-a685-e2276934f8f0", "parentControlId": 32094, "controlId": "03.17.03.b", "title": "03.17.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590769" }, { "id": 608263, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37a93924-0245-52f9-82ff-0f16b067c8d1", "parentControlId": 32094, "controlId": "GV.SC", "title": "GV.SC", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590769" }, { "id": 608264, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "346c526c-a4e6-536f-92ee-f9ae9951ec5b", "parentControlId": 32094, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590769" }, { "id": 608265, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590769", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8630a355-aea3-5e7d-8646-30b45f3a96c0", "parentControlId": 32094, "controlId": "GV.SC-07", "title": "GV.SC-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590769" }, { "id": 608297, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fb8837ea-0e63-59b3-bbe5-7a6ee3616933", "parentControlId": 32094, "controlId": "CIP-013-2 1.2.5", "title": "CIP-013-2 1.2.5", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590776" }, { "id": 608298, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590776", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e5b2503-14c3-5f0f-a240-d2129ce410de", "parentControlId": 32094, "controlId": "CIP-013-2 1.2.6", "title": "CIP-013-2 1.2.6", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590776" }, { "controlId": "C.12.2", "title": "C.12.2 — Supply Chain Protection", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SR-1, SR-3, SA-12", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "24665683-5c3d-525d-b30b-cb43291e8401", "isPublic": true }, { "controlId": "NEI 08-09 App E.12.2 / NEI 10-08", "title": "NEI 08-09 App E.12.2 / NEI 10-08 — Supply Chain Protection", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.12.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "0bc61b50-fa6b-5cb7-b000-9f19cb720f4e", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.12.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "1a997c81-1332-58e8-a91f-a9febfa8b6eb", "isPublic": true }, { "controlId": "CIP-013-2-R1", "title": "CIP-013-2-R1 — Supply Chain Cyber Security Risk Management Plan", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8cf88d0b-a312-5355-b082-4f6ef26a27d0", "isPublic": true }, { "controlId": "CIP-013-2-1.1", "title": "CIP-013-2-1.1 — One or more process(es) used in planning for the procurement of BES Cyber Systems and their associated EACMS and PACS...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-013-2-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e88bedcd-02f8-5e3b-9743-5bf7a0579ae1", "isPublic": true }, { "controlId": "CIP-013-2-1.2", "title": "CIP-013-2-1.2 — One or more process(es) used in procuring BES Cyber Systems, and their associated EACMS and PACS, that address the fo...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-013-2-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "228955e2-5f8f-59fc-859d-063b0a3d9923", "isPublic": true }, { "controlId": "CIP-013-2-R2", "title": "CIP-013-2-R2 — Supply Chain Risk Management Plan Implementation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "eab3cab4-9037-5426-a22f-6eb78e76fc39", "isPublic": true }, { "controlId": "CIP-013-2-R3", "title": "CIP-013-2-R3 — Supply Chain Risk Management Plan Review and Approval", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "10d0059f-42d3-552f-95c9-1cde49684ae8", "isPublic": true }, { "controlId": "NSS-17T-Sec4.6", "title": "NSS-17T-Sec4.6 — Supply Chain & Vendor Computer Security Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "525c0f49-1712-51e8-84f5-698ede79e925", "isPublic": true }, { "controlId": "IEC-62645-6.3", "title": "IEC-62645-6.3 — Supplier & Acquisition Cybersecurity Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "155e3363-a695-59f1-865c-7affdcfbe01a", "isPublic": true }, { "controlId": "IEC-63096-15.1", "title": "IEC-63096-15.1 — Information Security in Nuclear Supplier Relationships", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "ca6ce9df-b689-5385-bf53-c175497b3243", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.2", "title": "IEEE-7-4.3.2-5.3.2 — Commercial Grade Dedication (CGD) & Supply Chain Integrity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "7d35e3f3-e0f8-593d-b2b0-6d2430800d95", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.e", "title": "DOE-O-205.1D-4.e — Cybersecurity Supply Chain Risk Management (C-SCRM)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "47aa81fd-9c1a-561c-8d6d-d72428c38e34", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SCRM", "title": "ONR-SyAP-FSyP7-SCRM — Supply Chain Integrity & Vendor Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "84a8e2f8-9717-532b-a766-c88d91f857af", "isPublic": true } ], "id": 32094, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731357", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731357", "catalogueId": 1062, "uuid": "f0ca6cc8-d7a4-5c17-9c04-7cdbbe9833d9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization:\n(1) Evaluate security risks and threats associated with Technology Assets, Applications and/or Services (TAAS) supply chains; and\n(2) Take appropriate remediation actions to minimize the organization's exposure to those risks and threats, as necessary?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Supply Chain Risk Management (SCRM)", "description": "

Control Description

Mechanisms exist to:\n(1) Evaluate security risks and threats associated with Technology Assets, Applications and/or Services (TAAS) supply chains; and\n(2) Take appropriate remediation actions to minimize the organization's exposure to those risks and threats, as necessary.

Evidence Request List (ERL)

E-RSK-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to:\n(1) Evaluate security risks and threats associated with Technology Assets, Applications and/or Services (TAAS) supply chains; and\n(2) Take appropriate remediation actions to minimize the organization's exposure to those risks and threats, as necessary.

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.12.2
NERC-CIP (2026) Requirements: CIP-013-2-R1, CIP-013-2-R2, CIP-013-2-R3", "controlId": "TPM-03", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-03", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74498, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591309", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591309", "securityControlId": 32095, "ccis": [], "uuid": "6cc216f2-ab9a-54fc-bb63-3f3d710dcf7f", "testId": "TPM-03.1_A01", "test": "acquisition strategies, contract tools and procurement methods to protect against, identify and mitigate supply chain risks are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-05_ODP", "defaultText": null }, { "id": 74499, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59131", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59131", "securityControlId": 32095, "ccis": [], "uuid": "e9528320-4552-57b4-98a4-1cdb083bbe83", "testId": "TPM-03.1_A02", "test": "acquisition strategies, contract tools, and procurement method protect against, identify and mitigate supply chain risks are developed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-05[01]\n53A_R5_SR-05[02]\n53A_R5_SR-05[03]", "defaultText": null }, { "id": 74500, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59131", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59131", "securityControlId": 32095, "ccis": [], "uuid": "5f5116ca-05b2-5240-8d42-ba07451a07fb", "testId": "TPM-03.1_A03", "test": "acquisition strategies, contract tools, and procurement methods are developed to identify supply chain risks.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.17.02[01]", "defaultText": null }, { "id": 74501, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59131", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59131", "securityControlId": 32095, "ccis": [], "uuid": "ef137580-6ab7-5f0b-b26e-54a6667bddda", "testId": "TPM-03.1_A04", "test": "acquisition strategies, contract tools, and procurement methods are developed to protect against supply chain risks.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.17.02[02]", "defaultText": null }, { "id": 74502, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59131", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59131", "securityControlId": 32095, "ccis": [], "uuid": "f45613a7-7445-5928-830f-1dcd0a54d1b0", "testId": "TPM-03.1_A05", "test": "acquisition strategies, contract tools, and procurement methods are developed to mitigate supply chain risks.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.17.02[03]", "defaultText": null } ], "externalMappings": [ { "id": 608372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8448547d-092f-523d-acbb-95c69a4d1279", "parentControlId": 32095, "controlId": "5.21", "title": "5.21", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59079" }, { "id": 608373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59079", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2cefa943-e11f-56ac-8771-451579c0acbc", "parentControlId": 32095, "controlId": "5.22", "title": "5.22", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59079" }, { "id": 608376, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7fddbb42-f816-58dd-ae3f-587ad1459b0a", "parentControlId": 32095, "controlId": "T1059.002", "title": "T1059.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590791" }, { "id": 608377, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "006f669d-9ff2-5662-b127-dca19dd18ce5", "parentControlId": 32095, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590791" }, { "id": 608378, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a92976a-aec3-5d41-b932-fb2862a4a8ba", "parentControlId": 32095, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590791" }, { "id": 608379, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9eb34f2d-63c5-5e90-a875-2873b6e5bb0e", "parentControlId": 32095, "controlId": "T1195.002", "title": "T1195.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590791" }, { "id": 608380, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "770aec31-1ef6-5b0a-8d19-8edd5fa282a7", "parentControlId": 32095, "controlId": "T1195.003", "title": "T1195.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590791" }, { "id": 608381, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6bd461f-58de-580e-902f-ddbf462b2b84", "parentControlId": 32095, "controlId": "T1204.003", "title": "T1204.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590791" }, { "id": 608382, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee2f89f5-35ac-51ba-9334-490b8092f9cc", "parentControlId": 32095, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590791" }, { "id": 608383, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590791", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de7f9e19-6b48-52ed-80a0-08675eb194d3", "parentControlId": 32095, "controlId": "T1505.001", "title": "T1505.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590791" }, { "id": 608384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590792", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37057b1a-6138-58c2-b62e-d347c0fe1cdf", "parentControlId": 32095, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590792" }, { "id": 608385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590792", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90767374-cabb-5316-b85a-7adc9a7a67f4", "parentControlId": 32095, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590792" }, { "id": 608386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590792", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74149048-9846-53a7-bc43-4b184280aacc", "parentControlId": 32095, "controlId": "T1546.006", "title": "T1546.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590792" }, { "id": 608387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590792", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "655deb26-e320-5d97-85c4-6fca498c2b73", "parentControlId": 32095, "controlId": "T1554", "title": "T1554", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590792" }, { "id": 608388, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590792", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88158386-5362-5159-b5cc-00dfc4b981e7", "parentControlId": 32095, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590792" }, { "id": 608389, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590792", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02c3d3a8-7e4d-5662-bb0d-edaca7dbe1d8", "parentControlId": 32095, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590792" }, { "id": 608390, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590792", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68cf0ce8-0e70-5324-a1cb-58b461f1049d", "parentControlId": 32095, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590792" }, { "id": 608391, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43d9e8f9-aa8a-557f-9cb3-50dedbd395aa", "parentControlId": 32095, "controlId": "SA-12(1)", "title": "SA-12(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590801" }, { "id": 608392, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a4e5f7e0-0460-54a0-92ec-72959f36289d", "parentControlId": 32095, "controlId": "SR-03(01)", "title": "SR-03(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590801" }, { "id": 608393, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c370ab4-7531-5e8b-b5f2-9d04f065b306", "parentControlId": 32095, "controlId": "SR-05", "title": "SR-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590801" }, { "id": 608395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd4e5b86-1f35-56e0-af63-81f641cd1893", "parentControlId": 32095, "controlId": "SR-05", "title": "SR-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590801" }, { "id": 608396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "365734c0-fe20-53f7-b2cc-25991c3813b8", "parentControlId": 32095, "controlId": "SR-03(01)", "title": "SR-03(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590801" }, { "id": 608397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bd4e9d5-5c9e-5fde-a3b9-07eb900bb480", "parentControlId": 32095, "controlId": "SR-05", "title": "SR-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590801" }, { "id": 608398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590801", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c95960b1-ae12-5559-a73d-58c86596cd9b", "parentControlId": 32095, "controlId": "SR-05", "title": "SR-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590801" }, { "id": 608399, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d8eb231b-b750-53bf-b729-e1fb5b83f4c5", "parentControlId": 32095, "controlId": "SR-05", "title": "SR-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590802" }, { "id": 608400, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1df064ec-68a3-50ec-aa27-3d00d23f6d17", "parentControlId": 32095, "controlId": "SR-05", "title": "SR-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590802" }, { "id": 608403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee339a5c-21bb-503f-ae81-e3b4de456f32", "parentControlId": 32095, "controlId": "SR-3(1)", "title": "SR-3(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590802" }, { "id": 608404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9606a73-80b4-5aa5-8444-e5e7e73633f4", "parentControlId": 32095, "controlId": "SR-5", "title": "SR-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590802" }, { "id": 608405, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590802", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20351516-1884-55cc-9fb9-21e5441f231d", "parentControlId": 32095, "controlId": "SR-5", "title": "SR-5", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590802" }, { "id": 608411, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "91e3fd3b-e2d0-53ad-939d-2e168b8223a3", "parentControlId": 32095, "controlId": "03.17.01.a", "title": "03.17.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590803" }, { "id": 608412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a987c7ed-332a-58a8-a1b9-1d31a2d083ca", "parentControlId": 32095, "controlId": "03.17.02", "title": "03.17.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590803" }, { "id": 608413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fac50b77-1403-53bb-862b-a40c5a3ddffe", "parentControlId": 32095, "controlId": "03.17.03.a", "title": "03.17.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590803" }, { "id": 608414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590803", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c298c8b0-a3cc-5094-9f16-b5b9ce38dca7", "parentControlId": 32095, "controlId": "03.17.03.b", "title": "03.17.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590803" }, { "id": 608425, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb56736e-5687-5aef-8d42-c35165ef652d", "parentControlId": 32095, "controlId": "THIRD-PARTIES-2j", "title": "THIRD-PARTIES-2j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590807" }, { "id": 608426, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b2519c7-48e9-5e65-bbff-ee37de2d1b53", "parentControlId": 32095, "controlId": "THIRD-PARTIES-2k", "title": "THIRD-PARTIES-2k", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590807" }, { "id": 608427, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d593a9e2-a96d-5dc1-ac48-ee4b0722eeeb", "parentControlId": 32095, "controlId": "THIRD-PARTIES-2l", "title": "THIRD-PARTIES-2l", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590807" }, { "id": 608428, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72186751-e784-52dd-9f9c-6501ad0db8ca", "parentControlId": 32095, "controlId": "THIRD-PARTIES-2m", "title": "THIRD-PARTIES-2m", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590807" }, { "controlId": "C.12.2", "title": "C.12.2 — Supply Chain Protection", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SR-1, SR-3, SA-12", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "be915d8f-30d1-5265-8d55-961951430702", "isPublic": true }, { "controlId": "NEI 08-09 App E.12.2 / NEI 10-08", "title": "NEI 08-09 App E.12.2 / NEI 10-08 — Supply Chain Protection", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.12.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "2c01c104-942c-560c-99cd-4132c67da624", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.12.2", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "a60f28ce-d1ff-5d7c-87d8-be26777dd1c6", "isPublic": true }, { "controlId": "CIP-013-2-R1", "title": "CIP-013-2-R1 — Supply Chain Cyber Security Risk Management Plan", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "57a10a35-3e0b-51b4-a843-b9779bf1b38b", "isPublic": true }, { "controlId": "CIP-013-2-1.1", "title": "CIP-013-2-1.1 — One or more process(es) used in planning for the procurement of BES Cyber Systems and their associated EACMS and PACS...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-013-2-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d56a5a47-acdb-5595-b523-7a7b3e82eca4", "isPublic": true }, { "controlId": "CIP-013-2-1.2", "title": "CIP-013-2-1.2 — One or more process(es) used in procuring BES Cyber Systems, and their associated EACMS and PACS, that address the fo...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-013-2-R1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "10a15070-ba79-5843-93d1-a1ff22cba4f4", "isPublic": true }, { "controlId": "NSS-17T-Sec4.6", "title": "NSS-17T-Sec4.6 — Supply Chain & Vendor Computer Security Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "a100f2e7-cebf-5aac-9a1e-497a4a420d20", "isPublic": true }, { "controlId": "IEC-62645-6.3", "title": "IEC-62645-6.3 — Supplier & Acquisition Cybersecurity Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "0c100dbb-2058-5c22-8e9c-0d1f79a39852", "isPublic": true }, { "controlId": "IEC-63096-15.1", "title": "IEC-63096-15.1 — Information Security in Nuclear Supplier Relationships", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "c43b5de6-de25-5e7d-b3dd-7d044917a2fc", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.2", "title": "IEEE-7-4.3.2-5.3.2 — Commercial Grade Dedication (CGD) & Supply Chain Integrity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "36d924c7-b0b9-5ce6-b038-692846040b28", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.e", "title": "DOE-O-205.1D-4.e — Cybersecurity Supply Chain Risk Management (C-SCRM)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "8163e78c-e729-5a69-8c2a-7500c4415fcf", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SCRM", "title": "ONR-SyAP-FSyP7-SCRM — Supply Chain Integrity & Vendor Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "befe9fb2-c714-52d7-a985-fd8370d7b9b5", "isPublic": true } ], "id": 32095, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731357", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731357", "catalogueId": 1062, "uuid": "512d1829-b037-54d1-9f51-9058183b75ba", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize tailored acquisition strategies, contract tools and procurement methods for the purchase of unique Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Acquisition Strategies, Tools & Methods", "description": "

Control Description

Mechanisms exist to utilize tailored acquisition strategies, contract tools and procurement methods for the purchase of unique Technology Assets, Applications and/or Services (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize tailored acquisition strategies, contract tools and procurement methods for the purchase of unique Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.12.2
NERC-CIP (2026) Requirements: CIP-013-2-R1", "controlId": "TPM-03.1", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74503, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59131", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59131", "securityControlId": 32096, "ccis": [], "uuid": "897a0c06-7475-51a3-828f-4098804f674b", "testId": "TPM-03.2_A01", "test": "controls to limit harm from potential supply chain adversaries are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-03(02)_ODP", "defaultText": null }, { "id": 74504, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591311", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591311", "securityControlId": 32096, "ccis": [], "uuid": "8a9e3acb-380e-57ca-b111-30ac44b6c7f1", "testId": "TPM-03.2_A02", "test": "controls are employed to limit harm from potential adversaries identifying and targeting the organizational supply chain.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-03(02)", "defaultText": null } ], "externalMappings": [ { "id": 608466, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d48f9c31-6fe1-5229-a19b-2a51258160d2", "parentControlId": 32096, "controlId": "5.19", "title": "5.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590814" }, { "id": 608467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c05a2c33-d7ef-5de9-91b0-574344f0a2b2", "parentControlId": 32096, "controlId": "5.2", "title": "5.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590814" }, { "id": 608470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30ad1e0a-8339-5ab5-9c91-929682c0b967", "parentControlId": 32096, "controlId": "SA-12(5)", "title": "SA-12(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590814" }, { "id": 608471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a71d2921-5087-5310-93e9-55830c75a92f", "parentControlId": 32096, "controlId": "SR-03(02)", "title": "SR-03(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590814" }, { "id": 608472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590814", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "971de664-6631-576d-8368-40e1f1f66db7", "parentControlId": 32096, "controlId": "SR-03(02)", "title": "SR-03(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590814" }, { "id": 608474, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e2ae0d3-f717-534a-a2a3-a5e3ecbafae5", "parentControlId": 32096, "controlId": "03.17.03.a", "title": "03.17.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590815" }, { "id": 608475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb3bec58-c8ed-512c-a2b0-317b20a1da5d", "parentControlId": 32096, "controlId": "03.17.03.b", "title": "03.17.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590815" }, { "id": 608476, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97736f43-1c63-5242-ae4b-1605829ec68e", "parentControlId": 32096, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590815" }, { "id": 608477, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590815", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "860c39a9-072d-548f-9758-81d4a02dff89", "parentControlId": 32096, "controlId": "GV.SC-07", "title": "GV.SC-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590815" } ], "id": 32096, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731357", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731357", "catalogueId": 1062, "uuid": "e782b02d-dd7d-59ab-b085-0e12181871e7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize security safeguards to limit harm from potential adversaries who identify and target its supply chain?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Limit Potential Harm", "description": "

Control Description

Mechanisms exist to utilize security safeguards to limit harm from potential adversaries who identify and target the organization's supply chain.

Evidence Request List (ERL)

E-TPM-01\nE-TPM-02\nE-TPM-03\nE-TPM-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize security safeguards to limit harm from potential adversaries who identify and target the organization's supply chain.

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-03.2", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-03.2", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Liability clause in contracts

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Liability clause in contracts

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Liability clause in contracts

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Liability clause in contracts

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Liability clause in contracts", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74505, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591311", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591311", "securityControlId": 32097, "ccis": [], "uuid": "9f3bf62a-3bf6-5404-a77c-a954faee4e12", "testId": "TPM-03.3_A01", "test": "the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-03_ODP[01]", "defaultText": null }, { "id": 74506, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591311", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591311", "securityControlId": 32097, "ccis": [], "uuid": "e3805c52-653a-5a56-874c-66b5a0142584", "testId": "TPM-03.3_A02", "test": "supply chain personnel with whom to coordinate the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-03_ODP[02]", "defaultText": null }, { "id": 74507, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591311", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591311", "securityControlId": 32097, "ccis": [], "uuid": "e86f70ed-5fec-5a88-8f78-3d2321c5ab94", "testId": "TPM-03.3_A03", "test": "supply chain controls employed to protect against supply chain risks to the system, system component or system service and to limit the harm or consequences from supply chain-related events are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-03_ODP[03]", "defaultText": null }, { "id": 74508, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591312", "securityControlId": 32097, "ccis": [], "uuid": "efbae22d-021a-5f9f-b629-f777c07a6d5f", "testId": "TPM-03.3_A04", "test": "the document identifying the selected and implemented supply chain processes and controls is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-03_ODP[04]\n53A_R5_SR-03_ODP[05]", "defaultText": null }, { "id": 74509, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591312", "securityControlId": 32097, "ccis": [], "uuid": "5974790e-14b8-5bda-acd4-bdbaa19b24d4", "testId": "TPM-03.3_A05", "test": "a process or processes is/are established to identify and address weaknesses or deficiencies in the supply chain elements and processes of system or system component.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-03a.[01]", "defaultText": null }, { "id": 74510, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591312", "securityControlId": 32097, "ccis": [], "uuid": "da97cdf3-be17-548c-8181-2ee86b28f05b", "testId": "TPM-03.3_A06", "test": "the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of system or system component is/are coordinated with supply chain personnel.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-03a.[02]", "defaultText": null }, { "id": 74511, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591312", "securityControlId": 32097, "ccis": [], "uuid": "62887fad-b60e-5ba0-8c4c-13143749bbeb", "testId": "TPM-03.3_A07", "test": "supply chain controls are employed to protect against supply chain risks to the system, system component or system service and to limit the harm or consequences from supply chain-related events.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-03b.", "defaultText": null }, { "id": 74512, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591312", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591312", "securityControlId": 32097, "ccis": [], "uuid": "d9fc175a-5875-56ca-8253-131e9fb135cf", "testId": "TPM-03.3_A08", "test": "the selected and implemented supply chain processes and controls are documented in accordance with organization-defined criteria.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-03c.", "defaultText": null } ], "externalMappings": [ { "id": 608507, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590818", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b415dffa-79b8-53c3-bcee-505884980ef8", "parentControlId": 32097, "controlId": "5.19", "title": "5.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590818" }, { "id": 608508, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590818", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "279e4195-07b1-58e1-8a6b-9f101183236f", "parentControlId": 32097, "controlId": "5.22", "title": "5.22", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590818" }, { "id": 608511, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc0cf537-193a-5236-b52b-b7eb4c809ec3", "parentControlId": 32097, "controlId": "SA-12(15)", "title": "SA-12(15)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590819" }, { "id": 608512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f154d17-2c5a-53bb-b14e-7aeaff32e568", "parentControlId": 32097, "controlId": "SR-03", "title": "SR-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590819" }, { "id": 608513, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "054fbff9-4f54-575e-aa81-50a723999058", "parentControlId": 32097, "controlId": "SR-03", "title": "SR-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590819" }, { "id": 608514, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af6ceb87-19d3-56da-8f07-df1de0a74e43", "parentControlId": 32097, "controlId": "SR-03", "title": "SR-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590819" }, { "id": 608515, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590819", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4bc4fc67-bbf7-524a-9d91-c0a5a0e6ab1a", "parentControlId": 32097, "controlId": "SR-03", "title": "SR-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590819" }, { "id": 608516, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "081d1c03-2e58-5a27-bc53-cf455fdf5c2e", "parentControlId": 32097, "controlId": "SR-03", "title": "SR-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590821" }, { "id": 608517, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590821", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98eec1b9-b355-568c-ba46-3a0d3920f77c", "parentControlId": 32097, "controlId": "SR-03", "title": "SR-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590821" }, { "id": 608518, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24d26468-4010-5b71-8b51-7dec5db034df", "parentControlId": 32097, "controlId": "SR-3", "title": "SR-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590822" }, { "id": 608519, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "844162ae-cb68-573a-a653-563787782566", "parentControlId": 32097, "controlId": "SR-3", "title": "SR-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590822" }, { "id": 608523, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db99c675-2777-55e0-b431-5df7073116fe", "parentControlId": 32097, "controlId": "03.17.03.a", "title": "03.17.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590822" }, { "id": 608524, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f767487a-8cec-5ada-bf39-e35f0143c6e5", "parentControlId": 32097, "controlId": "03.17.03.b", "title": "03.17.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590822" }, { "id": 608525, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ccd1e7a7-e627-563a-9e5b-808724a1fee4", "parentControlId": 32097, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590822" }, { "id": 608526, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590822", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2130eae5-6b13-5219-ae5a-6fd7dbcef29e", "parentControlId": 32097, "controlId": "GV.SC-07", "title": "GV.SC-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590822" } ], "id": 32097, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731358", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731358", "catalogueId": 1062, "uuid": "e6633ea0-56df-5313-a208-8b944f2f1a38", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization address identified weaknesses or deficiencies in the security of the supply chain

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Processes To Address Weaknesses or Deficiencies", "description": "

Control Description

Mechanisms exist to address identified weaknesses or deficiencies in the security of the supply chain

Evidence Request List (ERL)

E-TPM-01\nE-TPM-02\nE-TPM-03\nE-TPM-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No centralized inventory of External Service Providers (ESP) is maintained.\n▪ ESP are not formally managed according to criticality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to address identified weaknesses or deficiencies in the security of the supply chain

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-03.3", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-03.3", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Liability clause in contracts

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Liability clause in contracts

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Liability clause in contracts

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Liability clause in contracts

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Liability clause in contracts", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74513, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591313", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591313", "securityControlId": 32098, "ccis": [], "uuid": "521f71b9-deeb-5392-a745-c7f26c757640", "testId": "TPM-03.4_A01", "test": "controls to ensure an adequate supply of critical system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-05(01)_ODP[01]", "defaultText": null }, { "id": 74514, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591313", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591313", "securityControlId": 32098, "ccis": [], "uuid": "785d2579-47b8-5069-bcd3-23f740e38fbf", "testId": "TPM-03.4_A02", "test": "critical system components of which an adequate supply is required are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-05(01)_ODP[02]", "defaultText": null }, { "id": 74515, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591313", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591313", "securityControlId": 32098, "ccis": [], "uuid": "72c6377a-621d-5267-931b-c1a74944a9eb", "testId": "TPM-03.4_A03", "test": "controls are employed to ensure an adequate supply of critical system components.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-05(01)", "defaultText": null } ], "externalMappings": [ { "id": 608542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "498407e0-d646-523d-a3d0-476d62c28878", "parentControlId": 32098, "controlId": "SR-05(01)", "title": "SR-05(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590825" }, { "id": 608543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f469c15-a3bb-5d0f-938a-b6b6a2a50943", "parentControlId": 32098, "controlId": "SR-05(01)", "title": "SR-05(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590825" }, { "id": 608544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae499aac-0822-563e-a8d4-e2291d5281e6", "parentControlId": 32098, "controlId": "SR-05(01)", "title": "SR-05(01)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590825" }, { "id": 608545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590825", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee750dbd-37e7-5a2e-9c58-40555ccc5f92", "parentControlId": 32098, "controlId": "SR-05(01)", "title": "SR-05(01)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590825" } ], "id": 32098, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731358", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731358", "catalogueId": 1062, "uuid": "db66db19-18e8-50dc-8d22-e86cd2ed8f2e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization develop and implement a spare parts strategy to ensure that an adequate supply of critical components is available to meet operational needs?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Adequate Supply", "description": "

Control Description

Mechanisms exist to develop and implement a spare parts strategy to ensure that an adequate supply of critical components is available to meet operational needs.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to develop and implement a spare parts strategy to ensure that an adequate supply of critical components is available to meet operational needs.

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "TPM-03.4", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-03.4", "references": "

Micro-Small Business (<10 staff)

∙ Include security requirements in vendor contracts

Small Business (10-49 staff)

∙ Security addendum in vendor contracts\n∙ Vendor security questionnaire

Medium Business (50-249 staff)

∙ Formal vendor contract security requirements\n∙ Regular vendor compliance reviews

Large Business (250-999 staff)

∙ Enterprise vendor contract security program\n∙ Standardized security SLAs

Enterprise (>1,000 staff)

∙ Enterprise TPRM platform (e.g., ProcessUnity, OneTrust)\n∙ Automated vendor contract compliance tracking", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74516, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591313", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591313", "securityControlId": 32099, "ccis": [], "uuid": "3f73f52e-9e18-5e1c-aacd-b7869c37e207", "testId": "TPM-04_A01", "test": "controls to be employed by external system service providers are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09_ODP[01]", "defaultText": null }, { "id": 74517, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591313", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591313", "securityControlId": 32099, "ccis": [], "uuid": "8db41ab2-b032-557c-9d41-e53231fd81fb", "testId": "TPM-04_A02", "test": "processes, methods and techniques employed to monitor control compliance by external service providers are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09_ODP[02]", "defaultText": null }, { "id": 74518, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591313", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591313", "securityControlId": 32099, "ccis": [], "uuid": "5e7f251b-007f-5932-ad3a-a9a6b9e54d9f", "testId": "TPM-04_A03", "test": "providers of external system services comply with organizational cybersecurity / data privacy requirements.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09a.[01]\n53A_R5_SA-09a.[02]", "defaultText": null }, { "id": 74519, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591314", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591314", "securityControlId": 32099, "ccis": [], "uuid": "dfc469db-4026-586e-972a-028a362cc53c", "testId": "TPM-04_A04", "test": "providers of external system services employ controls.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09a.[03]", "defaultText": null }, { "id": 74520, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591314", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591314", "securityControlId": 32099, "ccis": [], "uuid": "921d69c5-babd-5377-826c-9ff29607c4b1", "testId": "TPM-04_A05", "test": "organizational oversight with regard to external system services are defined and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-09b.[01]", "defaultText": null }, { "id": 74521, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591314", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591314", "securityControlId": 32099, "ccis": [], "uuid": "6f826bd6-dd07-56fa-bc21-af3189b47ae8", "testId": "TPM-04_A06", "test": "user roles and responsibilities with regard to external system services are defined and documented.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-09b.[02]", "defaultText": null }, { "id": 74522, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591314", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591314", "securityControlId": 32099, "ccis": [], "uuid": "2f29091c-cf9c-50bb-b6b2-d0544fc8ea11", "testId": "TPM-04_A07", "test": "processes, methods and techniques are employed to monitor control compliance by external service providers on an ongoing basis.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-09c.", "defaultText": null } ], "externalMappings": [ { "id": 608562, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a448e84-4938-516e-82a0-f7ba675df22a", "parentControlId": 32099, "controlId": "5.19", "title": "5.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590827" }, { "id": 608563, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590827", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39d42458-03d5-5809-9a92-9360e14e48a0", "parentControlId": 32099, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590827" }, { "id": 608571, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "61714928-2c2d-5d8b-92a7-846e12373afb", "parentControlId": 32099, "controlId": "T1041", "title": "T1041", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59083" }, { "id": 608572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bda08a14-b964-5f0b-a082-bb6e65f8bf2f", "parentControlId": 32099, "controlId": "T1048", "title": "T1048", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59083" }, { "id": 608573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59083", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a37a4c88-cbfb-5f19-ad4f-f7bf433f2460", "parentControlId": 32099, "controlId": "T1048.002", "title": "T1048.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59083" }, { "id": 608574, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bf1033cc-e92e-58b3-9784-d8a385430114", "parentControlId": 32099, "controlId": "T1048.003", "title": "T1048.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590831" }, { "id": 608575, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26513a7e-f4ea-56b0-bdb3-fe068de6f274", "parentControlId": 32099, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590831" }, { "id": 608576, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "408ef70b-f66f-51c9-9e31-9673cc6eebf5", "parentControlId": 32099, "controlId": "T1567", "title": "T1567", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590831" }, { "id": 608578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f858cbb-3d64-5379-964e-037adc6e8f49", "parentControlId": 32099, "controlId": "SA-9", "title": "SA-9", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590831" }, { "id": 608579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "619997f3-a729-5b01-9f62-bbc6e1880611", "parentControlId": 32099, "controlId": "SA-09", "title": "SA-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590831" }, { "id": 608581, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590831", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "38f0270a-9b1a-59fa-a021-9fc0d53c5357", "parentControlId": 32099, "controlId": "SA-09", "title": "SA-09", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590831" }, { "id": 608583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20789465-35ac-5b72-b4d2-63fc72e83749", "parentControlId": 32099, "controlId": "SA-09", "title": "SA-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590832" }, { "id": 608584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "616324ae-5179-53d6-9c29-37c1b2503f6f", "parentControlId": 32099, "controlId": "SA-09", "title": "SA-09", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590832" }, { "id": 608585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b4ac48c-a1b2-51f1-89d8-5b0297cc8900", "parentControlId": 32099, "controlId": "SA-09", "title": "SA-09", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590832" }, { "id": 608586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b9d894b-23a7-54f0-9259-25488691a38b", "parentControlId": 32099, "controlId": "SA-09", "title": "SA-09", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590832" }, { "id": 608587, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b84fe356-a242-542f-b7f3-bec6b3595343", "parentControlId": 32099, "controlId": "SA-9", "title": "SA-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590832" }, { "id": 608588, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2e7c329-f380-59c5-81e1-03cb56c43635", "parentControlId": 32099, "controlId": "NFO - SA-9", "title": "NFO - SA-9", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590832" }, { "id": 608589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6bbaa51-7fdf-5df6-b721-44669a659b19", "parentControlId": 32099, "controlId": "03.16.03.a", "title": "03.16.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590832" }, { "id": 608590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590832", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f420d8a-025f-54d4-aea6-0c4153dfe94b", "parentControlId": 32099, "controlId": "03.16.03.c", "title": "03.16.03.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590832" }, { "id": 608591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0bcedacb-554f-54d9-b876-c260dc43a5d2", "parentControlId": 32099, "controlId": "03.17.02", "title": "03.17.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590833" }, { "id": 608592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "629fc3ff-82a3-5ee4-b8ba-3d278fc479ef", "parentControlId": 32099, "controlId": "03.17.03.a", "title": "03.17.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590833" }, { "id": 608593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e3b3653-cc27-5d22-88de-ca4bbb41062d", "parentControlId": 32099, "controlId": "03.17.03.b", "title": "03.17.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590833" }, { "id": 608594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c08bb91-6ba8-5cde-8216-db23250d34f6", "parentControlId": 32099, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590833" }, { "id": 608595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590833", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10ce5064-6ccc-5e54-854b-05fca5e2f695", "parentControlId": 32099, "controlId": "GV.SC-07", "title": "GV.SC-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590833" }, { "id": 608625, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76722d91-9ff9-5cd3-b3b6-18a4844f75ae", "parentControlId": 32099, "controlId": "THREAT-2a", "title": "THREAT-2a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590838" }, { "id": 608626, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590838", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "643895a7-8ed0-5e49-84e1-98255d669562", "parentControlId": 32099, "controlId": "THIRD-PARTIES-1a", "title": "THIRD-PARTIES-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590838" }, { "controlId": "B.1.21", "title": "B.1.21 — Third Party Products and Controls", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SA-9, AC-20", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "03dbd159-3f1a-5236-833a-6b9f0bc346f5", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.21", "title": "NEI 08-09 App D.1.21 — Third Party Products and Controls", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.21", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e94a20ae-16d2-57aa-b5ab-bdd7edc5e3a2", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.21", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "c7c9eac9-24ec-5204-a4aa-b71a817ca37d", "isPublic": true }, { "controlId": "C.12.3", "title": "C.12.3 — Trustworthiness", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SA-9, SR-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "3b3e2fbd-2497-5f59-b5d4-9c548d8b3b66", "isPublic": true }, { "controlId": "NEI 08-09 App E.12.3 / NEI 10-08", "title": "NEI 08-09 App E.12.3 / NEI 10-08 — Trustworthiness", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.12.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6527372f-8f0b-5144-9c24-fc8c6b324a03", "isPublic": true }, { "controlId": "CIP-003-9-1.2.6", "title": "CIP-003-9-1.2.6", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "70c5c014-1754-5727-84df-b7e244e71c33", "isPublic": true }, { "controlId": "CIP-003-9-Attachment1-Sec6", "title": "CIP-003-9-Attachment1-Sec6", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b8f26da3-9459-5402-b9a3-7e274a4c582d", "isPublic": true }, { "controlId": "CIP-005-7-R3", "title": "CIP-005-7-R3 — Vendor Remote Access Management", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "06d686c0-539d-5b84-a30c-3841ee14a4fa", "isPublic": true }, { "controlId": "CIP-005-7-3.1", "title": "CIP-005-7-3.1 — Have one or more method(s) to determine authenticated vendor- initiated remote connections.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "5beaf2f8-7fa2-53ae-88b4-b0a366ae4a43", "isPublic": true }, { "controlId": "CIP-005-7-3.2", "title": "CIP-005-7-3.2 — Have one or more method(s) to terminate authenticated vendor-initiated remote connections and control the ability to...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-005-7-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2e60edc6-f3dd-5a2b-aae0-7b36f7d33400", "isPublic": true }, { "controlId": "CIP-013-2-R2", "title": "CIP-013-2-R2 — Supply Chain Risk Management Plan Implementation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2ee2efb9-c064-5748-ba67-41da2400fe6d", "isPublic": true }, { "controlId": "NSS-17T-Sec4.6", "title": "NSS-17T-Sec4.6 — Supply Chain & Vendor Computer Security Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "3028170b-ec10-58c9-8591-849dd3d43eac", "isPublic": true }, { "controlId": "IEC-62645-6.3", "title": "IEC-62645-6.3 — Supplier & Acquisition Cybersecurity Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "e31e0dd2-322e-5e03-9db3-04b1c78ef0eb", "isPublic": true }, { "controlId": "IEC-63096-15.1", "title": "IEC-63096-15.1 — Information Security in Nuclear Supplier Relationships", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "509c550c-0935-5efb-b910-1f64b0bedba0", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.2", "title": "IEEE-7-4.3.2-5.3.2 — Commercial Grade Dedication (CGD) & Supply Chain Integrity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "387b6b58-e4f9-5201-8823-4d69e55f8d87", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.e", "title": "DOE-O-205.1D-4.e — Cybersecurity Supply Chain Risk Management (C-SCRM)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "16e7a109-866f-58b3-b155-3b2189a0a5d8", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SCRM", "title": "ONR-SyAP-FSyP7-SCRM — Supply Chain Integrity & Vendor Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "c433d7a1-1153-5f4c-9d0b-c0ec4d25b9db", "isPublic": true } ], "id": 32099, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731358", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731358", "catalogueId": 1062, "uuid": "fa893e4c-5715-50db-b010-3421cf2ad522", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization mitigate the risks associated with third-party access to its Technology Assets, Applications, Services and/or Data (TAASD)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Third-Party Services", "description": "

Control Description

Mechanisms exist to mitigate the risks associated with third-party access to the organization's Technology Assets, Applications, Services and/or Data (TAASD).

Evidence Request List (ERL)

E-CPL-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel proactively control and monitor third-party accounts used to access, support, or maintain system components via remote access.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to mitigate the risks associated with third-party access to the organization's TAASD.

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.21, C.12.3
NERC-CIP (2026) Requirements: CIP-005-7-R3, CIP-013-2-R2", "controlId": "TPM-04", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-04", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74523, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591314", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591314", "securityControlId": 32100, "ccis": [], "uuid": "e9ee1ea8-32b7-5b39-a2e4-f9456e4b7fef", "testId": "TPM-04.1_A01", "test": "personnel or roles that approve the acquisition or outsourcing of dedicated cybersecurity services is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(01)_ODP", "defaultText": null }, { "id": 74524, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591315", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591315", "securityControlId": 32100, "ccis": [], "uuid": "503c5349-88bc-58eb-845c-c7923918f681", "testId": "TPM-04.1_A02", "test": "an organizational assessment of risk is conducted prior to the acquisition or outsourcing of cybersecurity services.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(01)(a)", "defaultText": null }, { "id": 74525, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591315", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591315", "securityControlId": 32100, "ccis": [], "uuid": "e4b40a3e-15e9-551c-b8ea-7d9497291c0c", "testId": "TPM-04.1_A03", "test": "personnel or roles approve the acquisition or outsourcing of dedicated cybersecurity services.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(01)(b)", "defaultText": null }, { "id": 74526, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591315", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591315", "securityControlId": 32100, "ccis": [], "uuid": "af9f48f2-86f0-5c75-8352-d22ff06df81e", "testId": "TPM-04.1_A04", "test": "a process for identifying weaknesses or deficiencies in the supply chain elements and processes is established.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.17.03.a[01]", "defaultText": null } ], "externalMappings": [ { "id": 608736, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590854", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d8f70cb-5298-5dda-91f7-a1c54da10432", "parentControlId": 32100, "controlId": "5.19", "title": "5.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590854" }, { "id": 608743, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590863", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7798f0c2-6794-59c0-9445-1ef48dfec880", "parentControlId": 32100, "controlId": "SA-9(1)", "title": "SA-9(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590863" }, { "id": 608744, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590863", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03d8c9b0-447e-5692-8986-1bcb24480832", "parentControlId": 32100, "controlId": "SA-09(01)", "title": "SA-09(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590863" }, { "id": 608745, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590863", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b31336d-f4bf-53ce-bbe8-9cbaa54a02e5", "parentControlId": 32100, "controlId": "SA-09(01)", "title": "SA-09(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590863" }, { "id": 608746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590863", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58957cfc-550a-5463-b439-c3a412737213", "parentControlId": 32100, "controlId": "SA-9(1)", "title": "SA-9(1)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590863" }, { "id": 608749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590863", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbf69f7b-12b3-538c-b7c9-87f312720259", "parentControlId": 32100, "controlId": "03.11.01.a", "title": "03.11.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590863" }, { "id": 608750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "400634bc-fbdd-5601-9a13-bdcaabbec4e1", "parentControlId": 32100, "controlId": "03.17.02", "title": "03.17.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590864" }, { "id": 608751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0bfcd482-ec7b-53f4-ad84-a90d146e93de", "parentControlId": 32100, "controlId": "03.17.03.a", "title": "03.17.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590864" }, { "id": 608752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3ecf95f-0959-5f16-bc5a-73586f1c21d9", "parentControlId": 32100, "controlId": "03.17.03.b", "title": "03.17.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590864" }, { "id": 608754, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "888cd9a3-a1ec-5cf7-8714-ff6b2e8f81de", "parentControlId": 32100, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590864" }, { "id": 608755, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "66d13f46-77f0-5a37-87e6-ee185f2e0952", "parentControlId": 32100, "controlId": "GV.SC-07", "title": "GV.SC-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590864" }, { "id": 608756, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c41b7e5-d974-59d3-ad27-ee38dda7ea0c", "parentControlId": 32100, "controlId": "ID.RA-10", "title": "ID.RA-10", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590864" }, { "id": 608757, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33e01566-aeb7-51a6-bc10-8e0b44304972", "parentControlId": 32100, "controlId": "ID.IM-01", "title": "ID.IM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590864" }, { "id": 608758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590864", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ae78334-fa6f-51e9-a644-c9daf96c2dcf", "parentControlId": 32100, "controlId": "ID.IM-02", "title": "ID.IM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590864" }, { "id": 608779, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590867", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfca649f-04f4-5bf9-aef6-ca8572d77060", "parentControlId": 32100, "controlId": "THIRD-PARTIES-1c", "title": "THIRD-PARTIES-1c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590867" }, { "id": 608780, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590867", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f993cc7-19d6-583d-be10-50b501807507", "parentControlId": 32100, "controlId": "THIRD-PARTIES-2a", "title": "THIRD-PARTIES-2a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590867" }, { "id": 608781, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590867", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6293df58-7fc1-5d60-be03-036261d07634", "parentControlId": 32100, "controlId": "THIRD-PARTIES-2b", "title": "THIRD-PARTIES-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590867" }, { "id": 608782, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590867", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b194932e-8bce-5f7a-ad75-ac31a60b95c5", "parentControlId": 32100, "controlId": "THIRD-PARTIES-2i", "title": "THIRD-PARTIES-2i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590867" }, { "id": 608783, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590867", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74fb60e0-39f3-56e7-81cc-7940207d7db1", "parentControlId": 32100, "controlId": "ARCHITECTURE-4b", "title": "ARCHITECTURE-4b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590867" }, { "id": 608784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590867", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "37261203-963c-5f29-87b9-90383ebdc151", "parentControlId": 32100, "controlId": "ARCHITECTURE-4e", "title": "ARCHITECTURE-4e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590868" } ], "id": 32100, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731359", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731359", "catalogueId": 1062, "uuid": "324e473d-3c16-5599-9bdf-0f047a9a5674", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct a risk assessment prior to the acquisition or outsourcing of technology-related Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Third-Party Risk Assessments & Approvals", "description": "

Control Description

Mechanisms exist to conduct a risk assessment prior to the acquisition or outsourcing of technology-related Technology Assets, Applications and/or Services (TAAS).

Evidence Request List (ERL)

E-TPM-01\nE-TPM-02\nE-TPM-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conduct a risk assessment prior to the acquisition or outsourcing of technology-related Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-04.1", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-04.1", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74527, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591315", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591315", "securityControlId": 32101, "ccis": [], "uuid": "4254a849-01fa-5e6a-a5f2-741b040a6fe8", "testId": "TPM-04.2_A01", "test": "external system services that require the identification of functions, ports, protocols and other services are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(02)_ODP", "defaultText": null }, { "id": 74528, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591315", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591315", "securityControlId": 32101, "ccis": [], "uuid": "114010ad-12b5-59d5-9adf-d3ebe67bd057", "testId": "TPM-04.2_A02", "test": "providers of external system services are required to identify the functions, ports, protocols and other services required for the use of such services.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(02)", "defaultText": null } ], "externalMappings": [ { "id": 608856, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8684d0a7-8992-5797-86bc-c6d1bb496a9c", "parentControlId": 32101, "controlId": "SA-9(2)", "title": "SA-9(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590881" }, { "id": 608857, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4be771d-3f22-5e27-acd3-5067792e432b", "parentControlId": 32101, "controlId": "SA-09(02)", "title": "SA-09(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590881" }, { "id": 608858, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2ee3fae-8274-5dde-bb5b-79584ff2356e", "parentControlId": 32101, "controlId": "SA-09(02)", "title": "SA-09(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590881" }, { "id": 608859, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18f57a75-ebb0-5d55-8d59-8e871a11555e", "parentControlId": 32101, "controlId": "SA-09(02)", "title": "SA-09(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590881" }, { "id": 608860, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40a9e305-c89c-562b-ba4e-97e0786ce8ef", "parentControlId": 32101, "controlId": "SA-09(02)", "title": "SA-09(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590881" }, { "id": 608861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4014a1c9-9470-5d94-8787-f49014c0268e", "parentControlId": 32101, "controlId": "SA-09(02)", "title": "SA-09(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590881" }, { "id": 608862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590881", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b311bf5b-765b-5480-ae6b-653c8a76ceaf", "parentControlId": 32101, "controlId": "NFO - SA-9(2)", "title": "NFO - SA-9(2)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590882" } ], "id": 32101, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731359", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731359", "catalogueId": 1062, "uuid": "dbcb2fea-dfff-548f-951a-5a52bd0ca0f1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require External Service Providers (ESPs) to identify and document the business need for ports, protocols and other services it requires to operate its Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "External Connectivity Requirements - Identification of Ports, Protocols & Services", "description": "

Control Description

Mechanisms exist to require External Service Providers (ESPs) to identify and document the business need for ports, protocols and other services it requires to operate its Technology Assets, Applications and/or Services (TAAS).

Evidence Request List (ERL)

E-CPL-06\nE-TDA-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ No centralized inventory of External Service Providers (ESP) is maintained.\n▪ ESP are not formally managed according to criticality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require External Service Providers (ESPs) to identify and document the business need for ports, protocols and other services it requires to operate its Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-04.2", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-04.2", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74529, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591316", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591316", "securityControlId": 32102, "ccis": [], "uuid": "89f11a7a-36ca-52f4-9f81-bfc8111a04d8", "testId": "TPM-04.3_A01", "test": "external service providers are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(04)_ODP[01]", "defaultText": null }, { "id": 74530, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591316", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591316", "securityControlId": 32102, "ccis": [], "uuid": "76f45955-c03c-5311-b5f4-2b7ad2a2e5b5", "testId": "TPM-04.3_A02", "test": "actions to be taken to verify that the interests of external service providers are consistent with and reflect organizational interests are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(04)_ODP[02]", "defaultText": null }, { "id": 74531, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591316", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591316", "securityControlId": 32102, "ccis": [], "uuid": "7aec3ef6-de48-562c-bcdb-7dc4cb3b2168", "testId": "TPM-04.3_A03", "test": "actions are taken to verify that the interests of external service providers are consistent with and reflect organizational interests.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(04)", "defaultText": null } ], "externalMappings": [ { "id": 608883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590884", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "518768f2-03a8-5133-ac39-c240b72015f0", "parentControlId": 32102, "controlId": "5.19", "title": "5.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590884" }, { "id": 608885, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590884", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52d357f9-65d6-5938-af2d-bfa58f6475d2", "parentControlId": 32102, "controlId": "SA-9(4)", "title": "SA-9(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590884" }, { "id": 608886, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590884", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9cf0d601-b59a-5b89-97ed-0326504aa2ff", "parentControlId": 32102, "controlId": "SA-09(03)", "title": "SA-09(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590884" }, { "id": 608887, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590884", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f27f4a54-a981-54c8-8b07-b19a868f5bc7", "parentControlId": 32102, "controlId": "SA-09(04)", "title": "SA-09(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590884" }, { "id": 608888, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590884", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7215843-f598-5208-8d40-e35c4d5dc267", "parentControlId": 32102, "controlId": "SA-09(03)", "title": "SA-09(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590884" }, { "id": 608889, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590885", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "30cfdf0b-9815-52d3-acec-16c28ab4ba35", "parentControlId": 32102, "controlId": "SA-09(04)", "title": "SA-09(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590885" }, { "id": 608890, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590885", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5a4dcf8c-395b-51c9-a193-ab2525dc5d63", "parentControlId": 32102, "controlId": "SA-9(4)", "title": "SA-9(4)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590885" }, { "id": 608892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590887", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ecea5b2-9a10-566b-8b82-9a26a1db4856", "parentControlId": 32102, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590887" } ], "id": 32102, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73136", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73136", "catalogueId": 1062, "uuid": "1a820e1d-3f3c-5d2c-b13a-bc52dd9bac91", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure that the interests of external service providers are consistent with and reflect organizational interests?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Conflict of Interests", "description": "

Control Description

Mechanisms exist to ensure that the interests of external service providers are consistent with and reflect organizational interests.

Evidence Request List (ERL)

E-TPM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure that the interests of external service providers are consistent with and reflect organizational interests.

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-04.3", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-04.3", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74532, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591316", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591316", "securityControlId": 32103, "ccis": [], "uuid": "ec95304f-4270-50c0-b0b4-cf6466ebf8d8", "testId": "TPM-04.4_A01", "test": "locations where information processing and data storage is/are to be restricted are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: information processing, information or data, AND system services", "otherId": "53A_R5_SA-09(05)_ODP[01]\n53A_R5_SA-09(05)_ODP[02]", "defaultText": null }, { "id": 74533, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591317", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591317", "securityControlId": 32103, "ccis": [], "uuid": "f9043dc8-9f50-5315-90ab-0bc31cb974e5", "testId": "TPM-04.4_A02", "test": "requirements or conditions for restricting the location of information processing, information storage or information services are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(05)_ODP[03]", "defaultText": null }, { "id": 74534, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591317", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591317", "securityControlId": 32103, "ccis": [], "uuid": "3aa7b56b-7361-5817-8d7a-881d8169bd4d", "testId": "TPM-04.4_A03", "test": "based on requirements, information processing, information storage or information services is/are restricted to locations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-09(05)", "defaultText": null }, { "id": 74535, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591317", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591317", "securityControlId": 32103, "ccis": [], "uuid": "a340adaf-8ab6-583f-8126-e4b4666dbec3", "testId": "TPM-04.4_A04", "test": "the location or site of the facility where the system resides is planned considering physical and environmental hazards.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-23a.", "defaultText": null }, { "id": 74536, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591317", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591317", "securityControlId": 32103, "ccis": [], "uuid": "b4a86115-6b34-5b3c-b30b-61c144d49385", "testId": "TPM-04.4_A05", "test": "for existing facilities, physical and environmental hazards are considered in the organizational risk management strategy.
PPTDF Applicability: Facility
Assessment Rigor: 1", "otherId": "53A_R5_PE-23b.", "defaultText": null } ], "externalMappings": [ { "id": 608906, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d33d4fd-340c-5f78-8f7a-9ecd19b30063", "parentControlId": 32103, "controlId": "5.21", "title": "5.21", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590889" }, { "id": 608908, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6173bfb1-14ab-505a-a966-728db6bcd493", "parentControlId": 32103, "controlId": "SA-9(5)", "title": "SA-9(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590889" }, { "id": 608909, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590889", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "634f886d-fa23-58de-9663-e174e54d0bb2", "parentControlId": 32103, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590889" }, { "id": 608910, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f707d8d-8685-53d6-a559-63aac509faf9", "parentControlId": 32103, "controlId": "SA-09(05)", "title": "SA-09(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59089" }, { "id": 608913, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d192e24e-7879-5828-9025-f633997ecf83", "parentControlId": 32103, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59089" }, { "id": 608914, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f45a71ad-6e7c-5b13-9313-726b08e9f5fa", "parentControlId": 32103, "controlId": "SA-09(05)", "title": "SA-09(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59089" }, { "id": 608915, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad4bc88f-2de3-5ae4-b400-ea90c08770df", "parentControlId": 32103, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59089" }, { "id": 608916, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1300a4d7-ad53-5546-8d2e-fafb8affb67d", "parentControlId": 32103, "controlId": "SA-9(5)", "title": "SA-9(5)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59089" }, { "id": 608917, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59089", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b1d65e2-897a-5155-87b3-e2aa4b7f2790", "parentControlId": 32103, "controlId": "PE-23", "title": "PE-23", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59089" }, { "id": 608921, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72b7c9b6-443d-59be-9610-64d32c855bac", "parentControlId": 32103, "controlId": "03.16.03.a", "title": "03.16.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590891" }, { "id": 608922, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590891", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "618a6b46-bbfa-5a4f-87e1-19c883e63b36", "parentControlId": 32103, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590891" } ], "id": 32103, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73136", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73136", "catalogueId": 1062, "uuid": "208cc14a-8d3b-5555-bb7c-83270c7aaf20", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization restrict the location of information processing/storage based on business requirements?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Third-Party Processing, Storage and Service Locations", "description": "

Control Description

Mechanisms exist to restrict the location of information processing/storage based on business requirements.

Evidence Request List (ERL)

E-AST-23

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to restrict the location of information processing/storage based on business requirements.

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-04.4", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-04.4", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74537, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591328", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591328", "securityControlId": 32104, "ccis": [], "uuid": "61b47a48-4724-54d2-9d43-7fef034a84d8", "testId": "TPM-05_A01", "test": "legally-binding contracts are executed to enforce cybersecurity / data privacy requirements by third-parties.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74538, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591328", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591328", "securityControlId": 32104, "ccis": [], "uuid": "e22b8456-16de-5738-b286-789df3919ddf", "testId": "TPM-05_A02", "test": "before sharing sensitive / regulated data, Non-Disclosure Agreements (NDAs) are executed with third parties.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74539, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591331", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591331", "securityControlId": 32104, "ccis": [], "uuid": "8f5e3124-814d-5710-977a-29f72f521ef1", "testId": "TPM-05_A03", "test": "security requirements to be satisfied by external system service providers are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.16.03.ODP[01]", "defaultText": null }, { "id": 74540, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591331", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591331", "securityControlId": 32104, "ccis": [], "uuid": "5eb7a3f6-f84d-549d-ab38-fc170d307954", "testId": "TPM-05_A04", "test": "the providers of external system services used for the processing, storage, or transmission of sensitive / regulated data comply with organization-defined security requirements.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74541, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591331", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591331", "securityControlId": 32104, "ccis": [], "uuid": "ba56c346-2dc3-53bc-9385-2232f5290b4b", "testId": "TPM-05_A05", "test": "the providers of external system services used for the processing, storage, or transmission of CUI comply with the following security requirements: .
PPTDF Applicability: Data
Assessment Rigor: NIST 800-171
SCF Defined Parameters: SDP values: \n(1) For cloud service providers:\n (i) FedRAMP Authorized at the FedRAMP Moderate (or higher) baseline in accordance with the FedRAMP Marketplace; or\n (ii) meets security requirements established by the government equivalent to the FedRAMP Moderate (or higher) baseline.\n(2) All other external service providers must meet NIST SP 800-171 R2.", "otherId": "171A_R3_A.03.16.03.a", "defaultText": null } ], "externalMappings": [ { "id": 609030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d624a9a-2aec-5ddc-a192-16f885a68f28", "parentControlId": 32104, "controlId": "5.19", "title": "5.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590921" }, { "id": 609031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e062cb4-9f25-57c7-91dc-a08cfd9f80c8", "parentControlId": 32104, "controlId": "5.2", "title": "5.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590921" }, { "id": 609032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "54e8d16e-f3fb-57aa-9404-0e0370319907", "parentControlId": 32104, "controlId": "5.21", "title": "5.21", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590921" }, { "id": 609033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "baca1e2e-8166-55a0-9b21-81f24ed5d343", "parentControlId": 32104, "controlId": "5.31", "title": "5.31", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590921" }, { "id": 609034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "788371d7-918f-5639-9361-1a306b1f0c9a", "parentControlId": 32104, "controlId": "6.6", "title": "6.6", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590921" }, { "id": 609035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590921", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32c5ea81-d52a-5a5f-8b57-9c727424f84c", "parentControlId": 32104, "controlId": "8.21", "title": "8.21", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590921" }, { "id": 609036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590922", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "461ee72e-7ef5-51d9-956e-ec3f03da177e", "parentControlId": 32104, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590922" }, { "id": 609061, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590929", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b03b9d8c-c170-5bfd-b2b1-10472e84f151", "parentControlId": 32104, "controlId": "SA-9(3)", "title": "SA-9(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590929" }, { "id": 609062, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590929", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9b256bd-fc7b-5cf9-b3f8-257518b27220", "parentControlId": 32104, "controlId": "SR-03(03)", "title": "SR-03(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590929" }, { "id": 609067, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59093", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc7c84a0-8234-518d-8117-11c3545c6f25", "parentControlId": 32104, "controlId": "SR-03(03)", "title": "SR-03(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59093" }, { "id": 609068, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59093", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c5361cf-fb36-5e8a-8d22-22828e51afea", "parentControlId": 32104, "controlId": "SA-9(3)", "title": "SA-9(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59093" }, { "id": 609069, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59093", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04356249-cb2e-5ed3-9a21-e819ae7d4b49", "parentControlId": 32104, "controlId": "SR-3(3)", "title": "SR-3(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59093" }, { "id": 609070, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59093", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3a66fed-3d86-5183-aabf-39b35d6d7bbb", "parentControlId": 32104, "controlId": "SR-3(3)", "title": "SR-3(3)", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59093" }, { "id": 609076, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590931", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8238001-4b30-5a77-b93d-6291b3914671", "parentControlId": 32104, "controlId": "3.1.1", "title": "3.1.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590931" }, { "id": 609077, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590931", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f0a2e60-916b-5ebf-ab00-2b1345637de8", "parentControlId": 32104, "controlId": "NFO - SA-4", "title": "NFO - SA-4", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590931" }, { "id": 609078, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590931", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01855832-da75-5029-ac2c-dabead5cb2f7", "parentControlId": 32104, "controlId": "03.01.20.b", "title": "03.01.20.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590931" }, { "id": 609079, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590931", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b1a9889-58e0-5996-b8cb-1a7bd9771af9", "parentControlId": 32104, "controlId": "03.01.20.c.01", "title": "03.01.20.c.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590931" }, { "id": 609080, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590931", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd7698a6-e8fc-53cc-8ec6-2e252beb5327", "parentControlId": 32104, "controlId": "03.01.20.c.02", "title": "03.01.20.c.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590931" }, { "id": 609081, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590932", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b014e2a8-a6b4-52c5-a9fd-146d1f7167e5", "parentControlId": 32104, "controlId": "03.07.06.a", "title": "03.07.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590932" }, { "id": 609082, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590932", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d1935fca-f106-55d9-a710-a56b021845f1", "parentControlId": 32104, "controlId": "03.16.03.a", "title": "03.16.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590932" }, { "id": 609083, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590932", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e4c80ac-c518-5fc0-ada6-9f91bdce60d9", "parentControlId": 32104, "controlId": "03.16.03.b", "title": "03.16.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590932" }, { "id": 609084, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590932", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f79ddcc0-9ccd-5f6d-bf04-fcf1929ffceb", "parentControlId": 32104, "controlId": "03.16.03.c", "title": "03.16.03.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590932" }, { "id": 609085, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590932", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "283d98e7-0187-5137-8be1-218e487d6c42", "parentControlId": 32104, "controlId": "03.17.02", "title": "03.17.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590932" }, { "id": 609086, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590932", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01694a1d-2ce8-5c20-8bc0-d0ab9aafaf21", "parentControlId": 32104, "controlId": "03.17.03.b", "title": "03.17.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590932" }, { "id": 609090, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590932", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cee71c68-f22e-5e65-9564-4e60ecef3e11", "parentControlId": 32104, "controlId": "GV.OC-02", "title": "GV.OC-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590932" }, { "id": 609091, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85fa2824-2ab9-52cc-b8dd-1bebfd739421", "parentControlId": 32104, "controlId": "GV.OC-03", "title": "GV.OC-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590935" }, { "id": 609092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f575d79f-5090-549d-844d-ea8769ee8306", "parentControlId": 32104, "controlId": "GV.SC-02", "title": "GV.SC-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590935" }, { "id": 609093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590935", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d19d910-981c-5c8a-a0a6-66244cc193a2", "parentControlId": 32104, "controlId": "GV.SC-05", "title": "GV.SC-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590935" }, { "id": 609094, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590936", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "32a25410-abb9-5d24-804c-ba7dec6070cb", "parentControlId": 32104, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590936" }, { "id": 609140, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590941", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0bfc251-74d6-5cc3-906b-6533bc3426b4", "parentControlId": 32104, "controlId": "THIRD-PARTIES-2c", "title": "THIRD-PARTIES-2c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590941" }, { "id": 609141, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3feb1265-ad7c-573a-9d1d-e89ae07db6a5", "parentControlId": 32104, "controlId": "THIRD-PARTIES-2e", "title": "THIRD-PARTIES-2e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590945" }, { "id": 609142, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c654a10-4288-5da6-8936-b24da28487d6", "parentControlId": 32104, "controlId": "THIRD-PARTIES-2f", "title": "THIRD-PARTIES-2f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590945" }, { "id": 609143, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bdb1d06f-1ce0-5c4c-b2e1-6fb05cc46b79", "parentControlId": 32104, "controlId": "THIRD-PARTIES-2g", "title": "THIRD-PARTIES-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590945" }, { "id": 609144, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590945", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02914525-d461-568e-a0f3-2f2ca2e6372b", "parentControlId": 32104, "controlId": "THIRD-PARTIES-2h", "title": "THIRD-PARTIES-2h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590945" }, { "id": 609225, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590958", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acb293cd-85f8-53f9-8282-0dc788c489a5", "parentControlId": 32104, "controlId": "7-2", "title": "7-2", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590958" }, { "id": 609226, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590958", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58672f6e-5637-53ed-afce-81ba9d10fb9e", "parentControlId": 32104, "controlId": "7-3", "title": "7-3", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590958" }, { "id": 609227, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590958", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9731f488-c67f-5f22-9428-3446833c3eb3", "parentControlId": 32104, "controlId": "7-4", "title": "7-4", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590958" }, { "id": 609228, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.590958", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58a7226c-d093-5d0d-8083-b756b49895dd", "parentControlId": 32104, "controlId": "7-5", "title": "7-5", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.590958" }, { "controlId": "B.1.21", "title": "B.1.21 — Third Party Products and Controls", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SA-9, AC-20", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "e8eeb884-8022-5326-8c79-8e239f4cf228", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.21", "title": "NEI 08-09 App D.1.21 — Third Party Products and Controls", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.21", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "29236b82-af5b-5305-a0c1-af3d10c17bc7", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.21", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "aa941757-793c-55a9-95c5-43cb4b1e9a8a", "isPublic": true }, { "controlId": "C.12.3", "title": "C.12.3 — Trustworthiness", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SA-9, SR-6", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "419b6676-e173-5605-ad5b-96416dc79520", "isPublic": true }, { "controlId": "NEI 08-09 App E.12.3 / NEI 10-08", "title": "NEI 08-09 App E.12.3 / NEI 10-08 — Trustworthiness", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.12.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "f2428802-6d82-59e5-967d-9078c3e393f9", "isPublic": true }, { "controlId": "CIP-013-2-R2", "title": "CIP-013-2-R2 — Supply Chain Risk Management Plan Implementation", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7e8db10e-7a9c-5b85-b038-624d4f532bea", "isPublic": true }, { "controlId": "NSS-17T-Sec4.6", "title": "NSS-17T-Sec4.6 — Supply Chain & Vendor Computer Security Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "dbaca0e7-456e-5ee9-b6d0-6b40220dc7ce", "isPublic": true }, { "controlId": "IEC-62645-6.3", "title": "IEC-62645-6.3 — Supplier & Acquisition Cybersecurity Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "541ad524-5b8e-520a-ab75-f8050e806e4a", "isPublic": true }, { "controlId": "IEC-63096-15.1", "title": "IEC-63096-15.1 — Information Security in Nuclear Supplier Relationships", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "1b60debd-d814-5026-ba20-78b79943a33a", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.2", "title": "IEEE-7-4.3.2-5.3.2 — Commercial Grade Dedication (CGD) & Supply Chain Integrity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "5357c7cf-c5c4-5022-8b4d-1e5eacd196d6", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.e", "title": "DOE-O-205.1D-4.e — Cybersecurity Supply Chain Risk Management (C-SCRM)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "fa23b774-0e5e-5a59-8243-67522939cd3a", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SCRM", "title": "ONR-SyAP-FSyP7-SCRM — Supply Chain Integrity & Vendor Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "8cfa38dc-07dd-5aeb-ba47-9f4dac4851c4", "isPublic": true } ], "id": 32104, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73136", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73136", "catalogueId": 1062, "uuid": "cde80ce3-a3a1-5212-be99-0cbcedf49a9b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Third-Party Contract Requirements", "description": "

Control Description

Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).

Evidence Request List (ERL)

E-RSK-02\nE-TPM-01\nE-TPM-03\nE-TPM-06\nE-TPM-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Procurement practices contractually require ESP to follow secure engineering practices as part of a broader Cybersecurity Supply Chain Risk Management (C-SCRM) initiative.\n▪ A formal agreement exists between the organization and applicable third-parties that includes a Non-Disclosure Agreement (NDA) addressing shared sensitive data.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its TAASD.

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.21, C.12.3
NERC-CIP (2026) Requirements: CIP-013-2-R2", "controlId": "TPM-05", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-05", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls\n∙ Non-Disclosure Agreements (NDAs)

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls\n∙ Non-Disclosure Agreements (NDAs)

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls\n∙ Non-Disclosure Agreements (NDAs)

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls\n∙ Non-Disclosure Agreements (NDAs)

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls\n∙ Non-Disclosure Agreements (NDAs)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74542, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591331", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591331", "securityControlId": 32105, "ccis": [], "uuid": "281b58e5-472c-501d-a951-303b5c152666", "testId": "TPM-05.1_A01", "test": "security requirements to be satisfied by external system service providers are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: notification of supply chain compromises and results of assessment or audits", "otherId": "53A_R5_SR-08_ODP[01]\n53A_R5_SR-08_ODP[02]", "defaultText": null }, { "id": 74543, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591332", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591332", "securityControlId": 32105, "ccis": [], "uuid": "649d9279-6751-5e28-9e6a-e506c5cbcdf1", "testId": "TPM-05.1_A02", "test": "agreements and procedures are established with entities involved in the supply chain for the system, system components or system service per organization-defined criteria.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: notification of supply chain compromises and results of assessment or audits", "otherId": "53A_R5_SR-08", "defaultText": null }, { "id": 74544, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591332", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591332", "securityControlId": 32105, "ccis": [], "uuid": "9088950c-846a-530e-ab06-3e308f68469b", "testId": "TPM-05.1_A03", "test": "External Service Providers (ESPs) are contractually obligated to provide notification of actual or potential compromises in the supply chain that can potentially affect or have adversely affected systems, applications and/or services that the organization utilizes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 609498, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c365e5c-606d-59e7-8d86-a033c5f73a87", "parentControlId": 32105, "controlId": "5.21", "title": "5.21", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591013" }, { "id": 609500, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2e9b66c-a101-5f09-9ff9-52e6551ee481", "parentControlId": 32105, "controlId": "SR-08", "title": "SR-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591013" }, { "id": 609501, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2cbc88ad-8e7b-53fe-bb33-08179b78097e", "parentControlId": 32105, "controlId": "SR-08", "title": "SR-08", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591013" }, { "id": 609504, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebdad660-4a78-5c81-9ac9-4d2da054fbf1", "parentControlId": 32105, "controlId": "SR-08", "title": "SR-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591013" }, { "id": 609505, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fe80a8a1-2d63-5e17-8660-dc2e9063ef78", "parentControlId": 32105, "controlId": "SR-08", "title": "SR-08", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591013" }, { "id": 609506, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a6c5e5f-d81d-56f7-af99-f9cef564f21a", "parentControlId": 32105, "controlId": "SR-08", "title": "SR-08", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591013" }, { "id": 609507, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591013", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64a90adc-b6f8-527c-b2de-9667589d2e76", "parentControlId": 32105, "controlId": "SR-08", "title": "SR-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591013" }, { "id": 609508, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591014", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "acbea97a-d4cd-5aaf-af91-ad2ccc0ea7b5", "parentControlId": 32105, "controlId": "SR-8", "title": "SR-8", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591014" }, { "id": 609509, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591014", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "165aa530-fd71-55e2-9ff7-9d951cef2de6", "parentControlId": 32105, "controlId": "SR-8", "title": "SR-8", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591014" }, { "id": 609512, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591014", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad4dbbfc-27dd-5ef6-aaee-ab9105d6e8ce", "parentControlId": 32105, "controlId": "03.17.02", "title": "03.17.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591014" }, { "id": 609529, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591016", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc76635d-5fb7-5293-9c21-0f71b8d2e425", "parentControlId": 32105, "controlId": "CIP-013-2 1.2.1", "title": "CIP-013-2 1.2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591016" } ], "id": 32105, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731361", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731361", "catalogueId": 1062, "uuid": "735dddb1-2a29-5cee-9c1b-1f1d32e6a242", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization compel External Service Providers (ESPs) to provide notification of actual or potential compromises in the supply chain that can potentially affect or have adversely affected Technology Assets, Applications and/or Services (TAAS) that the organization utilizes?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Security Compromise Notification Agreements", "description": "

Control Description

Mechanisms exist to compel External Service Providers (ESPs) to provide notification of actual or potential compromises in the supply chain that can potentially affect or have adversely affected Technology Assets, Applications and/or Services (TAAS) that the organization utilizes.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to compel External Service Providers (ESPs) to provide notification of actual or potential compromises in the supply chain that can potentially affect or have adversely affected Technology Assets, Applications and/or Services (TAAS) that the organization utilizes.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-05.1", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-05.1", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74545, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591332", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591332", "securityControlId": 32106, "ccis": [], "uuid": "3172cc86-6cdf-549d-a44a-6b95215dcef7", "testId": "TPM-05.2_A01", "test": "the controls included in the contracts of prime contractors are also included in the contracts of subcontractors.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-03(03)", "defaultText": null }, { "id": 74546, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591332", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591332", "securityControlId": 32106, "ccis": [], "uuid": "e96e2f7d-1f96-5336-8127-fccdfcffd378", "testId": "TPM-05.2_A02", "test": "security requirements to be satisfied by external system service providers are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.16.03.ODP[01]", "defaultText": null } ], "externalMappings": [ { "id": 609548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591021", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "611dd1e0-1515-5808-b259-64d83ba54e5b", "parentControlId": 32106, "controlId": "SR-03(03)", "title": "SR-03(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591021" }, { "id": 609552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591021", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f468f11c-5038-50c5-a8b6-0e7b8f460e09", "parentControlId": 32106, "controlId": "SR-03(03)", "title": "SR-03(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591022" }, { "id": 609553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "48c522b4-d4dd-59e2-a078-5c7dca73f7b9", "parentControlId": 32106, "controlId": "SR-3(3)", "title": "SR-3(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591022" }, { "id": 609554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7677f447-ff86-551d-bbd2-66353cd7138a", "parentControlId": 32106, "controlId": "SR-3(3)", "title": "SR-3(3)", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591022" }, { "id": 609557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee670092-5246-5499-91b4-c9b19bc086b9", "parentControlId": 32106, "controlId": "3.1.1", "title": "3.1.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591022" }, { "id": 609558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "907a1763-d59b-533b-82d4-b76494521871", "parentControlId": 32106, "controlId": "03.16.03.a", "title": "03.16.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591022" }, { "id": 609559, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5bfd36b8-44ce-53c0-ad15-775ce833a914", "parentControlId": 32106, "controlId": "03.16.03.b", "title": "03.16.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591022" }, { "id": 609560, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591022", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "62a2f0c3-494e-55f7-a286-b8a01f4e2318", "parentControlId": 32106, "controlId": "03.16.03.c", "title": "03.16.03.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591022" }, { "id": 609561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591023", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22567d7e-b2fb-5f3d-a543-c6126f2f8a66", "parentControlId": 32106, "controlId": "03.17.02", "title": "03.17.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591023" }, { "id": 609562, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591023", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e97b7c1-438f-537b-91d0-1c713ab308be", "parentControlId": 32106, "controlId": "03.17.03.b", "title": "03.17.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591023" }, { "id": 609564, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591023", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cb3e9983-c2fc-546d-8cda-f496bf5c18a2", "parentControlId": 32106, "controlId": "GV.OC-03", "title": "GV.OC-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591023" }, { "id": 609565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591023", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "092e2b1a-8383-524b-9a1b-47a9e204f857", "parentControlId": 32106, "controlId": "GV.SC-02", "title": "GV.SC-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591023" }, { "id": 609566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591023", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a3f117f-aad4-5c62-9029-bab10ae43c27", "parentControlId": 32106, "controlId": "GV.SC-05", "title": "GV.SC-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591023" }, { "id": 609567, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591023", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d1cb2f5-3de1-5cca-8164-1172149524fd", "parentControlId": 32106, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591023" }, { "id": 609568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591024", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42215232-e674-5a49-acd2-84f44e5d2308", "parentControlId": 32106, "controlId": "GV.SC-10", "title": "GV.SC-10", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591024" }, { "id": 609601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fe2b95c-9a6c-521c-a97c-e8607276b3e4", "parentControlId": 32106, "controlId": "7-2", "title": "7-2", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591037" }, { "id": 609602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591037", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "be95cb15-fe42-593e-8f3a-5da319939013", "parentControlId": 32106, "controlId": "7-4", "title": "7-4", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591037" }, { "id": 609603, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591038", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "edd78bf7-8d99-5a14-bc31-3692b5817856", "parentControlId": 32106, "controlId": "7-5", "title": "7-5", "catalog": "Safeguarding of NNPI (2010)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591038" } ], "id": 32106, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731361", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731361", "catalogueId": 1062, "uuid": "56562897-82c4-5327-90fc-d09b34ab46ac", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure applicable security, compliance and resilience requirements are included in contracts that flow-down to applicable sub-contractors and suppliers?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Contract Flow-Down Requirements", "description": "

Control Description

Mechanisms exist to ensure applicable security, compliance and resilience requirements are included in contracts that flow-down to applicable sub-contractors and suppliers.

Evidence Request List (ERL)

E-RSK-02

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Procurement practices contractually require ESP to follow secure engineering practices as part of a broader Cybersecurity Supply Chain Risk Management (C-SCRM) initiative.\n▪ A formal agreement exists between the organization and applicable third-parties that includes a Non-Disclosure Agreement (NDA) addressing shared sensitive data.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure applicable security, compliance and resilience requirements are included in contracts that flow-down to applicable sub-contractors and suppliers.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-05.2", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-05.2", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74547, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591333", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591333", "securityControlId": 32107, "ccis": [], "uuid": "4ffc8924-c3da-5750-8b05-1dea367cff53", "testId": "TPM-05.3_A01", "test": "Third-Party Service Providers (TSP) are obligated to use unique authentication factors for each of its customers.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 609639, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16b2feb2-763d-518a-9ad7-af49246ad060", "parentControlId": 32107, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591042" }, { "id": 609640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591042", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43ae8016-3537-5c37-99f6-f4eadee075bb", "parentControlId": 32107, "controlId": "GV.SC-10", "title": "GV.SC-10", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591042" } ], "id": 32107, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731361", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731361", "catalogueId": 1062, "uuid": "02614414-f942-5f3c-85aa-acecd496c4d8", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure External Service Providers (ESPs) use unique authentication factors for each of its customers?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Third-Party Authentication Practices", "description": "

Control Description

Mechanisms exist to ensure External Service Providers (ESPs) use unique authentication factors for each of its customers.

Evidence Request List (ERL)

E-TPM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure External Service Providers (ESPs) use unique authentication factors for each of its customers.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-05.3", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-05.3", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74548, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591333", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591333", "securityControlId": 32108, "ccis": [], "uuid": "fb1b6a45-2b65-5834-b5c0-19d4b7b9294e", "testId": "TPM-05.4_A01", "test": "a Responsible, Accountable, Supportive, Consulted & Informed (RASCI) matrix, or similar documentation, delineates assignment for cybersecurity / data privacy controls between internal stakeholders and Third-Party Service Providers (TSP).
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74549, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591333", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591334", "securityControlId": 32108, "ccis": [], "uuid": "85e67f52-3ec5-5ef1-8be5-158504fd0b36", "testId": "TPM-05.4_A02", "test": "user roles and responsibilities with regard to external system services, including shared responsibilities with external service providers, are defined and documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.16.03.b", "defaultText": null } ], "externalMappings": [ { "id": 609666, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74e0542a-ca16-5d40-abba-49976d67dc76", "parentControlId": 32108, "controlId": "4.3(c)", "title": "4.3(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591048" }, { "id": 609667, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a146285b-459a-5da4-8f19-f8da2c5b8592", "parentControlId": 32108, "controlId": "5.2", "title": "5.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591048" }, { "id": 609668, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591048", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad904b33-6069-5603-8ec4-80e78330281f", "parentControlId": 32108, "controlId": "5.23", "title": "5.23", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591048" }, { "id": 609684, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59105", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f106f0d-a248-5b77-a3ea-d2b43f5aa4b8", "parentControlId": 32108, "controlId": "SA-09(03)", "title": "SA-09(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59105" }, { "id": 609686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59105", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55172761-6e36-56ca-b307-1b8467903d38", "parentControlId": 32108, "controlId": "SA-09(03)", "title": "SA-09(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59105" }, { "id": 609687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59105", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c392124-fe7b-588e-9fad-582d370a1d83", "parentControlId": 32108, "controlId": "SA-9(3)", "title": "SA-9(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59105" }, { "id": 609691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591052", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e2d6246-616a-5a7c-b9e2-fad94ac03ad8", "parentControlId": 32108, "controlId": "03.07.06.a", "title": "03.07.06.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591052" }, { "id": 609692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5a88a99-0e90-53d2-96ec-4c0700ff3f0e", "parentControlId": 32108, "controlId": "03.16.03.b", "title": "03.16.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591053" }, { "id": 609694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8842795e-6067-586e-b9d1-4c952b3a2158", "parentControlId": 32108, "controlId": "GV.OC", "title": "GV.OC", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591053" }, { "id": 609695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2c54181-438a-5654-867e-c4ad27895ba5", "parentControlId": 32108, "controlId": "GV.OC-02", "title": "GV.OC-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591053" }, { "id": 609696, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f7c1bfe-5d0b-5562-b167-637764d02163", "parentControlId": 32108, "controlId": "GV.RM-05", "title": "GV.RM-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591053" }, { "id": 609697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e831814-df15-57c0-80a6-7f1b66655212", "parentControlId": 32108, "controlId": "GV.RR", "title": "GV.RR", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591053" }, { "id": 609698, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eec4c239-305a-59b5-b853-16baaf781d58", "parentControlId": 32108, "controlId": "GV.RR-02", "title": "GV.RR-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591053" }, { "id": 609699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "442bc7c1-b891-50a9-ab0c-b9d6e5f99af5", "parentControlId": 32108, "controlId": "GV.SC-02", "title": "GV.SC-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591053" }, { "id": 609700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591053", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f536ced6-1707-55a1-9b08-32ff0f849cd9", "parentControlId": 32108, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591054" }, { "id": 609701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591054", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1762d04f-b925-58b8-b18b-af60a1bf87a8", "parentControlId": 32108, "controlId": "ID.AM", "title": "ID.AM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591054" }, { "id": 609735, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22845cde-8ada-5697-b853-d073b5f94c2f", "parentControlId": 32108, "controlId": "THREAT-2a", "title": "THREAT-2a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591058" }, { "id": 609736, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591058", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f3dccd4-9b22-57bf-b81b-803786a1c16d", "parentControlId": 32108, "controlId": "THIRD-PARTIES-1a", "title": "THIRD-PARTIES-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591058" } ], "id": 32108, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731362", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731362", "catalogueId": 1062, "uuid": "a2c29994-b56f-5856-bd89-2f5337d5b22b", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization document and maintain a Responsible, Accountable, Supportive, Consulted & Informed (RASCI) matrix, or similar documentation, to delineate assignment for security, compliance and resilience controls between internal stakeholders and External Service Providers (ESPs)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Responsible, Accountable, Supportive, Consulted & Informed (RASCI) Matrix", "description": "

Control Description

Mechanisms exist to document and maintain a Responsible, Accountable, Supportive, Consulted & Informed (RASCI) matrix, or similar documentation, to delineate assignment for security, compliance and resilience controls between internal stakeholders and External Service Providers (ESPs).

Evidence Request List (ERL)

E-CPL-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel govern third-party cybersecurity and data protection roles and responsibilities through a Responsible, Accountable, Supportive, Consulted & Informed (RASCI) matrix, or similar shared responsibilities tracking tool.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to document and maintain a Responsible, Accountable, Supportive, Consulted & Informed (RASCI) matrix, or similar documentation, to delineate assignment for security, compliance and resilience controls between internal stakeholders and External Service Providers (ESPs).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-05.4", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-05.4", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Third-party contract requirements for cybersecurity controls\n∙ Customer Responsibility Matrix (CRM)\n∙ Shared Responsibility Matrix (SRM)\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Third-party contract requirements for cybersecurity controls\n∙ Customer Responsibility Matrix (CRM)\n∙ Shared Responsibility Matrix (SRM)\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Third-party contract requirements for cybersecurity controls\n∙ Customer Responsibility Matrix (CRM)\n∙ Shared Responsibility Matrix (SRM)\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Third-party contract requirements for cybersecurity controls\n∙ Customer Responsibility Matrix (CRM)\n∙ Shared Responsibility Matrix (SRM)\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Third-party contract requirements for cybersecurity controls\n∙ Customer Responsibility Matrix (CRM)\n∙ Shared Responsibility Matrix (SRM)\n∙ Responsible, Accountable, Supporting, Consulted and Informed (RASCI) matrix", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74550, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591334", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591334", "securityControlId": 32109, "ccis": [], "uuid": "f08e3e53-4f7f-58df-ac97-3b9be0ef2d09", "testId": "TPM-05.5_A01", "test": "recurring validation of the Responsible, Accountable, Supportive, Consulted & Informed (RASCI) matrix, or similar documentation, is performed to ensure cybersecurity / data privacy control assignments accurately reflect current business practices, compliance obligations, technologies and stakeholders.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74551, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591334", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591334", "securityControlId": 32109, "ccis": [], "uuid": "fd5a3468-aece-51c2-a19f-9cfacaa6e036", "testId": "TPM-05.5_A02", "test": "processes, methods, and techniques to monitor security requirement compliance by external service providers on an ongoing basis are implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.16.03.c", "defaultText": null } ], "externalMappings": [ { "id": 609783, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9b8bc6a-5a8f-5375-9f22-dbac953432b8", "parentControlId": 32109, "controlId": "03.16.03.c", "title": "03.16.03.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591069" }, { "id": 609784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591069", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c22f6e8-ded0-54b3-8fd9-144293a7ecd5", "parentControlId": 32109, "controlId": "03.17.02", "title": "03.17.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591069" }, { "id": 609785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "11c9105f-9ecf-5783-a24d-7def37f8b8f2", "parentControlId": 32109, "controlId": "03.17.03.a", "title": "03.17.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59107" }, { "id": 609786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cf2d0bd0-c30c-561e-a645-c1b8f13d6bce", "parentControlId": 32109, "controlId": "03.17.03.b", "title": "03.17.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59107" }, { "id": 609788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59107", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3eef225-ff5a-53b9-b2e5-080097f4c830", "parentControlId": 32109, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59107" }, { "id": 609808, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591074", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7c40a4c-da42-56e8-a7af-2302c23c2490", "parentControlId": 32109, "controlId": "THIRD-PARTIES-2d", "title": "THIRD-PARTIES-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591074" } ], "id": 32109, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731362", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731362", "catalogueId": 1062, "uuid": "22b4126b-e353-5181-b366-2c24ce7e56f9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization perform recurring validation of the Responsible, Accountable, Supportive, Consulted & Informed (RASCI) matrix, or similar documentation, to ensure security, compliance and resilience control assignments accurately reflect current:\n(1) Contractual obligations for the External Service Provider (ESP);\n(2) Business practices;\n(3) Applicable stakeholders; and\n(4) Deployed Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Third-Party Scope Review", "description": "

Control Description

Mechanisms exist to perform recurring validation of the Responsible, Accountable, Supportive, Consulted & Informed (RASCI) matrix, or similar documentation, to ensure security, compliance and resilience control assignments accurately reflect current:\n(1) Contractual obligations for the External Service Provider (ESP);\n(2) Business practices;\n(3) Applicable stakeholders; and\n(4) Deployed Technology Assets, Applications and/or Services (TAAS).

Evidence Request List (ERL)

E-TPM-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to perform recurring validation of the Responsible, Accountable, Supportive, Consulted & Informed (RASCI) matrix, or similar documentation, to ensure security, compliance and resilience control assignments accurately reflect current:\n(1) Contractual obligations for the External Service Provider (ESP);\n(2) Business practices;\n(3) Applicable stakeholders; and\n(4) Deployed Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-05.5", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-05.5", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74552, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591335", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591335", "securityControlId": 32110, "ccis": [], "uuid": "1ee38595-0762-58f5-a48d-8c3b49a2adab", "testId": "TPM-05.6_A01", "test": "a First-Party Declaration (1PD) is obtained from applicable Third-Party Service Providers (TSP) that provides assurance of compliance with specified statutory, regulatory and contractual obligations for cybersecurity / data privacy controls, including any flow-down requirements to subcontractors.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74553, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591335", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591335", "securityControlId": 32110, "ccis": [], "uuid": "12ab427d-9e70-5995-89b9-dfbf1b357718", "testId": "TPM-05.6_A02", "test": "processes, methods, and techniques to monitor security requirement compliance by external service providers on an ongoing basis are implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.16.03.c", "defaultText": null } ], "externalMappings": [ { "id": 609827, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591077", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fc14401-d808-5bed-8ad4-e285eebab30b", "parentControlId": 32110, "controlId": "03.01.20.c.01", "title": "03.01.20.c.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591077" }, { "id": 609828, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591077", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "badf53cb-2b58-5155-9404-c396d7a04cb4", "parentControlId": 32110, "controlId": "03.16.03.c", "title": "03.16.03.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591077" }, { "id": 609830, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591077", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "736319d0-b8b4-5479-83e9-9b27ea7c8471", "parentControlId": 32110, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591077" } ], "id": 32110, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731363", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731363", "catalogueId": 1062, "uuid": "9e7d2655-a1c6-59a8-a29d-d29f3000e221", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization obtain a First-Party Declaration(1PD) from applicable External Service Providers (ESPs) that provides assurance of compliance with specified statutory, regulatory and contractual obligations for security, compliance and resilience controls, including any flow-down requirements to subcontractors?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 7.0, "title": "First-Party Declaration (1PD)", "description": "

Control Description

Mechanisms exist to obtain a First-Party Declaration(1PD) from applicable External Service Providers (ESPs) that provides assurance of compliance with specified statutory, regulatory and contractual obligations for security, compliance and resilience controls, including any flow-down requirements to subcontractors.

Evidence Request List (ERL)

E-TPM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to obtain a First-Party Declaration(1PD) from applicable External Service Providers (ESPs) that provides assurance of compliance with specified statutory, regulatory and contractual obligations for security, compliance and resilience controls, including any flow-down requirements to subcontractors.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-05.6", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-05.6", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74554, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591335", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591335", "securityControlId": 32111, "ccis": [], "uuid": "f72c70d2-70e6-524b-9fe3-3f87329c3c28", "testId": "TPM-05.7_A01", "test": "contracts with third-parties include \"break clauses\" to enable the organization to exit a contract due to a third-party's non-compliance with contract requirements for cybersecurity / data privacy controls.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 609861, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "426ec5a7-0fc5-530b-b6a0-61194248f637", "parentControlId": 32111, "controlId": "SA-09(03)", "title": "SA-09(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591086" }, { "id": 609862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef683ba8-54ca-5216-8ef6-fb506c868b18", "parentControlId": 32111, "controlId": "SA-09(03)", "title": "SA-09(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591086" }, { "id": 609863, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591086", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bfaeb47-9680-5584-9bca-36d9d04a5549", "parentControlId": 32111, "controlId": "SA-9(3)", "title": "SA-9(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591086" }, { "id": 609867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f49b6c4-2a15-5622-94be-d275c729eae3", "parentControlId": 32111, "controlId": "03.17.01.a", "title": "03.17.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591087" }, { "id": 609868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03170152-9905-5712-853d-e259ab22024d", "parentControlId": 32111, "controlId": "03.17.02", "title": "03.17.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591087" }, { "id": 609869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a997a5a2-463e-51e3-941e-32a7c492bee5", "parentControlId": 32111, "controlId": "03.17.03.b", "title": "03.17.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591087" }, { "id": 609870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591087", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "628e4f15-e0f6-5421-8e09-ce5ae147d678", "parentControlId": 32111, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591087" } ], "id": 32111, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731363", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731363", "catalogueId": 1062, "uuid": "e6d3d934-0929-5971-a7bf-4667ae96a5d9", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization include \"break clauses\" within contracts for failure to meet contract criteria for security, compliance and/or resilience controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Break Clauses", "description": "

Control Description

Mechanisms exist to include \"break clauses\" within contracts for failure to meet contract criteria for security, compliance and/or resilience controls.

Evidence Request List (ERL)

E-TPM-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Contracts with ESP contain break clauses to enable penalty-free, early termination of a contract for cause, based on ESP cybersecurity and/or data protection practices deficiency(ies).

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to include \"break clauses\" within contracts for failure to meet contract criteria for security, compliance and/or resilience controls.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-05.7", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-05.7", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74555, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591336", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591336", "securityControlId": 32112, "ccis": [], "uuid": "f9353a37-bc19-5aef-acac-5c397c2eeb22", "testId": "TPM-05.8_A01", "test": "statutory, regulatory and/or contractual obligations requiring a conformity assessment by an independent Third-Party Assessment Organization (3PAO) are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74556, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591336", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591336", "securityControlId": 32112, "ccis": [], "uuid": "e7d494c8-3128-5e46-912f-28abaa245281", "testId": "TPM-05.8_A02", "test": "a current and passing conformity assessment by an independent Third-Party Assessment Organization (3PAO) exists for each applicable statutory, regulatory and/or contractual obligation requiring a 3PAO's attestation.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74557, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591336", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591336", "securityControlId": 32112, "ccis": [], "uuid": "04cddfd4-6264-55cb-9b7c-844ca0cba6c8", "testId": "TPM-05.8_A03", "test": "processes, methods, and techniques to monitor security requirement compliance by external service providers on an ongoing basis are implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.16.03.c", "defaultText": null } ], "externalMappings": [ { "id": 609898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591092", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51220682-eab4-5960-9a9e-3fb3b6d78b0f", "parentControlId": 32112, "controlId": "03.01.20.a", "title": "03.01.20.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591092" }, { "id": 609899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591092", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b043c14-a410-5265-a2c8-c9ce84c5311a", "parentControlId": 32112, "controlId": "03.01.20.b", "title": "03.01.20.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591092" }, { "id": 609900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591092", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d242bf9c-94b5-560b-9be8-6fefd0ead6eb", "parentControlId": 32112, "controlId": "03.01.20.c.01", "title": "03.01.20.c.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591092" }, { "id": 609901, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591092", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0f54d9de-a22f-5343-bbd4-2b2c1cceb41b", "parentControlId": 32112, "controlId": "03.16.03.a", "title": "03.16.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591093" }, { "id": 609902, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591093", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a14d752d-c2fa-55a5-ad62-6e2b3d2562b1", "parentControlId": 32112, "controlId": "03.16.03.c", "title": "03.16.03.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591093" } ], "id": 32112, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731363", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731363", "catalogueId": 1062, "uuid": "361fd988-a70d-5b9d-ba59-c634ce8f7b5e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization obtain an attestation from an independent Third-Party Assessment Organization (3PAO) that provides assurance of conformity with specified statutory, regulatory and contractual obligations for security, compliance and resilience controls, including any flow-down requirements to contractors and subcontractors?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 5.0, "title": "Third-Party Attestation (3PA)", "description": "

Control Description

Mechanisms exist to obtain an attestation from an independent Third-Party Assessment Organization (3PAO) that provides assurance of conformity with specified statutory, regulatory and contractual obligations for security, compliance and resilience controls, including any flow-down requirements to contractors and subcontractors.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to obtain an attestation from an independent Third-Party Assessment Organization (3PAO) that provides assurance of conformity with specified statutory, regulatory and contractual obligations for security, compliance and resilience controls, including any flow-down requirements to contractors and subcontractors.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-05.8", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-05.8", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74558, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591336", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591336", "securityControlId": 32113, "ccis": [], "uuid": "711eb079-ebd8-58d8-abaf-d773d289637c", "testId": "TPM-06_A01", "test": "roles and responsibilities for third-party provider personnel are documented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 609917, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9b07569-d949-54fe-b9b1-ea8bd1e8ef8c", "parentControlId": 32113, "controlId": "5.2", "title": "5.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591103" }, { "id": 609918, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "77c28edb-6d76-53be-8022-b9a0542daf93", "parentControlId": 32113, "controlId": "5.19", "title": "5.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591103" }, { "id": 609919, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591103", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92c57d6f-3c9e-57f1-8fa1-553385fad704", "parentControlId": 32113, "controlId": "8.3", "title": "8.3", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591103" }, { "id": 609929, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591104", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6dc379ad-7945-5024-b6ee-36208ff9b75d", "parentControlId": 32113, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591104" }, { "id": 609930, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591104", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fdfd0cb9-4a18-59bc-b8a1-3963b9ab8121", "parentControlId": 32113, "controlId": "ID.AM", "title": "ID.AM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591104" }, { "controlId": "NSS-17T-Sec4.6", "title": "NSS-17T-Sec4.6 — Supply Chain & Vendor Computer Security Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "848e0c74-3679-54b5-8510-63b29ae7cee2", "isPublic": true }, { "controlId": "IEC-62645-6.3", "title": "IEC-62645-6.3 — Supplier & Acquisition Cybersecurity Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "3c6b3644-9269-5e63-9437-04850913156b", "isPublic": true }, { "controlId": "IEC-63096-15.1", "title": "IEC-63096-15.1 — Information Security in Nuclear Supplier Relationships", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "58b01cb1-2442-5186-9e48-15dfc9064d3a", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.2", "title": "IEEE-7-4.3.2-5.3.2 — Commercial Grade Dedication (CGD) & Supply Chain Integrity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "74d508bb-4990-5c31-8981-98698beb9dca", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.e", "title": "DOE-O-205.1D-4.e — Cybersecurity Supply Chain Risk Management (C-SCRM)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "fed4c44f-6357-5f5f-a141-f605e8c70354", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SCRM", "title": "ONR-SyAP-FSyP7-SCRM — Supply Chain Integrity & Vendor Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "7e801aef-5bfa-5bdd-880c-83ec7d612a39", "isPublic": true } ], "id": 32113, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731364", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731364", "catalogueId": 1062, "uuid": "60ff7a1e-fec8-5f98-8374-2d548cf8c19d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization control personnel security requirements including security roles and responsibilities for third-party providers?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Third-Party Personnel Security", "description": "

Control Description

Mechanisms exist to control personnel security requirements including security roles and responsibilities for third-party providers.

Evidence Request List (ERL)

E-TPM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to control personnel security requirements including security roles and responsibilities for third-party providers.

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-06", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-06", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74561, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591337", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591337", "securityControlId": 32115, "ccis": [], "uuid": "d3f37bb4-9a12-5811-bc40-e45d3403aefc", "testId": "TPM-08_A01", "test": "the frequency at which to assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components or system services they provide is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SR-06_ODP", "defaultText": null }, { "id": 74562, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591338", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591338", "securityControlId": 32115, "ccis": [], "uuid": "b2a20fee-110f-501f-8929-d6f9460de600", "testId": "TPM-08_A02", "test": "the supply chain-related risks associated with suppliers or contractors and the systems, system components or system services they provide are assessed and reviewed per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_SR-06", "defaultText": null }, { "id": 74563, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591338", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591338", "securityControlId": 32115, "ccis": [], "uuid": "57992838-356b-5446-8a67-47927c9f2941", "testId": "TPM-08_A03", "test": "supply chain elements, processes and actors to be analyzed and tested are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-06(01)_ODP[01]\n53A_R5_SR-06(01)_ODP[02]", "defaultText": null }, { "id": 74564, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591338", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591338", "securityControlId": 32115, "ccis": [], "uuid": "33347067-d5dc-5a79-aea1-5a5173077a10", "testId": "TPM-08_A04", "test": "organization-defined mechanisms are employed on supply chain elements, processes and actors associated with the system, system component or system service.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SR-06(01)", "defaultText": null }, { "id": 74565, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591339", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591339", "securityControlId": 32115, "ccis": [], "uuid": "8386a55f-c6f3-540d-bc86-634425a9f3d3", "testId": "TPM-08_A05", "test": "processes, methods, and techniques to monitor security requirement compliance by external service providers on an ongoing basis are implemented.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.16.03.c", "defaultText": null } ], "externalMappings": [ { "id": 609982, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8c44254-0ee1-5d0a-80e5-7b4c9d01fde8", "parentControlId": 32115, "controlId": "5.19", "title": "5.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591117" }, { "id": 609983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed067730-7ce9-5e04-8477-b8a761624a54", "parentControlId": 32115, "controlId": "5.2", "title": "5.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591117" }, { "id": 609984, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21292a25-0d47-52a8-9a15-895b0dda2b95", "parentControlId": 32115, "controlId": "5.22", "title": "5.22", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591117" }, { "id": 609985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591117", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5ea896b-7cd4-5b03-aeb6-4c1014e94704", "parentControlId": 32115, "controlId": "8.21", "title": "8.21", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591117" }, { "id": 609997, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591122", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "caf1713b-5439-5419-a532-29b3633d1341", "parentControlId": 32115, "controlId": "SA-12(2)", "title": "SA-12(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591122" }, { "id": 609998, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591122", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "836e417b-7230-5858-9cce-83ef61516865", "parentControlId": 32115, "controlId": "SR-06", "title": "SR-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591122" }, { "id": 609999, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591122", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18c9fd3b-df45-52aa-ad0a-cd3385a8af0b", "parentControlId": 32115, "controlId": "SR-06(01)", "title": "SR-06(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591122" }, { "id": 610000, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591122", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a7cbbe41-2492-51b8-9a6e-687c64176fc4", "parentControlId": 32115, "controlId": "SR-06", "title": "SR-06", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591122" }, { "id": 610001, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591123", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d02715b-9925-5e86-9517-d20ecbcc8956", "parentControlId": 32115, "controlId": "SR-06", "title": "SR-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591123" }, { "id": 610002, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591123", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "894f10d6-ff97-5414-9c78-69bc1f302239", "parentControlId": 32115, "controlId": "SR-06(01)", "title": "SR-06(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591123" }, { "id": 610003, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591123", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "667441da-fcda-50ca-b475-563cff8d9c6e", "parentControlId": 32115, "controlId": "SR-06", "title": "SR-06", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591123" }, { "id": 610004, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591123", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9448d99-c4b3-51eb-8a3b-b0d8a0d7c01b", "parentControlId": 32115, "controlId": "SR-06", "title": "SR-06", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591123" }, { "id": 610006, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591123", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8444fa5-ff83-5826-931a-09d1eca3e1dc", "parentControlId": 32115, "controlId": "SR-6", "title": "SR-6", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591123" }, { "id": 610009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591124", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e3fc290e-1af4-538b-9efe-dc0e33762a1e", "parentControlId": 32115, "controlId": "03.16.03.c", "title": "03.16.03.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591124" }, { "id": 610010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591124", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "772b06f2-0e44-55dc-a642-437bd1cbc816", "parentControlId": 32115, "controlId": "03.17.02", "title": "03.17.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591124" }, { "id": 610012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591124", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abb4e9e8-b091-5a7b-89fd-33a26079ace4", "parentControlId": 32115, "controlId": "GV.SC-07", "title": "GV.SC-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591124" }, { "id": 610013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591124", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "207d9e34-3008-5079-bb72-b3e5e6eba599", "parentControlId": 32115, "controlId": "ID.IM-01", "title": "ID.IM-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591124" }, { "id": 610014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591124", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "966f7b3f-5e8e-5ce0-8c56-d578d09dc2be", "parentControlId": 32115, "controlId": "ID.IM-02", "title": "ID.IM-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591124" }, { "id": 610040, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a4067f8-5f08-5361-bba7-580d63ce3363", "parentControlId": 32115, "controlId": "THIRD-PARTIES-2d", "title": "THIRD-PARTIES-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591128" }, { "controlId": "NSS-17T-Sec4.6", "title": "NSS-17T-Sec4.6 — Supply Chain & Vendor Computer Security Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "b8573b2a-deb1-5178-bb27-8c342942f745", "isPublic": true }, { "controlId": "IEC-62645-6.3", "title": "IEC-62645-6.3 — Supplier & Acquisition Cybersecurity Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "4c48118d-89e3-57b2-9cac-020016dba79d", "isPublic": true }, { "controlId": "IEC-63096-15.1", "title": "IEC-63096-15.1 — Information Security in Nuclear Supplier Relationships", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "ac3c452e-f199-5168-94db-7e6ef14df0d5", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.2", "title": "IEEE-7-4.3.2-5.3.2 — Commercial Grade Dedication (CGD) & Supply Chain Integrity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "5ee30342-744f-52a4-bee9-8494d8baebc0", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.e", "title": "DOE-O-205.1D-4.e — Cybersecurity Supply Chain Risk Management (C-SCRM)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "60cebdca-635c-598a-a7bb-968a5ea73edb", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SCRM", "title": "ONR-SyAP-FSyP7-SCRM — Supply Chain Integrity & Vendor Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "390dee51-0aaf-5750-b1e6-b2715c29fad8", "isPublic": true } ], "id": 32115, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731364", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731364", "catalogueId": 1062, "uuid": "dd0db19a-9961-5d4d-923c-22804909b336", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization monitor, regularly review and assess External Service Providers (ESPs) for compliance with established contractual requirements for security, compliance and resilience controls?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Review of Third-Party Services", "description": "

Control Description

Mechanisms exist to monitor, regularly review and assess External Service Providers (ESPs) for compliance with established contractual requirements for security, compliance and resilience controls.

Evidence Request List (ERL)

E-TPM-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to monitor, regularly review and assess External Service Providers (ESPs) for compliance with established contractual requirements for security, compliance and resilience controls.

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-08", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-08", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74566, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591339", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591339", "securityControlId": 32116, "ccis": [], "uuid": "b9629399-3bdc-5a31-a4a7-f2f54e5fb46e", "testId": "TPM-09_A01", "test": "weaknesses or deficiencies in supply chain elements identified during independent or organizational assessments of such elements are remediated.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 610116, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591145", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4bcdccb0-2499-5d8c-a430-94d1124f6732", "parentControlId": 32116, "controlId": "5.19", "title": "5.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591145" }, { "id": 610118, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591146", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6cf3a007-170f-5372-a8fe-e0f5a70322cf", "parentControlId": 32116, "controlId": "03.17.02", "title": "03.17.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591146" }, { "id": 610119, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591146", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65cb3fa5-d8c1-5d21-be27-7a4192293442", "parentControlId": 32116, "controlId": "GV.SC-06", "title": "GV.SC-06", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591146" }, { "id": 610120, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591146", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65f912b8-a130-548e-8f52-22eb896a10ac", "parentControlId": 32116, "controlId": "GV.SC-07", "title": "GV.SC-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591146" }, { "id": 610121, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591146", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55bbc205-b559-55da-834c-de95a3f139b2", "parentControlId": 32116, "controlId": "GV.SC-08", "title": "GV.SC-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591146" }, { "controlId": "NSS-17T-Sec4.6", "title": "NSS-17T-Sec4.6 — Supply Chain & Vendor Computer Security Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d54fd29c-7676-58d1-9440-99ddb733adb5", "isPublic": true }, { "controlId": "IEC-62645-6.3", "title": "IEC-62645-6.3 — Supplier & Acquisition Cybersecurity Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "21f06e6c-c418-5287-b30c-ff8a4d2aa590", "isPublic": true }, { "controlId": "IEC-63096-15.1", "title": "IEC-63096-15.1 — Information Security in Nuclear Supplier Relationships", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "e246da0f-0a51-54c3-a391-338022bf2717", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.2", "title": "IEEE-7-4.3.2-5.3.2 — Commercial Grade Dedication (CGD) & Supply Chain Integrity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "353a3173-bf0a-568e-87b6-40c8ed9d4c9b", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.e", "title": "DOE-O-205.1D-4.e — Cybersecurity Supply Chain Risk Management (C-SCRM)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "c2ac8af1-658a-508d-acec-e41b004ecb3c", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SCRM", "title": "ONR-SyAP-FSyP7-SCRM — Supply Chain Integrity & Vendor Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "a9bd97bd-c50f-57e1-9b31-62fa9abd1f0b", "isPublic": true } ], "id": 32116, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731365", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731365", "catalogueId": 1062, "uuid": "e0ef7d7b-de1f-59f1-9ac5-43b2974d9d02", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization address weaknesses or deficiencies in supply chain elements identified during independent or organizational assessments of such elements?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Third-Party Deficiency Remediation", "description": "

Control Description

Mechanisms exist to address weaknesses or deficiencies in supply chain elements identified during independent or organizational assessments of such elements.

Evidence Request List (ERL)

E-TPM-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to address weaknesses or deficiencies in supply chain elements identified during independent or organizational assessments of such elements.

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-09", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-09", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Third-party contract requirements for cybersecurity controls

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Third-party contract requirements for cybersecurity controls

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Third-party contract requirements for cybersecurity controls

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Third-party contract requirements for cybersecurity controls

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Third-party contract requirements for cybersecurity controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74567, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59134", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59134", "securityControlId": 32117, "ccis": [], "uuid": "8c2b2813-aff3-57fb-84f8-03883f19cc23", "testId": "TPM-10_A01", "test": "affected third-parties are identified through change control practices.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74568, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59134", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59134", "securityControlId": 32117, "ccis": [], "uuid": "c7767d8c-a152-5af2-8462-10ed596c9b2b", "testId": "TPM-10_A02", "test": "provided services are assessed for impact from proposed changes.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74569, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59134", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59134", "securityControlId": 32117, "ccis": [], "uuid": "559b2a91-b00a-5fa9-bf38-517feaa37e1f", "testId": "TPM-10_A03", "test": "recurring reviews are performed of third-party provided services against existing contract requirements.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74570, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59134", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59134", "securityControlId": 32117, "ccis": [], "uuid": "46fdb5aa-b3a4-5ab2-9c55-96a01940f7fe", "testId": "TPM-10_A04", "test": "discrepancies in services provided and/or geolocation of provided services are evaluated for impact to the organization's operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 610155, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a9de18ae-1158-559f-b17b-23c097d29f91", "parentControlId": 32117, "controlId": "5.2", "title": "5.2", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591153" }, { "id": 610156, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591153", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efa18d3e-fc72-5f9d-af84-7692e2d4111e", "parentControlId": 32117, "controlId": "5.22", "title": "5.22", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591153" }, { "id": 610160, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41764974-55df-5861-bb69-951f124adb63", "parentControlId": 32117, "controlId": "SA-4", "title": "SA-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591154" }, { "id": 610161, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8c832c3b-a2fe-563a-bf9f-6270d50d7af9", "parentControlId": 32117, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591154" }, { "id": 610163, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "82e48fad-18c1-58fb-ae86-727b7e43906d", "parentControlId": 32117, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591154" }, { "id": 610164, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7f24d1a-cb28-52f2-8fce-fe81d49b2263", "parentControlId": 32117, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591154" }, { "id": 610165, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591154", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b4c47b76-96fd-5745-8e0a-8af10e92a888", "parentControlId": 32117, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591154" }, { "id": 610166, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c7bd800-f80e-5a86-8b44-8d350a3b91a6", "parentControlId": 32117, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591155" }, { "id": 610167, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b604b49d-49f4-5488-b7a4-7311ab2c8be8", "parentControlId": 32117, "controlId": "SA-04", "title": "SA-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591155" }, { "id": 610168, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "972ab690-a99f-558a-885d-28c0ce8fff89", "parentControlId": 32117, "controlId": "SA-4", "title": "SA-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591155" }, { "id": 610169, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3fa2b14-fa14-5a4a-b343-023e6ca6f35f", "parentControlId": 32117, "controlId": "SA-4", "title": "SA-4", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591155" }, { "id": 610173, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591156", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "463c2d95-4dcc-5dfa-acbf-c82c4f7e6603", "parentControlId": 32117, "controlId": "03.16.01", "title": "03.16.01", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591156" }, { "id": 610174, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591156", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d24d3815-c6cc-54ac-9ae3-4f56480a2558", "parentControlId": 32117, "controlId": "03.17.02", "title": "03.17.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591156" }, { "id": 610175, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591156", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "739eec38-d65c-5a60-80df-11498e95f4f1", "parentControlId": 32117, "controlId": "GV.SC-08", "title": "GV.SC-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591156" }, { "controlId": "NSS-17T-Sec4.6", "title": "NSS-17T-Sec4.6 — Supply Chain & Vendor Computer Security Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "ecc23297-819d-58a4-966f-c607d4a6d91d", "isPublic": true }, { "controlId": "IEC-62645-6.3", "title": "IEC-62645-6.3 — Supplier & Acquisition Cybersecurity Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "eeed8eb7-c187-5bbd-bd4b-1c7dfd794c39", "isPublic": true }, { "controlId": "IEC-63096-15.1", "title": "IEC-63096-15.1 — Information Security in Nuclear Supplier Relationships", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "e982038b-ea42-5c75-9dac-db9d59d57716", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.2", "title": "IEEE-7-4.3.2-5.3.2 — Commercial Grade Dedication (CGD) & Supply Chain Integrity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "cc9e05c7-1393-532a-ad5b-d74c4fde0d95", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.e", "title": "DOE-O-205.1D-4.e — Cybersecurity Supply Chain Risk Management (C-SCRM)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "cdf96640-f01d-5d1a-b866-ef3efe1deb0d", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SCRM", "title": "ONR-SyAP-FSyP7-SCRM — Supply Chain Integrity & Vendor Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "5e5c4117-6357-560e-9086-7f64b1f13ad6", "isPublic": true } ], "id": 32117, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731365", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731365", "catalogueId": 1062, "uuid": "fe1101a4-aa32-5e53-a9c9-9424f3a273fb", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization control changes to services by suppliers, taking into account the criticality of business Technology Assets, Applications, Services and/or Data (TAASD) that are in scope by the third-party?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Managing Changes To Third-Party Services", "description": "

Control Description

Mechanisms exist to control changes to services by suppliers, taking into account the criticality of business Technology Assets, Applications, Services and/or Data (TAASD) that are in scope by the third-party.

Evidence Request List (ERL)

E-TPM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to control changes to services by suppliers, taking into account the criticality of business TAASD that are in scope by the third-party.

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-10", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-10", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Data Protection Impact Assessment (DPIA)\n∙ Third-party contract requirements for cybersecurity controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74571, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591341", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591341", "securityControlId": 32118, "ccis": [], "uuid": "90069381-dc05-59da-ac4d-17f18d86772e", "testId": "TPM-11_A01", "test": "incident handling activities involving supply chain events are coordinated with other organizations involved in the supply chain.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_IR-04(10)", "defaultText": null } ], "externalMappings": [ { "id": 610216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591163", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d00f0bf-01ad-5af0-8f84-5bf115448961", "parentControlId": 32118, "controlId": "5.19", "title": "5.19", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591163" }, { "id": 610219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d39fb21-bb03-56ac-9796-50843bd3cfce", "parentControlId": 32118, "controlId": "IR-04(10)", "title": "IR-04(10)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591164" }, { "id": 610221, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c034b82-49ce-5cf1-bd20-cfcd025fb47a", "parentControlId": 32118, "controlId": "IR-04(10)", "title": "IR-04(10)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591164" }, { "id": 610223, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2747152-1d80-5d2a-9599-760cf50c3c31", "parentControlId": 32118, "controlId": "IR-4(10)", "title": "IR-4(10)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591164" }, { "id": 610224, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591164", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "95df9875-5d64-57e4-b3ae-fc56218f17fc", "parentControlId": 32118, "controlId": "IR-4(10)", "title": "IR-4(10)", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591164" }, { "id": 610226, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591165", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9b1c42a3-958d-5899-908e-274861503cdc", "parentControlId": 32118, "controlId": "GV.SC-08", "title": "GV.SC-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591165" }, { "id": 610240, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591166", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2534d2f-1b62-577c-a723-73209a33dc91", "parentControlId": 32118, "controlId": "CIP-013-2 1.2.1", "title": "CIP-013-2 1.2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591166" }, { "id": 610241, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591179", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de412118-697e-55de-b6e3-bccac4b4cfdf", "parentControlId": 32118, "controlId": "CIP-013-2 1.2.2", "title": "CIP-013-2 1.2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591179" }, { "controlId": "NSS-17T-Sec4.6", "title": "NSS-17T-Sec4.6 — Supply Chain & Vendor Computer Security Requirements", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "5b3f267a-bf39-5c38-a4da-0d672befd40c", "isPublic": true }, { "controlId": "IEC-62645-6.3", "title": "IEC-62645-6.3 — Supplier & Acquisition Cybersecurity Management", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "cf1240e1-ffd9-510e-804a-024f29e147b8", "isPublic": true }, { "controlId": "IEC-63096-15.1", "title": "IEC-63096-15.1 — Information Security in Nuclear Supplier Relationships", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "6afb5452-671a-547a-a38c-69085bcca942", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.2", "title": "IEEE-7-4.3.2-5.3.2 — Commercial Grade Dedication (CGD) & Supply Chain Integrity", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "11e5aa68-45a5-5bfb-85d8-482524705691", "isPublic": true }, { "controlId": "DOE-O-205.1D-4.e", "title": "DOE-O-205.1D-4.e — Cybersecurity Supply Chain Risk Management (C-SCRM)", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "DOE Order 205.1D (DOE Cybersecurity Program)", "uuid": "dc199085-8cee-58f5-929c-13879ac70a48", "isPublic": true }, { "controlId": "ONR-SyAP-FSyP7-SCRM", "title": "ONR-SyAP-FSyP7-SCRM — Supply Chain Integrity & Vendor Assurance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (TPM Domain)", "catalog": "UK ONR SyAPs (Civil Nuclear Security)", "uuid": "510f34ed-92f6-53f5-a2a2-b48174447ca9", "isPublic": true } ], "id": 32118, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731366", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731366", "catalogueId": 1062, "uuid": "d6b53688-dce9-5c9a-a3a8-c2d5fb3e8c4f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure response/recovery planning and testing are conducted with critical suppliers/providers?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Third-Party Incident Response & Recovery Capabilities", "description": "

Control Description

Mechanisms exist to ensure response/recovery planning and testing are conducted with critical suppliers/providers.

Evidence Request List (ERL)

E-TPM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.\n▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution, vendor management solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure response/recovery planning and testing are conducted with critical suppliers/providers.

Level 4 - Quantitatively Controlled: Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "TPM-11", "family": "Third-Party Management", "enhancements": "", "sortId": "TPM-11", "references": "

Micro-Small Business (<10 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Third-party contract requirements for cybersecurity controls

Small Business (10-49 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Third-party contract requirements for cybersecurity controls

Medium Business (50-249 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Third-party contract requirements for cybersecurity controls

Large Business (250-999 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Third-party contract requirements for cybersecurity controls

Enterprise (>1,000 staff)

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program\n∙ Third-party contract requirements for cybersecurity controls", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74577, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591342", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591342", "securityControlId": 32122, "ccis": [], "uuid": "31d39dc3-4053-5179-bf3b-6333a84b396f", "testId": "THR-01_A01", "test": "a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence is implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-16", "defaultText": null }, { "id": 74578, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591343", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591343", "securityControlId": 32122, "ccis": [], "uuid": "4659f2c2-7982-5a4d-808e-bcec7bb557cd", "testId": "THR-01_A02", "test": "sources of threat intelligence are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.11.1e_ODP[1]", "defaultText": null }, { "id": 74579, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591343", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591343", "securityControlId": 32122, "ccis": [], "uuid": "b8be0462-6adf-537a-8ea7-45b7e8def878", "testId": "THR-01_A03", "test": "a risk assessment methodology is identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.11.1e[a]", "defaultText": null }, { "id": 74580, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591343", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591343", "securityControlId": 32122, "ccis": [], "uuid": "b5b4e2ee-7168-55ad-a2b2-3a3daf31f833", "testId": "THR-01_A04", "test": "sources of threat intelligence are employed as part of a risk assessment to guide and inform the development of organizational systems and security architectures.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.11.1e[b]", "defaultText": null }, { "id": 74581, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591343", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591343", "securityControlId": 32122, "ccis": [], "uuid": "79718a9d-a983-5392-92c1-35e6e319688e", "testId": "THR-01_A05", "test": "sources of threat intelligence are employed as part of a risk assessment to guide and inform the selection of security solutions.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.11.1e[c]", "defaultText": null }, { "id": 74582, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591343", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591343", "securityControlId": 32122, "ccis": [], "uuid": "b104bcc1-d65b-55e2-a3db-ee5051c24e09", "testId": "THR-01_A06", "test": "sources of threat intelligence are employed as part of a risk assessment to guide and inform system monitoring activities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.11.1e[d]", "defaultText": null }, { "id": 74583, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591344", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591344", "securityControlId": 32122, "ccis": [], "uuid": "9cb858de-8bc6-5662-a568-efdc319de207", "testId": "THR-01_A07", "test": "sources of threat intelligence are employed as part of a risk assessment to guide and inform threat hunting activities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.11.1e[e]", "defaultText": null }, { "id": 74584, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591344", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591344", "securityControlId": 32122, "ccis": [], "uuid": "3e54d2b3-7b08-586b-b351-e66bda16892d", "testId": "THR-01_A08", "test": "sources of threat intelligence are employed as part of a risk assessment to guide and inform response and recovery activities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.11.1e[f]", "defaultText": null }, { "id": 74585, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591344", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591344", "securityControlId": 32122, "ccis": [], "uuid": "1137831c-8dbc-57b9-8fd2-81263493d6b5", "testId": "THR-01_A09", "test": "contact is established and institutionalized with selected groups and associations within the cybersecurity / data privacy community to facilitate ongoing security education and training for organizational personnel.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-15a.[01]\n53A_R5_PM-15a.[02]", "defaultText": null }, { "id": 74586, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591344", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591344", "securityControlId": 32122, "ccis": [], "uuid": "f4696a43-9dd2-5a53-8b8b-8195121c60dc", "testId": "THR-01_A10", "test": "contact is established and institutionalized with selected groups and associations within the cybersecurity / data privacy community to maintain currency with recommended security practices, techniques and technologies.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-15b.[01]\n53A_R5_PM-15b.[02]", "defaultText": null }, { "id": 74587, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591345", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591345", "securityControlId": 32122, "ccis": [], "uuid": "fb82f667-c77a-5833-aaf4-4ec852d07103", "testId": "THR-01_A11", "test": "contact is established and institutionalized with selected groups and associations within the cybersecurity / data privacy community to share current security information, including threats, vulnerabilities and incidents.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_PM-15c.[01]\n53A_R5_PM-15c.[02]", "defaultText": null }, { "id": 74588, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591345", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591345", "securityControlId": 32122, "ccis": [], "uuid": "11241fab-3434-5dac-bea9-1726f2fbf52e", "testId": "THR-01_A12", "test": "threat management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74589, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591345", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591345", "securityControlId": 32122, "ccis": [], "uuid": "b1ea8c9e-794f-586f-8931-0f303025b364", "testId": "THR-01_A13", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support threat management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74590, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591346", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591346", "securityControlId": 32122, "ccis": [], "uuid": "ca5f785d-133a-51fb-bf1e-b5dbbc8ae41c", "testId": "THR-01_A14", "test": "responsibility and authority for the performance of threat management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74591, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591346", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591346", "securityControlId": 32122, "ccis": [], "uuid": "e65dbcc9-f685-5cf6-8616-98437ce2f9f6", "testId": "THR-01_A15", "test": "personnel performing threat management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 610260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591181", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7761df6c-32b0-5884-bfa1-d8981dfe548a", "parentControlId": 32122, "controlId": "5.7", "title": "5.7", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591181" }, { "id": 610264, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591181", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ccf84e4-f1a4-5476-a666-82426283ee36", "parentControlId": 32122, "controlId": "PM-16", "title": "PM-16", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591181" }, { "id": 610265, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591181", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23b585c9-d59f-5a1f-b20b-1194820b675d", "parentControlId": 32122, "controlId": "PM-15", "title": "PM-15", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591182" }, { "id": 610266, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ca038be-25bf-5ca4-a3ef-68d6d2b5a226", "parentControlId": 32122, "controlId": "PM-16", "title": "PM-16", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591182" }, { "id": 610268, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "162c0dcc-ae24-5953-bad1-ab04e18d527f", "parentControlId": 32122, "controlId": "PM-15", "title": "PM-15", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591182" }, { "id": 610269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb7f878a-b3db-5b71-9b45-a026e0054c08", "parentControlId": 32122, "controlId": "PM-16", "title": "PM-16", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591182" }, { "id": 610270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fa738a6-6c93-5275-b0cb-334b4c7d8669", "parentControlId": 32122, "controlId": "PM-15", "title": "PM-15", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591182" }, { "id": 610271, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591182", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0991d342-f74b-5100-bd9c-ce9e0d6a9f29", "parentControlId": 32122, "controlId": "PM-16", "title": "PM-16", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591182" }, { "id": 610272, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a59b7c6-d0d9-578d-9edc-03e58689002b", "parentControlId": 32122, "controlId": "PM-15", "title": "PM-15", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591183" }, { "id": 610273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b3a37d0-3d7b-59be-a0c3-d37b0cf91f8b", "parentControlId": 32122, "controlId": "PM-16", "title": "PM-16", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591183" }, { "id": 610274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39e131ce-9e99-5387-b3ab-edef5f902b35", "parentControlId": 32122, "controlId": "PM-15", "title": "PM-15", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591183" }, { "id": 610275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90451b53-551e-5864-b4f3-b7922211fc07", "parentControlId": 32122, "controlId": "PM-16", "title": "PM-16", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591183" }, { "id": 610277, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7a257a9c-568d-5b04-b198-5a63e9459e25", "parentControlId": 32122, "controlId": "AT-3(6)", "title": "AT-3(6)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591183" }, { "id": 610278, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bfe9c0b3-f3a3-5b58-9ff7-b2aa6f4ece43", "parentControlId": 32122, "controlId": "PM-15", "title": "PM-15", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591183" }, { "id": 610279, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591183", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04a4ae35-5b63-58a5-a816-159a33795ddd", "parentControlId": 32122, "controlId": "PM-16", "title": "PM-16", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591183" }, { "id": 610285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd2c1b90-be6a-56d2-a09d-eb363038628b", "parentControlId": 32122, "controlId": "3.12.3", "title": "3.12.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591184" }, { "id": 610286, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1234837a-12a0-5d18-881c-ed1852dbee3f", "parentControlId": 32122, "controlId": "3.14.3", "title": "3.14.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591184" }, { "id": 610287, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4df79d2f-4d17-5ee6-8d49-6af6f678cbf8", "parentControlId": 32122, "controlId": "03.11.02.a", "title": "03.11.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591184" }, { "id": 610288, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa24a1a5-6cc6-566b-b8b0-3b7949b6b1cf", "parentControlId": 32122, "controlId": "03.14.03.a", "title": "03.14.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591184" }, { "id": 610290, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591184", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d1da893-6b3c-5c4d-a6c8-603b9be78212", "parentControlId": 32122, "controlId": "ID.RA-03", "title": "ID.RA-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591184" }, { "id": 610291, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d38f3e06-19fb-5404-94f0-635e0c5d2992", "parentControlId": 32122, "controlId": "ID.RA-08", "title": "ID.RA-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591187" }, { "id": 610292, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "532b69fa-7711-574b-9aa1-025bd91ff881", "parentControlId": 32122, "controlId": "DE", "title": "DE", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591187" }, { "id": 610293, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591187", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "354c02aa-41cb-562a-aea3-f2312c527100", "parentControlId": 32122, "controlId": "DE.AE-07", "title": "DE.AE-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591187" }, { "id": 610312, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59119", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc414857-a5ec-57d1-b527-a7e608dbf380", "parentControlId": 32122, "controlId": "§117.18(b)(5)", "title": "§117.18(b)(5)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59119" }, { "id": 610339, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591193", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0cd5be7-c942-51cb-a519-24406890ef9d", "parentControlId": 32122, "controlId": "A2.b", "title": "A2.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591193" }, { "controlId": "A.4.2.4", "title": "A.4.2.4 — Updating Cyber Security Practices", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-1, SI-5, CA-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "df6f7164-d10a-52ae-b61e-dac393ed62d4", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.4", "title": "NEI 08-09 Sec 4.2.4 — Updating Cyber Security Practices", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "9d5f3cff-913f-50b7-83c0-25c0b9b24c20", "isPublic": true }, { "controlId": "10 CFR 73.54(g)", "title": "10 CFR 73.54(g) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "9c56393b-5ef8-5f62-a76f-49428293c9cd", "isPublic": true }, { "controlId": "C.10.6", "title": "C.10.6 — Situation Awareness", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-5, PM-16", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "3988a09e-7891-58d5-9169-cad06457f994", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.6", "title": "NEI 08-09 App E.10.6 — Situation Awareness", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "471f27bf-1d34-508d-b2d8-2149f2b7774a", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(2)", "title": "10 CFR 73.54(d)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.10.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "adc5c4b3-2b74-5621-89a2-b4b2a5232bcc", "isPublic": true }, { "controlId": "C.10.9", "title": "C.10.9 — Contacts with Security Groups and Associations", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-15", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "09b7cebf-f048-5ee9-966d-7d7def50fe5f", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.9", "title": "NEI 08-09 App E.10.9 — Contacts with Security Groups and Associations", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.9", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "6a8185a3-44c0-5a03-8855-ad12059f1d26", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(1)", "title": "10 CFR 73.54(d)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.10.9", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "eb91b7d1-0e57-5bc1-9899-2232b159dd7a", "isPublic": true }, { "controlId": "C.13.1", "title": "C.13.1 — Threat and Vulnerability Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: RA-3, RA-5, SI-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "4576d610-f537-5cda-9486-b94fe5f856c9", "isPublic": true }, { "controlId": "NEI 08-09 App E.13.1", "title": "NEI 08-09 App E.13.1 — Threat and Vulnerability Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.13.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d8a74551-ec87-5053-8ea3-6d918959ca85", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1), (g)", "title": "10 CFR 73.54(c)(1), (g) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.13.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "447320af-f6df-5a0b-a125-cb8ac0a965c3", "isPublic": true }, { "controlId": "CIP-014-3-R4", "title": "CIP-014-3-R4 — Evaluation of Potential Threats and Vulnerabilities", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a0e8682c-ca65-5b5c-ab29-4486f12ae5e0", "isPublic": true }, { "controlId": "CIP-014-3-4.1", "title": "CIP-014-3-4.1 — Unique characteristics of the identified and verified Transmission station(s), Transmission substation(s), and primar...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "36efca55-096d-5dc3-b90a-93695a5305f8", "isPublic": true }, { "controlId": "CIP-014-3-4.2", "title": "CIP-014-3-4.2 — Prior history of attack on similar facilities taking into account the frequency, geographic proximity, and severity o...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6cbaf4ec-fc4a-5466-9c57-084f1d68ab72", "isPublic": true }, { "controlId": "CIP-014-3-4.3", "title": "CIP-014-3-4.3 — Intelligence or threat warnings received from sources such as law enforcement, the Electric Reliability Organization...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4efe717b-a057-5986-b855-7d0fff88e6af", "isPublic": true } ], "id": 32122, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731367", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731367", "catalogueId": 1062, "uuid": "c884b355-0b64-5a24-ae51-06dc3fce51cc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement a threat intelligence program that includes a cross-organization information-sharing capability that can influence the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, response and recovery activities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Threat Intelligence Program", "description": "

Control Description

Mechanisms exist to implement a threat intelligence program that includes a cross-organization information-sharing capability that can influence the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, response and recovery activities.

Evidence Request List (ERL)

E-THR-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Threat Management (THR) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with THR domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Threat management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel subscribe to threat feeds to maintain situational awareness of emerging threats.

Level 2 - Planned & Tracked: Threat Management (THR) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Threat management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Threat management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Threat Management (THR) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are well-documented and kept current by process owners.\n▪ A threat management team, or similar function, is appropriately staffed and supported to implement and maintain THR domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of threat management operations (e.g., threat intelligence solution, bug bounty solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement a threat intelligence program that includes a cross-organization information-sharing capability that can influence the development of the system and security architectures, selection of security solutions, monitoring, threat hunting, response and recovery activities.

Level 4 - Quantitatively Controlled: Threat Management (THR) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.2.4, C.10.6, C.10.9, C.13.1
NERC-CIP (2026) Requirements: CIP-014-3-R4", "controlId": "THR-01", "family": "Threat Management", "enhancements": "", "sortId": "THR-01", "references": "

Micro-Small Business (<10 staff)

∙ Subscribe to free threat intelligence feeds (e.g., CISA alerts)

Small Business (10-49 staff)

∙ CISA alerts subscription\n∙ Basic threat awareness program

Medium Business (50-249 staff)

∙ Threat intelligence program

Large Business (250-999 staff)

∙ Threat intelligence program

Enterprise (>1,000 staff)

∙ Threat intelligence program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74592, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591346", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591346", "securityControlId": 32123, "ccis": [], "uuid": "be7cc222-83fd-506f-9f15-e6d29405e082", "testId": "THR-02_A01", "test": "Indicators of Exposure (IOE) exist for personnel to understand the potential attack vectors that attackers could use to attack the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 610365, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5912", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da1da792-9d16-5cf0-834e-abf1fed16810", "parentControlId": 32123, "controlId": "5.7", "title": "5.7", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5912" }, { "id": 610367, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1636ca17-a947-57b4-82d2-c857c72ab658", "parentControlId": 32123, "controlId": "ID.RA-03", "title": "ID.RA-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591201" }, { "id": 610368, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da0059b4-b78b-5713-b746-d769f85ed664", "parentControlId": 32123, "controlId": "ID.RA-05", "title": "ID.RA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591201" }, { "id": 610369, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ec4df92-3b33-557f-a53d-968b15b20dd6", "parentControlId": 32123, "controlId": "ID.RA-08", "title": "ID.RA-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591201" }, { "id": 610370, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "83e04c1c-4ba8-5c40-b126-e4c3b1a16951", "parentControlId": 32123, "controlId": "DE", "title": "DE", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591201" }, { "id": 610371, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591201", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7780a739-21d6-5a11-a50a-bcca98319fcd", "parentControlId": 32123, "controlId": "DE.CM", "title": "DE.CM", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591201" }, { "controlId": "CIP-015-1-R3", "title": "CIP-015-1-R3 — INSM Anomalous Activity Evaluation and Response", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c5605329-7853-5af7-b251-53fd6c3513bb", "isPublic": true } ], "id": 32123, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731367", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731367", "catalogueId": 1062, "uuid": "9c505941-4fc9-5372-b498-7ba49efe128a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization develop Indicators of Exposure (IOE) to understand the potential attack vectors that attackers could use to attack the organization?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Indicators of Exposure (IOE)", "description": "

Control Description

Mechanisms exist to develop Indicators of Exposure (IOE) to understand the potential attack vectors that attackers could use to attack the organization.

Evidence Request List (ERL)

E-THR-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Threat Management (THR) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with THR domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Threat management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Threat Management (THR) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Threat management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Threat management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Threat Management (THR) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are well-documented and kept current by process owners.\n▪ A threat management team, or similar function, is appropriately staffed and supported to implement and maintain THR domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of threat management operations (e.g., threat intelligence solution, bug bounty solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to develop Indicators of Exposure (IOE) to understand the potential attack vectors that attackers could use to attack the organization.

Level 4 - Quantitatively Controlled: Threat Management (THR) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Threat Management (THR) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

NERC-CIP (2026) Requirements: CIP-015-1-R3", "controlId": "THR-02", "family": "Threat Management", "enhancements": "", "sortId": "THR-02", "references": "

Micro-Small Business (<10 staff)

∙ Indicators of Exposure (IoE)

Small Business (10-49 staff)

∙ Indicators of Exposure (IoE)

Medium Business (50-249 staff)

∙ Indicators of Exposure (IoE)

Large Business (250-999 staff)

∙ Indicators of Exposure (IoE)

Enterprise (>1,000 staff)

∙ Indicators of Exposure (IoE)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74593, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591347", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591347", "securityControlId": 32124, "ccis": [], "uuid": "04f04d57-8311-534f-8683-e5ee4eff0888", "testId": "THR-03_A01", "test": "external organizations from whom system security alerts, advisories and directives are to be received on an ongoing basis are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-05_ODP[01]\n172A_3.14.6e_ODP[1]", "defaultText": null }, { "id": 74594, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591347", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591347", "securityControlId": 32124, "ccis": [], "uuid": "8c1b43ef-6e36-54ff-bbc3-7ef0b0f426a9", "testId": "THR-03_A02", "test": "personnel or roles to whom security alerts, advisories and directives are to be disseminated is/are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-05_ODP[02]\n53A_R5_SI-05_ODP[03]", "defaultText": null }, { "id": 74595, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591347", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591347", "securityControlId": 32124, "ccis": [], "uuid": "6a28524a-34cc-52fa-86b1-044cd3913381", "testId": "THR-03_A03", "test": "elements within the organization to whom security alerts, advisories and directives are to be disseminated are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-05_ODP[04]", "defaultText": null }, { "id": 74596, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591347", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591347", "securityControlId": 32124, "ccis": [], "uuid": "2eef6ec0-b1ba-5eca-b991-18ecc3d2ee35", "testId": "THR-03_A04", "test": "external organizations to whom security alerts, advisories and directives are to be disseminated are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-05_ODP[05]", "defaultText": null }, { "id": 74597, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591348", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591348", "securityControlId": 32124, "ccis": [], "uuid": "4773c82f-1b24-51fc-aaee-7d213af4513b", "testId": "THR-03_A05", "test": "system security alerts, advisories, and directives from external organizations are received on an ongoing basis.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-05a.\n171A_R3_A.03.14.03.a", "defaultText": null }, { "id": 74598, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591348", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591348", "securityControlId": 32124, "ccis": [], "uuid": "dc4d0e6f-6c6c-5aa6-bfbc-baa32bf55aea", "testId": "THR-03_A06", "test": "threat indicator information is identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.6e[a]", "defaultText": null }, { "id": 74599, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591348", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591348", "securityControlId": 32124, "ccis": [], "uuid": "c6b550b7-5fcc-5dee-9d0b-5c0ab67ac97b", "testId": "THR-03_A07", "test": "effective mitigations are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.6e[b]", "defaultText": null }, { "id": 74600, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591348", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591348", "securityControlId": 32124, "ccis": [], "uuid": "e59aa808-5ca4-5454-8c09-b6bc51805aa9", "testId": "THR-03_A08", "test": "intrusion detection approaches are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.6e[c]", "defaultText": null }, { "id": 74601, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591348", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591348", "securityControlId": 32124, "ccis": [], "uuid": "9cc6c5a1-e560-5fc9-bf2c-8a635bd4f088", "testId": "THR-03_A09", "test": "threat hunting activities are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.6e[d]", "defaultText": null }, { "id": 74602, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591349", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591349", "securityControlId": 32124, "ccis": [], "uuid": "217d93af-85fa-5a90-ad53-e1097bf54db6", "testId": "THR-03_A10", "test": "internal security alerts, advisories and directives are generated as deemed necessary.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-05b.", "defaultText": null }, { "id": 74603, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591349", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591349", "securityControlId": 32124, "ccis": [], "uuid": "9a8da74a-4ca3-5dd2-9741-e46dc8e6e354", "testId": "THR-03_A11", "test": "security alerts, advisories and directives are disseminated per organization-defined criteria.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: to include system security personnel and administrators with configuration/patch-management responsibilities", "otherId": "53A_R5_SI-05c.", "defaultText": null }, { "id": 74604, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591349", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591349", "securityControlId": 32124, "ccis": [], "uuid": "e511a877-d0d4-5b7b-97c3-08b9019ecc5c", "testId": "THR-03_A12", "test": "security directives are implemented in accordance with established time frames or if the issuing organization is notified of the degree of noncompliance.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-05d.", "defaultText": null }, { "id": 74605, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591349", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591349", "securityControlId": 32124, "ccis": [], "uuid": "d5587fd3-a3c3-5e41-a4b6-1e950359975e", "testId": "THR-03_A13", "test": "external organizations from which to obtain threat indicator information and effective mitigations are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.6e_ODP[1]", "defaultText": null }, { "id": 74606, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591349", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591349", "securityControlId": 32124, "ccis": [], "uuid": "5a4625f6-3ebb-5262-9e8d-c33f8cc0beb4", "testId": "THR-03.1_A03", "test": "automated mechanisms used to broadcast security alert and advisory information throughout the organization are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-05(01)_ODP", "defaultText": null }, { "id": 74607, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591349", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591349", "securityControlId": 32124, "ccis": [], "uuid": "a6828bf9-f909-58bc-b385-9c41cd324f39", "testId": "THR-03.1_A04", "test": "automated mechanisms are used to broadcast security alerts and advisory information throughout the organization.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-05(01)", "defaultText": null }, { "id": 74608, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59135", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59135", "securityControlId": 32124, "ccis": [], "uuid": "eb038afa-a993-56e2-9748-dc8a6d7fa4be", "testId": "THR-03.1_A05", "test": "automated mechanisms are employed to maximize the effectiveness of sharing threat intelligence information.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_PM-16(01)", "defaultText": null } ], "externalMappings": [ { "id": 610394, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591206", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99e597e5-02e5-5aab-a27f-3e535dc0c1df", "parentControlId": 32124, "controlId": "7.4", "title": "7.4", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591206" }, { "id": 610395, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ce06c2e0-8012-551a-a1ce-2576a9ff27c9", "parentControlId": 32124, "controlId": "7.4(a)", "title": "7.4(a)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591207" }, { "id": 610396, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64ba5746-efe8-500b-bbf5-b715e933bc6a", "parentControlId": 32124, "controlId": "7.4(b)", "title": "7.4(b)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591207" }, { "id": 610397, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0299bdda-7e38-5904-a010-4e77d40eb56d", "parentControlId": 32124, "controlId": "7.4(c)", "title": "7.4(c)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591207" }, { "id": 610398, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49a606de-1715-5dfd-90c4-4f9ee0a9d03d", "parentControlId": 32124, "controlId": "7.4(d)", "title": "7.4(d)", "catalog": "ISO 27001 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591207" }, { "id": 610399, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e2aabec8-3022-585a-a385-44ead69f3652", "parentControlId": 32124, "controlId": "5.7", "title": "5.7", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591207" }, { "id": 610401, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c050ecb2-2a62-5baa-a640-66da13d255b4", "parentControlId": 32124, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591207" }, { "id": 610402, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d25fdfc5-e0f3-5159-a92e-9132d5116ca9", "parentControlId": 32124, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591207" }, { "id": 610403, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591207", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cfd2af38-db5e-503b-9b8c-9e92a08dad5a", "parentControlId": 32124, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591207" }, { "id": 610404, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da9ee42f-c46f-5237-b5e3-edd71bb40f6d", "parentControlId": 32124, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591208" }, { "id": 610406, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e082c7c1-35ec-5465-810b-96bc6bca0a6e", "parentControlId": 32124, "controlId": "SI-5", "title": "SI-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591208" }, { "id": 610407, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9143f85a-11ab-52ed-a883-18838ab89d7c", "parentControlId": 32124, "controlId": "SI-5(1)", "title": "SI-5(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591208" }, { "id": 610408, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e6f09978-997c-5cc1-a43b-01ed8adcdbcd", "parentControlId": 32124, "controlId": "PM-16(01)", "title": "PM-16(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591208" }, { "id": 610409, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97e23ce6-3cdf-5140-8c19-8582b887840a", "parentControlId": 32124, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591208" }, { "id": 610410, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcaa53ce-3874-5dcf-ace3-72f006648949", "parentControlId": 32124, "controlId": "SI-05(01)", "title": "SI-05(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591208" }, { "id": 610412, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd333009-9f7b-54d6-a755-43cd5db856a1", "parentControlId": 32124, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591208" }, { "id": 610413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591208", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a510039-d435-5eac-9d90-2a4dcf557200", "parentControlId": 32124, "controlId": "SI-05(01)", "title": "SI-05(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591209" }, { "id": 610414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "06c86317-b88d-5690-b1e4-27d51d7ccd01", "parentControlId": 32124, "controlId": "PM-16(01)", "title": "PM-16(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591209" }, { "id": 610415, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "68df4e55-34be-516e-9127-280574d1b8af", "parentControlId": 32124, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591209" }, { "id": 610416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65ecb0ec-99e6-52f0-b9ed-a970abc0e23e", "parentControlId": 32124, "controlId": "SI-05(01)", "title": "SI-05(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591209" }, { "id": 610417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55eb7b86-9a83-52a6-98e5-4f26e410a47e", "parentControlId": 32124, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591209" }, { "id": 610418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "85655c28-df6b-58c2-8443-aac365900648", "parentControlId": 32124, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591209" }, { "id": 610419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591209", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "99f29b1f-b887-5112-9f2f-dfe367940bb3", "parentControlId": 32124, "controlId": "SI-05", "title": "SI-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591209" }, { "id": 610421, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59121", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e14b735-88c1-55db-837d-c302c4a7109b", "parentControlId": 32124, "controlId": "AT-3(6)", "title": "AT-3(6)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59121" }, { "id": 610422, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59121", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16904107-56ae-5942-b2b9-0ccc0c159b7a", "parentControlId": 32124, "controlId": "SI-5", "title": "SI-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59121" }, { "id": 610423, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59121", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44d2e12b-0162-5ca6-97c9-ce9603b2cfea", "parentControlId": 32124, "controlId": "SI-5", "title": "SI-5", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59121" }, { "id": 610424, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59121", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7d62b6ca-7997-5189-a967-e8c844580933", "parentControlId": 32124, "controlId": "SI-5", "title": "SI-5", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59121" }, { "id": 610429, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59121", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dfa875b6-2e1d-5322-b6d0-65695e823131", "parentControlId": 32124, "controlId": "3.12.3", "title": "3.12.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59121" }, { "id": 610430, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e31f579-d8ee-5f3e-8d59-f83a745867de", "parentControlId": 32124, "controlId": "3.14.3", "title": "3.14.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591211" }, { "id": 610431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a146d3f4-0bab-5df6-a17d-d7312fd0e6c8", "parentControlId": 32124, "controlId": "03.02.01.a.02", "title": "03.02.01.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591211" }, { "id": 610432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "db2bba75-160c-518d-8c20-d156ba942694", "parentControlId": 32124, "controlId": "03.02.01.a.03", "title": "03.02.01.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591211" }, { "id": 610433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53e004cb-65c9-5c04-8505-4f6f040d4e42", "parentControlId": 32124, "controlId": "03.02.01.b", "title": "03.02.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591211" }, { "id": 610434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "96d31c16-501f-5253-afc5-c3263def2aa0", "parentControlId": 32124, "controlId": "03.02.02.b", "title": "03.02.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591211" }, { "id": 610435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4a6640bf-cd62-50a0-a8bc-cb4bdd922af2", "parentControlId": 32124, "controlId": "03.11.02.a", "title": "03.11.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591211" }, { "id": 610436, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591211", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a61f0b0f-964d-5646-8d57-ce215a902277", "parentControlId": 32124, "controlId": "03.14.03.a", "title": "03.14.03.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591211" }, { "id": 610441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "745e8640-4868-59bc-ac30-189a13c2ae3e", "parentControlId": 32124, "controlId": "ID.RA-02", "title": "ID.RA-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591215" }, { "id": 610442, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e5f7014-5635-54a0-bef6-0ff2d48a23ab", "parentControlId": 32124, "controlId": "ID.RA-03", "title": "ID.RA-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591215" }, { "id": 610443, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97cd6c9b-e3bd-5daf-ae4e-09582f555c15", "parentControlId": 32124, "controlId": "ID.RA-08", "title": "ID.RA-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591215" }, { "id": 610444, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "052defb2-fccf-5cdf-8555-1e5991b6a501", "parentControlId": 32124, "controlId": "DE", "title": "DE", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591215" }, { "id": 610445, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591215", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5342553c-afea-5cc0-9264-fba0aebcdb27", "parentControlId": 32124, "controlId": "DE.AE-07", "title": "DE.AE-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591215" }, { "id": 610464, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca3b14c3-9bb4-586a-8d64-da34e40ca37b", "parentControlId": 32124, "controlId": "THREAT-1a", "title": "THREAT-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591218" }, { "id": 610465, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5bc2a8e2-4ec7-54a5-9f50-bc2c95efe06e", "parentControlId": 32124, "controlId": "THREAT-1b", "title": "THREAT-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591218" }, { "id": 610466, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ce2b071-ad1e-5632-a2cf-e3a80abc33bb", "parentControlId": 32124, "controlId": "THREAT-1e", "title": "THREAT-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591218" }, { "id": 610467, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16c98675-df0c-5623-bc92-50d924427b3a", "parentControlId": 32124, "controlId": "THREAT-2f", "title": "THREAT-2f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591218" }, { "id": 610468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e2666df-b9a1-5dd9-83b4-12e8dd87e8f5", "parentControlId": 32124, "controlId": "THREAT-2j", "title": "THREAT-2j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591218" }, { "id": 610469, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d026ce8f-2376-5284-83ff-9869d95067bc", "parentControlId": 32124, "controlId": "THREAT-2k", "title": "THREAT-2k", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591218" }, { "id": 610470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78833bf9-fb1d-5cf2-a1a4-32807b2650f8", "parentControlId": 32124, "controlId": "RISK-2k", "title": "RISK-2k", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591218" }, { "id": 610471, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591218", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "833b3247-04c8-595e-be74-39ead3807106", "parentControlId": 32124, "controlId": "SITUATION-3e", "title": "SITUATION-3e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591219" }, { "controlId": "A.4.2.4", "title": "A.4.2.4 — Updating Cyber Security Practices", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-1, SI-5, CA-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "fcabab20-a9d3-5f42-90d4-607383ab9cb8", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.2.4", "title": "NEI 08-09 Sec 4.2.4 — Updating Cyber Security Practices", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.2.4", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "d6563182-165f-5257-9652-a860d710d8a2", "isPublic": true }, { "controlId": "10 CFR 73.54(g)", "title": "10 CFR 73.54(g) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.2.4", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "8d5f5407-3dee-54f8-861d-7217fa411dd5", "isPublic": true }, { "controlId": "C.3.5", "title": "C.3.5 — Security Alerts and Advisories", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "250878e4-0d17-5e3c-9e3b-36694c93f741", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.5", "title": "NEI 08-09 App E.3.5 — Security Alerts and Advisories", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "dda97402-0bd3-5aa2-af92-3de7dd506389", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.3.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "22de8712-a943-5f19-b9f4-1879b7a4d825", "isPublic": true } ], "id": 32124, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731368", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731368", "catalogueId": 1062, "uuid": "05049fa2-9bfd-5fc3-8038-46078326894e", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization maintain situational awareness of vulnerabilities and evolving threats by leveraging the knowledge of attacker tactics, techniques and procedures to facilitate the implementation of preventative and compensating controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Threat Intelligence Feeds", "description": "

Control Description

Mechanisms exist to maintain situational awareness of vulnerabilities and evolving threats by leveraging the knowledge of attacker tactics, techniques and procedures to facilitate the implementation of preventative and compensating controls.

Evidence Request List (ERL)

E-THR-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Threat Management (THR) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with THR domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Threat management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel subscribe to threat feeds to maintain situational awareness of emerging threats.

Level 2 - Planned & Tracked: Threat Management (THR) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Threat management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Threat management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel in supervisory positions subscribe to news feeds from groups and associations to facilitate ongoing education and training.

Level 3 - Well Defined: Threat Management (THR) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are well-documented and kept current by process owners.\n▪ A threat management team, or similar function, is appropriately staffed and supported to implement and maintain THR domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of threat management operations (e.g., threat intelligence solution, bug bounty solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to maintain situational awareness of vulnerabilities and evolving threats by leveraging the knowledge of attacker tactics, techniques and procedures to facilitate the implementation of preventative and compensating controls.

Level 4 - Quantitatively Controlled: Threat Management (THR) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.2.4, C.3.5", "controlId": "THR-03", "family": "Threat Management", "enhancements": "", "sortId": "THR-03", "references": "

Micro-Small Business (<10 staff)

∙ US-CERT mailing lists & feeds\n∙ Internal newsletters

Small Business (10-49 staff)

∙ US-CERT mailing lists & feeds\n∙ Internal newsletters

Medium Business (50-249 staff)

∙ US-CERT mailing lists & feeds\n∙ Internal newsletters\n∙ InfraGard (https://infragard.org)

Large Business (250-999 staff)

∙ US-CERT mailing lists & feeds\n∙ Internal newsletters\n∙ InfraGard (https://infragard.org)

Enterprise (>1,000 staff)

∙ US-CERT mailing lists & feeds\n∙ Internal newsletters\n∙ InfraGard (https://infragard.org)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74609, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59135", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59135", "securityControlId": 32125, "ccis": [], "uuid": "79e1b257-a051-5f35-9916-ec9acb0bb283", "testId": "THR-03.1_A01", "test": "internal security alerts, advisories, and directives are generated, as necessary.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.14.03.b[01]", "defaultText": null }, { "id": 74610, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59135", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59135", "securityControlId": 32125, "ccis": [], "uuid": "1fe139cd-a974-582c-ba60-5183d17fe679", "testId": "THR-03.1_A02", "test": "internal security alerts, advisories, and directives are disseminated, as necessary.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.14.03.b[02]", "defaultText": null } ], "externalMappings": [ { "id": 610533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59123", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "331f3288-d131-5bad-ae40-e14184da2a6a", "parentControlId": 32125, "controlId": "5.7", "title": "5.7", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59123" }, { "id": 610535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591231", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ed4f980-f494-5ae7-b8e8-e90207e4d131", "parentControlId": 32125, "controlId": "03.14.03.b", "title": "03.14.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591231" }, { "id": 610538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591231", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebbf9ff5-11df-5b25-87ab-e33ba82c42d2", "parentControlId": 32125, "controlId": "THREAT-1i", "title": "THREAT-1i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591231" }, { "id": 610539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591231", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a74c69d7-f07c-5d9d-a958-57751842952d", "parentControlId": 32125, "controlId": "THREAT-2b", "title": "THREAT-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591231" }, { "id": 610540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591231", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "75552f25-dd6f-5fa2-bf4b-e764e379cb37", "parentControlId": 32125, "controlId": "THREAT-2h", "title": "THREAT-2h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591231" }, { "id": 610541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591234", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa2baae5-5094-53e4-8d00-656d5b0e1468", "parentControlId": 32125, "controlId": "THREAT-2k", "title": "THREAT-2k", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591234" }, { "controlId": "C.10.9", "title": "C.10.9 — Contacts with Security Groups and Associations", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PM-15", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "456ae4e7-863f-541a-85d0-db7f7e696f23", "isPublic": true }, { "controlId": "NEI 08-09 App E.10.9", "title": "NEI 08-09 App E.10.9 — Contacts with Security Groups and Associations", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.10.9", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "32c21bdc-ada1-5906-9f35-06a2b914590b", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(1)", "title": "10 CFR 73.54(d)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.10.9", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "d2fc5e4c-b55f-50bc-8a7e-74c0fff78a1c", "isPublic": true } ], "id": 32125, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731368", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731368", "catalogueId": 1062, "uuid": "271d8275-f43e-5053-9c86-f5ea347d7dde", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize external threat intelligence feeds to generate and disseminate organization-specific security alerts, advisories and/or directives?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Threat Intelligence Reporting", "description": "

Control Description

Mechanisms exist to utilize external threat intelligence feeds to generate and disseminate organization-specific security alerts, advisories and/or directives.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Threat Management (THR) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with THR domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Threat management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel subscribe to threat feeds to maintain situational awareness of emerging threats.\n▪ IT and/or cybersecurity personnel provide limited threat intelligence feeds to employees for situational awareness of evolving threats.

Level 2 - Planned & Tracked: Threat Management (THR) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Threat management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Threat management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ Threat feeds are utilized to maintain situational awareness of emerging threats.

Level 3 - Well Defined: Threat Management (THR) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are well-documented and kept current by process owners.\n▪ A threat management team, or similar function, is appropriately staffed and supported to implement and maintain THR domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of threat management operations (e.g., threat intelligence solution, bug bounty solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize external threat intelligence feeds to generate and disseminate organization-specific security alerts, advisories and/or directives.

Level 4 - Quantitatively Controlled: Threat Management (THR) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: C.10.9", "controlId": "THR-03.1", "family": "Threat Management", "enhancements": "", "sortId": "THR-03.1", "references": "

Micro-Small Business (<10 staff)

∙ US-CERT mailing lists & feeds\n∙ Internal newsletters

Small Business (10-49 staff)

∙ US-CERT mailing lists & feeds\n∙ Internal newsletters

Medium Business (50-249 staff)

∙ US-CERT mailing lists & feeds\n∙ Internal newsletters\n∙ InfraGard (https://infragard.org)

Large Business (250-999 staff)

∙ US-CERT mailing lists & feeds\n∙ Internal newsletters\n∙ InfraGard (https://infragard.org)

Enterprise (>1,000 staff)

∙ US-CERT mailing lists & feeds\n∙ Internal newsletters\n∙ InfraGard (https://infragard.org)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74611, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59135", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59135", "securityControlId": 32126, "ccis": [], "uuid": "867e343f-2e35-5bed-b4bb-c7a492af5954", "testId": "THR-04_A01", "test": "an insider threat program that includes a cross-discipline insider threat incident handling team is implemented.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PM-12", "defaultText": null }, { "id": 74612, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591351", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591351", "securityControlId": 32126, "ccis": [], "uuid": "50cca5d9-1e77-5907-921f-7ff450952b37", "testId": "THR-04_A02", "test": "threat indicator information and effective mitigations obtained from external organizations are used to guide and inform intrusion detection and threat hunting.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.14.6e[e]", "defaultText": null } ], "externalMappings": [ { "id": 610564, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c22e80b-23dc-5c3a-96c4-e60c443dff20", "parentControlId": 32126, "controlId": "PM-12", "title": "PM-12", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591237" }, { "id": 610565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591237", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "801e9343-1907-5ac9-9242-58f01f7ce1fb", "parentControlId": 32126, "controlId": "PM-12", "title": "PM-12", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591237" }, { "id": 610566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87534747-00c2-5c84-b796-87d96e78c223", "parentControlId": 32126, "controlId": "PM-12", "title": "PM-12", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591246" }, { "id": 610567, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5b3c7657-7138-5ef7-92e6-64ae904d4eb6", "parentControlId": 32126, "controlId": "PM-12", "title": "PM-12", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591246" }, { "id": 610568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca980eff-0a7d-5f77-97b8-545c39c4a61f", "parentControlId": 32126, "controlId": "PM-12", "title": "PM-12", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591246" }, { "id": 610569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4aa9dcc7-b6b7-5289-801b-77ce52ea949b", "parentControlId": 32126, "controlId": "PM-12", "title": "PM-12", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591246" }, { "id": 610570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "42c76efc-8e4f-5c53-a6a0-e13d02a63cf4", "parentControlId": 32126, "controlId": "PM-12", "title": "PM-12", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591246" }, { "id": 610574, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591246", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ee6b576-9f68-5632-b70f-50319fab0d94", "parentControlId": 32126, "controlId": "ID.RA-03", "title": "ID.RA-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591247" }, { "id": 610578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9770195b-817d-57e8-a4c9-6bb0b1c3f064", "parentControlId": 32126, "controlId": "§117.18(b)(4)", "title": "§117.18(b)(4)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591247" }, { "id": 610579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e9bb9fa-7fac-5298-bb49-4cc031a8f648", "parentControlId": 32126, "controlId": "§117.18(b)(4)(i)", "title": "§117.18(b)(4)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591247" }, { "id": 610580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ee44836-76e9-5527-9de6-0084c94d853a", "parentControlId": 32126, "controlId": "§117.18(b)(4)(ii)", "title": "§117.18(b)(4)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591247" }, { "id": 610581, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591247", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9880be5f-3fba-5a0e-9993-8be7e8d11815", "parentControlId": 32126, "controlId": "§117.18(b)(4)(iii)", "title": "§117.18(b)(4)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591247" }, { "id": 610582, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591248", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "545f42ed-5a99-5b1f-a015-5cbd27e09203", "parentControlId": 32126, "controlId": "§117.18(b)(4)(iv)", "title": "§117.18(b)(4)(iv)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591248" } ], "id": 32126, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731368", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731368", "catalogueId": 1062, "uuid": "d3e47483-1d31-5e14-8bba-bce3fa327da0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement an insider threat program that includes a cross-discipline insider threat incident handling team?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Insider Threat Program", "description": "

Control Description

Mechanisms exist to implement an insider threat program that includes a cross-discipline insider threat incident handling team.

Evidence Request List (ERL)

E-THR-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Threat Management (THR) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with THR domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Threat management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Threat Management (THR) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Threat management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Threat management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Threat Management (THR) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are well-documented and kept current by process owners.\n▪ A threat management team, or similar function, is appropriately staffed and supported to implement and maintain THR domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of threat management operations (e.g., threat intelligence solution, bug bounty solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement an insider threat program that includes a cross-discipline insider threat incident handling team.

Level 4 - Quantitatively Controlled: Threat Management (THR) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "THR-04", "family": "Threat Management", "enhancements": "", "sortId": "THR-04", "references": "

Micro-Small Business (<10 staff)

∙ Subscribe to free threat intelligence feeds (e.g., CISA alerts)

Small Business (10-49 staff)

∙ CISA alerts subscription\n∙ Basic threat awareness program

Medium Business (50-249 staff)

∙ Insider threat program

Large Business (250-999 staff)

∙ Insider threat program

Enterprise (>1,000 staff)

∙ Insider threat program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74613, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591351", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591351", "securityControlId": 32127, "ccis": [], "uuid": "0544f63e-b99e-5c7c-a1c8-e98fd60bc847", "testId": "THR-05_A01", "test": "potential indicators associated with insider threats are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.2.3[a]", "defaultText": null }, { "id": 74614, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591351", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591351", "securityControlId": 32127, "ccis": [], "uuid": "c1204aff-34d5-5457-bba9-2ea7389a3ee4", "testId": "THR-05_A02", "test": "security literacy training is provided to system users on recognizing indicators of insider threat.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "171A_R3_A.03.02.01.a.03[01]\n53A_R5_AT-02(02)[01]", "defaultText": null }, { "id": 74615, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591351", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591351", "securityControlId": 32127, "ccis": [], "uuid": "6302fc6b-3ddc-501d-866c-3cd30647333d", "testId": "THR-05_A03", "test": "security literacy training is provided to system users on reporting indicators of insider threat.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "171A_R3_A.03.02.01.a.03[02]\n53A_R5_AT-02(02)[02]", "defaultText": null }, { "id": 74616, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591352", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591352", "securityControlId": 32127, "ccis": [], "uuid": "b4041e35-5849-58b2-9d2a-3baf9017a096", "testId": "THR-05_A04", "test": "security awareness training on recognizing and reporting potential indicators of insider threat is provided to managers and employees.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "171A_3.2.3[b]", "defaultText": null } ], "externalMappings": [ { "id": 610590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591249", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c79ea9f5-3b59-51f4-a8e7-f70429ceacff", "parentControlId": 32127, "controlId": "AT-2(2)", "title": "AT-2(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591249" }, { "id": 610591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff11a032-419b-5e75-9bd5-9bd099791a99", "parentControlId": 32127, "controlId": "AT-02(02)", "title": "AT-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591254" }, { "id": 610592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f734c405-375b-50e8-a5e4-57bca7999773", "parentControlId": 32127, "controlId": "AT-02(02)", "title": "AT-02(02)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591254" }, { "id": 610593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "575bac41-b786-5212-8f40-61422c8c0d44", "parentControlId": 32127, "controlId": "AT-02(02)", "title": "AT-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591254" }, { "id": 610594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2257be74-e735-5abe-b3dc-41244ef9314c", "parentControlId": 32127, "controlId": "AT-02(02)", "title": "AT-02(02)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591254" }, { "id": 610595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591254", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "52c3839b-414b-53e5-a47e-1901ab4edf16", "parentControlId": 32127, "controlId": "AT-02(02)", "title": "AT-02(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591254" }, { "id": 610596, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69ff5568-4ae0-551a-aa57-a5433d0b124c", "parentControlId": 32127, "controlId": "AT-02(02)", "title": "AT-02(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591255" }, { "id": 610597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5447400e-1ca1-5b6e-af32-9e21ae28a7da", "parentControlId": 32127, "controlId": "AT-2(2)", "title": "AT-2(2)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591255" }, { "id": 610598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "02a1264c-97cd-5915-b6e7-adb9c654ec0a", "parentControlId": 32127, "controlId": "AT-2(2)", "title": "AT-2(2)", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591255" }, { "id": 610599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "230447c3-0d73-5671-b7be-8937635dd172", "parentControlId": 32127, "controlId": "AT-2(2)", "title": "AT-2(2)", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591255" }, { "id": 610601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5f6767b-ee00-56cc-91a4-3cae4aa515cb", "parentControlId": 32127, "controlId": "3.2.3", "title": "3.2.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591255" }, { "id": 610602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591255", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1a256fca-ec85-5c28-916d-41809fedf379", "parentControlId": 32127, "controlId": "03.02.01.a.03", "title": "03.02.01.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591255" }, { "id": 610607, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591256", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63e242ec-82e4-568a-bb2b-723bcc90dc7e", "parentControlId": 32127, "controlId": "ID.RA-03", "title": "ID.RA-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591256" }, { "id": 610617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b67f277d-8c1f-532d-8c16-bf2908b0d156", "parentControlId": 32127, "controlId": "§117.12(g)", "title": "§117.12(g)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591257" }, { "id": 610618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591257", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f761252e-e92c-5140-a520-5d4edaa55637", "parentControlId": 32127, "controlId": "§117.12(g)(1)", "title": "§117.12(g)(1)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591257" }, { "id": 610619, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "79fe6f2c-f091-5023-a95c-9a228dd14aef", "parentControlId": 32127, "controlId": "§117.12(g)(1)(i)", "title": "§117.12(g)(1)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591258" }, { "id": 610620, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abeaa614-66e7-5aa5-9f0b-dd3fbbd6246c", "parentControlId": 32127, "controlId": "§117.12(g)(1)(ii)", "title": "§117.12(g)(1)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591258" }, { "id": 610621, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "56ca66df-d002-5a0d-a97f-f86772c22461", "parentControlId": 32127, "controlId": "§117.12(g)(1)(iii)", "title": "§117.12(g)(1)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591258" }, { "id": 610622, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcf09dd4-7cc9-5c5d-8e01-775276012649", "parentControlId": 32127, "controlId": "§117.12(g)(1)(iv)", "title": "§117.12(g)(1)(iv)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591258" }, { "id": 610623, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aae4da35-92c4-5db1-878b-20ab2ecaa1e5", "parentControlId": 32127, "controlId": "§117.12(g)(2)", "title": "§117.12(g)(2)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591258" }, { "id": 610624, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "65f86e8f-c9fb-57ec-b292-8bedf921080a", "parentControlId": 32127, "controlId": "§117.12(g)(2)(i)", "title": "§117.12(g)(2)(i)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591258" }, { "id": 610625, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eccf26b7-85ad-5634-b0e4-a38f0d99c23b", "parentControlId": 32127, "controlId": "§117.12(g)(2)(ii)", "title": "§117.12(g)(2)(ii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591258" }, { "id": 610626, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ad1c3c86-04aa-507d-805a-c54cb8c43372", "parentControlId": 32127, "controlId": "§117.12(g)(2)(iii)", "title": "§117.12(g)(2)(iii)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591258" }, { "id": 610627, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591258", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "868dea54-7678-53ce-a152-b64c31a21c05", "parentControlId": 32127, "controlId": "§117.12(g)(2)(iv)", "title": "§117.12(g)(2)(iv)", "catalog": "National Industrial Security Program Operating Manual (NISPOM) (2020)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591258" } ], "id": 32127, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731369", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731369", "catalogueId": 1062, "uuid": "df214791-6888-5861-8a0c-1ad33b3da8df", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize security awareness training on recognizing and reporting potential indicators of insider threat?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Insider Threat Awareness", "description": "

Control Description

Mechanisms exist to utilize security awareness training on recognizing and reporting potential indicators of insider threat.

Evidence Request List (ERL)

E-SAT-04\nE-SAT-05\nE-THR-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Threat Management (THR) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Threat management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Threat management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Threat Management (THR) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are well-documented and kept current by process owners.\n▪ A threat management team, or similar function, is appropriately staffed and supported to implement and maintain THR domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of threat management operations (e.g., threat intelligence solution, bug bounty solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize security awareness training on recognizing and reporting potential indicators of insider threat.

Level 4 - Quantitatively Controlled: Threat Management (THR) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "THR-05", "family": "Threat Management", "enhancements": "", "sortId": "THR-05", "references": "

Micro-Small Business (<10 staff)

∙ Basic insider threat awareness for all employees

Small Business (10-49 staff)

∙ Insider threat awareness training\n∙ Reporting procedure for suspicious behavior

Medium Business (50-249 staff)

∙ Formal insider threat awareness program\n∙ Reporting hotline or mechanism

Large Business (250-999 staff)

∙ Enterprise insider threat program\n∙ Behavioral monitoring\n∙ UEBA integration

Enterprise (>1,000 staff)

∙ Enterprise insider threat program (NITTF-aligned)\n∙ Dedicated insider threat team\n∙ UEBA platform (e.g., Varonis, Securonix)\n∙ Anonymous reporting", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74617, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591352", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591352", "securityControlId": 32128, "ccis": [], "uuid": "c3058c5f-8a05-5b78-9b56-b8d110c6ed3f", "testId": "THR-06_A01", "test": "a public reporting channel is established for receiving reports of vulnerabilities in organizational systems and system components.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-05(11)", "defaultText": null } ], "externalMappings": [ { "id": 610638, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59126", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac52e0a8-b87f-5f5c-8100-698b0aa49c07", "parentControlId": 32128, "controlId": "RA-05(11)", "title": "RA-05(11)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59126" }, { "id": 610639, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59126", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "af2ae45b-c350-5d9a-8b0e-d477ddf4b59e", "parentControlId": 32128, "controlId": "RA-05(11)", "title": "RA-05(11)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59126" }, { "id": 610640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59126", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36476953-fe21-5da8-9294-e2cb4f53975c", "parentControlId": 32128, "controlId": "RA-05(11)", "title": "RA-05(11)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59126" }, { "id": 610641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8c6469e-8298-5492-b4c9-f40b2f7df3f7", "parentControlId": 32128, "controlId": "RA-05(11)", "title": "RA-05(11)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591263" }, { "id": 610642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c4de9730-6af4-5303-9296-727dfe341a51", "parentControlId": 32128, "controlId": "RA-05(11)", "title": "RA-05(11)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591263" }, { "id": 610643, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591263", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22e62360-66b6-5bb8-b4cf-3544efb00c52", "parentControlId": 32128, "controlId": "RA-05(11)", "title": "RA-05(11)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591263" }, { "id": 610658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591265", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d04ee056-e2ed-53bc-8ce4-641cfe35271e", "parentControlId": 32128, "controlId": "THREAT-1m", "title": "THREAT-1m", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591265" } ], "id": 32128, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731369", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731369", "catalogueId": 1062, "uuid": "b658f947-8c09-5a21-b4a8-e1c39e7a32bc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization establish a Vulnerability Disclosure Program (VDP) to assist with the secure development and maintenance of Technology Assets, Applications and/or Services (TAAS) that receives unsolicited input from the public about vulnerabilities in organizational TAAS?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Vulnerability Disclosure Program (VDP)", "description": "

Control Description

Mechanisms exist to establish a Vulnerability Disclosure Program (VDP) to assist with the secure development and maintenance of Technology Assets, Applications and/or Services (TAAS) that receives unsolicited input from the public about vulnerabilities in organizational TAAS.

Evidence Request List (ERL)

E-TDA-16

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Threat Management (THR) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Threat management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Threat management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Threat Management (THR) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are well-documented and kept current by process owners.\n▪ A threat management team, or similar function, is appropriately staffed and supported to implement and maintain THR domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of threat management operations (e.g., threat intelligence solution, bug bounty solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to establish a Vulnerability Disclosure Program (VDP) to assist with the secure development and maintenance of Technology Assets, Applications and/or Services (TAAS) that receives unsolicited input from the public about vulnerabilities in organizational TAAS.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "THR-06", "family": "Threat Management", "enhancements": "", "sortId": "THR-06", "references": "

Micro-Small Business (<10 staff)

∙ Subscribe to free threat intelligence feeds (e.g., CISA alerts)

Small Business (10-49 staff)

∙ CISA alerts subscription\n∙ Basic threat awareness program

Medium Business (50-249 staff)

∙ Vulnerability Disclosure Program (VDP)\n∙ \"bug bounty\" program

Large Business (250-999 staff)

∙ Vulnerability Disclosure Program (VDP)\n∙ \"bug bounty\" program

Enterprise (>1,000 staff)

∙ Vulnerability Disclosure Program (VDP)\n∙ \"bug bounty\" program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74620, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591353", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591353", "securityControlId": 32130, "ccis": [], "uuid": "cff20669-1499-5bf2-8e95-ac4df26eec53", "testId": "THR-07_A01", "test": "a cyber threat capability is established and maintained to search for Indicators of Compromise (IOC) in organizational systems.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-10a.01", "defaultText": null }, { "id": 74621, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591353", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591353", "securityControlId": 32130, "ccis": [], "uuid": "c6ff772b-a11c-501c-b44e-439bba8f16f4", "testId": "THR-07_A02", "test": "a cyber threat capability is established and maintained to detect, track and disrupt threats that evade existing controls.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-10a.02", "defaultText": null }, { "id": 74622, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591353", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591353", "securityControlId": 32130, "ccis": [], "uuid": "c199c5ea-ad88-58ea-85d2-c18906a2bee6", "testId": "THR-07_A03", "test": "cyber threat hunting activities are conducted according to an organization-defined frequency and/or organization-defined event to detect, track and disrupt threats that evade existing controls.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.11.2e[b]\n172A_3.11.2e[c]\n53A_R5_RA-10b.", "defaultText": null }, { "id": 74623, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591353", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591353", "securityControlId": 32130, "ccis": [], "uuid": "17c30052-7dbe-5d5d-8e30-110e28b479af", "testId": "THR-07_A04", "test": "sensors and monitoring capabilities to be relocated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-48_ODP[01]", "defaultText": null }, { "id": 74624, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591354", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591354", "securityControlId": 32130, "ccis": [], "uuid": "352be708-f4f1-5cce-8fe6-5976d88e8d06", "testId": "THR-07_A05", "test": "locations to where sensors and monitoring capabilities are to be relocated are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-48_ODP[02]", "defaultText": null }, { "id": 74625, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591354", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591354", "securityControlId": 32130, "ccis": [], "uuid": "13742f85-4a72-5b4e-b8e8-f448273c7789", "testId": "THR-07_A06", "test": "conditions or circumstances for relocating sensors and monitoring capabilities are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-48_ODP[03]", "defaultText": null }, { "id": 74626, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591354", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591354", "securityControlId": 32130, "ccis": [], "uuid": "95525b28-a8bf-5a49-b87c-d34b81ff2770", "testId": "THR-07_A07", "test": "sensors and monitoring capabilities are relocated to locations under organization-defined conditions or circumstances.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SC-48", "defaultText": null }, { "id": 74627, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591354", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591354", "securityControlId": 32130, "ccis": [], "uuid": "8b74deb5-7682-5b70-92f5-7846c3e6ebe4", "testId": "THR-07_A08", "test": "Indicators of Compromise (IOC) are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.11.2e[a]", "defaultText": null }, { "id": 74628, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591354", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591354", "securityControlId": 32130, "ccis": [], "uuid": "8ccf1224-0af6-5839-b1c6-aa48eec4db7e", "testId": "THR-07_A09", "test": "organizational systems to search for Indicators of Compromise (IOC) are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.11.2e_ODP[4]", "defaultText": null }, { "id": 74629, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591355", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591355", "securityControlId": 32130, "ccis": [], "uuid": "b3baf382-5dbd-5f7e-aad5-5874d5cbcc63", "testId": "THR-07_A10", "test": "the frequency with which to conduct cyber threat hunting activities is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.11.2e_ODP[1]\n172A_3.11.2e_ODP[2]\n53A_R5_RA-10_ODP", "defaultText": null }, { "id": 74630, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591355", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591355", "securityControlId": 32130, "ccis": [], "uuid": "65d3b3d9-94f1-555c-99d1-7dcddbe09f20", "testId": "THR-07_A11", "test": "the event triggering cyber threat hunting activities is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.11.2e_ODP[3]", "defaultText": null } ], "externalMappings": [ { "id": 610686, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "354c474d-4743-5960-8d80-aab194f51ba3", "parentControlId": 32130, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591268" }, { "id": 610687, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6d82dc1-f4e8-5522-a1bd-7276d22297d1", "parentControlId": 32130, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591268" }, { "id": 610688, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "420eb793-e77a-5070-aa60-6fe3de378902", "parentControlId": 32130, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591268" }, { "id": 610689, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591268", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89fec346-0d9a-55b6-9804-7af0a4bf452f", "parentControlId": 32130, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591268" }, { "id": 610690, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591269", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d89a5e2-e013-5864-9355-b0723b7a0ab1", "parentControlId": 32130, "controlId": "T1195.002", "title": "T1195.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591269" }, { "id": 610691, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ae1eaba-3de9-553c-a8ad-4554dd44e2df", "parentControlId": 32130, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591271" }, { "id": 610692, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3c830718-8e70-574d-8e0a-93a85c15a8b2", "parentControlId": 32130, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591271" }, { "id": 610693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "147998f3-9b65-5000-b420-f79605ad3053", "parentControlId": 32130, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591271" }, { "id": 610694, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74598dfd-11d1-55f0-8d8f-adda01ed6bb9", "parentControlId": 32130, "controlId": "RA-10", "title": "RA-10", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591271" }, { "id": 610695, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591271", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2b192811-4dfd-5de8-94d0-accce493820b", "parentControlId": 32130, "controlId": "SC-48", "title": "SC-48", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591271" }, { "id": 610697, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ee80968-9bec-5d48-a1a9-92632b5b69e1", "parentControlId": 32130, "controlId": "RA-10", "title": "RA-10", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591272" }, { "id": 610698, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34e5983e-df49-5a80-9579-f05db2bb6667", "parentControlId": 32130, "controlId": "SC-48", "title": "SC-48", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591272" }, { "id": 610701, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591272", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "78c9a947-945d-57c6-9de6-a0655289415d", "parentControlId": 32130, "controlId": "RA-10", "title": "RA-10", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591272" }, { "id": 610708, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa9fbe38-3b32-55a8-820b-e120fdbcc313", "parentControlId": 32130, "controlId": "ID.RA-03", "title": "ID.RA-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591273" }, { "id": 610709, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591273", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b81f287-0d32-5730-98c0-832fef790ce1", "parentControlId": 32130, "controlId": "DE", "title": "DE", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591273" }, { "id": 610717, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ddef2a0-f1ac-500c-becb-0a86c6c16930", "parentControlId": 32130, "controlId": "C2", "title": "C2", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591274" }, { "id": 610718, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80ef1e27-d705-510c-966b-1f8b45121700", "parentControlId": 32130, "controlId": "C2.a (point 1)", "title": "C2.a (point 1)", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591274" }, { "id": 610719, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591274", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53edf95f-e5df-50be-bd17-7a78f4d25d95", "parentControlId": 32130, "controlId": "C2.a (point 2)", "title": "C2.a (point 2)", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591274" }, { "id": 610720, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d3d9d5e-aca6-50a6-b183-1c240091a277", "parentControlId": 32130, "controlId": "C2.a (point 3)", "title": "C2.a (point 3)", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591275" }, { "id": 610721, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e655d3a-0c9a-5144-9c70-2d78f5f44dd7", "parentControlId": 32130, "controlId": "C2.a (point 4)", "title": "C2.a (point 4)", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591275" }, { "id": 610722, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d95b6b8-3960-5415-adb0-c4f33609b272", "parentControlId": 32130, "controlId": "C2.a (point 5)", "title": "C2.a (point 5)", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591275" }, { "id": 610723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90e10d0b-bce0-5ba2-971d-7417b0a78ef3", "parentControlId": 32130, "controlId": "C2.a (point 6)", "title": "C2.a (point 6)", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591275" }, { "id": 610724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5fd05236-c7ff-50e0-81c2-24486946cbb4", "parentControlId": 32130, "controlId": "C2.a (point 7)", "title": "C2.a (point 7)", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591275" }, { "id": 610725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591275", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a60e35c-aad2-5ce5-81b0-5cf083004c3f", "parentControlId": 32130, "controlId": "C2.a (point 8)", "title": "C2.a (point 8)", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591275" } ], "id": 32130, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73137", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73137", "catalogueId": 1062, "uuid": "1b1fd7d9-88c5-5e9e-9e80-c10acef226d1", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization perform cyber threat hunting that uses Indicators of Compromise (IoC) to detect, track and disrupt threats that evade existing security controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 4.0, "title": "Threat Hunting", "description": "

Control Description

Mechanisms exist to perform cyber threat hunting that uses Indicators of Compromise (IoC) to detect, track and disrupt threats that evade existing security controls.

Evidence Request List (ERL)

E-THR-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Threat Management (THR) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Threat management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Threat management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Threat Management (THR) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are well-documented and kept current by process owners.\n▪ A threat management team, or similar function, is appropriately staffed and supported to implement and maintain THR domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of threat management operations (e.g., threat intelligence solution, bug bounty solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to perform cyber threat hunting that uses Indicators of Compromise (IoC) to detect, track and disrupt threats that evade existing security controls.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "THR-07", "family": "Threat Management", "enhancements": "", "sortId": "THR-07", "references": "

Micro-Small Business (<10 staff)

∙ Subscribe to free threat intelligence feeds (e.g., CISA alerts)

Small Business (10-49 staff)

∙ CISA alerts subscription\n∙ Basic threat awareness program

Medium Business (50-249 staff)

∙ Threat hunting capability

Large Business (250-999 staff)

∙ Threat hunting capability

Enterprise (>1,000 staff)

∙ Threat hunting capability", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74631, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591355", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591355", "securityControlId": 32131, "ccis": [], "uuid": "60e6ab06-8769-515c-a071-5f79641edb07", "testId": "THR-08_A01", "test": "the systems or system components with data or capabilities to be embedded are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-20_ODP", "defaultText": null }, { "id": 74632, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591355", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591355", "securityControlId": 32131, "ccis": [], "uuid": "9c9db7f0-71bb-5b21-894d-d366b77715fb", "testId": "THR-08_A02", "test": "data or capabilities are embedded in systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-20", "defaultText": null } ], "externalMappings": [ { "id": 610728, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e03392d5-5c49-5925-830e-36c69e36d8c4", "parentControlId": 32131, "controlId": "SI-20", "title": "SI-20", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591276" }, { "id": 610729, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0004feb-5b1e-5c67-8dbc-a7d5c91de91e", "parentControlId": 32131, "controlId": "SI-20", "title": "SI-20", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591276" }, { "id": 610731, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "97686499-51b6-5396-8fa6-5b5ce48d7dd3", "parentControlId": 32131, "controlId": "SI-20", "title": "SI-20", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591276" }, { "id": 610732, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591276", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "16cedfaa-6fec-5a8a-b049-5d7203d5915e", "parentControlId": 32131, "controlId": "SI-20", "title": "SI-20", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591276" } ], "id": 32131, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73137", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73137", "catalogueId": 1062, "uuid": "9d8f98ec-0322-506e-bcad-b8db8cb8b370", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization embed false data or steganographic data in files to enable the organization to determine if data has been exfiltrated and provide a means to identify the individual(s) involved?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Tainting", "description": "

Control Description

Mechanisms exist to embed false data or steganographic data in files to enable the organization to determine if data has been exfiltrated and provide a means to identify the individual(s) involved.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Threat Management (THR) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are well-documented and kept current by process owners.\n▪ A threat management team, or similar function, is appropriately staffed and supported to implement and maintain THR domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of threat management operations (e.g., threat intelligence solution, bug bounty solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to embed false data or steganographic data in files to enable the organization to determine if data has been exfiltrated and provide a means to identify the individual(s) involved.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "THR-08", "family": "Threat Management", "enhancements": "", "sortId": "THR-08", "references": "

Medium Business (50-249 staff)

∙ Use honeypots or canary tokens to detect attackers

Large Business (250-999 staff)

∙ Deception technology (honeypots, canary tokens) for threat detection

Enterprise (>1,000 staff)

∙ Enterprise deception platform (e.g., Thinkst Canary, Attivo)\n∙ Integrated with SIEM/SOAR for automated response", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74633, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591356", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591356", "securityControlId": 32132, "ccis": [], "uuid": "3e82c789-3cd0-574e-8720-4968cb0d178d", "testId": "THR-09_A01", "test": "the organization maintains a threat catalog that documents applicable internal and external threats that are specific to the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74634, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591356", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591356", "securityControlId": 32132, "ccis": [], "uuid": "54e75687-60fd-5ab8-bb01-df0ed97b8468", "testId": "THR-09_A02", "test": "the threat catalog documents both natural and manmade threats.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74635, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591356", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591356", "securityControlId": 32132, "ccis": [], "uuid": "c213287a-f7cb-5b91-9dc6-2e1fee0061e9", "testId": "THR-09_A03", "test": "on at least an annual basis, a threat assessment is performed to identify and assess applicable internal and external threats.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74636, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591356", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591356", "securityControlId": 32132, "ccis": [], "uuid": "323b2caa-45a2-5872-a88b-c55b8cbe0dc4", "testId": "THR-09_A04", "test": "the threat catalog is updated, based on a current threat assessment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 610746, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b464eeee-a8cd-53a0-a3fa-69b5bdb78469", "parentControlId": 32132, "controlId": "03.15.02.a.03", "title": "03.15.02.a.03", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591279" }, { "id": 610748, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591279", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ffbbc42-9475-548d-a7ad-53f666430924", "parentControlId": 32132, "controlId": "ID.RA-03", "title": "ID.RA-03", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591279" }, { "id": 610749, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0487ab85-8e1f-5610-81bc-b7d8df1a3075", "parentControlId": 32132, "controlId": "ID.RA-04", "title": "ID.RA-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59128" }, { "id": 610750, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b42c7b58-2863-5d9a-9704-b64bbbcba239", "parentControlId": 32132, "controlId": "ID.RA-05", "title": "ID.RA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59128" }, { "id": 610751, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6295f48-8f43-5989-8be2-daa5425afaa0", "parentControlId": 32132, "controlId": "PR.IR-02", "title": "PR.IR-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59128" }, { "id": 610752, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5efb9fc8-de35-5e69-95a5-e5b97720b945", "parentControlId": 32132, "controlId": "DE", "title": "DE", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59128" }, { "id": 610758, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59128", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bd45aa2e-9d84-5793-97ab-7e7e3c52a0e8", "parentControlId": 32132, "controlId": "RISK-2j", "title": "RISK-2j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591281" }, { "id": 610768, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ee92a48c-443d-5a71-964a-984763256331", "parentControlId": 32132, "controlId": "A2.b", "title": "A2.b", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591282" }, { "id": 610769, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591282", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6c98c529-528b-550f-a291-2c49655b0d85", "parentControlId": 32132, "controlId": "C1.f", "title": "C1.f", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591282" } ], "id": 32132, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73137", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73137", "catalogueId": 1062, "uuid": "37098f25-1510-5ae9-8b77-06c925a8b24c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization develop and keep current a catalog of applicable internal and external threats to the organization, both natural and manmade?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Threat Catalog", "description": "

Control Description

Mechanisms exist to develop and keep current a catalog of applicable internal and external threats to the organization, both natural and manmade.

Evidence Request List (ERL)

E-THR-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 - Planned & Tracked: Threat Management (THR) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Threat management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Threat management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Threat Management (THR) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are well-documented and kept current by process owners.\n▪ A threat management team, or similar function, is appropriately staffed and supported to implement and maintain THR domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of threat management operations (e.g., threat intelligence solution, bug bounty solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to develop and keep current a catalog of applicable internal and external threats to the organization, both natural and manmade.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "THR-09", "family": "Threat Management", "enhancements": "", "sortId": "THR-09", "references": "

Micro-Small Business (<10 staff)

∙ Documented threat catalog

Small Business (10-49 staff)

∙ Documented threat catalog

Medium Business (50-249 staff)

∙ Documented threat catalog

Large Business (250-999 staff)

∙ Documented threat catalog

Enterprise (>1,000 staff)

∙ Documented threat catalog", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74637, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591357", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591357", "securityControlId": 32133, "ccis": [], "uuid": "f15162a2-2dc8-58bc-af51-5cafbca4bf9a", "testId": "THR-10_A01", "test": "on at least an annual basis, a threat assessment is performed to identify and assess applicable internal and external threats.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74638, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591357", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591357", "securityControlId": 32133, "ccis": [], "uuid": "9989697b-d775-544b-bfc7-f937aef645cb", "testId": "THR-10_A02", "test": "a threat catalog captures applicable internal and external threats from the threat assessment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74639, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591357", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591357", "securityControlId": 32133, "ccis": [], "uuid": "bc9c8d22-3b22-5e65-a2a7-3debfeacf7fb", "testId": "THR-10_A03", "test": "each item in the threat catalog is prioritized, based on the potential threat to the organization.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 610786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8bf75cff-3d90-5c8b-bdf9-1b0b253d6efa", "parentControlId": 32133, "controlId": "03.14.03.b", "title": "03.14.03.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591284" }, { "id": 610787, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1ca336b-f944-5ee6-a620-22461ace6952", "parentControlId": 32133, "controlId": "ID.RA-04", "title": "ID.RA-04", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591284" }, { "id": 610788, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591284", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b5fd0a3e-ab35-5d92-853f-d33ee8186c9a", "parentControlId": 32133, "controlId": "ID.RA-05", "title": "ID.RA-05", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591285" }, { "id": 610789, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "561917aa-ecb6-5e3e-9a19-4055b983023a", "parentControlId": 32133, "controlId": "DE", "title": "DE", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591285" }, { "id": 610790, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591285", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5538ce9c-4ebe-5d5a-ae23-c8dc19aa3eeb", "parentControlId": 32133, "controlId": "DE.AE-07", "title": "DE.AE-07", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591285" }, { "id": 610797, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4d122bb9-6757-5a1f-95d8-1e74df9085a2", "parentControlId": 32133, "controlId": "THREAT-2c", "title": "THREAT-2c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591287" }, { "id": 610798, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bbaf594-ea2b-5265-b54f-f56ffd500bfd", "parentControlId": 32133, "controlId": "THREAT-2e", "title": "THREAT-2e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591287" }, { "id": 610799, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591287", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbd24b27-1f37-532a-813b-01d40bf88a22", "parentControlId": 32133, "controlId": "THREAT-2g", "title": "THREAT-2g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591287" }, { "id": 610800, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591288", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1909349f-8f96-5f3c-a479-886a52031520", "parentControlId": 32133, "controlId": "THREAT-2i", "title": "THREAT-2i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591288" } ], "id": 32133, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731371", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731371", "catalogueId": 1062, "uuid": "e789af41-665d-50ca-ab75-2e0d7017b55d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify, assess, prioritize and document the potential impact(s) and likelihood(s) of applicable internal and external threats?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Threat Analysis", "description": "

Control Description

Mechanisms exist to identify, assess, prioritize and document the potential impact(s) and likelihood(s) of applicable internal and external threats.

Evidence Request List (ERL)

E-THR-07

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Threat Management (THR) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with THR domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Threat management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Threat Management (THR) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Threat management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Threat management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Threat Management (THR) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are well-documented and kept current by process owners.\n▪ A threat management team, or similar function, is appropriately staffed and supported to implement and maintain THR domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of threat management operations (e.g., threat intelligence solution, bug bounty solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify, assess, prioritize and document the potential impact(s) and likelihood(s) of applicable internal and external threats.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "THR-10", "family": "Threat Management", "enhancements": "", "sortId": "THR-10", "references": "

Micro-Small Business (<10 staff)

∙ Documented threat analysis

Small Business (10-49 staff)

∙ Documented threat analysis

Medium Business (50-249 staff)

∙ Documented threat analysis

Large Business (250-999 staff)

∙ Documented threat analysis

Enterprise (>1,000 staff)

∙ Documented threat analysis", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74642, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591358", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591358", "securityControlId": 32135, "ccis": [], "uuid": "f8cd95f8-0925-590f-a399-dd4e73b6a4d6", "testId": "VPM-01_A01", "test": "an organization-wide vulnerability and patch management program is developed and implemented to proactively identify and remediation vulnerabilities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74643, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591358", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591358", "securityControlId": 32135, "ccis": [], "uuid": "4778eb0e-45b8-519b-9e99-26528dd38cf9", "testId": "VPM-01_A02", "test": "the time within which to identify system flaws is specified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.14.1[a]", "defaultText": null }, { "id": 74644, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591358", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591358", "securityControlId": 32135, "ccis": [], "uuid": "d83873c3-edf8-55c5-bb31-54bb23816870", "testId": "VPM-01_A03", "test": "system flaws are identified within the specified time frame.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.14.1[b]\n53A_R5_SI-02a.[01]", "defaultText": null }, { "id": 74645, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591359", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591359", "securityControlId": 32135, "ccis": [], "uuid": "18bf3f92-84bd-5b4a-a5d3-0075c1cce4e8", "testId": "VPM-01_A04", "test": "the time within which to report system flaws is specified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.14.1[c]", "defaultText": null }, { "id": 74646, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591359", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591359", "securityControlId": 32135, "ccis": [], "uuid": "db06fc8b-db5e-5f22-b144-fc00a032ee5d", "testId": "VPM-01_A05", "test": "system flaws are reported within the specified time frame.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.14.1[d]\n53A_R5_SI-02a.[02]", "defaultText": null }, { "id": 74647, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591359", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591359", "securityControlId": 32135, "ccis": [], "uuid": "8deeca0c-4192-5407-a5e6-aab2f0f7aeef", "testId": "VPM-01_A06", "test": "the time within which to correct system flaws is specified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.14.1[e]", "defaultText": null }, { "id": 74648, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591359", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591359", "securityControlId": 32135, "ccis": [], "uuid": "27fe83ec-6c55-57e9-9a5f-afdf4cc2b7aa", "testId": "VPM-01_A07", "test": "system flaws are corrected within the specified time frame.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.14.1[f]\n53A_R5_SI-02a.[03]", "defaultText": null }, { "id": 74649, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591359", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591359", "securityControlId": 32135, "ccis": [], "uuid": "ca9909ff-8b04-5324-b384-95a1480573ab", "testId": "VPM-01_A08", "test": "time period within which to install security-relevant software updates after the release of the updates is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-02_ODP", "defaultText": null }, { "id": 74650, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59136", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59136", "securityControlId": 32135, "ccis": [], "uuid": "4bfe61f8-e18c-5f4e-9d4c-691df76313ca", "testId": "VPM-01_A09", "test": "software updates related to flaw remediation are tested for effectiveness before installation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-02b.[01]", "defaultText": null }, { "id": 74651, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59136", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59136", "securityControlId": 32135, "ccis": [], "uuid": "909f6a84-1c23-5c25-ad82-2b94e36a9bef", "testId": "VPM-01_A10", "test": "software updates related to flaw remediation are tested for potential side effects before installation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-02b.[02]", "defaultText": null }, { "id": 74652, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59136", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59136", "securityControlId": 32135, "ccis": [], "uuid": "4b8e5505-5419-5fc9-8ede-8f1fefe23d25", "testId": "VPM-01_A11", "test": "firmware updates related to flaw remediation are tested for effectiveness before installation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-02b.[03]", "defaultText": null }, { "id": 74653, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59136", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59136", "securityControlId": 32135, "ccis": [], "uuid": "6e3ed067-0557-5f64-b5ee-b76ae646efd0", "testId": "VPM-01_A12", "test": "firmware updates related to flaw remediation are tested for potential side effects before installation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-02b.[04]", "defaultText": null }, { "id": 74654, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59136", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59136", "securityControlId": 32135, "ccis": [], "uuid": "a48d0789-381b-5cea-967b-9cb6587f7615", "testId": "VPM-01_A13", "test": "security-relevant software updates are installed within an organization-defined time period of the release of the updates.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: within thirty (30) days of release of updates", "otherId": "53A_R5_SI-02c.[01]", "defaultText": null }, { "id": 74655, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591361", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591361", "securityControlId": 32135, "ccis": [], "uuid": "8ef614fa-78ea-53d4-8b91-d167fda8c7a6", "testId": "VPM-01_A14", "test": "security-relevant firmware updates are installed within an organization-defined time period of the release of the updates.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: within thirty (30) days of release of updates", "otherId": "53A_R5_SI-02c.[02]", "defaultText": null }, { "id": 74656, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591361", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591361", "securityControlId": 32135, "ccis": [], "uuid": "47a17285-c7d7-5e71-9279-b3c86a73b373", "testId": "VPM-01_A15", "test": "flaw remediation is incorporated into the organizational configuration management process.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-02d.", "defaultText": null }, { "id": 74657, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591361", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591361", "securityControlId": 32135, "ccis": [], "uuid": "c9ea4c92-8ba1-5a43-b885-bea9a0139167", "testId": "VPM-01_A16", "test": "response times to remediate system vulnerabilities are defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.11.02.ODP[03]", "defaultText": null }, { "id": 74658, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591361", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591361", "securityControlId": 32135, "ccis": [], "uuid": "ea5d2cc5-dc5d-54c3-95ac-320b0270e4c4", "testId": "VPM-01_A17", "test": "vulnerability & patch management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74659, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591361", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591361", "securityControlId": 32135, "ccis": [], "uuid": "916c457e-ebc4-5f8e-8e4d-904746428350", "testId": "VPM-01_A18", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support vulnerability & patch management operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74660, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591362", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591362", "securityControlId": 32135, "ccis": [], "uuid": "87337790-d174-5d8b-9cf5-afd8f2739fa5", "testId": "VPM-01_A19", "test": "responsibility and authority for the performance of vulnerability & patch management-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74661, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591362", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591362", "securityControlId": 32135, "ccis": [], "uuid": "a56fe02e-6aa5-5dae-bce0-49bd3e84cca7", "testId": "VPM-01_A20", "test": "personnel performing vulnerability & patch management-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 610855, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76325e67-5bfe-5c73-a17f-978432a0a42f", "parentControlId": 32135, "controlId": "8.8", "title": "8.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591297" }, { "id": 610862, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591297", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3bf232f3-fc5f-5c5a-ad6f-f163207123ab", "parentControlId": 32135, "controlId": "SI-2", "title": "SI-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591297" }, { "id": 610863, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "41ea06e4-a7b8-52fa-b373-d5fd92970f54", "parentControlId": 32135, "controlId": "SI-3(2)", "title": "SI-3(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591298" }, { "id": 610864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "785fa7e9-0d7f-5640-b764-4aa89fd5ee9c", "parentControlId": 32135, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591298" }, { "id": 610865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebd56cc1-60da-56e6-b306-f83bf1cbb348", "parentControlId": 32135, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591298" }, { "id": 610868, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c97f1f7f-6d69-5f84-861e-1db86b558ec0", "parentControlId": 32135, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591298" }, { "id": 610869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7bc4d632-bc22-5491-97a0-f65ab20df6c5", "parentControlId": 32135, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591298" }, { "id": 610870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591298", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6f67606e-5ff2-5d98-a0e2-14db98beadf4", "parentControlId": 32135, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591298" }, { "id": 610871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "261fb15a-3993-5255-8df8-5e9d9a9338fb", "parentControlId": 32135, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591299" }, { "id": 610872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "20337f6b-0196-505b-a49b-a89fd66a8fa5", "parentControlId": 32135, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591299" }, { "id": 610873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e70fc362-edd3-5e39-b83e-ea2422f20d93", "parentControlId": 32135, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591299" }, { "id": 610874, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98c43d30-4631-56e1-ad40-0cf48403b950", "parentControlId": 32135, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591299" }, { "id": 610875, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fceb04f5-2a3e-5f37-b79a-d61b88e17b80", "parentControlId": 32135, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591299" }, { "id": 610876, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7918717e-e648-5083-ba0c-489f1943214f", "parentControlId": 32135, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591299" }, { "id": 610877, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ba6ee40-620b-5b75-a578-78b0a067f30c", "parentControlId": 32135, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591299" }, { "id": 610878, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a02dc4d1-027f-5f0e-a9bb-e9a44a91e81b", "parentControlId": 32135, "controlId": "SI-2", "title": "SI-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591299" }, { "id": 610879, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ebc12f82-1d6d-5250-8222-be3af169ef95", "parentControlId": 32135, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591299" }, { "id": 610880, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591299", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cc3d1310-c3cd-524d-9e72-ce681d60242d", "parentControlId": 32135, "controlId": "SI-2", "title": "SI-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591299" }, { "id": 610881, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8a34c190-6593-5021-9583-2c8464553328", "parentControlId": 32135, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5913" }, { "id": 610882, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "43fd4736-bb64-5b09-9d4e-be27c00dc028", "parentControlId": 32135, "controlId": "SI-2", "title": "SI-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5913" }, { "id": 610883, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7488460f-f814-5b5c-9513-952332238fe3", "parentControlId": 32135, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5913" }, { "id": 610888, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1cd60ddf-71c4-5b48-baa8-604920f19cf4", "parentControlId": 32135, "controlId": "3.14.1", "title": "3.14.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5913" }, { "id": 610889, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7558a382-049a-5b22-b592-e2a404a4ccdb", "parentControlId": 32135, "controlId": "03.11.02.a", "title": "03.11.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5913" }, { "id": 610890, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5913", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dafef379-f15a-5474-99df-60e61b02dc19", "parentControlId": 32135, "controlId": "03.14.01.a", "title": "03.14.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591301" }, { "id": 610898, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591312", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "358204bf-1f71-5705-a506-254d44e89808", "parentControlId": 32135, "controlId": "ID.RA-01", "title": "ID.RA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591312" }, { "id": 610899, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591312", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "826662c1-1e44-5dc1-8548-20ec85dbb8f3", "parentControlId": 32135, "controlId": "ID.RA-08", "title": "ID.RA-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591312" }, { "id": 610900, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591312", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "28127dc1-5815-55c3-b640-94ec044d8812", "parentControlId": 32135, "controlId": "PR.PS-02", "title": "PR.PS-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591312" }, { "id": 610947, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59132", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7581b51e-e6dd-5da1-bb0d-1588fc3ad692", "parentControlId": 32135, "controlId": "THREAT-1j", "title": "THREAT-1j", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59132" }, { "id": 610979, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591496", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca426e50-3b58-5608-9fbe-b69a9ce6b3a0", "parentControlId": 32135, "controlId": "CIP-003-8 1.1.7", "title": "CIP-003-8 1.1.7", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591496" }, { "id": 610980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591496", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4668220-a14e-5d75-9a62-778cf4db9a92", "parentControlId": 32135, "controlId": "CIP-007-6 1.3", "title": "CIP-007-6 1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591496" }, { "id": 610981, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591496", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5210d611-5837-5497-999e-c6613ae53a2d", "parentControlId": 32135, "controlId": "CIP-007-6 2.1", "title": "CIP-007-6 2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591496" }, { "id": 611034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591507", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f67cfb84-53f9-54c5-b231-ad540a11a00a", "parentControlId": 32135, "controlId": "B4.d", "title": "B4.d", "catalog": "UK - Cyber Assessment Framework (CAF) (v4.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591507" }, { "controlId": "A.4.1", "title": "A.4.1 — Continuous Monitoring and Assessment", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-7, SI-4, RA-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "74992188-cc4c-5ef4-bd4c-cc8ba189aa49", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.1", "title": "NEI 08-09 Sec 4.1 — Continuous Monitoring and Assessment", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "c2b13ef9-950a-5ff7-b258-b1dc139b89c2", "isPublic": true }, { "controlId": "10 CFR 73.54(g)", "title": "10 CFR 73.54(g) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "935f8b4a-acad-5afd-b1e3-a20e2460cd86", "isPublic": true }, { "controlId": "A.4.1.3", "title": "A.4.1.3 — Vulnerability Assessments and Scans", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: RA-5, SI-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "2be86f6c-d679-5df9-b50e-94aac726ada7", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.1.3", "title": "NEI 08-09 Sec 4.1.3 — Vulnerability Assessments and Scans", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.1.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "10b1832d-167a-5401-a175-cd4212a68544", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.1.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "5e09baff-72d7-55ba-805b-ad6f5b8eaff4", "isPublic": true }, { "controlId": "C.3.1", "title": "C.3.1 — System and Information Integrity Policy and Procedures", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-1", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "9e7cec92-62a8-5e20-b11b-6d707f7b4203", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.1", "title": "NEI 08-09 App E.3.1 — System and Information Integrity Policy and Procedures", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "e9848ad0-4d5c-5e0b-8930-e8d933abdd80", "isPublic": true }, { "controlId": "C.3.5", "title": "C.3.5 — Security Alerts and Advisories", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "fcc93c3e-77dd-5d1b-89cc-5b7492b37a0f", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.5", "title": "NEI 08-09 App E.3.5 — Security Alerts and Advisories", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "b29035f4-bac2-57ed-8d29-a9e23d3263cf", "isPublic": true }, { "controlId": "C.13.1", "title": "C.13.1 — Threat and Vulnerability Management", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: RA-3, RA-5, SI-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "1eab2c1f-e35c-5ec0-b9a1-cf9bc6b8646c", "isPublic": true }, { "controlId": "NEI 08-09 App E.13.1", "title": "NEI 08-09 App E.13.1 — Threat and Vulnerability Management", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.13.1", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "c10d76be-4e0b-5f50-a3d7-76ba1ffaf477", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1), (g)", "title": "10 CFR 73.54(c)(1), (g) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.13.1", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "3546d10c-6782-5e45-b418-ed131008f33b", "isPublic": true }, { "controlId": "CIP-007-6-R2", "title": "CIP-007-6-R2 — Security Patch Management", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "3e7071f8-148e-5beb-9431-a85d054c9efb", "isPublic": true }, { "controlId": "CIP-007-6-2.1", "title": "CIP-007-6-2.1 — A patch management process for tracking, evaluating, and installing cyber security patches for applicable Cyber Assets", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2d2274e6-ee05-5e4f-8f8d-0c1b70999288", "isPublic": true }, { "controlId": "CIP-007-6-2.2", "title": "CIP-007-6-2.2 — At least once every 35 calendar days, evaluate security patches for applicability that have been released since the l...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "7f5be534-0576-53c4-ae7d-06726304b210", "isPublic": true }, { "controlId": "CIP-007-6-2.3", "title": "CIP-007-6-2.3 — For applicable patches identified in Part 2.2, within 35 calendar days of the evaluation completion, take one of the...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "807f6c62-d486-5c3f-aaf2-051da0754da1", "isPublic": true }, { "controlId": "CIP-007-6-2.4", "title": "CIP-007-6-2.4 — For each mitigation plan created or revised in Part 2.3, implement the plan within the timeframe specified in the pla...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "07ddd553-4df3-5862-b70f-96b608dbc646", "isPublic": true }, { "controlId": "CIP-010-4-R3", "title": "CIP-010-4-R3 — Vulnerability Assessments", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "47066f23-0a3c-5b66-b4f2-52f2ba0d73e4", "isPublic": true }, { "controlId": "CIP-010-4-3.1", "title": "CIP-010-4-3.1 — At least once every 15 calendar months, conduct a paper or active vulnerability assessment.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a776b1ea-99d6-5efc-a46c-3108a2941053", "isPublic": true }, { "controlId": "CIP-010-4-3.2", "title": "CIP-010-4-3.2 — Where technically feasible, at least once every 36 calendar months", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "526dc93c-9a04-5129-8592-9a3ee6e98cca", "isPublic": true }, { "controlId": "CIP-010-4-3.2.1", "title": "CIP-010-4-3.2.1 — Perform an active vulnerability assessment in a test environment, or perform an active vulnerability assessment in a...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ae364c22-d66a-52d5-8c53-e8b569e9e2fe", "isPublic": true }, { "controlId": "CIP-010-4-3.2.2", "title": "CIP-010-4-3.2.2 — Document the results of the testing and, if a test environment was used, the differences between the test environment...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b971c1be-7aaa-56a3-810c-f23d951137cd", "isPublic": true }, { "controlId": "CIP-010-4-3.3", "title": "CIP-010-4-3.3 — Prior to adding a new applicable Cyber Asset to a production environment, perform an active vulnerability assessment...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4e2ee4d7-93b9-52dc-9ebd-aa89612995c1", "isPublic": true }, { "controlId": "CIP-010-4-3.4", "title": "CIP-010-4-3.4 — Document the results of the assessments conducted according to Parts 3.1, 3.2, and 3.3 and the action plan to remedia...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "6323b518-1088-5085-99f7-459bce3b63fe", "isPublic": true }, { "controlId": "NSS-17T-Sec6.6", "title": "NSS-17T-Sec6.6 — Vulnerability Management & Compensating Measures for Legacy I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "9d981f24-655c-593b-9497-92f20f5347f4", "isPublic": true }, { "controlId": "IEC-62645-8.2", "title": "IEC-62645-8.2 — Patch and Vulnerability Management During Plant Outages/Maintenance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "10ebca85-022e-5224-9302-7b93a43ae684", "isPublic": true }, { "controlId": "IEC-63096-12.6", "title": "IEC-63096-12.6 — Technical Vulnerability Management for CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "fed536dd-9252-5dc3-a411-ba536664a735", "isPublic": true } ], "id": 32135, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731371", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731371", "catalogueId": 1062, "uuid": "4f92531c-6e25-59f6-8f90-6dfaa1f4cf3a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation and monitoring of vulnerability management controls?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Vulnerability & Patch Management Program (VPMP)", "description": "

Control Description

Mechanisms exist to facilitate the implementation and monitoring of vulnerability management controls.

Evidence Request List (ERL)

E-MNT-03\nE-THR-05\nE-VPM-01

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Vulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel apply software patches through an informal process.\n▪ Occasional vulnerability scanning is conducted on High Value Assets (HVAs).\n▪ Vulnerability scanning services may not be internal competencies and have to be outsourced.\n▪ Penetration testing services may not be internal competencies and have to be outsourced.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define the breadth and depth of coverage for vulnerability scanning that covers system components scanned and types of vulnerabilities that are checked for.\n▪ IT and/or cybersecurity personnel maintain a structured process to apply software patches and other vulnerability remediation efforts.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation and monitoring of vulnerability management controls.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.1, A.4.1.3, C.3.1, C.3.5, C.13.1
NERC-CIP (2026) Requirements: CIP-007-6-R2, CIP-010-4-R3", "controlId": "VPM-01", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-01", "references": "

Micro-Small Business (<10 staff)

∙ Third-party advisors (e.g., virtual CISO, Managed Security Services Provider (MSSP), etc.)

Small Business (10-49 staff)

∙ Third-party advisors (e.g., virtual CISO, Managed Security Services Provider (MSSP), etc.)

Medium Business (50-249 staff)

∙ Vulnerability & Patch Management Program

Large Business (250-999 staff)

∙ Vulnerability & Patch Management Program

Enterprise (>1,000 staff)

∙ Vulnerability & Patch Management Program", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74662, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591363", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591363", "securityControlId": 32136, "ccis": [], "uuid": "b5e28a7b-29cd-545d-a726-03f35d5a50f3", "testId": "VPM-01.1_A01", "test": "the breadth of testing and evaluation of required controls is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(07)_ODP[01]\n172A_3.14.3e_ODP[1]", "defaultText": null }, { "id": 74663, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591363", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591363", "securityControlId": 32136, "ccis": [], "uuid": "6b0a1808-fa4f-538e-bd77-35e876225104", "testId": "VPM-01.1_A02", "test": "the depth of testing and evaluation of required controls is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(07)_ODP[02]", "defaultText": null }, { "id": 74664, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591363", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591363", "securityControlId": 32136, "ccis": [], "uuid": "f78a8d27-fc52-51ce-80b0-4eac739b6c7a", "testId": "VPM-01.1_A03", "test": "system, applications and services are monitored for vulnerabilities per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74665, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591364", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591364", "securityControlId": 32136, "ccis": [], "uuid": "510a134e-23e7-51d6-b2c3-949fcf6b09bd", "testId": "VPM-01.1_A04", "test": "systems and system components are included in the scope of the specified enhanced security requirements.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "172A_3.14.3e[a]", "defaultText": null }, { "id": 74666, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591364", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591364", "securityControlId": 32136, "ccis": [], "uuid": "c02dcbbb-c73b-5497-a633-2f296b961998", "testId": "VPM-01.1_A05", "test": "systems and system components that are not included in systems and system components are segregated in purpose-specific networks.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "172A_3.14.3e[b]", "defaultText": null }, { "id": 74667, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591364", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591364", "securityControlId": 32136, "ccis": [], "uuid": "71ffac69-9747-5918-8cb8-4bdc3d472615", "testId": "VPM-01.1_A06", "test": "the developer of the system, system component or system service is required to perform attack surface reviews.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(06)", "defaultText": null }, { "id": 74668, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591364", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591364", "securityControlId": 32136, "ccis": [], "uuid": "5952e8b1-d4d2-558c-8fab-b56e276e794a", "testId": "VPM-01.1_A07", "test": "the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets an organization-defined breadth.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(07)[01]", "defaultText": null }, { "id": 74669, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591365", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591365", "securityControlId": 32136, "ccis": [], "uuid": "13555700-9005-5997-8cb4-1a109e5aa147", "testId": "VPM-01.1_A08", "test": "the developer of the system, system component, or system service is required to verify that the scope of testing and evaluation provides complete coverage of the required controls at an organization-defined depth.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SA-11(07)[02]", "defaultText": null }, { "id": 74670, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591365", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591365", "securityControlId": 32136, "ccis": [], "uuid": "62dbb2d8-1e00-5ed0-80a6-ba53f9935abf", "testId": "VPM-01.1_A09", "test": "the system is monitored for vulnerabilities .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least monthly, or when there are significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.11.02.a[01]", "defaultText": null } ], "externalMappings": [ { "id": 611093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fefb311e-9b06-51de-ab81-970986e37c09", "parentControlId": 32136, "controlId": "8.8", "title": "8.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59152" }, { "id": 611097, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dcbc4ad6-9e76-5033-94bd-d18640ef3d79", "parentControlId": 32136, "controlId": "SA-11(06)", "title": "SA-11(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59152" }, { "id": 611098, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59152", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7bfbaa6-2899-51ac-ab52-07d7551c3736", "parentControlId": 32136, "controlId": "SA-11(07)", "title": "SA-11(07)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59152" }, { "id": 611101, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "628c3cf1-7556-58bd-9985-3549ddc2cfc8", "parentControlId": 32136, "controlId": "SA-11(06)", "title": "SA-11(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591521" }, { "id": 611102, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae0e73cb-8443-5f86-86f2-7c46f0527c1c", "parentControlId": 32136, "controlId": "SA-11(07)", "title": "SA-11(07)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591521" }, { "id": 611104, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6badbc5-d744-5136-97c3-6c94a2130c02", "parentControlId": 32136, "controlId": "03.11.02.a", "title": "03.11.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591521" }, { "id": 611105, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4ca4ce7d-c0e8-5b08-aca8-380459b8a7a0", "parentControlId": 32136, "controlId": "03.14.01.a", "title": "03.14.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591521" }, { "id": 611107, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591521", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2926bc40-8b2c-51e8-9514-a3b74ea54a13", "parentControlId": 32136, "controlId": "PR.PS-02", "title": "PR.PS-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591521" }, { "id": 611153, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591529", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "268eb1cd-a82a-5792-a161-0a4e12ef725f", "parentControlId": 32136, "controlId": "THREAT-1e", "title": "THREAT-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591529" } ], "id": 32136, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731372", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731372", "catalogueId": 1062, "uuid": "706f0f7d-7ab1-55cd-bde4-102958272972", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define and manage the scope for its attack surface management activities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Attack Surface Scope", "description": "

Control Description

Mechanisms exist to define and manage the scope for its attack surface management activities.

Evidence Request List (ERL)

E-VPM-06

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nVulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define the breadth and depth of coverage for vulnerability scanning that covers system components scanned and types of vulnerabilities that are checked for.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to define and manage the scope for its attack surface management activities.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-01.1", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Identify what systems and software are in scope for security testing

Small Business (10-49 staff)

∙ Attack surface inventory\n∙ Define scope for vulnerability management

Medium Business (50-249 staff)

∙ Formal attack surface scoping process\n∙ Asset-driven attack surface management

Large Business (250-999 staff)

∙ Enterprise attack surface management (ASM) program\n∙ Automated attack surface discovery

Enterprise (>1,000 staff)

∙ Enterprise ASM platform (e.g., CyCognito, Mandiant ASM)\n∙ Automated continuous attack surface monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74671, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591365", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591365", "securityControlId": 32137, "ccis": [], "uuid": "879ebf41-4b88-5bca-bdab-b39c3c53f8c8", "testId": "VPM-02_A01", "test": "vulnerabilities are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.11.3[a]", "defaultText": null }, { "id": 74672, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591365", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591365", "securityControlId": 32137, "ccis": [], "uuid": "c2c67647-bca2-547d-985e-e71239181d9c", "testId": "VPM-02_A02", "test": "response times to remediate system vulnerabilities are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.11.02.ODP[03]", "defaultText": null }, { "id": 74673, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591366", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591366", "securityControlId": 32137, "ccis": [], "uuid": "bd423eb7-6ff0-59e5-a50a-cd2303c7fe3f", "testId": "VPM-02_A03", "test": "vulnerabilities are remediated in accordance with risk assessments.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_3.11.3[b]", "defaultText": null } ], "externalMappings": [ { "id": 611192, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591536", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "de6c3853-09da-5a61-b993-311e6649cfbe", "parentControlId": 32137, "controlId": "EVENT 1.9", "title": "EVENT 1.9", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591536" }, { "id": 611193, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591536", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "87dc4dc1-5cd4-599f-9453-741935e21591", "parentControlId": 32137, "controlId": "8.8", "title": "8.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591536" }, { "id": 611208, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e99fc97d-2f9e-575e-9207-823d50e54cb6", "parentControlId": 32137, "controlId": "PM-4", "title": "PM-4", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591538" }, { "id": 611209, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5deeb03b-0911-5487-9875-57a75bf5762c", "parentControlId": 32137, "controlId": "SC-18(1)", "title": "SC-18(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591538" }, { "id": 611210, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ad47a9e-7963-5f36-bbb2-96e6e93c7e62", "parentControlId": 32137, "controlId": "PM-04", "title": "PM-04", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591538" }, { "id": 611211, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a5c3729-004e-5f80-8e99-9639e3f923b1", "parentControlId": 32137, "controlId": "SC-18(01)", "title": "SC-18(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591538" }, { "id": 611214, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591538", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39f52680-a862-5900-9192-416cca668a5b", "parentControlId": 32137, "controlId": "PM-04", "title": "PM-04", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591539" }, { "id": 611215, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591539", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df56bf4a-2d19-5f30-b6d0-5504f5d03367", "parentControlId": 32137, "controlId": "SC-18(01)", "title": "SC-18(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591539" }, { "id": 611216, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49bde0d5-c7b7-559a-9593-4451d047977b", "parentControlId": 32137, "controlId": "PM-04", "title": "PM-04", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59155" }, { "id": 611217, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d202ced5-c50a-564b-babb-ce4ea09ad59a", "parentControlId": 32137, "controlId": "PM-04", "title": "PM-04", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59155" }, { "id": 611218, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1c57ed40-3dcb-5a3e-b142-160660651b91", "parentControlId": 32137, "controlId": "PM-04", "title": "PM-04", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59155" }, { "id": 611219, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aceb30ab-0968-5980-a964-99c579a9f62c", "parentControlId": 32137, "controlId": "PM-4", "title": "PM-4", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59155" }, { "id": 611222, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59155", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c25a37b5-5957-5811-bdf9-9d6e63cc3558", "parentControlId": 32137, "controlId": "3.14.1", "title": "3.14.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59155" }, { "id": 611223, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "193aa126-f79a-5082-a0f5-955dfacd3c72", "parentControlId": 32137, "controlId": "03.11.02.b", "title": "03.11.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591551" }, { "id": 611224, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec97eb51-342e-5d0b-aff8-31655cff663b", "parentControlId": 32137, "controlId": "03.12.02.a.02", "title": "03.12.02.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591551" }, { "id": 611225, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2cc7c6c-4ed0-5a8d-9c48-c5dfb999e84e", "parentControlId": 32137, "controlId": "03.14.01.a", "title": "03.14.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591551" }, { "id": 611230, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5efbffaf-9b9f-5ad4-b200-23e2736b700a", "parentControlId": 32137, "controlId": "ID.RA-08", "title": "ID.RA-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591551" }, { "id": 611231, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591551", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0fa084bc-20ea-502e-b02c-55bbc38b54f4", "parentControlId": 32137, "controlId": "PR.PS-02", "title": "PR.PS-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591551" }, { "id": 611285, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59156", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b45dcb2-9d4a-52c9-a021-8554de2aae34", "parentControlId": 32137, "controlId": "CIP-007-6 2.2", "title": "CIP-007-6 2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59156" }, { "id": 611286, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59156", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff6b9269-eaca-5d02-9d95-869ddefd39dd", "parentControlId": 32137, "controlId": "CIP-007-6 2.3", "title": "CIP-007-6 2.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59156" }, { "id": 611287, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59156", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4b81eb50-dd74-538a-8ebd-febbbb10e42c", "parentControlId": 32137, "controlId": "CIP-007-6 2.4", "title": "CIP-007-6 2.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59156" }, { "controlId": "A.4.1.3", "title": "A.4.1.3 — Vulnerability Assessments and Scans", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: RA-5, SI-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "d3a88100-2453-5d2f-a9a7-30ab9c1e4874", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.1.3", "title": "NEI 08-09 Sec 4.1.3 — Vulnerability Assessments and Scans", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.1.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "107ebf7c-d3f6-5cdb-9dac-d4e80a6e8921", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.1.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "b8cf84c8-9707-5662-acd5-0fcd71e424d6", "isPublic": true }, { "controlId": "C.3.2", "title": "C.3.2 — Flaw Remediation", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "93ff70be-9fb2-596a-9bc4-0231988d881d", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.2", "title": "NEI 08-09 App E.3.2 — Flaw Remediation", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "5ff92dea-044d-5e30-84b8-8ccf42711ad3", "isPublic": true }, { "controlId": "C.13.3", "title": "C.13.3 — Corrective Action Program", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CA-5, IR-4, PM-14", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "33c14388-bf43-55a8-8f45-75924af73262", "isPublic": true }, { "controlId": "NEI 08-09 App E.13.3 (CAP)", "title": "NEI 08-09 App E.13.3 (CAP) — Corrective Action Program", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.13.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "45653074-f3e3-5f55-b84d-ba14b1c3e06a", "isPublic": true }, { "controlId": "10 CFR 73.54(d)(3), 73.55(b)(10)", "title": "10 CFR 73.54(d)(3), 73.55(b)(10) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 C.13.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "88330ff0-284b-566d-90df-8f5856901541", "isPublic": true }, { "controlId": "CIP-007-6-R2", "title": "CIP-007-6-R2 — Security Patch Management", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2244cabc-1029-5ee3-9969-0c075686f763", "isPublic": true }, { "controlId": "CIP-007-6-2.1", "title": "CIP-007-6-2.1 — A patch management process for tracking, evaluating, and installing cyber security patches for applicable Cyber Assets", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "f8138344-ee71-5876-9503-9d65bf766569", "isPublic": true }, { "controlId": "CIP-007-6-2.2", "title": "CIP-007-6-2.2 — At least once every 35 calendar days, evaluate security patches for applicability that have been released since the l...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e2a7afd9-e3c0-5771-92c8-8043e4634af5", "isPublic": true }, { "controlId": "CIP-007-6-2.3", "title": "CIP-007-6-2.3 — For applicable patches identified in Part 2.2, within 35 calendar days of the evaluation completion, take one of the...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "06d582fc-236a-5848-84db-f67f8e41196c", "isPublic": true }, { "controlId": "CIP-007-6-2.4", "title": "CIP-007-6-2.4 — For each mitigation plan created or revised in Part 2.3, implement the plan within the timeframe specified in the pla...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "35c35343-56cf-55a4-9d38-ee784c9d8602", "isPublic": true }, { "controlId": "NSS-17T-Sec6.6", "title": "NSS-17T-Sec6.6 — Vulnerability Management & Compensating Measures for Legacy I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "0fe0af46-d349-57f6-90b2-f49f242d98b9", "isPublic": true }, { "controlId": "IEC-62645-8.2", "title": "IEC-62645-8.2 — Patch and Vulnerability Management During Plant Outages/Maintenance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "7cfa7e1f-60a1-55dd-a091-d821dd79a83b", "isPublic": true }, { "controlId": "IEC-63096-12.6", "title": "IEC-63096-12.6 — Technical Vulnerability Management for CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "e7f71476-48ef-508a-b992-e701b1c71beb", "isPublic": true } ], "id": 32137, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731372", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731372", "catalogueId": 1062, "uuid": "76236a43-f278-59ef-825c-e82516fb3d38", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure that vulnerabilities are properly identified, tracked and remediated?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Vulnerability Remediation Process", "description": "

Control Description

Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.

Evidence Request List (ERL)

E-RSK-03\nE-RSK-04\nE-VPM-01\nE-VPM-09

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nVulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure that vulnerabilities are properly identified, tracked and remediated.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.4.1.3, C.3.2, C.13.3
NERC-CIP (2026) Requirements: CIP-007-6-R2", "controlId": "VPM-02", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-02", "references": "

Micro-Small Business (<10 staff)

∙ Patch software when updates are released

Small Business (10-49 staff)

∙ Vulnerability remediation policy\n∙ Prioritized patching schedule

Medium Business (50-249 staff)

∙ Formal vulnerability remediation process\n∙ Risk-based prioritization\n∙ Remediation SLAs

Large Business (250-999 staff)

∙ Enterprise vulnerability remediation program\n∙ Defined SLAs by severity\n∙ Tracking and reporting

Enterprise (>1,000 staff)

∙ Enterprise vulnerability management platform (e.g., Tenable.io, Qualys)\n∙ Automated remediation tracking\n∙ SIEM integration", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74674, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591366", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591366", "securityControlId": 32138, "ccis": [], "uuid": "640e6063-ab70-5e07-9fdb-92bcdee82b01", "testId": "VPM-03_A01", "test": "a risk ranking methodology is utilized to prioritize newly discovered security vulnerabilities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 611341, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "790b85cd-3b32-5799-ab57-1f9c91fb93f3", "parentControlId": 32138, "controlId": "8.8", "title": "8.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591571" }, { "id": 611343, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591571", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "51eb208e-6739-5e6a-aa30-6492b8bb1368", "parentControlId": 32138, "controlId": "03.11.02.a", "title": "03.11.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591571" }, { "id": 611344, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591572", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8cee13ab-3f60-5170-9ec2-fd8d33741886", "parentControlId": 32138, "controlId": "ID.RA-08", "title": "ID.RA-08", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591572" }, { "id": 611359, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89b08a2a-640b-534b-af7f-45a2c8c2a3fa", "parentControlId": 32138, "controlId": "THREAT-1b", "title": "THREAT-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591573" }, { "id": 611360, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591573", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fcde36b-972a-587a-90f9-6453842028c5", "parentControlId": 32138, "controlId": "THREAT-1g", "title": "THREAT-1g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591573" }, { "id": 611361, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f2f082ea-1a29-5b9d-b4c7-7de969b5fdd5", "parentControlId": 32138, "controlId": "THREAT-1h", "title": "THREAT-1h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591574" }, { "id": 611362, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "411e071d-62a5-588a-80b6-f9e33685609f", "parentControlId": 32138, "controlId": "THREAT-2b", "title": "THREAT-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591574" }, { "id": 611363, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591574", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "88e66fb5-7ea5-5f0a-bda8-8e49ece44d36", "parentControlId": 32138, "controlId": "THREAT-2d", "title": "THREAT-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591574" }, { "controlId": "NSS-17T-Sec6.6", "title": "NSS-17T-Sec6.6 — Vulnerability Management & Compensating Measures for Legacy I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "5b4808c2-70c8-5227-b111-c5bce153b3ab", "isPublic": true }, { "controlId": "IEC-62645-8.2", "title": "IEC-62645-8.2 — Patch and Vulnerability Management During Plant Outages/Maintenance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "78e9ade7-1552-56b0-8fec-ce8e1a4db74b", "isPublic": true }, { "controlId": "IEC-63096-12.6", "title": "IEC-63096-12.6 — Technical Vulnerability Management for CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "0de34480-7df2-53ae-80e4-ddee05ce4763", "isPublic": true } ], "id": 32138, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731373", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731373", "catalogueId": 1062, "uuid": "061025c9-6aa1-512a-825b-936382b73347", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify and assign a risk ranking to newly discovered security vulnerabilities using reputable outside sources for security vulnerability information?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Vulnerability Ranking", "description": "

Control Description

Mechanisms exist to identify and assign a risk ranking to newly discovered security vulnerabilities using reputable outside sources for security vulnerability information.

Evidence Request List (ERL)

E-RSK-03\nE-RSK-04\nE-VPM-01\nE-VPM-10

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nVulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify and assign a risk ranking to newly discovered security vulnerabilities using reputable outside sources for security vulnerability information.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-03", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-03", "references": "

Micro-Small Business (<10 staff)

∙ Patch critical vulnerabilities first

Small Business (10-49 staff)

∙ Risk-based vulnerability ranking policy (critical, high, medium, low)

Medium Business (50-249 staff)

∙ Formal vulnerability ranking methodology (CVSS + business context)

Large Business (250-999 staff)

∙ Enterprise vulnerability ranking program\n∙ Risk-based prioritization with business impact

Enterprise (>1,000 staff)

∙ Enterprise vulnerability management platform with risk-based ranking (e.g., Tenable.io, Qualys)\n∙ Threat intelligence integration for prioritization", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74675, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591366", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591366", "securityControlId": 32139, "ccis": [], "uuid": "f0e508c7-2a18-5a60-9134-9379f8422aae", "testId": "VPM-03.1_A01", "test": "on at least an annual basis, a threat assessment is performed to identify and assess applicable internal and external threats.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74676, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591367", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591367", "securityControlId": 32139, "ccis": [], "uuid": "1adf33ee-a745-5843-ad93-c481cf9da856", "testId": "VPM-03.1_A02", "test": "a threat catalog captures applicable internal and external threats from the threat assessment.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74677, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591367", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591367", "securityControlId": 32139, "ccis": [], "uuid": "82d79805-da77-5cb7-bc01-d227604ebb1e", "testId": "VPM-03.1_A03", "test": "the scope of Attack Surface Management (ASM) is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74678, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591367", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591367", "securityControlId": 32139, "ccis": [], "uuid": "31391638-ed42-532e-9ef2-a0f1606247d4", "testId": "VPM-03.1_A04", "test": "vulnerability scanning activities are performed against the scope of ASM to identify applicable vulnerabilities.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74679, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591367", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591367", "securityControlId": 32139, "ccis": [], "uuid": "c1d74c39-a8a4-5c6b-852d-39184a777400", "testId": "VPM-03.1_A05", "test": "the organization documents the potential impact(s) and likelihood(s) of applicable internal and external threats exploiting known vulnerabilities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74680, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591368", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591368", "securityControlId": 32139, "ccis": [], "uuid": "94dfa135-b6b8-5cd3-b2fe-90075bb10229", "testId": "VPM-03.1_A06", "test": "each item in the threat catalog is prioritized, based on potential impact(s) and likelihood(s) of applicable internal and external threats exploiting identified vulnerabilities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 611386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591576", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f61b0a77-e920-595a-a2ea-ed4a84ef75b3", "parentControlId": 32139, "controlId": "THREAT-1b", "title": "THREAT-1b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591576" }, { "id": 611387, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591576", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aca040db-9415-5adf-b1ae-6f731eaba678", "parentControlId": 32139, "controlId": "THREAT-1g", "title": "THREAT-1g", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591577" }, { "id": 611388, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9ad1e90-4e70-5e30-84cb-723a799b59ff", "parentControlId": 32139, "controlId": "THREAT-1h", "title": "THREAT-1h", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591577" }, { "id": 611389, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591577", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e499ca8-059b-52c7-bee7-eeb84aae95c1", "parentControlId": 32139, "controlId": "THREAT-2b", "title": "THREAT-2b", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591577" } ], "id": 32139, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731373", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731373", "catalogueId": 1062, "uuid": "6fff7d36-b20a-594c-bb73-66edac6dde5a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify, assess, prioritize and document the potential impact(s) and likelihood(s) of applicable internal and external threats exploiting known vulnerabilities?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Vulnerability Exploitation Analysis", "description": "

Control Description

Mechanisms exist to identify, assess, prioritize and document the potential impact(s) and likelihood(s) of applicable internal and external threats exploiting known vulnerabilities.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nVulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify, assess, prioritize and document the potential impact(s) and likelihood(s) of applicable internal and external threats exploiting known vulnerabilities.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-03.1", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-03.1", "references": "

Micro-Small Business (<10 staff)

∙ Review vulnerabilities for evidence of active exploitation

Small Business (10-49 staff)

∙ Check CVEs for known exploits before prioritizing patches

Medium Business (50-249 staff)

∙ Formal vulnerability exploitation analysis process\n∙ CISA KEV catalog review

Large Business (250-999 staff)

∙ Enterprise vulnerability exploitation analysis\n∙ Threat intelligence integration for exploit data

Enterprise (>1,000 staff)

∙ Enterprise vulnerability management with threat intel integration (e.g., Tenable, Qualys)\n∙ CISA KEV, EPSS scoring\n∙ Automated exploit prioritization", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74681, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591368", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591368", "securityControlId": 32140, "ccis": [], "uuid": "88eb2cb2-a7b7-52cf-a78b-08b231a50d22", "testId": "VPM-04_A01", "test": "sources of new threats and vulnerabilities are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74682, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591368", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591368", "securityControlId": 32140, "ccis": [], "uuid": "125323d4-840d-59f9-967f-de6c91df0b91", "testId": "VPM-04_A02", "test": "a time period is defined to seek out new, applicable threats and vulnerabilities.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74683, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591368", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591368", "securityControlId": 32140, "ccis": [], "uuid": "2454d535-29b7-507c-8662-c708efd27f7b", "testId": "VPM-04_A03", "test": "a capability exists to respond to new threats and vulnerabilities on an ongoing basis.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74684, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591369", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591369", "securityControlId": 32140, "ccis": [], "uuid": "88ae44ba-a270-50e1-b810-5b26d00a6a47", "testId": "VPM-04_A04", "test": "system vulnerabilities are remediated within organization-defined response times.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74685, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591369", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591369", "securityControlId": 32140, "ccis": [], "uuid": "913b5a46-1454-568a-afbc-5882c68162f1", "testId": "VPM-04_A05", "test": "system vulnerabilities are remediated within .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: thirty (30) days from date of discovery for high-risk vulnerabilities (including both critical and high); 90 days from date of discovery for moderate-risk vulnerabilities; and 180 days from date of discovery for low-risk vulnerabilities", "otherId": "171A_R3_A.03.11.02.b", "defaultText": null } ], "externalMappings": [ { "id": 611413, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591581", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7cdce882-34e7-535f-9a48-0f7960319685", "parentControlId": 32140, "controlId": "SC-18(1)", "title": "SC-18(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591581" }, { "id": 611414, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26b4f4d5-ff4e-5475-b8d5-f141e5496c16", "parentControlId": 32140, "controlId": "SC-18(01)", "title": "SC-18(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591582" }, { "id": 611416, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e0ecc66-4b4f-506f-8482-5fe812c2aa1e", "parentControlId": 32140, "controlId": "SC-18(01)", "title": "SC-18(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591582" }, { "id": 611417, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7296d347-bedf-5ceb-9b8c-c8e240672a41", "parentControlId": 32140, "controlId": "3.11.3", "title": "3.11.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591582" }, { "id": 611418, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1dc80ca8-11d2-57e5-bca0-40c8c7669df4", "parentControlId": 32140, "controlId": "03.11.02.b", "title": "03.11.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591582" }, { "id": 611419, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec084c55-16c8-5c83-a8fb-1dd980a8d4bf", "parentControlId": 32140, "controlId": "03.14.01.a", "title": "03.14.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591582" }, { "id": 611420, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591582", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ac3a22c-d523-50f2-aa40-22384cde9a9f", "parentControlId": 32140, "controlId": "03.14.01.b", "title": "03.14.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591583" }, { "id": 611439, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "574b036a-1c22-5c7e-8b30-fbe333c368c8", "parentControlId": 32140, "controlId": "THREAT-1d", "title": "THREAT-1d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591585" }, { "id": 611440, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591585", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c586d0fb-cc6d-53c2-a256-c3db79fcb035", "parentControlId": 32140, "controlId": "THREAT-1i", "title": "THREAT-1i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591585" }, { "id": 611441, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591588", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d6972d2-1acf-5c1a-b7b0-c788cc943453", "parentControlId": 32140, "controlId": "THREAT-2d", "title": "THREAT-2d", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591588" }, { "controlId": "A.3.1.6", "title": "A.3.1.6 — Application of Security Controls", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: PL-2, CA-2, RA-3, SC-7", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "d3d5a4da-aaf4-5e95-bc55-a300397801c1", "isPublic": true }, { "controlId": "NEI 08-09 Sec 3.1.6", "title": "NEI 08-09 Sec 3.1.6 — Application of Security Controls", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.3.1.6", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "0740d366-4251-5858-aef6-47285db2ae56", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1), (a)(2)", "title": "10 CFR 73.54(c)(1), (a)(2) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.3.1.6", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "da1fba02-2ca4-530f-a3e8-8671f785ff39", "isPublic": true }, { "controlId": "A.4.1.3", "title": "A.4.1.3 — Vulnerability Assessments and Scans", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: RA-5, SI-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "722374db-6d19-53ee-9df0-636c2a6b1f55", "isPublic": true }, { "controlId": "NEI 08-09 Sec 4.1.3", "title": "NEI 08-09 Sec 4.1.3 — Vulnerability Assessments and Scans", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 A.4.1.3", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "c9c10f5b-e1a9-55cc-9de8-d1301b18dbf1", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 A.4.1.3", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "456f0099-48b0-5580-8417-99cd8a784d00", "isPublic": true }, { "controlId": "CIP-010-4-R3", "title": "CIP-010-4-R3 — Vulnerability Assessments", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2b001a8a-9aae-5a58-936b-5260c060cd0b", "isPublic": true }, { "controlId": "CIP-010-4-3.1", "title": "CIP-010-4-3.1 — At least once every 15 calendar months, conduct a paper or active vulnerability assessment.", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b2f8c13f-1b3f-54d3-aa56-acfe2cd27b49", "isPublic": true }, { "controlId": "CIP-010-4-3.2", "title": "CIP-010-4-3.2 — Where technically feasible, at least once every 36 calendar months", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2ca1f964-c5c4-5c5b-aa0a-4d8cd880f191", "isPublic": true }, { "controlId": "CIP-010-4-3.2.1", "title": "CIP-010-4-3.2.1 — Perform an active vulnerability assessment in a test environment, or perform an active vulnerability assessment in a...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4542a13e-b1a5-534e-b80c-dcb68ffd7807", "isPublic": true }, { "controlId": "CIP-010-4-3.2.2", "title": "CIP-010-4-3.2.2 — Document the results of the testing and, if a test environment was used, the differences between the test environment...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "4aeb240a-0225-5736-96a9-09264c88f2c8", "isPublic": true }, { "controlId": "CIP-010-4-3.3", "title": "CIP-010-4-3.3 — Prior to adding a new applicable Cyber Asset to a production environment, perform an active vulnerability assessment...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "508dff75-da38-5e12-8078-a60995f51f94", "isPublic": true }, { "controlId": "CIP-010-4-3.4", "title": "CIP-010-4-3.4 — Document the results of the assessments conducted according to Parts 3.1, 3.2, and 3.3 and the action plan to remedia...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-010-4-R3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "cd542a27-d172-5e9d-85e4-ac06445cf63b", "isPublic": true }, { "controlId": "CIP-014-3-R4", "title": "CIP-014-3-R4 — Evaluation of Potential Threats and Vulnerabilities", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "c79283c9-552b-5c7c-bcd8-c5c3f3322fb1", "isPublic": true }, { "controlId": "CIP-014-3-4.1", "title": "CIP-014-3-4.1 — Unique characteristics of the identified and verified Transmission station(s), Transmission substation(s), and primar...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "cc06428c-a384-5dc7-93f3-2054e1353564", "isPublic": true }, { "controlId": "CIP-014-3-4.2", "title": "CIP-014-3-4.2 — Prior history of attack on similar facilities taking into account the frequency, geographic proximity, and severity o...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "e04712ee-88c5-5778-b0f5-f6274505601e", "isPublic": true }, { "controlId": "CIP-014-3-4.3", "title": "CIP-014-3-4.3 — Intelligence or threat warnings received from sources such as law enforcement, the Electric Reliability Organization...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-014-3-R4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "b4a9af3b-b979-5c02-b392-53d750b411b7", "isPublic": true }, { "controlId": "NSS-17T-Sec6.6", "title": "NSS-17T-Sec6.6 — Vulnerability Management & Compensating Measures for Legacy I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "d5709638-a46f-5ac8-b337-d3e9e38652ac", "isPublic": true }, { "controlId": "IEC-62645-8.2", "title": "IEC-62645-8.2 — Patch and Vulnerability Management During Plant Outages/Maintenance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "c891c80a-9be2-5c53-84eb-297c61e4012c", "isPublic": true }, { "controlId": "IEC-63096-12.6", "title": "IEC-63096-12.6 — Technical Vulnerability Management for CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "16a23919-2a16-58e5-a73c-01bb0c517e1a", "isPublic": true } ], "id": 32140, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731373", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731373", "catalogueId": 1062, "uuid": "e1036c45-b6ed-511e-af9b-db2c4292f321", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization address new threats and vulnerabilities on an ongoing basis and ensure assets are protected against known attacks?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Continuous Vulnerability Remediation Activities", "description": "

Control Description

Mechanisms exist to address new threats and vulnerabilities on an ongoing basis and ensure assets are protected against known attacks.

Evidence Request List (ERL)

E-MNT-03\nE-THR-05

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nVulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to address new threats and vulnerabilities on an ongoing basis and ensure assets are protected against known attacks.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: A.3.1.6, A.4.1.3
NERC-CIP (2026) Requirements: CIP-010-4-R3, CIP-014-3-R4", "controlId": "VPM-04", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-04", "references": "

Micro-Small Business (<10 staff)

∙ Continuously monitor for new vulnerabilities in used software

Small Business (10-49 staff)

∙ Continuous vulnerability scanning and remediation cycle

Medium Business (50-249 staff)

∙ Formal continuous vulnerability management program\n∙ Regular scan cadence

Large Business (250-999 staff)

∙ Enterprise continuous vulnerability management (e.g., Tenable.io, Qualys)\n∙ Automated remediation workflows

Enterprise (>1,000 staff)

∙ Enterprise continuous vulnerability management platform\n∙ Real-time scanning\n∙ Automated patching integration\n∙ SIEM/SOAR integration", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74689, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591373", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591373", "securityControlId": 32143, "ccis": [], "uuid": "529c3654-06d3-5d98-9d48-d5c93239dff4", "testId": "VPM-04.3_A01", "test": "criteria are defined to justify the deferral of software and/or firmware patches.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74690, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591373", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591373", "securityControlId": 32143, "ccis": [], "uuid": "12e4b7d9-ee43-56db-a27c-3f8c9294c9c3", "testId": "VPM-04.3_A02", "test": "the deferral of software and/or firmware patches is facilitated when the disadvantages of applying the patch outweighs the benefits, based on organization-defined criteria.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 611491, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591596", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "581c5e94-4bdb-5ff8-a33f-c8546e48c6ed", "parentControlId": 32143, "controlId": "COMP 3.5", "title": "COMP 3.5", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591596" } ], "id": 32143, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731374", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731374", "catalogueId": 1062, "uuid": "9801b42e-7d84-54e3-bc60-16449cd4ef11", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the deferral of software and/or firmware patches when the disadvantages of applying the patch outweighs the benefits?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 2.0, "title": "Deferred Patching Decisions", "description": "

Control Description

Mechanisms exist to facilitate the deferral of software and/or firmware patches when the disadvantages of applying the patch outweighs the benefits.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Vulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel apply software patches through an informal process.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the deferral of software and/or firmware patches when the disadvantages of applying the patch outweighs the benefits.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-04.3", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-04.3", "references": "", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74691, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591374", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591374", "securityControlId": 32144, "ccis": [], "uuid": "2d880917-14de-5ee5-8fd8-9c9b3fdb8942", "testId": "VPM-05_A01", "test": "the time period within which to install security-relevant software updates after the release of the updates is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-02_ODP\n171A_R3_A.03.14.01.ODP[01]", "defaultText": null }, { "id": 74692, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591374", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591374", "securityControlId": 32144, "ccis": [], "uuid": "842555ae-3594-563a-8d5f-1488ce20cf3c", "testId": "VPM-05_A02", "test": "system flaws are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-02a.[01]\n171A_R3_A.03.14.01.a[01]", "defaultText": null }, { "id": 74693, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591374", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591374", "securityControlId": 32144, "ccis": [], "uuid": "e6de15a2-3bf8-56e9-b44b-50bc9410103c", "testId": "VPM-05_A03", "test": "automated patch management tools are employed to facilitate flaw remediation to components.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-02(04)", "defaultText": null }, { "id": 74694, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591375", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591375", "securityControlId": 32144, "ccis": [], "uuid": "08de80ee-f8cf-594e-81e7-2a0cf5198d0f", "testId": "VPM-05_A04", "test": "system flaws are corrected.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-02a.[03]\n171A_R3_A.03.14.01.a[03]", "defaultText": null }, { "id": 74695, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591375", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591375", "securityControlId": 32144, "ccis": [], "uuid": "b5f94fb8-2211-550c-a038-b81a5197d676", "testId": "VPM-05_A05", "test": "system flaws are reported.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "53A_R5_SI-02a.[02]\n171A_R3_A.03.14.01.a[02]", "defaultText": null }, { "id": 74696, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591375", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591375", "securityControlId": 32144, "ccis": [], "uuid": "49c7da6f-c97c-55aa-88bf-3e3b9b3d4ebe", "testId": "VPM-05_A06", "test": "software updates related to flaw remediation are tested for effectiveness before installation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-02b.[01]", "defaultText": null }, { "id": 74697, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591375", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591375", "securityControlId": 32144, "ccis": [], "uuid": "33299646-6375-56cb-ae9f-b7dd3d8f9074", "testId": "VPM-05_A07", "test": "software updates related to flaw remediation are tested for potential side effects before installation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-02b.[02]", "defaultText": null }, { "id": 74698, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591375", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591375", "securityControlId": 32144, "ccis": [], "uuid": "c90abedd-9d14-59f0-8840-b0eec314c89e", "testId": "VPM-05_A08", "test": "firmware updates related to flaw remediation are tested for effectiveness before installation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-02b.[03]", "defaultText": null }, { "id": 74699, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591376", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591376", "securityControlId": 32144, "ccis": [], "uuid": "aea84164-3783-5ae0-8271-2f5b4d758a00", "testId": "VPM-05_A09", "test": "firmware updates related to flaw remediation are tested for potential side effects before installation.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-02b.[04]", "defaultText": null }, { "id": 74700, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591376", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591376", "securityControlId": 32144, "ccis": [], "uuid": "4c41ee6e-02ba-5dd9-825f-f75e6eeaa941", "testId": "VPM-05_A10", "test": "security-relevant software updates are installed within an organization-defined time period of the release of the updates.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: within thirty (30) days of release of updates", "otherId": "53A_R5_SI-02c.[01]", "defaultText": null }, { "id": 74701, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591376", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591376", "securityControlId": 32144, "ccis": [], "uuid": "4ecbce33-5362-524f-946c-d74150172833", "testId": "VPM-05_A11", "test": "security-relevant firmware updates are installed within an organization-defined time period of the release of the updates.
PPTDF Applicability: Technology
Assessment Rigor: 3
SCF Defined Parameters: within thirty (30) days of release of updates", "otherId": "53A_R5_SI-02c.[02]", "defaultText": null }, { "id": 74702, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591376", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591376", "securityControlId": 32144, "ccis": [], "uuid": "3a234d40-54c3-5f47-9a53-4784e419e579", "testId": "VPM-05_A12", "test": "flaw remediation is incorporated into the organizational configuration management process.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-02d.", "defaultText": null }, { "id": 74703, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591377", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591377", "securityControlId": 32144, "ccis": [], "uuid": "c879fe88-d0ea-5c54-ba3f-6c821e772ff1", "testId": "VPM-05_A13", "test": "the system components requiring automated patch management tools to facilitate flaw remediation are defined.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-02(04)_ODP", "defaultText": null }, { "id": 74704, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591377", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591377", "securityControlId": 32144, "ccis": [], "uuid": "606feb5b-3f21-579c-9998-0e37d6f11257", "testId": "VPM-05_A14", "test": "the time period within which to install security-relevant firmware updates after the release of the updates is defined.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_R3_A.03.14.01.ODP[02]", "defaultText": null }, { "id": 74705, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591377", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591377", "securityControlId": 32144, "ccis": [], "uuid": "a1769aa9-7b21-5c23-a584-68cfbcb30e11", "testId": "VPM-05_A15", "test": "system vulnerabilities are remediated within .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: thirty (30) days from date of discovery for high-risk vulnerabilities (including both critical and high); 90 days from date of discovery for moderate-risk vulnerabilities; and 180 days from date of discovery for low-risk vulnerabilities", "otherId": "171A_R3_A.03.11.02.b", "defaultText": null }, { "id": 74706, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591377", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591377", "securityControlId": 32144, "ccis": [], "uuid": "1b0f7c86-fbe3-57cc-8f77-a9753b4657b1", "testId": "VPM-05_A16", "test": "security-relevant software updates are installed within of the release of the updates.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: thirty (30) days for high-risk flaws (including both critical and high), 90 days for moderate-risk flaws, and 180 days for low-risk flaws", "otherId": "171A_R3_A.03.14.01.b[01]", "defaultText": null }, { "id": 74707, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591377", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591377", "securityControlId": 32144, "ccis": [], "uuid": "1e2d16a1-22bc-5fc1-ae49-100022d83791", "testId": "VPM-05_A17", "test": "security-relevant firmware updates are installed within of the release of the updates.
PPTDF Applicability: Technology
Assessment Rigor: NIST 800-171
SCF Defined Parameters: thirty (30) days for high-risk flaws (including both critical and high), 90 days for moderate-risk flaws, and 180 days for low-risk flaws", "otherId": "171A_R3_A.03.14.01.b[02]", "defaultText": null } ], "externalMappings": [ { "id": 611527, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5916", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53d2c6cb-5acc-5d32-97dd-1273952ac6c6", "parentControlId": 32144, "controlId": "8.8", "title": "8.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5916" }, { "id": 611530, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ef196ae1-4276-56c5-ae9d-073f97ead929", "parentControlId": 32144, "controlId": "T1003", "title": "T1003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591601" }, { "id": 611531, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7636d8f8-cac4-56a4-89d6-b581e3f8774e", "parentControlId": 32144, "controlId": "T1003.001", "title": "T1003.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591601" }, { "id": 611532, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9d86b049-ad3c-50fa-8929-4c2c5c639264", "parentControlId": 32144, "controlId": "T1027", "title": "T1027", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591601" }, { "id": 611533, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9ba32ee7-93f8-5958-a8eb-e3c8cc366a35", "parentControlId": 32144, "controlId": "T1027.002", "title": "T1027.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591601" }, { "id": 611534, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4e290802-c305-55e9-a0e4-949a3c3a9f43", "parentControlId": 32144, "controlId": "T1027.007", "title": "T1027.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591601" }, { "id": 611535, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "01d1b112-8a7e-5d80-9f10-2425252862e5", "parentControlId": 32144, "controlId": "T1027.008", "title": "T1027.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591601" }, { "id": 611536, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1756ad1e-78f9-548c-bb64-a2c9917bd3e2", "parentControlId": 32144, "controlId": "T1027.009", "title": "T1027.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591601" }, { "id": 611537, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591601", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9a276ce-45d4-59bc-b3d0-da15d7d601f9", "parentControlId": 32144, "controlId": "T1047", "title": "T1047", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591601" }, { "id": 611538, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "678e4c5b-6777-5b4c-a37a-86930072b88e", "parentControlId": 32144, "controlId": "T1055", "title": "T1055", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591602" }, { "id": 611539, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7c51c42-1b85-5f96-b097-7de474a6fd72", "parentControlId": 32144, "controlId": "T1055.001", "title": "T1055.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591602" }, { "id": 611540, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591602", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab34c5e5-1064-573d-85da-761bae364eb9", "parentControlId": 32144, "controlId": "T1055.002", "title": "T1055.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591602" }, { "id": 611541, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bedea46e-8c65-5e90-b6e9-4f891b6c41b5", "parentControlId": 32144, "controlId": "T1055.003", "title": "T1055.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591617" }, { "id": 611542, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08d81822-4664-5237-b651-15e6feb2ce85", "parentControlId": 32144, "controlId": "T1055.004", "title": "T1055.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591617" }, { "id": 611543, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591617", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d0cacd2e-cd63-5365-a242-c98576f2fee8", "parentControlId": 32144, "controlId": "T1055.005", "title": "T1055.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591617" }, { "id": 611544, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f6181d84-aed5-5bae-9718-5ee0c8c083fe", "parentControlId": 32144, "controlId": "T1055.008", "title": "T1055.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591618" }, { "id": 611545, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3bb23a7-5397-58e3-ad29-33351c47c301", "parentControlId": 32144, "controlId": "T1055.009", "title": "T1055.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591618" }, { "id": 611546, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9bc1dd74-047e-50ce-a67f-121ba8cd33c3", "parentControlId": 32144, "controlId": "T1055.011", "title": "T1055.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591618" }, { "id": 611547, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "36b12c44-3beb-54f0-ad0a-3b5c25fa3160", "parentControlId": 32144, "controlId": "T1055.012", "title": "T1055.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591618" }, { "id": 611548, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd3f6dd9-81c5-5520-9c05-a663bea283a9", "parentControlId": 32144, "controlId": "T1055.013", "title": "T1055.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591618" }, { "id": 611549, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ae20c5b-a6d1-5207-955a-712ad22b98c3", "parentControlId": 32144, "controlId": "T1055.014", "title": "T1055.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591618" }, { "id": 611550, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9213ee16-5c90-5464-bb0c-6053b3753d40", "parentControlId": 32144, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591618" }, { "id": 611551, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1aa3d4be-c0bc-5d02-81d4-d95d7d0804dc", "parentControlId": 32144, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591618" }, { "id": 611552, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591618", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6e61a81-f6af-5d07-97a2-a2d4dc666505", "parentControlId": 32144, "controlId": "T1059.005", "title": "T1059.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591618" }, { "id": 611553, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "81a29d5c-4aa9-50ed-851b-0d00aafa8f86", "parentControlId": 32144, "controlId": "T1059.006", "title": "T1059.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591619" }, { "id": 611554, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7b974ec-dd9c-56e7-94ba-0d792b9de197", "parentControlId": 32144, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591619" }, { "id": 611555, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "651ac343-729b-59ce-9631-846721e92d6c", "parentControlId": 32144, "controlId": "T1072", "title": "T1072", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591619" }, { "id": 611556, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "15e8fa0d-a050-544a-baac-f706136777ac", "parentControlId": 32144, "controlId": "T1106", "title": "T1106", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591619" }, { "id": 611557, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "784a3f39-1422-5226-a718-ee64f04a91f7", "parentControlId": 32144, "controlId": "T1137", "title": "T1137", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591619" }, { "id": 611558, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "503e5756-0912-5c1b-b030-a4cd9edb2402", "parentControlId": 32144, "controlId": "T1137.003", "title": "T1137.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591619" }, { "id": 611559, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "21d2a4f1-270e-5697-ad64-e0c1bac65916", "parentControlId": 32144, "controlId": "T1137.004", "title": "T1137.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591619" }, { "id": 611560, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f19adf3-cb7e-5956-ac19-8ff8b5e6cb3d", "parentControlId": 32144, "controlId": "T1137.005", "title": "T1137.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591619" }, { "id": 611561, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591619", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f40ea82-eb30-533e-a74f-0ffbf64716ad", "parentControlId": 32144, "controlId": "T1189", "title": "T1189", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591619" }, { "id": 611562, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80a2ce3a-1e19-5d50-8706-40bac18a1f35", "parentControlId": 32144, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59162" }, { "id": 611563, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0ddaf803-4947-58b7-8030-41615d63e22c", "parentControlId": 32144, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59162" }, { "id": 611564, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "64147dc8-b38d-5ea7-83e2-cb6eec0afcdc", "parentControlId": 32144, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59162" }, { "id": 611565, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a505ad56-66a2-5f3a-9df1-6c3eb2ae4280", "parentControlId": 32144, "controlId": "T1195.002", "title": "T1195.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59162" }, { "id": 611566, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08bdfcbe-0a99-5b57-b456-04a5e2c230d6", "parentControlId": 32144, "controlId": "T1195.003", "title": "T1195.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59162" }, { "id": 611567, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ba80d23-aa35-58b8-9cd7-c26870788a56", "parentControlId": 32144, "controlId": "T1203", "title": "T1203", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59162" }, { "id": 611568, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59162", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8fdd0604-8249-5503-92ba-3682cd5b606d", "parentControlId": 32144, "controlId": "T1204", "title": "T1204", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59162" }, { "id": 611569, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c05a37b5-2166-52f5-9ac5-9483d66101ed", "parentControlId": 32144, "controlId": "T1204.001", "title": "T1204.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591621" }, { "id": 611570, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e20d95c-e12e-5a33-a547-4b32ba4c6d7f", "parentControlId": 32144, "controlId": "T1204.003", "title": "T1204.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591621" }, { "id": 611571, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "715edfcc-b546-558b-9cf4-7590a77de261", "parentControlId": 32144, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591621" }, { "id": 611572, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d87cc09-123a-5777-8586-dd77813d7aac", "parentControlId": 32144, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591621" }, { "id": 611573, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1abca7f5-dcc7-55ee-8064-6ae5fbe4e16a", "parentControlId": 32144, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591621" }, { "id": 611574, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "867718e7-5d6e-530e-958a-dc34ed32e683", "parentControlId": 32144, "controlId": "T1213.003", "title": "T1213.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591621" }, { "id": 611575, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6067dbf4-5cb3-5d86-846f-0b7a8f084552", "parentControlId": 32144, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591621" }, { "id": 611576, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2f04750-8510-5b83-a809-a18e7ce1d034", "parentControlId": 32144, "controlId": "T1221", "title": "T1221", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591621" }, { "id": 611577, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591621", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "085e1076-e3cf-5bc8-b3f9-91cbdcba0a95", "parentControlId": 32144, "controlId": "T1495", "title": "T1495", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591621" }, { "id": 611578, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5978eaf1-6a0b-53b7-9ac8-196817de6cec", "parentControlId": 32144, "controlId": "T1525", "title": "T1525", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591622" }, { "id": 611579, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "44c484ef-4c97-54e1-ba05-a10b4a9c7e23", "parentControlId": 32144, "controlId": "T1542", "title": "T1542", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591622" }, { "id": 611580, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "07f772e1-96ae-57a9-911c-84342dee5e89", "parentControlId": 32144, "controlId": "T1542.001", "title": "T1542.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591622" }, { "id": 611581, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e65f2c3-5d17-58cf-95f0-79a1f93868fc", "parentControlId": 32144, "controlId": "T1542.003", "title": "T1542.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591622" }, { "id": 611582, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b9473537-5af7-57d7-83d8-76056e3a7bcc", "parentControlId": 32144, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591622" }, { "id": 611583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9fc34b53-42cd-5d06-88c9-216842310c92", "parentControlId": 32144, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591622" }, { "id": 611584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "57514f01-0bf5-527c-ad86-5bb360e956a1", "parentControlId": 32144, "controlId": "T1546", "title": "T1546", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591622" }, { "id": 611585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "73ec8f83-9bfd-5cc4-b4f3-73729f4d58a4", "parentControlId": 32144, "controlId": "T1546.006", "title": "T1546.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591622" }, { "id": 611586, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3652b17e-e27e-5b23-91b1-d4285ddc2322", "parentControlId": 32144, "controlId": "T1546.010", "title": "T1546.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591622" }, { "id": 611587, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591622", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6ec2983b-6fdc-5591-950c-96da2ab66e3e", "parentControlId": 32144, "controlId": "T1546.011", "title": "T1546.011", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591623" }, { "id": 611588, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12f2395f-ea01-5892-8d36-c0c5c0b94f64", "parentControlId": 32144, "controlId": "T1546.016", "title": "T1546.016", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591623" }, { "id": 611589, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08002d28-d8f5-56b7-bc08-b6d66e8ec074", "parentControlId": 32144, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591623" }, { "id": 611590, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591623", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6b24576-f7bf-588e-8aa7-2208a3cfe741", "parentControlId": 32144, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591623" }, { "id": 611591, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e331e2fe-4352-5a7c-9c69-40211f194336", "parentControlId": 32144, "controlId": "T1548.002", "title": "T1548.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591625" }, { "id": 611592, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591625", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7bdb6a46-9a91-5fe8-a8d9-43d1ee0cd0ee", "parentControlId": 32144, "controlId": "T1548.006", "title": "T1548.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591625" }, { "id": 611593, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6bc69369-ec21-5292-a009-38394c0ba601", "parentControlId": 32144, "controlId": "T1550.002", "title": "T1550.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591626" }, { "id": 611594, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49b2b63f-9bfa-571b-b372-4e7996d53589", "parentControlId": 32144, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591626" }, { "id": 611595, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2fb20d07-2e7e-5490-a133-367c7d68108d", "parentControlId": 32144, "controlId": "T1552.006", "title": "T1552.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591626" }, { "id": 611596, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ac80c563-e183-523b-ad46-165e4022cf4b", "parentControlId": 32144, "controlId": "T1553", "title": "T1553", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591626" }, { "id": 611597, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3706bd61-a81e-5604-926e-a101f7a65086", "parentControlId": 32144, "controlId": "T1553.006", "title": "T1553.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591626" }, { "id": 611598, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "13dd7a53-0b5c-5718-880a-5476745ee2e5", "parentControlId": 32144, "controlId": "T1555", "title": "T1555", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591626" }, { "id": 611599, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "188a3a48-29d8-5c7d-ac1d-865fe0d8f76c", "parentControlId": 32144, "controlId": "T1555.005", "title": "T1555.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591626" }, { "id": 611600, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591626", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7467aaf-c942-5de0-bec0-fc8e096d8048", "parentControlId": 32144, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591626" }, { "id": 611601, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7edadd14-f1d5-5529-a660-ab635daae3ec", "parentControlId": 32144, "controlId": "T1559.002", "title": "T1559.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591627" }, { "id": 611602, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "63c68b58-14bf-5f6c-8f11-47a383a31a8e", "parentControlId": 32144, "controlId": "T1566", "title": "T1566", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591627" }, { "id": 611603, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0575edb7-ddf9-5882-b960-a105b843e6f4", "parentControlId": 32144, "controlId": "T1566.001", "title": "T1566.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591627" }, { "id": 611604, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "879cc5fc-25f9-53c7-93ef-a99955c5724a", "parentControlId": 32144, "controlId": "T1566.003", "title": "T1566.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591627" }, { "id": 611605, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49615394-fe4f-51a3-aa75-2451a0ad95f8", "parentControlId": 32144, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591627" }, { "id": 611606, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e297f740-d89f-5275-82cc-472d9d1c951d", "parentControlId": 32144, "controlId": "T1574.002", "title": "T1574.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591627" }, { "id": 611607, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3e9c9ad3-12c7-5563-8049-4917d7995ee6", "parentControlId": 32144, "controlId": "T1574.013", "title": "T1574.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591627" }, { "id": 611608, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5aaa1647-d24c-55e5-97fb-31b9f18ec15e", "parentControlId": 32144, "controlId": "T1601", "title": "T1601", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591627" }, { "id": 611609, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591627", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eea6a295-c527-5da3-8ac3-13e1e04f4e34", "parentControlId": 32144, "controlId": "T1601.001", "title": "T1601.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591627" }, { "id": 611610, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26b0899c-a782-5687-8b01-308c73d11b7d", "parentControlId": 32144, "controlId": "T1601.002", "title": "T1601.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591628" }, { "id": 611611, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "289ecd19-df7e-53de-94b7-2d4c4a21bd5b", "parentControlId": 32144, "controlId": "T1606", "title": "T1606", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591628" }, { "id": 611612, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff4e4fae-7ee3-513b-939f-218219fd2788", "parentControlId": 32144, "controlId": "T1606.001", "title": "T1606.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591628" }, { "id": 611613, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "04f548fd-db36-5e27-be11-e663e3df49da", "parentControlId": 32144, "controlId": "T1611", "title": "T1611", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591628" }, { "id": 611615, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591628", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94549175-2417-5fae-ae7b-f9da0ad220f4", "parentControlId": 32144, "controlId": "SI-2", "title": "SI-2", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591628" }, { "id": 611616, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3d13274b-52c0-5bdb-b08d-c5d7015e564a", "parentControlId": 32144, "controlId": "SI-3(2)", "title": "SI-3(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591634" }, { "id": 611617, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "052966cf-08d0-5e45-b703-255307b8aa92", "parentControlId": 32144, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591634" }, { "id": 611618, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a6df2eff-f39e-5400-94ba-73cfccacecbf", "parentControlId": 32144, "controlId": "SI-02(04)", "title": "SI-02(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591634" }, { "id": 611619, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591634", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f81d3b61-aff4-5dd9-a5f7-71ed729690ca", "parentControlId": 32144, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591634" }, { "id": 611623, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591635", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "690bf636-d2eb-574c-b6d7-1735e9647290", "parentControlId": 32144, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591635" }, { "id": 611624, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591635", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a30eb8d2-3cb7-53cf-9550-52dfaa957192", "parentControlId": 32144, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591635" }, { "id": 611625, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591635", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55095061-da3d-5d84-98bf-6107ebbf5ea0", "parentControlId": 32144, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591635" }, { "id": 611626, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591635", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e5024584-5028-5b0c-bab1-09cc899f8d62", "parentControlId": 32144, "controlId": "SI-02(04)", "title": "SI-02(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591635" }, { "id": 611627, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591635", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c1a2b59a-f4ec-511d-aba6-2ef28d6fd601", "parentControlId": 32144, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591635" }, { "id": 611628, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591635", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3df6d43d-a212-52d8-8cbf-08fc1cdf2212", "parentControlId": 32144, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591635" }, { "id": 611629, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591635", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed106553-164f-50c4-92b5-ac341eb4381b", "parentControlId": 32144, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591635" }, { "id": 611630, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03b529df-2870-5975-93a6-c7d0a9dee453", "parentControlId": 32144, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591636" }, { "id": 611631, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "55908e61-e311-561b-9cf8-375334f1ec42", "parentControlId": 32144, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591636" }, { "id": 611632, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2dec3360-a99d-5097-b601-2fb8a7cd6948", "parentControlId": 32144, "controlId": "SI-02", "title": "SI-02", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591636" }, { "id": 611633, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d5594f67-532e-586c-a1d3-e56ea28be4c1", "parentControlId": 32144, "controlId": "SI-03", "title": "SI-03", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591636" }, { "id": 611634, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8512af58-0dd5-5260-870f-8e79da2bd525", "parentControlId": 32144, "controlId": "SI-2", "title": "SI-2", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591636" }, { "id": 611635, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "00c4abb4-1df4-5ed2-aa5b-47d063b182eb", "parentControlId": 32144, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591636" }, { "id": 611636, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e529d57-ad3a-5ea0-a5fb-5990e00627be", "parentControlId": 32144, "controlId": "SI-2", "title": "SI-2", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591636" }, { "id": 611637, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aad6ed5a-bfe9-5a3c-a35f-10b8e1b8e9cf", "parentControlId": 32144, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591636" }, { "id": 611638, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "285ba28c-625a-59ad-94cc-4c8218e1580e", "parentControlId": 32144, "controlId": "SI-2", "title": "SI-2", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591636" }, { "id": 611639, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591636", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b7545e1c-939a-5ea1-af3b-f7df37c206b8", "parentControlId": 32144, "controlId": "SI-3", "title": "SI-3", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591637" }, { "id": 611644, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591637", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f1f17c7b-1833-525f-8c41-e68f160acf59", "parentControlId": 32144, "controlId": "3.11.3", "title": "3.11.3", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591637" }, { "id": 611645, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591637", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "90b0627b-175a-590a-ab26-29cec48e7179", "parentControlId": 32144, "controlId": "3.14.1", "title": "3.14.1", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591637" }, { "id": 611646, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "021c52f8-185d-5b00-be74-02a9dc27fa19", "parentControlId": 32144, "controlId": "03.11.02.b", "title": "03.11.02.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591638" }, { "id": 611647, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2d69452d-b5d8-52ae-8712-114cd3c9bc16", "parentControlId": 32144, "controlId": "03.12.02.a.02", "title": "03.12.02.a.02", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591638" }, { "id": 611648, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d20db218-1734-5d88-85c6-38077673feb1", "parentControlId": 32144, "controlId": "03.14.01.a", "title": "03.14.01.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591638" }, { "id": 611649, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591638", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d04ae83a-7dd5-59f2-8815-e65d553a2d6e", "parentControlId": 32144, "controlId": "03.14.01.b", "title": "03.14.01.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591638" }, { "id": 611658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591639", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa5a08ad-ab4d-51a5-93e5-e83ba87848cf", "parentControlId": 32144, "controlId": "PR.PS-02", "title": "PR.PS-02", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591639" }, { "id": 611699, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "448a46f7-84d0-5237-a746-00581f179678", "parentControlId": 32144, "controlId": "CIP-007-6 1.3", "title": "CIP-007-6 1.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591644" }, { "id": 611700, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591644", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "166a091a-d7d3-582a-af37-29c4cf9c3017", "parentControlId": 32144, "controlId": "CIP-007-6 2.3", "title": "CIP-007-6 2.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591644" }, { "controlId": "B.5.5", "title": "B.5.5 — Installing Operating Systems, Applications, and Third-Party Software Updates", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: CM-11, SI-7, CM-5", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "38234b9b-2ff9-579f-8ae9-a9e9e341f5fe", "isPublic": true }, { "controlId": "NEI 08-09 App D.5.5", "title": "NEI 08-09 App D.5.5 — Installing Operating Systems, Applications, and Third-Party Software Updates", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.5.5", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "1f46abc3-b76f-51cc-9d08-00c3777e8c5d", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.5.5", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "30f0f353-73cb-5cb8-bce2-b3d83e512f50", "isPublic": true }, { "controlId": "C.3.2", "title": "C.3.2 — Flaw Remediation", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SI-2", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "935ed785-8760-5417-a209-c756c862a738", "isPublic": true }, { "controlId": "NEI 08-09 App E.3.2", "title": "NEI 08-09 App E.3.2 — Flaw Remediation", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 C.3.2", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "9bba7ab9-5a4c-5834-9e87-5909b5a268e3", "isPublic": true }, { "controlId": "CIP-007-6-R2", "title": "CIP-007-6-R2 — Security Patch Management", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "81cf3c1a-b283-5d88-94e5-7e3a7426cdb2", "isPublic": true }, { "controlId": "CIP-007-6-2.1", "title": "CIP-007-6-2.1 — A patch management process for tracking, evaluating, and installing cyber security patches for applicable Cyber Assets", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "a2e981d9-c947-5936-af17-3e35721ae6a9", "isPublic": true }, { "controlId": "CIP-007-6-2.2", "title": "CIP-007-6-2.2 — At least once every 35 calendar days, evaluate security patches for applicability that have been released since the l...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "d65fbf3b-3f1f-50e3-9087-d2dacd15b4bf", "isPublic": true }, { "controlId": "CIP-007-6-2.3", "title": "CIP-007-6-2.3 — For applicable patches identified in Part 2.2, within 35 calendar days of the evaluation completion, take one of the...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "9d4a857a-9c1b-506d-8a39-415103b4e227", "isPublic": true }, { "controlId": "CIP-007-6-2.4", "title": "CIP-007-6-2.4 — For each mitigation plan created or revised in Part 2.3, implement the plan within the timeframe specified in the pla...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "125eee4d-056c-59f1-bcc3-d199ed78cf6b", "isPublic": true }, { "controlId": "NSS-17T-Sec6.6", "title": "NSS-17T-Sec6.6 — Vulnerability Management & Compensating Measures for Legacy I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "acd63cbb-ba7d-5914-b73d-76a950db5c05", "isPublic": true }, { "controlId": "IEC-62645-8.2", "title": "IEC-62645-8.2 — Patch and Vulnerability Management During Plant Outages/Maintenance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "a1d15f05-f687-5f7d-9c87-647ae92a91a3", "isPublic": true }, { "controlId": "IEC-63096-12.6", "title": "IEC-63096-12.6 — Technical Vulnerability Management for CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "640ee947-e635-57da-bd6b-bae9d6b7b48b", "isPublic": true } ], "id": 32144, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731374", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731374", "catalogueId": 1062, "uuid": "7886e45f-d09a-56f3-8964-2897edd67bb6", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct software patching for all deployed systems, applications and firmware?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 10.0, "title": "Software & Firmware Patching", "description": "

Control Description

Mechanisms exist to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.

Evidence Request List (ERL)

E-MNT-03\nE-VPM-10

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nVulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel maintain a structured process to apply software patches and other vulnerability remediation efforts.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conduct software patching for all deployed Technology Assets, Applications and/or Services (TAAS), including firmware.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.5.5, C.3.2
NERC-CIP (2026) Requirements: CIP-007-6-R2", "controlId": "VPM-05", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-05", "references": "

Micro-Small Business (<10 staff)

∙ ManageEngine Endpoint Central (https://manageengine.com)

Small Business (10-49 staff)

∙ ManageEngine Endpoint Central (https://manageengine.com)

Medium Business (50-249 staff)

∙ ManageEngine Endpoint Central (https://manageengine.com)

Large Business (250-999 staff)

∙ ManageEngine Endpoint Central (https://manageengine.com)

Enterprise (>1,000 staff)

∙ ManageEngine Endpoint Central (https://manageengine.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74708, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591378", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591378", "securityControlId": 32145, "ccis": [], "uuid": "72ce52b5-61ec-508a-af69-a45db99421d2", "testId": "VPM-05.1_A01", "test": "cybersecurity / data privacy controls and related processes to be centrally managed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-09_ODP", "defaultText": null }, { "id": 74709, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591378", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591378", "securityControlId": 32145, "ccis": [], "uuid": "7744d5dc-13a6-5200-8cb9-09082dff798c", "testId": "VPM-05.1_A02", "test": "controls and related processes are centrally managed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_PL-09", "defaultText": null }, { "id": 74710, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591378", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591378", "securityControlId": 32145, "ccis": [], "uuid": "e402a6a2-6ed9-5c4f-928e-8703496cff02", "testId": "VPM-05.1_A03", "test": "the system components requiring automated patch management tools to facilitate flaw remediation are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-02(04)_ODP", "defaultText": null }, { "id": 74711, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591378", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591378", "securityControlId": 32145, "ccis": [], "uuid": "c64bf26e-7520-5631-ab2d-faf4a4d1be9d", "testId": "VPM-05.1_A04", "test": "automated patch management tools are employed to facilitate flaw remediation to components.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-02(04)", "defaultText": null } ], "externalMappings": [ { "id": 611784, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591662", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "76ae151b-edc6-52c5-8186-5211b94f051e", "parentControlId": 32145, "controlId": "SI-2(1)", "title": "SI-2(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591662" }, { "id": 611785, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591662", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f9fef7b-4978-527f-89ef-b8f27d4d16da", "parentControlId": 32145, "controlId": "PL-09", "title": "PL-09", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591662" }, { "id": 611786, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591662", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "22148518-3d4d-5ca9-93c6-426e793cfead", "parentControlId": 32145, "controlId": "SI-02(04)", "title": "SI-02(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591662" }, { "id": 611789, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591663", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "921d1dc5-d6b8-5574-b934-215219e1e392", "parentControlId": 32145, "controlId": "PL-09", "title": "PL-09", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591663" }, { "id": 611790, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591663", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc6008d8-6d54-5cd6-a484-bdf8144baf0c", "parentControlId": 32145, "controlId": "SI-02(04)", "title": "SI-02(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591663" }, { "id": 611791, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591663", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2170ef97-4690-56c2-ba27-9fcb86309bde", "parentControlId": 32145, "controlId": "PL-9", "title": "PL-9", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591663" }, { "id": 611832, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591668", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c17ede8a-361d-52d8-aa7e-ecac353f2fae", "parentControlId": 32145, "controlId": "THREAT-1l", "title": "THREAT-1l", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591668" }, { "id": 611833, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591668", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7179efbd-3807-5dbb-b88a-2fd3e1416fff", "parentControlId": 32145, "controlId": "RISK-2l", "title": "RISK-2l", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591668" } ], "id": 32145, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731375", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731375", "catalogueId": 1062, "uuid": "d8b824f2-815b-5600-a215-0d7d89671408", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization centrally-manage the flaw remediation process?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Centralized Management of Flaw Remediation Processes", "description": "

Control Description

Mechanisms exist to centrally-manage the flaw remediation process.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nVulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to centrally-manage the flaw remediation process.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-05.1", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-05.1", "references": "

Micro-Small Business (<10 staff)

∙ Centrally track vulnerability status across all systems

Small Business (10-49 staff)

∙ Centralized vulnerability tracking spreadsheet or tool

Medium Business (50-249 staff)

∙ Centralized vulnerability management platform (e.g., Tenable.io, Qualys)

Large Business (250-999 staff)

∙ Enterprise centralized vulnerability management platform with integrated asset management

Enterprise (>1,000 staff)

∙ Enterprise vulnerability management platform (e.g., Tenable One, Qualys VMDR)\n∙ Full asset-vulnerability integration\n∙ Automated centralized management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74712, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591379", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591379", "securityControlId": 32146, "ccis": [], "uuid": "f4f7d0a8-ad62-59d8-89fb-00f115434450", "testId": "VPM-05.2_A01", "test": "automated mechanisms to determine if applicable security-relevant software and firmware updates are installed on system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least monthly", "otherId": "53A_R5_SI-02(02)_ODP[01]", "defaultText": null }, { "id": 74713, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591379", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591379", "securityControlId": 32146, "ccis": [], "uuid": "90dfea50-22af-5ab8-84ba-860877b858f8", "testId": "VPM-05.2_A02", "test": "the frequency at which to determine if applicable security-relevant software and firmware updates are installed on system components is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least monthly", "otherId": "53A_R5_SI-02(02)_ODP[02]", "defaultText": null }, { "id": 74714, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591379", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591379", "securityControlId": 32146, "ccis": [], "uuid": "7be919e2-91b2-5377-ae75-4c6b613e7923", "testId": "VPM-05.2_A03", "test": "system components have applicable security-relevant software and firmware updates installed frequency using automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: at least monthly", "otherId": "53A_R5_SI-02(02)", "defaultText": null }, { "id": 74715, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591379", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591379", "securityControlId": 32146, "ccis": [], "uuid": "7412497a-6075-5a73-8aeb-959d36dd9f99", "testId": "VPM-05.2_A04", "test": "the system components requiring automated patch management tools to facilitate flaw remediation are defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_SI-02(04)_ODP", "defaultText": null }, { "id": 74716, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59138", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59138", "securityControlId": 32146, "ccis": [], "uuid": "8c9e9cf2-75b8-5991-b15e-b1e203fe73b7", "testId": "VPM-05.2_A05", "test": "automated patch management tools are employed to facilitate flaw remediation to components.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_SI-02(04)", "defaultText": null } ], "externalMappings": [ { "id": 611864, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591671", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "051fd06c-c5d4-553d-b842-df24b1d01d85", "parentControlId": 32146, "controlId": "COMP 3.3", "title": "COMP 3.3", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591671" }, { "id": 611865, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591671", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8088e9ed-f06c-573e-a12c-9b0154338a4a", "parentControlId": 32146, "controlId": "SI-2(2)", "title": "SI-2(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591671" }, { "id": 611866, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591672", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "efa0ddf4-494a-5de2-8b6f-673ca7ed65af", "parentControlId": 32146, "controlId": "SI-02(02)", "title": "SI-02(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591672" }, { "id": 611867, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591672", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "09c6cb93-9e85-5073-bccb-f2662fcebcb4", "parentControlId": 32146, "controlId": "SI-02(04)", "title": "SI-02(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591672" }, { "id": 611869, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591672", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fd6c1709-a8c6-53c7-a347-1992d739fb9c", "parentControlId": 32146, "controlId": "SI-02(02)", "title": "SI-02(02)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591672" }, { "id": 611870, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591672", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4594c0f3-9770-5082-9354-15139df3ba08", "parentControlId": 32146, "controlId": "SI-02(02)", "title": "SI-02(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591672" }, { "id": 611871, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591672", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f89c95c-ee96-5b4b-8bdc-0b4285a78cac", "parentControlId": 32146, "controlId": "SI-02(04)", "title": "SI-02(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591672" }, { "id": 611872, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591672", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "baea0321-4710-571a-867f-c7a082bb4860", "parentControlId": 32146, "controlId": "SI-02(02)", "title": "SI-02(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591672" }, { "id": 611873, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591672", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1212b674-9087-5788-b6bd-9d9a65ca1a0f", "parentControlId": 32146, "controlId": "SI-02(02)", "title": "SI-02(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591672" } ], "id": 32146, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731375", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731375", "catalogueId": 1062, "uuid": "636fa095-0879-57fd-827b-6bc3f6fe1736", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to determine the state of system components with regard to flaw remediation?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Automated Remediation Status", "description": "

Control Description

Automated mechanisms exist to determine the state of system components with regard to flaw remediation.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nVulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically determine the state of system components with regard to flaw remediation.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-05.2", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-05.2", "references": "

Micro-Small Business (<10 staff)

∙ Check remediation status of patched systems

Small Business (10-49 staff)

∙ Automated remediation verification scans after patching

Medium Business (50-249 staff)

∙ Formal remediation verification process\n∙ Rescan after patching

Large Business (250-999 staff)

∙ Enterprise automated remediation verification scanning

Enterprise (>1,000 staff)

∙ Enterprise vulnerability management with automated remediation status tracking and verification", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74717, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59138", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59138", "securityControlId": 32147, "ccis": [], "uuid": "aebdaad4-b1ae-5f17-b3da-7e5080e6103e", "testId": "VPM-05.3_A01", "test": "the benchmarks for taking corrective actions are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-02(03)_ODP", "defaultText": null }, { "id": 74718, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59138", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59138", "securityControlId": 32147, "ccis": [], "uuid": "ad32b98e-4394-5e02-a159-ce069c7fc7c1", "testId": "VPM-05.3_A02", "test": "the time between flaw identification and flaw remediation is measured.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-02(03)(a)", "defaultText": null }, { "id": 74719, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59138", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59138", "securityControlId": 32147, "ccis": [], "uuid": "695d3daa-7b43-5dce-894b-30bbbb4c3076", "testId": "VPM-05.3_A03", "test": "benchmarks for taking corrective actions have been established.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-02(03)(b)", "defaultText": null } ], "externalMappings": [ { "id": 611890, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591674", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "49d4add4-414d-58f9-b5d6-a61e07873d91", "parentControlId": 32147, "controlId": "SI-2(3)", "title": "SI-2(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591674" }, { "id": 611891, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591675", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed5fb01c-e0cb-5084-baae-9c1bf8b2fa4a", "parentControlId": 32147, "controlId": "SI-02(03)", "title": "SI-02(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591675" }, { "id": 611892, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591675", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3652f775-4438-5ab2-9e5f-e86ed087bd3d", "parentControlId": 32147, "controlId": "SI-02(03)", "title": "SI-02(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591675" }, { "id": 611893, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591675", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f29e8541-a4f6-50f8-a94c-bda8d20ec177", "parentControlId": 32147, "controlId": "THREAT-1i", "title": "THREAT-1i", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591675" }, { "id": 611894, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591675", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "815d7db2-7924-587b-a38c-5dae48f24932", "parentControlId": 32147, "controlId": "RISK-2l", "title": "RISK-2l", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591675" } ], "id": 32147, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731376", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731376", "catalogueId": 1062, "uuid": "cffcdb1e-9697-5bea-a209-1643e3ff21f2", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization track the effectiveness of remediation operations through metrics reporting?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 6.0, "title": "Time To Remediate / Benchmarks For Corrective Action", "description": "

Control Description

Mechanisms exist to track the effectiveness of remediation operations through metrics reporting.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nVulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to track the effectiveness of remediation operations through metrics reporting.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "VPM-05.3", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-05.3", "references": "

Micro-Small Business (<10 staff)

∙ Define and track time-to-remediate goals by severity

Small Business (10-49 staff)

∙ Vulnerability remediation SLAs by severity level

Medium Business (50-249 staff)

∙ Formal remediation SLA policy with benchmark tracking

Large Business (250-999 staff)

∙ Enterprise remediation SLA management and benchmarking program

Enterprise (>1,000 staff)

∙ Enterprise vulnerability management platform with SLA tracking and reporting (e.g., Tenable.io, Qualys)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74720, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59138", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59138", "securityControlId": 32148, "ccis": [], "uuid": "3f0864fe-dee8-59bd-bce0-6dacf26edba4", "testId": "VPM-05.4_A01", "test": "the system components requiring automated patch management tools to facilitate flaw remediation are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-02(04)_ODP", "defaultText": null }, { "id": 74721, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59138", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591381", "securityControlId": 32148, "ccis": [], "uuid": "947da460-72c4-5bcf-8ed3-576beec64563", "testId": "VPM-05.4_A02", "test": "automated patch management tools are employed to facilitate flaw remediation to components.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-02(04)", "defaultText": null }, { "id": 74722, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591381", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591381", "securityControlId": 32148, "ccis": [], "uuid": "aed729ba-ac32-5a98-9a78-abde22d333c8", "testId": "VPM-05.4_A03", "test": "security-relevant software and firmware updates to be automatically installed to system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-02(05)_ODP[01]", "defaultText": null }, { "id": 74723, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591381", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591381", "securityControlId": 32148, "ccis": [], "uuid": "1879d6e3-8264-590c-b607-16b10a910e2d", "testId": "VPM-05.4_A04", "test": "system components requiring security-relevant software updates to be automatically installed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-02(05)_ODP[02]", "defaultText": null }, { "id": 74724, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591381", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591381", "securityControlId": 32148, "ccis": [], "uuid": "af581b3b-2d96-5bd0-affe-110d7224ab08", "testId": "VPM-05.4_A05", "test": "security-relevant software and firmware updates are installed automatically to system components.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-02(05)", "defaultText": null } ], "externalMappings": [ { "id": 611912, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f758e70d-8dd6-5af5-9825-78479b27779a", "parentControlId": 32148, "controlId": "SI-2(5)", "title": "SI-2(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591677" }, { "id": 611913, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3f2b4ea1-12c3-51b1-b36e-b9054656b722", "parentControlId": 32148, "controlId": "SI-02(04)", "title": "SI-02(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591677" }, { "id": 611914, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4dd7e27-d610-5130-b440-cc239e2004d6", "parentControlId": 32148, "controlId": "SI-02(05)", "title": "SI-02(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591677" }, { "id": 611916, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591677", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f879d37-ef82-5786-986b-ea57bcefb0bd", "parentControlId": 32148, "controlId": "SI-02(04)", "title": "SI-02(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591677" }, { "id": 611917, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "787f3e1a-0376-50f9-8f4c-d889041b1b66", "parentControlId": 32148, "controlId": "SI-02(05)", "title": "SI-02(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591678" }, { "id": 611918, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591678", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a63f2f31-2b1d-53e7-8c03-78b2d59301b7", "parentControlId": 32148, "controlId": "SI-2(5)", "title": "SI-2(5)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591678" } ], "id": 32148, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731376", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731376", "catalogueId": 1062, "uuid": "d4974f98-893d-5f05-bfef-47dfcd0899aa", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to install the latest stable versions of security-relevant software and firmware updates?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Automated Software & Firmware Updates", "description": "

Control Description

Automated mechanisms exist to install the latest stable versions of security-relevant software and firmware updates.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Vulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ IT and/or cybersecurity personnel apply software patches through an informal process.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically install the latest stable versions of security-relevant software and firmware updates.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-05.4", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-05.4", "references": "

Micro-Small Business (<10 staff)

∙ Azure Update Manager (https://azure.microsoft.com)\n∙ ManageEngine Endpoint Central (https://manageengine.com)

Small Business (10-49 staff)

∙ Azure Update Manager (https://azure.microsoft.com)\n∙ ManageEngine Endpoint Central (https://manageengine.com)

Medium Business (50-249 staff)

∙ Azure Update Manager (https://azure.microsoft.com)\n∙ ManageEngine Endpoint Central (https://manageengine.com)

Large Business (250-999 staff)

∙ Azure Update Manager (https://azure.microsoft.com)\n∙ ManageEngine Endpoint Central (https://manageengine.com)

Enterprise (>1,000 staff)

∙ Azure Update Manager (https://azure.microsoft.com)\n∙ ManageEngine Endpoint Central (https://manageengine.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74725, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591381", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591381", "securityControlId": 32149, "ccis": [], "uuid": "46e3e168-6b00-5a74-95f8-f25f717743d5", "testId": "VPM-05.5_A01", "test": "software and firmware components to be removed after updated versions have been installed are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SI-02(06)_ODP", "defaultText": null }, { "id": 74726, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591381", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591381", "securityControlId": 32149, "ccis": [], "uuid": "35c595c2-42ed-5ed7-9b44-86e895d15a7a", "testId": "VPM-05.5_A02", "test": "previous versions of software and firmware components are removed after updated versions have been installed.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_SI-02(06)", "defaultText": null } ], "externalMappings": [ { "id": 611934, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7a6ff6b-265c-586c-9466-954f8bf20362", "parentControlId": 32149, "controlId": "SI-2(6)", "title": "SI-2(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591679" }, { "id": 611935, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "69afe6f8-e9f2-5bf3-b0c7-7c97f8cdf812", "parentControlId": 32149, "controlId": "SI-02(06)", "title": "SI-02(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591679" }, { "id": 611936, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591679", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ff12b12-a0d3-55b2-9698-b5a697f03366", "parentControlId": 32149, "controlId": "SI-02(06)", "title": "SI-02(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59168" } ], "id": 32149, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731376", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731376", "catalogueId": 1062, "uuid": "18fdc296-0dd5-58b2-b835-d57d229792fa", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization remove old versions of software and firmware components after updated versions have been installed?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Removal of Previous Versions", "description": "

Control Description

Mechanisms exist to remove old versions of software and firmware components after updated versions have been installed.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Vulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to remove old versions of software and firmware components after updated versions have been installed.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "VPM-05.5", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-05.5", "references": "

Micro-Small Business (<10 staff)

∙ Remove old versions of software when updating

Small Business (10-49 staff)

∙ Policy requiring removal of previous software versions after update

Medium Business (50-249 staff)

∙ Formal previous version removal process and verification

Large Business (250-999 staff)

∙ Enterprise software version management\n∙ Automated detection of old versions

Enterprise (>1,000 staff)

∙ Enterprise software lifecycle management platform\n∙ Automated previous version detection and removal", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74727, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591382", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591382", "securityControlId": 32150, "ccis": [], "uuid": "f8721c9a-d2b4-50a4-8535-1e6f30b3c960", "testId": "VPM-05.6_A01", "test": "a process to conduct reasonable testing of software and/or firmware patching in a non-production environment, prior to production release, is defined.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 74728, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591382", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591382", "securityControlId": 32150, "ccis": [], "uuid": "c1c9383b-b221-5538-b10a-5d648aa00126", "testId": "VPM-05.6_A02", "test": "prior to production release, the organization performs reasonable testing of software and/or firmware patching in a non-production environment.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 611939, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c90592a-68f7-57ff-a742-f842d3df1e07", "parentControlId": 32150, "controlId": "COMP 3.2", "title": "COMP 3.2", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59168" }, { "id": 611940, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59168", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6b56f6e7-1dc0-5642-b925-c53ea860c183", "parentControlId": 32150, "controlId": "COMP 3.4", "title": "COMP 3.4", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59168" } ], "id": 32150, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731377", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731377", "catalogueId": 1062, "uuid": "717e6f60-0291-529c-8f68-eb22c3548b96", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization perform due diligence on software and/or firmware update stability by conducting pre-production testing in a non-production environment?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Pre-Deployment Patch Testing", "description": "

Control Description

Mechanisms exist to perform due diligence on software and/or firmware update stability by conducting pre-production testing in a non-production environment.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Vulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to perform due diligence on software and/or firmware update stability by conducting pre-production testing in a non-production environment.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "VPM-05.6", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-05.6", "references": "

Micro-Small Business (<10 staff)

∙ Test patches in non-production environment first

Small Business (10-49 staff)

∙ Pre-deployment patch testing procedure

Medium Business (50-249 staff)

∙ Formal patch testing process\n∙ Staging environment for pre-production patch validation

Large Business (250-999 staff)

∙ Enterprise patch testing program\n∙ Automated testing in staging environment

Enterprise (>1,000 staff)

∙ Enterprise patch management platform (e.g., Microsoft SCCM, Tanium)\n∙ Automated pre-production testing\n∙ Pilot group deployment", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74731, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591383", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591383", "securityControlId": 32152, "ccis": [], "uuid": "dff2866c-3fdd-5b69-a3e1-4e76855c5d12", "testId": "VPM-05.8_A01", "test": "software and/or firmware patches are obtained from trusted sources.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74732, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591383", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591383", "securityControlId": 32152, "ccis": [], "uuid": "d899ff87-8a5f-5a46-bef8-ef5fa4d13de6", "testId": "VPM-05.8_A02", "test": "software and/or firmware patches are checked for integrity.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 611950, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591681", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fcba02f6-993f-5165-afcf-f8052313a740", "parentControlId": 32152, "controlId": "COMP 3.1", "title": "COMP 3.1", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591681" } ], "id": 32152, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731377", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731377", "catalogueId": 1062, "uuid": "13371ce9-f7ab-5d5c-8791-abbe48abe5bc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization ensure software and/or firmware patches are:\n(1) Obtained from trusted sources; and \n(2) Checked for integrity?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Software Patch Integrity", "description": "

Control Description

Mechanisms exist to ensure software and/or firmware patches are:\n(1) Obtained from trusted sources; and \n(2) Checked for integrity.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Vulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to ensure software and/or firmware patches are:\n(1) Obtained from trusted sources; and \n(2) Checked for integrity.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-05.8", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-05.8", "references": "

Micro-Small Business (<10 staff)

∙ Verify patch integrity before installing (check hash/signature)

Small Business (10-49 staff)

∙ Patch integrity verification policy\n∙ Check digital signatures before installation

Medium Business (50-249 staff)

∙ Formal patch integrity verification process\n∙ Cryptographic signature verification

Large Business (250-999 staff)

∙ Enterprise patch integrity verification program\n∙ Automated signature checking

Enterprise (>1,000 staff)

∙ Enterprise patch management with automated integrity verification (e.g., SCCM, Tanium)\n∙ Cryptographic signature enforcement", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74733, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591383", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591383", "securityControlId": 32153, "ccis": [], "uuid": "8fd6c423-6efd-5e0b-8b3c-48122df46c0a", "testId": "VPM-06_A01", "test": "the frequency at which the system is scanned for vulnerabilities is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least monthly", "otherId": "53A_R5_RA-05_ODP[01]\n53A_R5_RA-05_ODP[02]\n171A_3.11.2[a]\n171A_R3_A.03.11.02.ODP[02]", "defaultText": null }, { "id": 74734, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591383", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591383", "securityControlId": 32153, "ccis": [], "uuid": "ce1417de-4bd1-5b31-a406-0b378366696a", "testId": "VPM-06_A02", "test": "response times to remediate legitimate vulnerabilities in accordance with an organizational assessment of risk are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-05_ODP[03]", "defaultText": null }, { "id": 74735, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591383", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591383", "securityControlId": 32153, "ccis": [], "uuid": "20f6e744-f412-5a08-a4da-1ec66681d432", "testId": "VPM-06_A03", "test": "personnel or roles with whom information obtained from the vulnerability scanning process and control assessments are to be shared.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-05_ODP[04]", "defaultText": null }, { "id": 74736, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591384", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591384", "securityControlId": 32153, "ccis": [], "uuid": "399e87ff-0690-593e-a160-67621ac1e9f4", "testId": "VPM-06_A04", "test": "vulnerability scan reports and results from vulnerability monitoring are analyzed.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-05c.", "defaultText": null }, { "id": 74737, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591385", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591385", "securityControlId": 32153, "ccis": [], "uuid": "2bd6f764-bf71-5ece-a913-f6eed2867d4a", "testId": "VPM-06_A05", "test": "systems and hosted applications are scanned for vulnerabilities frequently and/or randomly in accordance with organization-defined process and when new vulnerabilities potentially affecting the system are identified and reported.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: monthly operating system/infrastructure; monthly web applications (including APIs) and databases", "otherId": "53A_R5_RA-05a.[01]\n53A_R5_RA-05a.[02]", "defaultText": null }, { "id": 74738, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591385", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591385", "securityControlId": 32153, "ccis": [], "uuid": "1857795f-4d53-5767-9b8f-1b4b7abbc960", "testId": "VPM-06_A06", "test": "vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_RA-05b.", "defaultText": null }, { "id": 74739, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591385", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591385", "securityControlId": 32153, "ccis": [], "uuid": "0e36d692-fce6-5585-945d-c72897f4e019", "testId": "VPM-06_A07", "test": "vulnerability monitoring tools and techniques are employed to automate parts of the vulnerability management process by using standards for enumerating platforms, software flaws and improper configurations.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_RA-05b.01", "defaultText": null }, { "id": 74740, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591386", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591386", "securityControlId": 32153, "ccis": [], "uuid": "2c6022ee-dad1-55b5-a8ed-d169802f986e", "testId": "VPM-06_A08", "test": "vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for formatting checklists and test procedures.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_RA-05b.02", "defaultText": null }, { "id": 74741, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591386", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591386", "securityControlId": 32153, "ccis": [], "uuid": "dda5fb21-d1f0-5ecc-9f55-5ce284093d53", "testId": "VPM-06_A09", "test": "vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for measuring vulnerability impact.
PPTDF Applicability: Technology
Assessment Rigor: 2", "otherId": "53A_R5_RA-05b.03", "defaultText": null }, { "id": 74742, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591386", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591386", "securityControlId": 32153, "ccis": [], "uuid": "af9d0f14-c34a-5f30-bea1-885720af15c4", "testId": "VPM-06_A10", "test": "the system is scanned for vulnerabilities per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least monthly", "otherId": "171A_3.11.2[b]", "defaultText": null }, { "id": 74743, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591386", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591386", "securityControlId": 32153, "ccis": [], "uuid": "15c108d7-3180-5369-b8e7-2a15ea4daf37", "testId": "VPM-06_A11", "test": "vulnerability scans are performed on applications with the defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least monthly", "otherId": "171A_3.11.2[c]", "defaultText": null }, { "id": 74744, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591386", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591386", "securityControlId": 32153, "ccis": [], "uuid": "e3ab4827-50e1-556b-b9f4-8445c7be1be0", "testId": "VPM-06_A12", "test": "the system is monitored for vulnerabilities when new vulnerabilities that affect the system are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.11.2[d]\n171A_R3_A.03.11.02.a[03]", "defaultText": null }, { "id": 74745, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591387", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591387", "securityControlId": 32153, "ccis": [], "uuid": "719f9f79-f772-5042-9c32-0f0466a310f5", "testId": "VPM-06_A13", "test": "the system is scanned for vulnerabilities when new vulnerabilities that affect the system are identified.
PPTDF Applicability: Process
Assessment Rigor: 2", "otherId": "171A_3.11.2[e]\n171A_R3_A.03.11.02.a[04]", "defaultText": null }, { "id": 74746, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591387", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591387", "securityControlId": 32153, "ccis": [], "uuid": "bdada4c8-46d0-5377-ab91-9502db787522", "testId": "VPM-06_A14", "test": "legitimate vulnerabilities are remediated response times in accordance with an organizational assessment of risk.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: high-risk vulnerabilities mitigated within thirty (30) days from date of discovery; moderate-risk vulnerabilities mitigated within ninety (90) days from date of discovery; low risk vulnerabilities mitigated within one hundred and eighty (180) days from date of discovery", "otherId": "53A_R5_RA-05d.", "defaultText": null }, { "id": 74747, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591387", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591387", "securityControlId": 32153, "ccis": [], "uuid": "65ccb32b-73ff-528e-a1ab-fa12ed23c3e2", "testId": "VPM-06_A15", "test": "information obtained from the vulnerability monitoring process and control assessments is shared with personnel or roles to help eliminate similar vulnerabilities in other systems.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "53A_R5_RA-05e.", "defaultText": null }, { "id": 74748, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591387", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591387", "securityControlId": 32153, "ccis": [], "uuid": "a6cf985a-a17a-5036-a9cd-c2434ef3d494", "testId": "VPM-06_A16", "test": "vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned are employed.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_RA-05f.", "defaultText": null }, { "id": 74749, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591388", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591388", "securityControlId": 32153, "ccis": [], "uuid": "76dfb061-fe4a-5bc5-9ceb-2f794eca6b23", "testId": "VPM-06_A17", "test": "the frequency at which to update system vulnerabilities to be scanned is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least monthly", "otherId": "171A_R3_A.03.11.02.ODP[04]", "defaultText": null }, { "id": 74750, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591388", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591388", "securityControlId": 32153, "ccis": [], "uuid": "d2e5d7a1-315a-59d0-bf63-871e63ca906b", "testId": "VPM-06_A18", "test": "the system is monitored for vulnerabilities per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least monthly", "otherId": "SCF Created", "defaultText": null }, { "id": 74751, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591388", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591388", "securityControlId": 32153, "ccis": [], "uuid": "e871ead3-a072-585f-9678-73bbed05d718", "testId": "VPM-06_A19", "test": "system vulnerabilities to be scanned are updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 3
SCF Defined Parameters: at least monthly", "otherId": "SCF Created", "defaultText": null }, { "id": 74752, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591388", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591388", "securityControlId": 32153, "ccis": [], "uuid": "230c568f-4a20-51e1-95af-3c848ff446a3", "testId": "VPM-06_A20", "test": "system vulnerabilities to be scanned are updated when new vulnerabilities are identified and reported.
PPTDF Applicability: Process
Assessment Rigor: 3", "otherId": "SCF Created", "defaultText": null }, { "id": 74753, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591388", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591388", "securityControlId": 32153, "ccis": [], "uuid": "19d53744-8a68-57e6-b34f-fdeac0f7a36d", "testId": "VPM-06_A21", "test": "the frequency at which the system is monitored for vulnerabilities is defined.
PPTDF Applicability: Process
Assessment Rigor: 2
SCF Defined Parameters: at least monthly", "otherId": "171A_R3_A.03.11.02.ODP[01]", "defaultText": null }, { "id": 74754, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591388", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591388", "securityControlId": 32153, "ccis": [], "uuid": "1c10df65-d13a-52f4-b361-3bf5925499e2", "testId": "VPM-06_A22", "test": "the system is monitored for vulnerabilities .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least monthly, or when there are significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.11.02.a[01]", "defaultText": null }, { "id": 74755, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591388", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591389", "securityControlId": 32153, "ccis": [], "uuid": "a704819c-6cce-587c-9982-cb41616fa299", "testId": "VPM-06_A23", "test": "the system is scanned for vulnerabilities .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: at least monthly, or when there are significant incidents or significant changes to risks", "otherId": "171A_R3_A.03.11.02.a[02]", "defaultText": null }, { "id": 74756, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591389", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591389", "securityControlId": 32153, "ccis": [], "uuid": "18cc48a1-ae25-55f7-b34b-4b2ad6a28d1b", "testId": "VPM-06_A24", "test": "system vulnerabilities to be scanned are updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: no more than 24 hours prior to running the scans", "otherId": "171A_R3_A.03.11.02.c[01]", "defaultText": null } ], "externalMappings": [ { "id": 611973, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6effd825-22ab-52b1-8c03-11e0bc34312a", "parentControlId": 32153, "controlId": "ORG 2.2(c)", "title": "ORG 2.2(c)", "catalog": "IEC 62443-2-1 (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591684" }, { "id": 611975, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2f66d508-67d5-5af6-b116-6baabce378c7", "parentControlId": 32153, "controlId": "8.8", "title": "8.8", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591684" }, { "id": 611977, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "040bad45-d03d-5ae0-9ab4-7975c93b96dc", "parentControlId": 32153, "controlId": "T1011.001", "title": "T1011.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591684" }, { "id": 611978, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591684", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0d7d1d45-ba6c-51cd-bf58-ee74a967c36a", "parentControlId": 32153, "controlId": "T1021.001", "title": "T1021.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591684" }, { "id": 611979, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b3e62ab9-4b1e-520c-b077-1da86a72c5d4", "parentControlId": 32153, "controlId": "T1021.003", "title": "T1021.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591685" }, { "id": 611980, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ed04f1b8-011d-547c-bdf6-03399e8b675e", "parentControlId": 32153, "controlId": "T1021.004", "title": "T1021.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591685" }, { "id": 611981, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "005648f2-f3fc-5923-92f2-cbc01dd104c3", "parentControlId": 32153, "controlId": "T1021.005", "title": "T1021.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591685" }, { "id": 611982, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bce6a5d3-0f2e-55dc-8a9f-9ef3e7bb4a27", "parentControlId": 32153, "controlId": "T1021.006", "title": "T1021.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591685" }, { "id": 611983, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8c3275b-2567-57b5-95e9-1941407c0dbb", "parentControlId": 32153, "controlId": "T1046", "title": "T1046", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591685" }, { "id": 611984, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5ebb7320-e180-5090-a1d4-00aa6d2e9073", "parentControlId": 32153, "controlId": "T1047", "title": "T1047", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591685" }, { "id": 611985, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "23e2f926-c095-52f8-b7a9-2337275fe27f", "parentControlId": 32153, "controlId": "T1052", "title": "T1052", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591685" }, { "id": 611986, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "26cae351-7e68-5011-8547-cbd901e3c366", "parentControlId": 32153, "controlId": "T1052.001", "title": "T1052.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591685" }, { "id": 611987, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591685", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f5dad230-60ea-5976-b7bb-9ddeb44423ad", "parentControlId": 32153, "controlId": "T1053", "title": "T1053", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591685" }, { "id": 611988, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4c04efc1-fccc-508b-8045-183551c58419", "parentControlId": 32153, "controlId": "T1053.002", "title": "T1053.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591686" }, { "id": 611989, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "aa6b1cac-f615-5d37-8180-eb6c54395c1f", "parentControlId": 32153, "controlId": "T1053.003", "title": "T1053.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591686" }, { "id": 611990, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24e8a900-538d-540f-bd60-bc9f6dddaf02", "parentControlId": 32153, "controlId": "T1053.005", "title": "T1053.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591686" }, { "id": 611991, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "80e6d1fe-ea06-5214-9829-e8579b7a6180", "parentControlId": 32153, "controlId": "T1059", "title": "T1059", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591686" }, { "id": 611992, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39172371-96c9-58ef-9814-2aedd283b60f", "parentControlId": 32153, "controlId": "T1059.001", "title": "T1059.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591686" }, { "id": 611993, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9587ba4e-8092-58d5-b390-3c941b393433", "parentControlId": 32153, "controlId": "T1059.005", "title": "T1059.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591686" }, { "id": 611994, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f89ca532-8f8c-55ec-b44f-5b7c6fbbde63", "parentControlId": 32153, "controlId": "T1059.007", "title": "T1059.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591686" }, { "id": 611995, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a1fa28b0-9245-5514-997c-6824c828b0f5", "parentControlId": 32153, "controlId": "T1068", "title": "T1068", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591686" }, { "id": 611996, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591686", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8209049d-42af-5a06-a209-6d37b10a8aab", "parentControlId": 32153, "controlId": "T1078", "title": "T1078", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591686" }, { "id": 611997, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34ebbe04-4f1e-52d6-91b2-6d079e2a09a9", "parentControlId": 32153, "controlId": "T1091", "title": "T1091", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591687" }, { "id": 611998, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d2d1894-7042-5a29-9b24-46ad8e508815", "parentControlId": 32153, "controlId": "T1092", "title": "T1092", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591687" }, { "id": 611999, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18f417b9-b269-5a53-9720-a4d093eed36e", "parentControlId": 32153, "controlId": "T1098.004", "title": "T1098.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591687" }, { "id": 612000, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da27015e-7ade-5a07-9501-8179bc63dc0b", "parentControlId": 32153, "controlId": "T1127", "title": "T1127", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591687" }, { "id": 612001, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "883d8032-9989-5445-a08e-df5cc71d42f8", "parentControlId": 32153, "controlId": "T1127.001", "title": "T1127.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591687" }, { "id": 612002, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "421b75b0-7add-5907-a501-ff1251b74109", "parentControlId": 32153, "controlId": "T1127.002", "title": "T1127.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591687" }, { "id": 612003, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a660b5f-ce32-594e-81e1-5d6318e4b91e", "parentControlId": 32153, "controlId": "T1133", "title": "T1133", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591687" }, { "id": 612004, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cedb787a-ae4f-586a-a77e-0de26b53716f", "parentControlId": 32153, "controlId": "T1137", "title": "T1137", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591687" }, { "id": 612005, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591687", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "df534c22-de4f-5f53-855b-bc415b157587", "parentControlId": 32153, "controlId": "T1137.001", "title": "T1137.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591687" }, { "id": 612006, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7c2d40c0-8701-5559-9ec9-204a45a23128", "parentControlId": 32153, "controlId": "T1176", "title": "T1176", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591688" }, { "id": 612007, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0bc21f2-1837-5eb8-86f6-485fca2a853b", "parentControlId": 32153, "controlId": "T1190", "title": "T1190", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591688" }, { "id": 612008, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0b80e55-6571-5c43-b7b6-d0f6ada534aa", "parentControlId": 32153, "controlId": "T1195", "title": "T1195", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591688" }, { "id": 612009, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c674dc24-c465-54a0-a8ff-827cf704e501", "parentControlId": 32153, "controlId": "T1195.001", "title": "T1195.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591688" }, { "id": 612010, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39084d69-8fe7-5415-8981-a60a0cfdb0d2", "parentControlId": 32153, "controlId": "T1195.002", "title": "T1195.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591688" }, { "id": 612011, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d9c15c80-3705-5951-9c5e-692934baaf39", "parentControlId": 32153, "controlId": "T1204.003", "title": "T1204.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591688" }, { "id": 612012, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591688", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dc7976f0-8211-5a8d-a22c-7e18118467e8", "parentControlId": 32153, "controlId": "T1210", "title": "T1210", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591689" }, { "id": 612013, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "400db54e-a4bb-553d-a6fe-246b12fde9e8", "parentControlId": 32153, "controlId": "T1211", "title": "T1211", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591689" }, { "id": 612014, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ccaa67f5-6024-5330-a5c6-286b43124dae", "parentControlId": 32153, "controlId": "T1212", "title": "T1212", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591689" }, { "id": 612015, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9216b9be-e67b-568d-97c1-a46af62a9108", "parentControlId": 32153, "controlId": "T1213", "title": "T1213", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591689" }, { "id": 612016, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5f72ec7c-10b4-5219-9a79-3b9a749f7da2", "parentControlId": 32153, "controlId": "T1213.001", "title": "T1213.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591689" }, { "id": 612017, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "74ddd81f-bf3c-5909-8373-3e4e0bae15a6", "parentControlId": 32153, "controlId": "T1213.002", "title": "T1213.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591689" }, { "id": 612018, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94491871-aa99-5180-86eb-1c9be64bab1a", "parentControlId": 32153, "controlId": "T1213.003", "title": "T1213.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591689" }, { "id": 612019, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591689", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2ee65ddb-0358-57df-85cb-151851f49f52", "parentControlId": 32153, "controlId": "T1213.005", "title": "T1213.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591689" }, { "id": 612020, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f47b99c0-fa19-5a8a-b2d7-6d214b652559", "parentControlId": 32153, "controlId": "T1218", "title": "T1218", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59169" }, { "id": 612021, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ea2e74bb-1de2-5fcc-afb5-7b8de2bb4cdf", "parentControlId": 32153, "controlId": "T1218.003", "title": "T1218.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59169" }, { "id": 612022, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2a4b0bf2-543e-5992-836b-3d468f80d9e2", "parentControlId": 32153, "controlId": "T1218.004", "title": "T1218.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59169" }, { "id": 612023, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f84dfc3e-f8a7-5856-afa6-06cbfa4fac25", "parentControlId": 32153, "controlId": "T1218.005", "title": "T1218.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59169" }, { "id": 612024, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5aeba57c-d435-50f1-8c71-3d494cd3fa63", "parentControlId": 32153, "controlId": "T1218.008", "title": "T1218.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59169" }, { "id": 612025, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94115680-983e-5853-be1f-ebeb7a4899e8", "parentControlId": 32153, "controlId": "T1218.009", "title": "T1218.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59169" }, { "id": 612026, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "53123669-7b39-5f16-b545-cb9c1faea60a", "parentControlId": 32153, "controlId": "T1218.012", "title": "T1218.012", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59169" }, { "id": 612027, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4f7dd9f3-56db-564f-8565-d46fd54c64b5", "parentControlId": 32153, "controlId": "T1218.013", "title": "T1218.013", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59169" }, { "id": 612028, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "72c8c5b5-c37b-5014-a5a9-e50198a6e636", "parentControlId": 32153, "controlId": "T1218.014", "title": "T1218.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59169" }, { "id": 612029, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59169", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eba3ae6a-19a0-5703-81a8-97925bb7acb3", "parentControlId": 32153, "controlId": "T1218.015", "title": "T1218.015", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591691" }, { "id": 612030, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1b8bb68a-586f-59d0-b8ae-05749c9d0d8e", "parentControlId": 32153, "controlId": "T1221", "title": "T1221", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591691" }, { "id": 612031, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a94a5229-7a39-5ae5-86a1-3e451759fb09", "parentControlId": 32153, "controlId": "T1482", "title": "T1482", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591691" }, { "id": 612032, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e8e3669-29ad-5b20-a65c-d90e24ec4852", "parentControlId": 32153, "controlId": "T1484", "title": "T1484", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591691" }, { "id": 612033, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0202e5d-a21d-56a7-b5ce-0e8369144702", "parentControlId": 32153, "controlId": "T1505", "title": "T1505", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591691" }, { "id": 612034, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d06283c-c57f-5d6a-936e-6a7b90093249", "parentControlId": 32153, "controlId": "T1505.001", "title": "T1505.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591691" }, { "id": 612035, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c9cf128e-12fe-5887-95bc-87b75dde9e6e", "parentControlId": 32153, "controlId": "T1505.002", "title": "T1505.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591691" }, { "id": 612036, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0cb4c02f-8010-5fd9-a960-7cd33181f909", "parentControlId": 32153, "controlId": "T1505.003", "title": "T1505.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591691" }, { "id": 612037, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0974e4a9-eb34-5985-bd61-dc1c0bed65fc", "parentControlId": 32153, "controlId": "T1505.004", "title": "T1505.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591691" }, { "id": 612038, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591691", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd150000-6eba-5f63-bb33-8a250a22da79", "parentControlId": 32153, "controlId": "T1505.005", "title": "T1505.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591691" }, { "id": 612039, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ffc24bb-63d9-5b24-b38c-b753aa4c5f74", "parentControlId": 32153, "controlId": "T1525", "title": "T1525", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591692" }, { "id": 612040, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591692", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "58947f5f-d9b8-5a10-a678-8692423e30c2", "parentControlId": 32153, "controlId": "T1528", "title": "T1528", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591692" }, { "id": 612041, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "33c7eadb-4f79-5672-bd95-0b5034bf3c0c", "parentControlId": 32153, "controlId": "T1530", "title": "T1530", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5917" }, { "id": 612042, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.5917", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f06d1a09-908a-52cc-91da-3ffb2ddffa5b", "parentControlId": 32153, "controlId": "T1542.004", "title": "T1542.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.5917" }, { "id": 612043, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591701", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a5467df8-2ad1-5ba1-becb-86fbf51fb928", "parentControlId": 32153, "controlId": "T1542.005", "title": "T1542.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591701" }, { "id": 612044, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591701", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9f590492-af43-57f7-9506-34c5972a919d", "parentControlId": 32153, "controlId": "T1543", "title": "T1543", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591701" }, { "id": 612045, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591701", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d6d388f-e604-5678-809e-0efa38e2bf14", "parentControlId": 32153, "controlId": "T1546.002", "title": "T1546.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591701" }, { "id": 612046, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591701", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08dfec5c-3137-5e44-85be-801baf236c52", "parentControlId": 32153, "controlId": "T1546.014", "title": "T1546.014", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591701" }, { "id": 612047, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591701", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e579dd85-088a-5ede-a659-614aad77f479", "parentControlId": 32153, "controlId": "T1547.006", "title": "T1547.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591701" }, { "id": 612048, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591701", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8e72bddd-70bc-593e-9ded-d3cd4dbbefc6", "parentControlId": 32153, "controlId": "T1547.007", "title": "T1547.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591701" }, { "id": 612049, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591701", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "92a0d2a7-a9de-55a8-b29f-3d52262802c6", "parentControlId": 32153, "controlId": "T1547.008", "title": "T1547.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591701" }, { "id": 612050, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591702", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1d75f1e4-05ac-5207-9be1-e43df79a0a88", "parentControlId": 32153, "controlId": "T1548", "title": "T1548", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591702" }, { "id": 612051, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591702", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c6cb8293-19c1-5234-a63f-f85866041a1f", "parentControlId": 32153, "controlId": "T1548.002", "title": "T1548.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591702" }, { "id": 612052, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591702", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ff3d483c-d781-5230-b1f0-c066440870d8", "parentControlId": 32153, "controlId": "T1548.003", "title": "T1548.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591702" }, { "id": 612053, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591702", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "403a4e23-31c0-5b55-8b6d-2ea3d15da115", "parentControlId": 32153, "controlId": "T1548.006", "title": "T1548.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591702" }, { "id": 612054, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591702", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8577b046-288a-5c62-a7ad-f5ee25913c17", "parentControlId": 32153, "controlId": "T1552", "title": "T1552", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591702" }, { "id": 612055, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591702", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e8bd1235-30d2-57db-b141-c4a410c2f8d0", "parentControlId": 32153, "controlId": "T1552.001", "title": "T1552.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591702" }, { "id": 612056, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591702", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3346a27a-b11a-54db-865b-b8505c3f4f10", "parentControlId": 32153, "controlId": "T1552.002", "title": "T1552.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591702" }, { "id": 612057, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591702", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "485b3011-da5d-56cc-8cde-b78f09741bbb", "parentControlId": 32153, "controlId": "T1552.004", "title": "T1552.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591702" }, { "id": 612058, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591702", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0aaaba92-7f7c-5f9f-b99d-4ce290ed33a3", "parentControlId": 32153, "controlId": "T1552.006", "title": "T1552.006", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591702" }, { "id": 612059, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c3564f9-457f-5150-81cb-830edfe64c79", "parentControlId": 32153, "controlId": "T1557", "title": "T1557", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591703" }, { "id": 612060, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9e4a07c7-e26b-57dd-92c1-1ac8e1166453", "parentControlId": 32153, "controlId": "T1558.004", "title": "T1558.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591703" }, { "id": 612061, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "24513090-da71-593f-a818-0920e21dc51d", "parentControlId": 32153, "controlId": "T1559", "title": "T1559", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591703" }, { "id": 612062, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "030c5ae5-c900-5a32-b3ac-38c3027296d4", "parentControlId": 32153, "controlId": "T1559.002", "title": "T1559.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591703" }, { "id": 612063, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7cc79bf6-9fbe-5aa1-b7f3-7a2040bde35b", "parentControlId": 32153, "controlId": "T1560", "title": "T1560", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591703" }, { "id": 612064, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "27527156-6834-51ba-88d0-c5d42a9ceecb", "parentControlId": 32153, "controlId": "T1560.001", "title": "T1560.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591703" }, { "id": 612065, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "946eb75b-7125-5427-b45b-67cc268f567a", "parentControlId": 32153, "controlId": "T1562", "title": "T1562", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591703" }, { "id": 612066, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591703", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1fa922c6-06f0-55dd-b7dc-fb5552da7b84", "parentControlId": 32153, "controlId": "T1562.010", "title": "T1562.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591703" }, { "id": 612067, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2c840b48-54f9-5bff-9d47-702824aa01e3", "parentControlId": 32153, "controlId": "T1563", "title": "T1563", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591704" }, { "id": 612068, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "08d11304-c880-5e50-ad66-4d1af741d452", "parentControlId": 32153, "controlId": "T1563.001", "title": "T1563.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591704" }, { "id": 612069, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6e8052b7-212c-5083-a10e-bd30275e1bb7", "parentControlId": 32153, "controlId": "T1563.002", "title": "T1563.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591704" }, { "id": 612070, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8d9b30e0-0a13-5fb6-9844-d34aac5b54c2", "parentControlId": 32153, "controlId": "T1566", "title": "T1566", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591704" }, { "id": 612071, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ef5d4d0-4dad-5f76-9d12-e6669b3b753d", "parentControlId": 32153, "controlId": "T1574", "title": "T1574", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591704" }, { "id": 612072, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0b796c2b-ba42-5fb9-a51e-0ea9fa63f20f", "parentControlId": 32153, "controlId": "T1574.001", "title": "T1574.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591704" }, { "id": 612073, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8cc2d0c0-308c-55ac-8125-92020957c866", "parentControlId": 32153, "controlId": "T1574.004", "title": "T1574.004", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591704" }, { "id": 612074, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5c7ce22e-38f7-56e8-af1a-4fcdac97f199", "parentControlId": 32153, "controlId": "T1574.005", "title": "T1574.005", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591704" }, { "id": 612075, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591704", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "152f4d3d-1cdb-539f-bd0a-900081b7363a", "parentControlId": 32153, "controlId": "T1574.007", "title": "T1574.007", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591704" }, { "id": 612076, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591705", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fa0ae5ee-4223-5be7-bb92-4ca2126b1923", "parentControlId": 32153, "controlId": "T1574.008", "title": "T1574.008", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591705" }, { "id": 612077, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591705", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "39322dac-0be8-5493-979e-192684ca8bdd", "parentControlId": 32153, "controlId": "T1574.009", "title": "T1574.009", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591705" }, { "id": 612078, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591705", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1f704fde-d6a3-5359-82b5-3dd5acc17ba5", "parentControlId": 32153, "controlId": "T1574.010", "title": "T1574.010", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591705" }, { "id": 612079, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591705", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f4bd7f11-e6d0-59e6-9210-2699b94cd684", "parentControlId": 32153, "controlId": "T1578", "title": "T1578", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591705" }, { "id": 612080, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591705", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ca54660f-258c-55a8-9541-99b8829ab7be", "parentControlId": 32153, "controlId": "T1578.001", "title": "T1578.001", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591705" }, { "id": 612081, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591705", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bc0ce9f7-2d4c-5faa-ac9b-db25319bd178", "parentControlId": 32153, "controlId": "T1578.002", "title": "T1578.002", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591705" }, { "id": 612082, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591705", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c8fa6fd5-c494-5c91-98af-2821c3e93a9d", "parentControlId": 32153, "controlId": "T1578.003", "title": "T1578.003", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591705" }, { "id": 612083, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591705", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "34dc588b-01a6-5fb1-991a-aa65e59093bb", "parentControlId": 32153, "controlId": "T1612", "title": "T1612", "catalog": "MITRE ATT&CK (v16.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591705" }, { "id": 612086, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591706", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cd2cc35f-f115-5152-8688-d4f99b55837f", "parentControlId": 32153, "controlId": "RA-5", "title": "RA-5", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591706" }, { "id": 612087, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591706", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5e53605a-8d77-5177-9f82-04e346dd6bf1", "parentControlId": 32153, "controlId": "RA-05", "title": "RA-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591706" }, { "id": 612089, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591706", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "29cc8922-0fce-5eb0-bf7c-6e1dab9def84", "parentControlId": 32153, "controlId": "RA-05", "title": "RA-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591706" }, { "id": 612090, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591706", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c3a44456-7793-50bc-8625-64ff5e031e33", "parentControlId": 32153, "controlId": "RA-05", "title": "RA-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591706" }, { "id": 612091, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591706", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "760352f4-3bc0-54c4-98d5-45877c84fd0f", "parentControlId": 32153, "controlId": "RA-05", "title": "RA-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591706" }, { "id": 612092, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b6bf176e-a5ae-52e7-a979-6696ae3bf1b8", "parentControlId": 32153, "controlId": "RA-05", "title": "RA-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591707" }, { "id": 612093, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ec94490e-9cea-5978-96c5-48ccf90009e3", "parentControlId": 32153, "controlId": "RA-05", "title": "RA-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591707" }, { "id": 612094, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7eb1a42-d502-5138-ace3-e800fb793f03", "parentControlId": 32153, "controlId": "RA-5", "title": "RA-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591707" }, { "id": 612095, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6112270e-c3c5-54c8-947a-83a429347423", "parentControlId": 32153, "controlId": "RA-5", "title": "RA-5", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591707" }, { "id": 612096, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7237f288-d384-54c7-b2d3-d6b8585d23cc", "parentControlId": 32153, "controlId": "RA-5", "title": "RA-5", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591707" }, { "id": 612099, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e93c18d1-9037-5e70-82d9-614a9041016d", "parentControlId": 32153, "controlId": "3.11.2", "title": "3.11.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591707" }, { "id": 612100, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591707", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9449d3fe-e310-5eab-b7d5-69c0f731bf7a", "parentControlId": 32153, "controlId": "03.11.02.a", "title": "03.11.02.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591707" }, { "id": 612115, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591709", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03e6b92d-93bc-5a46-9e22-5721ea13d170", "parentControlId": 32153, "controlId": "ID.RA-01", "title": "ID.RA-01", "catalog": "NIST Cybersecurity Framework (v2.0)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591709" }, { "id": 612154, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591714", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3a43dc18-81ff-5a19-9021-f6e1e8d588ac", "parentControlId": 32153, "controlId": "THREAT-1c", "title": "THREAT-1c", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591714" }, { "id": 612155, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591714", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e9caa68f-f233-5b32-8569-126a4624a7a2", "parentControlId": 32153, "controlId": "THREAT-1f", "title": "THREAT-1f", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591714" }, { "id": 612156, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591714", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d998118-ac7c-5be8-89af-cd515bcda1b3", "parentControlId": 32153, "controlId": "THREAT-1k", "title": "THREAT-1k", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591714" }, { "id": 612177, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "12b41315-c21f-58a5-b942-cba5b3376751", "parentControlId": 32153, "controlId": "CIP-010-4 3.1", "title": "CIP-010-4 3.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591716" }, { "id": 612178, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591716", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a2b18a6a-056d-5e7b-b49f-38516fbd79db", "parentControlId": 32153, "controlId": "CIP-010-4 3.2.1", "title": "CIP-010-4 3.2.1", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591716" }, { "id": 612179, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591717", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c83a8f4b-7ac9-5e44-8b74-f63071c6d4dc", "parentControlId": 32153, "controlId": "CIP-010-4 3.2.2", "title": "CIP-010-4 3.2.2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591717" }, { "id": 612180, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591717", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d2fe6ee1-5ceb-5ef6-9dad-1b264578eff2", "parentControlId": 32153, "controlId": "CIP-010-4 3.3", "title": "CIP-010-4 3.3", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591717" }, { "id": 612181, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591717", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c0d578b1-0b06-52b8-8838-40beb81f7331", "parentControlId": 32153, "controlId": "CIP-010-4 3.4", "title": "CIP-010-4 3.4", "catalog": "NERC Critical Infrastructure Protection (CIP) (2024)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591717" }, { "controlId": "CIP-007-6-R2", "title": "CIP-007-6-R2 — Security Patch Management", "mappingType": "Equivalent", "notes": "NERC CIP 2026 Portfolio (CIP-002-5.1a through CIP-015-1 incl. CIP-003-9 & CIP-012-2)", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "0bc0deb1-638f-58b7-ba68-b1f39a9db181", "isPublic": true }, { "controlId": "CIP-007-6-2.1", "title": "CIP-007-6-2.1 — A patch management process for tracking, evaluating, and installing cyber security patches for applicable Cyber Assets", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "ca2901c2-c236-5b5b-a8a4-0ff47ac6d0a0", "isPublic": true }, { "controlId": "CIP-007-6-2.2", "title": "CIP-007-6-2.2 — At least once every 35 calendar days, evaluate security patches for applicability that have been released since the l...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "13e13695-8509-5d42-8da0-5316e39e419d", "isPublic": true }, { "controlId": "CIP-007-6-2.3", "title": "CIP-007-6-2.3 — For applicable patches identified in Part 2.2, within 35 calendar days of the evaluation completion, take one of the...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "39c86c2c-93b8-5aa7-bf87-efba1bc09319", "isPublic": true }, { "controlId": "CIP-007-6-2.4", "title": "CIP-007-6-2.4 — For each mitigation plan created or revised in Part 2.3, implement the plan within the timeframe specified in the pla...", "mappingType": "Equivalent", "notes": "Sub-requirement of CIP-007-6-R2", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "2b5075d8-0f69-5983-b8e3-dc0174fb7594", "isPublic": true }, { "controlId": "NSS-17T-Sec6.6", "title": "NSS-17T-Sec6.6 — Vulnerability Management & Compensating Measures for Legacy I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "235a7380-c399-59b0-a271-656d0a77f783", "isPublic": true }, { "controlId": "IEC-62645-8.2", "title": "IEC-62645-8.2 — Patch and Vulnerability Management During Plant Outages/Maintenance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "8f032bb1-635b-5985-8b48-e05ecf0fafc4", "isPublic": true }, { "controlId": "IEC-63096-12.6", "title": "IEC-63096-12.6 — Technical Vulnerability Management for CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "2d54e3fb-82a4-53ba-a306-c429f4594abe", "isPublic": true } ], "id": 32153, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731378", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731378", "catalogueId": 1062, "uuid": "b78500a0-0c47-5bab-87a1-2eb6b572862d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Vulnerability Scanning", "description": "

Control Description

Mechanisms exist to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.

Evidence Request List (ERL)

E-VPM-05\nE-VPM-11

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Vulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.\n▪ Occasional vulnerability scanning is conducted on High Value Assets (HVAs).\n▪ Vulnerability scanning services may not be internal competencies and have to be outsourced.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel configure technologies to update vulnerability scanning tools.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to detect vulnerabilities and configuration errors by routine vulnerability scanning of systems and applications.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.

Nuclear Regulatory Applicability

NERC-CIP (2026) Requirements: CIP-007-6-R2", "controlId": "VPM-06", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-06", "references": "

Micro-Small Business (<10 staff)

∙ External vulnerability scans (unauthenticated)\n∙ Internal vulnerability scans (authenticated)\n∙ Nessus (https://tenable.com)\n∙ Qualys (https://qualys.com)\n∙ Rapid7 (https://rapid7.com)

Small Business (10-49 staff)

∙ External vulnerability scans (unauthenticated)\n∙ Internal vulnerability scans (authenticated)\n∙ Nessus (https://tenable.com)\n∙ Qualys (https://qualys.com)\n∙ Rapid7 (https://rapid7.com)

Medium Business (50-249 staff)

∙ External vulnerability scans (unauthenticated)\n∙ Internal vulnerability scans (authenticated)\n∙ Nessus (https://tenable.com)\n∙ Qualys (https://qualys.com)\n∙ Rapid7 (https://rapid7.com)

Large Business (250-999 staff)

∙ External vulnerability scans (unauthenticated)\n∙ Internal vulnerability scans (authenticated)\n∙ Nessus (https://tenable.com)\n∙ Qualys (https://qualys.com)\n∙ Rapid7 (https://rapid7.com)

Enterprise (>1,000 staff)

∙ External vulnerability scans (unauthenticated)\n∙ Internal vulnerability scans (authenticated)\n∙ Nessus (https://tenable.com)\n∙ Qualys (https://qualys.com)\n∙ Rapid7 (https://rapid7.com)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74757, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591389", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591389", "securityControlId": 32154, "ccis": [], "uuid": "d1b50bc4-beff-5914-8841-75351fb3356c", "testId": "VPM-06.1_A01", "test": "the frequency at which to update system vulnerabilities to be scanned is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: within 24 hours prior to\nrunning scans", "otherId": "53A_R5_RA-05(02)_ODP[01]\n53A_R5_RA-05(02)_ODP[02]\n171A_R3_A.03.11.02.ODP[04]", "defaultText": null }, { "id": 74758, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591389", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591389", "securityControlId": 32154, "ccis": [], "uuid": "c8fd0ca8-f768-5b70-8299-bebc137a5db6", "testId": "VPM-06.1_A02", "test": "system vulnerabilities to be scanned are updated per an organization-defined frequency.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: within 24 hours prior to\nrunning scans", "otherId": "53A_R5_RA-05(02)", "defaultText": null }, { "id": 74759, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59139", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59139", "securityControlId": 32154, "ccis": [], "uuid": "d364d24a-97af-524a-81b5-dcb3d49f9434", "testId": "VPM-06.1_A03", "test": "system vulnerabilities to be scanned are updated when new vulnerabilities are identified and reported.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "171A_R3_A.03.11.02.c[02]", "defaultText": null }, { "id": 74760, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59139", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59139", "securityControlId": 32154, "ccis": [], "uuid": "bfac0dec-0d49-5bf4-9e05-21472a72e56b", "testId": "VPM-06.1_A04", "test": "system vulnerabilities to be scanned are updated .
PPTDF Applicability: Process
Assessment Rigor: NIST 800-171
SCF Defined Parameters: no more than 24 hours prior to running the scans", "otherId": "171A_R3_A.03.11.02.c[01]", "defaultText": null } ], "externalMappings": [ { "id": 612253, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fcfcc3b9-84b8-53da-894e-4df787a4506d", "parentControlId": 32154, "controlId": "RA-5(1)", "title": "RA-5(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591726" }, { "id": 612254, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6d7e13ee-2e51-539e-8886-87ed2251108e", "parentControlId": 32154, "controlId": "RA-5(2)", "title": "RA-5(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591726" }, { "id": 612255, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "986e1a64-87e8-5e51-a510-109da7f581aa", "parentControlId": 32154, "controlId": "RA-05", "title": "RA-05", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591726" }, { "id": 612256, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "066cddf3-d7bb-5ef6-b671-3711102db4c8", "parentControlId": 32154, "controlId": "RA-05(02)", "title": "RA-05(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591726" }, { "id": 612258, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591726", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7ed7894e-ed89-5809-b6f1-5ac7039792f4", "parentControlId": 32154, "controlId": "RA-05", "title": "RA-05", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591726" }, { "id": 612259, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ede096b4-1531-5276-ad6a-2f7b2b79311f", "parentControlId": 32154, "controlId": "RA-05(02)", "title": "RA-05(02)", "catalog": "NIST SP 800-53 R5 - Low Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591727" }, { "id": 612260, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "225a2000-7e47-5fab-89c3-03cdfbbf169a", "parentControlId": 32154, "controlId": "RA-05", "title": "RA-05", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591727" }, { "id": 612261, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e25ec77-4eff-526d-8c05-d812f71a588a", "parentControlId": 32154, "controlId": "RA-05(02)", "title": "RA-05(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591727" }, { "id": 612262, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f7e8dc8b-31f5-5ca6-8737-02c907e4030d", "parentControlId": 32154, "controlId": "RA-05", "title": "RA-05", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591727" }, { "id": 612263, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "89c11e2a-3c6e-57a8-b61d-e230ca2c2c09", "parentControlId": 32154, "controlId": "RA-05(02)", "title": "RA-05(02)", "catalog": "NIST SP 800-82 R3 - Low OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591727" }, { "id": 612264, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "665be2f4-819a-5ae9-b69e-dd5d08f68d73", "parentControlId": 32154, "controlId": "RA-05", "title": "RA-05", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591727" }, { "id": 612265, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591727", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5157b0c3-a0dc-5646-ae2a-0f20d770f7ef", "parentControlId": 32154, "controlId": "RA-05(02)", "title": "RA-05(02)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591727" }, { "id": 612266, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591728", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "202e4fe8-f0b1-57aa-ad34-5dcdf38f1bcc", "parentControlId": 32154, "controlId": "RA-05", "title": "RA-05", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591728" }, { "id": 612267, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591728", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "98271873-ce3f-508e-aa05-69f04a0348e1", "parentControlId": 32154, "controlId": "RA-05(02)", "title": "RA-05(02)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591728" }, { "id": 612268, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591728", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "c87b8cb4-e08e-58f6-9da6-9b0d3b964754", "parentControlId": 32154, "controlId": "RA-5", "title": "RA-5", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591728" }, { "id": 612269, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591728", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0c2d7dc3-8420-5fce-a441-6297df3f10a5", "parentControlId": 32154, "controlId": "RA-5", "title": "RA-5", "catalog": "NIST SP 800-161 R1 UDP1 - C-SCRM Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591728" }, { "id": 612270, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591728", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "18ce5c9c-507f-574a-b3ed-e6c13e5e30f8", "parentControlId": 32154, "controlId": "RA-5", "title": "RA-5", "catalog": "NIST SP 800-161 R1 UDP1 - Flow Down Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591728" }, { "id": 612273, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591728", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4392c7bc-2531-5cc6-a490-e96f3136c8c1", "parentControlId": 32154, "controlId": "NFO - RA-5(1)", "title": "NFO - RA-5(1)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591728" }, { "id": 612274, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591728", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dd5e9f02-f08e-5c43-bd5a-3e545d800b10", "parentControlId": 32154, "controlId": "NFO - RA-5(2)", "title": "NFO - RA-5(2)", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591728" }, { "id": 612275, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591728", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "5d48c53c-75b3-5473-9588-50fec130d7cd", "parentControlId": 32154, "controlId": "03.11.02.c", "title": "03.11.02.c", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591729" }, { "id": 612286, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59173", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b8ccccf3-fa22-59da-8e6e-e2f11705772e", "parentControlId": 32154, "controlId": "THREAT-1a", "title": "THREAT-1a", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59173" }, { "id": 612287, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59173", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b0bc18a8-85eb-5d21-b5e3-bc61218c6a03", "parentControlId": 32154, "controlId": "THREAT-1e", "title": "THREAT-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59173" } ], "id": 32154, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731378", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731378", "catalogueId": 1062, "uuid": "7509646f-36c4-567b-97e7-840f6f534083", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization update vulnerability scanning tools?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Update Tool Capability", "description": "

Control Description

Mechanisms exist to update vulnerability scanning tools.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Vulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel configure technologies to update vulnerability scanning tools.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to update vulnerability scanning tools.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-06.1", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-06.1", "references": "

Micro-Small Business (<10 staff)

∙ Keep vulnerability scanning tools updated

Small Business (10-49 staff)

∙ Vulnerability scanner update policy\n∙ Ensure scanner plugins are current

Medium Business (50-249 staff)

∙ Formal vulnerability scanner maintenance program\n∙ Regular plugin/feed updates

Large Business (250-999 staff)

∙ Enterprise vulnerability scanner management\n∙ Automated scanner updates and tuning

Enterprise (>1,000 staff)

∙ Enterprise vulnerability management platform with automated scanner updates (e.g., Tenable, Qualys)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74761, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59139", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59139", "securityControlId": 32155, "ccis": [], "uuid": "7bcb84cd-45a8-524f-9005-c9079eebdbd7", "testId": "VPM-06.2_A01", "test": "the breadth and depth of vulnerability scanning coverage are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-05(03)", "defaultText": null } ], "externalMappings": [ { "id": 612321, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0a7f299f-3b9b-5ea6-a64f-0dc67d416315", "parentControlId": 32155, "controlId": "RA-5(3)", "title": "RA-5(3)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591734" }, { "id": 612322, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0e557f1b-986a-5cef-93e9-2d706d91eac0", "parentControlId": 32155, "controlId": "RA-05(03)", "title": "RA-05(03)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591734" }, { "id": 612323, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d856d824-f818-55f0-a7b4-f90c5100eca4", "parentControlId": 32155, "controlId": "RA-05(03)", "title": "RA-05(03)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591734" }, { "id": 612324, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591734", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "9db2f5e9-f3c0-5766-b50e-393458c3ab71", "parentControlId": 32155, "controlId": "RA-5(3)", "title": "RA-5(3)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591734" }, { "id": 612338, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591736", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "6a63dbda-2b9c-5a55-9ce1-d10379ad4d21", "parentControlId": 32155, "controlId": "THREAT-1e", "title": "THREAT-1e", "catalog": "Cybersecurity Capability Maturity Model (C2M2) (v2.1)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591736" } ], "id": 32155, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731378", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731378", "catalogueId": 1062, "uuid": "76bbc11e-2c5d-5dea-92a9-a22ca3af3b9f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization identify the breadth and depth of coverage for vulnerability scanning that define the system components scanned and types of vulnerabilities that are checked for?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Breadth / Depth of Coverage", "description": "

Control Description

Mechanisms exist to identify the breadth and depth of coverage for vulnerability scanning that define the system components scanned and types of vulnerabilities that are checked for.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Vulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel define the breadth and depth of coverage for vulnerability scanning that covers system components scanned and types of vulnerabilities that are checked for.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to identify the breadth and depth of coverage for vulnerability scanning that define the system components scanned and types of vulnerabilities that are checked for.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-06.2", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-06.2", "references": "

Micro-Small Business (<10 staff)

∙ Scan all systems in scope for vulnerabilities

Small Business (10-49 staff)

∙ Comprehensive vulnerability scan coverage policy

Medium Business (50-249 staff)

∙ Formal scan coverage policy\n∙ All in-scope assets scanned regularly

Large Business (250-999 staff)

∙ Enterprise vulnerability scan coverage management\n∙ Asset-driven scan scope

Enterprise (>1,000 staff)

∙ Enterprise vulnerability management with comprehensive asset discovery and scanning (e.g., Tenable One)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74762, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591399", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591399", "securityControlId": 32156, "ccis": [], "uuid": "4bf90c1b-4ebc-5e7b-af57-2c5a80553463", "testId": "VPM-06.3_A01", "test": "system components to which privileged access is authorized for selected vulnerability scanning activities are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: all components that support authentication", "otherId": "53A_R5_RA-05(05)_ODP[01]", "defaultText": null }, { "id": 74763, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591399", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591399", "securityControlId": 32156, "ccis": [], "uuid": "149ed94e-bb02-5508-bbc9-93b7a1228af1", "testId": "VPM-06.3_A02", "test": "vulnerability scanning activities selected for privileged access authorization to system components are defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: all scans", "otherId": "53A_R5_RA-05(05)_ODP[02]", "defaultText": null }, { "id": 74764, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591399", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591399", "securityControlId": 32156, "ccis": [], "uuid": "f922b151-d0bf-5960-b56f-e755d54c3ee4", "testId": "VPM-06.3_A03", "test": "privileged access authorization is implemented to system components for vulnerability scanning activities.
PPTDF Applicability: Technology
Assessment Rigor: 1
SCF Defined Parameters: all components that support authentication", "otherId": "53A_R5_RA-05(05)", "defaultText": null } ], "externalMappings": [ { "id": 612351, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2bc0c895-7a76-518b-a0e9-e50bd02f0792", "parentControlId": 32156, "controlId": "RA-5(5)", "title": "RA-5(5)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591737" }, { "id": 612352, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1ed4fc14-3f3d-5e66-a421-04b0e91e4167", "parentControlId": 32156, "controlId": "RA-05(05)", "title": "RA-05(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591737" }, { "id": 612353, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "555b48fb-984c-5969-a805-c523517c8e65", "parentControlId": 32156, "controlId": "RA-05(05)", "title": "RA-05(05)", "catalog": "NIST SP 800-53 R5 - Moderate Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591737" }, { "id": 612354, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591737", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8b9d59dc-60de-5de6-b88e-39e1ba15124a", "parentControlId": 32156, "controlId": "RA-05(05)", "title": "RA-05(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591737" }, { "id": 612355, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591738", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ae7642f9-1a0e-51e0-9da2-b0aa7818322a", "parentControlId": 32156, "controlId": "RA-05(05)", "title": "RA-05(05)", "catalog": "NIST SP 800-82 R3 - Moderate OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591738" }, { "id": 612356, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591738", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "94b3b729-6a01-523f-9093-d08e89d085ec", "parentControlId": 32156, "controlId": "RA-05(05)", "title": "RA-05(05)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591738" }, { "id": 612358, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591738", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "10cc81a0-6b4d-5d20-b382-d295c672bbdd", "parentControlId": 32156, "controlId": "3.11.2", "title": "3.11.2", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591738" } ], "id": 32156, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731379", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731379", "catalogueId": 1062, "uuid": "4832421b-89ac-51b6-85cd-21057f896b98", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization implement privileged access authorization for selected vulnerability scanning activities?

Assessment Frequency

Semi-Annual", "practiceLevel": "", "weight": 9.0, "title": "Privileged Access", "description": "

Control Description

Mechanisms exist to implement privileged access authorization for selected vulnerability scanning activities.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nVulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to implement privileged access authorization for selected vulnerability scanning activities.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-06.3", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-06.3", "references": "

Micro-Small Business (<10 staff)

∙ Use privileged credentials for more thorough vulnerability scans

Small Business (10-49 staff)

∙ Credentialed scanning policy for comprehensive vulnerability detection

Medium Business (50-249 staff)

∙ Formal credentialed scanning program\n∙ Secure credential management for scanners

Large Business (250-999 staff)

∙ Enterprise credentialed scanning with PAM integration

Enterprise (>1,000 staff)

∙ Enterprise vulnerability management with PAM-integrated credentialed scanning (e.g., Tenable + CyberArk)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74765, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5914", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5914", "securityControlId": 32157, "ccis": [], "uuid": "2d4ea250-eb90-5ada-97f4-1521d9a1ed7d", "testId": "VPM-06.4_A01", "test": "automated mechanisms to compare the results of multiple vulnerability scans are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-05(06)_ODP", "defaultText": null }, { "id": 74766, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5914", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5914", "securityControlId": 32157, "ccis": [], "uuid": "28e64aee-c82d-569d-9225-a65004ea21c6", "testId": "VPM-06.4_A02", "test": "the results of multiple vulnerability scans are compared using automated mechanisms.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_RA-05(06)", "defaultText": null } ], "externalMappings": [ { "id": 612371, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b178b5ec-aac3-5059-a18c-2f977193f18f", "parentControlId": 32157, "controlId": "RA-5(6)", "title": "RA-5(6)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591748" }, { "id": 612372, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "436bde49-c797-5ceb-8b3f-ea26defa2895", "parentControlId": 32157, "controlId": "RA-05(06)", "title": "RA-05(06)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591748" }, { "id": 612373, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "bda9fc24-9380-508c-8968-9d8140dfc71f", "parentControlId": 32157, "controlId": "RA-05(06)", "title": "RA-05(06)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591748" }, { "id": 612375, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591748", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d6d1d25e-105d-5b21-a845-ca9742c9178d", "parentControlId": 32157, "controlId": "RA-5(6)", "title": "RA-5(6)", "catalog": "NIST SP 800-161 R1 UDP1", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591748" } ], "id": 32157, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731379", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731379", "catalogueId": 1062, "uuid": "a9ee3f41-cf40-5c4e-bdf1-5072848d0bdc", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to compare the results of vulnerability scans over time to determine trends in system vulnerabilities?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 9.0, "title": "Trend Analysis", "description": "

Control Description

Automated mechanisms exist to compare the results of vulnerability scans over time to determine trends in system vulnerabilities.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nVulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically compare the results of vulnerability scans over time to determine trends in system vulnerabilities.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-06.4", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-06.4", "references": "

Micro-Small Business (<10 staff)

∙ Review vulnerability trends over time

Small Business (10-49 staff)

∙ Vulnerability trend analysis and reporting

Medium Business (50-249 staff)

∙ Formal vulnerability trend analysis program\n∙ Regular metrics review

Large Business (250-999 staff)

∙ Enterprise vulnerability metrics and trend analysis dashboard

Enterprise (>1,000 staff)

∙ Enterprise vulnerability management platform with trend analytics (e.g., Tenable.io, Qualys VMDR)\n∙ Executive dashboards", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74767, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5914", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5914", "securityControlId": 32158, "ccis": [], "uuid": "3f79e19c-6664-5667-939c-4d80805d4077", "testId": "VPM-06.5_A01", "test": "a system, application or service whose historic event logs are to be reviewed is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-05(08)_ODP[01]", "defaultText": null }, { "id": 74768, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.5914", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.5914", "securityControlId": 32158, "ccis": [], "uuid": "5bb53eb5-b6bd-5246-888c-f2f3bf9fb333", "testId": "VPM-06.5_A02", "test": "a time period for a potential previous exploit of a system, application or service is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-05(08)_ODP[02]", "defaultText": null }, { "id": 74769, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591401", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591401", "securityControlId": 32158, "ccis": [], "uuid": "7804d4aa-9b8a-5f2e-a409-52fbb718205c", "testId": "VPM-06.5_A03", "test": "historic event logs are reviewed to determine if a vulnerability identified in a system, application or service has been previously exploited within an organization-defined time period.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-05(08)", "defaultText": null } ], "externalMappings": [ { "id": 612384, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "0802a95c-c21a-5c73-8704-58cfade9885f", "parentControlId": 32158, "controlId": "RA-5(8)", "title": "RA-5(8)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591749" }, { "id": 612385, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "baec3acb-bd78-597c-bce7-67cc13becb5f", "parentControlId": 32158, "controlId": "RA-05(08)", "title": "RA-05(08)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591749" }, { "id": 612386, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591749", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "abd25520-3c60-5955-880f-6f9fffb1e9f2", "parentControlId": 32158, "controlId": "RA-05(08)", "title": "RA-05(08)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591749" } ], "id": 32158, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731379", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731379", "catalogueId": 1062, "uuid": "82eb685d-f3e1-556c-b575-88d585224ab0", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization review historical event logs to determine if identified vulnerabilities have been previously exploited?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Review Historical Event logs", "description": "

Control Description

Mechanisms exist to review historical event logs to determine if identified vulnerabilities have been previously exploited.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Vulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to review historical event logs to determine if identified vulnerabilities have been previously exploited.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. \n▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.", "controlId": "VPM-06.5", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-06.5", "references": "

Micro-Small Business (<10 staff)

∙ Review historical logs when analyzing vulnerabilities

Small Business (10-49 staff)

∙ Policy to review historical logs during vulnerability analysis

Medium Business (50-249 staff)

∙ Formal historical log review process for vulnerability analysis

Large Business (250-999 staff)

∙ Enterprise SIEM with historical log review integrated with vulnerability management

Enterprise (>1,000 staff)

∙ Enterprise SIEM (e.g., Splunk, IBM QRadar) integrated with vulnerability management for historical correlation", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74772, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591402", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591402", "securityControlId": 32161, "ccis": [], "uuid": "718b7700-f482-55f9-a7d7-0722a61855a5", "testId": "VPM-06.8_A01", "test": "corrective actions to be taken if information about the system is discoverable are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-05(04)_ODP", "defaultText": null }, { "id": 74773, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591402", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591402", "securityControlId": 32161, "ccis": [], "uuid": "23955994-f08f-51e8-8e88-b4aaf529873c", "testId": "VPM-06.8_A02", "test": "corrective actions are taken when information about the system is confirmed as discoverable.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-05(04)[02]", "defaultText": null }, { "id": 74774, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591402", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591402", "securityControlId": 32161, "ccis": [], "uuid": "9ad44321-b682-59ad-bb8f-367635411ed7", "testId": "VPM-06.8_A03", "test": "information about the system is discoverable.
PPTDF Applicability: Technology
Assessment Rigor: 3", "otherId": "53A_R5_RA-05(04)[01]", "defaultText": null } ], "externalMappings": [ { "id": 612431, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591755", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3503017-1294-5a58-a59c-5bca925d2ca7", "parentControlId": 32161, "controlId": "RA-5(4)", "title": "RA-5(4)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591755" }, { "id": 612432, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "b11a80d8-a911-5427-bd64-136938d645b7", "parentControlId": 32161, "controlId": "RA-05(04)", "title": "RA-05(04)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591756" }, { "id": 612433, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3e86500-aa94-574e-ba27-4ff7dd79d2a4", "parentControlId": 32161, "controlId": "RA-05(04)", "title": "RA-05(04)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591756" }, { "id": 612434, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d783c37b-dbb9-5ebd-ae4e-2a138688fdd0", "parentControlId": 32161, "controlId": "RA-05(04)", "title": "RA-05(04)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591756" }, { "id": 612435, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591756", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "1cd6ce0f-26e1-5985-be71-5ab66fb59483", "parentControlId": 32161, "controlId": "RA-05(04)", "title": "RA-05(04)", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591756" } ], "id": 32161, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.73138", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.73138", "catalogueId": 1062, "uuid": "4b7f0419-1b20-54a7-b9e1-6b46181b9d16", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization define what information is allowed to be discoverable by adversaries and take corrective actions to remediate non-compliant Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 5.0, "title": "Acceptable Discoverable Information", "description": "

Control Description

Mechanisms exist to define what information is allowed to be discoverable by adversaries and take corrective actions to remediate non-compliant Technology Assets, Applications and/or Services (TAAS).

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nVulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to define what information is allowed to be discoverable by adversaries and take corrective actions to remediate non-compliant Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-06.8", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-06.8", "references": "

Micro-Small Business (<10 staff)

∙ Limit what information is visible about Technology Assets, Applications and/or Services (TAAS) on the internet

Small Business (10-49 staff)

∙ Minimize publicly discoverable information about Technology Assets, Applications and/or Services (TAAS) (banners, versions)

Medium Business (50-249 staff)

∙ Formal acceptable discoverable information policy\n∙ Remove unnecessary Technology Assets, Applications and/or Services (TAAS) banners and version info

Large Business (250-999 staff)

∙ Enterprise attack surface minimization program\n∙ Automated scan for exposed information

Enterprise (>1,000 staff)

∙ Enterprise attack surface management (ASM) platform (e.g., CyCognito, Mandiant ASM)\n∙ Automated discovery and reduction of exposed info", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74775, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591402", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591402", "securityControlId": 32162, "ccis": [], "uuid": "278b973f-d357-55e5-9995-254fcf5bf332", "testId": "VPM-06.9_A01", "test": "the output from vulnerability scanning tools is correlated to determine the presence of multi-vulnerability and multi-hop attack vectors.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "53A_R5_RA-05(10)", "defaultText": null } ], "externalMappings": [ { "id": 612446, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591757", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7336e859-12bc-5838-9fab-3c9a8048b87f", "parentControlId": 32162, "controlId": "RA-5(10)", "title": "RA-5(10)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591757" }, { "id": 612447, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591757", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "deb5636b-7668-57c0-9c58-54b39c0fd181", "parentControlId": 32162, "controlId": "RA-05(10)", "title": "RA-05(10)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591757" }, { "id": 612448, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591757", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "40a27db5-9bfa-5226-a333-7e46e1584bb0", "parentControlId": 32162, "controlId": "RA-05(10)", "title": "RA-05(10)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591757" } ], "id": 32162, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731381", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731381", "catalogueId": 1062, "uuid": "c63e3c97-ac09-5f0e-8965-3cc04c018a35", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization use automated mechanisms to correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability/multi-hop attack vectors?

Assessment Frequency

Quarterly", "practiceLevel": "", "weight": 5.0, "title": "Correlate Scanning Information", "description": "

Control Description

Automated mechanisms exist to correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability/multi-hop attack vectors.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Vulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to automatically correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability/multi-hop attack vectors.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-06.9", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-06.9", "references": "

Micro-Small Business (<10 staff)

∙ Correlate scan results across multiple tools

Small Business (10-49 staff)

∙ Correlate vulnerability data from multiple scans/tools

Medium Business (50-249 staff)

∙ Formal vulnerability data correlation process\n∙ Normalized view across tools

Large Business (250-999 staff)

∙ Enterprise vulnerability correlation platform\n∙ Unified risk view across tools

Enterprise (>1,000 staff)

∙ Enterprise vulnerability management platform with multi-source correlation (e.g., Tenable One, Nucleus)\n∙ SIEM integration", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74776, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591402", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591402", "securityControlId": 32163, "ccis": [], "uuid": "28149670-02f7-5c74-821b-a8f8f18a531d", "testId": "VPM-07_A01", "test": "the breadth of penetration testing is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(05)_ODP[01]\n53A_R5_CA-08_ODP[02]\n53A_R5_SA-11(05)(a)[01]", "defaultText": null }, { "id": 74777, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591403", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591403", "securityControlId": 32163, "ccis": [], "uuid": "8c8930e6-a837-5650-9470-e3a3cd60a1b7", "testId": "VPM-07_A02", "test": "the depth of penetration testing is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(05)_ODP[02]\n53A_R5_SA-11(05)(a)[02]", "defaultText": null }, { "id": 74778, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591403", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591403", "securityControlId": 32163, "ccis": [], "uuid": "d50316d0-5dd0-5c69-8cd3-34e536c9cabf", "testId": "VPM-07_A03", "test": "constraints of penetration testing are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_SA-11(05)_ODP[03]\n53A_R5_SA-11(05)(b)", "defaultText": null }, { "id": 74779, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591403", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591403", "securityControlId": 32163, "ccis": [], "uuid": "f374b2f9-0c35-5d74-b2e8-963926a48698", "testId": "VPM-07_A04", "test": "automated scanning tools are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.12.1e[a]", "defaultText": null }, { "id": 74780, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591403", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591403", "securityControlId": 32163, "ccis": [], "uuid": "2f105241-44d9-5c2a-a833-c4456e3b73ff", "testId": "VPM-07_A05", "test": "ad hoc tests using subject matter experts are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.12.1e[b]", "defaultText": null }, { "id": 74781, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591403", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591403", "securityControlId": 32163, "ccis": [], "uuid": "f024fee1-5493-53ec-a6b1-f7805d7b589d", "testId": "VPM-07_A06", "test": "penetration testing is conducted frequently leveraging automated scanning tools and ad hoc tests using subject matter experts.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "172A_3.12.1e[c]", "defaultText": null }, { "id": 74782, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591404", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591404", "securityControlId": 32163, "ccis": [], "uuid": "576a3603-cb1f-5967-bf29-804d9a5c2fa6", "testId": "VPM-07_A07", "test": "frequency at which to conduct penetration testing on systems or system components is defined.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-08_ODP[01]\n172A_3.12.1e_ODP[1]", "defaultText": null }, { "id": 74783, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591404", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591404", "securityControlId": 32163, "ccis": [], "uuid": "82b276dd-c42c-539f-82f3-59b0809bc8f4", "testId": "VPM-07_A08", "test": "penetration testing is conducted organization-defined frequency on organization-defined system(s) or system components.
PPTDF Applicability: Process
Assessment Rigor: 1
SCF Defined Parameters: at least annually", "otherId": "53A_R5_CA-08", "defaultText": null } ], "externalMappings": [ { "id": 612468, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59176", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "340aabaa-dd9b-5f94-9829-69702f5271b0", "parentControlId": 32163, "controlId": "CA-8", "title": "CA-8", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59176" }, { "id": 612469, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59176", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "cde0cbb6-8271-53f4-a3c8-0ec94c486171", "parentControlId": 32163, "controlId": "CA-08", "title": "CA-08", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59176" }, { "id": 612470, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59176", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3ca02e7f-07cc-58ec-b9dc-15486acfc46e", "parentControlId": 32163, "controlId": "SA-11(05)", "title": "SA-11(05)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59176" }, { "id": 612472, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59176", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fc97b75f-d38a-5309-8720-beed77a0b9f1", "parentControlId": 32163, "controlId": "CA-08", "title": "CA-08", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59176" }, { "id": 612473, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59176", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "274882c4-1755-52ee-8673-e15d9932935f", "parentControlId": 32163, "controlId": "CA-08", "title": "CA-08", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59176" }, { "id": 612474, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59176", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7f7a4296-6797-5371-aca1-45591ee1fc41", "parentControlId": 32163, "controlId": "SA-11(05)", "title": "SA-11(05)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59176" }, { "id": 612475, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591761", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "ab83e6f8-919e-5f04-9fea-6376888b5df2", "parentControlId": 32163, "controlId": "CA-08", "title": "CA-08", "catalog": "NIST SP 800-82 R3 - High OT Overlay", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591761" }, { "controlId": "NSS-17T-Sec6.6", "title": "NSS-17T-Sec6.6 — Vulnerability Management & Compensating Measures for Legacy I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "49c3f1b6-07ff-5a54-b34f-20aa17f509e2", "isPublic": true }, { "controlId": "IEC-62645-8.2", "title": "IEC-62645-8.2 — Patch and Vulnerability Management During Plant Outages/Maintenance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "3eee6f7d-6821-5e10-b09b-27b747cf50a3", "isPublic": true }, { "controlId": "IEC-63096-12.6", "title": "IEC-63096-12.6 — Technical Vulnerability Management for CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "1d64870e-c2e8-5598-962a-78ab7ff257dd", "isPublic": true } ], "id": 32163, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731381", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731381", "catalogueId": 1062, "uuid": "bd976e04-046a-55a4-b518-39b82753740c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization conduct penetration testing on Technology Assets, Applications and/or Services (TAAS)?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Penetration Testing", "description": "

Control Description

Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).

Evidence Request List (ERL)

E-VPM-02\nE-VPM-03

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nVulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel, or contracted professionals, conduct annual penetration testing on network segments hosting High Value Assets (HVAs).

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-07", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-07", "references": "

Small Business (10-49 staff)

∙ Annual penetration test by qualified tester

Medium Business (50-249 staff)

∙ Annual penetration test by qualified third-party tester

Large Business (250-999 staff)

∙ Enterprise penetration testing program\n∙ Annual external and internal pen tests

Enterprise (>1,000 staff)

∙ Enterprise penetration testing program\n∙ Annual and event-driven pen tests\n∙ Red team exercises\n∙ Purple teaming", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74784, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591404", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591404", "securityControlId": 32164, "ccis": [], "uuid": "8e959f16-78c9-5037-9905-f097b3bf40c1", "testId": "VPM-07.1_A01", "test": "an independent penetration testing agent or team is employed to perform penetration testing on the system or system components.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-08(01)", "defaultText": null } ], "externalMappings": [ { "id": 612582, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "4688547a-bb17-5c46-9c7b-85e84ea7ca54", "parentControlId": 32164, "controlId": "CA-8(1)", "title": "CA-8(1)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591773" }, { "id": 612583, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19d9af1a-81d1-551e-a8cf-c05871b4090d", "parentControlId": 32164, "controlId": "CA-08(01)", "title": "CA-08(01)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591773" }, { "id": 612584, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "03468426-6e29-55a9-9c68-850b729d0113", "parentControlId": 32164, "controlId": "CA-08(01)", "title": "CA-08(01)", "catalog": "NIST SP 800-53 R5 - High Baseline", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591773" }, { "id": 612585, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591773", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d7b4d7d1-daf2-5c63-bf1b-b0d367d0d849", "parentControlId": 32164, "controlId": "CA-08(01)", "title": "CA-08(01)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591773" } ], "id": 32164, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731381", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731381", "catalogueId": 1062, "uuid": "629203cd-2d6f-57c2-adf7-368b2c0b3c02", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize an independent assessor or penetration team to perform penetration testing?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 6.0, "title": "Independent Penetration Agent or Team", "description": "

Control Description

Mechanisms exist to utilize an independent assessor or penetration team to perform penetration testing.

Evidence Request List (ERL)

E-VPM-04

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nVulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel, or contracted professionals, use red team exercises to simulate attempts by adversaries to compromise TAASD in accordance with entity-defined rules of engagement.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize an independent assessor or penetration team to perform penetration testing.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-07.1", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-07.1", "references": "

Medium Business (50-249 staff)

∙ Third-party independent penetration testing

Large Business (250-999 staff)

∙ Enterprise independent penetration testing program (qualified third-party testers)

Enterprise (>1,000 staff)

∙ Enterprise independent pen testing program\n∙ Qualified third-party pen test teams\n∙ Annual and ad-hoc testing\n∙ Full red team exercises", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74785, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591404", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591404", "securityControlId": 32165, "ccis": [], "uuid": "eb54b995-c3c0-5bd1-9539-2877b4b92376", "testId": "VPM-08_A01", "test": "locations to employ technical surveillance countermeasure surveys are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-06_ODP[01]", "defaultText": null }, { "id": 74786, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591405", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591405", "securityControlId": 32165, "ccis": [], "uuid": "72628633-8697-5f81-90a4-49a07130224c", "testId": "VPM-08_A02", "test": "the frequency at which to employ technical surveillance countermeasure surveys is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-06_ODP[02]\n53A_R5_RA-06_ODP[03]", "defaultText": null }, { "id": 74787, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591406", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591406", "securityControlId": 32165, "ccis": [], "uuid": "d4d2a036-7e2d-5a5c-8abe-2869e79abc7d", "testId": "VPM-08_A03", "test": "events or indicators which, if they occur, trigger a technical surveillance countermeasures survey are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-06_ODP[04]", "defaultText": null }, { "id": 74788, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591407", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591407", "securityControlId": 32165, "ccis": [], "uuid": "32ffa5fc-8c2c-5961-bee6-343076f26011", "testId": "VPM-08_A04", "test": "a technical surveillance countermeasures survey is employed at locations per organization-defined criteria.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_RA-06", "defaultText": null } ], "externalMappings": [ { "id": 612627, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591778", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eead373f-d14f-556f-b0bb-036149f4e98f", "parentControlId": 32165, "controlId": "RA-6", "title": "RA-6", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591778" }, { "id": 612628, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591778", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "fce99b6b-6e80-5bb7-9fb0-64326f2b105d", "parentControlId": 32165, "controlId": "RA-06", "title": "RA-06", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591778" }, { "id": 612629, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591778", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "d3829b4c-e0a7-5d72-965a-0c3820fad2bb", "parentControlId": 32165, "controlId": "RA-06", "title": "RA-06", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591778" }, { "controlId": "NSS-17T-Sec6.6", "title": "NSS-17T-Sec6.6 — Vulnerability Management & Compensating Measures for Legacy I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "77ceaace-6e20-5324-b2b2-49a774b6dd7f", "isPublic": true }, { "controlId": "IEC-62645-8.2", "title": "IEC-62645-8.2 — Patch and Vulnerability Management During Plant Outages/Maintenance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "2b9f13ed-7c15-5c28-a012-7e53503911ca", "isPublic": true }, { "controlId": "IEC-63096-12.6", "title": "IEC-63096-12.6 — Technical Vulnerability Management for CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "dcdbc2a7-b165-5ee6-a0db-a4ce02788334", "isPublic": true } ], "id": 32165, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731382", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731382", "catalogueId": 1062, "uuid": "87be7830-bb96-58cb-ad30-6533485af6f7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize a technical surveillance countermeasures survey?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 1.0, "title": "Technical Surveillance Countermeasures Security", "description": "

Control Description

Mechanisms exist to utilize a technical surveillance countermeasures survey.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nVulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize a technical surveillance countermeasures survey.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-08", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-08", "references": "

Micro-Small Business (<10 staff)

∙ Free vulnerability scanner (e.g., OpenVAS)\n∙ Apply patches monthly

Small Business (10-49 staff)

∙ Vulnerability scanner (e.g., Tenable Nessus Essentials)\n∙ Patch management policy

Medium Business (50-249 staff)

∙ Facility sweeping for \"bugs\" or other unauthorized surveillance technologies.

Large Business (250-999 staff)

∙ Facility sweeping for \"bugs\" or other unauthorized surveillance technologies.

Enterprise (>1,000 staff)

∙ Facility sweeping for \"bugs\" or other unauthorized surveillance technologies.", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74791, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591407", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591407", "securityControlId": 32167, "ccis": [], "uuid": "0b4ce71e-a52c-564f-81ff-f38b05becb2f", "testId": "VPM-10_A01", "test": "red team exercises to simulate attempts by adversaries to compromise organizational systems are defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-08(02)_ODP", "defaultText": null }, { "id": 74792, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591407", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591407", "securityControlId": 32167, "ccis": [], "uuid": "bde10ed7-aef8-5848-bfdc-28bcd9b2a15d", "testId": "VPM-10_A02", "test": "organization-defined red team exercises are employed to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "53A_R5_CA-08(02)", "defaultText": null } ], "externalMappings": [ { "id": 612640, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591779", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "2e1f0512-b818-5372-98aa-9f892a00c8ac", "parentControlId": 32167, "controlId": "CA-8(2)", "title": "CA-8(2)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591779" }, { "id": 612641, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59178", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "3b7f5ca3-dda3-5e3d-b2bf-be4ad0422b4d", "parentControlId": 32167, "controlId": "CA-08(02)", "title": "CA-08(02)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59178" }, { "id": 612642, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.59178", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a0f6736a-d836-5e65-8ce9-5d13cbb5a878", "parentControlId": 32167, "controlId": "CA-08(02)", "title": "CA-08(02)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.59178" }, { "controlId": "NSS-17T-Sec6.6", "title": "NSS-17T-Sec6.6 — Vulnerability Management & Compensating Measures for Legacy I&C", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "2ed1fb2a-fc29-58f3-a423-903ad26c0681", "isPublic": true }, { "controlId": "IEC-62645-8.2", "title": "IEC-62645-8.2 — Patch and Vulnerability Management During Plant Outages/Maintenance", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "51a0ff40-df08-516d-99e0-8b714bcf52f2", "isPublic": true }, { "controlId": "IEC-63096-12.6", "title": "IEC-63096-12.6 — Technical Vulnerability Management for CDAs", "mappingType": "intersects with", "notes": "International/Sector Nuclear Alignment (VPM Domain)", "catalog": "IEC 63096 (Nuclear Security Controls)", "uuid": "7ed79432-8d41-56e5-b88b-9045feded42b", "isPublic": true } ], "id": 32167, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731382", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731382", "catalogueId": 1062, "uuid": "51690df0-2ceb-55ca-bf26-9ea4c825de9a", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize \"red team\" exercises to simulate attempts by adversaries to compromise Technology Assets, Applications and/or Services (TAAS) in accordance with organization-defined rules of engagement?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 3.0, "title": "Red Team Exercises", "description": "

Control Description

Mechanisms exist to utilize \"red team\" exercises to simulate attempts by adversaries to compromise Technology Assets, Applications and/or Services (TAAS) in accordance with organization-defined rules of engagement.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Vulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.\n▪ IT and/or cybersecurity personnel, or contracted professionals, use red team exercises to simulate attempts by adversaries to compromise TAASD in accordance with entity-defined rules of engagement.

Level 3 - Well Defined: Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.\n▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution, vulnerability scanning solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize \"red team\" exercises to simulate attempts by adversaries to compromise Technology Assets, Applications and/or Services (TAAS) in accordance with organization-defined rules of engagement.

Level 4 - Quantitatively Controlled: Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "VPM-10", "family": "Vulnerability & Patch Management", "enhancements": "", "sortId": "VPM-10", "references": "

Micro-Small Business (<10 staff)

∙ Free vulnerability scanner (e.g., OpenVAS)\n∙ Apply patches monthly

Small Business (10-49 staff)

∙ Vulnerability scanner (e.g., Tenable Nessus Essentials)\n∙ Patch management policy

Medium Business (50-249 staff)

∙ Vulnerability management program\n∙ Scheduled scanning\n∙ Risk-based patching

Large Business (250-999 staff)

∙ \"red team\" exercises

Enterprise (>1,000 staff)

∙ \"red team\" exercises", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74793, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591408", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591408", "securityControlId": 32168, "ccis": [], "uuid": "dc6f99fe-7b4e-545f-b741-bb43e9b8dd9d", "testId": "WEB-01_A01", "test": "an enterprise-wide web management policy, as well as associated standards, controls and procedures exists.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74794, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591408", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591408", "securityControlId": 32168, "ccis": [], "uuid": "fb767725-e75d-51a0-8509-009bbf0f72a2", "testId": "WEB-01_A02", "test": "web security operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74795, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591408", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591408", "securityControlId": 32168, "ccis": [], "uuid": "6a538b81-62c5-5116-aa8a-081406e117ab", "testId": "WEB-01_A03", "test": "adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support web security operations.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74796, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591408", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591408", "securityControlId": 32168, "ccis": [], "uuid": "484d3e55-a537-55e3-9c5f-f2de70beb281", "testId": "WEB-01_A04", "test": "responsibility and authority for the performance of web security-related activities are assigned to designated personnel.
PPTDF Applicability: People
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74797, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591409", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591409", "securityControlId": 32168, "ccis": [], "uuid": "3e24ae44-fb6e-574a-adce-8f83a7c8b8fb", "testId": "WEB-01_A05", "test": "personnel performing web security-related activities have the skills and knowledge needed to perform their assigned duties.
PPTDF Applicability: People
Assessment Rigor: 2", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 612657, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591781", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "eb2d95fe-3194-55c1-a205-3c4771f3a859", "parentControlId": 32168, "controlId": "3.1.22", "title": "3.1.22", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591781" }, { "id": 612658, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591781", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "19f9680a-bff5-5289-9f9c-cb52b03796c4", "parentControlId": 32168, "controlId": "03.01.22.a", "title": "03.01.22.a", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591781" } ], "id": 32168, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731383", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731383", "catalogueId": 1062, "uuid": "b2a461ae-0d97-5629-9c8b-6c199b068da7", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization facilitate the implementation of an enterprise-wide web management policy, as well as associated standards, controls and procedures?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Web Security", "description": "

Control Description

Mechanisms exist to facilitate the implementation of an enterprise-wide web management policy, as well as associated standards, controls and procedures.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Web Security (WEB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with WEB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Web management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Web Security (WEB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with WEB domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with WEB domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with WEB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Web security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Web security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Web Security (WEB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with WEB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with WEB domain capabilities are well-documented and kept current by process owners.\n▪ A web management team, or simiE210:E1635main capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of web management operations (e.g., secure web gateway, Content Management System (CMS) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with WEB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to facilitate the implementation of an enterprise-wide web management policy, as well as associated standards, controls and procedures.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "WEB-01", "family": "Web Security", "enhancements": "", "sortId": "WEB-01", "references": "

Micro-Small Business (<10 staff)

∙ Keep website CMS and plugins updated

Small Business (10-49 staff)

∙ Web security policy\n∙ HTTPS enforcement\n∙ Regular updates for web software

Medium Business (50-249 staff)

∙ Formal web security program\n∙ WAF\n∙ HTTPS enforcement\n∙ Regular security testing

Large Business (250-999 staff)

∙ Enterprise web security program\n∙ WAF\n∙ DAST\n∙ Content security policy\n∙ Bot management

Enterprise (>1,000 staff)

∙ Enterprise web security platform (e.g., Imperva, Cloudflare)\n∙ WAF\n∙ DDoS protection\n∙ DAST integration\n∙ Bot management", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74798, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591409", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591409", "securityControlId": 32169, "ccis": [], "uuid": "1b080d1e-f8c6-53da-a5f4-727d648d33db", "testId": "WEB-01.1_A01", "test": "a capability exists to review secure pages for unauthorized code.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "controlId": "B.3.14", "title": "B.3.14 — Mobile Code", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: SC-18", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "89487858-ace7-53a1-8b93-3cc917f85899", "isPublic": true }, { "controlId": "NEI 08-09 App D.3.14", "title": "NEI 08-09 App D.3.14 — Mobile Code", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.3.14", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "84726ff2-4b51-5f3a-8aa1-e591d47daf9e", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.3.14", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "06718066-1b02-58f9-89c5-4333e223810c", "isPublic": true } ], "id": 32169, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731383", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731383", "catalogueId": 1062, "uuid": "6a7e8cca-b432-52dd-8ab8-e1474fe9e75c", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization prevent unauthorized code from being present in a secure page as it is rendered in a client’s browser?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Unauthorized Code", "description": "

Control Description

Mechanisms exist to prevent unauthorized code from being present in a secure page as it is rendered in a client’s browser.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nWeb Security (WEB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with WEB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Web management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Web Security (WEB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with WEB domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with WEB domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with WEB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Web security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Web security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Web Security (WEB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with WEB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with WEB domain capabilities are well-documented and kept current by process owners.\n▪ A web management team, or simiE210:E1635main capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of web management operations (e.g., secure web gateway, Content Management System (CMS) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with WEB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to prevent unauthorized code from being present in a secure page as it is rendered in a client’s browser.

Level 4 - Quantitatively Controlled: Utilize SCR-CMM Level 3 criteria definitions:\n▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. \n▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.3.14", "controlId": "WEB-01.1", "family": "Web Security", "enhancements": "", "sortId": "WEB-01.1", "references": "

Micro-Small Business (<10 staff)

∙ Review website for unauthorized scripts or content regularly

Small Business (10-49 staff)

∙ Policy to prevent and detect unauthorized code on web properties

Medium Business (50-249 staff)

∙ Formal unauthorized code detection program\n∙ Web integrity monitoring

Large Business (250-999 staff)

∙ Enterprise web integrity monitoring (e.g., RiskIQ, Reflectiz)\n∙ Automated unauthorized code detection

Enterprise (>1,000 staff)

∙ Enterprise web security platform with unauthorized code detection (e.g., Featurespace, Reflectiz, c/side)\n∙ Real-time monitoring", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74799, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591409", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591409", "securityControlId": 32170, "ccis": [], "uuid": "0578a0d3-ce0c-5328-bb3c-ebaea2a0229f", "testId": "WEB-02_A01", "test": "a Demilitarized Zone (DMZ) architecture is utilized for Internet-facing technologies to restrict inbound traffic to authorized devices on certain services, protocols and ports.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 612693, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591794", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "7dbbdba8-1963-5363-bc8c-c28da0cf189d", "parentControlId": 32170, "controlId": "8.22", "title": "8.22", "catalog": "ISO 27002 (2022)", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591794" }, { "id": 612698, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591794", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "f48d0c32-471e-5b0e-ab2c-8317dc44c0ea", "parentControlId": 32170, "controlId": "3.1.22", "title": "3.1.22", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591794" } ], "id": 32170, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731383", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731383", "catalogueId": 1062, "uuid": "bcb2bdff-a782-5a45-8371-d9d29a58cf15", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization utilize a Demilitarized Zone (DMZ) to restrict inbound traffic to authorized Technology Assets, Applications and/or Services (TAAS) on certain services, protocols and ports?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 9.0, "title": "Use of Demilitarized Zones (DMZ)", "description": "

Control Description

Mechanisms exist to utilize a Demilitarized Zone (DMZ) to restrict inbound traffic to authorized Technology Assets, Applications and/or Services (TAAS) on certain services, protocols and ports.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nWeb Security (WEB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with WEB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Web management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Web Security (WEB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with WEB domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with WEB domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with WEB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Web security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Web security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Web Security (WEB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with WEB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with WEB domain capabilities are well-documented and kept current by process owners.\n▪ A web management team, or simiE210:E1635main capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of web management operations (e.g., secure web gateway, Content Management System (CMS) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with WEB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to utilize a Demilitarized Zone (DMZ) to restrict inbound traffic to authorized Technology Assets, Applications and/or Services (TAAS) on certain services, protocols and ports.

Level 4 - Quantitatively Controlled: Web Security (WEB) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "WEB-02", "family": "Web Security", "enhancements": "", "sortId": "WEB-02", "references": "

Micro-Small Business (<10 staff)

∙ Host internet-facing services in isolated network from internal systems

Small Business (10-49 staff)

∙ DMZ for internet-facing web services

Medium Business (50-249 staff)

∙ Formal DMZ architecture for web services\n∙ Separation from internal network

Large Business (250-999 staff)

∙ Enterprise DMZ design with WAF and IDS/IPS for web services

Enterprise (>1,000 staff)

∙ Enterprise web architecture with DMZ\n∙ WAF\n∙ Reverse proxy\n∙ Network segmentation\n∙ DDoS protection", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74800, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59141", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59141", "securityControlId": 32171, "ccis": [], "uuid": "173b39ed-c449-5912-a63c-d6fa38929ad9", "testId": "WEB-03_A01", "test": "a Web Application Firewalls (WAFs) is utilized for Internet-facing technologies to protect against application-specific threats.
PPTDF Applicability: Technology
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 612723, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591797", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "e32d30f9-34ea-59f0-8d75-1ca442b3e94f", "parentControlId": 32171, "controlId": "SC-7(17)", "title": "SC-7(17)", "catalog": "NIST SP 800-53 R4", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591797" }, { "id": 612724, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "a3d44503-91c3-534a-a50f-2f2bb1e9824e", "parentControlId": 32171, "controlId": "SC-07(17)", "title": "SC-07(17)", "catalog": "NIST SP 800-53 R5", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591798" }, { "id": 612725, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591798", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "8ad792f2-6f0d-5e52-b01f-f9085e4a1918", "parentControlId": 32171, "controlId": "SC-07(17)", "title": "SC-07(17)", "catalog": "NIST SP 800-82 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591798" } ], "id": 32171, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731384", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731384", "catalogueId": 1062, "uuid": "ea6eed1a-8118-55c8-a5df-9efbb334a07d", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization deploy Web Application Firewalls (WAFs) to provide defense-in-depth protection for application-specific threats?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 8.0, "title": "Web Application Firewall (WAF)", "description": "

Control Description

Mechanisms exist to deploy Web Application Firewalls (WAFs) to provide defense-in-depth protection for application-specific threats.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nWeb Security (WEB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with WEB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Web management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Web Security (WEB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with WEB domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with WEB domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with WEB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Web security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Web security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Web Security (WEB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with WEB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with WEB domain capabilities are well-documented and kept current by process owners.\n▪ A web management team, or simiE210:E1635main capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of web management operations (e.g., secure web gateway, Content Management System (CMS) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with WEB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to deploy Web Application Firewalls (WAFs) to provide defense-in-depth protection for application-specific threats.

Level 4 - Quantitatively Controlled: Web Security (WEB) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "WEB-03", "family": "Web Security", "enhancements": "", "sortId": "WEB-03", "references": "

Micro-Small Business (<10 staff)

∙ Keep website CMS and plugins updated\n∙ Use HTTPS

Small Business (10-49 staff)

∙ Web Application Firewall (WAF)

Medium Business (50-249 staff)

∙ Web Application Firewall (WAF)

Large Business (250-999 staff)

∙ Web Application Firewall (WAF)

Enterprise (>1,000 staff)

∙ Web Application Firewall (WAF)", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74801, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.59141", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.59141", "securityControlId": 32172, "ccis": [], "uuid": "f07cf8b9-0173-5bfd-970d-1ce7fed95c5e", "testId": "WEB-04_A01", "test": "a capability exists to protect the confidentiality and availability of client data that is stored, transmitted or processed by the Internet-based service.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 612740, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591799", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "da4b139f-bc4d-5f8c-9759-27f5df793800", "parentControlId": 32172, "controlId": "3.1.22", "title": "3.1.22", "catalog": "NIST SP 800-171 R2", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591799" }, { "controlId": "B.1.23", "title": "B.1.23 — Publicly Accessible Content", "mappingType": "Equivalent", "notes": "NIST 800-53 bridge: AC-22", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "abef63cc-167d-5309-9fc2-11d13f644f05", "isPublic": true }, { "controlId": "NEI 08-09 App D.1.23", "title": "NEI 08-09 App D.1.23 — Publicly Accessible Content", "mappingType": "Equivalent", "notes": "Corresponds to NRC RG 5.71 B.1.23", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "2bec281c-c3ba-5797-9755-69a046d771e8", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(1)", "title": "10 CFR 73.54(c)(1) — Protection of Digital Computer and Communication Systems and Networks", "mappingType": "subset of", "notes": "Via NRC RG 5.71 B.1.23", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "50d4d6f8-46dc-5373-a06a-d96f79be6934", "isPublic": true } ], "id": 32172, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731384", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731384", "catalogueId": 1062, "uuid": "00cdab32-b67d-581c-a3a2-ba0b5c2acf51", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization deploy reasonably-expected security, compliance and resilience controls to protect the confidentiality and availability of client data that is stored, transmitted or processed by the Internet-based service?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 10.0, "title": "Client-Facing Web Services", "description": "

Control Description

Mechanisms exist to deploy reasonably-expected security, compliance and resilience controls to protect the confidentiality and availability of client data that is stored, transmitted or processed by the Internet-based service.

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: SCR-CMM Level 1 criteria definitions are not available for this control:\n▪ A reasonable person would conclude this control requires a structured process.\n▪ At this level of maturity, the \"ad hoc\" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. \nWeb Security (WEB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with WEB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Web management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: Web Security (WEB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with WEB domain capabilities are formally documented and centrally-managed by the entity.\n▪ Standardized Operating Procedures (SOP) associated with WEB domain capabilities are documented and maintained by process owners.\n▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with WEB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).\n▪ Web security-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).\n▪ Web security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 - Well Defined: Web Security (WEB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with WEB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with WEB domain capabilities are well-documented and kept current by process owners.\n▪ A web management team, or simiE210:E1635main capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of web management operations (e.g., secure web gateway, Content Management System (CMS) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with WEB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to deploy reasonably-expected security, compliance and resilience controls to protect the confidentiality and availability of client data that is stored, transmitted or processed by the Internet-based service.

Level 4 - Quantitatively Controlled: Web Security (WEB) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Nuclear Regulatory Applicability

U.S. NRC RG 5.71 (10 CFR 73.54) Controls: B.1.23", "controlId": "WEB-04", "family": "Web Security", "enhancements": "", "sortId": "WEB-04", "references": "

Micro-Small Business (<10 staff)

∙ Only expose necessary web service APIs/endpoints to clients

Small Business (10-49 staff)

∙ Client-facing web service security policy\n∙ Minimize exposed endpoints

Medium Business (50-249 staff)

∙ Formal client-facing web service security standards\n∙ API security controls

Large Business (250-999 staff)

∙ Enterprise client-facing web security program\n∙ API gateway\n∙ WAF\n∙ Rate limiting

Enterprise (>1,000 staff)

∙ Enterprise web services security platform (e.g., Apigee, AWS API Gateway + WAF)\n∙ Full API security lifecycle", "relatedControls": "", "otherId": "" }, { "parameters": [], "ccis": [], "objectives": [], "tests": [ { "id": 74812, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591413", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591413", "securityControlId": 32182, "ccis": [], "uuid": "1fa0ba56-29d1-58ec-870b-c8477fea59f9", "testId": "WEB-14_A01", "test": "the scope of publicly accessible systems is defined.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74813, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591413", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591413", "securityControlId": 32182, "ccis": [], "uuid": "2bbcfb58-ade1-579e-890e-3ae463b8e7da", "testId": "WEB-14_A02", "test": "publicly accessible systems containing sensitive / regulated data are identified.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74814, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591413", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591413", "securityControlId": 32182, "ccis": [], "uuid": "c1bf3608-5db6-573e-bca4-36f5886d7195", "testId": "WEB-14_A03", "test": "a capability exists to routinely review the content on publicly accessible systems for sensitive / regulated data and remove such information, if discovered.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null }, { "id": 74815, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:58.591413", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:58.591413", "securityControlId": 32182, "ccis": [], "uuid": "7bbe4a25-85a3-5b58-a96a-a9057fab1cee", "testId": "WEB-14_A04", "test": "a capability exists to expeditiously remove sensitive / regulated data from publicly accessible systems, if discovered.
PPTDF Applicability: Process
Assessment Rigor: 1", "otherId": "SCF Created", "defaultText": null } ], "externalMappings": [ { "id": 612805, "createdBy": null, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:54:02.591807", "lastUpdatedBy": null, "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "isPublic": true, "uuid": "dbdf8098-2de8-5da8-8258-530fb799096e", "parentControlId": 32182, "controlId": "03.01.22.b", "title": "03.01.22.b", "catalog": "NIST SP 800-171 R3", "mappingType": "Equivalent", "notes": "", "dateLastUpdated": "2026-04-12T18:54:02.591807" } ], "id": 32182, "isPublic": true, "createdById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateCreated": "2026-04-12T18:53:53.731387", "lastUpdatedById": "1afdd567-dc3f-474c-9f8d-541e6e0a2229", "dateLastUpdated": "2026-04-12T18:53:53.731387", "catalogueId": 1062, "uuid": "a2e2eb16-b004-5e27-bf6d-58121f04709f", "controlType": null, "subControls": "", "mappings": "", "assessmentPlan": "

SCF Control Question

Does the organization routinely review the content on publicly accessible systems for sensitive/regulated data and remove such information, if discovered?

Assessment Frequency

Annual", "practiceLevel": "", "weight": 7.0, "title": "Publicly Accessible Content Reviews", "description": "

Control Description

Mechanisms exist to routinely review the content on publicly accessible systems for sensitive/regulated data and remove such information, if discovered.

Evidence Request List (ERL)

E-DCH-12

SCR-CMM Maturity Model

Level 0 - Not Performed: Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 - Performed Informally: Web Security (WEB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:\n▪ Policies, standards & procedures associated with WEB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.\n▪ Web management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.

Level 2 - Planned & Tracked: SCR-CMM Level 2 criteria definitions are not available for this control:\n▪ A reasonable person would conclude a well-defined and standardized process is required.\n▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.\n▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 - Well Defined: Web Security (WEB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Policies and standards associated with WEB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.\n▪ Standardized Operating Procedures (SOP) associated with WEB domain capabilities are well-documented and kept current by process owners.\n▪ A web management team, or simiE210:E1635main capabilities.\n▪ Technology is leveraged to enhance the efficiency and accuracy of web management operations (e.g., secure web gateway, Content Management System (CMS) solution, etc.).\n▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with WEB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).\n▪ An implemented and operational capability exists to routinely review the content on publicly accessible systems for sensitive/regulated data and remove such information, if discovered.

Level 4 - Quantitatively Controlled: Web Security (WEB) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:\n▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.\n▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).\n▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).\n▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.\n▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).\n▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.\n▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 - Continuously Improving: Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:\n▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. \n▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.\n▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.", "controlId": "WEB-14", "family": "Web Security", "enhancements": "", "sortId": "WEB-14", "references": "

Micro-Small Business (<10 staff)

∙ Review public website content for accuracy and appropriateness regularly

Small Business (10-49 staff)

∙ Publicly accessible content review policy and schedule

Medium Business (50-249 staff)

∙ Formal content review program for public-facing web content

Large Business (250-999 staff)

∙ Enterprise content governance program\n∙ Regular content audits\n∙ Content accuracy review

Enterprise (>1,000 staff)

∙ Enterprise web content governance platform\n∙ Automated content monitoring\n∙ Regular content audits by stakeholders", "relatedControls": "", "otherId": "" }, { "uuid": "182adb7c-bb99-5c5d-87bf-4799ad9784fd", "title": "Safety, Security, and Emergency Preparedness (SSEP) Consequence & Pathway Analysis", "controlId": "NUC-01", "description": "

Control Description

Mechanisms exist to identify and document Critical Systems (CSs) and Critical Digital Assets (CDAs) associated with Safety-Related, Important-to-Safety (ITS), Security, Balance-of-Plant (BOP), and Emergency Preparedness (EP) functions by conducting unmitigated consequence, dependency, and physical/logical communication pathway analyses (including physical and electronic walkdowns).

Evidence Request List (ERL)

E-NUC-01; E-NUC-02

SCR-CMM Maturity Model

Level 1 - Performed Informally: CDA identification is performed ad-hoc.

Level 3 - Well Defined: Documented SSEP consequence and pathway analyses (per NRC RG 5.71 Rev. 1 and NEI 13-10) are maintained and verified via physical/electronic walkdowns.", "references": "10 CFR 73.54 | 10 CFR 73.77 | 10 CFR 73.58 | NRC RG 5.71 Rev. 1 | NEI 08-09 Rev. 6 | NEI 13-10 | IAEA NSS 17-T | IEC 62645", "relatedControls": "", "subControls": "", "enhancements": "", "family": "Asset Management", "mappings": "", "assessmentPlan": "

Control Question

Does the facility perform and document unmitigated SSEP consequence, dependency, and physical/electronic walkdown pathway analyses to identify all Critical Systems (CSs) and Critical Digital Assets (CDAs)?

Assessment Frequency

Annually or upon plant modification", "weight": 10.0, "practiceLevel": "Nuclear Critical Digital Asset (CDA) Baseline", "catalogueId": 0, "isPublic": true, "archived": false, "externalMappings": [ { "controlId": "A.3.1.3", "title": "A.3.1.3 — Identification of Critical Digital Assets", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "298ece2a-2453-5854-bff3-127164257a2f", "isPublic": true }, { "controlId": "A.3.1.4", "title": "A.3.1.4 — Reviews and Validation Testing (Walkdowns)", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "dd895d9e-bdd9-5c03-a674-ea030606939e", "isPublic": true }, { "controlId": "NEI 13-10 Sec 3", "title": "NEI 13-10 Sec 3 — CDA Direct vs. Indirect Consequence Categorization", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "7caaab9f-686b-5b02-b61b-bb8b8f56cdcf", "isPublic": true }, { "controlId": "10 CFR 73.54(a)(1), (b)(1)", "title": "10 CFR 73.54(a)(1), (b)(1) — Analysis of Digital Computer and Communication Systems", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "7416d338-c918-5860-b02e-e61ef00d5ac7", "isPublic": true }, { "controlId": "NSS-17T-Sec4.3", "title": "NSS-17T-Sec4.3 — Identification & Categorization of Digital Assets", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "3959b593-81d5-5278-87fd-8c1387caffdc", "isPublic": true }, { "controlId": "IEC-62645-5.3.3", "title": "IEC-62645-5.3.3 — I&C Security Degree Assignment (S1, S2, S3)", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "3a437879-6ef2-5ae5-8f58-86d5f8173155", "isPublic": true } ], "tests": [ { "uuid": "a7117d5f-c130-53e0-8178-d53bffc81282", "testId": "NUC-01-AO-01", "test": "Verify that: Does the facility perform and document unmitigated SSEP consequence, dependency, and physical/electronic walkdown pathway analyses to identify all Critical Systems (CSs) and Critical Digital Assets (CDAs)?", "otherId": "NUC-01", "defaultText": null } ] }, { "uuid": "80bbd795-7d3d-519a-8772-efd392e8f928", "title": "Nuclear Defense-in-Depth Security Levels & Deterministic Unidirectional Pathways (Data Diodes)", "controlId": "NUC-02", "description": "

Control Description

Mechanisms exist to establish a graded multi-level nuclear defensive architecture (e.g., Levels 4, 3, 2, 1, 0) where communication from higher-security zones (Safety/Security Level 4 and 3 CDAs) to lower-security zones is restricted strictly to hardware-enforced, deterministic unidirectional pathways (e.g., optical data diodes) that physically prevent reverse data flow, handshaking, or remote command execution.

Evidence Request List (ERL)

E-NUC-03

SCR-CMM Maturity Model

Level 1 - Performed Informally: Software firewalls separate plant and corporate networks.

Level 3 - Well Defined: Hardware-enforced optical data diodes isolate Level 4/3 CDAs from Level 2/1 networks in accordance with NRC RG 5.71 Rev. 1 (Appendix C.6/C.7) and RG 1.152 Rev. 4.", "references": "10 CFR 73.54 | 10 CFR 73.77 | 10 CFR 73.58 | NRC RG 5.71 Rev. 1 | NEI 08-09 Rev. 6 | NEI 13-10 | IAEA NSS 17-T | IEC 62645", "relatedControls": "", "subControls": "", "enhancements": "", "family": "Network Security", "mappings": "", "assessmentPlan": "

Control Question

Are Safety and Security CDAs (Levels 4 and 3) isolated from lower-security zones using hardware-enforced deterministic unidirectional communication devices (optical data diodes) with zero inbound electronic access?

Assessment Frequency

Continuous / Annually", "weight": 10.0, "practiceLevel": "Nuclear Critical Digital Asset (CDA) Baseline", "catalogueId": 0, "isPublic": true, "archived": false, "externalMappings": [ { "controlId": "C.6", "title": "C.6 — Defensive Strategy", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "82a9560d-020d-5925-b0e2-b644ebe6a175", "isPublic": true }, { "controlId": "C.7", "title": "C.7 — Defense-in-Depth Architecture (Levels 0-4)", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "33072471-1486-51c1-8d8f-7b2a8f4025aa", "isPublic": true }, { "controlId": "B.1.4", "title": "B.1.4 — Information Flow Enforcement", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "ec3a6d3a-26d7-510c-a892-4ae594f3e3d3", "isPublic": true }, { "controlId": "NEI 08-09 App E.7", "title": "NEI 08-09 App E.7 — Defensive Architecture & Unidirectional Boundary Protection", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "b024d84d-e3e2-5d1f-b417-77ef48f6ddc9", "isPublic": true }, { "controlId": "10 CFR 73.54(c)(2)", "title": "10 CFR 73.54(c)(2) — Defense-in-Depth Protective Strategies", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "045ac574-9530-5707-b43a-342f437357ee", "isPublic": true }, { "controlId": "NSS-17T-Sec5", "title": "NSS-17T-Sec5 — Computer Security Zones & Graded Defensive Levels", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "0fd47177-58b5-518f-a3c5-d13c33402437", "isPublic": true }, { "controlId": "IEC-62645-6.2", "title": "IEC-62645-6.2 — Deterministic Unidirectional Boundary Decoupling", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "IEC 62645 (Nuclear I&C Cybersecurity)", "uuid": "71719762-0119-59c7-a275-d2c174bf41d0", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.6", "title": "IEEE-7-4.3.2-5.6 — Independence Between Safety and Non-Safety Systems", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "ab248dde-d473-5287-b0d7-2ea17e2a02b5", "isPublic": true } ], "tests": [ { "uuid": "da469f15-a9c9-54a8-963a-6a652b267a94", "testId": "NUC-02-AO-01", "test": "Verify that: Are Safety and Security CDAs (Levels 4 and 3) isolated from lower-security zones using hardware-enforced deterministic unidirectional communication devices (optical data diodes) with zero inbound electronic access?", "otherId": "NUC-02", "defaultText": null } ] }, { "uuid": "9f53f2ac-77f6-5b8b-b405-c2687ea1df2c", "title": "Nuclear Safety-Security Interface & Plant Modification Screening (10 CFR 50.59 & 73.58)", "controlId": "NUC-03", "description": "

Control Description

Mechanisms exist to coordinate between nuclear safety/engineering and cybersecurity/physical security organizations prior to implementing plant modifications or cybersecurity controls to verify that security controls do not adversely impact nuclear safety or SSEP functions, and that engineering changes do not degrade the Cyber Security Plan, in accordance with 10 CFR 73.58 ('Safety/Security Interface Requirements') and 10 CFR 50.59.

Evidence Request List (ERL)

E-NUC-04", "references": "10 CFR 73.54 | 10 CFR 73.77 | 10 CFR 73.58 | NRC RG 5.71 Rev. 1 | NEI 08-09 Rev. 6 | NEI 13-10 | IAEA NSS 17-T | IEC 62645", "relatedControls": "", "subControls": "", "enhancements": "", "family": "Change Management", "mappings": "", "assessmentPlan": "

Control Question

Are all digital plant modifications and cybersecurity control changes evaluated under 10 CFR 73.58 (Safety/Security Interface) and 10 CFR 50.59 to ensure zero adverse impact on SSEP functions?

Assessment Frequency

Per engineering modification", "weight": 10.0, "practiceLevel": "Nuclear Critical Digital Asset (CDA) Baseline", "catalogueId": 0, "isPublic": true, "archived": false, "externalMappings": [ { "controlId": "A.3.1.6", "title": "A.3.1.6 — Application of Security Controls (No Adverse Impact on SSEP)", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "aaa8f9d8-8edf-5fe9-8217-889717bc8b63", "isPublic": true }, { "controlId": "A.4.2.2", "title": "A.4.2.2 — Security Impact Analysis of Changes and Environment", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "3e93aa60-0667-5d4e-95ef-835cb57542ca", "isPublic": true }, { "controlId": "C.11.5", "title": "C.11.5 — Security Impact Analysis of Changes and Environment", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "5a4d1c3e-de17-5ee3-af3c-d512082aa2b3", "isPublic": true }, { "controlId": "10 CFR 73.58 & 10 CFR 50.59", "title": "10 CFR 73.58 & 10 CFR 50.59 — Safety/Security Interface & Plant Modification Evaluation", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "600a92c3-f272-5490-b3f0-a1573d2daba4", "isPublic": true }, { "controlId": "NSS-17T-Sec6.2", "title": "NSS-17T-Sec6.2 — Safety-Security Interface Management", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "1b04fd32-db95-577c-9b4e-8c234923cac5", "isPublic": true }, { "controlId": "IEEE-7-4.3.2-5.3.6", "title": "IEEE-7-4.3.2-5.3.6 — Safety and Security Impact Analysis of Modifications", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "IEEE Std 7-4.3.2 (Nuclear Safety Digital Devices)", "uuid": "f8e90ff5-f7d9-5495-a2c0-b9ec015d20e5", "isPublic": true } ], "tests": [ { "uuid": "5c1ce057-5a7e-54a2-8e7b-a42080242e77", "testId": "NUC-03-AO-01", "test": "Verify that: Are all digital plant modifications and cybersecurity control changes evaluated under 10 CFR 73.58 (Safety/Security Interface) and 10 CFR 50.59 to ensure zero adverse impact on SSEP functions?", "otherId": "NUC-03", "defaultText": null } ] }, { "uuid": "a3c0a1f5-258a-5f33-a014-4a499f22bd82", "title": "Attack Vector & Attack Tree Equivalence Analysis for Alternate Countermeasures", "controlId": "NUC-04", "description": "

Control Description

Mechanisms exist to perform and document formal attack vector and attack tree analyses whenever a baseline technical security control (e.g., NRC RG 5.71 Appendix B) cannot be directly applied to a CDA, demonstrating either that the threat/attack vector does not exist or that alternative/compensating countermeasures provide equal or greater protection against Design Basis Threat (DBT) cyber adversaries.

Evidence Request List (ERL)

E-NUC-05", "references": "10 CFR 73.54 | 10 CFR 73.77 | 10 CFR 73.58 | NRC RG 5.71 Rev. 1 | NEI 08-09 Rev. 6 | NEI 13-10 | IAEA NSS 17-T | IEC 62645", "relatedControls": "", "subControls": "", "enhancements": "", "family": "Risk Management", "mappings": "", "assessmentPlan": "

Control Question

Does the Cyber Security Team (CST) document formal attack vector and attack tree analyses against the Design Basis Threat (DBT) before omitting a control or applying alternative countermeasures?

Assessment Frequency

Per control tailoring / Annually", "weight": 9.0, "practiceLevel": "Nuclear Critical Digital Asset (CDA) Baseline", "catalogueId": 0, "isPublic": true, "archived": false, "externalMappings": [ { "controlId": "A.3.1.6", "title": "A.3.1.6 — Application of Security Controls (Attack Vector/Tree Analysis)", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "06189038-71ff-5068-897b-913487b946a5", "isPublic": true }, { "controlId": "NEI 13-10 Sec 5", "title": "NEI 13-10 Sec 5 — Attack Vector & Alternate Control Equivalency Analysis", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "NEI 08-09 Rev. 6 & NEI 13-10", "uuid": "403ddaea-ab15-5edd-aaa8-015fff98a366", "isPublic": true }, { "controlId": "10 CFR 73.54(a)(2), (c)(1)", "title": "10 CFR 73.54(a)(2), (c)(1) — High Assurance Protection Against Design Basis Threat (DBT)", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "1e4d707b-6296-5059-8dfe-2f16a01a3f14", "isPublic": true }, { "controlId": "NSS-17T-Sec4.2", "title": "NSS-17T-Sec4.2 — Design Basis Threat (DBT) Cyber Risk & Attack Vector Assessment", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "IAEA NSS 17-T (Rev. 1) & NSS 42-G", "uuid": "a0f26ada-964f-560b-9d0d-c4ea36fa8f86", "isPublic": true } ], "tests": [ { "uuid": "49fe60c6-bd44-5b6e-9dd9-e5ba7c8c9d0a", "testId": "NUC-04-AO-01", "test": "Verify that: Does the Cyber Security Team (CST) document formal attack vector and attack tree analyses against the Design Basis Threat (DBT) before omitting a control or applying alternative countermeasures?", "otherId": "NUC-04", "defaultText": null } ] }, { "uuid": "8dc73479-e270-5c32-924d-353d52ebc593", "title": "Regulated Nuclear Cyber Event Notification & E-ISAC Reporting (1-Hour / 4-Hour / 8-Hour Timelines)", "controlId": "NUC-05", "description": "

Control Description

Mechanisms exist to evaluate, classify, and report cybersecurity events to nuclear and bulk electric system regulators within strict statutory timelines—including 1-hour notification for cyber attacks that adversely impact SSEP functions, 4-hour notification for cyber attacks that could impact SSEP or compromise defensive layers, 8-hour notification for intelligence/precursor activity, and 24-hour log recording per 10 CFR 73.77 (RG 5.83 Rev. 1 / NEI 15-09), as well as 1-hour DOE / E-ISAC / CISA reporting under NERC CIP-008-6.

Evidence Request List (ERL)

E-NUC-06", "references": "10 CFR 73.54 | 10 CFR 73.77 | 10 CFR 73.58 | NRC RG 5.71 Rev. 1 | NEI 08-09 Rev. 6 | NEI 13-10 | IAEA NSS 17-T | IEC 62645", "relatedControls": "", "subControls": "", "enhancements": "", "family": "Incident Response", "mappings": "", "assessmentPlan": "

Control Question

Are incident response procedures and operations center personnel trained and equipped to meet 1-hour, 4-hour, and 8-hour NRC Operations Center reporting timelines under 10 CFR 73.77 and NERC CIP-008-6?

Assessment Frequency

Per incident / Tested annually", "weight": 10.0, "practiceLevel": "Nuclear Critical Digital Asset (CDA) Baseline", "catalogueId": 0, "isPublic": true, "archived": false, "externalMappings": [ { "controlId": "C.8.6", "title": "C.8.6 — Incident Reporting (RG 5.83 Rev. 1 / 10 CFR 73.77)", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "U.S. NRC Regulatory Guide 5.71 (Rev. 1)", "uuid": "5ccdf217-5f00-5419-98ac-e5102fb2783d", "isPublic": true }, { "controlId": "10 CFR 73.77(a)(1)-(3)", "title": "10 CFR 73.77(a)(1)-(3) — 1-Hour, 4-Hour, and 8-Hour Cyber Security Event Notifications", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "10 CFR 73.54 / 73.77 / Part 53", "uuid": "cbb4325c-f16e-5209-baa1-291168ab8a12", "isPublic": true }, { "controlId": "CIP-008-6-R4", "title": "CIP-008-6-R4 — Incident Response Notification and Reporting to E-ISAC / NCCIC", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "NERC Critical Infrastructure Protection (CIP) (2026)", "uuid": "8c793f64-0336-55aa-9f47-dc38542bd237", "isPublic": true }, { "controlId": "REGDOC-2.12.1-Sec7", "title": "REGDOC-2.12.1-Sec7 — Cyber Security Incident Response and Regulatory Reporting", "mappingType": "Equivalent", "notes": "Nuclear-Specific Regulatory Requirement", "catalog": "CNSC REGDOC-2.12.1 Vol. II (Canada Nuclear)", "uuid": "902bb16c-66b4-5f48-b947-b604c0d257cf", "isPublic": true } ], "tests": [ { "uuid": "f8778372-53b4-5696-bf97-a7fa587b449c", "testId": "NUC-05-AO-01", "test": "Verify that: Are incident response procedures and operations center personnel trained and equipped to meet 1-hour, 4-hour, and 8-hour NRC Operations Center reporting timelines under 10 CFR 73.77 and NERC CIP-008-6?", "otherId": "NUC-05", "defaultText": null } ] } ], "evidenceRequests": [ { "uuid": "49f3105b-8794-59ff-a070-18ad0881c966", "erlNumber": "E-AST-01", "title": "IT Asset Management (ITAM)", "description": "Documented evidence of an IT Asset Management (ITAM) program that addresses the due diligence and due care activities associated with maintaining both secure, compliance and resilient Technology Assets, Applications and/or Services (TAAS).", "areaOfFocus": "Asset Management", "documentationArtifact": "IT Asset Management (ITAM)", "controlMappings": [ "AST-01", "AST-03", "AST-03.1", "AST-10", "CFG-05", "END-01", "IAC-01", "IAC-02.2", "MON-03", "MON-16.4" ] }, { "uuid": "5f1f9b7d-aabb-54f8-a643-350b74514260", "erlNumber": "E-AST-02", "title": "Asset Scoping Guidance", "description": "Documented evidence of an asset scoping guidance. This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on defining in-scope Technology Assets, Applications, Services and/or Data (TAASD) (including third-parties).", "areaOfFocus": "Asset Management", "documentationArtifact": "Asset Scoping Guidance", "controlMappings": [ "AST-04.1", "AST-04.2", "AST-04.3", "CPL-01.2", "IAO-01.1" ] }, { "uuid": "86d096b7-b68d-5665-9cfd-159447f601cb", "erlNumber": "E-AST-03", "title": "Asset Disposal Evidence", "description": "Documented evidence of asset disposal/destruction (e.g., asset tracking by serial # for shredding, degaussing, etc.).", "areaOfFocus": "Asset Management", "documentationArtifact": "Asset Disposal Evidence", "controlMappings": [ "AST-09", "DCH-08", "DCH-09", "DCH-09.1" ] }, { "uuid": "0e4635de-7ca2-5ac6-bb46-d34a77b3a5d0", "erlNumber": "E-AST-04", "title": "Asset Inventories - Hardware", "description": "Documented evidence of an inventory of the organization's technology hardware assets.", "areaOfFocus": "Asset Management", "documentationArtifact": "Asset Inventories - Hardware", "controlMappings": [ "AST-02" ] }, { "uuid": "acbcf868-86f6-5798-be82-6ef4e07106ea", "erlNumber": "E-AST-05", "title": "Asset Inventories - Software", "description": "Documented evidence of an inventory of the organization's software assets.", "areaOfFocus": "Asset Management", "documentationArtifact": "Asset Inventories - Software", "controlMappings": [ "AST-02" ] }, { "uuid": "be994c75-1253-5ed9-855d-f7c063089a70", "erlNumber": "E-AST-06", "title": "Asset Inventories - Cloud Service Provider (CSP)", "description": "Documented evidence of an inventory of the organization's cloud-based services (e.g., SaaS, IaaS, PaaS, etc.).", "areaOfFocus": "Asset Management", "documentationArtifact": "Asset Inventories - Cloud Service Provider (CSP)", "controlMappings": [ "CLD-01", "CLD-09", "TPM-01.1" ] }, { "uuid": "a20eedfd-53ac-5d7f-b2bc-1a0d86078d6f", "erlNumber": "E-AST-07", "title": "Cyber-Physical Systems (CPS)", "description": "Documented evidence of an inventory of the organization's physical assets that process functions based on software and networks.", "areaOfFocus": "Asset Management", "documentationArtifact": "Cyber-Physical Systems (CPS)", "controlMappings": [ "AST-02", "EMB-01" ] }, { "uuid": "65216219-f215-57f6-bc38-d0e26c6a310a", "erlNumber": "E-AST-08", "title": "Asset Inventories - Sensitive / Regulated Data", "description": "Documented evidence of an inventory of the organization's sensitive/regulated data (including systems where sensitive/regulated data is stored, processed and/or transmitted) that contains sufficient information to determine the potential impact in the event of a data loss incident.", "areaOfFocus": "Asset Management", "documentationArtifact": "Asset Inventories - Sensitive / Regulated Data", "controlMappings": [ "CLD-10", "DCH-01.3", "DCH-06.2", "BCD-11.2", "PRI-05.5" ] }, { "uuid": "d1f37510-bc0a-5241-bd91-2cd11850cdc9", "erlNumber": "E-AST-09", "title": "Computer Lifecycle Plan (CLP)", "description": "Documented evidence of a Computer Lifecycle Plan (CLP) that describes how the life of technology assets is managed.", "areaOfFocus": "Asset Management", "documentationArtifact": "Computer Lifecycle Plan (CLP)", "controlMappings": [ "SEA-07", "SEA-07.1", "TDA-17" ] }, { "uuid": "76d5102b-2f5d-5e1d-9be6-636538a63836", "erlNumber": "E-AST-10", "title": "Prohibited Equipment List (PEM)", "description": "Documented evidence of equipment identified by Federal Acquisition Regulation (FAR) section 889 prohibitions for certain telecommunications equipment.", "areaOfFocus": "Asset Management", "documentationArtifact": "Prohibited Equipment List (PEM)", "controlMappings": [ "AST-17" ] }, { "uuid": "e0f49549-80cb-58bd-8724-e5bd7132e2e1", "erlNumber": "E-AST-11", "title": "Data Retention Program", "description": "Documented evidence of a formal data retention program that governs the retention and destruction of data types.", "areaOfFocus": "Asset Management", "documentationArtifact": "Data Retention Program", "controlMappings": [ "DCH-18", "MON-10", "PRI-05" ] }, { "uuid": "000c9ca3-2260-579a-a2e7-249bcfa6a551", "erlNumber": "E-AST-12", "title": "Secure Baseline Configurations Reviews", "description": "Documented evidence of a review process to ensure Secure Baseline Configurations (SBC) are current and applicable (e.g., system configuration settings and associated documentation).", "areaOfFocus": "Asset Management", "documentationArtifact": "Secure Baseline Configurations Reviews", "controlMappings": [ "CFG-02", "CFG-02.1", "CFG-02.5", "CFG-03", "NET-04", "NET-04.1", "NET-04.6" ] }, { "uuid": "a56c1992-9c74-5d91-9bb1-98aaa24f2d04", "erlNumber": "E-AST-13", "title": "Secure Baseline Configurations - Cloud-Based Services", "description": "Documented evidence of secure baseline configurations for all deployed types of cloud-based services or applications.", "areaOfFocus": "Asset Management", "documentationArtifact": "Secure Baseline Configurations - Cloud-Based Services", "controlMappings": [ "CFG-02", "CFG-03", "CFG-02.5" ] }, { "uuid": "6c686965-f086-5afe-b49b-5269bb502dfb", "erlNumber": "E-AST-14", "title": "Secure Baseline Configurations - Databases", "description": "Documented evidence of secure baseline configurations for all deployed types of databases.", "areaOfFocus": "Asset Management", "documentationArtifact": "Secure Baseline Configurations - Databases", "controlMappings": [ "CFG-02", "CFG-03", "CFG-02.5" ] }, { "uuid": "fcf484b2-1af9-53e6-8b17-3ccfb4f0aa27", "erlNumber": "E-AST-15", "title": "Secure Baseline Configurations - Embedded Technologies", "description": "Documented evidence of secure baseline configurations for all deployed types of embedded technologies.", "areaOfFocus": "Asset Management", "documentationArtifact": "Secure Baseline Configurations - Embedded Technologies", "controlMappings": [ "CFG-02", "CFG-03", "CFG-02.5" ] }, { "uuid": "0016c708-3e04-5a40-81d8-e5114556444e", "erlNumber": "E-AST-16", "title": "Secure Baseline Configurations - Major Applications", "description": "Documented evidence of secure baseline configurations for all deployed types of major applications.", "areaOfFocus": "Asset Management", "documentationArtifact": "Secure Baseline Configurations - Major Applications", "controlMappings": [ "CFG-02", "CFG-03", "CFG-02.5" ] }, { "uuid": "42bb42e3-1cc5-58a5-8f1c-7f36be072c3a", "erlNumber": "E-AST-17", "title": "Secure Baseline Configurations - Minor Applications", "description": "Documented evidence of secure baseline configurations for all deployed types of minor applications.", "areaOfFocus": "Asset Management", "documentationArtifact": "Secure Baseline Configurations - Minor Applications", "controlMappings": [ "CFG-02", "CFG-03", "CFG-02.5" ] }, { "uuid": "55cb211f-a7c4-53bd-9347-a2948b1ee253", "erlNumber": "E-AST-18", "title": "Secure Baseline Configurations - Mobile Devices", "description": "Documented evidence of secure baseline configurations for all deployed types of mobile devices.", "areaOfFocus": "Asset Management", "documentationArtifact": "Secure Baseline Configurations - Mobile Devices", "controlMappings": [ "CFG-02", "CFG-03", "CFG-02.5" ] }, { "uuid": "54e585bb-b48f-52b6-a53f-7f0a5a6f78f6", "erlNumber": "E-AST-19", "title": "Secure Baseline Configurations - Network Devices", "description": "Documented evidence of secure baseline configurations for all deployed types of network devices.", "areaOfFocus": "Asset Management", "documentationArtifact": "Secure Baseline Configurations - Network Devices", "controlMappings": [ "CFG-02", "CFG-02.5", "CFG-03", "NET-04", "NET-04.1" ] }, { "uuid": "65d2de33-a5d1-54a1-8a4d-2023ec1f563f", "erlNumber": "E-AST-20", "title": "Secure Baseline Configurations - Server Class Systems", "description": "Documented evidence of secure baseline configurations for all deployed types of server-class operating systems.", "areaOfFocus": "Asset Management", "documentationArtifact": "Secure Baseline Configurations - Server Class Systems", "controlMappings": [ "CFG-02", "CFG-02.5", "CFG-03", "CFG-03.2" ] }, { "uuid": "b14a225c-fb1e-5dd5-b40d-368cd06f1588", "erlNumber": "E-AST-21", "title": "Secure Baseline Configurations - Workstation Class Systems", "description": "Documented evidence of secure baseline configurations for all deployed types of workstation-class operating systems.", "areaOfFocus": "Asset Management", "documentationArtifact": "Secure Baseline Configurations - Workstation Class Systems", "controlMappings": [ "CFG-02", "CFG-02.5", "CFG-03", "CFG-03.2", "CFG-05" ] }, { "uuid": "dd558708-427f-53ef-a2ec-c030e08111c6", "erlNumber": "E-AST-22", "title": "Provenance", "description": "Documented evidence that tracks the origin, development, ownership, location and changes to Technology Assets, Applications, Services and/or Data (TAASD).", "areaOfFocus": "Asset Management", "documentationArtifact": "Provenance", "controlMappings": [ "AST-03.2" ] }, { "uuid": "3915b060-dc70-57ef-82d9-dd68e95a03b5", "erlNumber": "E-AST-23", "title": "Geolocation Inventory", "description": "Documented evidence of designated internal and third-party facilities where organizational data is stored, transmitted and/or processed.", "areaOfFocus": "Asset Management", "documentationArtifact": "Geolocation Inventory", "controlMappings": [ "CLD-09", "DCH-19", "DCH-24" ] }, { "uuid": "15659d76-f88c-5a90-8b73-1bd67c118680", "erlNumber": "E-AST-24", "title": "Technology Assets, Applications, and/or Services (TAAS) Categorization", "description": "Documented evidence of a methodology to categorize Technology Assets, Applications, and/or Services (TAAS) (e.g., criticality and data classification considerations)", "areaOfFocus": "Asset Management", "documentationArtifact": "Technology Assets, Applications, and/or Services (TAAS) Categorization", "controlMappings": [ "AST-31" ] }, { "uuid": "08950b77-3951-54c7-800d-8b9e3bf26d15", "erlNumber": "E-AST-25", "title": "Logical Tamper Detection Tool", "description": "Documented evidence of software that is implemented and configured to detect logical tampering (e.g., configurations).", "areaOfFocus": "Asset Management", "documentationArtifact": "Logical Tamper Detection Tool", "controlMappings": [ "AST-15" ] }, { "uuid": "1764465d-85b0-5b82-b89f-6c2261402788", "erlNumber": "E-AST-26", "title": "Roots of Trust Evidence", "description": "Documented evidence of product supplier data that can be used as a “roots of trust” basis for integrity verification.", "areaOfFocus": "Asset Management", "documentationArtifact": "Roots of Trust Evidence", "controlMappings": [ "AST-18" ] }, { "uuid": "daa15a4a-7881-58c7-8837-9af292079a45", "erlNumber": "E-AST-27", "title": "Configuration Management", "description": "Documented evidence of standardized configuration management practices.", "areaOfFocus": "Asset Management", "documentationArtifact": "Configuration Management", "controlMappings": [ "CFG-01" ] }, { "uuid": "ba8b3be5-2920-5c29-988b-84fc1d3dafd9", "erlNumber": "E-AST-28", "title": "Software Licenses", "description": "Documented evidence of software license inventories.", "areaOfFocus": "Asset Management", "documentationArtifact": "Software Licenses", "controlMappings": [ "AST-02" ] }, { "uuid": "688a8f5b-8c83-5aaf-b1a4-7b98a58eaad6", "erlNumber": "E-AST-30", "title": "System Events To Be Logged", "description": "Documented evidence of the justification for certain system events to be logged.", "areaOfFocus": "Asset Management", "documentationArtifact": "System Events To Be Logged", "controlMappings": [ "MON-01.16" ] }, { "uuid": "ea314b0b-a15e-510b-8c03-3363853dd4cf", "erlNumber": "E-AST-31", "title": "Allowlist / Denylist", "description": "Documented evidence of software applications that are explicitly allowed (allowlist / whitelist) and/or blocked (denylist / blacklist).", "areaOfFocus": "Asset Management", "documentationArtifact": "Allowlist / Denylist", "controlMappings": [ "CFG-03.3" ] }, { "uuid": "a6474c56-6cb3-5558-a31b-b55346c98a68", "erlNumber": "E-AST-32", "title": "Mobile Code", "description": "Documented evidence of mobile code that is explicitly allowed (allowlist / whitelist) and/or blocked (denylist / blacklist).", "areaOfFocus": "Asset Management", "documentationArtifact": "Mobile Code", "controlMappings": [ "END-10" ] }, { "uuid": "1e6f16ef-6100-5e8d-8445-98284c36fc96", "erlNumber": "E-AST-33", "title": "Tailored Baselines", "description": "Documented evidence exists for tailored baseline configurations to address unique business and/or technical requirements (e.g., kiosk, hazardous environments, etc.).", "areaOfFocus": "Asset Management", "documentationArtifact": "Tailored Baselines", "controlMappings": [ "AST-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.9" ] }, { "uuid": "821bd039-cae3-5112-8781-1b5644742fb9", "erlNumber": "E-BCM-01", "title": "Continuity of Operations Plan (COOP)", "description": "Documented evidence of a Continuity of Operations Plan (COOP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. This involves internal and external stakeholders for incident response, disaster recovery and business continuity support requirements.", "areaOfFocus": "Business Continuity", "documentationArtifact": "Continuity of Operations Plan (COOP)", "controlMappings": [ "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.6", "BCD-01.7", "BCD-02.1", "SEA-01.2" ] }, { "uuid": "bbdb0c2e-64f0-5e6c-beac-12bb6d6b651a", "erlNumber": "E-BCM-02", "title": "Recovery Time Objectives (RTOs)", "description": "Documented evidence of Recovery Time Objectives (RTOs) that guide Continuity of Operations Plan (COOP)-related operations.", "areaOfFocus": "Business Continuity", "documentationArtifact": "Recovery Time Objectives (RTOs)", "controlMappings": [ "BCD-01.4" ] }, { "uuid": "fabb69fe-e77d-57d7-83f5-259b1b4b50b0", "erlNumber": "E-BCM-03", "title": "Recovery Point Objectives (RPOs)", "description": "Documented evidence of Recovery Point Objectives (RPOs) that guide Continuity of Operations Plan (COOP)-related operations.", "areaOfFocus": "Business Continuity", "documentationArtifact": "Recovery Point Objectives (RPOs)", "controlMappings": [ "BCD-01.4" ] }, { "uuid": "cc43249d-4863-5121-82ae-3f20dcf00522", "erlNumber": "E-BCM-04", "title": "COOP Root Cause Analysis (RCA)", "description": "Documented evidence of a Root Cause Analysis (RCA) from any Continuity of Operations Plan (COOP)-related training, testing or incident.", "areaOfFocus": "Business Continuity", "documentationArtifact": "COOP Root Cause Analysis (RCA)", "controlMappings": [ "BCD-05" ] }, { "uuid": "15ef79ec-89e1-550b-9010-7df7a46be522", "erlNumber": "E-BCM-05", "title": "COOP Updates", "description": "Documented evidence of a periodic review process for the organization's Continuity of Operations Plan (COOP) to identify necessary updates.", "areaOfFocus": "Business Continuity", "documentationArtifact": "COOP Updates", "controlMappings": [ "BCD-06" ] }, { "uuid": "a415969b-62ee-5a83-b243-1dcb32fd7bee", "erlNumber": "E-BCM-06", "title": "COOP Testing", "description": "Documented evidence of a Continuity of Operations Plan (COOP)-related testing activity.", "areaOfFocus": "Business Continuity", "documentationArtifact": "COOP Testing", "controlMappings": [ "BCD-03.1", "BCD-04" ] }, { "uuid": "14ce6e0e-779e-5bb2-b33c-0b6dddec1202", "erlNumber": "E-BCM-07", "title": "COOP Training", "description": "Documented evidence of a Continuity of Operations Plan (COOP)-related training activity.", "areaOfFocus": "Business Continuity", "documentationArtifact": "COOP Training", "controlMappings": [ "BCD-03", "BCD-04" ] }, { "uuid": "e192a8b2-4c61-5974-9495-0faf57ca6551", "erlNumber": "E-BCM-08", "title": "COOP Criticality Analysis", "description": "Documented evidence of a Continuity of Operations Plan (COOP)-related criticality analysis.", "areaOfFocus": "Business Continuity", "documentationArtifact": "COOP Criticality Analysis", "controlMappings": [ "BCD-02", "TDA-06.1" ] }, { "uuid": "54af466a-fa4d-58c1-b52b-84d24e950ad6", "erlNumber": "E-BCM-09", "title": "COOP Dependency Analysis", "description": "Documented evidence of a Continuity of Operations Plan (COOP)-related dependency analysis for Technology Assets, Applications, Services and/or Data (TAASD) (including facilities and third-parties).", "areaOfFocus": "Business Continuity", "documentationArtifact": "COOP Dependency Analysis", "controlMappings": [ "AST-01.1", "RSK-02", "RSK-02.1" ] }, { "uuid": "b7f8cf7c-f76a-5566-96db-101b06b0be11", "erlNumber": "E-BCM-10", "title": "Backups", "description": "Documented evidence of a Continuity of Operations Plan (COOP)-related data backup scheme that demonstrates the methods of data backup (including protection measures) for all data types to ensure business continuity requirements.", "areaOfFocus": "Business Continuity", "documentationArtifact": "Backups", "controlMappings": [ "BCD-11", "BCD-11.1" ] }, { "uuid": "7e9da05a-5b9a-5ba0-a8f1-a278b687012b", "erlNumber": "E-BCM-11", "title": "Backups - Local", "description": "Documented evidence of event logs for the on-site / local data backup solution.", "areaOfFocus": "Business Continuity", "documentationArtifact": "Backups - Local", "controlMappings": [ "BCD-11", "BCD-11.2" ] }, { "uuid": "104968e2-b29a-5ea5-80b7-773afc8e1f5d", "erlNumber": "E-BCM-12", "title": "Backups - Remote", "description": "Documented evidence of event logs for the off-site / remote data backup solution.", "areaOfFocus": "Business Continuity", "documentationArtifact": "Backups - Remote", "controlMappings": [ "BCD-11", "BCD-11.2", "BCD-11.6" ] }, { "uuid": "f32df40b-a4c6-5e92-8adf-b1ca981a5fcc", "erlNumber": "E-BCM-13", "title": "Backups - Recovery Activities", "description": "Documented evidence of recovery activities (successful and failed).", "areaOfFocus": "Business Continuity", "documentationArtifact": "Backups - Recovery Activities", "controlMappings": [ "BCD-11", "BCD-11.1" ] }, { "uuid": "24d9eaef-5d89-5cce-9540-0f3da632647e", "erlNumber": "E-BCM-14", "title": "Recovery Operations Criteria", "description": "Documented evidence of specific criteria to activate Business Continuity / Disaster Recovery (BC/DR) plans.", "areaOfFocus": "Business Continuity", "documentationArtifact": "Recovery Operations Criteria", "controlMappings": [ "BCD-01.5" ] }, { "uuid": "df0d1f7b-a618-599a-bc9d-d02bf42e3025", "erlNumber": "E-BCM-15", "title": "Restoration Events", "description": "Documented evidence of system, application and/or data recovery events. This can include random testing of data backups to ensure recovery methods are viable.", "areaOfFocus": "Business Continuity", "documentationArtifact": "Restoration Events", "controlMappings": [ "BCD-11.5", "BCD-12" ] }, { "uuid": "433f241c-8157-5f01-a6c5-8795511c76c2", "erlNumber": "E-BCM-16", "title": "Encrypted Backup Media", "description": "Documented evidence of backup media being encrypted.", "areaOfFocus": "Business Continuity", "documentationArtifact": "Encrypted Backup Media", "controlMappings": [ "BCD-11.4" ] }, { "uuid": "7913724c-05d0-5c01-92d6-fcebf715d8f3", "erlNumber": "E-BCM-17", "title": "Designated Alternative Decision Makers", "description": "Documented evidence of personnel being assigned with decision-making authority if the primary decision maker is unable to communicate due to adverse conditions.", "areaOfFocus": "Business Continuity", "documentationArtifact": "Designated Alternative Decision Makers", "controlMappings": [ "BCD-06.1" ] }, { "uuid": "b624c75c-aebc-5285-94c7-7f92387abd94", "erlNumber": "E-CAP-01", "title": "Capacity Planning", "description": "Documented evidence of proactive capacity planning to meet expected and anticipated future technology-related capacity and/or performance requirements.", "areaOfFocus": "Capacity Management", "documentationArtifact": "Capacity Planning", "controlMappings": [ "CAP-01", "CAP-03" ] }, { "uuid": "2dffcca9-2067-5dd6-9528-6f37e3b96649", "erlNumber": "E-CAP-02", "title": "Resource Prioritization", "description": "Documented evidence of resource prioritization to maintain business performance requirements for critical Technology Assets, Applications, Services and/or Data (TAASD) (including facilities and third-parties).", "areaOfFocus": "Capacity Management", "documentationArtifact": "Resource Prioritization", "controlMappings": [ "CAP-02" ] }, { "uuid": "33137f18-46bf-5ecd-bd72-bac946a5f86c", "erlNumber": "E-CAP-03", "title": "Technology Performance Monitoring", "description": "Documented evidence of performance monitoring for technology-related capacity and/or performance criteria.", "areaOfFocus": "Capacity Management", "documentationArtifact": "Technology Performance Monitoring", "controlMappings": [ "CAP-04" ] }, { "uuid": "fee532bc-f62e-5765-b0e8-d3c85ea491d5", "erlNumber": "E-CAP-04", "title": "Dynamic Expansion Capabilities", "description": "Documented evidence of dynamic expansion capabilities (e.g., elastic expansion) to meet capacity and/or performance requirements for critical Technology Assets, Applications and/or Services (TAAS).", "areaOfFocus": "Capacity Management", "documentationArtifact": "Dynamic Expansion Capabilities", "controlMappings": [ "CAP-05" ] }, { "uuid": "462cec17-7b5e-50da-bc42-d34abf55e76e", "erlNumber": "E-CHG-01", "title": "Business Impact Analysis (BIA)", "description": "Documented evidence of a Business Impact Analysis (BIA) for proposed changes.", "areaOfFocus": "Change Management", "documentationArtifact": "Business Impact Analysis (BIA)", "controlMappings": [ "RSK-08", "TDA-06.1" ] }, { "uuid": "5593a5f2-02e3-5bdc-b0bd-690a535ae64d", "erlNumber": "E-CHG-02", "title": "Charter - Change Control Board (CCB)", "description": "Documented evidence of the organization's Change Control Board (CCB) charter and mission to govern the organization's change control processes.", "areaOfFocus": "Change Management", "documentationArtifact": "Charter - Change Control Board (CCB)", "controlMappings": [ "CHG-01", "CHG-02", "CHG-02.1" ] }, { "uuid": "24fd536e-d4db-5cfa-a0ab-c498f298ce50", "erlNumber": "E-CHG-03", "title": "Change Control Board (CCB) Minutes", "description": "Documented evidence of Change Control Board (CCB) meeting minutes", "areaOfFocus": "Change Management", "documentationArtifact": "Change Control Board (CCB) Minutes", "controlMappings": [ "CHG-02.2" ] }, { "uuid": "a89b8406-d667-5208-a3f0-97becece1f27", "erlNumber": "E-CHG-04", "title": "Evidence of Cybersecurity / Data Privacy Reviews", "description": "Documented evidence of Change Control Board (CCB) meeting-related security, compliance and/or resilience reviews for proposed change(s).", "areaOfFocus": "Change Management", "documentationArtifact": "Evidence of Cybersecurity / Data Privacy Reviews", "controlMappings": [ "CHG-02.3", "CHG-03" ] }, { "uuid": "e527f884-ffc5-541a-a9e1-d37a088cf448", "erlNumber": "E-CHG-05", "title": "Change Control Records", "description": "Documented evidence of change control records (including test results, when applicable).", "areaOfFocus": "Change Management", "documentationArtifact": "Change Control Records", "controlMappings": [ "CHG-02", "CHG-02.2" ] }, { "uuid": "f4df699b-0d0e-5db0-8e54-0b833c2b67a1", "erlNumber": "E-CHG-06", "title": "Stakeholder Notification of Changes", "description": "Documented evidence of stakeholder notification communications for proposed changes.", "areaOfFocus": "Change Management", "documentationArtifact": "Stakeholder Notification of Changes", "controlMappings": [ "CHG-05" ] }, { "uuid": "2a725ad6-60b2-5f27-aaa5-e76b43b26d31", "erlNumber": "E-CPL-01", "title": "Statutory, Regulatory & Contractual Obligations", "description": "Documented evidence of applicable statutory, regulatory and/or contractual obligations for cybersecurity & data privacy controls.", "areaOfFocus": "Compliance", "documentationArtifact": "Statutory, Regulatory & Contractual Obligations", "controlMappings": [ "CPL-01", "MON-03" ] }, { "uuid": "bea6d4aa-e3c7-578c-a99f-992337dd7a67", "erlNumber": "E-CPL-02", "title": "Defined Compliance Scope (DCS)", "description": "Documented evidence of a formal scoping document that identifies applicable statutory, regulatory and/or contractual obligations for the organization. Defines the affected Lines of Business (LOB), internal / external stakeholders and facilities for the specific scope of compliance obligations.", "areaOfFocus": "Compliance", "documentationArtifact": "Defined Compliance Scope (DCS)", "controlMappings": [ "AST-04.1", "AST-04.2", "AST-04.3", "CPL-01.2" ] }, { "uuid": "ac12955e-964b-5e4b-b6bb-dbec161b8b37", "erlNumber": "E-CPL-03", "title": "Shared Responsibility Matrix (SRM) / Controls Responsibility Matrix (CRM)", "description": "Documented evidence of a Controls Responsibility Matrix (CRM), or similar documentation, that identifies the stakeholder involved in executing assigned controls (e.g., Responsible, Accountable, Supportive, Consulted & Informed (RASCI) matrix).", "areaOfFocus": "Compliance", "documentationArtifact": "Shared Responsibility Matrix (SRM) / Controls Responsibility Matrix (CRM)", "controlMappings": [ "AST-01.2", "AST-03", "CLD-06.1", "TPM-05.4" ] }, { "uuid": "5f496908-1a36-5dc6-9263-957a55881dc3", "erlNumber": "E-CPL-04", "title": "Internal Audit (IA)", "description": "Documented evidence of an Internal Audit (IA) capability.", "areaOfFocus": "Compliance", "documentationArtifact": "Internal Audit (IA)", "controlMappings": [ "CPL-02.1" ] }, { "uuid": "cef6e9ff-6fe8-58af-8cb3-fcccc159f295", "erlNumber": "E-CPL-05", "title": "Internal Audit (IA) Findings", "description": "Documented evidence of a centrally-managed and prioritized repository Internal Audit (IA) findings.", "areaOfFocus": "Compliance", "documentationArtifact": "Internal Audit (IA) Findings", "controlMappings": [ "CPL-01.1", "CPL-03", "GOV-01.2" ] }, { "uuid": "47461005-f7b6-58a8-9c86-5e045dfaf508", "erlNumber": "E-CPL-06", "title": "Manufacturer Disclosure Statement for Medical Device Security (MDS2)", "description": "Documented Manufacturer Disclosure Statement for Medical Device Security (MDS2) that communicates information about medical device cybersecurity & data privacy characteristics to current device owners and potential buyers. [note MDS2 is specific to medical device manufacturers]", "areaOfFocus": "Compliance", "documentationArtifact": "Manufacturer Disclosure Statement for Medical Device Security (MDS2)", "controlMappings": [ "TDA-01.1", "TDA-02.1", "TDA-04", "TDA-04.1", "TPM-04", "TPM-04.2" ] }, { "uuid": "3116ab8e-06a5-55c0-ab8d-483cc8674a60", "erlNumber": "E-CPL-07", "title": "Control Assessments", "description": "Documented evidence of internal or third-party control assessments to provide governance oversight of cybersecurity & data privacy controls.", "areaOfFocus": "Compliance", "documentationArtifact": "Control Assessments", "controlMappings": [ "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1" ] }, { "uuid": "3930ba6a-d823-55fb-8e3f-95fbe513a485", "erlNumber": "E-CPL-08", "title": "Functional Review of Cybersecurity Controls", "description": "Documented evidence of control testing to ensure cybersecurity controls function as expected.", "areaOfFocus": "Compliance", "documentationArtifact": "Functional Review of Cybersecurity Controls", "controlMappings": [ "CPL-03.2" ] }, { "uuid": "b2b4f185-b9f4-5b35-8019-e08862a1eb10", "erlNumber": "E-CPL-09", "title": "Non-Compliance Oversight Reporting", "description": "Documented evidence of governance oversight reporting of non-compliance to the organization's executive leadership.", "areaOfFocus": "Compliance", "documentationArtifact": "Non-Compliance Oversight Reporting", "controlMappings": [ "CPL-02", "GOV-01.2" ] }, { "uuid": "9551ac92-bb1b-5178-b5db-bf4fa4e173f9", "erlNumber": "E-CRY-01", "title": "Cryptographic Protections", "description": "Documented evidence of organization-approved cryptographic solutions and modules for both data at rest and in transit.", "areaOfFocus": "Cryptographic Protections", "documentationArtifact": "Cryptographic Protections", "controlMappings": [ "CRY-01", "CRY-03", "CRY-04", "CRY-05", "CRY-09", "CRY-09.1", "CRY-09.2", "DCH-01", "DCH-01.2" ] }, { "uuid": "3635216f-2151-5d7e-9fd6-f5c285875240", "erlNumber": "E-CRY-02", "title": "Cryptographic Key Management", "description": "Documented evidence of cryptographic key management practices.", "areaOfFocus": "Cryptographic Protections", "documentationArtifact": "Cryptographic Key Management", "controlMappings": [ "CRY-09" ] }, { "uuid": "cb606acd-2be4-554d-ab07-bcd2f650a824", "erlNumber": "E-DCH-01", "title": "Data Classification Scheme", "description": "Documented evidence of an organization-specific data classification scheme.", "areaOfFocus": "Data Protection", "documentationArtifact": "Data Classification Scheme", "controlMappings": [ "AST-04.1", "DCH-02" ] }, { "uuid": "06af46dc-10b6-5361-95bb-b3f72a185b8f", "erlNumber": "E-DCH-02", "title": "Data Handling Practices", "description": "Documented evidence of an organization-specific data handling practices (e.g., guidance specific the data classification scheme).", "areaOfFocus": "Data Protection", "documentationArtifact": "Data Handling Practices", "controlMappings": [ "AST-04.1", "DCH-01.1", "DCH-01.2", "DCH-01.4", "DCH-02", "DCH-06" ] }, { "uuid": "07b04731-731e-5108-b5f1-c4801f20b938", "erlNumber": "E-DCH-03", "title": "Network Diagram - Global System View (GSV)", "description": "Documented evidence of a high-level network diagram that provides a conceptual, logical depiction of the network(s) to describe the interconnections of the systems/applications/services, including internal and external interfaces.", "areaOfFocus": "Data Protection", "documentationArtifact": "Network Diagram - Global System View (GSV)", "controlMappings": [ "AST-04", "NET-02" ] }, { "uuid": "35d0d386-1f65-52bb-b4bd-1e2e670e701a", "erlNumber": "E-DCH-04", "title": "Network Diagram - Low Level", "description": "Documented evidence of a low-level network diagram that provides a detailed, logical depiction of assets on the network(s).", "areaOfFocus": "Data Protection", "documentationArtifact": "Network Diagram - Low Level", "controlMappings": [ "AST-04", "NET-02" ] }, { "uuid": "11afc694-ceaf-569b-87e6-c5d1ec3d0408", "erlNumber": "E-DCH-05", "title": "Data Flow Diagram (DFD)", "description": "Documented evidence of a Data Flow Diagram (DFD) that accurately identifies where sensitive/regulated data is stored, transmitted and/or processed.", "areaOfFocus": "Data Protection", "documentationArtifact": "Data Flow Diagram (DFD)", "controlMappings": [ "AST-02.8", "AST-04", "NET-02" ] }, { "uuid": "173dbe13-0c70-56d0-bb4f-08a5c62488f1", "erlNumber": "E-DCH-06", "title": "Third-Party Inventories", "description": "Documented evidence of an inventory of External Service Providers (ESP), contractors, vendors, etc. that directly or indirectly impact the organization's Technology Assets, Applications, Services and/or Data (TAASD).", "areaOfFocus": "Data Protection", "documentationArtifact": "Third-Party Inventories", "controlMappings": [ "TPM-01.1" ] }, { "uuid": "05d7fe94-b7a5-590a-852b-1b7a05482a31", "erlNumber": "E-DCH-07", "title": "Media Sanitization Documentation", "description": "Documented evidence of media sanitization actions.", "areaOfFocus": "Data Protection", "documentationArtifact": "Media Sanitization Documentation", "controlMappings": [ "DCH-09", "DCH-09.1" ] }, { "uuid": "93093a1b-8480-5a82-8375-244c652345d0", "erlNumber": "E-DCH-08", "title": "Authorization Documentation", "description": "Documented evidence of that identifies authorized users and processes acting on behalf of authorized users.", "areaOfFocus": "Data Protection", "documentationArtifact": "Authorization Documentation", "controlMappings": [ "CFG-08", "DCH-01.4" ] }, { "uuid": "550b8838-4ded-5ad6-b432-311ed5744d9b", "erlNumber": "E-DCH-09", "title": "Assigned Responsibilities", "description": "Documented evidence of data stewardship being assigned and communicated to individuals entrusted with sensitive and/or regulated data.", "areaOfFocus": "Data Protection", "documentationArtifact": "Assigned Responsibilities", "controlMappings": [ "CRY-01", "DCH-01.1", "DCH-14" ] }, { "uuid": "f787f0aa-da1f-5e44-8a36-83a59f4d0471", "erlNumber": "E-DCH-10", "title": "Structured & Unstructured Data Reviews", "description": "Documented evidence of a capability to review and/or scan data repositories (structured or unstructured) for instances of sensitive and/or regulated data.", "areaOfFocus": "Data Protection", "documentationArtifact": "Structured & Unstructured Data Reviews", "controlMappings": [ "DCH-06.3" ] }, { "uuid": "256e601e-5fec-5ddf-aec9-00a35d60a8b0", "erlNumber": "E-DCH-11", "title": "Authorized Users To Post Publicly Accessible Content", "description": "Documented evidence of list of users authorized to post publicly accessible content on organizational systems.", "areaOfFocus": "Data Protection", "documentationArtifact": "Authorized Users To Post Publicly Accessible Content", "controlMappings": [ "HRS-05.2" ] }, { "uuid": "9ad65724-b513-545f-952c-3d1bec4a9787", "erlNumber": "E-DCH-12", "title": "Publicly Accessible Information Reviews", "description": "Documented evidence of reviews for publicly accessible sensitive / regulated data.", "areaOfFocus": "Data Protection", "documentationArtifact": "Publicly Accessible Information Reviews", "controlMappings": [ "DCH-15", "WEB-14" ] }, { "uuid": "46d39e33-b363-59e8-b965-2680baa49b45", "erlNumber": "E-DCH-13", "title": "Media Storage Facilities", "description": "Documented evidence of media storage facilities.", "areaOfFocus": "Data Protection", "documentationArtifact": "Media Storage Facilities", "controlMappings": [ "BCD-01.3", "DCH-06" ] }, { "uuid": "f5522b59-166e-5274-abe1-0041df08482c", "erlNumber": "E-DCH-14", "title": "Media Transportation Records", "description": "Documented evidence of media transportation records.", "areaOfFocus": "Data Protection", "documentationArtifact": "Media Transportation Records", "controlMappings": [ "DCH-07" ] }, { "uuid": "f30d8954-6851-5e2a-8f05-e74eaa4a31e4", "erlNumber": "E-DCH-15", "title": "Geolocation Restrictions", "description": "Documented evidence of geolocation restrictions placed on specific types of sensitive and/or regulated data for where that data can be stored and/or processed.", "areaOfFocus": "Data Protection", "documentationArtifact": "Geolocation Restrictions", "controlMappings": [ "CLD-09" ] }, { "uuid": "da5b2607-0a89-54c9-8bd6-817652f56675", "erlNumber": "E-END-01", "title": "Endpoint Security Tools", "description": "Documented evidence of endpoint security tools employed by the organization to ensure secure, compliant and resilient Technology Assets, Applications and/or Services (TAAS) (e.g., antimalware, FIM, etc.).", "areaOfFocus": "Endpoint Security", "documentationArtifact": "Endpoint Security Tools", "controlMappings": [ "END-01", "END-04", "END-06" ] }, { "uuid": "ada1d368-71fb-554a-809e-31d15db1171d", "erlNumber": "E-END-02", "title": "Malware Tool Updates", "description": "Documented evidence of malicious code protection updates.", "areaOfFocus": "Endpoint Security", "documentationArtifact": "Malware Tool Updates", "controlMappings": [ "END-04.1" ] }, { "uuid": "e61db365-47c4-5a1b-a06e-50328b9a6985", "erlNumber": "E-END-03", "title": "Antimalware Scanning Results", "description": "Documented evidence of scan results from malicious code protection mechanisms.", "areaOfFocus": "Endpoint Security", "documentationArtifact": "Antimalware Scanning Results", "controlMappings": [ "END-04.3", "MON-01.4" ] }, { "uuid": "32dcd800-141c-5e3e-9448-5ace9e9068b5", "erlNumber": "E-GOV-01", "title": "Charter - Cybersecurity Program", "description": "Documented evidence of a charter to establish and resource the organization's cybersecurity program.", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Charter - Cybersecurity Program", "controlMappings": [ "GOV-01" ] }, { "uuid": "942ab52e-02a3-53e5-b225-155529026110", "erlNumber": "E-GOV-02", "title": "Charter - Data Privacy Program", "description": "Documented evidence of a charter to establish and resource the organization's data privacy program.", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Charter - Data Privacy Program", "controlMappings": [ "GOV-01", "PRI-01" ] }, { "uuid": "613c124e-209d-54e4-ac79-eaa3ef2c03ee", "erlNumber": "E-GOV-03", "title": "Charter - Cybersecurity Steering Committee", "description": "Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of cybersecurity management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives.", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Charter - Cybersecurity Steering Committee", "controlMappings": [ "GOV-01.1", "GOV-01.2" ] }, { "uuid": "9b2b567a-b390-5689-918d-90779217e4cf", "erlNumber": "E-GOV-04", "title": "Charter - Data Privacy Steering Committee", "description": "Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of privacy management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives.", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Charter - Data Privacy Steering Committee", "controlMappings": [ "GOV-01.2", "CPL-02" ] }, { "uuid": "12cae70c-e021-560c-ac48-de16bdb148f6", "erlNumber": "E-GOV-05", "title": "Charter - Audit Committee", "description": "Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of internal and external audit management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives.", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Charter - Audit Committee", "controlMappings": [ "GOV-01.2", "CPL-02" ] }, { "uuid": "56ef450a-9a3a-59b4-bbf8-4982ed887354", "erlNumber": "E-GOV-06", "title": "Charter - Risk Committee", "description": "Documented evidence of an executive steering committee, or advisory board, that is formed to perform oversight of risk management decisions and is comprised of key cybersecurity, technology, risk, privacy and business executives.", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Charter - Risk Committee", "controlMappings": [ "GOV-01.2", "CPL-02" ] }, { "uuid": "b3088ccb-a07e-5dcd-8af8-ab80984bbf7c", "erlNumber": "E-GOV-07", "title": "Charter - Data Management Board (DMB)", "description": "Documented evidence of the organization's Data Management Board (DMB) charter and mission.", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Charter - Data Management Board (DMB)", "controlMappings": [ "GOV-01.2" ] }, { "uuid": "77017887-c5f0-5585-9e19-acbb576cb7a0", "erlNumber": "E-GOV-08", "title": "Cybersecurity & Data Protection Policies", "description": "Documented evidence of an appropriately-scoped cybersecurity & data protection policies. Policies are high-level statements of management intent from an organization's executive leadership that are designed to influence decisions and guide the organization to achieve the desired outcomes. Policies are enforced by standards and further implemented by procedures to establish actionable and accountable requirements.", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Cybersecurity & Data Protection Policies", "controlMappings": [ "GOV-02", "PRI-01" ] }, { "uuid": "249f093b-248b-582d-8774-afcaf42ec43c", "erlNumber": "E-GOV-09", "title": "Cybersecurity & Data Protection Standards", "description": "Documented evidence of an appropriately-scoped cybersecurity & data protection standards. Standards are mandatory requirements regarding processes, actions and configurations. Standards are intended to be granular and prescriptive to ensure Technology Assets, Applications and/or Services (TAAS) are designed and operated to include appropriate cybersecurity & data protection protections", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Cybersecurity & Data Protection Standards", "controlMappings": [ "GOV-02" ] }, { "uuid": "05de949d-bc94-5daa-86a5-d9dd7815b9e9", "erlNumber": "E-GOV-10", "title": "Cybersecurity & Data Protection Controls", "description": "Documented evidence of an appropriately-scoped cybersecurity & data protection controls. Controls are technical, administrative or physical safeguards. Controls are the nexus used to manage risks through preventing, detecting or lessening the ability of a particular threat from negatively impacting business processes. Controls directly map to standards, since control testing is designed to measure specific aspects of how standards are actually implemented.", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Cybersecurity & Data Protection Controls", "controlMappings": [ "GOV-09", "CPL-01", "CPL-01.2", "BCD-13", "BCD-13.1", "SEA-01.1", "SEA-01.2" ] }, { "uuid": "18337ea8-49d8-54db-8a3e-a8cb3fe05b26", "erlNumber": "E-GOV-11", "title": "Cybersecurity & Data Protection Procedures", "description": "Documented evidence of an appropriate appropriately-scoped cybersecurity & data protection procedures. Procedures are a documented set of steps necessary to perform a specific task or process in conformance with an applicable standard. Procedures help address the question of how the organization actually operationalizes a policy, standard or control. The result of a procedure is intended to satisfy a specific control. Procedures are also commonly referred to as “control activities.”", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Cybersecurity & Data Protection Procedures", "controlMappings": [ "GOV-02", "OPS-01.1", "BCD-13", "BCD-13.1" ] }, { "uuid": "81054cd6-2cae-5264-9e5f-5f6af1cea9b1", "erlNumber": "E-GOV-12", "title": "Cybersecurity & Data Protection Policies & Standards Reviews", "description": "Documented evidence of a periodic review process for the organization's cybersecurity & data protection policies and standards to identify necessary updates.", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Cybersecurity & Data Protection Policies & Standards Reviews", "controlMappings": [ "GOV-03", "SEA-01.1", "SEA-01.2" ] }, { "uuid": "932e5d3b-885a-5428-b748-86f3611f6cd4", "erlNumber": "E-GOV-13", "title": "Measures of Performance (Metrics)", "description": "Documented evidence of formal measure of performance that are used to track the health of the cybersecurity & data protection program (e.g., metrics, KPIs, KRIs).", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Measures of Performance (Metrics)", "controlMappings": [ "GOV-01.2", "GOV-05", "GOV-05.2", "CPL-02" ] }, { "uuid": "819a62b5-d0d1-54df-bd9e-1c5294584dec", "erlNumber": "E-GOV-14", "title": "Materiality Threshold Definition", "description": "Documented evidence of criteria to define the organization's materiality threshold.", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Materiality Threshold Definition", "controlMappings": [ "GOV-16" ] }, { "uuid": "65ae6e9b-c584-5094-b336-4df30ad3a179", "erlNumber": "E-GOV-18", "title": "Exception Management", "description": "Documented evidence of authorized exceptions to standards (e.g., configurations, practices, etc.)", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Exception Management", "controlMappings": [ "CRY-01.1", "GOV-02.1" ] }, { "uuid": "aaed98f6-9a6a-5725-8dcc-d9f83b3c05e4", "erlNumber": "E-GOV-19", "title": "Operationalizing Cybersecurity & Data Protection Practices", "description": "Documented evidence of personnel management actions to compel data and/or process owners to operationalize cybersecurity and data protection practices for each Technology Asset, Application and/or Service (TAAS) under their control.", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Operationalizing Cybersecurity & Data Protection Practices", "controlMappings": [ "GOV-15" ] }, { "uuid": "89291236-ba6e-5876-a3ac-e07d8005c111", "erlNumber": "E-GOV-20", "title": "Compensating Controls", "description": "Documented evidence of compensating controls (e.g., countermeasure to reduce risk associated with control deficiencies).", "areaOfFocus": "Cybersecurity & Data Protection Management", "documentationArtifact": "Compensating Controls", "controlMappings": [ "CFG-02.9", "RSK-06.2" ] }, { "uuid": "1cdcb67a-278d-5e52-8078-ab04d247f66a", "erlNumber": "E-HRS-01", "title": "Position Categorization", "description": "Documented evidence of a discrete roles for cybersecurity & data privacy functions (e.g., position categorization).", "areaOfFocus": "Human Resources", "documentationArtifact": "Position Categorization", "controlMappings": [ "GOV-04", "HRS-01", "HRS-02", "HRS-03", "HRS-03.1" ] }, { "uuid": "e9f01ef8-1eff-54dc-9d51-c46a692aa5f6", "erlNumber": "E-HRS-02", "title": "Assigned Roles - Application Developers", "description": "List of employed or contract personnel assigned to application development roles.", "areaOfFocus": "Human Resources", "documentationArtifact": "Assigned Roles - Application Developers", "controlMappings": [ "HRS-02", "HRS-02.1", "HRS-03", "OPS-01" ] }, { "uuid": "9b071a11-63d7-5cc9-a108-32010db541e1", "erlNumber": "E-HRS-03", "title": "Assigned Roles - Cybersecurity Staff", "description": "List of employed or contract personnel assigned to cybersecurity roles.", "areaOfFocus": "Human Resources", "documentationArtifact": "Assigned Roles - Cybersecurity Staff", "controlMappings": [ "HRS-02", "HRS-02.1", "HRS-03", "OPS-01" ] }, { "uuid": "a0af47b4-8355-545a-84b9-0ed6a888a486", "erlNumber": "E-HRS-04", "title": "Assigned Roles - Data Privacy Staff", "description": "List of employed or contract personnel assigned to data privacy roles.", "areaOfFocus": "Human Resources", "documentationArtifact": "Assigned Roles - Data Privacy Staff", "controlMappings": [ "HRS-02", "HRS-02.1", "HRS-03", "OPS-01" ] }, { "uuid": "fe4fafec-05de-5638-b9c0-b310b1fe61cd", "erlNumber": "E-HRS-05", "title": "Role Assignment - CISO", "description": "Documented evidence of a formal role assignment to the Chief Information Security Officer (CISO) position.", "areaOfFocus": "Human Resources", "documentationArtifact": "Role Assignment - CISO", "controlMappings": [ "GOV-04" ] }, { "uuid": "9e151170-b953-580d-8481-16ed2631f8bb", "erlNumber": "E-HRS-06", "title": "Role Assignment - COO", "description": "Documented evidence of a formal role assignment to the Chief Operations Officer (COO) position.", "areaOfFocus": "Human Resources", "documentationArtifact": "Role Assignment - COO", "controlMappings": [ "GOV-04" ] }, { "uuid": "cbc209c7-9beb-5576-8920-836b9efbc599", "erlNumber": "E-HRS-07", "title": "Role Assignment - CIO", "description": "Documented evidence of a formal role assignment to the Chief Information Officer (CIO) position.", "areaOfFocus": "Human Resources", "documentationArtifact": "Role Assignment - CIO", "controlMappings": [ "GOV-04" ] }, { "uuid": "6ef4beb1-6d16-5b82-9001-95a51b5350fb", "erlNumber": "E-HRS-08", "title": "Role Assignment - CPO", "description": "Documented evidence of a formal role assignment to the Chief Privacy Officer (CPO) position.", "areaOfFocus": "Human Resources", "documentationArtifact": "Role Assignment - CPO", "controlMappings": [ "GOV-04", "PRI-01.1" ] }, { "uuid": "c8064074-364a-5027-9ed7-9a1a0ad2154f", "erlNumber": "E-HRS-09", "title": "Role Assignment - CRO", "description": "Documented evidence of a formal role assignment to the Chief Risk Officer (CRO) position.", "areaOfFocus": "Human Resources", "documentationArtifact": "Role Assignment - CRO", "controlMappings": [ "GOV-04" ] }, { "uuid": "b311380e-a169-5392-9235-a713327c7e22", "erlNumber": "E-HRS-10", "title": "Role Assignment - DPO", "description": "Documented evidence of a formal role assignment to Data Protection Officer (DPO) positions.", "areaOfFocus": "Human Resources", "documentationArtifact": "Role Assignment - DPO", "controlMappings": [ "GOV-04" ] }, { "uuid": "d1be0c17-bb4b-583c-8732-3e16bfd7b6d3", "erlNumber": "E-HRS-11", "title": "Role Assignment - Sensitive / Regulated Data", "description": "Documented evidence of a formal role assignment to personnel who are cleared to handle sensitive/regulated data.", "areaOfFocus": "Human Resources", "documentationArtifact": "Role Assignment - Sensitive / Regulated Data", "controlMappings": [ "HRS-02", "HRS-02.1", "HRS-03" ] }, { "uuid": "2b64463d-a01c-576d-880d-65376cfaa612", "erlNumber": "E-HRS-12", "title": "Role Review", "description": "Documented evidence of a formal review process to ensure personnel roles currently reflect business needs.", "areaOfFocus": "Human Resources", "documentationArtifact": "Role Review", "controlMappings": [ "IAC-07", "IAC-07.1", "IAC-08", "IAC-17" ] }, { "uuid": "e491ad77-c21f-57e8-ab6c-5701283a8bb3", "erlNumber": "E-HRS-13", "title": "Defined Cybersecurity & Data Privacy Responsibilities", "description": "Documented evidence of a role-based cybersecurity & data privacy responsibilities to ensure personnel are both educated on the role and are responsible for the associated control execution.", "areaOfFocus": "Human Resources", "documentationArtifact": "Defined Cybersecurity & Data Privacy Responsibilities", "controlMappings": [ "CHG-04", "GOV-04", "HRS-03", "HRS-03.1", "OPS-01" ] }, { "uuid": "264abe72-5053-5a7c-88e2-f316ceb04402", "erlNumber": "E-HRS-14", "title": "Responsibilities Review", "description": "Documented evidence of a formal review process to ensure assigned responsibilities currently reflect business needs for the assigned role.", "areaOfFocus": "Human Resources", "documentationArtifact": "Responsibilities Review", "controlMappings": [ "IAC-17" ] }, { "uuid": "70f91c73-c22e-5be7-854f-7a4cd0bda515", "erlNumber": "E-HRS-15", "title": "Organization Chart", "description": "Current and accurate organization chart that depicts logical staff hierarchies.", "areaOfFocus": "Human Resources", "documentationArtifact": "Organization Chart", "controlMappings": [ "GOV-04", "GOV-04.1", "GOV-04.2", "HRS-01", "OPS-01" ] }, { "uuid": "57ac422c-04f4-59a0-b1c4-74901b1959bc", "erlNumber": "E-HRS-16", "title": "Access Agreements", "description": "Documented evidence of personnel management practices protecting sensitive/regulated data through formal access agreements.", "areaOfFocus": "Human Resources", "documentationArtifact": "Access Agreements", "controlMappings": [ "HRS-03.1", "HRS-05", "HRS-06", "HRS-10" ] }, { "uuid": "f13797d5-58ae-55f5-9730-e295dc147d32", "erlNumber": "E-HRS-17", "title": "Background Checks", "description": "Documented evidence of personnel screening practices, which centers around some form of formalized background check process.", "areaOfFocus": "Human Resources", "documentationArtifact": "Background Checks", "controlMappings": [ "HRS-04", "HRS-04.1" ] }, { "uuid": "d164d5c8-6ee7-5e2d-bd99-92f2eb460690", "erlNumber": "E-HRS-18", "title": "Provisioning Checklist (Onboarding)", "description": "Documented evidence of personnel management practices to formally onboard personnel into their assigned roles.", "areaOfFocus": "Human Resources", "documentationArtifact": "Provisioning Checklist (Onboarding)", "controlMappings": [ "HRS-03", "HRS-03.1", "HRS-04.2", "HRS-05.7", "HRS-10", "IAC-07", "IAC-28" ] }, { "uuid": "257559b7-f87c-5662-bd39-46dd18ef6489", "erlNumber": "E-HRS-19", "title": "Deprovisioning Checklist (Offboarding)", "description": "Documented evidence of personnel management practices to formally offboard personnel from their assigned roles due to employment termination or role change.", "areaOfFocus": "Human Resources", "documentationArtifact": "Deprovisioning Checklist (Offboarding)", "controlMappings": [ "HRS-06.2", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "IAC-07", "IAC-07.1", "IAC-07.2" ] }, { "uuid": "b9bddddb-08cc-598f-aa2d-87b49d86727a", "erlNumber": "E-HRS-20", "title": "Non-Disclosure Agreements (NDAs)", "description": "Documented evidence of the use of Non-Disclosure Agreements (NDAs) that restricts unauthorized sharing of sensitive/regulated data.", "areaOfFocus": "Human Resources", "documentationArtifact": "Non-Disclosure Agreements (NDAs)", "controlMappings": [ "HRS-06.1" ] }, { "uuid": "2578a376-3503-58b0-98f7-9f9e2ea9d6e4", "erlNumber": "E-HRS-21", "title": "Position Competency Requirements", "description": "Documented evidence of personnel management practices to define minimum competency requirements for cybersecurity & data privacy-related roles.", "areaOfFocus": "Human Resources", "documentationArtifact": "Position Competency Requirements", "controlMappings": [ "HRS-03.2", "HRS-04", "HRS-04.1" ] }, { "uuid": "c7c60dca-4d83-5b5a-97a0-735e557d71ef", "erlNumber": "E-HRS-22", "title": "Rules of Behavior", "description": "Documented evidence of personnel management practices to define \"acceptable use\" or \"rules of behavior\" criteria that specify acceptable and unacceptable user behaviors.", "areaOfFocus": "Human Resources", "documentationArtifact": "Rules of Behavior", "controlMappings": [ "HRS-02", "HRS-02.1", "HRS-03", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-10" ] }, { "uuid": "f374bfeb-7a3a-5649-96dd-57091395e7ec", "erlNumber": "E-HRS-23", "title": "Critical Cybersecurity & Data Privacy Skills", "description": "Documented evidence of personnel management practices to formally identify critical cybersecurity skills needed to support business operations.", "areaOfFocus": "Human Resources", "documentationArtifact": "Critical Cybersecurity & Data Privacy Skills", "controlMappings": [ "HRS-03.2", "HRS-13" ] }, { "uuid": "681f4e9c-cf8f-5948-98f2-9d4838855a12", "erlNumber": "E-HRS-24", "title": "Critical Cybersecurity & Data Privacy Skill Gaps", "description": "Documented evidence of personnel management practices to formally identify critical cybersecurity & data privacy skill gaps.", "areaOfFocus": "Human Resources", "documentationArtifact": "Critical Cybersecurity & Data Privacy Skill Gaps", "controlMappings": [ "HRS-13" ] }, { "uuid": "6304f2e2-a4d5-50aa-8a50-9655518d3454", "erlNumber": "E-HRS-25", "title": "Separation of Duties (SoD)", "description": "Documented evidence of personnel management practices to implement and maintain Separation of Duties (SoD) to prevent potential inappropriate activity without collusion.", "areaOfFocus": "Human Resources", "documentationArtifact": "Separation of Duties (SoD)", "controlMappings": [ "HRS-11", "HRS-12" ] }, { "uuid": "ba69f7fe-23c7-5315-aafc-a13ba5e442ba", "erlNumber": "E-HRS-27", "title": "Personnel Sanctions", "description": "Documented evidence of personnel management practices to formally sanction unacceptable behavior(s).", "areaOfFocus": "Human Resources", "documentationArtifact": "Personnel Sanctions", "controlMappings": [ "HRS-01", "HRS-07", "OPS-01" ] }, { "uuid": "bcd34189-1c98-5b45-af82-269a6895729e", "erlNumber": "E-HRS-28", "title": "Authorized Personnel Access List", "description": "Documented evidence of an authorized personnel access list.", "areaOfFocus": "Human Resources", "documentationArtifact": "Authorized Personnel Access List", "controlMappings": [ "HRS-03", "PES-02" ] }, { "uuid": "d830b14d-765b-5095-93b2-1baa3ea34e88", "erlNumber": "E-HRS-29", "title": "Personnel Actions Documentation", "description": "Documented evidence of notifications or records of recently transferred, separated, or terminated employees.", "areaOfFocus": "Human Resources", "documentationArtifact": "Personnel Actions Documentation", "controlMappings": [ "HRS-07", "HRS-08", "HRS-09" ] }, { "uuid": "5611382c-9ff4-533c-bdf8-aefd36526aea", "erlNumber": "E-IAM-01", "title": "Access Permission Review", "description": "Documented evidence of periodic access permission reviews.", "areaOfFocus": "Identity & Access Management", "documentationArtifact": "Access Permission Review", "controlMappings": [ "IAC-17" ] }, { "uuid": "33b66368-86a5-5514-803e-8f8a49d10746", "erlNumber": "E-IAM-02", "title": "Defined Roles & Authorizations (RBAC)", "description": "Documented evidence of defined access control-specific roles (e.g., Role Based Access Control (RBAC)) that affect both logical and physical access authorizations.", "areaOfFocus": "Identity & Access Management", "documentationArtifact": "Defined Roles & Authorizations (RBAC)", "controlMappings": [ "CFG-05", "CHG-04", "DCH-03", "END-03", "IAC-08", "IAC-21" ] }, { "uuid": "a2009751-6df1-58af-a750-2f4f1164541a", "erlNumber": "E-IAM-03", "title": "Privileged User Inventory", "description": "Documented evidence of an inventory of privileged users across Technology Assets, Applications and/or Services (TAAS) (internal and external).", "areaOfFocus": "Identity & Access Management", "documentationArtifact": "Privileged User Inventory", "controlMappings": [ "IAC-16", "IAC-16.1" ] }, { "uuid": "fea45f72-43e9-5adc-9222-3a44a3e77fee", "erlNumber": "E-IAM-04", "title": "User & Service Inventory", "description": "Documented evidence of an inventory of authorized users and services.", "areaOfFocus": "Identity & Access Management", "documentationArtifact": "User & Service Inventory", "controlMappings": [ "IAC-01.3" ] }, { "uuid": "48e4cb29-8c30-5f34-9a9c-d96ad468d6ba", "erlNumber": "E-IAM-05", "title": "Identity & Access Management (IAM) Function", "description": "Documented evidence of an Identity & Access Management (IAM), or similar function, that facilitates the implementation of identification and access management controls.", "areaOfFocus": "Identity & Access Management", "documentationArtifact": "Identity & Access Management (IAM) Function", "controlMappings": [ "IAC-01", "IAC-02", "IAC-02.2", "IAC-03", "IAC-03.5", "IAC-04", "IAC-05", "IAC-21", "IAC-28" ] }, { "uuid": "89ac843b-6ce0-5aef-be5d-c48758e3ae76", "erlNumber": "E-IAM-06", "title": "Authenticate, Authorize and Audit (AAA) Solution", "description": "Documented evidence of an Authenticate, Authorize and Audit (AAA) solution (on-premises and hosted by External Service Providers (ESP)).", "areaOfFocus": "Identity & Access Management", "documentationArtifact": "Authenticate, Authorize and Audit (AAA) Solution", "controlMappings": [ "IAC-01.2", "IAC-02", "IAC-02.2", "IAC-03", "IAC-03.5", "IAC-04", "IAC-05", "IAC-21", "IAC-28" ] }, { "uuid": "b6baf0dd-285d-5655-b14c-6c3f0dcf3cea", "erlNumber": "E-IAM-07", "title": "Account Management Compliance Reviews", "description": "Documented evidence of account management compliance reviews.", "areaOfFocus": "Identity & Access Management", "documentationArtifact": "Account Management Compliance Reviews", "controlMappings": [ "IAC-15", "IAC-15.7" ] }, { "uuid": "62406faa-bb3e-57e2-9d19-605b5f95c74e", "erlNumber": "E-IAM-08", "title": "Conditions for Group / Role Membership", "description": "Documented evidence of conditions for group and role membership.", "areaOfFocus": "Identity & Access Management", "documentationArtifact": "Conditions for Group / Role Membership", "controlMappings": [ "IAC-15", "IAC-15.5" ] }, { "uuid": "947bf69c-2629-59c2-ae08-214286948ff8", "erlNumber": "E-IAM-09", "title": "Access Authorization Records", "description": "Documented evidence of access authorization records.", "areaOfFocus": "Identity & Access Management", "documentationArtifact": "Access Authorization Records", "controlMappings": [ "IAC-21.3", "IAC-28.1" ] }, { "uuid": "831db57e-1791-5f88-abe9-d7ce7c8f0d92", "erlNumber": "E-IAM-10", "title": "Active Accounts", "description": "Documented evidence of active system accounts and the name of the individual associated with each account.", "areaOfFocus": "Identity & Access Management", "documentationArtifact": "Active Accounts", "controlMappings": [ "IAC-01.3" ] }, { "uuid": "7e811f76-f4bb-5d1b-b645-c9148d3d3f8a", "erlNumber": "E-IAM-11", "title": "Recently Disabled Accounts", "description": "Documented evidence of list of recently disabled system accounts along with the name of the individual associated with each account.", "areaOfFocus": "Identity & Access Management", "documentationArtifact": "Recently Disabled Accounts", "controlMappings": [ "IAC-01.3" ] }, { "uuid": "fee5e519-c562-58c2-950f-7530d66bbbba", "erlNumber": "E-IAM-12", "title": "Account Management Documentation", "description": "Documented evidence of list of account management practices.", "areaOfFocus": "Identity & Access Management", "documentationArtifact": "Account Management Documentation", "controlMappings": [ "IAC-01" ] }, { "uuid": "06b94be5-3769-56b2-aad9-0ffd05b43883", "erlNumber": "E-IAM-13", "title": "Authenticator Types", "description": "Documented evidence of system authenticator types.", "areaOfFocus": "Asset Management", "documentationArtifact": "Authenticator Types", "controlMappings": [ "IAC-02" ] }, { "uuid": "98c7e2d3-df81-5e70-b1b7-8676fd13b9f5", "erlNumber": "E-IAM-14", "title": "Remote Access Authorizations", "description": "Documented evidence of authorization for users to connect via remote access methods.", "areaOfFocus": "Asset Management", "documentationArtifact": "Remote Access Authorizations", "controlMappings": [ "NET-14", "NET-14.5", "NET-14.6" ] }, { "uuid": "edb57f0e-903e-5a2c-bd89-458a2cef1411", "erlNumber": "E-IAO-01", "title": "Information Assurance Program (IAP)", "description": "Documented evidence of a Information Assurance Program (IAP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards.", "areaOfFocus": "Information Assurance", "documentationArtifact": "Information Assurance Program (IAP)", "controlMappings": [ "IAO-01", "IAO-02.4" ] }, { "uuid": "c60174b9-51a5-5eba-9675-c8c89cfadadc", "erlNumber": "E-IAO-03", "title": "Pre-Production Controls Testing", "description": "Documented evidence of pre-production cybersecurity & data protection controls testing to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting expected requirements.", "areaOfFocus": "Information Assurance", "documentationArtifact": "Pre-Production Controls Testing", "controlMappings": [ "IAO-02", "IAO-02.4", "IAO-03.2" ] }, { "uuid": "d14a16be-5421-5740-b457-49805aed8bd5", "erlNumber": "E-IAO-04", "title": "Security Assessment Plan", "description": "Documented evidence of a plan to conduct security assessments.", "areaOfFocus": "Information Assurance", "documentationArtifact": "Security Assessment Plan", "controlMappings": [ "IAO-02" ] }, { "uuid": "f06a904e-7663-5f76-9a86-e10fd39c1f6b", "erlNumber": "E-IAO-05", "title": "Security Assessment Report", "description": "Documented evidence of a report on security assessments.", "areaOfFocus": "Information Assurance", "documentationArtifact": "Security Assessment Report", "controlMappings": [ "IAO-02.4" ] }, { "uuid": "fcbbd859-8970-5da5-be7e-c0197164f659", "erlNumber": "E-IRO-01", "title": "Incident Response Plan (IRP)", "description": "Documented evidence of a Incident Response Plan (IRP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards.", "areaOfFocus": "Incident Response", "documentationArtifact": "Incident Response Plan (IRP)", "controlMappings": [ "IRO-01", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-10", "IRO-10.2" ] }, { "uuid": "4b310966-fb17-5c6f-b736-410087330965", "erlNumber": "E-IRO-02", "title": "Indicators of Compromise (IOC)", "description": "Documented evidence of defined Indicators of Compromise (IOC).", "areaOfFocus": "Incident Response", "documentationArtifact": "Indicators of Compromise (IOC)", "controlMappings": [ "MON-11.3", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "IRO-03" ] }, { "uuid": "dea8924e-9b54-502f-9678-0a752cd041df", "erlNumber": "E-IRO-03", "title": "Incident Tracking", "description": "Documented evidence of a centralized repository to track cybersecurity & data privacy incidents.", "areaOfFocus": "Incident Response", "documentationArtifact": "Incident Tracking", "controlMappings": [ "IRO-02", "IRO-09" ] }, { "uuid": "4803b1e9-d8e7-57b2-8f94-161faef99ff9", "erlNumber": "E-IRO-04", "title": "IRP Testing", "description": "Documented evidence of an Incident Response Plan (IRP)-related testing activity.", "areaOfFocus": "Incident Response", "documentationArtifact": "IRP Testing", "controlMappings": [ "IRO-06" ] }, { "uuid": "18283a1c-936e-5670-839e-22e7190eeca8", "erlNumber": "E-IRO-05", "title": "Table Top Exercises", "description": "Documented evidence of \"table top\" exercises that test incident response practices.", "areaOfFocus": "Incident Response", "documentationArtifact": "Table Top Exercises", "controlMappings": [ "IRO-05" ] }, { "uuid": "ac230fc4-0e2f-539c-8170-57cc1aaeb969", "erlNumber": "E-IRO-06", "title": "IRP Training", "description": "Documented evidence of an Incident Response Plan (IRP)-related training activity.", "areaOfFocus": "Incident Response", "documentationArtifact": "IRP Training", "controlMappings": [ "IRO-05" ] }, { "uuid": "3c03cf6c-2f0c-512f-b863-638862d0276f", "erlNumber": "E-IRO-07", "title": "IRP Updates", "description": "Documented evidence of a periodic review process for the organization's Incident Response Plan (IRP) to identify necessary updates.", "areaOfFocus": "Incident Response", "documentationArtifact": "IRP Updates", "controlMappings": [ "IRO-04.2" ] }, { "uuid": "04776b49-196c-5900-bedb-e1befe68acb9", "erlNumber": "E-IRO-08", "title": "Root Cause Analysis (RCA)", "description": "Documented evidence of a Root Cause Analysis (RCA) from any Incident Response Plan (IRP)-related training, testing or significant incident.", "areaOfFocus": "Incident Response", "documentationArtifact": "Root Cause Analysis (RCA)", "controlMappings": [ "IRO-13" ] }, { "uuid": "c21de290-2335-503b-af2b-883e60dacf3f", "erlNumber": "E-IRO-09", "title": "Formally Assigned Incident Response Roles & Responsibilities", "description": "Documented evidence of the establishment of a formally-assigned, integrated team of cybersecurity, IT and business function representatives that are capable of addressing cybersecurity & data privacy incident response operations.", "areaOfFocus": "Incident Response", "documentationArtifact": "Formally Assigned Incident Response Roles & Responsibilities", "controlMappings": [ "IRO-07", "IRO-16" ] }, { "uuid": "5acf5cf4-c6b4-5c7a-8df1-0c259012d8da", "erlNumber": "E-IRO-10", "title": "Chain of Custody", "description": "Documented evidence of an in-house, or externally contracted, capability to perform digital forensics and maintain the integrity of the chain of custody, in accordance with applicable laws, regulations and industry-recognized secure practices.", "areaOfFocus": "Incident Response", "documentationArtifact": "Chain of Custody", "controlMappings": [ "IRO-08" ] }, { "uuid": "a3159855-b46f-5279-ab9e-777084fdb89c", "erlNumber": "E-IRO-11", "title": "Incident Reporting Capability", "description": "Documented evidence of a capability to provide situational awareness of incidents to internal stakeholders and generated necessary reporting to affected clients, applicable third-parties and regulatory authorities.", "areaOfFocus": "Incident Response", "documentationArtifact": "Incident Reporting Capability", "controlMappings": [ "IRO-10", "IRO-10.2" ] }, { "uuid": "d5366319-0e22-50ab-b8fd-276ae9e085b9", "erlNumber": "E-IRO-12", "title": "Sensitive / Regulated Data Spills", "description": "Documented evidence of records of response to sensitive / regulated data spills.", "areaOfFocus": "Incident Response", "documentationArtifact": "Sensitive / Regulated Data Spills", "controlMappings": [ "IRO-12" ] }, { "uuid": "2b4f943a-161f-5f2f-88b3-04d1ee29c2c7", "erlNumber": "E-IRO-13", "title": "Incident Response Records", "description": "Documented evidence of records of response to cybersecurity and/or data protection incidents.", "areaOfFocus": "Incident Response", "documentationArtifact": "Incident Response Records", "controlMappings": [ "IRO-09" ] }, { "uuid": "86671573-ca69-53b4-abd2-f0db379e0202", "erlNumber": "E-MNT-01", "title": "Maintenance - Authorized Maintenance Personnel", "description": "Documented evidence of personnel who have designated maintenance roles.", "areaOfFocus": "Maintenance", "documentationArtifact": "Maintenance - Authorized Maintenance Personnel", "controlMappings": [ "MNT-06.1" ] }, { "uuid": "d9514297-3f99-50b0-8938-1218de618387", "erlNumber": "E-MNT-02", "title": "Maintenance Plan", "description": "Documented evidence of a Maintenance Plan. This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards.", "areaOfFocus": "Maintenance", "documentationArtifact": "Maintenance Plan", "controlMappings": [ "MNT-01" ] }, { "uuid": "f7f33e11-97d4-5f30-a863-8d1fb4a580ff", "erlNumber": "E-MNT-03", "title": "Patch Management", "description": "Documented evidence of maintenance activities for Technology Assets, Applications and/or Services (TAAS) (e.g., patch management).", "areaOfFocus": "Maintenance", "documentationArtifact": "Patch Management", "controlMappings": [ "VPM-01", "VPM-04", "VPM-05" ] }, { "uuid": "a25ec67b-26cd-5b5f-81d8-ab01e47234c0", "erlNumber": "E-MNT-04", "title": "Maintenance Activities", "description": "Documented evidence of maintenance activities for the organization's Technology Assets, Applications and/or Services (TAAS).", "areaOfFocus": "Maintenance", "documentationArtifact": "Maintenance Activities", "controlMappings": [ "MNT-01", "MNT-02", "MNT-03", "MNT-03.1" ] }, { "uuid": "7ac5c76f-6d63-59e8-b707-bec8bb59f167", "erlNumber": "E-MNT-05", "title": "Maintenance Tool Inspection Records", "description": "Documented evidence of maintenance tool inspection records.", "areaOfFocus": "Maintenance", "documentationArtifact": "Maintenance Tool Inspection Records", "controlMappings": [ "MNT-04.2" ] }, { "uuid": "01e3ded5-4431-5f23-8211-c696776b7da0", "erlNumber": "E-MON-01", "title": "Event Log Review & Analysis", "description": "Documented evidence of a capability to perform security event log review and analysis (e.g., system monitoring records, continuous monitoring strategy, etc.).", "areaOfFocus": "Event Log Monitoring", "documentationArtifact": "Event Log Review & Analysis", "controlMappings": [ "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.8", "MON-02", "MON-02.2" ] }, { "uuid": "41c56dee-24c9-5dd9-898c-531799f1fd9a", "erlNumber": "E-MON-02", "title": "Malware Activity", "description": "Documented evidence of malware activity being logged and included as part of the centralized event log collection and review/analysis process.", "areaOfFocus": "Event Log Monitoring", "documentationArtifact": "Malware Activity", "controlMappings": [ "MON-01.8", "MON-02.2", "END-04.3" ] }, { "uuid": "46899bcb-a0c4-5d91-91fd-36c9c3745108", "erlNumber": "E-MON-03", "title": "Privileged User Oversight", "description": "Documented evidence of privileged user activity being logged and included as part of the centralized event log collection and review/analysis process.", "areaOfFocus": "Event Log Monitoring", "documentationArtifact": "Privileged User Oversight", "controlMappings": [ "MON-01.14", "MON-01.15" ] }, { "uuid": "e835b261-de89-578e-87d2-fbb4f6053c53", "erlNumber": "E-MON-05", "title": "Centralized Event Log Collection", "description": "Documented evidence of security-relevant activities being logged and included as part of the centralized event log collection and review/analysis process.", "areaOfFocus": "Event Log Monitoring", "documentationArtifact": "Centralized Event Log Collection", "controlMappings": [ "MON-01.2", "MON-01.8", "MON-02", "MON-02.2", "MON-02.1" ] }, { "uuid": "2d39fce3-6770-527e-89a0-2109c0d0d580", "erlNumber": "E-MON-06", "title": "Automated Event Escalation & Reporting", "description": "Documented evidence of a capability for selected events to alert applicable personnel, or roles, based on the type of event. This can be demonstrated by the configuration of a Security Incident Event Manager (SIEM), or similar technology, that helps automate event log analysis and reporting.", "areaOfFocus": "Event Log Monitoring", "documentationArtifact": "Automated Event Escalation & Reporting", "controlMappings": [ "MON-01", "MON-01.1", "MON-01.3", "MON-01.4", "MON-01.12" ] }, { "uuid": "191b3c03-e9f0-59bd-997d-70015ec7772b", "erlNumber": "E-MON-07", "title": "Situational Awareness", "description": "Documented evidence of the organization leveraging knowledge of event log generation to gain situational awareness of cross-domain activities (e.g., technology issues, security events, policy violations, service provider activities, remote workforce activities, physical security events, etc.).", "areaOfFocus": "Event Log Monitoring", "documentationArtifact": "Situational Awareness", "controlMappings": [ "MON-01", "MON-01.1", "MON-01.3", "MON-01.4", "MON-02.1", "MON-11.3", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3" ] }, { "uuid": "077b7aba-fb77-542b-bb3b-223228414c15", "erlNumber": "E-MON-08", "title": "Integrity Monitoring", "description": "Documented evidence of integrity monitoring, where files and/or configurations on critical Technology Assets, Applications and/or Services (TAAS) are actively monitored for changes that could indicate unauthorized changes.", "areaOfFocus": "Event Log Monitoring", "documentationArtifact": "Integrity Monitoring", "controlMappings": [ "MON-01.7" ] }, { "uuid": "3b92767c-1ba8-5f5a-9f55-946511a9ddca", "erlNumber": "E-MON-09", "title": "Event Logs", "description": "Documented evidence of event logs being generated by Technology Assets, Applications and/or Services (TAAS).", "areaOfFocus": "Event Log Monitoring", "documentationArtifact": "Event Logs", "controlMappings": [ "MON-03.2", "MON-03.3" ] }, { "uuid": "24fe7fa0-809c-5fa1-ad17-bdc234839e4c", "erlNumber": "E-MON-10", "title": "Event Logging Processing Failure Notifications", "description": "Documented evidence of the list of personnel to be notified in the event of an event log processing failure.", "areaOfFocus": "Event Log Monitoring", "documentationArtifact": "Event Logging Processing Failure Notifications", "controlMappings": [ "MON-05" ] }, { "uuid": "7b80fa8c-2e6b-5310-94db-83c4613b8744", "erlNumber": "E-MON-11", "title": "System Authenticator Types", "description": "Documented evidence of the list of authorized system authenticator types.", "areaOfFocus": "Event Log Monitoring", "documentationArtifact": "System Authenticator Types", "controlMappings": [ "IAC-01" ] }, { "uuid": "7acc90b8-16f3-5394-82f3-7338d42215b5", "erlNumber": "E-NET-01", "title": "Content / DNS Filtering", "description": "Documented evidence of the methods that content / DNS filtering is implemented to prevent Internet traffic from prohibited content and/or hostile web sites.", "areaOfFocus": "Network Security", "documentationArtifact": "Content / DNS Filtering", "controlMappings": [ "NET-18", "NET-18.1" ] }, { "uuid": "22064e16-b6de-5969-86da-9c7ca0ba794d", "erlNumber": "E-NET-03", "title": "Work From Anywhere (WFA) Guidance (remote workers)", "description": "Documented evidence of administrative and technical measures that are enforced at \"alternate work sites\" which includes working from home or working while traveling on business.", "areaOfFocus": "Network Security", "documentationArtifact": "Work From Anywhere (WFA) Guidance (remote workers)", "controlMappings": [ "NET-14", "NET-14.5" ] }, { "uuid": "ecff2c41-635d-5bac-9a46-b09f74e7451c", "erlNumber": "E-NET-04", "title": "Network Security Controls (NSC)", "description": "Documented evidence of the organization's network security controls (e.g., boundary protections, content filtering, wireless infrastructure, etc.).", "areaOfFocus": "Network Security", "documentationArtifact": "Network Security Controls (NSC)", "controlMappings": [ "NET-01" ] }, { "uuid": "ce7b1a3e-b0a6-54a5-b8d0-98c111a74dd1", "erlNumber": "E-NET-05", "title": "Zero Trust Architecture (ZTA)", "description": "Documented evidence of controls that would enable the organization to claim conformity with Zero Trust (ZT) principles.", "areaOfFocus": "Network Security", "documentationArtifact": "Zero Trust Architecture (ZTA)", "controlMappings": [ "NET-01.1" ] }, { "uuid": "775fe2de-61d7-5852-b3d8-d94ceca4250e", "erlNumber": "E-NET-06", "title": "Authorized Network Connections", "description": "Documented evidence of third-party Technology Assets, Applications and/or Services (TAAS) authorized to connect to organizational TAAS, including remote access authorizations.", "areaOfFocus": "Network Security", "documentationArtifact": "Authorized Network Connections", "controlMappings": [ "NET-04", "NET-05", "NET-05.1", "MDM-11" ] }, { "uuid": "1344a376-9731-5258-9861-f6ea05fde4d7", "erlNumber": "E-NET-07", "title": "External System Accessibility", "description": "Documented evidence of a list of Technology Assets, Applications and/or Services (TAAS) accessible from third-party entities.", "areaOfFocus": "Network Security", "documentationArtifact": "External System Accessibility", "controlMappings": [ "NET-04", "NET-04.1" ] }, { "uuid": "aa5c0426-d069-5ab2-b623-f5c9fa76764d", "erlNumber": "E-NET-08", "title": "Internal Boundaries", "description": "Documented evidence of key internal boundaries.", "areaOfFocus": "Network Security", "documentationArtifact": "Internal Boundaries", "controlMappings": [ "NET-03" ] }, { "uuid": "41eb82ef-184e-5427-8960-f29593a5dd66", "erlNumber": "E-NET-09", "title": "Network Access Control Points", "description": "Documented evidence of network access control points.", "areaOfFocus": "Network Security", "documentationArtifact": "Network Access Control Points", "controlMappings": [ "NET-03", "NET-05.1", "NET-14.3" ] }, { "uuid": "c57e7c5d-7592-5042-a83c-cf5c9a4be929", "erlNumber": "E-NET-10", "title": "Information Flow Control", "description": "Documented evidence of information flow control mechanisms (e.g., Access Control Lists, etc.).", "areaOfFocus": "Network Security", "documentationArtifact": "Information Flow Control", "controlMappings": [ "NET-04", "NET-04.1" ] }, { "uuid": "5835b900-5c62-5d36-b914-f955ec3970e5", "erlNumber": "E-OPS-01", "title": "Security Operations Center (SOC)", "description": "Documented evidence of a Security Operations Center (SOC).", "areaOfFocus": "Security Operations", "documentationArtifact": "Security Operations Center (SOC)", "controlMappings": [ "OPS-04" ] }, { "uuid": "e31105f6-a4cd-5631-bd9a-9f22752f2700", "erlNumber": "E-PES-01", "title": "Environmental Monitoring", "description": "Documented evidence of environmental monitoring (e.g., water leaks, temperature, humidity, etc.)", "areaOfFocus": "Physical Security", "documentationArtifact": "Environmental Monitoring", "controlMappings": [ "PES-01", "PES-07", "PES-07.5", "PES-08", "PES-09" ] }, { "uuid": "da109ef7-810a-563f-ad03-bc4b66c4c089", "erlNumber": "E-PES-02", "title": "Visitor Logbook", "description": "Documented evidence of a visitor management and logging visitor activities.", "areaOfFocus": "Physical Security", "documentationArtifact": "Visitor Logbook", "controlMappings": [ "PES-03.3", "PES-06", "PES-06.4" ] }, { "uuid": "5873b818-6c31-55dd-9bce-2d45c0864077", "erlNumber": "E-PES-03", "title": "Defined Physical Security Roles", "description": "Documented evidence of defined physical access control-specific roles that limit physical access to rooms and/or facilities.", "areaOfFocus": "Physical Security", "documentationArtifact": "Defined Physical Security Roles", "controlMappings": [ "PES-02", "PES-02.1" ] }, { "uuid": "f5b2eaeb-096b-5d81-b2a8-2fdfbbbe7c44", "erlNumber": "E-PES-04", "title": "Physical Security Plan", "description": "Documented evidence of a physical security plan.", "areaOfFocus": "Physical Security", "documentationArtifact": "Physical Security Plan", "controlMappings": [ "PES-01.1" ] }, { "uuid": "6c27dca7-b3f2-584c-90b7-af67664eeb0a", "erlNumber": "E-PES-05", "title": "Physical Security Operations", "description": "Documented evidence of the organization's physical security capabilities as it pertains to operating and monitoring Physical Access Control (PAC) mechanisms.", "areaOfFocus": "Physical Security", "documentationArtifact": "Physical Security Operations", "controlMappings": [ "PES-01", "PES-02", "PES-02.1", "PES-03", "PES-05" ] }, { "uuid": "de8ce910-1d47-5883-ae3a-2f38f904d97e", "erlNumber": "E-PES-06", "title": "Physical Access Control Logs", "description": "Documented evidence of physical access control logs or records.", "areaOfFocus": "Physical Security", "documentationArtifact": "Physical Access Control Logs", "controlMappings": [ "PES-03" ] }, { "uuid": "3e9e3342-bab0-524e-b85c-543a970d267b", "erlNumber": "E-PES-07", "title": "Physical Access Control Devices", "description": "Documented evidence of Physical Access Control (PAC) mechanisms.", "areaOfFocus": "Physical Security", "documentationArtifact": "Physical Access Control Devices", "controlMappings": [ "PES-03" ] }, { "uuid": "cb5b8fd3-7e4e-5371-bfc1-33334365ee6a", "erlNumber": "E-PES-08", "title": "Physical Access Control Device Inventories", "description": "Documented evidence of inventory records of physical access control devices.", "areaOfFocus": "Physical Security", "documentationArtifact": "Physical Access Control Device Inventories", "controlMappings": [ "PES-03" ] }, { "uuid": "635d5a26-e289-5251-bc3c-5bb385c3280d", "erlNumber": "E-PES-09", "title": "Key & Combination Changes", "description": "Documented evidence of key and lock combination changes.", "areaOfFocus": "Physical Security", "documentationArtifact": "Key & Combination Changes", "controlMappings": [ "PES-03" ] }, { "uuid": "6aa80c3b-3724-5f8a-9cd4-27eb8651495c", "erlNumber": "E-PES-10", "title": "Physical Access Authorizations", "description": "Documented evidence of physical access authorization activities (e.g., list reviews, termination changes, etc.).", "areaOfFocus": "Physical Security", "documentationArtifact": "Physical Access Authorizations", "controlMappings": [ "PES-02", "PES-02.1" ] }, { "uuid": "df857a0f-a7ef-588f-87e0-f8c585e645c7", "erlNumber": "E-PES-11", "title": "Physical Security Zones", "description": "Documented evidence of security safeguards controlling access to designated physical security zones within facilities.", "areaOfFocus": "Physical Security", "documentationArtifact": "Physical Security Zones", "controlMappings": [ "PES-01.2" ] }, { "uuid": "810c7f31-f769-5d84-bc37-8370828db554", "erlNumber": "E-PES-12", "title": "Entry and Exist Points", "description": "Documented evidence of physical entry and exit points.", "areaOfFocus": "Physical Security", "documentationArtifact": "Entry and Exist Points", "controlMappings": [ "PES-03.1" ] }, { "uuid": "8564538f-7a57-51f5-bda7-95e50220a9c1", "erlNumber": "E-PRI-01", "title": "Accounting of Disclosures", "description": "Documented evidence of accounting for privacy-related disclosures.", "areaOfFocus": "Privacy", "documentationArtifact": "Accounting of Disclosures", "controlMappings": [ "PRI-14.1" ] }, { "uuid": "2948bc15-02dd-5463-a33d-bf29a08b726e", "erlNumber": "E-PRI-02", "title": "Authorized Use", "description": "Documented evidence of authorized use definitions for privacy-related data operations.", "areaOfFocus": "Privacy", "documentationArtifact": "Authorized Use", "controlMappings": [ "PRI-04", "PRI-04.1", "PRI-05", "PRI-05.1" ] }, { "uuid": "5465cc8e-cc94-538f-9dbf-fede5a459300", "erlNumber": "E-PRI-04", "title": "Data Protection Impact Assessment (DPIA)", "description": "Documented evidence of Data Protection Impact Assessment (DPIA).", "areaOfFocus": "Privacy", "documentationArtifact": "Data Protection Impact Assessment (DPIA)", "controlMappings": [ "RSK-10" ] }, { "uuid": "afa2d38a-e1ec-58e1-91ad-db2f197b6ee9", "erlNumber": "E-PRI-05", "title": "Data Sharing Agreement", "description": "Documented evidence of formal data sharing practices that address, at a minimum:\n• The business justification for the data sharing;\n• The type / category of data being shared;\n• The third-parties the data is being shared with;\n• Lawful bases for data sharing; and\n• Data subject rights.", "areaOfFocus": "Privacy", "documentationArtifact": "Data Sharing Agreement", "controlMappings": [ "PRI-07", "PRI-07.1" ] }, { "uuid": "bb9aa59f-04cc-5a15-9468-49358710cdf3", "erlNumber": "E-PRI-06", "title": "Data Subject Access", "description": "Documented evidence of how data subject access requests are handled that includes intake through remediation.", "areaOfFocus": "Privacy", "documentationArtifact": "Data Subject Access", "controlMappings": [ "PRI-06" ] }, { "uuid": "b146e41a-61a3-54b5-9082-6c0aa30114e3", "erlNumber": "E-PRI-07", "title": "Personal Data Categories", "description": "Documented evidence of formal personal data categories.", "areaOfFocus": "Privacy", "documentationArtifact": "Personal Data Categories", "controlMappings": [ "PRI-05.7" ] }, { "uuid": "9b0b87c9-b5b0-5d35-8966-3493d4d44d32", "erlNumber": "E-PRI-08", "title": "Data Privacy Notice", "description": "Documented evidence of a publicly-accessible data privacy notice.", "areaOfFocus": "Privacy", "documentationArtifact": "Data Privacy Notice", "controlMappings": [ "PRI-02" ] }, { "uuid": "e268d3b2-4e08-586c-8cf3-b0656cfbcac1", "erlNumber": "E-PRM-01", "title": "Cybersecurity Business Plan (CBP)", "description": "Documented evidence of a cybersecurity-specific business plan that documents a strategic plan and discrete objectives.", "areaOfFocus": "Resource Management", "documentationArtifact": "Cybersecurity Business Plan (CBP)", "controlMappings": [ "GOV-08", "PRM-01.1", "PRM-03" ] }, { "uuid": "4e72c42c-4326-58ca-93e5-0bf6d608a709", "erlNumber": "E-PRM-02", "title": "Portfolio Roadmap", "description": "Documented evidence of the organization's roadmap for implementing cybersecurity-related initiatives and technologies.", "areaOfFocus": "Resource Management", "documentationArtifact": "Portfolio Roadmap", "controlMappings": [ "PRM-01", "PRM-02", "PRM-03" ] }, { "uuid": "80f4a0fc-1b8c-5c0d-8687-e626dca37ba2", "erlNumber": "E-PRM-03", "title": "Secure Development Lifecycle (SDLC)", "description": "Documented evidence of a secure development lifecycle that the organization utilizes for new initiatives or significant changes to existing initiatives to ensure cybersecurity & data privacy principles are identified and implemented by default.", "areaOfFocus": "Resource Management", "documentationArtifact": "Secure Development Lifecycle (SDLC)", "controlMappings": [ "PRM-04", "PRM-05", "PRM-06", "PRM-07" ] }, { "uuid": "21f936dc-6203-50f5-874f-5a49cec45464", "erlNumber": "E-PRM-05", "title": "System Design Document (SDD)", "description": "Documented evidence of a System Design Document (SDD) focuses on how a Technology Asset, Application and/or Service (TAAS) is built (e.g., architecture, components, data flow, functions, etc.).", "areaOfFocus": "Resource Management", "documentationArtifact": "System Design Document (SDD)", "controlMappings": [ "PRM-04", "PRM-05", "PRM-06", "PRM-07" ] }, { "uuid": "fd633997-bd05-5f07-a36b-8abb46018399", "erlNumber": "E-PRM-06", "title": "Quarterly Business Review (QBR)", "description": "Documented evidence of a Quarterly Business Review (QBR), or similar process, to provide recurring status reports on the current state of the cybersecurity and data protection program.", "areaOfFocus": "Resource Management", "documentationArtifact": "Quarterly Business Review (QBR)", "controlMappings": [ "GOV-01.1" ] }, { "uuid": "630f844a-8b2f-5353-956a-cf6aef057aa5", "erlNumber": "E-RSK-01", "title": "Risk Management Program (RMP)", "description": "Documented evidence of a Risk Management Program (RMP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards.", "areaOfFocus": "Risk Management", "documentationArtifact": "Risk Management Program (RMP)", "controlMappings": [ "RSK-01", "RSK-01.1", "RSK-02", "RSK-12" ] }, { "uuid": "cb395c53-8d52-571e-be18-da35d25b6560", "erlNumber": "E-RSK-02", "title": "Supply Chain Risk Management (SCRM) Plan", "description": "Documented evidence of a Supply Chain Risk Management (SCRM) Plan. This is program-level documentation in the form of a playbook, concept of operations or a similar format provides guidance on organizational practices that support existing policies and standards.", "areaOfFocus": "Risk Management", "documentationArtifact": "Supply Chain Risk Management (SCRM) Plan", "controlMappings": [ "IRO-10.4", "RSK-09", "TPM-03", "TPM-05", "TPM-05.2" ] }, { "uuid": "edb087d6-432e-57ef-8923-5955e41ffba7", "erlNumber": "E-RSK-03", "title": "Plan of Actions & Milestones (POA&M) / Risk Register", "description": "Documented evidence of a POA&M, or risk register, that tracks control deficiencies from identification through remediation.", "areaOfFocus": "Risk Management", "documentationArtifact": "Plan of Actions & Milestones (POA&M) / Risk Register", "controlMappings": [ "AST-02.4", "CPL-02", "IAO-05", "RSK-04.1", "RSK-06", "RSK-06.1", "RSK-06.2", "VPM-02", "VPM-03" ] }, { "uuid": "9ad71bae-9fc2-5260-a006-30ef71a055bb", "erlNumber": "E-RSK-04", "title": "Cybersecurity Risk Assessment (RA)", "description": "Documented evidence of a cybersecurity-specific risk assessment.", "areaOfFocus": "Risk Management", "documentationArtifact": "Cybersecurity Risk Assessment (RA)", "controlMappings": [ "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-05", "VPM-02", "VPM-03" ] }, { "uuid": "fdd9ecaf-806e-5164-b4d4-f5eb1278f43e", "erlNumber": "E-RSK-05", "title": "Supply Chain Risk Assessment (SCRA)", "description": "Documented evidence of supply chain-specific risk assessment that evaluates risks that are specific to its supply chain.", "areaOfFocus": "Risk Management", "documentationArtifact": "Supply Chain Risk Assessment (SCRA)", "controlMappings": [ "RSK-09.1" ] }, { "uuid": "20f8118c-8cd4-5dea-872c-28aa5608367d", "erlNumber": "E-RSK-06", "title": "Risk Threshold", "description": "Documented evidence the organization has a defined risk threshold.", "areaOfFocus": "Risk Management", "documentationArtifact": "Risk Threshold", "controlMappings": [ "RSK-01.1", "RSK-01.3" ] }, { "uuid": "c7c1dc21-1666-5c2a-99c7-12dee232acf6", "erlNumber": "E-RSK-07", "title": "Risk Tolerance", "description": "Documented evidence the organization has a defined risk tolerance.", "areaOfFocus": "Risk Management", "documentationArtifact": "Risk Tolerance", "controlMappings": [ "RSK-01.1", "RSK-01.4" ] }, { "uuid": "4addd8c9-2abe-5bc6-a42d-c0ce41baeffe", "erlNumber": "E-RSK-08", "title": "Risk Appetite", "description": "Documented evidence the organization has a defined risk appetite.", "areaOfFocus": "Risk Management", "documentationArtifact": "Risk Appetite", "controlMappings": [ "RSK-01.1", "RSK-01.5" ] }, { "uuid": "8321ad53-0f17-557f-89bb-42bbd380e7c0", "erlNumber": "E-RSK-09", "title": "Risk Catalog", "description": "Documented evidence of a risk catalog.", "areaOfFocus": "Risk Management", "documentationArtifact": "Risk Catalog", "controlMappings": [ "RSK-03.1" ] }, { "uuid": "345e53cc-fda3-5b2e-87e4-8368b8ce9b2a", "erlNumber": "E-RSK-13", "title": "Risk Treatment Options", "description": "Documented evidence of organization-approved risk treatment options.", "areaOfFocus": "Risk Management", "documentationArtifact": "Risk Treatment Options", "controlMappings": [ "RSK-06.3" ] }, { "uuid": "6115a424-679a-5652-953c-40f31b24133d", "erlNumber": "E-SAT-01", "title": "Continuing Professional Education (CPE)", "description": "Documented evidence of Continuing Professional Education (CPE) requirements for cybersecurity & data privacy personnel.", "areaOfFocus": "Education", "documentationArtifact": "Continuing Professional Education (CPE)", "controlMappings": [ "SAT-03.7" ] }, { "uuid": "89612596-e807-5a80-875f-6f97550c731b", "erlNumber": "E-SAT-02", "title": "Initial User Training", "description": "Documented evidence of initial user training for security, compliance and/or resilience topics.", "areaOfFocus": "Education", "documentationArtifact": "Initial User Training", "controlMappings": [ "SAT-01", "SAT-02", "SAT-02.2", "SAT-04", "HRS-05.7" ] }, { "uuid": "96275ab8-ee82-501a-8c47-ccdadfd9108f", "erlNumber": "E-SAT-03", "title": "Practical Exercises", "description": "Documented evidence of practical user training exercises for security, compliance and/or resilience topics (e.g., phishing exercise).", "areaOfFocus": "Education", "documentationArtifact": "Practical Exercises", "controlMappings": [ "SAT-02.1", "SAT-03.1", "SAT-04" ] }, { "uuid": "dc8ee7e6-10cf-54b5-8413-298f36fc1539", "erlNumber": "E-SAT-04", "title": "Recurring User Training", "description": "Documented evidence of recurring (e.g., annual) user training for security, compliance and/or resilience topics.", "areaOfFocus": "Education", "documentationArtifact": "Recurring User Training", "controlMappings": [ "SAT-01", "SAT-03.6", "SAT-03.7", "SAT-04", "HRS-05.7", "THR-05" ] }, { "uuid": "1a6683f6-dc71-531d-bd10-6995473835d2", "erlNumber": "E-SAT-05", "title": "Role-Based Training", "description": "Documented evidence of specialized user training for privileged users, executives, individuals who handle sensitive/regulated data, etc.", "areaOfFocus": "Education", "documentationArtifact": "Role-Based Training", "controlMappings": [ "DCH-14", "SAT-01", "SAT-03", "SAT-03.5", "SAT-04", "THR-05" ] }, { "uuid": "30f5a164-0670-58a2-9c19-b33e9ac444f4", "erlNumber": "E-SAT-06", "title": "Training Materials", "description": "Documented evidence of security awareness training materials (e.g., curriculum, course work, presentations, etc.)", "areaOfFocus": "Education", "documentationArtifact": "Training Materials", "controlMappings": [ "SAT-04" ] }, { "uuid": "3a8d8d35-ed59-5e9d-ba86-c080589f00b2", "erlNumber": "E-SAT-07", "title": "Training Records", "description": "Documented evidence of security awareness training records", "areaOfFocus": "Education", "documentationArtifact": "Training Records", "controlMappings": [ "SAT-04" ] }, { "uuid": "f898a271-27ad-525e-9378-fbdb4c8b2bef", "erlNumber": "E-SEA-01", "title": "Logon Banner", "description": "Documented evidence of a system use notification message or logon banner.", "areaOfFocus": "Secure Engineering & Architecture", "documentationArtifact": "Logon Banner", "controlMappings": [ "SEA-18", "SEA-18.1", "SEA-18.2" ] }, { "uuid": "bc38526f-c88c-504a-ae67-12569e4570bb", "erlNumber": "E-SEA-02", "title": "Security Architecture", "description": "Documented evidence of security architecture-related documentation.", "areaOfFocus": "Secure Engineering & Architecture", "documentationArtifact": "Security Architecture", "controlMappings": [ "SEA-01", "SEA-02" ] }, { "uuid": "06465757-e460-552d-a46c-ef081263aa83", "erlNumber": "E-TDA-01", "title": "Secure Software Development Principles (SSDP)", "description": "Documented evidence of a Secure Software Development Principles (SSDP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards.", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "Secure Software Development Principles (SSDP)", "controlMappings": [ "SEA-01", "TDA-01", "TDA-14", "TDA-14.1", "TDA-14.2" ] }, { "uuid": "bab858e5-a8e7-55aa-8ce6-ed670038624b", "erlNumber": "E-TDA-02", "title": "Secure Engineering & Data Privacy (SEDP)", "description": "Documented evidence of a Secure Engineering & Data Privacy (SEDP) program. This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards.", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "Secure Engineering & Data Privacy (SEDP)", "controlMappings": [ "SEA-01", "TDA-01", "TDA-14", "TDA-14.1", "TDA-14.2" ] }, { "uuid": "cd7433e7-7760-52c1-8f63-ca387a3fb433", "erlNumber": "E-TDA-03", "title": "Application Security Testing (AST)", "description": "Documented evidence of application security testing (e.g., DAST, SAST, fuzzing, etc.).", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "Application Security Testing (AST)", "controlMappings": [ "TDA-06.2", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6" ] }, { "uuid": "098ccfa1-0df9-5243-b848-0cce71d993c0", "erlNumber": "E-TDA-04", "title": "Design and Development Plan (DDP)", "description": "Documented evidence of an engineering method to control the design process and govern the lifecycle of the product/service.", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "Design and Development Plan (DDP)", "controlMappings": [ "SEA-01", "SEA-02", "SEA-03", "TDA-02.3", "TDA-05", "TDA-06.3", "TDA-14", "TDA-14.1", "TDA-14.2" ] }, { "uuid": "846c0654-3fa4-5548-84b3-a4585f7aa9cd", "erlNumber": "E-TDA-05", "title": "Failure Mode and Effect Analysis (FMEA)", "description": "Documented evidence of an engineering method designed to define, identify, and present solutions for system failures, problems, or errors.", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "Failure Mode and Effect Analysis (FMEA)", "controlMappings": [ "TDA-01.1", "TDA-06.5", "TDA-09" ] }, { "uuid": "2250902e-ef65-5912-8138-a7cf99bb6d7b", "erlNumber": "E-TDA-06", "title": "Multi Patient Harm View (MPHV)", "description": "Documented evidence of a description of a Multi Patient Harm View (MPHV) that explains how the device / system defends against and/or responds to attacks with the potential to harm multiple patients. [note MPHV is specific to medical device manufacturers]", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "Multi Patient Harm View (MPHV)", "controlMappings": [ "TDA-01.1", "TDA-02", "TDA-04", "TDA-04.1" ] }, { "uuid": "41c50f45-afdd-5523-9b79-ee297bb1e823", "erlNumber": "E-TDA-07", "title": "Ports, Protocols & Services (PPS)", "description": "Documented evidence of all ports, protocols and services in use by the system, application or service.", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "Ports, Protocols & Services (PPS)", "controlMappings": [ "TDA-01.1", "TDA-02.1", "TPM-04.2" ] }, { "uuid": "f231aec8-13e2-5144-b995-27cd10990260", "erlNumber": "E-TDA-08", "title": "Secure Engineering Principles (SEP)", "description": "Documented evidence of defined secure engineering principles used to ensure Sensitivity, Integrity, Availability & Safety (CIAS) concerns are properly addressed in the design and implementation of Technology Assets, Applications and/or Services (TAAS).", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "Secure Engineering Principles (SEP)", "controlMappings": [ "SEA-01", "TDA-01", "TDA-06", "TDA-14", "TDA-14.1", "TDA-14.2" ] }, { "uuid": "b29deceb-79e1-55c0-8e01-f3178e269897", "erlNumber": "E-TDA-09", "title": "Security Architecture View", "description": "Documented evidence that identifies security-relevant system elements and their interfaces:\n• Define security context, domains, boundaries, and external interfaces of the system;\n• Align the architecture with (a) the system security objectives and requirements, (b) security design characteristics; and\n• Establish traceability of architecture elements to user and system security requirements.", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "Security Architecture View", "controlMappings": [ "CLD-02", "SEA-01", "SEA-02", "SEA-03" ] }, { "uuid": "763e625f-3efc-5c25-91f6-021872fdbbf2", "erlNumber": "E-TDA-10", "title": "Security Use Case View (SUCV)", "description": "Documented evidence of diagrams, with explanatory text, describing various security scenarios in each of the operational and clinical functionality states of the system and how the system addresses each scenario architecturally. [note SUCV is specific to medical device manufacturers]", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "Security Use Case View (SUCV)", "controlMappings": [ "TDA-04", "TDA-04.1", "TDA-06.2" ] }, { "uuid": "c56c7a04-6e3b-51ad-b6d8-7915ddb99024", "erlNumber": "E-TDA-11", "title": "Software Assurance Maturity Model (SAMM)", "description": "Documented evidence of a Software Assurance Maturity Model (SAMM).", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "Software Assurance Maturity Model (SAMM)", "controlMappings": [ "TDA-06", "TDA-06.3" ] }, { "uuid": "e1980b3f-c30a-57b1-b71d-7544bca3b29d", "erlNumber": "E-TDA-12", "title": "Software Bill of Materials (SBOM)", "description": "Documented evidence of a Software Bill of Materials (SBOM).", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "Software Bill of Materials (SBOM)", "controlMappings": [ "TDA-04.2" ] }, { "uuid": "867cb9bd-7c34-58aa-860d-10ae31c8c39e", "erlNumber": "E-TDA-14", "title": "System Security Plan (SSP)", "description": "Documented evidence of at least one (1) System Security Plan (SSP) that covers the sensitive/regulated data environment. There may be multiple SSPs, based on applicable contracts.", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "System Security Plan (SSP)", "controlMappings": [ "AST-02.4", "IAO-03" ] }, { "uuid": "91108181-0c73-5435-a8ef-3272244605fd", "erlNumber": "E-TDA-15", "title": "Updateability / Patchability View", "description": "Documented evidence of a description of the end-to-end process permitting software updates and patches to be deployed to the device/service.", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "Updateability / Patchability View", "controlMappings": [ "TDA-01.1", "TDA-01.2", "TDA-04.1" ] }, { "uuid": "63ba0992-d621-5af4-8591-0f3b70c18e46", "erlNumber": "E-TDA-16", "title": "Vulnerability Disclosure Program (VDP)", "description": "Documented evidence of a Vulnerability Disclosure Program (VDP) (e.g., bug bounty).", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "Vulnerability Disclosure Program (VDP)", "controlMappings": [ "THR-06" ] }, { "uuid": "819783d8-be90-54af-8e38-dc739e1d18b1", "erlNumber": "E-TDA-17", "title": "System Design Documentation", "description": "Documented evidence of system design documentation.", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "System Design Documentation", "controlMappings": [ "TDA-01", "TDA-01.1" ] }, { "uuid": "df80a95f-9096-5424-8b05-14a40a799e92", "erlNumber": "E-TDA-18", "title": "System Security Plan (SSP) Reviews", "description": "Documented evidence of reviews and/or updates to System Security Plan (SSP) documentation.", "areaOfFocus": "Technology Design & Acquisition", "documentationArtifact": "System Security Plan (SSP) Reviews", "controlMappings": [ "IAO-03" ] }, { "uuid": "b235d68f-2478-51fe-9f88-8baad09c6c31", "erlNumber": "E-THR-01", "title": "Indicators of Exposure (IOE)", "description": "Documented evidence of defined Indicators of Exposure (IOE).", "areaOfFocus": "Threat Management", "documentationArtifact": "Indicators of Exposure (IOE)", "controlMappings": [ "THR-02" ] }, { "uuid": "75b91ec2-f5f8-506b-bc8e-32c4955fe46b", "erlNumber": "E-THR-02", "title": "Industry Associations / Memberships", "description": "Documented evidence of industry associations the organization utilizes to maintain situational awareness of evolving threats and trends.", "areaOfFocus": "Threat Management", "documentationArtifact": "Industry Associations / Memberships", "controlMappings": [ "GOV-07" ] }, { "uuid": "d082382a-f5c7-51ad-9e36-296dc61cecbc", "erlNumber": "E-THR-03", "title": "Threat Intelligence Feeds (TIF)", "description": "Documented evidence of threat intelligence feeds.", "areaOfFocus": "Threat Management", "documentationArtifact": "Threat Intelligence Feeds (TIF)", "controlMappings": [ "THR-03" ] }, { "uuid": "eaa8a79f-5591-57d5-a049-b92b2cb22878", "erlNumber": "E-THR-04", "title": "Threat Intelligence Program (TIP)", "description": "Documented evidence of a formal capability that intakes and analysis threat information to determine specific threat to the organization and necessary actions to mitigate the threat(s).", "areaOfFocus": "Threat Management", "documentationArtifact": "Threat Intelligence Program (TIP)", "controlMappings": [ "THR-01", "THR-04", "THR-05" ] }, { "uuid": "1401aa58-8fad-5625-9db2-2f8774253191", "erlNumber": "E-THR-05", "title": "Threat Mitigation", "description": "Documented evidence of steps taken to mitigate identified threats.", "areaOfFocus": "Threat Management", "documentationArtifact": "Threat Mitigation", "controlMappings": [ "TDA-06.2", "THR-07", "VPM-01", "VPM-04" ] }, { "uuid": "5e03c127-0043-5158-88bb-eea9accdc776", "erlNumber": "E-THR-06", "title": "Threat Catalog", "description": "Documented evidence of a threat catalog.", "areaOfFocus": "Threat Management", "documentationArtifact": "Threat Catalog", "controlMappings": [ "THR-09" ] }, { "uuid": "f5e01e93-3bb4-5491-9c69-a637fd2faa04", "erlNumber": "E-THR-07", "title": "Threat Analysis", "description": "Documented evidence of a completed threat analysis.", "areaOfFocus": "Threat Management", "documentationArtifact": "Threat Analysis", "controlMappings": [ "THR-10" ] }, { "uuid": "2208b3f6-e7eb-5e32-9543-0474673873c4", "erlNumber": "E-TPM-01", "title": "Third-Party Contracts", "description": "Documented evidence of third-party contractual obligations for cybersecurity & data privacy protections.", "areaOfFocus": "Third-Party Management", "documentationArtifact": "Third-Party Contracts", "controlMappings": [ "PRI-07", "PRI-07.1", "TPM-01", "TPM-03.2", "TPM-03.3", "TPM-04.1", "TPM-05", "TPM-04.3", "TPM-05.3", "TPM-05.6", "TPM-06", "TPM-10", "TPM-11" ] }, { "uuid": "db8f60f8-bc48-533e-a13b-c7e86a809ab7", "erlNumber": "E-TPM-02", "title": "Third-Party Criticality Assessment", "description": "Documented evidence of third-party criticality assessment that evaluates the critical nature of each third-party the organization works with.", "areaOfFocus": "Third-Party Management", "documentationArtifact": "Third-Party Criticality Assessment", "controlMappings": [ "RSK-02", "RSK-02.1", "TDA-06.1", "TPM-02", "TPM-03.2", "TPM-03.3", "TPM-04.1" ] }, { "uuid": "fc400162-f237-5b73-a8ed-3730b9ae9f4e", "erlNumber": "E-TPM-03", "title": "Third-Party Service Reviews", "description": "Documented evidence of a formal, annual stakeholder review of third-party services for each External Service Provider (ESP).", "areaOfFocus": "Third-Party Management", "documentationArtifact": "Third-Party Service Reviews", "controlMappings": [ "TPM-01", "TPM-03.2", "TPM-03.3", "TPM-04.1", "TPM-05", "TPM-05.5", "TPM-08", "TPM-09" ] }, { "uuid": "e8e6eadf-bf3f-548b-bbea-f3def6d718bc", "erlNumber": "E-TPM-04", "title": "Service Level Agreements (SLAs)", "description": "Documented evidence of third-party Service Level Agreements (SLAs) to support business operations.", "areaOfFocus": "Third-Party Management", "documentationArtifact": "Service Level Agreements (SLAs)", "controlMappings": [ "BCD-09.3", "BCD-10.1", "OPS-03" ] }, { "uuid": "7dd0a9f7-e6ac-5ef3-bd03-02a41e8c135b", "erlNumber": "E-TPM-05", "title": "Break Clauses", "description": "Documented evidence of \"break clauses\" in third-party contracts.", "areaOfFocus": "Third-Party Management", "documentationArtifact": "Break Clauses", "controlMappings": [ "TPM-03.2", "TPM-03.3", "TPM-05.7" ] }, { "uuid": "9ea86dcd-fede-5f6c-bf12-b9fa8581283a", "erlNumber": "E-TPM-06", "title": "Third-Party Terms & Conditions", "description": "Documented evidence of terms and conditions for external systems.", "areaOfFocus": "Third-Party Management", "documentationArtifact": "Third-Party Terms & Conditions", "controlMappings": [ "TPM-01", "TPM-05" ] }, { "uuid": "6003caf8-c6c4-53d9-b5b3-863f8ec3c310", "erlNumber": "E-TPM-07", "title": "System Connection or Processing Agreements", "description": "Documented evidence of system connection or processing agreements.", "areaOfFocus": "Third-Party Management", "documentationArtifact": "System Connection or Processing Agreements", "controlMappings": [ "TPM-05" ] }, { "uuid": "5d364900-13a4-5b47-b5ed-920e1e6fd560", "erlNumber": "E-VPM-01", "title": "Vulnerability & Patch Management Program (VPMP)", "description": "Documented evidence of a Vulnerability & Patch Management Program (VPMP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards.", "areaOfFocus": "Vulnerability & Patch Management", "documentationArtifact": "Vulnerability & Patch Management Program (VPMP)", "controlMappings": [ "VPM-01", "VPM-02", "VPM-03" ] }, { "uuid": "b8dc0bf2-5853-5682-849f-87fdbc376a90", "erlNumber": "E-VPM-02", "title": "Penetration Testing - Application", "description": "Documented evidence of Application Security Testing (AST) activities:\n• Abuse case, malformed, and unexpected inputs (e.g., Robustness or Fuzz testing);\n• Attack surface analysis;\n• Vulnerability chaining;\n• Closed box testing of known vulnerability scanning;\n• Software composition analysis of binary executable files; and/or\n• Static and dynamic code analysis, including testing for credentials that are “hardcoded,” default, easily guessed, and easily compromised.", "areaOfFocus": "Vulnerability Management", "documentationArtifact": "Penetration Testing - Application", "controlMappings": [ "VPM-07" ] }, { "uuid": "67f5bdfb-5525-5cee-923b-232d62d09582", "erlNumber": "E-VPM-03", "title": "Penetration Testing - Network", "description": "Documented evidence of internal and external network penetration testing activities that focus on discovering and exploiting security vulnerabilities.", "areaOfFocus": "Vulnerability Management", "documentationArtifact": "Penetration Testing - Network", "controlMappings": [ "VPM-07" ] }, { "uuid": "53e5ecb4-16b1-5652-aa77-fb3c2c2d38d3", "erlNumber": "E-VPM-04", "title": "Red Team Testing", "description": "Documented evidence of \"red team\" testing.", "areaOfFocus": "Vulnerability Management", "documentationArtifact": "Red Team Testing", "controlMappings": [ "VPM-07.1" ] }, { "uuid": "600452e8-0e0e-5b24-9a75-fd7f50dccae2", "erlNumber": "E-VPM-05", "title": "Vulnerability Assessments", "description": "Documented evidence of internal and external vulnerability assessment activities.", "areaOfFocus": "Vulnerability Management", "documentationArtifact": "Vulnerability Assessments", "controlMappings": [ "VPM-06" ] }, { "uuid": "e96841f3-bc86-5a4e-a989-8a1759bd6ff0", "erlNumber": "E-VPM-06", "title": "Attack Surface Scope", "description": "Documented evidence of the organization defining its attack surface (e.g., may be in the form of graphical network diagrams or other forms of written documentation).", "areaOfFocus": "Vulnerability Management", "documentationArtifact": "Attack Surface Scope", "controlMappings": [ "VPM-01.1" ] }, { "uuid": "06edcfeb-7a41-5f45-bcfc-ce5af871213c", "erlNumber": "E-VPM-07", "title": "Flaw Remediation Change Control", "description": "Documented evidence of installation/change control records for security-relevant software and firmware updates.", "areaOfFocus": "Vulnerability Management", "documentationArtifact": "Flaw Remediation Change Control", "controlMappings": [ "VPM-01.1" ] }, { "uuid": "14e6da3a-17c6-543e-9b8c-6959b3672417", "erlNumber": "E-VPM-08", "title": "Flaw Remediation Test Results", "description": "Documented evidence of test results from the installation of software and firmware updates to correct system flaws.", "areaOfFocus": "Vulnerability Management", "documentationArtifact": "Flaw Remediation Test Results", "controlMappings": [ "VPM-01.1" ] }, { "uuid": "f3f1ced0-c84e-56a6-98a1-139ebc94d3cd", "erlNumber": "E-VPM-09", "title": "Flaw Remediation Actions", "description": "Documented evidence of list of recent security flaw remediation actions performed on the system (e.g., list of installed patches, service packs, hot fixes, and other software updates to correct system flaws).", "areaOfFocus": "Vulnerability Management", "documentationArtifact": "Flaw Remediation Actions", "controlMappings": [ "VPM-02" ] }, { "uuid": "b0e8d5b3-e976-599c-bc02-9de526c95f59", "erlNumber": "E-VPM-10", "title": "Applicable Flaws & Vulnerabilities", "description": "Documented evidence of flaws and vulnerabilities potentially affecting a specific system, application and/or service.", "areaOfFocus": "Vulnerability Management", "documentationArtifact": "Applicable Flaws & Vulnerabilities", "controlMappings": [ "VPM-03", "VPM-05" ] }, { "uuid": "8035003d-96a0-581f-adc4-07d42d49bc1b", "erlNumber": "E-VPM-11", "title": "Vulnerability Scanning", "description": "Documented evidence of internal and external vulnerability scans being performed.", "areaOfFocus": "Vulnerability Management", "documentationArtifact": "Vulnerability Scanning", "controlMappings": [ "VPM-06" ] }, { "uuid": "010e719f-e153-59a6-8ebc-8decade415fa", "erlNumber": "E-NUC-01", "title": "Critical Systems (CS) & Critical Digital Asset (CDA) Inventory and SSEP Consequence Analysis", "description": "Documented inventory of all Critical Systems (CSs) and Critical Digital Assets (CDAs) supporting Safety-Related, Important-to-Safety (ITS), Security, Balance-of-Plant (BOP), and Emergency Preparedness (EP) functions, including unmitigated SSEP consequence and direct/indirect pathway analyses per 10 CFR 73.54(b)(1), RG 5.71 Rev. 1 (A.3.1.3), and NEI 13-10.", "areaOfFocus": "Nuclear Asset & Consequence Management", "documentationArtifact": "Critical Systems (CS) & Critical Digital Asset (CDA) Inventory and SSEP Consequence Analysis", "controlMappings": [ "NUC-01", "AST-01", "AST-02", "AST-02.1", "EMB-03" ] }, { "uuid": "882568ee-29d2-571e-9201-f4f00e0e5c60", "erlNumber": "E-NUC-02", "title": "Physical & Electronic Walkdown Validation Records for CDAs", "description": "Comprehensive walkdown inspection records performed by the Cyber Security Team (CST) tracing all physical and logical communication pathways into and out of each CDA, verifying termination points, tamper seals, locked cabinets, and resolving undocumented connections per RG 5.71 Rev. 1 (A.3.1.4).", "areaOfFocus": "Nuclear Assurance & Walkdown Validation", "documentationArtifact": "Physical & Electronic Walkdown Validation Records for CDAs", "controlMappings": [ "NUC-01", "IAO-02", "AST-01.1", "PES-01" ] }, { "uuid": "ab7ba87e-57e2-528b-8f91-340fbf8da25e", "erlNumber": "E-NUC-03", "title": "Nuclear Defensive Architecture Diagram & Hardware Data Diode Verification", "description": "Detailed defensive architecture diagrams showing Security Levels 4, 3, 2, 1, and 0 (or IEC 62645 Security Degrees S1–S3) and validation test results proving hardware-enforced deterministic unidirectional flow (optical data diodes) from Level 4/3 CDAs to lower levels per RG 5.71 Rev. 1 (C.6/C.7) and RG 1.152 Rev. 4.", "areaOfFocus": "Nuclear Defense-in-Depth Architecture", "documentationArtifact": "Nuclear Defensive Architecture Diagram & Hardware Data Diode Verification", "controlMappings": [ "NUC-02", "NET-02", "NET-03", "NET-03.1", "EMB-03" ] }, { "uuid": "f2e33495-b7bb-5499-ab46-5173cab73190", "erlNumber": "E-NUC-04", "title": "10 CFR 73.58 Safety-Security Interface & 10 CFR 50.59 Modification Screening Records", "description": "Completed engineering change packages and 10 CFR 73.58 / 10 CFR 50.59 screening determinations demonstrating cross-functional review between reactor engineering/operations and cybersecurity prior to modifying CDAs or security controls.", "areaOfFocus": "Nuclear Change Management & Safety-Security Interface", "documentationArtifact": "10 CFR 73.58 Safety-Security Interface & 10 CFR 50.59 Modification Screening Records", "controlMappings": [ "NUC-03", "CHG-01", "CHG-02", "CHG-03", "SEA-01" ] }, { "uuid": "d3a4e3a3-166d-5b38-9f2c-dff8cfb82050", "erlNumber": "E-NUC-05", "title": "Attack Vector & Attack Tree Equivalency Analyses for Alternate Controls", "description": "Formal attack tree and attack vector analyses evaluated up to and including the Design Basis Threat (DBT), justifying any omitted Appendix B technical controls or demonstrating equivalency of alternate countermeasures per RG 5.71 Rev. 1 (A.3.1.6) and NEI 13-10.", "areaOfFocus": "Nuclear Risk & Alternate Control Justification", "documentationArtifact": "Attack Vector & Attack Tree Equivalency Analyses for Alternate Controls", "controlMappings": [ "NUC-04", "RSK-04", "SEA-01.1", "IAO-02" ] }, { "uuid": "c44d842b-a010-5e76-8211-096a3975c46c", "erlNumber": "E-NUC-06", "title": "10 CFR 73.77 (1/4/8-Hour) & NERC CIP-008-6 Cyber Event Notification Drills and Logs", "description": "Procedures, drill records, and 24-hour event logs demonstrating capability to classify and report nuclear cyber security events to the NRC Headquarters Operations Center within 1, 4, and 8 hours (10 CFR 73.77 / RG 5.83 Rev. 1) and to the E-ISAC/CISA within 1 hour (NERC CIP-008-6).", "areaOfFocus": "Nuclear Incident Reporting", "documentationArtifact": "10 CFR 73.77 (1/4/8-Hour) & NERC CIP-008-6 Cyber Event Notification Drills and Logs", "controlMappings": [ "NUC-05", "IRO-01", "IRO-06", "IRO-06.1" ] } ], "risks": [ { "uuid": "7d2965f9-a93e-5600-a507-d1a0ddb89adf", "riskNumber": "MT-1", "title": "Civil or Political Unrest", "description": "Civil or political unrest can be singular or wide-spread events that can be unexpected and unpredictable. These events can occur anywhere, at any time.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Civil or political unrest can be singular or wide-spread events that can be unexpected and unpredictable. These events can occur anywhere, at any time.", "threatNumbers": "MT-1", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.2", "CRY-01.3", "CRY-01.4", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-19", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "b9a6c5c8-a059-56e1-80aa-1956d521fdd5", "riskNumber": "MT-10", "title": "Technical / Mechanical Failure", "description": "Technical /mechanical failure is a broad category that includes non-malicious failure due to a defect in the technology, materials or workmanship. Technical / mechanical failures are unexpected and unpredictable, even when routine and preventative maintenance is performed. These incidents can range from malfunctions, to reliability concerns to catastrophic damage (including loss of life).", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Technical /mechanical failure is a broad category that includes non-malicious failure due to a defect in the technology, materials or workmanship. Technical / mechanical failures are unexpected and unpredictable, even when routine and preventative maintenance is performed. These incidents can range from malfunctions, to reliability concerns to catastrophic damage (including loss of life).", "threatNumbers": "MT-10", "controlMappings": [ "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CHG-08", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.2", "CRY-01.3", "CRY-01.4", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-03.3", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.5", "END-14.6", "END-16", "END-16.1", "HRS-08", "HRS-09", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-12.1", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.3", "IRO-02.4", "IRO-02.6", "IRO-03", "IRO-04", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.4", "IRO-10.5", "IRO-11.1", "IRO-11.2", "IRO-15", "IRO-16", "IAO-02", "IAO-02.2", "IAO-06", "IAO-07", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-04.12", "NET-04.13", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-15", "PES-16", "PRI-01", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "SEA-01.2", "SEA-01.3", "SEA-03.1", "SEA-03.2", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13.1", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-19", "SEA-20", "OPS-01", "SAT-01", "SAT-01.1", "SAT-02.1", "TDA-01.2", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-20.4", "TPM-03.4", "VPM-05.4", "VPM-06.9", "VPM-07", "VPM-08", "WEB-03" ] }, { "uuid": "9969ba18-b85c-5b3c-9c5a-aa1154c959bb", "riskNumber": "MT-11", "title": "Statutory / Regulatory / Contractual Obligation", "description": "Laws, regulations and/or contractual obligations that directly or indirectly weaken an organization's security & privacy controls. This includes hostile nation states that leverage statutory and/or regulatory means for economic or political espionage and/or cyberwarfare activities. \n\nChanges in statutes, laws, policies, regulations and/or agreements that materially impact a business or market sector and that can increase business operating costs, reduce the attractiveness of investment, or change the competitive landscape. This extends across the supply chain due to a wide-range of laws and regulations.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Laws, regulations and/or contractual obligations that directly or indirectly weaken an organization's security & privacy controls. This includes hostile nation states that leverage statutory and/or regulatory means for economic or political espionage and/or cyberwarfare activities. \n\nChanges in statutes, laws, policies, regulations and/or agreements that materially impact a business or market sector and that can increase business operating costs, reduce the attractiveness of investment, or change the competitive landscape. This extends across the supply chain due to a wide-range of laws and regulations.", "threatNumbers": "MT-11", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CHG-08", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-06.1", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.2", "CRY-01.3", "CRY-01.4", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.5", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-03.5", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-15", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-19", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.4", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "7b5c4f4e-fbb8-5b8a-8844-34e802842222", "riskNumber": "MT-12", "title": "Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data", "description": "Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) data is information an organization utilizes for business processes even though the data is untrustworthy, due to the data's currency, accuracy, integrity and/or applicability.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) data is information an organization utilizes for business processes even though the data is untrustworthy, due to the data's currency, accuracy, integrity and/or applicability.", "threatNumbers": "MT-12", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-02.10", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-04.2", "AST-04.3", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-06.1", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-09.1", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-03.3", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.5", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-03.5", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-04.12", "NET-04.13", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-15", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-19", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-03.7", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "c61b485e-ba92-52f8-bb0b-3392f4b8f6a1", "riskNumber": "MT-13", "title": "Artificial Intelligence & Autonomous Technologies (AAT)", "description": "Artificial Intelligence & Autonomous Technologies (AAT) is a broad category that ranges from non-malicious failure due to a defect in the algorithm to emergent properties or unintended consequences. AAT failures can be due to hardware failures, inherent biases or other flaws in the underlying algorithm. These incidents can range from malfunctions, to reliability concerns to catastrophic damage (including loss of life).", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Artificial Intelligence & Autonomous Technologies (AAT) is a broad category that ranges from non-malicious failure due to a defect in the algorithm to emergent properties or unintended consequences. AAT failures can be due to hardware failures, inherent biases or other flaws in the underlying algorithm. These incidents can range from malfunctions, to reliability concerns to catastrophic damage (including loss of life).", "threatNumbers": "MT-13", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-02.10", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-04.2", "AST-04.3", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-06.1", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-09.1", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.2", "CRY-01.3", "CRY-01.4", "CRY-01.5", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-03.3", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.5", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-03.5", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-04.12", "NET-04.13", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-15", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-19", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-03.7", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "5b58cf89-7048-5282-bbf0-f9783af128df", "riskNumber": "MT-14", "title": "Fraud, Corruption and/or Willful Criminal Conduct", "description": "Willful criminal conduct is a broad category that includes consciously-committed criminal acts performed by individuals (e.g., mens rea). These incidents can include a wide-range of activities that includes fraud, corruption, theft and illegal content. Criminal conduct generally involves one of the following kinds of mens rea: (1) intent, (2) knowledge, (3) recklessness and/or (4) negligence.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Willful criminal conduct is a broad category that includes consciously-committed criminal acts performed by individuals (e.g., mens rea). These incidents can include a wide-range of activities that includes fraud, corruption, theft and illegal content. Criminal conduct generally involves one of the following kinds of mens rea: (1) intent, (2) knowledge, (3) recklessness and/or (4) negligence.", "threatNumbers": "MT-14", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "GOV-19", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-02.10", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-04.2", "AST-04.3", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-06.1", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-09.1", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.2", "CRY-01.3", "CRY-01.4", "CRY-01.5", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-03.3", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.5", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-03.5", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-16.5", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IAC-30", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-04.12", "NET-04.13", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-15", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-19", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-03.7", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "97a252d6-84e9-5719-af1f-2400acb31889", "riskNumber": "MT-15", "title": "Conflict of Interest (COI)", "description": "Conflict of Interest (COI) is a broad category but pertains to an ethical incompatibility. COI exist when (1) the concerns or goals of different parties are incompatible or (2) a person in a decision-making position is able to derive personal benefit from actions taken or decisions made in their official capacity.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Conflict of Interest (COI) is a broad category but pertains to an ethical incompatibility. COI exist when (1) the concerns or goals of different parties are incompatible or (2) a person in a decision-making position is able to derive personal benefit from actions taken or decisions made in their official capacity.", "threatNumbers": "MT-15", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.3", "AST-02.4", "AST-02.7", "AST-02.8", "AST-02.9", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-04.2", "AST-04.3", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-06.1", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-07", "CFG-08", "MON-01", "MON-01.1", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.7", "MON-01.8", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02.5", "MON-02.6", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.2", "MON-08.3", "MON-09", "MON-09.1", "MON-10", "MON-11", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.2", "CRY-01.3", "CRY-01.4", "CRY-01.5", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.8", "DCH-24", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.5", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.3", "IAC-03.4", "IAC-03.5", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.3", "IAC-10.5", "IAC-10.6", "IAC-10.8", "IAC-10.9", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-10", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-15", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-14", "SEA-15", "SEA-16", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-19", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-03.7", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.3", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.5", "VPM-06.8", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "a4539b9a-0b67-570f-a14f-d0825380e9f1", "riskNumber": "MT-16", "title": "Macroeconomics", "description": "Macroeconomic factors that can negatively affect the global supply chain. Macroeconomic factors directly impact unemployment rates, interest rates, exchange rates and commodity prices. Due to how fiscal and monetary policies can negatively affect the global supply chain, this can disrupt or degrade an organization's business operations.\n\nEconomic instability can lead to reduced investment and weakened consumer confidence. Multiple factors may cause instability and may include recession, sanctions, demand shocks, price volatility, inflation and unemployment. An out-of-balance economy can lead to unpredictable fluctuations in growth, inflation, employment and financial health. This instability can be episodic, meaning discrete events such as job loss, or it can be chronic, meaning sustained events such as variations to employee compensation.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Macroeconomic factors that can negatively affect the global supply chain. Macroeconomic factors directly impact unemployment rates, interest rates, exchange rates and commodity prices. Due to how fiscal and monetary policies can negatively affect the global supply chain, this can disrupt or degrade an organization's business operations.\n\nEconomic instability can lead to reduced investment and weakened consumer confidence. Multiple factors may cause instability and may include recession, sanctions, demand shocks, price volatility, inflation and unemployment. An out-of-balance economy can lead to unpredictable fluctuations in growth, inflation, employment and financial health. This instability can be episodic, meaning discrete events such as job loss, or it can be chronic, meaning sustained events such as variations to employee compensation.", "threatNumbers": "MT-16", "controlMappings": [ "GOV-01", "AST-01", "BCD-01", "BCD-01.5", "CAP-01", "CAP-05", "CHG-01", "CLD-01", "CPL-01", "CPL-01.4", "CFG-01", "MON-01", "MON-01.16", "CRY-01", "DCH-01", "EMB-01", "END-01", "HRS-01", "IAC-01", "IAC-01.3", "IRO-01", "IAO-01", "MNT-01", "MDM-01", "NET-01", "PES-01", "PRI-01", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-09", "RSK-09.1", "SEA-01", "SEA-07.1", "OPS-01", "SAT-01", "SAT-01.1", "TDA-01", "TDA-01.1", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09", "TDA-14", "TDA-17", "TDA-17.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "WEB-01" ] }, { "uuid": "ae27058a-4391-5e8a-89e0-316d7933cd4a", "riskNumber": "MT-17", "title": "Foreign Ownership, Control, or Influence (FOCI)", "description": "Foreign Ownership, Control, or Influence (FOCI) is a Supply Chain Risk Management (SCRM) threat category that pertains to the ownership of, control of, or influence over an organization. Primarily, the concern is if a foreign interest (e.g., foreign government or parties owned or controlled by a foreign government) has the direct or indirect ability to influence decisions that affect the management or operations of the organization.\n\nThe ability exercise the power to influence management or operations may result in unauthorized access to sensitive / regulated data or may adversely affect the performance of contracts and/or programs. FOCI may have national security implications, in addition to corporate espionage / maleficence.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Foreign Ownership, Control, or Influence (FOCI) is a Supply Chain Risk Management (SCRM) threat category that pertains to the ownership of, control of, or influence over an organization. Primarily, the concern is if a foreign interest (e.g., foreign government or parties owned or controlled by a foreign government) has the direct or indirect ability to influence decisions that affect the management or operations of the organization.\n\nThe ability exercise the power to influence management or operations may result in unauthorized access to sensitive / regulated data or may adversely affect the performance of contracts and/or programs. FOCI may have national security implications, in addition to corporate espionage / maleficence.", "threatNumbers": "MT-17", "controlMappings": [ "GOV-01", "AST-01", "BCD-01", "BCD-01.5", "CAP-01", "CAP-05", "CHG-01", "CLD-01", "CPL-01", "CPL-01.4", "CFG-01", "MON-01", "MON-01.16", "CRY-01", "DCH-01", "EMB-01", "END-01", "HRS-01", "IAC-01", "IAC-01.3", "IRO-01", "IAO-01", "MNT-01", "MDM-01", "NET-01", "PES-01", "PRI-01", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-07.1", "OPS-01", "SAT-01", "SAT-01.1", "TDA-01", "TDA-01.1", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09", "TDA-14", "TDA-17", "TDA-17.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "WEB-01" ] }, { "uuid": "2da08fde-bfa9-5942-96a7-7d3b66605f04", "riskNumber": "MT-18", "title": "Geopolitical", "description": "Geopolitical is a Supply Chain Risk Management (SCRM) threat category that pertains to a specific geographic location, or region of relevance, that affects the supply chain. Primarily, the concern is if a foreign state can affect the supply chain through political intervention within the host nation.\n\nInternal or geopolitical instability can lead to disrupted supply chain operations, increased business operating costs, reduced attractiveness of investment and/or altered competitive landscapes.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Geopolitical is a Supply Chain Risk Management (SCRM) threat category that pertains to a specific geographic location, or region of relevance, that affects the supply chain. Primarily, the concern is if a foreign state can affect the supply chain through political intervention within the host nation.\n\nInternal or geopolitical instability can lead to disrupted supply chain operations, increased business operating costs, reduced attractiveness of investment and/or altered competitive landscapes.", "threatNumbers": "MT-18", "controlMappings": [ "GOV-01", "AST-01", "BCD-01", "BCD-01.5", "CAP-01", "CAP-05", "CHG-01", "CLD-01", "CPL-01", "CPL-01.4", "CFG-01", "MON-01", "MON-01.16", "CRY-01", "DCH-01", "EMB-01", "END-01", "HRS-01", "IAC-01", "IAC-01.3", "IRO-01", "IAO-01", "MNT-01", "MDM-01", "NET-01", "PES-01", "PRI-01", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-09", "RSK-09.1", "SEA-01", "SEA-07.1", "OPS-01", "SAT-01", "SAT-01.1", "TDA-01", "TDA-01.1", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09", "TDA-14", "TDA-17", "TDA-17.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "WEB-01" ] }, { "uuid": "28e2c6de-4143-5b6c-96ff-4b43c4cadd62", "riskNumber": "MT-19", "title": "Sanctions", "description": "Sanctions is a Supply Chain Risk Management (SCRM) threat category that pertains to past or present fraudulent activity or corruption. Primarily, the concern is if the third-party is subject to suspension, exclusion or other sanctions that can affect the supply chain.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Sanctions is a Supply Chain Risk Management (SCRM) threat category that pertains to past or present fraudulent activity or corruption. Primarily, the concern is if the third-party is subject to suspension, exclusion or other sanctions that can affect the supply chain.", "threatNumbers": "MT-19", "controlMappings": [ "GOV-01", "AST-01", "BCD-01", "BCD-01.5", "CAP-01", "CAP-05", "CHG-01", "CLD-01", "CPL-01", "CPL-01.4", "CFG-01", "MON-01", "MON-01.16", "CRY-01", "DCH-01", "EMB-01", "END-01", "HRS-01", "IAC-01", "IAC-01.3", "IRO-01", "IAO-01", "MNT-01", "MDM-01", "NET-01", "PES-01", "PRI-01", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-09", "RSK-09.1", "SEA-01", "SEA-07.1", "OPS-01", "SAT-01", "SAT-01.1", "TDA-01", "TDA-01.1", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09", "TDA-14", "TDA-17", "TDA-17.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "WEB-01" ] }, { "uuid": "5bb1168c-d27b-57ae-b683-9e0707697344", "riskNumber": "MT-2", "title": "Technology & Cybersecurity", "description": "Unlike physical threats that prompt immediate action (e.g., \"stop, drop and roll\" in the event of a fire), cyber incidents are often difficult to identify as the incident is occurring. Detection generally occurs after the incident has occurred, with the exception of \"denial of service\" attacks. The spectrum of cybersecurity risks is limitless and threats can have wide-ranging effects on the individual, organizational, geographic and national levels. \n\nThis category of risk includes the management of cybersecurity requirements for Information and Communications Technology (ICT), including technical vulnerabilities and weaknesses in computation logic (code) found in software and hardware components that, when exploited, results in a negative impact to Confidentiality, Integrity, Availability and/or Safety (CIAS).", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Unlike physical threats that prompt immediate action (e.g., \"stop, drop and roll\" in the event of a fire), cyber incidents are often difficult to identify as the incident is occurring. Detection generally occurs after the incident has occurred, with the exception of \"denial of service\" attacks. The spectrum of cybersecurity risks is limitless and threats can have wide-ranging effects on the individual, organizational, geographic and national levels. \n\nThis category of risk includes the management of cybersecurity requirements for Information and Communications Technology (ICT), including technical vulnerabilities and weaknesses in computation logic (code) found in software and hardware components that, when exploited, results in a negative impact to Confidentiality, Integrity, Availability and/or Safety (CIAS).", "threatNumbers": "MT-2", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-02.10", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CHG-08", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "MON-19", "CRY-01", "CRY-01.1", "CRY-01.2", "CRY-01.3", "CRY-01.4", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.5", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-16.5", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IAC-30", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-09.4", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-19", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-02", "WEB-03", "WEB-04" ] }, { "uuid": "71e347ff-4572-5346-b461-dd4753f08b59", "riskNumber": "MT-20", "title": "Counterfeit / Non-Conforming Products", "description": "Counterfeit / Non-Conforming Products is a Supply Chain Risk Management (SCRM) threat category that pertains to the integrity of components within the supply chain. Counterfeits are products introduced to the supply chain that falsely claim to be produced by the legitimate Original Equipment Manufacturer (OEM), whereas non-conforming are OEM products / materials that fail to meet the customer specifications. Both can have a detrimental effect on the supply chain.\n\nThe items lack industry standard tests during the production phase ( e.g., pressure testing) or are counterfeit items could pose significant risk to the function and safety of the system, increased maintenance costs due to depreciation in quality and added stresses due to an item's inability to function at true capacity.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Counterfeit / Non-Conforming Products is a Supply Chain Risk Management (SCRM) threat category that pertains to the integrity of components within the supply chain. Counterfeits are products introduced to the supply chain that falsely claim to be produced by the legitimate Original Equipment Manufacturer (OEM), whereas non-conforming are OEM products / materials that fail to meet the customer specifications. Both can have a detrimental effect on the supply chain.\n\nThe items lack industry standard tests during the production phase ( e.g., pressure testing) or are counterfeit items could pose significant risk to the function and safety of the system, increased maintenance costs due to depreciation in quality and added stresses due to an item's inability to function at true capacity.", "threatNumbers": "MT-20", "controlMappings": [ "GOV-01", "AST-01", "BCD-01", "BCD-01.5", "CAP-01", "CAP-05", "CHG-01", "CLD-01", "CPL-01", "CPL-01.4", "CFG-01", "MON-01", "MON-01.16", "CRY-01", "DCH-01", "EMB-01", "END-01", "HRS-01", "IAC-01", "IAC-01.3", "IRO-01", "IAO-01", "MNT-01", "MDM-01", "NET-01", "PES-01", "PRI-01", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-09", "RSK-09.1", "SEA-01", "SEA-07.1", "OPS-01", "SAT-01", "SAT-01.1", "TDA-01", "TDA-01.1", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09", "TDA-14", "TDA-17", "TDA-17.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "WEB-01" ] }, { "uuid": "f6871482-f1fb-5d5d-83f3-9e7392036fcd", "riskNumber": "MT-21", "title": "Operational Environment", "description": "Operational Environment is a Supply Chain Risk Management (SCRM) threat category that pertains to the user environment (e.g., place of performance). Primarily, the concern is if the operational environment is hazardous that could expose the organization operationally or financially.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Operational Environment is a Supply Chain Risk Management (SCRM) threat category that pertains to the user environment (e.g., place of performance). Primarily, the concern is if the operational environment is hazardous that could expose the organization operationally or financially.", "threatNumbers": "MT-21", "controlMappings": [ "GOV-01", "AST-01", "BCD-01", "BCD-01.5", "CAP-01", "CAP-05", "CHG-01", "CLD-01", "CPL-01", "CPL-01.4", "CFG-01", "MON-01", "MON-01.16", "CRY-01", "DCH-01", "EMB-01", "END-01", "HRS-01", "IAC-01", "IAC-01.3", "IRO-01", "IAO-01", "MNT-01", "MDM-01", "NET-01", "PES-01", "PRI-01", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-09", "RSK-09.1", "SEA-01", "SEA-07.1", "OPS-01", "SAT-01", "SAT-01.1", "TDA-01", "TDA-01.1", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09", "TDA-14", "TDA-17", "TDA-17.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "WEB-01" ] }, { "uuid": "0f2fdfbd-b34f-576f-ba6c-6c3d664fd5cb", "riskNumber": "MT-22", "title": "Manufacturing & Supply", "description": "Manufacturing & Supply is a Supply Chain Risk Management (SCRM) threat category pertaining to interdependencies related to data, systems and mission functions. Concerns include the availability of supply, capacity to surge, sole-source and concentration within or over-reliance on a single source.\n\nAt issue is a single supplier or sector/market that is incapable of meeting market demand. This can be due to reduced throughput or production delays caused by capacity constraints, obsolescence, industrial limitations, market conditions, disrupted material delivery and other conditions.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Manufacturing & Supply is a Supply Chain Risk Management (SCRM) threat category pertaining to interdependencies related to data, systems and mission functions. Concerns include the availability of supply, capacity to surge, sole-source and concentration within or over-reliance on a single source.\n\nAt issue is a single supplier or sector/market that is incapable of meeting market demand. This can be due to reduced throughput or production delays caused by capacity constraints, obsolescence, industrial limitations, market conditions, disrupted material delivery and other conditions.", "threatNumbers": "MT-22", "controlMappings": [ "GOV-01", "AST-01", "BCD-01", "BCD-01.5", "CAP-01", "CAP-05", "CHG-01", "CLD-01", "CPL-01", "CPL-01.4", "CFG-01", "MON-01", "MON-01.16", "CRY-01", "DCH-01", "EMB-01", "END-01", "HRS-01", "IAC-01", "IAC-01.3", "IRO-01", "IAO-01", "MNT-01", "MDM-01", "NET-01", "PES-01", "PRI-01", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-09", "RSK-09.1", "SEA-01", "SEA-07.1", "OPS-01", "SAT-01", "SAT-01.1", "TDA-01", "TDA-01.1", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09", "TDA-14", "TDA-17", "TDA-17.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "WEB-01" ] }, { "uuid": "85a81687-8dcb-51d3-8e39-34cbde62386c", "riskNumber": "MT-23", "title": "Product Quality & Design", "description": "Product Quality & Design s a Supply Chain Risk Management (SCRM) threat category that pertains to inherent design and quality problems (e.g., raw materials, ingredients, production, logistics, packaging) that result in the product and/or service failing to meet performance specifications and quality standards. This includes an understanding of the quality assurance practices associated with preventing mistakes or defects in manufactured/ developed products and avoiding problems when delivering solutions or services to customers.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Product Quality & Design s a Supply Chain Risk Management (SCRM) threat category that pertains to inherent design and quality problems (e.g., raw materials, ingredients, production, logistics, packaging) that result in the product and/or service failing to meet performance specifications and quality standards. This includes an understanding of the quality assurance practices associated with preventing mistakes or defects in manufactured/ developed products and avoiding problems when delivering solutions or services to customers.", "threatNumbers": "MT-23", "controlMappings": [ "GOV-01", "AST-01", "BCD-01", "BCD-01.5", "CAP-01", "CAP-05", "CHG-01", "CLD-01", "CPL-01", "CPL-01.4", "CFG-01", "MON-01", "MON-01.16", "CRY-01", "DCH-01", "EMB-01", "END-01", "HRS-01", "IAC-01", "IAC-01.3", "IAC-10.13", "IRO-01", "IAO-01", "MNT-01", "MDM-01", "NET-01", "PES-01", "PRI-01", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-09", "RSK-09.1", "SEA-01", "SEA-07.1", "OPS-01", "SAT-01", "SAT-01.1", "TDA-01", "TDA-01.1", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09", "TDA-14", "TDA-17", "TDA-17.1", "TDA-20.4", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "WEB-01" ] }, { "uuid": "10278ebb-b64c-5486-81f7-febd094f1255", "riskNumber": "MT-24", "title": "Financial", "description": "Financial is a Supply Chain Risk Management (SCRM) threat category that pertains to financial distress that can lead to the inability to meet contractual obligations, hostile takeovers, or bankruptcy. This involves situations where a supplier cannot generate revenue or income resulting in the inability to meet financial obligations.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Financial is a Supply Chain Risk Management (SCRM) threat category that pertains to financial distress that can lead to the inability to meet contractual obligations, hostile takeovers, or bankruptcy. This involves situations where a supplier cannot generate revenue or income resulting in the inability to meet financial obligations.", "threatNumbers": "MT-24", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "GOV-19", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-02.10", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-04.2", "AST-04.3", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-06.1", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-09.1", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.2", "CRY-01.3", "CRY-01.4", "CRY-01.5", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-03.3", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.5", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-03.5", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-04.12", "NET-04.13", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-15", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-19", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-03.7", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "dc2b44f3-d680-5198-a505-161f8932b59a", "riskNumber": "MT-25", "title": "Human Capital", "description": "Human Capital is a threat category that pertains to human skills, knowledge and actions that may impact a market's ability to produce goods and/or services to meet demand. This includes industrial disputes, labor availability and unrest, attrition of required skills and consumer behavior that disrupts a given market or industry.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Human Capital is a threat category that pertains to human skills, knowledge and actions that may impact a market's ability to produce goods and/or services to meet demand. This includes industrial disputes, labor availability and unrest, attrition of required skills and consumer behavior that disrupts a given market or industry.", "threatNumbers": "MT-25", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "GOV-19", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-02.10", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-04.2", "AST-04.3", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-06.1", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-09.1", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.2", "CRY-01.3", "CRY-01.4", "CRY-01.5", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-03.3", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.5", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-03.5", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-04.12", "NET-04.13", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-15", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-19", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-03.7", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "2b3cb017-26d5-51bb-97fd-9daeda221e1a", "riskNumber": "MT-26", "title": "Transportation & Distribution", "description": "Transportation & Distribution is a threat category that pertains to dynamic disruptions within the transportation and logistics of moving a product from one point to another. The transportation industry is among the most risk-prone of all industries due to accidents, losses of cargo, driver shortages and deteriorating infrastructure. These risks can cause shipment delays, supply chain disruptions, increased costs and damaged reputations. In addition, the inability to predict and plan for disruptions in the logistics plan presents risk in meeting delivery requirements and maintaining operations.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Transportation & Distribution is a threat category that pertains to dynamic disruptions within the transportation and logistics of moving a product from one point to another. The transportation industry is among the most risk-prone of all industries due to accidents, losses of cargo, driver shortages and deteriorating infrastructure. These risks can cause shipment delays, supply chain disruptions, increased costs and damaged reputations. In addition, the inability to predict and plan for disruptions in the logistics plan presents risk in meeting delivery requirements and maintaining operations.", "threatNumbers": "MT-26", "controlMappings": [ "RSK-09", "TDA-01", "TDA-01.1" ] }, { "uuid": "06bd0f2c-ddff-5579-97a8-ef5415bd4fea", "riskNumber": "MT-27", "title": "Infrastructure", "description": "Infrastructure is a threat category that pertains to the availability and functioning of fundamental facilities and systems necessary to support an industry and its supply chains within a country. This includes buildings, transportation networks, utilities and equipment. Additionally, this includes how well those facilities and systems are protected from both natural and man-made threats.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Infrastructure is a threat category that pertains to the availability and functioning of fundamental facilities and systems necessary to support an industry and its supply chains within a country. This includes buildings, transportation networks, utilities and equipment. Additionally, this includes how well those facilities and systems are protected from both natural and man-made threats.", "threatNumbers": "MT-27", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "GOV-19", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-02.10", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-04.2", "AST-04.3", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-06.1", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-09.1", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.2", "CRY-01.3", "CRY-01.4", "CRY-01.5", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-03.3", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.5", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-03.5", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-04.12", "NET-04.13", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-15", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-19", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-03.7", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "2606fb56-fbcc-5a30-a13f-173903433277", "riskNumber": "MT-3", "title": "Hazardous Materials Emergencies", "description": "Hazardous materials emergencies are focused on accidental disasters that occur in industrialized nations. These incidents can range from industrial chemical spills to groundwater contamination.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Hazardous materials emergencies are focused on accidental disasters that occur in industrialized nations. These incidents can range from industrial chemical spills to groundwater contamination.", "threatNumbers": "MT-3", "controlMappings": [ "GOV-01.1", "GOV-02.1", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-07", "GOV-10", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-02", "AST-02.8", "AST-03", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-15.1", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-11", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CLD-01", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-02.3", "CFG-08", "CFG-08.1", "MON-01.5", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.7", "MON-08.4", "MON-10", "MON-11.2", "MON-11.3", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.1", "CRY-05.2", "CRY-09", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.3", "DCH-03", "DCH-03.1", "DCH-04.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-07", "DCH-07.1", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.5", "DCH-13", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14.1", "DCH-18", "DCH-19", "DCH-21", "DCH-22.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "END-01", "END-02", "END-04.3", "END-08.1", "HRS-01", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.2", "HRS-05", "HRS-05.1", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-12.1", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-04", "IAC-05", "IAC-05.1", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.2", "IAC-10.2", "IAC-10.3", "IAC-10.12", "IAC-10.13", "IAC-15.8", "IAC-16", "IAC-20.1", "IAC-20.2", "IAC-20.5", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-15", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MDM-01", "MDM-02", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.5", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08", "NET-08.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.3", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-03", "PES-03.1", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PRI-05", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-10", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-04", "PRM-07", "RSK-01", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-07.2", "SEA-07.3", "SEA-08.1", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-04", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "9b8c8293-4dfb-5a7a-98ca-d1f6037b9731", "riskNumber": "MT-4", "title": "Nuclear, Biological and Chemical (NBC) Weapons", "description": "The use of NBC weapons are in the possible arsenals of international terrorists and it must be a consideration. Terrorist use of a “dirty bomb” — is considered far more likely than use of a traditional nuclear explosive device. This may be a combination of conventional explosive device with radioactive / chemical / biological material and be designed to scatter lethal and sub-lethal amounts of material over a wide area.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "The use of NBC weapons are in the possible arsenals of international terrorists and it must be a consideration. Terrorist use of a “dirty bomb” — is considered far more likely than use of a traditional nuclear explosive device. This may be a combination of conventional explosive device with radioactive / chemical / biological material and be designed to scatter lethal and sub-lethal amounts of material over a wide area.", "threatNumbers": "MT-4", "controlMappings": [ "GOV-01.1", "GOV-02.1", "GOV-04", "GOV-07", "GOV-10", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-02", "AST-02.8", "AST-03", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-15.1", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-11", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-05", "CLD-01", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-02.3", "CFG-08", "CFG-08.1", "MON-01.5", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.7", "MON-08.4", "MON-10", "MON-11.2", "MON-11.3", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.1", "CRY-05.2", "CRY-09", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.3", "DCH-03", "DCH-03.1", "DCH-04.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-07", "DCH-07.1", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.5", "DCH-13", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14.1", "DCH-18", "DCH-19", "DCH-21", "DCH-22.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "END-01", "END-02", "END-04.3", "END-08.1", "HRS-01", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.2", "HRS-05", "HRS-05.1", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-12.1", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-04", "IAC-05", "IAC-05.1", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.2", "IAC-10.2", "IAC-10.3", "IAC-10.12", "IAC-10.13", "IAC-15.8", "IAC-16", "IAC-20.1", "IAC-20.2", "IAC-20.5", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-15", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MDM-01", "MDM-02", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.5", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08", "NET-08.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.3", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-03", "PES-03.1", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-15", "PRI-05", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-10", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-04", "PRM-07", "RSK-01", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-07.2", "SEA-07.3", "SEA-08.1", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-04", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-03", "THR-03.1", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "58282db9-0a6e-5b10-9c65-99124e02dc5e", "riskNumber": "MT-5", "title": "Physical Crime", "description": "Physical crime includes \"traditional\" crimes of opportunity. These incidents can range from theft, to vandalism, riots, looting, arson and other forms of criminal activities.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Physical crime includes \"traditional\" crimes of opportunity. These incidents can range from theft, to vandalism, riots, looting, arson and other forms of criminal activities.", "threatNumbers": "MT-5", "controlMappings": [ "GOV-01.1", "GOV-04", "GOV-07", "GOV-10", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-02", "AST-02.8", "AST-03", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-11", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-04", "CAP-05", "CLD-01", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-02.3", "CFG-08", "CFG-08.1", "MON-01.5", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.7", "MON-08.4", "MON-10", "MON-11.2", "MON-11.3", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.1", "CRY-05.2", "CRY-09", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.3", "DCH-03", "DCH-03.1", "DCH-04.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-07", "DCH-07.1", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.5", "DCH-13", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14.1", "DCH-18", "DCH-19", "DCH-21", "DCH-22.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "END-01", "END-02", "END-04.3", "END-08.1", "HRS-01", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.2", "HRS-05", "HRS-05.1", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-12.1", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-04", "IAC-05", "IAC-05.1", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.2", "IAC-10.2", "IAC-10.3", "IAC-10.12", "IAC-10.13", "IAC-15.8", "IAC-16", "IAC-20.1", "IAC-20.2", "IAC-20.5", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-09.4", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-15", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MDM-01", "MDM-02", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.5", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08", "NET-08.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.3", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-03", "PES-03.1", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PRI-05", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-10", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-04", "PRM-07", "RSK-01", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-07.2", "SEA-07.3", "SEA-08.1", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-04", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "746d8464-e213-5dd4-b32a-ac88b458a9b9", "riskNumber": "MT-6", "title": "Terrorism & Armed Attacks", "description": "Armed attacks, regardless of the motivation of the attacker, can impact a business. Scenarios can range from single actors (e.g., \"disgruntled\" employee) all the way to a coordinated terrorist attack by multiple assailants. These incidents can range from the use of blade weapons (e.g., knives), blunt objects (e.g., clubs), to firearms and explosives.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Armed attacks, regardless of the motivation of the attacker, can impact a business. Scenarios can range from single actors (e.g., \"disgruntled\" employee) all the way to a coordinated terrorist attack by multiple assailants. These incidents can range from the use of blade weapons (e.g., knives), blunt objects (e.g., clubs), to firearms and explosives.", "threatNumbers": "MT-6", "controlMappings": [ "GOV-01.1", "GOV-02.1", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-07", "GOV-10", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-02", "AST-02.8", "AST-03", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-15.1", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-11", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-04", "CAP-05", "CLD-01", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-02.3", "CFG-08", "CFG-08.1", "MON-01.5", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.7", "MON-08.4", "MON-10", "MON-11.2", "MON-11.3", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.1", "CRY-05.2", "CRY-09", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.3", "DCH-03", "DCH-03.1", "DCH-04.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-07", "DCH-07.1", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.5", "DCH-13", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14.1", "DCH-18", "DCH-19", "DCH-21", "DCH-22.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "END-01", "END-02", "END-04.3", "END-08.1", "HRS-01", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.2", "HRS-05", "HRS-05.1", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-12.1", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-04", "IAC-05", "IAC-05.1", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.2", "IAC-10.2", "IAC-10.3", "IAC-10.12", "IAC-10.13", "IAC-15.8", "IAC-16", "IAC-20.1", "IAC-20.2", "IAC-20.5", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-09.4", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-15", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MDM-01", "MDM-02", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.5", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08", "NET-08.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.3", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-03", "PES-03.1", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-15", "PRI-05", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-10", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-04", "PRM-07", "RSK-01", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-07.2", "SEA-07.3", "SEA-08.1", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-04", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "7a828a9c-9450-5fce-97ea-816502434abb", "riskNumber": "MT-7", "title": "Utility Service Disruption", "description": "Utility service disruptions are focused on the sustained loss of electricity, Internet, natural gas, water and/or sanitation services. These incidents can have a variety of causes but directly impact the fulfillment of utility services that your business needs to operate.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Utility service disruptions are focused on the sustained loss of electricity, Internet, natural gas, water and/or sanitation services. These incidents can have a variety of causes but directly impact the fulfillment of utility services that your business needs to operate.", "threatNumbers": "MT-7", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.2", "CRY-01.3", "CRY-01.4", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-19", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-02", "WEB-03", "WEB-04" ] }, { "uuid": "90cda0e9-8881-5d4c-8f87-ba6c1bde5a32", "riskNumber": "MT-8", "title": "Dysfunctional Management Practices", "description": "Dysfunctional management practices are a manmade threat that expose an organization to significant risk. The threat stems from the inability of weak, ineffective and/or incompetent management to (1) make a risk-based decision and (2) support that decision. The resulting risk manifests due to (1) an absence of a required control or (2) a control deficiency.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Dysfunctional management practices are a manmade threat that expose an organization to significant risk. The threat stems from the inability of weak, ineffective and/or incompetent management to (1) make a risk-based decision and (2) support that decision. The resulting risk manifests due to (1) an absence of a required control or (2) a control deficiency.", "threatNumbers": "MT-8", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "GOV-19", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-02.10", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-04.2", "AST-04.3", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CHG-08", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-06.1", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-09.1", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "MON-19", "CRY-01", "CRY-01.1", "CRY-01.2", "CRY-01.3", "CRY-01.4", "CRY-01.5", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-03.3", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.5", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-03.5", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-16.5", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IAC-30", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-09.4", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-04.12", "NET-04.13", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-15", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-19", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-03.7", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "c07150f6-c393-508c-9799-8d2451c61fe3", "riskNumber": "MT-9", "title": "Human Error", "description": "Human error is a broad category that includes non-malicious actions that are unexpected and unpredictable by humans. These incidents can range from misconfigurations, to misunderstandings or other unintentional accidents.", "riskGrouping": "Man-Made Threat", "nistCsfFunction": "", "threatGrouping": "Man-Made Threat", "threatDescription": "Human error is a broad category that includes non-malicious actions that are unexpected and unpredictable by humans. These incidents can range from misconfigurations, to misunderstandings or other unintentional accidents.", "threatNumbers": "MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "GOV-19", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-02.10", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-04.2", "AST-04.3", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CHG-08", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-06.1", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-09.1", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "MON-19", "CRY-01", "CRY-01.1", "CRY-01.2", "CRY-01.3", "CRY-01.4", "CRY-01.5", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-03.3", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.5", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-03.5", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-16.5", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IAC-30", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-09.4", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-04.12", "NET-04.13", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-15", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-19", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-03.7", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "c0dae47a-b052-5ee9-9376-30c433bca51e", "riskNumber": "NT-1", "title": "Drought & Water Shortage", "description": "Regardless of geographic location, periods of reduced rainfall are expected. For non-agricultural industries, drought may not be impactful to operations until it reaches the extent of water rationing.", "riskGrouping": "Natural Threat", "nistCsfFunction": "", "threatGrouping": "Natural Threat", "threatDescription": "Regardless of geographic location, periods of reduced rainfall are expected. For non-agricultural industries, drought may not be impactful to operations until it reaches the extent of water rationing.", "threatNumbers": "NT-1", "controlMappings": [ "GOV-01.2", "GOV-04.1", "GOV-04.2", "GOV-15", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-01", "AST-01.1", "AST-12", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-10.4", "CHG-01", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "EMB-15", "END-04.3", "END-08.1", "HRS-01", "HRS-05.7", "HRS-11", "IAC-05.2", "IAC-20.6", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "NET-04.6", "NET-14", "NET-14.5", "PES-01", "PES-06.6", "PES-07", "PES-07.5", "PES-07.6", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PRM-04", "PRM-07", "RSK-01", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-07.2", "SEA-07.3", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.5", "SAT-03.7", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "b4610828-e8e5-5972-a64b-4c82e5d15146", "riskNumber": "NT-10", "title": "Thunderstorms & Lightning", "description": "Thunderstorms are most prevalent in the spring and summer months and generally occur during the afternoon and evening hours, but they can occur year-round and at all hours. Many hazardous weather events are associated with thunderstorms. Under the right conditions, rainfall from thunderstorms causes flash flooding and lightning is responsible for equipment damage, fires and fatalities.", "riskGrouping": "Natural Threat", "nistCsfFunction": "", "threatGrouping": "Natural Threat", "threatDescription": "Thunderstorms are most prevalent in the spring and summer months and generally occur during the afternoon and evening hours, but they can occur year-round and at all hours. Many hazardous weather events are associated with thunderstorms. Under the right conditions, rainfall from thunderstorms causes flash flooding and lightning is responsible for equipment damage, fires and fatalities.", "threatNumbers": "NT-10", "controlMappings": [ "GOV-01.2", "GOV-04.1", "GOV-04.2", "GOV-15", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-02", "AST-03.2", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-15.1", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CAP-05", "CHG-01", "CLD-01", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-02.3", "CFG-08", "CFG-08.1", "MON-01.5", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.7", "MON-08.4", "MON-10", "MON-11.2", "MON-11.3", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.1", "CRY-05.2", "CRY-09", "CRY-09.3", "CRY-09.4", "DCH-01", "DCH-01.3", "DCH-03", "DCH-03.1", "DCH-04.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-07", "DCH-07.1", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.5", "DCH-13", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14.1", "DCH-18", "DCH-19", "DCH-21", "DCH-22.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-04.3", "END-08.1", "HRS-01", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.2", "HRS-05", "HRS-05.1", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-11", "HRS-12.1", "IAC-01", "IAC-01.3", "IAC-02", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-04", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.2", "IAC-10.2", "IAC-10.3", "IAC-10.12", "IAC-10.13", "IAC-15.8", "IAC-16", "IAC-20.1", "IAC-20.2", "IAC-20.5", "IAC-20.6", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-15", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-05", "NET-01", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08", "NET-08.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.3", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-03", "PES-03.1", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PRI-05", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-10", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-04", "PRM-07", "RSK-01", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-07.2", "SEA-07.3", "SEA-08.1", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.3", "SAT-03.5", "SAT-03.7", "SAT-04", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "2132980a-744d-5078-8eb3-f0b0d5674214", "riskNumber": "NT-11", "title": "Tornadoes", "description": "Tornadoes occur in many parts of the world, including the US, Australia, Europe, Africa, Asia and South America. Tornadoes can happen at any time of year and occur at any time of day or night, but most tornadoes occur between 4–9 p.m. Tornadoes (with winds up to about 300 mph) can destroy all but the best-built man-made structures.", "riskGrouping": "Natural Threat", "nistCsfFunction": "", "threatGrouping": "Natural Threat", "threatDescription": "Tornadoes occur in many parts of the world, including the US, Australia, Europe, Africa, Asia and South America. Tornadoes can happen at any time of year and occur at any time of day or night, but most tornadoes occur between 4–9 p.m. Tornadoes (with winds up to about 300 mph) can destroy all but the best-built man-made structures.", "threatNumbers": "NT-11", "controlMappings": [ "GOV-01.2", "GOV-04.1", "GOV-04.2", "GOV-15", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-02", "AST-03.2", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-15.1", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CAP-04", "CAP-05", "CHG-01", "CLD-01", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-02.3", "CFG-08", "CFG-08.1", "MON-01.5", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.7", "MON-08.4", "MON-10", "MON-11.2", "MON-11.3", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.1", "CRY-05.2", "CRY-09", "CRY-09.3", "CRY-09.4", "DCH-01", "DCH-01.3", "DCH-03", "DCH-03.1", "DCH-04.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-07", "DCH-07.1", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.5", "DCH-13", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14.1", "DCH-18", "DCH-19", "DCH-21", "DCH-22.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-04.3", "END-08.1", "HRS-01", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.2", "HRS-05", "HRS-05.1", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-11", "HRS-12.1", "IAC-01", "IAC-01.3", "IAC-02", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-04", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.2", "IAC-10.2", "IAC-10.3", "IAC-10.12", "IAC-10.13", "IAC-15.8", "IAC-16", "IAC-20.1", "IAC-20.2", "IAC-20.5", "IAC-20.6", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-15", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08", "NET-08.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.3", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-03", "PES-03.1", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PRI-05", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-10", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-04", "PRM-07", "RSK-01", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-07.2", "SEA-07.3", "SEA-08.1", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.3", "SAT-03.5", "SAT-03.7", "SAT-04", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "49e318d7-921c-5d24-af85-290bf1a11f2f", "riskNumber": "NT-12", "title": "Tsunamis", "description": "All tsunamis are potentially dangerous, even though they may not damage every coastline they strike. A tsunami can strike anywhere along most of the US coastline. The most destructive tsunamis have occurred along the coasts of California, Oregon, Washington, Alaska and Hawaii.", "riskGrouping": "Natural Threat", "nistCsfFunction": "", "threatGrouping": "Natural Threat", "threatDescription": "All tsunamis are potentially dangerous, even though they may not damage every coastline they strike. A tsunami can strike anywhere along most of the US coastline. The most destructive tsunamis have occurred along the coasts of California, Oregon, Washington, Alaska and Hawaii.", "threatNumbers": "NT-12", "controlMappings": [ "GOV-01.2", "GOV-04.1", "GOV-04.2", "GOV-15", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-02", "AST-03.2", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-15.1", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CAP-04", "CAP-05", "CHG-01", "CLD-01", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-02.3", "CFG-08", "CFG-08.1", "MON-01.5", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.7", "MON-08.4", "MON-10", "MON-11.2", "MON-11.3", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.1", "CRY-05.2", "CRY-09", "CRY-09.3", "CRY-09.4", "DCH-01", "DCH-01.3", "DCH-03", "DCH-03.1", "DCH-04.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-07", "DCH-07.1", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.5", "DCH-13", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14.1", "DCH-18", "DCH-19", "DCH-21", "DCH-22.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-04.3", "END-08.1", "HRS-01", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.2", "HRS-05", "HRS-05.1", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-11", "HRS-12.1", "IAC-01", "IAC-01.3", "IAC-02", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-04", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.2", "IAC-10.2", "IAC-10.3", "IAC-10.12", "IAC-10.13", "IAC-15.8", "IAC-16", "IAC-20.1", "IAC-20.2", "IAC-20.5", "IAC-20.6", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-15", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08", "NET-08.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.3", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-03", "PES-03.1", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PRI-05", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-10", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-04", "PRM-07", "RSK-01", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-07.2", "SEA-07.3", "SEA-08.1", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.3", "SAT-03.5", "SAT-03.7", "SAT-04", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "13d8c489-c1fe-5ced-8c5e-db6d7478d73f", "riskNumber": "NT-13", "title": "Volcanoes", "description": "While volcanoes are geographically fixed objects, volcanic fallout can have significant downwind impacts for thousands of miles. Far outside of the blast zone, volcanoes can significantly damage or degrade transportation systems and also cause electrical grids to fail.", "riskGrouping": "Natural Threat", "nistCsfFunction": "", "threatGrouping": "Natural Threat", "threatDescription": "While volcanoes are geographically fixed objects, volcanic fallout can have significant downwind impacts for thousands of miles. Far outside of the blast zone, volcanoes can significantly damage or degrade transportation systems and also cause electrical grids to fail.", "threatNumbers": "NT-13", "controlMappings": [ "GOV-01.2", "GOV-04.1", "GOV-04.2", "GOV-15", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-02", "AST-03.2", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-15.1", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CAP-04", "CAP-05", "CHG-01", "CLD-01", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-02.3", "CFG-08", "CFG-08.1", "MON-01.5", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.7", "MON-08.4", "MON-10", "MON-11.2", "MON-11.3", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.1", "CRY-05.2", "CRY-09", "CRY-09.3", "CRY-09.4", "DCH-01", "DCH-01.3", "DCH-03", "DCH-03.1", "DCH-04.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-07", "DCH-07.1", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.5", "DCH-13", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14.1", "DCH-18", "DCH-19", "DCH-21", "DCH-22.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-04.3", "END-08.1", "HRS-01", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.2", "HRS-05", "HRS-05.1", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-11", "HRS-12.1", "IAC-01", "IAC-01.3", "IAC-02", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-04", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.2", "IAC-10.2", "IAC-10.3", "IAC-10.12", "IAC-10.13", "IAC-15.8", "IAC-16", "IAC-20.1", "IAC-20.2", "IAC-20.5", "IAC-20.6", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-15", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08", "NET-08.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.3", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-03", "PES-03.1", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PRI-05", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-10", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-04", "PRM-07", "RSK-01", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-07.2", "SEA-07.3", "SEA-08.1", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.3", "SAT-03.5", "SAT-03.7", "SAT-04", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "f92e9dc3-b271-5587-985d-db98479febee", "riskNumber": "NT-14", "title": "Winter Storms & Extreme Cold", "description": "Winter storms is a broad category of meteorological events that include events that range from ice storms, to heavy snowfall, to unseasonably (e.g., record breaking) cold temperatures. Winter storms can significantly impact business operations and transportation systems over a wide geographic region.", "riskGrouping": "Natural Threat", "nistCsfFunction": "", "threatGrouping": "Natural Threat", "threatDescription": "Winter storms is a broad category of meteorological events that include events that range from ice storms, to heavy snowfall, to unseasonably (e.g., record breaking) cold temperatures. Winter storms can significantly impact business operations and transportation systems over a wide geographic region.", "threatNumbers": "NT-14", "controlMappings": [ "GOV-01.2", "GOV-04.1", "GOV-04.2", "GOV-15", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-02", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-15.1", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CHG-01", "CLD-01", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-02.3", "CFG-08", "CFG-08.1", "MON-01.5", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.7", "MON-08.4", "MON-10", "MON-11.2", "MON-11.3", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.1", "CRY-05.2", "CRY-09", "CRY-09.3", "CRY-09.4", "DCH-01", "DCH-01.3", "DCH-03", "DCH-03.1", "DCH-04.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-07", "DCH-07.1", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.5", "DCH-13", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14.1", "DCH-18", "DCH-19", "DCH-21", "DCH-22.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-04.3", "END-08.1", "HRS-01", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.2", "HRS-05", "HRS-05.1", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-11", "HRS-12.1", "IAC-01", "IAC-01.3", "IAC-02", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-04", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.2", "IAC-10.2", "IAC-10.3", "IAC-10.12", "IAC-10.13", "IAC-15.8", "IAC-16", "IAC-20.1", "IAC-20.2", "IAC-20.5", "IAC-20.6", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-15", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08", "NET-08.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.3", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-03", "PES-03.1", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PRI-05", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-10", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-04", "PRM-07", "RSK-01", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-07.2", "SEA-07.3", "SEA-08.1", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.3", "SAT-03.5", "SAT-03.7", "SAT-04", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "54c6afb4-9fde-5dca-948e-7aeb31d93648", "riskNumber": "NT-2", "title": "Earthquakes", "description": "Earthquakes are sudden rolling or shaking events caused by movement under the earth’s surface. Although earthquakes usually last less than one minute, the scope of devastation can be widespread and have long-lasting impact.", "riskGrouping": "Natural Threat", "nistCsfFunction": "", "threatGrouping": "Natural Threat", "threatDescription": "Earthquakes are sudden rolling or shaking events caused by movement under the earth’s surface. Although earthquakes usually last less than one minute, the scope of devastation can be widespread and have long-lasting impact.", "threatNumbers": "NT-2", "controlMappings": [ "GOV-01.2", "GOV-04.1", "GOV-04.2", "GOV-15", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-02", "AST-03.2", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-15.1", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CAP-04", "CAP-05", "CHG-01", "CLD-01", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-02.3", "CFG-08", "CFG-08.1", "MON-01.5", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.7", "MON-08.4", "MON-10", "MON-11.2", "MON-11.3", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.1", "CRY-05.2", "CRY-09", "CRY-09.3", "CRY-09.4", "DCH-01", "DCH-01.3", "DCH-03", "DCH-03.1", "DCH-04.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-07", "DCH-07.1", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.5", "DCH-13", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14.1", "DCH-18", "DCH-19", "DCH-21", "DCH-22.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-04.3", "END-08.1", "HRS-01", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.2", "HRS-05", "HRS-05.1", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-11", "HRS-12.1", "IAC-01", "IAC-01.3", "IAC-02", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-04", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.2", "IAC-10.2", "IAC-10.3", "IAC-10.12", "IAC-10.13", "IAC-15.8", "IAC-16", "IAC-20.1", "IAC-20.2", "IAC-20.5", "IAC-20.6", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-15", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08", "NET-08.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.3", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-03", "PES-03.1", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PRI-05", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-10", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-04", "PRM-07", "RSK-01", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-07.2", "SEA-07.3", "SEA-08.1", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.3", "SAT-03.5", "SAT-03.7", "SAT-04", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "d29fb8e6-4d9f-5c09-b218-53d7c6e6875f", "riskNumber": "NT-3", "title": "Fire & Wildfires", "description": "Regardless of geographic location or even building material, fire is a concern for every business. When thinking of a fire in a building, it envisions a total loss to all technology hardware, including backup tapes and all paper files being consumed in the fire.", "riskGrouping": "Natural Threat", "nistCsfFunction": "", "threatGrouping": "Natural Threat", "threatDescription": "Regardless of geographic location or even building material, fire is a concern for every business. When thinking of a fire in a building, it envisions a total loss to all technology hardware, including backup tapes and all paper files being consumed in the fire.", "threatNumbers": "NT-3", "controlMappings": [ "GOV-01.2", "GOV-04.1", "GOV-04.2", "GOV-15", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-02", "AST-03.2", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-15.1", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CAP-04", "CAP-05", "CHG-01", "CLD-01", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-02.3", "CFG-08", "CFG-08.1", "MON-01.5", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.7", "MON-08.4", "MON-10", "MON-11.2", "MON-11.3", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.1", "CRY-05.2", "CRY-09", "CRY-09.3", "CRY-09.4", "DCH-01", "DCH-01.3", "DCH-03", "DCH-03.1", "DCH-04.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-07", "DCH-07.1", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.5", "DCH-13", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14.1", "DCH-18", "DCH-19", "DCH-21", "DCH-22.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-04.3", "END-08.1", "HRS-01", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.2", "HRS-05", "HRS-05.1", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-11", "HRS-12.1", "IAC-01", "IAC-01.3", "IAC-02", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-04", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.2", "IAC-10.2", "IAC-10.3", "IAC-10.12", "IAC-10.13", "IAC-15.8", "IAC-16", "IAC-20.1", "IAC-20.2", "IAC-20.5", "IAC-20.6", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-15", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08", "NET-08.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.3", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-03", "PES-03.1", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PRI-05", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-10", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-04", "PRM-07", "RSK-01", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-07.2", "SEA-07.3", "SEA-08.1", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.3", "SAT-03.5", "SAT-03.7", "SAT-04", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "146d526d-4cda-5258-b770-40109e28c204", "riskNumber": "NT-4", "title": "Floods", "description": "Flooding is the most common of natural hazards and requires an understanding of the local environment, including floodplains and the frequency of flooding events. Location of critical technologies should be considered (e.g., server room is in the basement or first floor of the facility).", "riskGrouping": "Natural Threat", "nistCsfFunction": "", "threatGrouping": "Natural Threat", "threatDescription": "Flooding is the most common of natural hazards and requires an understanding of the local environment, including floodplains and the frequency of flooding events. Location of critical technologies should be considered (e.g., server room is in the basement or first floor of the facility).", "threatNumbers": "NT-4", "controlMappings": [ "GOV-01.2", "GOV-04.1", "GOV-04.2", "GOV-15", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-02", "AST-03.2", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-15.1", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CAP-04", "CAP-05", "CHG-01", "CLD-01", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-02.3", "CFG-08", "CFG-08.1", "MON-01.5", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.7", "MON-08.4", "MON-10", "MON-11.2", "MON-11.3", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.1", "CRY-05.2", "CRY-09", "CRY-09.3", "CRY-09.4", "DCH-01", "DCH-01.3", "DCH-03", "DCH-03.1", "DCH-04.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-07", "DCH-07.1", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.5", "DCH-13", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14.1", "DCH-18", "DCH-19", "DCH-21", "DCH-22.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-04.3", "END-08.1", "HRS-01", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.2", "HRS-05", "HRS-05.1", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-11", "HRS-12.1", "IAC-01", "IAC-01.3", "IAC-02", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-04", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.2", "IAC-10.2", "IAC-10.3", "IAC-10.12", "IAC-10.13", "IAC-15.8", "IAC-16", "IAC-20.1", "IAC-20.2", "IAC-20.5", "IAC-20.6", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-15", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08", "NET-08.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.3", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-03", "PES-03.1", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PRI-05", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-10", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-04", "PRM-07", "RSK-01", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-07.2", "SEA-07.3", "SEA-08.1", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.3", "SAT-03.5", "SAT-03.7", "SAT-04", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "839911d8-233a-5ac3-90fa-5b57f840dea4", "riskNumber": "NT-5", "title": "Hurricanes & Tropical Storms", "description": "Hurricanes and tropical storms are among the most powerful natural disasters because of their size and destructive potential. In addition to high winds, regional flooding and infrastructure damage should be considered when assessing hurricanes and tropical storms.", "riskGrouping": "Natural Threat", "nistCsfFunction": "", "threatGrouping": "Natural Threat", "threatDescription": "Hurricanes and tropical storms are among the most powerful natural disasters because of their size and destructive potential. In addition to high winds, regional flooding and infrastructure damage should be considered when assessing hurricanes and tropical storms.", "threatNumbers": "NT-5", "controlMappings": [ "GOV-01.2", "GOV-04.1", "GOV-04.2", "GOV-15", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-02", "AST-03.2", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-15.1", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CAP-04", "CAP-05", "CHG-01", "CLD-01", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-02.3", "CFG-08", "CFG-08.1", "MON-01.5", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.7", "MON-08.4", "MON-10", "MON-11.2", "MON-11.3", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.1", "CRY-05.2", "CRY-09", "CRY-09.3", "CRY-09.4", "DCH-01", "DCH-01.3", "DCH-03", "DCH-03.1", "DCH-04.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-07", "DCH-07.1", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.5", "DCH-13", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14.1", "DCH-18", "DCH-19", "DCH-21", "DCH-22.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-04.3", "END-08.1", "HRS-01", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.2", "HRS-05", "HRS-05.1", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-11", "HRS-12.1", "IAC-01", "IAC-01.3", "IAC-02", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-04", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.2", "IAC-10.2", "IAC-10.3", "IAC-10.12", "IAC-10.13", "IAC-15.8", "IAC-16", "IAC-20.1", "IAC-20.2", "IAC-20.5", "IAC-20.6", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-15", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08", "NET-08.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.3", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-03", "PES-03.1", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PRI-05", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-10", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-04", "PRM-07", "RSK-01", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-07.2", "SEA-07.3", "SEA-08.1", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.3", "SAT-03.5", "SAT-03.7", "SAT-04", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "ec72e0d9-167d-5910-a84a-0cd52f59e244", "riskNumber": "NT-6", "title": "Landslides & Debris Flow", "description": "Landslides occur throughout the world and can be caused by a variety of factors including earthquakes, storms, volcanic eruptions, fire and by human modification of land. Landslides can occur quickly, often with little notice. Location of critical technologies should be considered (e.g., server room is in the basement or first floor of the facility).", "riskGrouping": "Natural Threat", "nistCsfFunction": "", "threatGrouping": "Natural Threat", "threatDescription": "Landslides occur throughout the world and can be caused by a variety of factors including earthquakes, storms, volcanic eruptions, fire and by human modification of land. Landslides can occur quickly, often with little notice. Location of critical technologies should be considered (e.g., server room is in the basement or first floor of the facility).", "threatNumbers": "NT-6", "controlMappings": [ "GOV-01.2", "GOV-04.1", "GOV-04.2", "GOV-15", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-02", "AST-03.2", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-15.1", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CAP-04", "CAP-05", "CHG-01", "CLD-01", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-02.3", "CFG-08", "CFG-08.1", "MON-01.5", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.7", "MON-08.4", "MON-10", "MON-11.2", "MON-11.3", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.1", "CRY-05.2", "CRY-09", "CRY-09.3", "CRY-09.4", "DCH-01", "DCH-01.3", "DCH-03", "DCH-03.1", "DCH-04.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-07", "DCH-07.1", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.5", "DCH-13", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14.1", "DCH-18", "DCH-19", "DCH-21", "DCH-22.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-04.3", "END-08.1", "HRS-01", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.2", "HRS-05", "HRS-05.1", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-11", "HRS-12.1", "IAC-01", "IAC-01.3", "IAC-02", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-04", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.2", "IAC-10.2", "IAC-10.3", "IAC-10.12", "IAC-10.13", "IAC-15.8", "IAC-16", "IAC-20.1", "IAC-20.2", "IAC-20.5", "IAC-20.6", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-15", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08", "NET-08.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.3", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-03", "PES-03.1", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PRI-05", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-10", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-04", "PRM-07", "RSK-01", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-07.2", "SEA-07.3", "SEA-08.1", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.3", "SAT-03.5", "SAT-03.7", "SAT-04", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "61ad5a61-f616-58f0-b317-6a204be45c87", "riskNumber": "NT-7", "title": "Pandemic (Disease) Outbreaks", "description": "Due to the wide variety of possible scenarios, consideration should be given both to the magnitude of what can reasonably happen during a pandemic outbreak (e.g., COVID-19, Influenza, SARS, Ebola, etc.) and what actions the business can be taken to help lessen the impact of a pandemic on operations.", "riskGrouping": "Natural Threat", "nistCsfFunction": "", "threatGrouping": "Natural Threat", "threatDescription": "Due to the wide variety of possible scenarios, consideration should be given both to the magnitude of what can reasonably happen during a pandemic outbreak (e.g., COVID-19, Influenza, SARS, Ebola, etc.) and what actions the business can be taken to help lessen the impact of a pandemic on operations.", "threatNumbers": "NT-7", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CHG-08", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "MON-19", "CRY-01", "CRY-01.1", "CRY-01.2", "CRY-01.3", "CRY-01.4", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-10", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-09.4", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-19", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-03.7", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "2e40efe7-29c9-504d-8356-df2438947eb4", "riskNumber": "NT-8", "title": "Severe Weather", "description": "Severe weather is a broad category of meteorological events that include events that range from damaging winds to hail.", "riskGrouping": "Natural Threat", "nistCsfFunction": "", "threatGrouping": "Natural Threat", "threatDescription": "Severe weather is a broad category of meteorological events that include events that range from damaging winds to hail.", "threatNumbers": "NT-8", "controlMappings": [ "GOV-01.2", "GOV-04.1", "GOV-04.2", "GOV-15", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-02", "AST-03.2", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-15.1", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CAP-05", "CHG-01", "CLD-01", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-02.3", "CFG-08", "CFG-08.1", "MON-01.5", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.7", "MON-08.4", "MON-10", "MON-11.2", "MON-11.3", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.1", "CRY-05.2", "CRY-09", "CRY-09.3", "CRY-09.4", "DCH-01", "DCH-01.3", "DCH-03", "DCH-03.1", "DCH-04.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-07", "DCH-07.1", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.5", "DCH-13", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14.1", "DCH-18", "DCH-19", "DCH-21", "DCH-22.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-04.3", "END-08.1", "HRS-01", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.2", "HRS-05", "HRS-05.1", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-11", "HRS-12.1", "IAC-01", "IAC-01.3", "IAC-02", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-04", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.2", "IAC-10.2", "IAC-10.3", "IAC-10.12", "IAC-10.13", "IAC-15.8", "IAC-16", "IAC-20.1", "IAC-20.2", "IAC-20.5", "IAC-20.6", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-15", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "NET-01", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08", "NET-08.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.3", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-03", "PES-03.1", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PRI-05", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-10", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-04", "PRM-07", "RSK-01", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-07.2", "SEA-07.3", "SEA-08.1", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.3", "SAT-03.5", "SAT-03.7", "SAT-04", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "bfee9f3e-b6de-5bfe-8696-7b533c7c4ca4", "riskNumber": "NT-9", "title": "Space Weather", "description": "Space weather includes natural events in space that can affect the near-earth environment and satellites. Most commonly, this is associated with solar flares from the Sun, so an understanding of how solar flares may impact the business is of critical importance in assessing this threat.", "riskGrouping": "Natural Threat", "nistCsfFunction": "", "threatGrouping": "Natural Threat", "threatDescription": "Space weather includes natural events in space that can affect the near-earth environment and satellites. Most commonly, this is associated with solar flares from the Sun, so an understanding of how solar flares may impact the business is of critical importance in assessing this threat.", "threatNumbers": "NT-9", "controlMappings": [ "GOV-01.2", "GOV-04.1", "GOV-04.2", "GOV-15", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.1", "AST-02", "AST-03.2", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-15.1", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.6", "BCD-01.7", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-04", "BCD-04.2", "BCD-05", "BCD-07", "BCD-08", "BCD-08.2", "BCD-09", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CAP-05", "CHG-01", "CLD-01", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.4", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-02.3", "CFG-08", "CFG-08.1", "MON-01.5", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.7", "MON-08.4", "MON-10", "MON-11.2", "MON-11.3", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.1", "CRY-05.2", "CRY-09", "CRY-09.3", "CRY-09.4", "DCH-01", "DCH-01.3", "DCH-03", "DCH-03.1", "DCH-04.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-07", "DCH-07.1", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.5", "DCH-13", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14.1", "DCH-18", "DCH-19", "DCH-21", "DCH-22.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-04.3", "END-08.1", "HRS-01", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.2", "HRS-05", "HRS-05.1", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-10", "HRS-11", "HRS-12.1", "IAC-01", "IAC-01.3", "IAC-02", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-04", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.2", "IAC-10.2", "IAC-10.3", "IAC-10.12", "IAC-10.13", "IAC-15.8", "IAC-16", "IAC-20.1", "IAC-20.2", "IAC-20.5", "IAC-20.6", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-15", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-05", "NET-01", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08", "NET-08.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.3", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-03", "PES-03.1", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-15", "PRI-05", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-10", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-04", "PRM-07", "RSK-01", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "SEA-01.1", "SEA-07.2", "SEA-07.3", "SEA-08.1", "SEA-14.1", "SEA-14.2", "SEA-15", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03.3", "SAT-03.5", "SAT-03.7", "SAT-04", "TDA-01", "TDA-02", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-03.1", "TDA-05", "TDA-08", "TDA-09.1", "TPM-01", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-06", "TPM-09", "TPM-10", "TPM-11", "THR-01", "VPM-01", "VPM-01.1", "VPM-02", "VPM-04", "VPM-05", "VPM-05.1", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10" ] }, { "uuid": "0c30000f-105a-54e9-8e3f-7915132a9a54", "riskNumber": "R-AC-1", "title": "Inability to maintain individual accountability", "description": "The inability to maintain accountability (e.g., asset ownership, non-repudiation of actions or inactions, etc.).", "riskGrouping": "Access Control", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-02.5", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-11.8", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.5", "CHG-04", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-07", "CHG-08", "CLD-01", "CLD-02", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01.14", "MON-01.15", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-05.2", "MON-06", "MON-07", "MON-07.1", "MON-08", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-09.1", "MON-11", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "MON-19", "CRY-01.5", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.3", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-24", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01.1", "HRS-02.1", "HRS-02.2", "HRS-04.1", "HRS-04.3", "HRS-05.1", "HRS-05.7", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-16.5", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IAC-30", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MDM-01", "MDM-02", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-04.12", "NET-04.13", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-08.1", "NET-09", "NET-09.1", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-15", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-06", "PES-06.1", "PES-06.3", "PES-06.4", "PES-06.5", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-01.1", "PRI-05", "PRI-05.1", "PRI-05.5", "PRI-05.6", "PRI-07.1", "PRI-08", "PRI-14", "PRM-04", "PRM-05", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-07", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-13", "SEA-13.1", "SEA-17", "SEA-20", "OPS-01", "OPS-01.1", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.6", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-04", "THR-05", "THR-07", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-10", "WEB-01", "WEB-01.1" ] }, { "uuid": "5e499f2d-1214-5631-bbc4-621b8b554893", "riskNumber": "R-AC-2", "title": "Improper assignment of privileged functions", "description": "The inability to implement least privileges (e.g., Role-Based Access Control (RBAC), Privileged Account Management (PAM), etc.).", "riskGrouping": "Access Control", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-04.1", "GOV-04.2", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-02", "AST-02.5", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-17", "AST-18", "AST-27", "AST-30", "AST-31", "BCD-11.8", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-04", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-07", "CLD-01", "CLD-02", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01.14", "MON-01.15", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-06", "MON-08", "MON-08.2", "MON-08.3", "MON-08.4", "MON-11", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-14.3", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-16.5", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IAC-30", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-05.1", "MNT-05.2", "MNT-06", "MNT-06.1", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02.3", "NET-03", "NET-03.1", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-04.12", "NET-04.13", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-08.1", "NET-09", "NET-09.1", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-06", "PES-06.1", "PES-06.3", "PES-06.5", "PES-11", "PES-12", "PES-12.1", "PRI-01", "PRI-05", "PRI-05.1", "PRI-05.5", "PRI-05.6", "PRI-07.1", "PRI-08", "PRI-14", "PRM-04", "PRM-05", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-07", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-13", "SEA-13.1", "SEA-17", "SEA-20", "OPS-01", "OPS-01.1", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.6", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-04", "THR-05", "THR-07", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02" ] }, { "uuid": "d674eda4-0369-5d81-820b-9f9304be7bce", "riskNumber": "R-AC-3", "title": "Privilege escalation", "description": "The inability to restrict access to privileged functions.", "riskGrouping": "Access Control", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-04.1", "GOV-04.2", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-02", "AST-02.5", "AST-02.7", "AST-02.9", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-05", "AST-06", "AST-07", "AST-08", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-17", "AST-18", "AST-27", "AST-30", "AST-31", "BCD-15", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-08", "CLD-01", "CLD-02", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01.13", "MON-01.14", "MON-01.15", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-06", "MON-08", "MON-08.2", "MON-08.3", "MON-08.4", "MON-11", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-24", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01.1", "HRS-02.1", "HRS-02.2", "HRS-04.1", "HRS-04.3", "HRS-05.7", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-16.5", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IAC-30", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-07", "MNT-08", "MNT-09", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-04.12", "NET-04.13", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-06", "PES-06.1", "PES-06.3", "PES-06.5", "PES-11", "PES-12", "PES-12.1", "PRI-05", "PRI-05.1", "PRI-07.1", "PRI-08", "PRI-14", "PRM-04", "PRM-05", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-17", "SEA-20", "OPS-01", "OPS-01.1", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-04", "THR-05", "THR-06", "THR-07", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02" ] }, { "uuid": "871643a1-6168-5f2a-a2f0-450564b9cdeb", "riskNumber": "R-AC-4", "title": "Unauthorized access", "description": "The inability to restrict access to only authorized individuals, groups or services.", "riskGrouping": "Access Control", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-04.1", "GOV-04.2", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-01", "AST-01.1", "AST-02", "AST-02.1", "AST-02.5", "AST-02.8", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-08.2", "BCD-09.2", "BCD-11.4", "BCD-11.5", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-13", "BCD-15", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04", "CHG-04.1", "CLD-01", "CLD-02", "CLD-04", "CLD-06", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-06", "MON-08", "MON-08.2", "MON-08.3", "MON-08.4", "MON-11", "MON-11.3", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.3", "CRY-01.5", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22.1", "DCH-23.4", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-16.5", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IAC-30", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.4", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-04.12", "NET-04.13", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.3", "PRI-05", "PRI-05.1", "PRI-05.5", "PRI-05.6", "PRI-06.1", "PRI-06.3", "PRI-07.1", "PRI-08", "PRI-14", "PRM-04", "PRM-05", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-17", "SEA-20", "OPS-01", "OPS-01.1", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-04", "WEB-14" ] }, { "uuid": "67eb4b45-ce7b-5d71-8b95-b0c14af02d05", "riskNumber": "R-AM-1", "title": "Lost, damaged or stolen asset(s)", "description": "Lost, damaged or stolen assets.", "riskGrouping": "Asset Management", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-04.1", "GOV-04.2", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-01", "AST-01.1", "AST-02.5", "AST-02.7", "AST-02.9", "AST-02.10", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-15", "AST-15.1", "AST-17", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-04.1", "BCD-04.2", "BCD-08", "BCD-09", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-13", "BCD-13.1", "BCD-15", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-07", "CHG-08", "CLD-01", "CLD-02", "CLD-06", "CLD-09", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-06", "MON-08", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.2", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.5", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MDM-04", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.3", "NET-03", "NET-03.1", "NET-03.4", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-08", "NET-08.1", "NET-09", "NET-09.1", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-05", "PRI-05.1", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-17", "SEA-20", "OPS-01", "OPS-01.1", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-05", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.6", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.6", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03" ] }, { "uuid": "76a6fcc3-fe8e-5d3c-95a1-6b4efd9058ec", "riskNumber": "R-AM-2", "title": "Loss of integrity through unauthorized changes", "description": "Unauthorized changes that corrupt the integrity of the system / application / service.", "riskGrouping": "Asset Management", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-04.1", "GOV-04.2", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-01", "AST-01.1", "AST-02", "AST-02.5", "AST-02.8", "AST-02.9", "AST-02.10", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-05", "AST-06", "AST-07", "AST-08", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-04.1", "BCD-04.2", "BCD-11.4", "BCD-11.5", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-13", "BCD-13.1", "BCD-15", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.1", "CHG-04.2", "CHG-06", "CHG-08", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-06", "MON-08", "MON-08.2", "MON-08.3", "MON-08.4", "MON-11", "MON-11.2", "MON-11.3", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.3", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.5", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MDM-04", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.4", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-14", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.3", "PRI-05", "PRI-05.1", "PRI-06.1", "PRI-06.3", "PRI-07.1", "PRI-08", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRM-04", "PRM-05", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-17", "SEA-20", "OPS-01", "OPS-01.1", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-04" ] }, { "uuid": "981203a1-605d-5201-948c-c0b1d477625d", "riskNumber": "R-AM-3", "title": "Emergent properties and/or unintended consequences", "description": "Emergent properties and/or unintended consequences from Artificial Intelligence & Autonomous Technologies (AAT).", "riskGrouping": "Asset Management", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-02.1", "GOV-10", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-02.10", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-04.2", "AST-04.3", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-02.5", "CHG-03", "CHG-04", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-06.1", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-09.1", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.2", "CRY-01.3", "CRY-01.4", "CRY-01.5", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-03.3", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-07.1", "HRS-09.2", "HRS-09.4", "HRS-11", "HRS-12", "HRS-12.1", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-03.5", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.3", "IRO-02.6", "IRO-03", "IRO-04", "IRO-05.1", "IRO-05.2", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10.1", "IRO-11.1", "IRO-12", "IRO-12.4", "IRO-15", "IRO-16", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MDM-01", "MDM-02", "MDM-03", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-04.12", "NET-04.13", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-02.1", "PES-03", "PES-03.3", "PES-03.4", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "SEA-01.1", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-19", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-03.1", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-12", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04" ] }, { "uuid": "5acbd433-7de0-578e-824f-e252a927c909", "riskNumber": "R-BC-1", "title": "Business interruption", "description": "Increased latency, or a service outage, that negatively impact business operations.", "riskGrouping": "Business Continuity", "nistCsfFunction": "Recover", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-04.1", "GOV-04.2", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.5", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-07", "CHG-08", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.2", "MON-08", "MON-11", "MON-11.3", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.3", "CRY-01.4", "CRY-01.5", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.2", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-09.4", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-04", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-04.12", "NET-04.13", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-14", "PES-15", "PES-16", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-08", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-15", "SEA-17", "SEA-20", "OPS-01", "OPS-01.1", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-03.7", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03" ] }, { "uuid": "014e4ef2-7285-5879-8ac3-8c5e0c1b91be", "riskNumber": "R-BC-2", "title": "Data loss / corruption", "description": "The inability to maintain the confidentiality of the data (compromise) or prevent data corruption (loss).", "riskGrouping": "Business Continuity", "nistCsfFunction": "Recover", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-04.1", "GOV-04.2", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.3", "AST-02.5", "AST-02.8", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-04.1", "BCD-04.2", "BCD-07", "BCD-08", "BCD-09", "BCD-11.4", "BCD-11.5", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-13", "BCD-13.1", "BCD-15", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-07", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.2", "MON-08", "MON-08.2", "MON-08.3", "MON-08.4", "MON-11", "MON-11.3", "MON-12", "MON-13", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.3", "CRY-01.4", "CRY-01.5", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-04.12", "NET-04.13", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-15", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.3", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06.1", "PRI-06.3", "PRI-07.1", "PRI-08", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-20", "OPS-01", "OPS-01.1", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-04" ] }, { "uuid": "eafd1815-3797-5b1a-adde-60b495f4785a", "riskNumber": "R-BC-3", "title": "Reduction in productivity", "description": "Diminished user productivity.", "riskGrouping": "Business Continuity", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-02", "AST-02.5", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-05", "AST-06", "AST-07", "AST-08", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-07", "CLD-01", "CLD-02", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-06", "MON-08", "MON-11", "MON-11.3", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01.5", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.7", "NET-04.10", "NET-04.11", "NET-04.12", "NET-04.13", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-06.4", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-15", "PES-16", "PRI-06.1", "PRI-08", "PRI-14", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-06", "SEA-07.1", "SEA-15", "OPS-01", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-03.7", "TDA-01", "TDA-01.1", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.6", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02" ] }, { "uuid": "95af3077-1856-58c7-be7f-2ed7efb04c99", "riskNumber": "R-BC-4", "title": "Information loss / corruption or system compromise due to technical attack", "description": "A technical attack that compromises data, systems, applications or services (e.g., malware, phishing, hacking, etc.).", "riskGrouping": "Business Continuity", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.7", "AST-02.8", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-04.1", "BCD-04.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-04.2", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-07", "CHG-08", "CLD-01", "CLD-02", "CLD-04", "CLD-06", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-06", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-11", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "MON-19", "CRY-01", "CRY-01.1", "CRY-01.5", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.2", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-16.5", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IAC-30", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-09.4", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.8", "NET-04.9", "NET-04.12", "NET-04.13", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-06", "PES-06.1", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-15", "PRI-01", "PRI-05", "PRI-05.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-14", "SEA-14.1", "SEA-14.2", "SEA-15", "SEA-16", "SEA-17", "SEA-20", "OPS-01", "OPS-01.1", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03" ] }, { "uuid": "0e359a9c-e214-5311-86a4-8027dbabc2b6", "riskNumber": "R-BC-5", "title": "Information loss / corruption or system compromise due to non‐technical attack", "description": "A non-technical attack that compromises data, systems, applications or services (e.g., social engineering, sabotage, etc.).", "riskGrouping": "Business Continuity", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-01.2", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-04.1", "BCD-04.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-07", "CLD-01", "CLD-02", "CLD-06", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-06", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-11", "MON-11.3", "MON-12", "MON-13", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.5", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-03.3", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.2", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01.2", "IAC-05.2", "IAC-20.6", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04.3", "MNT-05.1", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.4", "NET-03.5", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.8", "NET-04.9", "NET-04.12", "NET-04.13", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08.1", "NET-09", "NET-09.1", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-05", "PRI-05.1", "PRI-05.5", "PRI-05.6", "PRI-07.1", "PRI-08", "PRI-14", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-13", "SEA-13.1", "SEA-15", "SEA-17", "SEA-20", "OPS-01", "OPS-01.1", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.6", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "THR-08", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-10", "WEB-01", "WEB-01.1", "WEB-04" ] }, { "uuid": "8df3b7c3-7de2-5802-b040-5cca27327bff", "riskNumber": "R-EX-1", "title": "Loss of revenue", "description": "A negative impact on the ability to generate revenue (e.g., a loss of clients or an inability to generate future revenue).", "riskGrouping": "Exposure", "nistCsfFunction": "Recover", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-07", "CLD-01", "CLD-02", "CLD-04", "CLD-06", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-11", "MON-11.3", "MON-12", "MON-13", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-23.3", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-09.4", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-15", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-04", "PRM-05", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-06", "SEA-07.1", "SEA-15", "SEA-18", "SEA-18.1", "SEA-18.2", "OPS-01", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.3", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-04", "WEB-14" ] }, { "uuid": "120799db-498f-509c-8e96-6cf6f0db8f4d", "riskNumber": "R-EX-2", "title": "Cancelled contract", "description": "A cancelled contract with a client or other entity for cause (e.g., failure to fulfill obligations for secure practices).", "riskGrouping": "Exposure", "nistCsfFunction": "Recover", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-03", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-07", "CLD-01", "CLD-02", "CLD-04", "CLD-06", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-11", "MON-11.3", "MON-12", "MON-13", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-23.3", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-04", "PRM-05", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-06", "SEA-07.1", "SEA-15", "SEA-18", "SEA-18.1", "SEA-18.2", "OPS-01", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.3", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-04", "WEB-14" ] }, { "uuid": "934fb573-4342-5431-893e-6156c24e1483", "riskNumber": "R-EX-3", "title": "Diminished competitive advantage", "description": "Diminished competitive advantage (e.g., lose market share, internal dysfunction, etc.).", "riskGrouping": "Exposure", "nistCsfFunction": "Recover", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-06", "AST-07", "AST-08", "AST-09", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-07", "CLD-01", "CLD-02", "CLD-04", "CLD-06", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-11", "MON-11.3", "MON-12", "MON-13", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-04", "PRM-05", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-06", "SEA-07.1", "SEA-15", "SEA-18", "SEA-18.1", "SEA-18.2", "OPS-01", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.3", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-04", "WEB-14" ] }, { "uuid": "209ac40a-ad41-5ee1-ad10-7bee1ead567b", "riskNumber": "R-EX-4", "title": "Diminished reputation", "description": "Diminished brand value (e.g., tarnished reputation).", "riskGrouping": "Exposure", "nistCsfFunction": "Recover", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-03", "AST-04", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-07", "CLD-01", "CLD-02", "CLD-04", "CLD-06", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-11", "MON-11.3", "MON-12", "MON-13", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-09.4", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-04", "PRM-05", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-06", "SEA-07.1", "SEA-15", "SEA-18", "SEA-18.1", "SEA-18.2", "OPS-01", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.3", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-04", "WEB-14" ] }, { "uuid": "cdc0f803-6731-5d4d-9ac9-c1683e97f580", "riskNumber": "R-EX-5", "title": "Fines and judgements", "description": "Financial damages due to fines and/or judgements from statutory / regulatory / contractual non-compliance.", "riskGrouping": "Exposure", "nistCsfFunction": "Recover", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-04", "AST-04.1", "AST-04.2", "AST-04.3", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.4", "BCD-11.5", "BCD-11.6", "BCD-11.7", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-06", "CHG-07", "CLD-01", "CLD-02", "CLD-04", "CLD-06", "CLD-06.1", "CLD-09", "CLD-10", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-11", "MON-11.3", "MON-12", "MON-13", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.2", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-04", "PRM-05", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-06", "SEA-07.1", "SEA-15", "SEA-18", "SEA-18.1", "SEA-18.2", "OPS-01", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.3", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "94b67a60-ffa2-5e2b-870d-83023c6ea49a", "riskNumber": "R-EX-6", "title": "Unmitigated vulnerabilities", "description": "Unmitigated technical vulnerabilities that lack compensating controls or other mitigation actions.", "riskGrouping": "Exposure", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.2", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-12", "AST-13", "AST-14", "AST-16", "AST-17", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-13", "BCD-15", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-06", "CHG-07", "CLD-01", "CLD-02", "CLD-04", "CLD-06", "CLD-09", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-10", "MON-11", "MON-11.3", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "MON-19", "CRY-01", "CRY-01.1", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.2", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-09.4", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-07", "MNT-08", "MNT-09", "MDM-01", "MDM-02", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-08.1", "NET-14.5", "NET-14.6", "NET-14.7", "PES-01.1", "PES-01.2", "PES-06.6", "PES-11", "PES-12", "PES-12.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-07.1", "OPS-01", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-05", "TDA-06", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-14" ] }, { "uuid": "ca1a7fb7-dc97-5cdd-a0aa-2feb5c0b1d1e", "riskNumber": "R-EX-7", "title": "System compromise", "description": "A compromise of a system, application or service that affects confidentiality, integrity, availability and/or safety.", "riskGrouping": "Exposure", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-01", "AST-02.7", "AST-02.8", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-11.4", "BCD-11.5", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-13", "BCD-15", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-04.2", "CHG-06", "CHG-07", "CHG-08", "CLD-01", "CLD-02", "CLD-04", "CLD-06", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-06", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-11", "MON-11.3", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "MON-19", "CRY-01", "CRY-01.1", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.2", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.5", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-16.5", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IAC-30", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-04.7", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-17", "SEA-20", "OPS-01", "OPS-01.1", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-03.7", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-05", "TDA-06", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "b0e54314-ee01-57a8-b592-76f435874f3a", "riskNumber": "R-GV-1", "title": "Inability to support business processes", "description": "Insufficient cybersecurity and/or privacy practices that cannot securely support the organization's technologies & processes.", "riskGrouping": "Governance", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-02", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-04.2", "AST-04.3", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-08", "BCD-08.1", "BCD-08.2", "BCD-09", "BCD-09.1", "BCD-09.2", "BCD-09.3", "BCD-09.4", "BCD-09.5", "BCD-10", "BCD-10.1", "BCD-10.2", "BCD-10.3", "BCD-10.4", "BCD-11", "BCD-11.1", "BCD-11.2", "BCD-11.6", "BCD-11.7", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CAP-05", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-06", "CHG-07", "CLD-01", "CLD-02", "CLD-04", "CLD-06", "CLD-06.1", "CLD-09", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.2", "MON-08", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-10", "MON-11", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.3", "CRY-01.4", "CRY-01.5", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.2", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-03.3", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.5", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-03.4", "IAC-03.5", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-09.6", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-15", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-15", "SEA-17", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-03.7", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.2", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-03", "TDA-03.1", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "04b591a9-028a-52d2-9937-b247f98767e8", "riskNumber": "R-GV-2", "title": "Incorrect controls scoping", "description": "Missing or incorrect cybersecurity and/or privacy controls due to incorrect or inadequate control scoping practices.", "riskGrouping": "Governance", "nistCsfFunction": "Identify", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-11.4", "BCD-11.5", "BCD-11.8", "BCD-11.9", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-07", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-06.1", "CLD-09", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-11", "MON-11.1", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.3", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.3", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-15", "SEA-17", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04" ] }, { "uuid": "bdb9d1db-057c-5f32-b362-e8a29f41a9ff", "riskNumber": "R-GV-3", "title": "Lack of roles & responsibilities", "description": "Insufficient cybersecurity and/or privacy roles & responsibilities that cannot securely support the organization's technologies & processes.", "riskGrouping": "Governance", "nistCsfFunction": "Identify", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-02.4", "AST-02.5", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-12", "AST-13", "AST-14", "AST-16", "AST-17", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-11.8", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-06", "CLD-06.1", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-10", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02.3", "NET-03", "NET-03.1", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08.1", "NET-09", "NET-09.1", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-06", "PES-06.1", "PES-06.3", "PES-06.5", "PES-06.6", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-01.1", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-07.1", "PRI-08", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-07.1", "OPS-01", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-05", "TDA-06", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.6", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02" ] }, { "uuid": "e5934d7e-2fa7-572c-8f02-0468d0d13a76", "riskNumber": "R-GV-4", "title": "Inadequate internal practices", "description": "Insufficient cybersecurity and/or privacy practices that can securely support the organization's technologies & processes.", "riskGrouping": "Governance", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-01", "AST-01.2", "AST-02", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-10.4", "BCD-11.4", "BCD-11.5", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-06", "CHG-07", "CHG-08", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-06.1", "CLD-09", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-07", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "MON-19", "CRY-01", "CRY-01.1", "CRY-01.3", "CRY-01.4", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-03.3", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "EMB-16", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-15", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-03.7", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04", "TDA-04.1", "TDA-04.2", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "607bbfc5-a34a-5097-9860-a3f139289d37", "riskNumber": "R-GV-5", "title": "Inadequate third-party practices", "description": "Insufficient Cybersecurity Supply Chain Risk Management (C-SCRM) practices that cannot securely support the organization's technologies & processes.", "riskGrouping": "Governance", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-19", "AST-02", "AST-02.4", "AST-02.5", "AST-02.8", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-10.4", "BCD-11.4", "BCD-11.5", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-13.1", "BCD-15", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-03", "CLD-04", "CLD-06", "CLD-06.1", "CLD-09", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-01.3", "CRY-01.4", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-03.2", "DCH-04", "DCH-04.1", "DCH-05", "DCH-05.1", "DCH-05.2", "DCH-05.3", "DCH-05.4", "DCH-05.5", "DCH-05.6", "DCH-05.7", "DCH-05.8", "DCH-05.9", "DCH-05.10", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.1", "DCH-22.2", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-23.5", "DCH-23.6", "DCH-23.7", "DCH-23.8", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.3", "NET-03.4", "NET-03.5", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.7", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-11", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.3", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.2", "PRI-05.3", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-05.7", "PRI-06", "PRI-06.1", "PRI-06.2", "PRI-06.3", "PRI-06.4", "PRI-07", "PRI-07.1", "PRI-08", "PRI-09", "PRI-10", "PRI-10.1", "PRI-11", "PRI-13", "PRI-14", "PRI-14.1", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-06", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-11", "SEA-12", "SEA-13", "SEA-13.1", "SEA-15", "SEA-17", "SEA-18", "SEA-18.1", "SEA-18.2", "SEA-20", "OPS-01", "OPS-01.1", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.1", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04" ] }, { "uuid": "cb12d4ec-1af1-592e-9c42-399669c6b395", "riskNumber": "R-GV-6", "title": "Lack of oversight of internal controls", "description": "The inability to demonstrate appropriate evidence of due diligence and due care in overseeing the organization's internal cybersecurity and/or privacy controls.", "riskGrouping": "Governance", "nistCsfFunction": "Identify", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "GOV-19", "AST-02", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-12", "AST-13", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-11.8", "BCD-11.9", "BCD-15", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CHG-08", "CLD-01", "CLD-02", "CLD-06", "CLD-06.1", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-08", "MON-11", "MON-11.3", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "MON-19", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-07", "DCH-07.1", "DCH-09.5", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22.1", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-04.7", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-08.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12.2", "NET-13", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-14", "PES-16", "PRI-01", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.4", "PRI-05.5", "PRI-06.1", "PRI-07.1", "PRI-08", "PRI-14", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-07.1", "SEA-18", "SEA-18.1", "SEA-18.2", "OPS-01", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.2", "TDA-05", "TDA-06", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-04", "WEB-14" ] }, { "uuid": "cbfb3a36-d98e-5784-9973-f7ce962c99af", "riskNumber": "R-GV-7", "title": "Lack of oversight of third-party controls", "description": "The inability to demonstrate appropriate evidence of due diligence and due care in overseeing third-party cybersecurity and/or privacy controls.", "riskGrouping": "Governance", "nistCsfFunction": "Identify", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "GOV-19", "AST-02", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-12", "AST-13", "AST-16", "AST-17", "AST-18", "AST-27", "AST-30", "AST-31", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-11.8", "BCD-11.9", "BCD-15", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-06", "CLD-06.1", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-08", "MON-11", "MON-11.3", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-07", "DCH-07.1", "DCH-09.5", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22.1", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-04.7", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-08.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12.2", "NET-13", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-14", "PES-16", "PRI-01", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.4", "PRI-05.5", "PRI-06.1", "PRI-07.1", "PRI-08", "PRI-14", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-18", "SEA-18.1", "SEA-18.2", "OPS-01", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.2", "TDA-05", "TDA-06", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-04" ] }, { "uuid": "3d3df608-a30f-5d35-9052-ba809f50a0d1", "riskNumber": "R-GV-8", "title": "Illegal content or abusive action", "description": "Disruptive content or actions that negatively affect business operations (e.g., abusive content, harmful speech, threats of violence, illegal content, etc.).", "riskGrouping": "Governance", "nistCsfFunction": "Identify", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-12", "AST-13", "AST-16", "AST-17", "AST-27", "AST-30", "AST-31", "BCD-11.9", "CHG-06.1", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03.2", "CFG-01", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.17", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-06", "MON-08", "MON-11", "MON-11.3", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "DCH-01", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.5", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-04.2", "IRO-04.3", "IRO-08", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "MDM-01", "MDM-02", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-04.7", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-08.1", "NET-12.2", "NET-13", "NET-14.5", "NET-14.6", "NET-14.8", "NET-15", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-06", "PES-06.1", "PES-06.3", "PES-06.5", "PES-11", "PES-12", "PES-12.1", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-05", "SEA-07.1", "OPS-01", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-05", "TDA-07", "TDA-08", "TDA-09.6", "TDA-11", "TDA-11.1", "TDA-13", "TPM-01", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-04.1", "TPM-04.2", "TPM-05.7", "THR-04", "THR-05", "THR-07", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-10", "WEB-01", "WEB-02", "WEB-14" ] }, { "uuid": "e9b05cd2-e131-5199-8f87-506103884e40", "riskNumber": "R-IR-1", "title": "Inability to investigate / prosecute incidents", "description": "Insufficient incident response practices that prevent the organization from investigating and/or prosecuting incidents (e.g., chain of custody corruption, available sources of evidence, etc.).", "riskGrouping": "Incident Response", "nistCsfFunction": "Respond", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-01", "AST-01.1", "AST-01.2", "AST-02", "AST-02.1", "AST-02.2", "AST-02.4", "AST-02.5", "AST-02.8", "AST-02.9", "AST-02.10", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-10.4", "BCD-11.8", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-13", "BCD-15", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-07", "CHG-08", "CLD-01", "CLD-02", "CLD-06", "CLD-06.1", "CLD-09", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-09.1", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "MON-19", "CRY-01", "CRY-01.1", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.2", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-16.5", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-09.4", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-04", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-04.12", "NET-04.13", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-05", "PRI-05.1", "PRI-05.5", "PRI-05.6", "PRI-07.1", "PRI-08", "PRI-14", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-07", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-13", "SEA-13.1", "SEA-17", "SEA-19", "SEA-20", "OPS-01", "OPS-01.1", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-07", "TDA-08", "TDA-09.6", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "THR-08", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-04", "WEB-14" ] }, { "uuid": "a68fc14e-b880-593a-8f35-d35056b2cac0", "riskNumber": "R-IR-2", "title": "Improper response to incidents", "description": "The inability to appropriately respond to incidents in a timely manner.", "riskGrouping": "Incident Response", "nistCsfFunction": "Respond", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-02.4", "AST-02.5", "AST-02.8", "AST-02.9", "AST-02.10", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-10.4", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-06", "CHG-07", "CLD-01", "CLD-02", "CLD-06", "CLD-06.1", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.2", "MON-08", "MON-09", "MON-09.1", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-14.3", "DCH-22.2", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-16.5", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-09.4", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-06", "MNT-06.1", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.5", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.8", "NET-04.9", "NET-04.12", "NET-04.13", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08.1", "NET-08.2", "NET-09.2", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.3", "PES-06.5", "PES-06.6", "PES-11", "PES-12", "PES-12.1", "PRI-05.5", "PRI-05.6", "PRI-07.1", "PRI-08", "PRI-14", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "OPS-01", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-07", "TDA-08", "TDA-09.6", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-14" ] }, { "uuid": "7cf32a7c-b1fd-5e32-a827-fb5d5f32d4ab", "riskNumber": "R-IR-3", "title": "Ineffective remediation actions", "description": "The inability to ensure incident response actions were correct and/or effective.", "riskGrouping": "Incident Response", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-02", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-02.10", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-12", "AST-13", "AST-14", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-07", "BCD-10.4", "BCD-12.4", "BCD-15", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-06", "CLD-06.1", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-09.1", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.2", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-16.5", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.3", "IRO-02.4", "IRO-02.5", "IRO-02.6", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-09.4", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02.3", "NET-03", "NET-03.1", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.12", "NET-04.13", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-08.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-18.3", "PES-01.1", "PES-01.2", "PES-06.6", "PES-11", "PES-12", "PES-12.1", "PRI-01", "PRI-05", "PRI-05.1", "PRI-08", "PRI-14", "PRI-14.1", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "OPS-01", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-03", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-07", "TDA-08", "TDA-09.6", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-14" ] }, { "uuid": "a3aa3988-e904-561e-a0f1-076b930a2ce5", "riskNumber": "R-IR-4", "title": "Expense associated with managing a loss event", "description": "Financial repercussions from responding to an incident or loss.", "riskGrouping": "Incident Response", "nistCsfFunction": "Respond", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "AST-02.2", "AST-02.4", "AST-02.5", "AST-02.9", "AST-02.10", "AST-02.11", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-10", "AST-11", "AST-12", "AST-13", "AST-14", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.3", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-01.7", "BCD-02", "BCD-02.1", "BCD-02.2", "BCD-02.3", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-08", "BCD-09", "BCD-10.4", "BCD-11.4", "BCD-11.5", "BCD-12", "BCD-12.1", "BCD-12.2", "BCD-12.4", "BCD-13", "BCD-15", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-06", "CHG-07", "CLD-01", "CLD-02", "CLD-06", "CLD-06.1", "CLD-09", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.1", "MON-03.2", "MON-03.3", "MON-03.5", "MON-06", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-08.2", "MON-08.3", "MON-08.4", "MON-09", "MON-09.1", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-01", "CRY-01.1", "CRY-02", "CRY-03", "CRY-04", "CRY-05", "CRY-05.1", "CRY-05.2", "CRY-07", "CRY-08", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-10", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.2", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-16.5", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-09.4", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-03", "MDM-04", "MDM-05", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.4", "NET-03.5", "NET-03.6", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.8", "NET-04.9", "NET-04.12", "NET-04.13", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-01.1", "PRI-01.3", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.5", "PRI-05.6", "PRI-07.1", "PRI-08", "PRI-14", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-01.2", "SEA-01.3", "SEA-02", "SEA-02.2", "SEA-03", "SEA-03.1", "SEA-03.2", "SEA-04", "SEA-04.1", "SEA-04.2", "SEA-04.3", "SEA-05", "SEA-07", "SEA-07.1", "SEA-07.2", "SEA-07.3", "SEA-08", "SEA-08.1", "SEA-09", "SEA-10", "SEA-13", "SEA-13.1", "SEA-17", "SEA-20", "OPS-01", "OPS-01.1", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-04", "WEB-14" ] }, { "uuid": "3e367442-0728-549d-9920-1bdcad498f08", "riskNumber": "R-SA-1", "title": "Inability to maintain situational awareness", "description": "The inability to detect cybersecurity and/or privacy incidents (e.g., a lack of situational awareness).", "riskGrouping": "Situational Awareness", "nistCsfFunction": "Detect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-06", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-01", "AST-01.1", "AST-02.1", "AST-02.2", "AST-02.4", "AST-02.5", "AST-02.7", "AST-02.8", "AST-02.9", "AST-02.10", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-04.2", "AST-04.3", "AST-05", "AST-06", "AST-07", "AST-08", "AST-12", "AST-13", "AST-15", "AST-15.1", "AST-16", "AST-17", "AST-18", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-01", "BCD-01.1", "BCD-01.2", "BCD-01.4", "BCD-01.5", "BCD-01.6", "BCD-01.7", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-04.1", "BCD-04.2", "BCD-05", "BCD-06", "BCD-06.1", "BCD-06.2", "BCD-10.4", "CAP-01", "CAP-02", "CAP-03", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-06", "CHG-07", "CLD-01", "CLD-02", "CLD-06", "CLD-06.1", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.2", "MON-07", "MON-07.1", "MON-08", "MON-08.1", "MON-09", "MON-09.1", "MON-10", "MON-11", "MON-11.1", "MON-11.2", "MON-11.3", "MON-12", "MON-13", "MON-14", "MON-14.1", "MON-15", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "MON-19", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-06", "DCH-06.1", "DCH-06.2", "DCH-06.3", "DCH-06.4", "DCH-07", "DCH-07.1", "DCH-07.2", "DCH-08", "DCH-09", "DCH-09.1", "DCH-09.2", "DCH-09.3", "DCH-09.4", "DCH-09.5", "DCH-10", "DCH-10.1", "DCH-10.2", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.1", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-16", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22", "DCH-22.2", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-03", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-16", "END-16.1", "HRS-01.1", "HRS-02.1", "HRS-02.2", "HRS-04.1", "HRS-04.3", "HRS-05.7", "HRS-07.1", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-09.3", "IRO-09.4", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-05.1", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.3", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-06.2", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-04", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.2", "NET-03.5", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.2", "NET-04.3", "NET-04.4", "NET-04.5", "NET-04.6", "NET-04.8", "NET-04.9", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-07", "NET-08", "NET-08.1", "NET-08.2", "NET-09", "NET-09.1", "NET-09.2", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12", "NET-12.1", "NET-12.2", "NET-13", "NET-14", "NET-14.1", "NET-14.2", "NET-14.3", "NET-14.4", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.1", "NET-15.2", "NET-15.3", "NET-15.4", "NET-17", "NET-18", "NET-18.1", "NET-18.2", "NET-18.3", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-05.1", "PES-05.2", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.4", "PES-06.5", "PES-06.6", "PES-07", "PES-07.1", "PES-07.2", "PES-07.3", "PES-07.4", "PES-07.5", "PES-07.6", "PES-07.7", "PES-08", "PES-08.1", "PES-08.2", "PES-08.3", "PES-09", "PES-09.1", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-13", "PES-14", "PES-16", "PRI-01", "PRI-01.3", "PRI-05", "PRI-05.1", "PRI-05.4", "PRI-05.5", "PRI-05.6", "PRI-07.1", "PRI-08", "PRI-14", "PRI-14.1", "PRM-04", "PRM-05", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.1", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-19", "OPS-01", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04", "TDA-04.1", "TDA-05", "TDA-05.1", "TDA-05.2", "TDA-06", "TDA-06.1", "TDA-06.2", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-06", "THR-07", "THR-08", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.4", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-06.8", "VPM-06.9", "VPM-07", "VPM-07.1", "VPM-08", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-03", "WEB-14" ] }, { "uuid": "c2cf129c-e080-5b44-9027-32c11f281cc3", "riskNumber": "R-SA-2", "title": "Lack of a security-minded workforce", "description": "The inability to appropriately educate and train personnel to foster a security-minded workforce.", "riskGrouping": "Situational Awareness", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-07", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "AST-03", "AST-04", "AST-05", "AST-12", "AST-13", "AST-16", "AST-24", "AST-25", "AST-27", "AST-30", "AST-31", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "CPL-01", "CPL-01.1", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03.2", "CFG-03.3", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.2", "CFG-06", "CFG-06.1", "MON-01.15", "MON-11.3", "MON-17", "DCH-01", "DCH-01.1", "DCH-02", "DCH-03", "DCH-03.1", "DCH-07", "DCH-07.1", "DCH-14.3", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-08.1", "END-13.2", "END-13.3", "END-14.1", "END-14.2", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-05.2", "IAC-16", "IAC-18", "IAC-19", "IRO-01", "IRO-02", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10.4", "IRO-10.5", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "MNT-05.2", "MNT-06", "MNT-06.1", "MDM-01", "MDM-02", "MDM-06", "MDM-07", "NET-12.2", "NET-13", "NET-14.5", "NET-15.3", "PES-01", "PES-06", "PES-06.1", "PES-06.3", "PES-06.5", "PRI-01", "PRI-01.3", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.4", "PRI-08", "PRI-14", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-18", "SEA-18.1", "SEA-18.2", "OPS-01", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-03.7", "TDA-01", "TDA-02.3", "TDA-02.4", "TDA-05", "TDA-06", "TDA-07", "TDA-08", "TDA-10", "TDA-11.1", "TPM-01", "THR-01", "THR-04", "THR-05", "THR-07", "THR-09", "THR-10", "VPM-03.1", "VPM-10" ] }, { "uuid": "2097a199-5193-51c6-86e5-1b9d36df61eb", "riskNumber": "R-SC-1", "title": "Third-party cybersecurity exposure", "description": "Loss of Confidentiality, Integrity, Availability and/or Safety (CIAS) from third-party cybersecurity practices, vulnerabilities and/or incidents that affects the supply chain through impacted products and/or services.", "riskGrouping": "Supply Chain", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "GOV-19", "AST-02", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-12", "AST-13", "AST-16", "AST-17", "AST-18", "AST-27", "AST-30", "AST-31", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-11.8", "BCD-11.9", "BCD-15", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-06", "CLD-06.1", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-08", "MON-11", "MON-11.3", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-07", "DCH-07.1", "DCH-09.5", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22.1", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-04.7", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-08.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12.2", "NET-13", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-14", "PES-16", "PRI-01", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.4", "PRI-05.5", "PRI-06.1", "PRI-07.1", "PRI-08", "PRI-14", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-18", "SEA-18.1", "SEA-18.2", "OPS-01", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.2", "TDA-05", "TDA-06", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-04" ] }, { "uuid": "b7faa67e-6732-5ad8-b297-64acaaefe39e", "riskNumber": "R-SC-2", "title": "Third-party physical security exposure", "description": "Loss of Confidentiality, Integrity, Availability and/or Safety (CIAS) from physical security exposure of third-party structures, facilities and/or other physical assets that affects the supply chain through impacted products and/or services.", "riskGrouping": "Supply Chain", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "GOV-19", "AST-02", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-12", "AST-13", "AST-16", "AST-17", "AST-18", "AST-27", "AST-30", "AST-31", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-11.8", "BCD-11.9", "BCD-15", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-06", "CLD-06.1", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-08", "MON-11", "MON-11.3", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-07", "DCH-07.1", "DCH-09.5", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22.1", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-04.7", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-08.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12.2", "NET-13", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-14", "PES-16", "PRI-01", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.4", "PRI-05.5", "PRI-06.1", "PRI-07.1", "PRI-08", "PRI-14", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-18", "SEA-18.1", "SEA-18.2", "OPS-01", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.2", "TDA-05", "TDA-06", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-04" ] }, { "uuid": "8bd81312-6e0f-5f5e-bd1f-88e573d66c1e", "riskNumber": "R-SC-3", "title": "Third-party supply chain relationships, visibility and controls", "description": "Loss of Confidentiality, Integrity, Availability and/or Safety (CIAS) from \"downstream\" third-party relationships, visibility and controls that affect the supply chain through impacted products and/or services.", "riskGrouping": "Supply Chain", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "GOV-19", "AST-02", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-12", "AST-13", "AST-16", "AST-17", "AST-18", "AST-27", "AST-30", "AST-31", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-11.8", "BCD-11.9", "BCD-15", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-06", "CLD-06.1", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-08", "MON-11", "MON-11.3", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-07", "DCH-07.1", "DCH-09.5", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22.1", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-04.7", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-08.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12.2", "NET-13", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-14", "PES-16", "PRI-01", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.4", "PRI-05.5", "PRI-06.1", "PRI-07.1", "PRI-08", "PRI-14", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-18", "SEA-18.1", "SEA-18.2", "OPS-01", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.2", "TDA-05", "TDA-06", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-04" ] }, { "uuid": "97454e9f-0b65-5d69-bfac-41756fd3999a", "riskNumber": "R-SC-4", "title": "Third-party compliance / legal exposure", "description": "The inability to maintain compliance due to third-party non-compliance, criminal acts, or other relevant legal action(s).", "riskGrouping": "Supply Chain", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "GOV-19", "AST-02", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-12", "AST-13", "AST-16", "AST-17", "AST-18", "AST-27", "AST-30", "AST-31", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-11.8", "BCD-11.9", "BCD-15", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-06", "CLD-06.1", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-08", "MON-11", "MON-11.3", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-07", "DCH-07.1", "DCH-09.5", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22.1", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-04.7", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-08.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12.2", "NET-13", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-14", "PES-16", "PRI-01", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.4", "PRI-05.5", "PRI-06.1", "PRI-07.1", "PRI-08", "PRI-14", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-18", "SEA-18.1", "SEA-18.2", "OPS-01", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.2", "TDA-05", "TDA-06", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-04" ] }, { "uuid": "8690d06f-893b-51ed-9647-af0e319b52b4", "riskNumber": "R-SC-5", "title": "Use of product / service", "description": "The misuse of the product / service in a manner that it was not designed or how it was approved for use.", "riskGrouping": "Supply Chain", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "GOV-19", "AST-02", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-12", "AST-13", "AST-16", "AST-17", "AST-18", "AST-27", "AST-30", "AST-31", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-11.8", "BCD-11.9", "BCD-15", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-06", "CLD-06.1", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-08", "MON-11", "MON-11.3", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-07", "DCH-07.1", "DCH-09.5", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22.1", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-04.7", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-08.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12.2", "NET-13", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-14", "PES-16", "PRI-01", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.4", "PRI-05.5", "PRI-06.1", "PRI-07.1", "PRI-08", "PRI-14", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-18", "SEA-18.1", "SEA-18.2", "OPS-01", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.2", "TDA-05", "TDA-06", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-04" ] }, { "uuid": "63cc58b3-245f-576e-a936-19e5bac07fb2", "riskNumber": "R-SC-6", "title": "Reliance on the third-party", "description": "The inability to continue business operations, due to the reliance on the third-party product and/or service.", "riskGrouping": "Supply Chain", "nistCsfFunction": "Protect", "threatGrouping": "Man-Made Threat, Natural Threat", "threatDescription": "NT-1: Drought & Water Shortage; NT-10: Thunderstorms & Lightning; NT-11: Tornadoes; NT-12: Tsunamis; NT-13: Volcanoes; NT-14: Winter Storms & Extreme Cold; NT-2: Earthquakes; NT-3: Fire & Wildfires; NT-4: Floods; NT-5: Hurricanes & Tropical Storms; NT-6: Landslides & Debris Flow; NT-7: Pandemic (Disease) Outbreaks; NT-8: Severe Weather; NT-9: Space Weather; MT-1: Civil or Political Unrest; MT-10: Technical / Mechanical Failure; MT-11: Statutory / Regulatory / Contractual Obligation; MT-12: Redundant, Obsolete/Outdated, Toxic or Trivial (ROTT) Data; MT-13: Artificial Intelligence & Autonomous Technologies (AAT); MT-14: Fraud, Corruption and/or Willful Criminal Conduct; MT-15: Conflict of Interest (COI); MT-16: Macroeconomics; MT-17: Foreign Ownership, Control, or Influence (FOCI); MT-18: Geopolitical; MT-19: Sanctions; MT-2: Technology & Cybersecurity; MT-20: Counterfeit / Non-Conforming Products; MT-21: Operational Environment; MT-22: Manufacturing & Supply; MT-23: Product Quality & Design; MT-24: Financial; MT-25: Human Capital; MT-26: Transportation & Distribution; MT-27: Infrastructure; MT-3: Hazardous Materials Emergencies; MT-4: Nuclear, Biological and Chemical (NBC) Weapons; MT-5: Physical Crime; MT-6: Terrorism & Armed Attacks; MT-7: Utility Service Disruption; MT-8: Dysfunctional Management Practices; MT-9: Human Error", "threatNumbers": "NT-1,NT-10,NT-11,NT-12,NT-13,NT-14,NT-2,NT-3,NT-4,NT-5,NT-6,NT-7,NT-8,NT-9,MT-1,MT-10,MT-11,MT-12,MT-13,MT-14,MT-15,MT-16,MT-17,MT-18,MT-19,MT-2,MT-20,MT-21,MT-22,MT-23,MT-24,MT-25,MT-26,MT-27,MT-3,MT-4,MT-5,MT-6,MT-7,MT-8,MT-9", "controlMappings": [ "GOV-01", "GOV-01.1", "GOV-01.2", "GOV-02", "GOV-02.1", "GOV-03", "GOV-04", "GOV-04.1", "GOV-04.2", "GOV-05", "GOV-05.2", "GOV-07", "GOV-08", "GOV-09", "GOV-10", "GOV-11", "GOV-15", "GOV-15.1", "GOV-15.2", "GOV-15.3", "GOV-15.4", "GOV-15.5", "GOV-16", "GOV-19", "AST-02", "AST-02.3", "AST-02.4", "AST-02.5", "AST-02.9", "AST-03", "AST-03.1", "AST-03.2", "AST-04", "AST-04.1", "AST-05", "AST-06", "AST-07", "AST-08", "AST-09", "AST-12", "AST-13", "AST-16", "AST-17", "AST-18", "AST-27", "AST-30", "AST-31", "BCD-03", "BCD-03.1", "BCD-03.2", "BCD-04", "BCD-11.8", "BCD-11.9", "BCD-15", "CAP-04", "CHG-01", "CHG-02", "CHG-02.1", "CHG-02.2", "CHG-02.3", "CHG-02.4", "CHG-03", "CHG-04.1", "CHG-04.3", "CHG-04.4", "CHG-04.5", "CHG-05", "CHG-06", "CHG-06.1", "CHG-07", "CLD-01", "CLD-02", "CLD-06", "CLD-06.1", "CPL-01", "CPL-01.1", "CPL-01.2", "CPL-01.3", "CPL-01.4", "CPL-01.5", "CPL-02", "CPL-02.1", "CPL-03", "CPL-03.1", "CPL-03.2", "CPL-04", "CFG-01", "CFG-01.1", "CFG-02", "CFG-02.1", "CFG-02.2", "CFG-02.3", "CFG-02.4", "CFG-02.5", "CFG-02.7", "CFG-02.8", "CFG-02.9", "CFG-03", "CFG-03.1", "CFG-03.2", "CFG-03.3", "CFG-03.4", "CFG-04", "CFG-04.1", "CFG-05", "CFG-05.1", "CFG-05.2", "CFG-06", "CFG-06.1", "CFG-08", "CFG-08.1", "MON-01", "MON-01.1", "MON-01.2", "MON-01.3", "MON-01.4", "MON-01.5", "MON-01.6", "MON-01.7", "MON-01.8", "MON-01.11", "MON-01.12", "MON-01.13", "MON-01.14", "MON-01.15", "MON-01.16", "MON-01.17", "MON-02", "MON-02.1", "MON-02.2", "MON-02.3", "MON-02.4", "MON-02.5", "MON-02.6", "MON-02.7", "MON-02.8", "MON-03", "MON-03.2", "MON-03.3", "MON-03.6", "MON-04", "MON-05", "MON-05.1", "MON-05.2", "MON-06", "MON-06.1", "MON-06.2", "MON-08", "MON-11", "MON-11.3", "MON-12", "MON-16", "MON-16.1", "MON-16.2", "MON-16.3", "MON-16.4", "MON-17", "CRY-09", "CRY-09.1", "CRY-09.2", "CRY-09.3", "CRY-09.4", "CRY-09.7", "CRY-11", "DCH-01", "DCH-01.1", "DCH-01.3", "DCH-01.4", "DCH-02", "DCH-03", "DCH-03.1", "DCH-07", "DCH-07.1", "DCH-09.5", "DCH-11", "DCH-12", "DCH-13", "DCH-13.1", "DCH-13.2", "DCH-13.3", "DCH-13.4", "DCH-14", "DCH-14.2", "DCH-14.3", "DCH-15", "DCH-17", "DCH-18", "DCH-18.1", "DCH-18.2", "DCH-19", "DCH-21", "DCH-22.1", "DCH-22.3", "DCH-23", "DCH-23.1", "DCH-23.2", "DCH-23.3", "DCH-23.4", "DCH-24", "DCH-24.1", "EMB-01", "EMB-03", "EMB-04", "EMB-05", "EMB-06", "EMB-15", "END-01", "END-02", "END-03", "END-03.1", "END-03.2", "END-04", "END-04.1", "END-04.3", "END-04.4", "END-04.5", "END-04.7", "END-05", "END-06", "END-06.1", "END-06.2", "END-06.3", "END-06.4", "END-06.5", "END-06.6", "END-06.7", "END-07", "END-08", "END-08.1", "END-08.2", "END-09", "END-10", "END-11", "END-12", "END-13", "END-13.1", "END-13.2", "END-13.3", "END-13.4", "END-14", "END-14.1", "END-14.2", "END-14.6", "END-16", "END-16.1", "HRS-01", "HRS-01.1", "HRS-02", "HRS-02.1", "HRS-02.2", "HRS-03", "HRS-03.1", "HRS-03.2", "HRS-04", "HRS-04.1", "HRS-04.2", "HRS-04.3", "HRS-05", "HRS-05.1", "HRS-05.2", "HRS-05.3", "HRS-05.4", "HRS-05.5", "HRS-05.7", "HRS-06", "HRS-06.1", "HRS-06.2", "HRS-07", "HRS-07.1", "HRS-08", "HRS-09", "HRS-09.1", "HRS-09.2", "HRS-09.3", "HRS-09.4", "HRS-10", "HRS-11", "HRS-12", "HRS-12.1", "HRS-13", "IAC-01", "IAC-01.2", "IAC-01.3", "IAC-02", "IAC-02.1", "IAC-02.2", "IAC-02.3", "IAC-02.4", "IAC-03", "IAC-03.1", "IAC-03.2", "IAC-03.3", "IAC-04", "IAC-04.1", "IAC-05", "IAC-05.1", "IAC-05.2", "IAC-06", "IAC-06.1", "IAC-06.2", "IAC-06.3", "IAC-06.4", "IAC-07", "IAC-07.1", "IAC-07.2", "IAC-08", "IAC-09", "IAC-09.1", "IAC-09.2", "IAC-09.3", "IAC-09.4", "IAC-09.5", "IAC-10", "IAC-10.1", "IAC-10.2", "IAC-10.3", "IAC-10.4", "IAC-10.5", "IAC-10.6", "IAC-10.7", "IAC-10.8", "IAC-10.9", "IAC-10.10", "IAC-10.11", "IAC-10.12", "IAC-10.13", "IAC-11", "IAC-12", "IAC-12.1", "IAC-13", "IAC-13.1", "IAC-13.2", "IAC-14", "IAC-15", "IAC-15.1", "IAC-15.2", "IAC-15.3", "IAC-15.4", "IAC-15.5", "IAC-15.6", "IAC-15.7", "IAC-15.8", "IAC-16", "IAC-16.1", "IAC-17", "IAC-18", "IAC-19", "IAC-20", "IAC-20.1", "IAC-20.2", "IAC-20.3", "IAC-20.5", "IAC-20.6", "IAC-21", "IAC-21.1", "IAC-21.2", "IAC-21.3", "IAC-21.4", "IAC-21.5", "IAC-21.6", "IAC-21.7", "IAC-22", "IAC-23", "IAC-24", "IAC-24.1", "IAC-25", "IAC-25.1", "IAC-26", "IAC-27", "IAC-28", "IAC-28.1", "IAC-28.2", "IAC-28.3", "IAC-28.4", "IAC-28.5", "IRO-01", "IRO-02", "IRO-02.1", "IRO-02.2", "IRO-02.4", "IRO-02.5", "IRO-03", "IRO-04", "IRO-04.1", "IRO-04.2", "IRO-04.3", "IRO-05", "IRO-05.1", "IRO-05.2", "IRO-06", "IRO-06.1", "IRO-07", "IRO-08", "IRO-09", "IRO-09.1", "IRO-10", "IRO-10.1", "IRO-10.2", "IRO-10.3", "IRO-10.4", "IRO-10.5", "IRO-11", "IRO-11.1", "IRO-11.2", "IRO-12", "IRO-12.1", "IRO-12.2", "IRO-12.3", "IRO-12.4", "IRO-13", "IRO-14", "IRO-15", "IRO-16", "IAO-01", "IAO-01.1", "IAO-02", "IAO-02.1", "IAO-02.2", "IAO-02.3", "IAO-02.4", "IAO-03", "IAO-03.1", "IAO-03.2", "IAO-04", "IAO-05", "IAO-06", "IAO-07", "MNT-01", "MNT-02", "MNT-02.1", "MNT-03", "MNT-03.1", "MNT-03.2", "MNT-03.3", "MNT-04", "MNT-04.1", "MNT-04.2", "MNT-04.3", "MNT-04.4", "MNT-05", "MNT-05.1", "MNT-05.2", "MNT-05.4", "MNT-05.5", "MNT-05.6", "MNT-05.7", "MNT-06", "MNT-06.1", "MNT-07", "MNT-08", "MNT-09", "MNT-11", "MDM-01", "MDM-02", "MDM-06", "MDM-07", "MDM-11", "NET-01", "NET-01.1", "NET-02", "NET-02.2", "NET-02.3", "NET-03", "NET-03.1", "NET-03.7", "NET-03.8", "NET-04", "NET-04.1", "NET-04.6", "NET-04.7", "NET-04.10", "NET-04.11", "NET-05", "NET-05.1", "NET-05.2", "NET-06", "NET-06.1", "NET-06.3", "NET-06.4", "NET-06.5", "NET-08.1", "NET-10", "NET-10.1", "NET-10.2", "NET-10.4", "NET-12.2", "NET-13", "NET-14.5", "NET-14.6", "NET-14.7", "NET-14.8", "NET-15", "NET-15.3", "NET-15.4", "NET-18", "NET-18.1", "NET-18.2", "PES-01", "PES-01.1", "PES-01.2", "PES-02", "PES-02.1", "PES-02.2", "PES-03", "PES-03.1", "PES-03.2", "PES-03.3", "PES-03.4", "PES-04", "PES-04.1", "PES-05", "PES-06", "PES-06.1", "PES-06.2", "PES-06.3", "PES-06.5", "PES-06.6", "PES-10", "PES-11", "PES-12", "PES-12.1", "PES-12.2", "PES-14", "PES-16", "PRI-01", "PRI-01.2", "PRI-01.3", "PRI-01.6", "PRI-02", "PRI-02.1", "PRI-02.2", "PRI-02.3", "PRI-02.4", "PRI-02.5", "PRI-02.6", "PRI-02.7", "PRI-03", "PRI-03.1", "PRI-03.2", "PRI-03.4", "PRI-04", "PRI-04.1", "PRI-04.5", "PRI-04.6", "PRI-05", "PRI-05.1", "PRI-05.4", "PRI-05.5", "PRI-06.1", "PRI-07.1", "PRI-08", "PRI-14", "PRM-01", "PRM-01.1", "PRM-02", "PRM-03", "PRM-04", "PRM-05", "PRM-06", "PRM-07", "RSK-01", "RSK-01.1", "RSK-01.3", "RSK-01.4", "RSK-01.5", "RSK-02", "RSK-02.1", "RSK-03", "RSK-03.1", "RSK-04", "RSK-04.1", "RSK-04.2", "RSK-05", "RSK-06", "RSK-06.1", "RSK-06.2", "RSK-06.3", "RSK-07", "RSK-08", "RSK-09", "RSK-09.1", "RSK-10", "RSK-11", "RSK-12", "SEA-01", "SEA-01.1", "SEA-02", "SEA-02.2", "SEA-03", "SEA-04.1", "SEA-05", "SEA-18", "SEA-18.1", "SEA-18.2", "OPS-01", "OPS-02", "OPS-03", "OPS-04", "SAT-01", "SAT-01.1", "SAT-02", "SAT-02.1", "SAT-02.2", "SAT-03", "SAT-03.1", "SAT-03.2", "SAT-03.3", "SAT-03.5", "SAT-03.6", "SAT-04", "TDA-01", "TDA-01.1", "TDA-01.2", "TDA-02", "TDA-02.1", "TDA-02.3", "TDA-02.4", "TDA-02.7", "TDA-02.9", "TDA-02.10", "TDA-02.11", "TDA-02.14", "TDA-04.2", "TDA-05", "TDA-06", "TDA-06.3", "TDA-06.5", "TDA-06.6", "TDA-07", "TDA-08", "TDA-09", "TDA-09.1", "TDA-09.2", "TDA-09.3", "TDA-09.5", "TDA-09.6", "TDA-09.7", "TDA-10", "TDA-11", "TDA-11.1", "TDA-12", "TDA-13", "TDA-14", "TDA-14.1", "TDA-14.2", "TDA-15", "TDA-16", "TDA-17", "TDA-17.1", "TDA-18", "TDA-19", "TDA-20", "TDA-20.4", "TPM-01", "TPM-01.1", "TPM-02", "TPM-03", "TPM-03.2", "TPM-03.3", "TPM-03.4", "TPM-04", "TPM-04.1", "TPM-04.2", "TPM-04.3", "TPM-04.4", "TPM-05", "TPM-05.1", "TPM-05.2", "TPM-05.3", "TPM-05.4", "TPM-05.5", "TPM-05.6", "TPM-05.7", "TPM-05.8", "TPM-06", "TPM-08", "TPM-09", "TPM-10", "TPM-11", "THR-01", "THR-02", "THR-03", "THR-03.1", "THR-04", "THR-05", "THR-07", "THR-09", "THR-10", "VPM-01", "VPM-01.1", "VPM-02", "VPM-03", "VPM-03.1", "VPM-04", "VPM-04.3", "VPM-05", "VPM-05.1", "VPM-05.2", "VPM-05.3", "VPM-05.4", "VPM-05.5", "VPM-05.6", "VPM-05.8", "VPM-06", "VPM-06.1", "VPM-06.2", "VPM-06.3", "VPM-06.4", "VPM-06.5", "VPM-07", "VPM-07.1", "VPM-10", "WEB-01", "WEB-01.1", "WEB-02", "WEB-04" ] } ] } }